* [PATCH 4.9 001/130] x86/entry/64: Remove %ebx handling from error_entry/exit
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.9 002/130] ARC: Explicitly add -mmedium-calls to CFLAGS Greg Kroah-Hartman
` (125 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Boris Ostrovsky,
Borislav Petkov, Brian Gerst, Dave Hansen, Denys Vlasenko,
Dominik Brodowski, H. Peter Anvin, Josh Poimboeuf, Juergen Gross,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, xen-devel,
Ingo Molnar, Sarah Newman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
commit b3681dd548d06deb2e1573890829dff4b15abf46 upstream.
error_entry and error_exit communicate the user vs. kernel status of
the frame using %ebx. This is unnecessary -- the information is in
regs->cs. Just use regs->cs.
This makes error_entry simpler and makes error_exit more robust.
It also fixes a nasty bug. Before all the Spectre nonsense, the
xen_failsafe_callback entry point returned like this:
ALLOC_PT_GPREGS_ON_STACK
SAVE_C_REGS
SAVE_EXTRA_REGS
ENCODE_FRAME_POINTER
jmp error_exit
And it did not go through error_entry. This was bogus: RBX
contained garbage, and error_exit expected a flag in RBX.
Fortunately, it generally contained *nonzero* garbage, so the
correct code path was used. As part of the Spectre fixes, code was
added to clear RBX to mitigate certain speculation attacks. Now,
depending on kernel configuration, RBX got zeroed and, when running
some Wine workloads, the kernel crashes. This was introduced by:
commit 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
With this patch applied, RBX is no longer needed as a flag, and the
problem goes away.
I suspect that malicious userspace could use this bug to crash the
kernel even without the offending patch applied, though.
[ Historical note: I wrote this patch as a cleanup before I was aware
of the bug it fixed. ]
[ Note to stable maintainers: this should probably get applied to all
kernels. If you're nervous about that, a more conservative fix to
add xorl %ebx,%ebx; incl %ebx before the jump to error_exit should
also fix the problem. ]
Reported-and-tested-by: M. Vefa Bicakci <m.v.b@runbox.com>
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Greg KH <gregkh@linuxfoundation.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Fixes: 3ac6d8c787b8 ("x86/entry/64: Clear registers for exceptions/interrupts, to reduce speculation attack surface")
Link: http://lkml.kernel.org/r/b5010a090d3586b2d6e06c7ad3ec5542d1241c45.1532282627.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sarah Newman <srn@prgmr.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/entry/entry_64.S | 20 ++++----------------
1 file changed, 4 insertions(+), 16 deletions(-)
--- a/arch/x86/entry/entry_64.S
+++ b/arch/x86/entry/entry_64.S
@@ -774,7 +774,7 @@ ENTRY(\sym)
call \do_sym
- jmp error_exit /* %ebx: no swapgs flag */
+ jmp error_exit
.endif
END(\sym)
.endm
@@ -1043,7 +1043,6 @@ END(paranoid_exit)
/*
* Save all registers in pt_regs, and switch gs if needed.
- * Return: EBX=0: came from user mode; EBX=1: otherwise
*/
ENTRY(error_entry)
cld
@@ -1056,7 +1055,6 @@ ENTRY(error_entry)
* the kernel CR3 here.
*/
SWITCH_KERNEL_CR3
- xorl %ebx, %ebx
testb $3, CS+8(%rsp)
jz .Lerror_kernelspace
@@ -1087,7 +1085,6 @@ ENTRY(error_entry)
* for these here too.
*/
.Lerror_kernelspace:
- incl %ebx
leaq native_irq_return_iret(%rip), %rcx
cmpq %rcx, RIP+8(%rsp)
je .Lerror_bad_iret
@@ -1119,28 +1116,19 @@ ENTRY(error_entry)
/*
* Pretend that the exception came from user mode: set up pt_regs
- * as if we faulted immediately after IRET and clear EBX so that
- * error_exit knows that we will be returning to user mode.
+ * as if we faulted immediately after IRET.
*/
mov %rsp, %rdi
call fixup_bad_iret
mov %rax, %rsp
- decl %ebx
jmp .Lerror_entry_from_usermode_after_swapgs
END(error_entry)
-
-/*
- * On entry, EBX is a "return to kernel mode" flag:
- * 1: already in kernel mode, don't need SWAPGS
- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode
- */
ENTRY(error_exit)
- movl %ebx, %eax
DISABLE_INTERRUPTS(CLBR_NONE)
TRACE_IRQS_OFF
- testl %eax, %eax
- jnz retint_kernel
+ testb $3, CS(%rsp)
+ jz retint_kernel
jmp retint_user
END(error_exit)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 002/130] ARC: Explicitly add -mmedium-calls to CFLAGS
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.9 001/130] x86/entry/64: Remove %ebx handling from error_entry/exit Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.9 003/130] usb: dwc3: of-simple: fix use-after-free on remove Greg Kroah-Hartman
` (124 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <abrodkin@synopsys.com>
[ Upstream commit 74c11e300c103af47db5b658fdcf28002421e250 ]
GCC built for arc*-*-linux has "-mmedium-calls" implicitly enabled by default
thus we don't see any problems during Linux kernel compilation.
----------------------------->8------------------------
arc-linux-gcc -mcpu=arc700 -Q --help=target | grep calls
-mlong-calls [disabled]
-mmedium-calls [enabled]
----------------------------->8------------------------
But if we try to use so-called Elf32 toolchain with GCC configured for
arc*-*-elf* then we'd see the following failure:
----------------------------->8------------------------
init/do_mounts.o: In function 'init_rootfs':
do_mounts.c:(.init.text+0x108): relocation truncated to fit: R_ARC_S21W_PCREL
against symbol 'unregister_filesystem' defined in .text section in fs/filesystems.o
arc-elf32-ld: final link failed: Symbol needs debug section which does not exist
make: *** [vmlinux] Error 1
----------------------------->8------------------------
That happens because neither "-mmedium-calls" nor "-mlong-calls" are enabled in
Elf32 GCC:
----------------------------->8------------------------
arc-elf32-gcc -mcpu=arc700 -Q --help=target | grep calls
-mlong-calls [disabled]
-mmedium-calls [disabled]
----------------------------->8------------------------
Now to make it possible to use Elf32 toolchain for building Linux kernel
we're explicitly add "-mmedium-calls" to CFLAGS.
And since we add "-mmedium-calls" to the global CFLAGS there's no point in
having per-file copies thus removing them.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/Makefile | 15 +--------------
1 file changed, 1 insertion(+), 14 deletions(-)
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -18,7 +18,7 @@ endif
KBUILD_DEFCONFIG := nsim_700_defconfig
-cflags-y += -fno-common -pipe -fno-builtin -D__linux__
+cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7
cflags-$(CONFIG_ISA_ARCV2) += -mcpu=archs
@@ -141,16 +141,3 @@ dtbs: scripts
archclean:
$(Q)$(MAKE) $(clean)=$(boot)
-
-# Hacks to enable final link due to absence of link-time branch relexation
-# and gcc choosing optimal(shorter) branches at -O3
-#
-# vineetg Feb 2010: -mlong-calls switched off for overall kernel build
-# However lib/decompress_inflate.o (.init.text) calls
-# zlib_inflate_workspacesize (.text) causing relocation errors.
-# Thus forcing all exten calls in this file to be long calls
-export CFLAGS_decompress_inflate.o = -mmedium-calls
-export CFLAGS_initramfs.o = -mmedium-calls
-ifdef CONFIG_SMP
-export CFLAGS_core.o = -mmedium-calls
-endif
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 003/130] usb: dwc3: of-simple: fix use-after-free on remove
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.9 001/130] x86/entry/64: Remove %ebx handling from error_entry/exit Greg Kroah-Hartman
2018-08-23 7:51 ` [PATCH 4.9 002/130] ARC: Explicitly add -mmedium-calls to CFLAGS Greg Kroah-Hartman
@ 2018-08-23 7:51 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 004/130] netfilter: ipv6: nf_defrag: reduce struct net memory waste Greg Kroah-Hartman
` (123 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:51 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Felipe Balbi, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 896e518883f18e601335908192e33426c1f599a4 ]
The clocks have already been explicitly disabled and put as part of
remove() so the runtime suspend callback must not be run when balancing
the runtime PM usage count before returning.
Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-of-simple.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -132,8 +132,9 @@ static int dwc3_of_simple_remove(struct
of_platform_depopulate(dev);
- pm_runtime_put_sync(dev);
pm_runtime_disable(dev);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_set_suspended(dev);
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 004/130] netfilter: ipv6: nf_defrag: reduce struct net memory waste
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2018-08-23 7:51 ` [PATCH 4.9 003/130] usb: dwc3: of-simple: fix use-after-free on remove Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 005/130] selftests: pstore: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
` (122 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, Pablo Neira Ayuso, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9ce7bc036ae4cfe3393232c86e9e1fea2153c237 ]
It is a waste of memory to use a full "struct netns_sysctl_ipv6"
while only one pointer is really used, considering netns_sysctl_ipv6
keeps growing.
Also, since "struct netns_frags" has cache line alignment,
it is better to move the frags_hdr pointer outside, otherwise
we spend a full cache line for this pointer.
This saves 192 bytes of memory per netns.
Fixes: c038a767cd69 ("ipv6: add a new namespace for nf_conntrack_reasm")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/net_namespace.h | 1 +
include/net/netns/ipv6.h | 1 -
net/ipv6/netfilter/nf_conntrack_reasm.c | 6 +++---
3 files changed, 4 insertions(+), 4 deletions(-)
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -116,6 +116,7 @@ struct net {
#endif
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
struct netns_nf_frag nf_frag;
+ struct ctl_table_header *nf_frag_frags_hdr;
#endif
struct sock *nfnl;
struct sock *nfnl_stash;
--- a/include/net/netns/ipv6.h
+++ b/include/net/netns/ipv6.h
@@ -89,7 +89,6 @@ struct netns_ipv6 {
#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
struct netns_nf_frag {
- struct netns_sysctl_ipv6 sysctl;
struct netns_frags frags;
};
#endif
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -117,7 +117,7 @@ static int nf_ct_frag6_sysctl_register(s
if (hdr == NULL)
goto err_reg;
- net->nf_frag.sysctl.frags_hdr = hdr;
+ net->nf_frag_frags_hdr = hdr;
return 0;
err_reg:
@@ -131,8 +131,8 @@ static void __net_exit nf_ct_frags6_sysc
{
struct ctl_table *table;
- table = net->nf_frag.sysctl.frags_hdr->ctl_table_arg;
- unregister_net_sysctl_table(net->nf_frag.sysctl.frags_hdr);
+ table = net->nf_frag_frags_hdr->ctl_table_arg;
+ unregister_net_sysctl_table(net->nf_frag_frags_hdr);
if (!net_eq(net, &init_net))
kfree(table);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 005/130] selftests: pstore: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 004/130] netfilter: ipv6: nf_defrag: reduce struct net memory waste Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 006/130] selftests: static_keys: " Greg Kroah-Hartman
` (121 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG),
Kees Cook, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 856e7c4b619af622d56b3b454f7bec32a170ac99 ]
When pstore_post_reboot test gets skipped because of unmet dependencies
and/or unsupported configuration, it returns 0 which is treated as a pass
by the Kselftest framework. This leads to false positive result even when
the test could not be run.
Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/pstore/pstore_post_reboot_tests | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/tools/testing/selftests/pstore/pstore_post_reboot_tests
+++ b/tools/testing/selftests/pstore/pstore_post_reboot_tests
@@ -7,13 +7,16 @@
#
# Released under the terms of the GPL v2.
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
. ./common_tests
if [ -e $REBOOT_FLAG ]; then
rm $REBOOT_FLAG
else
prlog "pstore_crash_test has not been executed yet. we skip further tests."
- exit 0
+ exit $ksft_skip
fi
prlog -n "Mounting pstore filesystem ... "
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 006/130] selftests: static_keys: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 005/130] selftests: pstore: return Kselftest Skip code for skipped tests Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 007/130] selftests: user: " Greg Kroah-Hartman
` (120 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 8781578087b8fb8829558bac96c3c24e5ba26f82 ]
When static_keys test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as a fail
by the Kselftest framework. This leads to false negative result even when
the test could not be run.
Change it to return kselftest skip code when a test gets skipped to clearly
report that the test could not be run.
Added an explicit searches for test_static_key_base and test_static_keys
modules and return skip code if they aren't found to differentiate between
the failure to load the module condition and module not found condition.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/static_keys/test_static_keys.sh | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/tools/testing/selftests/static_keys/test_static_keys.sh
+++ b/tools/testing/selftests/static_keys/test_static_keys.sh
@@ -1,6 +1,19 @@
#!/bin/sh
# Runs static keys kernel module tests
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+if ! /sbin/modprobe -q -n test_static_key_base; then
+ echo "static_key: module test_static_key_base is not found [SKIP]"
+ exit $ksft_skip
+fi
+
+if ! /sbin/modprobe -q -n test_static_keys; then
+ echo "static_key: module test_static_keys is not found [SKIP]"
+ exit $ksft_skip
+fi
+
if /sbin/modprobe -q test_static_key_base; then
if /sbin/modprobe -q test_static_keys; then
echo "static_key: ok"
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 007/130] selftests: user: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 006/130] selftests: static_keys: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 008/130] selftests: zram: " Greg Kroah-Hartman
` (119 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit d7d5311d4aa9611fe1a5a851e6f75733237a668a ]
When user test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative result
even when the test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run. Add an explicit check
for module presence and return skip code if module isn't present.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/user/test_user_copy.sh | 7 +++++++
1 file changed, 7 insertions(+)
--- a/tools/testing/selftests/user/test_user_copy.sh
+++ b/tools/testing/selftests/user/test_user_copy.sh
@@ -1,6 +1,13 @@
#!/bin/sh
# Runs copy_to/from_user infrastructure using test_user_copy kernel module
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
+if ! /sbin/modprobe -q -n test_user_copy; then
+ echo "user: module test_user_copy is not found [SKIP]"
+ exit $ksft_skip
+fi
if /sbin/modprobe -q test_user_copy; then
/sbin/modprobe -q -r test_user_copy
echo "user_copy: ok"
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 008/130] selftests: zram: return Kselftest Skip code for skipped tests
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 007/130] selftests: user: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 009/130] selftests: sync: add config fragment for testing sync framework Greg Kroah-Hartman
` (118 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shuah Khan (Samsung OSG), Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Shuah Khan (Samsung OSG)" <shuah@kernel.org>
[ Upstream commit 685814466bf8398192cf855415a0bb2cefc1930e ]
When zram test is skipped because of unmet dependencies and/or
unsupported configuration, it exits with error which is treated as
a fail by the Kselftest framework. This leads to false negative result
even when the test could not be run.
Change it to return kselftest skip code when a test gets skipped to
clearly report that the test could not be run.
Kselftest framework SKIP code is 4 and the framework prints appropriate
messages to indicate that the test is skipped.
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/zram/zram.sh | 5 ++++-
tools/testing/selftests/zram/zram_lib.sh | 5 ++++-
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/tools/testing/selftests/zram/zram.sh
+++ b/tools/testing/selftests/zram/zram.sh
@@ -1,6 +1,9 @@
#!/bin/bash
TCID="zram.sh"
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
. ./zram_lib.sh
run_zram () {
@@ -23,5 +26,5 @@ elif [ -b /dev/zram0 ]; then
else
echo "$TCID : No zram.ko module or /dev/zram0 device file not found"
echo "$TCID : CONFIG_ZRAM is not set"
- exit 1
+ exit $ksft_skip
fi
--- a/tools/testing/selftests/zram/zram_lib.sh
+++ b/tools/testing/selftests/zram/zram_lib.sh
@@ -18,6 +18,9 @@ MODULE=0
dev_makeswap=-1
dev_mounted=-1
+# Kselftest framework requirement - SKIP code is 4.
+ksft_skip=4
+
trap INT
check_prereqs()
@@ -27,7 +30,7 @@ check_prereqs()
if [ $uid -ne 0 ]; then
echo $msg must be run as root >&2
- exit 0
+ exit $ksft_skip
fi
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 009/130] selftests: sync: add config fragment for testing sync framework
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 008/130] selftests: zram: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 010/130] ARM: dts: NSP: Fix i2c controller interrupt type Greg Kroah-Hartman
` (117 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fathi Boudra, Anders Roxell,
Shuah Khan (Samsung OSG),
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fathi Boudra <fathi.boudra@linaro.org>
[ Upstream commit d6a3e55131fcb1e5ca1753f4b6f297a177b2fc91 ]
Unless the software synchronization objects (CONFIG_SW_SYNC) is enabled,
the sync test will be skipped:
TAP version 13
1..0 # Skipped: Sync framework not supported by kernel
Add a config fragment file to be able to run "make kselftest-merge" to
enable relevant configuration required in order to run the sync test.
Signed-off-by: Fathi Boudra <fathi.boudra@linaro.org>
Link: https://lkml.org/lkml/2017/5/5/14
Signed-off-by: Anders Roxell <anders.roxell@linaro.org>
Signed-off-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/sync/config | 4 ++++
1 file changed, 4 insertions(+)
create mode 100644 tools/testing/selftests/sync/config
--- /dev/null
+++ b/tools/testing/selftests/sync/config
@@ -0,0 +1,4 @@
+CONFIG_STAGING=y
+CONFIG_ANDROID=y
+CONFIG_SYNC=y
+CONFIG_SW_SYNC=y
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 010/130] ARM: dts: NSP: Fix i2c controller interrupt type
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 009/130] selftests: sync: add config fragment for testing sync framework Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 011/130] ARM: dts: NSP: Fix PCIe controllers interrupt types Greg Kroah-Hartman
` (116 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit a3e32e78a40017756c71ef6dad429ffe3301126a ]
The i2c controller should use IRQ_TYPE_LEVEL_HIGH instead of
IRQ_TYPE_NONE.
Fixes: 0f9f27a36d09 ("ARM: dts: NSP: Add I2C support to the DT")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-nsp.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -288,7 +288,7 @@
reg = <0x38000 0x50>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 89 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 89 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 011/130] ARM: dts: NSP: Fix PCIe controllers interrupt types
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 010/130] ARM: dts: NSP: Fix i2c controller interrupt type Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 012/130] ARM: dts: Cygnus: Fix I2C controller interrupt type Greg Kroah-Hartman
` (115 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Florian Fainelli, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit 403fde644855bc71318c8db65646383e22653b13 ]
The interrupts for the PCIe controllers should all be of type
IRQ_TYPE_LEVEL_HIGH instead of IRQ_TYPE_NONE.
Fixes: d71eb9412088 ("ARM: dts: NSP: Add MSI support on PCI")
Fixes: 522199029fdc ("ARM: dts: NSP: Fix PCIE DT issue")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-nsp.dtsi | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
--- a/arch/arm/boot/dts/bcm-nsp.dtsi
+++ b/arch/arm/boot/dts/bcm-nsp.dtsi
@@ -375,7 +375,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 131 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <0>;
@@ -397,10 +397,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 127 IRQ_TYPE_NONE>,
- <GIC_SPI 128 IRQ_TYPE_NONE>,
- <GIC_SPI 129 IRQ_TYPE_NONE>,
- <GIC_SPI 130 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 128 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 129 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 130 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
@@ -411,7 +411,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 137 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <1>;
@@ -433,10 +433,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 133 IRQ_TYPE_NONE>,
- <GIC_SPI 134 IRQ_TYPE_NONE>,
- <GIC_SPI 135 IRQ_TYPE_NONE>,
- <GIC_SPI 136 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 133 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 134 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 135 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 136 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
@@ -447,7 +447,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 143 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <2>;
@@ -469,10 +469,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 139 IRQ_TYPE_NONE>,
- <GIC_SPI 140 IRQ_TYPE_NONE>,
- <GIC_SPI 141 IRQ_TYPE_NONE>,
- <GIC_SPI 142 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 139 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 140 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 142 IRQ_TYPE_LEVEL_HIGH>;
brcm,pcie-msi-inten;
};
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 012/130] ARM: dts: Cygnus: Fix I2C controller interrupt type
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 011/130] ARM: dts: NSP: Fix PCIe controllers interrupt types Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 013/130] ARM: dts: Cygnus: Fix PCIe " Greg Kroah-Hartman
` (114 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit 71ca3409703b62b6a092d0d9d13f366c121bc5d3 ]
Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
Cygnus SoC.
Fixes: b51c05a331ff ("ARM: dts: add I2C device nodes for Broadcom Cygnus")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-cygnus.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
@@ -128,7 +128,7 @@
reg = <0x18008000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 85 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
@@ -157,7 +157,7 @@
reg = <0x1800b000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 86 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 013/130] ARM: dts: Cygnus: Fix PCIe controller interrupt type
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 012/130] ARM: dts: Cygnus: Fix I2C controller interrupt type Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 014/130] arm64: dts: ns2: Fix I2C " Greg Kroah-Hartman
` (113 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit 6cb1628ad3506b315cdddd7676db0ff2af378d28 ]
Fix PCIe controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom
Cygnus SoC
Fixes: cd590b50a936 ("ARM: dts: enable PCIe support for Cygnus")
Fixes: f6b889358a82 ("ARM: dts: Enable MSI support for Broadcom Cygnus")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/bcm-cygnus.dtsi | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/arch/arm/boot/dts/bcm-cygnus.dtsi
+++ b/arch/arm/boot/dts/bcm-cygnus.dtsi
@@ -168,7 +168,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 100 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <0>;
@@ -190,10 +190,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 96 IRQ_TYPE_NONE>,
- <GIC_SPI 97 IRQ_TYPE_NONE>,
- <GIC_SPI 98 IRQ_TYPE_NONE>,
- <GIC_SPI 99 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 98 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 99 IRQ_TYPE_LEVEL_HIGH>;
};
};
@@ -203,7 +203,7 @@
#interrupt-cells = <1>;
interrupt-map-mask = <0 0 0 0>;
- interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_NONE>;
+ interrupt-map = <0 0 0 0 &gic GIC_SPI 106 IRQ_TYPE_LEVEL_HIGH>;
linux,pci-domain = <1>;
@@ -225,10 +225,10 @@
compatible = "brcm,iproc-msi";
msi-controller;
interrupt-parent = <&gic>;
- interrupts = <GIC_SPI 102 IRQ_TYPE_NONE>,
- <GIC_SPI 103 IRQ_TYPE_NONE>,
- <GIC_SPI 104 IRQ_TYPE_NONE>,
- <GIC_SPI 105 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>,
+ <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH>;
};
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 014/130] arm64: dts: ns2: Fix I2C controller interrupt type
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 013/130] ARM: dts: Cygnus: Fix PCIe " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 016/130] IB/rxe: Fix missing completion for mem_reg work requests Greg Kroah-Hartman
` (112 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ray Jui, Florian Fainelli, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ray Jui <ray.jui@broadcom.com>
[ Upstream commit e605c287deed45624e8d35a15e3f0b4faab1a62d ]
Fix I2C controller interrupt to use IRQ_TYPE_LEVEL_HIGH for Broadcom NS2
SoC.
Fixes: 7ac674e8df7a ("arm64: dts: Add I2C nodes for NS2")
Signed-off-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/ns2.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/broadcom/ns2.dtsi
+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi
@@ -393,7 +393,7 @@
reg = <0x66080000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 394 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 394 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
@@ -421,7 +421,7 @@
reg = <0x660b0000 0x100>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 395 IRQ_TYPE_NONE>;
+ interrupts = <GIC_SPI 395 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <100000>;
status = "disabled";
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 016/130] IB/rxe: Fix missing completion for mem_reg work requests
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 014/130] arm64: dts: ns2: Fix I2C " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 017/130] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store() Greg Kroah-Hartman
` (111 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vijay Immanuel, Yonatan Cohen,
Jason Gunthorpe, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijay Immanuel <vijayi@attalasystems.com>
[ Upstream commit 375dc53d032fc11e98036b5f228ad13f7c5933f5 ]
Run the completer task to post a work completion after processing
a memory registration or invalidate work request. This covers the
case where the memory registration or invalidate was the last work
request posted to the qp.
Signed-off-by: Vijay Immanuel <vijayi@attalasystems.com>
Reviewed-by: Yonatan Cohen <yonatanc@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/sw/rxe/rxe_req.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/infiniband/sw/rxe/rxe_req.c
+++ b/drivers/infiniband/sw/rxe/rxe_req.c
@@ -648,6 +648,9 @@ next_wqe:
} else {
goto exit;
}
+ if ((wqe->wr.send_flags & IB_SEND_SIGNALED) ||
+ qp->sq_sig_type == IB_SIGNAL_ALL_WR)
+ rxe_run_task(&qp->comp.task, 1);
qp->req.wqe_index = next_index(qp->sq.queue,
qp->req.wqe_index);
goto next_wqe;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 017/130] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 016/130] IB/rxe: Fix missing completion for mem_reg work requests Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 018/130] usb: dwc2: fix isoc split in transfer with no data Greg Kroah-Hartman
` (110 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Garry, Tejun Heo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.garry@huawei.com>
[ Upstream commit fae2a63737e5973f1426bc139935a0f42e232844 ]
Currently smatch warns of possible Spectre-V1 issue in ahci_led_store():
drivers/ata/libahci.c:1150 ahci_led_store() warn: potential spectre issue 'pp->em_priv' (local cap)
Userspace controls @pmp from following callchain:
em_message->store()
->ata_scsi_em_message_store()
-->ap->ops->em_store()
--->ahci_led_store()
After the mask+shift @pmp is effectively an 8b value, which is used to
index into an array of length 8, so sanitize the array index.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libahci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -35,6 +35,7 @@
#include <linux/kernel.h>
#include <linux/gfp.h>
#include <linux/module.h>
+#include <linux/nospec.h>
#include <linux/blkdev.h>
#include <linux/delay.h>
#include <linux/interrupt.h>
@@ -1124,10 +1125,12 @@ static ssize_t ahci_led_store(struct ata
/* get the slot number from the message */
pmp = (state & EM_MSG_LED_PMP_SLOT) >> 8;
- if (pmp < EM_MAX_SLOTS)
+ if (pmp < EM_MAX_SLOTS) {
+ pmp = array_index_nospec(pmp, EM_MAX_SLOTS);
emp = &pp->em_priv[pmp];
- else
+ } else {
return -EINVAL;
+ }
/* mask off the activity bits if we are in sw_activity
* mode, user should turn off sw_activity before setting
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 018/130] usb: dwc2: fix isoc split in transfer with no data
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 017/130] libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 019/130] usb: gadget: composite: fix delayed_status race condition when set_interface Greg Kroah-Hartman
` (109 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gevorg Sahakyan, Heiko Stuebner,
William Wu, Felipe Balbi, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit 70c3c8cb83856758025c2a211dd022bc0478922a ]
If isoc split in transfer with no data (the length of DATA0
packet is zero), we can't simply return immediately. Because
the DATA0 can be the first transaction or the second transaction
for the isoc split in transaction. If the DATA0 packet with no
data is in the first transaction, we can return immediately.
But if the DATA0 packet with no data is in the second transaction
of isoc split in transaction sequence, we need to increase the
qtd->isoc_frame_index and giveback urb to device driver if needed,
otherwise, the MDATA packet will be lost.
A typical test case is that connect the dwc2 controller with an
usb hs Hub (GL852G-12), and plug an usb fs audio device (Plantronics
headset) into the downstream port of Hub. Then use the usb mic
to record, we can find noise when playback.
In the case, the isoc split in transaction sequence like this:
- SSPLIT IN transaction
- CSPLIT IN transaction
- MDATA packet (176 bytes)
- CSPLIT IN transaction
- DATA0 packet (0 byte)
This patch use both the length of DATA0 and qtd->isoc_split_offset
to check if the DATA0 is in the second transaction.
Tested-by: Gevorg Sahakyan <sahakyan@synopsys.com>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Minas Harutyunyan hminas@synopsys.com>
Signed-off-by: William Wu <william.wu@rock-chips.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/hcd_intr.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/dwc2/hcd_intr.c
+++ b/drivers/usb/dwc2/hcd_intr.c
@@ -922,9 +922,8 @@ static int dwc2_xfercomp_isoc_split_in(s
frame_desc = &qtd->urb->iso_descs[qtd->isoc_frame_index];
len = dwc2_get_actual_xfer_length(hsotg, chan, chnum, qtd,
DWC2_HC_XFER_COMPLETE, NULL);
- if (!len) {
+ if (!len && !qtd->isoc_split_offset) {
qtd->complete_split = 0;
- qtd->isoc_split_offset = 0;
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 019/130] usb: gadget: composite: fix delayed_status race condition when set_interface
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 018/130] usb: dwc2: fix isoc split in transfer with no data Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 020/130] usb: gadget: dwc2: fix memory leak in gadget_init() Greg Kroah-Hartman
` (108 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chunfeng Yun, Jay Hsu, Felipe Balbi,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
[ Upstream commit 980900d6318066b9f8314bfb87329a20fd0d1ca4 ]
It happens when enable debug log, if set_alt() returns
USB_GADGET_DELAYED_STATUS and usb_composite_setup_continue()
is called before increasing count of @delayed_status,
so fix it by using spinlock of @cdev->lock.
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Tested-by: Jay Hsu <shih-chieh.hsu@mediatek.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/composite.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1712,6 +1712,8 @@ composite_setup(struct usb_gadget *gadge
*/
if (w_value && !f->get_alt)
break;
+
+ spin_lock(&cdev->lock);
value = f->set_alt(f, w_index, w_value);
if (value == USB_GADGET_DELAYED_STATUS) {
DBG(cdev,
@@ -1721,6 +1723,7 @@ composite_setup(struct usb_gadget *gadge
DBG(cdev, "delayed_status count %d\n",
cdev->delayed_status);
}
+ spin_unlock(&cdev->lock);
break;
case USB_REQ_GET_INTERFACE:
if (ctrl->bRequestType != (USB_DIR_IN|USB_RECIP_INTERFACE))
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 020/130] usb: gadget: dwc2: fix memory leak in gadget_init()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 019/130] usb: gadget: composite: fix delayed_status race condition when set_interface Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 021/130] xen: add error handling for xenbus_printf Greg Kroah-Hartman
` (107 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, Marek Szyprowski,
Minas Harutyunyan, Grigor Tovmasyan, Felipe Balbi, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Grigor Tovmasyan <Grigor.Tovmasyan@synopsys.com>
[ Upstream commit 9bb073a053f0464ea74a4d4c331fdb7da58568d6 ]
Freed allocated request for ep0 to prevent memory leak in case when
dwc2_driver_probe() failed.
Cc: Stefan Wahren <stefan.wahren@i2se.com>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Acked-by: Minas Harutyunyan <hminas@synopsys.com>
Signed-off-by: Grigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc2/gadget.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -3948,9 +3948,11 @@ int dwc2_gadget_init(struct dwc2_hsotg *
}
ret = usb_add_gadget_udc(dev, &hsotg->gadget);
- if (ret)
+ if (ret) {
+ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep,
+ hsotg->ctrl_req);
return ret;
-
+ }
dwc2_hsotg_dump(hsotg);
return 0;
@@ -3963,6 +3965,7 @@ int dwc2_gadget_init(struct dwc2_hsotg *
int dwc2_hsotg_remove(struct dwc2_hsotg *hsotg)
{
usb_del_gadget_udc(&hsotg->gadget);
+ dwc2_hsotg_ep_free_request(&hsotg->eps_out[0]->ep, hsotg->ctrl_req);
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 021/130] xen: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 020/130] usb: gadget: dwc2: fix memory leak in gadget_init() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 022/130] scsi: xen-scsifront: " Greg Kroah-Hartman
` (106 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Boris Ostrovsky,
Juergen Gross, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 84c029a73327cef571eaa61c7d6e67e8031b52ec ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/manage.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -291,8 +291,15 @@ static void sysrq_handler(struct xenbus_
return;
}
- if (sysrq_key != '\0')
- xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+ if (sysrq_key != '\0') {
+ err = xenbus_printf(xbt, "control", "sysrq", "%c", '\0');
+ if (err) {
+ pr_err("%s: Error %d writing sysrq in control/sysrq\n",
+ __func__, err);
+ xenbus_transaction_end(xbt, 1);
+ return;
+ }
+ }
err = xenbus_transaction_end(xbt, 0);
if (err == -EAGAIN)
@@ -344,7 +351,12 @@ static int setup_shutdown_watcher(void)
continue;
snprintf(node, FEATURE_PATH_SIZE, "feature-%s",
shutdown_handlers[idx].command);
- xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+ err = xenbus_printf(XBT_NIL, "control", node, "%u", 1);
+ if (err) {
+ pr_err("%s: Error %d writing %s\n", __func__,
+ err, node);
+ return err;
+ }
}
return 0;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 022/130] scsi: xen-scsifront: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 021/130] xen: add error handling for xenbus_printf Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 023/130] xen/scsiback: " Greg Kroah-Hartman
` (105 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Juergen Gross, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 93efbd39870474cc536b9caf4a6efeb03b0bc56f ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/xen-scsifront.c | 33 ++++++++++++++++++++++++++-------
1 file changed, 26 insertions(+), 7 deletions(-)
--- a/drivers/scsi/xen-scsifront.c
+++ b/drivers/scsi/xen-scsifront.c
@@ -676,10 +676,17 @@ static int scsifront_dev_reset_handler(s
static int scsifront_sdev_configure(struct scsi_device *sdev)
{
struct vscsifrnt_info *info = shost_priv(sdev->host);
+ int err;
- if (info && current == info->curr)
- xenbus_printf(XBT_NIL, info->dev->nodename,
+ if (info && current == info->curr) {
+ err = xenbus_printf(XBT_NIL, info->dev->nodename,
info->dev_state_path, "%d", XenbusStateConnected);
+ if (err) {
+ xenbus_dev_error(info->dev, err,
+ "%s: writing dev_state_path", __func__);
+ return err;
+ }
+ }
return 0;
}
@@ -687,10 +694,15 @@ static int scsifront_sdev_configure(stru
static void scsifront_sdev_destroy(struct scsi_device *sdev)
{
struct vscsifrnt_info *info = shost_priv(sdev->host);
+ int err;
- if (info && current == info->curr)
- xenbus_printf(XBT_NIL, info->dev->nodename,
+ if (info && current == info->curr) {
+ err = xenbus_printf(XBT_NIL, info->dev->nodename,
info->dev_state_path, "%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing dev_state_path", __func__);
+ }
}
static struct scsi_host_template scsifront_sht = {
@@ -1025,9 +1037,12 @@ static void scsifront_do_lun_hotplug(str
if (scsi_add_device(info->host, chn, tgt, lun)) {
dev_err(&dev->dev, "scsi_add_device\n");
- xenbus_printf(XBT_NIL, dev->nodename,
+ err = xenbus_printf(XBT_NIL, dev->nodename,
info->dev_state_path,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(dev, err,
+ "%s: writing dev_state_path", __func__);
}
break;
case VSCSIFRONT_OP_DEL_LUN:
@@ -1041,10 +1056,14 @@ static void scsifront_do_lun_hotplug(str
}
break;
case VSCSIFRONT_OP_READD_LUN:
- if (device_state == XenbusStateConnected)
- xenbus_printf(XBT_NIL, dev->nodename,
+ if (device_state == XenbusStateConnected) {
+ err = xenbus_printf(XBT_NIL, dev->nodename,
info->dev_state_path,
"%d", XenbusStateConnected);
+ if (err)
+ xenbus_dev_error(dev, err,
+ "%s: writing dev_state_path", __func__);
+ }
break;
default:
break;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 023/130] xen/scsiback: add error handling for xenbus_printf
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 022/130] scsi: xen-scsifront: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 024/130] arm64: make secondary_start_kernel() notrace Greg Kroah-Hartman
` (104 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhouyang Jia, Juergen Gross, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhouyang Jia <jiazhouyang09@gmail.com>
[ Upstream commit 7c63ca24c878e0051c91904b72174029320ef4bd ]
When xenbus_printf fails, the lack of error-handling code may
cause unexpected results.
This patch adds error-handling code after calling xenbus_printf.
Signed-off-by: Zhouyang Jia <jiazhouyang09@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-scsiback.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -1014,6 +1014,7 @@ static void scsiback_do_add_lun(struct v
{
struct v2p_entry *entry;
unsigned long flags;
+ int err;
if (try) {
spin_lock_irqsave(&info->v2p_lock, flags);
@@ -1029,8 +1030,11 @@ static void scsiback_do_add_lun(struct v
scsiback_del_translation_entry(info, vir);
}
} else if (!try) {
- xenbus_printf(XBT_NIL, info->dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, info->dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
}
}
@@ -1069,8 +1073,11 @@ static void scsiback_do_1lun_hotplug(str
snprintf(str, sizeof(str), "vscsi-devs/%s/p-dev", ent);
val = xenbus_read(XBT_NIL, dev->nodename, str, NULL);
if (IS_ERR(val)) {
- xenbus_printf(XBT_NIL, dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
return;
}
strlcpy(phy, val, VSCSI_NAMELEN);
@@ -1081,8 +1088,11 @@ static void scsiback_do_1lun_hotplug(str
err = xenbus_scanf(XBT_NIL, dev->nodename, str, "%u:%u:%u:%u",
&vir.hst, &vir.chn, &vir.tgt, &vir.lun);
if (XENBUS_EXIST_ERR(err)) {
- xenbus_printf(XBT_NIL, dev->nodename, state,
+ err = xenbus_printf(XBT_NIL, dev->nodename, state,
"%d", XenbusStateClosed);
+ if (err)
+ xenbus_dev_error(info->dev, err,
+ "%s: writing %s", __func__, state);
return;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 024/130] arm64: make secondary_start_kernel() notrace
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 023/130] xen/scsiback: " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 025/130] qed: Add sanity check for SIMD fastpath handler Greg Kroah-Hartman
` (103 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Suzuki K Poulose,
Zhizhou Zhang, Catalin Marinas, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
[ Upstream commit b154886f7892499d0d3054026e19dfb9a731df61 ]
We can't call function trace hook before setup percpu offset.
When entering secondary_start_kernel(), percpu offset has not
been initialized. So this lead hotplug malfunction.
Here is the flow to reproduce this bug:
echo 0 > /sys/devices/system/cpu/cpu1/online
echo function > /sys/kernel/debug/tracing/current_tracer
echo 1 > /sys/kernel/debug/tracing/tracing_on
echo 1 > /sys/devices/system/cpu/cpu1/online
Acked-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Zhizhou Zhang <zhizhouzhang@asrmicro.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/smp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -205,7 +205,7 @@ int __cpu_up(unsigned int cpu, struct ta
* This is the secondary CPU boot entry. We're using this CPUs
* idle thread stack, but a set of temporary page tables.
*/
-asmlinkage void secondary_start_kernel(void)
+asmlinkage notrace void secondary_start_kernel(void)
{
struct mm_struct *mm = &init_mm;
unsigned int cpu = smp_processor_id();
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 025/130] qed: Add sanity check for SIMD fastpath handler.
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 024/130] arm64: make secondary_start_kernel() notrace Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 026/130] enic: initialize enic->rfs_h.lock in enic_probe Greg Kroah-Hartman
` (102 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
Michal Kalderon, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit 3935a70968820c3994db4de7e6e1c7e814bff875 ]
Avoid calling a SIMD fastpath handler if it is NULL. The check is needed
to handle an unlikely scenario where unsolicited interrupt is destined to
a PF in INTa mode.
Fixes: fe56b9e6a ("qed: Add module with basic common support")
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qed/qed_main.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qed/qed_main.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
@@ -502,8 +502,16 @@ static irqreturn_t qed_single_int(int ir
/* Fastpath interrupts */
for (j = 0; j < 64; j++) {
if ((0x2ULL << j) & status) {
- hwfn->simd_proto_handler[j].func(
- hwfn->simd_proto_handler[j].token);
+ struct qed_simd_fp_handler *p_handler =
+ &hwfn->simd_proto_handler[j];
+
+ if (p_handler->func)
+ p_handler->func(p_handler->token);
+ else
+ DP_NOTICE(hwfn,
+ "Not calling fastpath handler as it is NULL [handler #%d, status 0x%llx]\n",
+ j, status);
+
status &= ~(0x2ULL << j);
rc = IRQ_HANDLED;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 026/130] enic: initialize enic->rfs_h.lock in enic_probe
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 025/130] qed: Add sanity check for SIMD fastpath handler Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 027/130] net: hamradio: use eth_broadcast_addr Greg Kroah-Hartman
` (101 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Govindarajulu Varadarajan,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Govindarajulu Varadarajan <gvaradar@cisco.com>
[ Upstream commit 3256d29fc7aecdf99feb1cb9475ed2252769a8a7 ]
lockdep spotted that we are using rfs_h.lock in enic_get_rxnfc() without
initializing. rfs_h.lock is initialized in enic_open(). But ethtool_ops
can be called when interface is down.
Move enic_rfs_flw_tbl_init to enic_probe.
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 18 PID: 1189 Comm: ethtool Not tainted 4.17.0-rc7-devel+ #27
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
Call Trace:
dump_stack+0x85/0xc0
register_lock_class+0x550/0x560
? __handle_mm_fault+0xa8b/0x1100
__lock_acquire+0x81/0x670
lock_acquire+0xb9/0x1e0
? enic_get_rxnfc+0x139/0x2b0 [enic]
_raw_spin_lock_bh+0x38/0x80
? enic_get_rxnfc+0x139/0x2b0 [enic]
enic_get_rxnfc+0x139/0x2b0 [enic]
ethtool_get_rxnfc+0x8d/0x1c0
dev_ethtool+0x16c8/0x2400
? __mutex_lock+0x64d/0xa00
? dev_load+0x6a/0x150
dev_ioctl+0x253/0x4b0
sock_do_ioctl+0x9a/0x130
sock_ioctl+0x1af/0x350
do_vfs_ioctl+0x8e/0x670
? syscall_trace_enter+0x1e2/0x380
ksys_ioctl+0x60/0x90
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x5a/0x170
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Signed-off-by: Govindarajulu Varadarajan <gvaradar@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/cisco/enic/enic_clsf.c | 3 +--
drivers/net/ethernet/cisco/enic/enic_main.c | 3 ++-
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -78,7 +78,6 @@ void enic_rfs_flw_tbl_init(struct enic *
enic->rfs_h.max = enic->config.num_arfs;
enic->rfs_h.free = enic->rfs_h.max;
enic->rfs_h.toclean = 0;
- enic_rfs_timer_start(enic);
}
void enic_rfs_flw_tbl_free(struct enic *enic)
@@ -87,7 +86,6 @@ void enic_rfs_flw_tbl_free(struct enic *
enic_rfs_timer_stop(enic);
spin_lock_bh(&enic->rfs_h.lock);
- enic->rfs_h.free = 0;
for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
struct hlist_head *hhead;
struct hlist_node *tmp;
@@ -98,6 +96,7 @@ void enic_rfs_flw_tbl_free(struct enic *
enic_delfltr(enic, n->fltr_id);
hlist_del(&n->node);
kfree(n);
+ enic->rfs_h.free++;
}
}
spin_unlock_bh(&enic->rfs_h.lock);
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -1760,7 +1760,7 @@ static int enic_open(struct net_device *
vnic_intr_unmask(&enic->intr[i]);
enic_notify_timer_start(enic);
- enic_rfs_flw_tbl_init(enic);
+ enic_rfs_timer_start(enic);
return 0;
@@ -2692,6 +2692,7 @@ static int enic_probe(struct pci_dev *pd
enic->notify_timer.function = enic_notify_timer;
enic->notify_timer.data = (unsigned long)enic;
+ enic_rfs_flw_tbl_init(enic);
enic_set_rx_coal_setting(enic);
INIT_WORK(&enic->reset, enic_reset);
INIT_WORK(&enic->tx_hang_reset, enic_tx_hang_reset);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 027/130] net: hamradio: use eth_broadcast_addr
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 026/130] enic: initialize enic->rfs_h.lock in enic_probe Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 028/130] net: propagate dev_get_valid_name return code Greg Kroah-Hartman
` (100 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <stefan@agner.ch>
[ Upstream commit 4e8439aa34802deab11cee68b0ecb18f887fb153 ]
The array bpq_eth_addr is only used to get the size of an
address, whereas the bcast_addr is used to set the broadcast
address. This leads to a warning when using clang:
drivers/net/hamradio/bpqether.c:94:13: warning: variable 'bpq_eth_addr' is not
needed and will not be emitted [-Wunneeded-internal-declaration]
static char bpq_eth_addr[6];
^
Remove both variables and use the common eth_broadcast_addr
to set the broadcast address.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/hamradio/bpqether.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/net/hamradio/bpqether.c
+++ b/drivers/net/hamradio/bpqether.c
@@ -89,10 +89,6 @@
static const char banner[] __initconst = KERN_INFO \
"AX.25: bpqether driver version 004\n";
-static char bcast_addr[6]={0xFF,0xFF,0xFF,0xFF,0xFF,0xFF};
-
-static char bpq_eth_addr[6];
-
static int bpq_rcv(struct sk_buff *, struct net_device *, struct packet_type *, struct net_device *);
static int bpq_device_event(struct notifier_block *, unsigned long, void *);
@@ -515,8 +511,8 @@ static int bpq_new_device(struct net_dev
bpq->ethdev = edev;
bpq->axdev = ndev;
- memcpy(bpq->dest_addr, bcast_addr, sizeof(bpq_eth_addr));
- memcpy(bpq->acpt_addr, bcast_addr, sizeof(bpq_eth_addr));
+ eth_broadcast_addr(bpq->dest_addr);
+ eth_broadcast_addr(bpq->acpt_addr);
err = register_netdevice(ndev);
if (err)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 028/130] net: propagate dev_get_valid_name return code
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 027/130] net: hamradio: use eth_broadcast_addr Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 029/130] net: stmmac: socfpga: add additional ocp reset line for Stratix10 Greg Kroah-Hartman
` (99 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Li RongQing, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 7892bd081045222b9e4027fec279a28d6fe7aa66 ]
if dev_get_valid_name failed, propagate its return code
and remove the setting err to ENODEV, it will be set to
0 again before dev_change_net_namespace exits.
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7945,7 +7945,8 @@ int dev_change_net_namespace(struct net_
/* We get here if we can't use the current device name */
if (!pat)
goto out;
- if (dev_get_valid_name(net, dev, pat) < 0)
+ err = dev_get_valid_name(net, dev, pat);
+ if (err < 0)
goto out;
}
@@ -7957,7 +7958,6 @@ int dev_change_net_namespace(struct net_
dev_close(dev);
/* And unlink it from device chain */
- err = -ENODEV;
unlist_netdevice(dev);
synchronize_net();
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 029/130] net: stmmac: socfpga: add additional ocp reset line for Stratix10
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 028/130] net: propagate dev_get_valid_name return code Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 030/130] nvmet: reset keep alive timer in controller enable Greg Kroah-Hartman
` (98 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dinh Nguyen, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinh Nguyen <dinguyen@kernel.org>
[ Upstream commit bc8a2d9bcbf1ca548b1deb315d14e1da81945bea ]
The Stratix10 platform has an additional reset line, OCP(Open Core Protocol),
that also needs to get deasserted for the stmmac ethernet controller to work.
Thus we need to update the Kconfig to include ARCH_STRATIX10 in order to build
dwmac-socfpga.
Also, remove the redundant check for the reset controller pointer. The
reset driver already checks for the pointer and returns 0 if the pointer
is NULL.
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/Kconfig | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 18 ++++++++++++++----
2 files changed, 15 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -83,7 +83,7 @@ config DWMAC_ROCKCHIP
config DWMAC_SOCFPGA
tristate "SOCFPGA dwmac support"
default ARCH_SOCFPGA
- depends on OF && (ARCH_SOCFPGA || COMPILE_TEST)
+ depends on OF && (ARCH_SOCFPGA || ARCH_STRATIX10 || COMPILE_TEST)
select MFD_SYSCON
help
Support for ethernet controller on Altera SOCFPGA
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c
@@ -55,6 +55,7 @@ struct socfpga_dwmac {
struct device *dev;
struct regmap *sys_mgr_base_addr;
struct reset_control *stmmac_rst;
+ struct reset_control *stmmac_ocp_rst;
void __iomem *splitter_base;
bool f2h_ptp_ref_clk;
struct tse_pcs pcs;
@@ -262,8 +263,8 @@ static int socfpga_dwmac_set_phy_mode(st
val = SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII;
/* Assert reset to the enet controller before changing the phy mode */
- if (dwmac->stmmac_rst)
- reset_control_assert(dwmac->stmmac_rst);
+ reset_control_assert(dwmac->stmmac_ocp_rst);
+ reset_control_assert(dwmac->stmmac_rst);
regmap_read(sys_mgr_base_addr, reg_offset, &ctrl);
ctrl &= ~(SYSMGR_EMACGRP_CTRL_PHYSEL_MASK << reg_shift);
@@ -285,8 +286,8 @@ static int socfpga_dwmac_set_phy_mode(st
/* Deassert reset for the phy configuration to be sampled by
* the enet controller, and operation to start in requested mode
*/
- if (dwmac->stmmac_rst)
- reset_control_deassert(dwmac->stmmac_rst);
+ reset_control_deassert(dwmac->stmmac_ocp_rst);
+ reset_control_deassert(dwmac->stmmac_rst);
if (phymode == PHY_INTERFACE_MODE_SGMII) {
if (tse_pcs_init(dwmac->pcs.tse_pcs_base, &dwmac->pcs) != 0) {
dev_err(dwmac->dev, "Unable to initialize TSE PCS");
@@ -321,6 +322,15 @@ static int socfpga_dwmac_probe(struct pl
goto err_remove_config_dt;
}
+ dwmac->stmmac_ocp_rst = devm_reset_control_get_optional(dev, "stmmaceth-ocp");
+ if (IS_ERR(dwmac->stmmac_ocp_rst)) {
+ ret = PTR_ERR(dwmac->stmmac_ocp_rst);
+ dev_err(dev, "error getting reset control of ocp %d\n", ret);
+ goto err_remove_config_dt;
+ }
+
+ reset_control_deassert(dwmac->stmmac_ocp_rst);
+
ret = socfpga_dwmac_parse_data(dwmac, dev);
if (ret) {
dev_err(dev, "Unable to parse OF data\n");
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 030/130] nvmet: reset keep alive timer in controller enable
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 029/130] net: stmmac: socfpga: add additional ocp reset line for Stratix10 Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 031/130] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP Greg Kroah-Hartman
` (97 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Gurtovoy, Sagi Grimberg,
Christoph Hellwig, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Gurtuvoy <maxg@mellanox.com>
[ Upstream commit d68a90e148f5a82aa67654c5012071e31c0e4baa ]
Controllers that are not yet enabled should not really enforce keep alive
timeouts, but we still want to track a timeout and cleanup in case a host
died before it enabled the controller. Hence, simply reset the keep
alive timer when the controller is enabled.
Suggested-by: Max Gurtovoy <maxg@mellanox.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/core.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -578,6 +578,14 @@ static void nvmet_start_ctrl(struct nvme
}
ctrl->csts = NVME_CSTS_RDY;
+
+ /*
+ * Controllers that are not yet enabled should not really enforce the
+ * keep alive timeout, but we still want to track a timeout and cleanup
+ * in case a host died before it enabled the controller. Hence, simply
+ * reset the keep alive timer when the controller is enabled.
+ */
+ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
}
static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 031/130] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 030/130] nvmet: reset keep alive timer in controller enable Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 032/130] net: davinci_emac: match the mdio device against its compatible if possible Greg Kroah-Hartman
` (96 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
[ Upstream commit 2f24ef7413a4d91657ef04e77c27ce0b313e6c95 ]
machine_desc->init_per_cpu() hook is supposed to be per cpu
initialization and would seem to apply equally to UP and/or SMP.
Infact the comment in header file seems to suggest it works for
UP too, which was not the case and this patch.
This enables !CONFIG_SMP build for platforms such as hsdk.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
[vgupta: trimmeed changelog]
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/include/asm/mach_desc.h | 2 --
arch/arc/kernel/irq.c | 2 +-
2 files changed, 1 insertion(+), 3 deletions(-)
--- a/arch/arc/include/asm/mach_desc.h
+++ b/arch/arc/include/asm/mach_desc.h
@@ -34,9 +34,7 @@ struct machine_desc {
const char *name;
const char **dt_compat;
void (*init_early)(void);
-#ifdef CONFIG_SMP
void (*init_per_cpu)(unsigned int);
-#endif
void (*init_machine)(void);
void (*init_late)(void);
--- a/arch/arc/kernel/irq.c
+++ b/arch/arc/kernel/irq.c
@@ -31,10 +31,10 @@ void __init init_IRQ(void)
/* a SMP H/w block could do IPI IRQ request here */
if (plat_smp_ops.init_per_cpu)
plat_smp_ops.init_per_cpu(smp_processor_id());
+#endif
if (machine_desc->init_per_cpu)
machine_desc->init_per_cpu(smp_processor_id());
-#endif
}
/*
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 032/130] net: davinci_emac: match the mdio device against its compatible if possible
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 031/130] ARC: Enable machine_desc->init_per_cpu for !CONFIG_SMP Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 033/130] KVM: arm/arm64: Drop resource size check for GICV window Greg Kroah-Hartman
` (95 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bartosz Golaszewski, David S. Miller,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Golaszewski <bgolaszewski@baylibre.com>
[ Upstream commit ea0820bb771175c7d4192fc6f5b5c56b3c6d5239 ]
Device tree based systems without of_dev_auxdata will have the mdio
device named differently than "davinci_mdio(.0)". In this case use the
device's parent's compatible string for matching
Signed-off-by: Bartosz Golaszewski <bgolaszewski@baylibre.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ti/davinci_emac.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1387,6 +1387,10 @@ static int emac_devioctl(struct net_devi
static int match_first_device(struct device *dev, void *data)
{
+ if (dev->parent && dev->parent->of_node)
+ return of_device_is_compatible(dev->parent->of_node,
+ "ti,davinci_mdio");
+
return !strncmp(dev_name(dev), "davinci_mdio", 12);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 033/130] KVM: arm/arm64: Drop resource size check for GICV window
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 032/130] net: davinci_emac: match the mdio device against its compatible if possible Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 034/130] locking/lockdep: Do not record IRQ state within lockdep code Greg Kroah-Hartman
` (94 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ard Biesheuvel, Marc Zyngier, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[ Upstream commit ba56bc3a0786992755e6804fbcbdc60ef6cfc24c ]
When booting a 64 KB pages kernel on a ACPI GICv3 system that
implements support for v2 emulation, the following warning is
produced
GICV size 0x2000 not a multiple of page size 0x10000
and support for v2 emulation is disabled, preventing GICv2 VMs
from being able to run on such hosts.
The reason is that vgic_v3_probe() performs a sanity check on the
size of the window (it should be a multiple of the page size),
while the ACPI MADT parsing code hardcodes the size of the window
to 8 KB. This makes sense, considering that ACPI does not bother
to describe the size in the first place, under the assumption that
platforms implementing ACPI will follow the architecture and not
put anything else in the same 64 KB window.
So let's just drop the sanity check altogether, and assume that
the window is at least 64 KB in size.
Fixes: 909777324588 ("KVM: arm/arm64: vgic-new: vgic_init: implement kvm_vgic_hyp_init")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/arm/vgic/vgic-v3.c | 5 -----
1 file changed, 5 deletions(-)
--- a/virt/kvm/arm/vgic/vgic-v3.c
+++ b/virt/kvm/arm/vgic/vgic-v3.c
@@ -337,11 +337,6 @@ int vgic_v3_probe(const struct gic_kvm_i
pr_warn("GICV physical address 0x%llx not page aligned\n",
(unsigned long long)info->vcpu.start);
kvm_vgic_global_state.vcpu_base = 0;
- } else if (!PAGE_ALIGNED(resource_size(&info->vcpu))) {
- pr_warn("GICV size 0x%llx not a multiple of page size 0x%lx\n",
- (unsigned long long)resource_size(&info->vcpu),
- PAGE_SIZE);
- kvm_vgic_global_state.vcpu_base = 0;
} else {
kvm_vgic_global_state.vcpu_base = info->vcpu.start;
kvm_vgic_global_state.can_emulate_gicv2 = true;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 034/130] locking/lockdep: Do not record IRQ state within lockdep code
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 033/130] KVM: arm/arm64: Drop resource size check for GICV window Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 035/130] ipv6: mcast: fix unsolicited report interval after receiving querys Greg Kroah-Hartman
` (93 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Steven Rostedt (VMware),
Andrew Morton, Linus Torvalds, Paul E. McKenney, Peter Zijlstra,
Thomas Gleixner, Will Deacon, Ingo Molnar, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
[ Upstream commit fcc784be837714a9173b372ff9fb9b514590dad9 ]
While debugging where things were going wrong with mapping
enabling/disabling interrupts with the lockdep state and actual real
enabling and disabling interrupts, I had to silent the IRQ
disabling/enabling in debug_check_no_locks_freed() because it was
always showing up as it was called before the splat was.
Use raw_local_irq_save/restore() for not only debug_check_no_locks_freed()
but for all internal lockdep functions, as they hide useful information
about where interrupts were used incorrectly last.
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Link: https://lkml.kernel.org/lkml/20180404140630.3f4f4c7a@gandalf.local.home
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/locking/lockdep.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -1240,11 +1240,11 @@ unsigned long lockdep_count_forward_deps
this.parent = NULL;
this.class = class;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
arch_spin_lock(&lockdep_lock);
ret = __lockdep_count_forward_deps(&this);
arch_spin_unlock(&lockdep_lock);
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
return ret;
}
@@ -1267,11 +1267,11 @@ unsigned long lockdep_count_backward_dep
this.parent = NULL;
this.class = class;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
arch_spin_lock(&lockdep_lock);
ret = __lockdep_count_backward_deps(&this);
arch_spin_unlock(&lockdep_lock);
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
return ret;
}
@@ -4273,7 +4273,7 @@ void debug_check_no_locks_freed(const vo
if (unlikely(!debug_locks))
return;
- local_irq_save(flags);
+ raw_local_irq_save(flags);
for (i = 0; i < curr->lockdep_depth; i++) {
hlock = curr->held_locks + i;
@@ -4284,7 +4284,7 @@ void debug_check_no_locks_freed(const vo
print_freed_lock_bug(curr, mem_from, mem_from + mem_len, hlock);
break;
}
- local_irq_restore(flags);
+ raw_local_irq_restore(flags);
}
EXPORT_SYMBOL_GPL(debug_check_no_locks_freed);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 035/130] ipv6: mcast: fix unsolicited report interval after receiving querys
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 034/130] locking/lockdep: Do not record IRQ state within lockdep code Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 036/130] Smack: Mark inode instant in smack_task_to_inode Greg Kroah-Hartman
` (92 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hangbin Liu, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 6c6da92808442908287fae8ebb0ca041a52469f4 ]
After recieving MLD querys, we update idev->mc_maxdelay with max_delay
from query header. This make the later unsolicited reports have the same
interval with mc_maxdelay, which means we may send unsolicited reports with
long interval time instead of default configured interval time.
Also as we will not call ipv6_mc_reset() after device up. This issue will
be there even after leave the group and join other groups.
Fixes: fc4eba58b4c14 ("ipv6: make unsolicited report intervals configurable for mld")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/mcast.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2084,7 +2084,8 @@ void ipv6_mc_dad_complete(struct inet6_d
mld_send_initial_cr(idev);
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev, idev->mc_maxdelay);
+ mld_dad_start_timer(idev,
+ unsolicited_report_interval(idev));
}
}
@@ -2096,7 +2097,8 @@ static void mld_dad_timer_expire(unsigne
if (idev->mc_dad_count) {
idev->mc_dad_count--;
if (idev->mc_dad_count)
- mld_dad_start_timer(idev, idev->mc_maxdelay);
+ mld_dad_start_timer(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
@@ -2454,7 +2456,8 @@ static void mld_ifc_timer_expire(unsigne
if (idev->mc_ifc_count) {
idev->mc_ifc_count--;
if (idev->mc_ifc_count)
- mld_ifc_start_timer(idev, idev->mc_maxdelay);
+ mld_ifc_start_timer(idev,
+ unsolicited_report_interval(idev));
}
in6_dev_put(idev);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 036/130] Smack: Mark inode instant in smack_task_to_inode
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 035/130] ipv6: mcast: fix unsolicited report interval after receiving querys Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 037/130] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump Greg Kroah-Hartman
` (91 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Casey Schaufler, James Morris, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <casey@schaufler-ca.com>
[ Upstream commit 7b4e88434c4e7982fb053c49657e1c8bbb8692d9 ]
Smack: Mark inode instant in smack_task_to_inode
/proc clean-up in commit 1bbc55131e59bd099fdc568d3aa0b42634dbd188
resulted in smack_task_to_inode() being called before smack_d_instantiate.
This resulted in the smk_inode value being ignored, even while present
for files in /proc/self. Marking the inode as instant here fixes that.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/smack/smack_lsm.c | 1 +
1 file changed, 1 insertion(+)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2307,6 +2307,7 @@ static void smack_task_to_inode(struct t
struct smack_known *skp = smk_of_task_struct(p);
isp->smk_inode = skp;
+ isp->smk_flags |= SMK_INODE_INSTANT;
}
/*
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 037/130] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 036/130] Smack: Mark inode instant in smack_task_to_inode Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 038/130] batman-adv: Fix bat_v " Greg Kroah-Hartman
` (90 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Ziegler, Sven Eckelmann,
Marek Lindner, Simon Wunderlich, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit b5685d2687d6612adf5eac519eb7008f74dfd1ec ]
A reference for the best gateway is taken when the list of gateways in the
mesh is sent via netlink. This is necessary to check whether the currently
dumped entry is the currently selected gateway or not. This information is
then transferred as flag BATADV_ATTR_FLAG_BEST.
After the comparison of the current entry is done,
batadv_iv_gw_dump_entry() has to decrease the reference counter again.
Otherwise the reference will be held and thus prevents a proper shutdown of
the batman-adv interfaces (and some of the interfaces enslaved in it).
Fixes: efb766af06e3 ("batman-adv: add B.A.T.M.A.N. IV bat_gw_dump implementations")
Reported-by: Andreas Ziegler <dev@andreas-ziegler.de>
Tested-by: Andreas Ziegler <dev@andreas-ziegler.de>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -2704,7 +2704,7 @@ static int batadv_iv_gw_dump_entry(struc
{
struct batadv_neigh_ifinfo *router_ifinfo = NULL;
struct batadv_neigh_node *router;
- struct batadv_gw_node *curr_gw;
+ struct batadv_gw_node *curr_gw = NULL;
int ret = 0;
void *hdr;
@@ -2752,6 +2752,8 @@ static int batadv_iv_gw_dump_entry(struc
ret = 0;
out:
+ if (curr_gw)
+ batadv_gw_node_put(curr_gw);
if (router_ifinfo)
batadv_neigh_ifinfo_put(router_ifinfo);
if (router)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 038/130] batman-adv: Fix bat_v best gw refcnt after netlink dump
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 037/130] batman-adv: Fix bat_ogm_iv best gw refcnt after netlink dump Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 039/130] cxgb4: when disabling dcb set txq dcb priority to 0 Greg Kroah-Hartman
` (89 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sven Eckelmann, Marek Lindner,
Simon Wunderlich, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
[ Upstream commit 9713cb0cf19f1cec6c007e3b37be0697042b6720 ]
A reference for the best gateway is taken when the list of gateways in the
mesh is sent via netlink. This is necessary to check whether the currently
dumped entry is the currently selected gateway or not. This information is
then transferred as flag BATADV_ATTR_FLAG_BEST.
After the comparison of the current entry is done,
batadv_v_gw_dump_entry() has to decrease the reference counter again.
Otherwise the reference will be held and thus prevents a proper shutdown of
the batman-adv interfaces (and some of the interfaces enslaved in it).
Fixes: b71bb6f924fe ("batman-adv: add B.A.T.M.A.N. V bat_gw_dump implementations")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Acked-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_v.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/batman-adv/bat_v.c
+++ b/net/batman-adv/bat_v.c
@@ -919,7 +919,7 @@ static int batadv_v_gw_dump_entry(struct
{
struct batadv_neigh_ifinfo *router_ifinfo = NULL;
struct batadv_neigh_node *router;
- struct batadv_gw_node *curr_gw;
+ struct batadv_gw_node *curr_gw = NULL;
int ret = 0;
void *hdr;
@@ -987,6 +987,8 @@ static int batadv_v_gw_dump_entry(struct
ret = 0;
out:
+ if (curr_gw)
+ batadv_gw_node_put(curr_gw);
if (router_ifinfo)
batadv_neigh_ifinfo_put(router_ifinfo);
if (router)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 039/130] cxgb4: when disabling dcb set txq dcb priority to 0
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 038/130] batman-adv: Fix bat_v " Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 040/130] iio: pressure: bmp280: fix relative humidity unit Greg Kroah-Hartman
` (88 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, AMG Zollner Robert, David Ahern,
Casey Leedom, Ganesh Goudar, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ganesh Goudar <ganeshgr@chelsio.com>
[ Upstream commit 5ce36338a30f9814fc4824f9fe6c20cd83d872c7 ]
When we are disabling DCB, store "0" in txq->dcb_prio
since that's used for future TX Work Request "OVLAN_IDX"
values. Setting non zero priority upon disabling DCB
would halt the traffic.
Reported-by: AMG Zollner Robert <robert@cloudmedia.eu>
CC: David Ahern <dsa@cumulusnetworks.com>
Signed-off-by: Casey Leedom <leedom@chelsio.com>
Signed-off-by: Ganesh Goudar <ganeshgr@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -274,7 +274,7 @@ static void dcb_tx_queue_prio_enable(str
"Can't %s DCB Priority on port %d, TX Queue %d: err=%d\n",
enable ? "set" : "unset", pi->port_id, i, -err);
else
- txq->dcb_prio = value;
+ txq->dcb_prio = enable ? value : 0;
}
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 040/130] iio: pressure: bmp280: fix relative humidity unit
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 039/130] cxgb4: when disabling dcb set txq dcb priority to 0 Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 041/130] brcmfmac: stop watchdog before detach and free everything Greg Kroah-Hartman
` (87 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomasz Duszynski, Matt Ranostay,
Jonathan Cameron, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Duszynski <tduszyns@gmail.com>
[ Upstream commit 13399ff25f179811ce9c1df1523eb39f9e4a4772 ]
According to IIO ABI relative humidity reading should be
returned in milli percent.
This patch addresses that by applying proper scaling and
returning integer instead of fractional format type specifier.
Note that the fixes tag is before the driver was heavily refactored
to introduce spi support, so the patch won't apply that far back.
Signed-off-by: Tomasz Duszynski <tduszyns@gmail.com>
Fixes: 14beaa8f5ab1 ("iio: pressure: bmp280: add humidity support")
Acked-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/bmp280-core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -347,10 +347,9 @@ static int bmp280_read_humid(struct bmp2
adc_humidity = be16_to_cpu(tmp);
comp_humidity = bmp280_compensate_humidity(data, adc_humidity);
- *val = comp_humidity;
- *val2 = 1024;
+ *val = comp_humidity * 1000 / 1024;
- return IIO_VAL_FRACTIONAL;
+ return IIO_VAL_INT;
}
static int bmp280_read_raw(struct iio_dev *indio_dev,
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 041/130] brcmfmac: stop watchdog before detach and free everything
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 040/130] iio: pressure: bmp280: fix relative humidity unit Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 042/130] ARM: dts: am437x: make edt-ft5x06 a wakeup source Greg Kroah-Hartman
` (86 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Trimarchi, Arend van Spriel,
Andy Shevchenko, Kalle Valo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Trimarchi <michael@amarulasolutions.com>
[ Upstream commit 373c83a801f15b1e3d02d855fad89112bd4ccbe0 ]
Using built-in in kernel image without a firmware in filesystem
or in the kernel image can lead to a kernel NULL pointer deference.
Watchdog need to be stopped in brcmf_sdio_remove
The system is going down NOW!
[ 1348.110759] Unable to handle kernel NULL pointer dereference at virtual address 000002f8
Sent SIGTERM to all processes
[ 1348.121412] Mem abort info:
[ 1348.126962] ESR = 0x96000004
[ 1348.130023] Exception class = DABT (current EL), IL = 32 bits
[ 1348.135948] SET = 0, FnV = 0
[ 1348.138997] EA = 0, S1PTW = 0
[ 1348.142154] Data abort info:
[ 1348.145045] ISV = 0, ISS = 0x00000004
[ 1348.148884] CM = 0, WnR = 0
[ 1348.151861] user pgtable: 4k pages, 48-bit VAs, pgdp = (____ptrval____)
[ 1348.158475] [00000000000002f8] pgd=0000000000000000
[ 1348.163364] Internal error: Oops: 96000004 [#1] PREEMPT SMP
[ 1348.168927] Modules linked in: ipv6
[ 1348.172421] CPU: 3 PID: 1421 Comm: brcmf_wdog/mmc0 Not tainted 4.17.0-rc5-next-20180517 #18
[ 1348.180757] Hardware name: Amarula A64-Relic (DT)
[ 1348.185455] pstate: 60000005 (nZCv daif -PAN -UAO)
[ 1348.190251] pc : brcmf_sdiod_freezer_count+0x0/0x20
[ 1348.195124] lr : brcmf_sdio_watchdog_thread+0x64/0x290
[ 1348.200253] sp : ffff00000b85be30
[ 1348.203561] x29: ffff00000b85be30 x28: 0000000000000000
[ 1348.208868] x27: ffff00000b6cb918 x26: ffff80003b990638
[ 1348.214176] x25: ffff0000087b1a20 x24: ffff80003b94f800
[ 1348.219483] x23: ffff000008e620c8 x22: ffff000008f0b660
[ 1348.224790] x21: ffff000008c6a858 x20: 00000000fffffe00
[ 1348.230097] x19: ffff80003b94f800 x18: 0000000000000001
[ 1348.235404] x17: 0000ffffab2e8a74 x16: ffff0000080d7de8
[ 1348.240711] x15: 0000000000000000 x14: 0000000000000400
[ 1348.246018] x13: 0000000000000400 x12: 0000000000000001
[ 1348.251324] x11: 00000000000002c4 x10: 0000000000000a10
[ 1348.256631] x9 : ffff00000b85bc40 x8 : ffff80003be11870
[ 1348.261937] x7 : ffff80003dfc7308 x6 : 000000078ff08b55
[ 1348.267243] x5 : 00000139e1058400 x4 : 0000000000000000
[ 1348.272550] x3 : dead000000000100 x2 : 958f2788d6618100
[ 1348.277856] x1 : 00000000fffffe00 x0 : 0000000000000000
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Tested-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -4229,6 +4229,13 @@ void brcmf_sdio_remove(struct brcmf_sdio
brcmf_dbg(TRACE, "Enter\n");
if (bus) {
+ /* Stop watchdog task */
+ if (bus->watchdog_tsk) {
+ send_sig(SIGTERM, bus->watchdog_tsk, 1);
+ kthread_stop(bus->watchdog_tsk);
+ bus->watchdog_tsk = NULL;
+ }
+
/* De-register interrupt handler */
brcmf_sdiod_intr_unregister(bus->sdiodev);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 042/130] ARM: dts: am437x: make edt-ft5x06 a wakeup source
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 041/130] brcmfmac: stop watchdog before detach and free everything Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 043/130] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl Greg Kroah-Hartman
` (85 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Tony Lindgren, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <daniel@zonque.org>
[ Upstream commit 49a6ec5b807ea4ad7ebe1f58080ebb8497cb2d2c ]
The touchscreen driver no longer configures the device as wakeup source by
default. A "wakeup-source" property is needed.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am437x-sk-evm.dts | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/boot/dts/am437x-sk-evm.dts
+++ b/arch/arm/boot/dts/am437x-sk-evm.dts
@@ -533,6 +533,8 @@
touchscreen-size-x = <480>;
touchscreen-size-y = <272>;
+
+ wakeup-source;
};
tlv320aic3106: tlv320aic3106@1b {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 043/130] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 042/130] ARM: dts: am437x: make edt-ft5x06 a wakeup source Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 044/130] usb: xhci: remove the code build warning Greg Kroah-Hartman
` (84 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit c9a4c63888dbb79ce4d068ca1dd8b05bc3f156b1 ]
The kernel may spew a WARNING with UBSAN undefined behavior at
handling ALSA sequencer ioctl SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT:
UBSAN: Undefined behaviour in sound/core/seq/seq_clientmgr.c:2007:14
signed integer overflow:
2147483647 + 1 cannot be represented in type 'int'
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x122/0x1c8 lib/dump_stack.c:113
ubsan_epilogue+0x12/0x86 lib/ubsan.c:159
handle_overflow+0x1c2/0x21f lib/ubsan.c:190
__ubsan_handle_add_overflow+0x2a/0x31 lib/ubsan.c:198
snd_seq_ioctl_query_next_client+0x1ac/0x1d0 sound/core/seq/seq_clientmgr.c:2007
snd_seq_ioctl+0x264/0x3d0 sound/core/seq/seq_clientmgr.c:2144
....
It happens only when INT_MAX is passed there, as we're incrementing it
unconditionally. So the fix is trivial, check the value with
INT_MAX. Although the bug itself is fairly harmless, it's better to
fix it so that fuzzers won't hit this again later.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=200211
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_clientmgr.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -2002,7 +2002,8 @@ static int snd_seq_ioctl_query_next_clie
struct snd_seq_client *cptr = NULL;
/* search for next client */
- info->client++;
+ if (info->client < INT_MAX)
+ info->client++;
if (info->client < 0)
info->client = 0;
for (; info->client < SNDRV_SEQ_MAX_CLIENTS; info->client++) {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 044/130] usb: xhci: remove the code build warning
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 043/130] ALSA: seq: Fix UBSAN warning at SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT ioctl Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 045/130] usb: xhci: increase CRS timeout value Greg Kroah-Hartman
` (83 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dongjiu Geng, Thierry Reding,
Jon Hunter, Mathias Nyman, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongjiu Geng <gengdongjiu@huawei.com>
[ Upstream commit 36eb93509c45d0bdbd8d09a01ab9d857972f5963 ]
Initialize the 'err' variate to remove the build warning,
the warning is shown as below:
drivers/usb/host/xhci-tegra.c: In function 'tegra_xusb_mbox_thread':
drivers/usb/host/xhci-tegra.c:552:6: warning: 'err' may be used uninitialized in this function [-Wuninitialized]
drivers/usb/host/xhci-tegra.c:482:6: note: 'err' was declared here
Fixes: e84fce0f8837 ("usb: xhci: Add NVIDIA Tegra XUSB controller driver")
Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Acked-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-tegra.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -482,7 +482,7 @@ static void tegra_xusb_mbox_handle(struc
unsigned long mask;
unsigned int port;
bool idle, enable;
- int err;
+ int err = 0;
memset(&rsp, 0, sizeof(rsp));
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 045/130] usb: xhci: increase CRS timeout value
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 044/130] usb: xhci: remove the code build warning Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 046/130] NFC: pn533: Fix wrong GFP flag usage Greg Kroah-Hartman
` (82 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ajay Gupta, Nagaraj Annaiah,
Mathias Nyman, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ajay Gupta <ajaykuee@gmail.com>
[ Upstream commit 305886ca87be480ae159908c2affd135c04215cf ]
Some controllers take almost 55ms to complete controller
restore state (CRS).
There is no timeout limit mentioned in xhci specification so
fixing the issue by increasing the timeout limit to 100ms
[reformat code comment -Mathias]
Signed-off-by: Ajay Gupta <ajaykuee@gmail.com>
Signed-off-by: Nagaraj Annaiah <naga.annaiah@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1056,8 +1056,13 @@ int xhci_resume(struct xhci_hcd *xhci, b
command = readl(&xhci->op_regs->command);
command |= CMD_CRS;
writel(command, &xhci->op_regs->command);
+ /*
+ * Some controllers take up to 55+ ms to complete the controller
+ * restore so setting the timeout to 100ms. Xhci specification
+ * doesn't mention any timeout value.
+ */
if (xhci_handshake(&xhci->op_regs->status,
- STS_RESTORE, 0, 10 * 1000)) {
+ STS_RESTORE, 0, 100 * 1000)) {
xhci_warn(xhci, "WARN: xHC restore state timeout\n");
spin_unlock_irq(&xhci->lock);
return -ETIMEDOUT;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 046/130] NFC: pn533: Fix wrong GFP flag usage
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 045/130] usb: xhci: increase CRS timeout value Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 047/130] perf test session topology: Fix test on s390 Greg Kroah-Hartman
` (81 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Thalmeier, Hans de Goede,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit ecc443c03fb14abfb8a6af5e3b2d43b5257e60f2 ]
pn533_recv_response() is an urb completion handler, so it must use
GFP_ATOMIC. pn533_usb_send_frame() OTOH runs from a regular sleeping
context, so the pn533_submit_urb_for_response() there (and only there)
can use the regular GFP_KERNEL flags.
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1514134
Fixes: 9815c7cf22da ("NFC: pn533: Separate physical layer from ...")
Cc: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/pn533/usb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/nfc/pn533/usb.c
+++ b/drivers/nfc/pn533/usb.c
@@ -71,7 +71,7 @@ static void pn533_recv_response(struct u
struct sk_buff *skb = NULL;
if (!urb->status) {
- skb = alloc_skb(urb->actual_length, GFP_KERNEL);
+ skb = alloc_skb(urb->actual_length, GFP_ATOMIC);
if (!skb) {
nfc_err(&phy->udev->dev, "failed to alloc memory\n");
} else {
@@ -180,7 +180,7 @@ static int pn533_usb_send_frame(struct p
if (dev->protocol_type == PN533_PROTO_REQ_RESP) {
/* request for response for sent packet directly */
- rc = pn533_submit_urb_for_response(phy, GFP_ATOMIC);
+ rc = pn533_submit_urb_for_response(phy, GFP_KERNEL);
if (rc)
goto error;
} else if (dev->protocol_type == PN533_PROTO_REQ_ACK_RESP) {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 047/130] perf test session topology: Fix test on s390
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 046/130] NFC: pn533: Fix wrong GFP flag usage Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 048/130] perf report powerpc: Fix crash if callchain is empty Greg Kroah-Hartman
` (80 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Richter, Hendrik Brueckner,
Heiko Carstens, Martin Schwidefsky, Arnaldo Carvalho de Melo,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Richter <tmricht@linux.ibm.com>
[ Upstream commit b930e62ecd362843002bdf84c2940439822af321 ]
On s390 this test case fails because the socket identifiction numbers
assigned to the CPU are higher than the CPU identification numbers.
F/ix this by adding the platform architecture into the perf data header
flag information. This helps identifiing the test platform and handles
s390 specifics in process_cpu_topology().
Before:
[root@p23lp27 perf]# perf test -vvvvv -F 39
39: Session topology :
--- start ---
templ file: /tmp/perf-test-iUv755
socket_id number is too big.You may need to upgrade the perf tool.
---- end ----
Session topology: Skip
[root@p23lp27 perf]#
After:
[root@p23lp27 perf]# perf test -vvvvv -F 39
39: Session topology :
--- start ---
templ file: /tmp/perf-test-8X8VTs
CPU 0, core 0, socket 6
CPU 1, core 1, socket 3
---- end ----
Session topology: Ok
[root@p23lp27 perf]#
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Fixes: c84974ed9fb6 ("perf test: Add entry to test cpu topology")
Link: http://lkml.kernel.org/r/20180611073153.15592-2-tmricht@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/tests/topology.c | 1 +
1 file changed, 1 insertion(+)
--- a/tools/perf/tests/topology.c
+++ b/tools/perf/tests/topology.c
@@ -42,6 +42,7 @@ static int session_write_header(char *pa
perf_header__set_feat(&session->header, HEADER_CPU_TOPOLOGY);
perf_header__set_feat(&session->header, HEADER_NRCPUS);
+ perf_header__set_feat(&session->header, HEADER_ARCH);
session->header.data_size += DATA_SIZE;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 048/130] perf report powerpc: Fix crash if callchain is empty
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 047/130] perf test session topology: Fix test on s390 Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 049/130] perf bench: Fix numa report output code Greg Kroah-Hartman
` (79 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ravi Bangoria, Sandipan Das,
Jiri Olsa, Naveen N. Rao, Sukadev Bhattiprolu,
Arnaldo Carvalho de Melo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandipan Das <sandipan@linux.ibm.com>
[ Upstream commit 143c99f6ac6812d23254e80844d6e34be897d3e1 ]
For some cases, the callchain provided by the kernel may be empty. So,
the callchain ip filtering code will cause a crash if we do not check
whether the struct ip_callchain pointer is NULL before accessing any
members.
This can be observed on a powerpc64le system running Fedora 27 as shown
below.
# perf record -b -e cycles:u ls
Before:
# perf report --branch-history
perf: Segmentation fault
-------- backtrace --------
perf[0x1027615c]
linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
perf(arch_skip_callchain_idx+0x44)[0x10257c58]
perf[0x1017f2e4]
perf(thread__resolve_callchain+0x124)[0x1017ff5c]
perf(sample__resolve_callchain+0xf0)[0x10172788]
...
After:
# perf report --branch-history
Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
Overhead Source:Line Symbol Shared Object
+ 11.60% _init+35736 [.] _init ls
+ 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ 8.83% _init+236 [.] _init ls
...
Reported-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Signed-off-by: Sandipan Das <sandipan@linux.ibm.com>
Acked-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Cc: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20180611104049.11048-1-sandipan@linux.ibm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct threa
u64 ip;
u64 skip_slot = -1;
- if (chain->nr < 3)
+ if (!chain || chain->nr < 3)
return skip_slot;
ip = chain->ips[2];
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 049/130] perf bench: Fix numa report output code
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 048/130] perf report powerpc: Fix crash if callchain is empty Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 050/130] netfilter: nf_log: fix uninit read in nf_log_proc_dostring Greg Kroah-Hartman
` (78 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Alexander Shishkin,
David Ahern, Namhyung Kim, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 983107072be1a39cbde67d45cb0059138190e015 ]
Currently we can hit following assert when running numa bench:
$ perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZ0cm --thp 1
perf: bench/numa.c:1577: __bench_numa: Assertion `!(!(((wait_stat) & 0x7f) == 0))' failed.
The assertion is correct, because we hit the SIGFPE in following line:
Thread 2.2 "thread 0/0" received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0x7fffd28c6700 (LWP 11750)]
0x000.. in worker_thread (__tdata=0x7.. ) at bench/numa.c:1257
1257 td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
We don't check if the runtime is actually bigger than 1 second,
and thus this might end up with zero division within FPU.
Adding the check to prevent this.
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20180620094036.17278-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/bench/numa.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/tools/perf/bench/numa.c
+++ b/tools/perf/bench/numa.c
@@ -1093,7 +1093,7 @@ static void *worker_thread(void *__tdata
u8 *global_data;
u8 *process_data;
u8 *thread_data;
- u64 bytes_done;
+ u64 bytes_done, secs;
long work_done;
u32 l;
struct rusage rusage;
@@ -1249,7 +1249,8 @@ static void *worker_thread(void *__tdata
timersub(&stop, &start0, &diff);
td->runtime_ns = diff.tv_sec * NSEC_PER_SEC;
td->runtime_ns += diff.tv_usec * NSEC_PER_USEC;
- td->speed_gbs = bytes_done / (td->runtime_ns / NSEC_PER_SEC) / 1e9;
+ secs = td->runtime_ns / NSEC_PER_SEC;
+ td->speed_gbs = secs ? bytes_done / secs / 1e9 : 0;
getrusage(RUSAGE_THREAD, &rusage);
td->system_time_ns = rusage.ru_stime.tv_sec * NSEC_PER_SEC;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 050/130] netfilter: nf_log: fix uninit read in nf_log_proc_dostring
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 049/130] perf bench: Fix numa report output code Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 051/130] ceph: fix dentry leak in splice_dentry() Greg Kroah-Hartman
` (77 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Pablo Neira Ayuso, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
[ Upstream commit dffd22aed2aa1e804bccf19b30a421e89ee2ae61 ]
When proc_dostring() is called with a non-zero offset in strict mode, it
doesn't just write to the ->data buffer, it also reads. Make sure it
doesn't read uninitialized data.
Fixes: c6ac37d8d884 ("netfilter: nf_log: fix error on write NONE to [...]")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_log.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -426,6 +426,10 @@ static int nf_log_proc_dostring(struct c
if (write) {
struct ctl_table tmp = *table;
+ /* proc_dostring() can append to existing strings, so we need to
+ * initialize it as an empty string.
+ */
+ buf[0] = '\0';
tmp.data = buf;
r = proc_dostring(&tmp, write, buffer, lenp, ppos);
if (r)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 051/130] ceph: fix dentry leak in splice_dentry()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 050/130] netfilter: nf_log: fix uninit read in nf_log_proc_dostring Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 052/130] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs Greg Kroah-Hartman
` (76 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yan, Zheng, Jeff Layton,
Ilya Dryomov, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Yan, Zheng" <zyan@redhat.com>
[ Upstream commit 8b8f53af1ed9df88a4c0fbfdf3db58f62060edf3 ]
In any case, d_splice_alias() does not drop reference of original
dentry.
Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/inode.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1077,6 +1077,7 @@ static struct dentry *splice_dentry(stru
if (IS_ERR(realdn)) {
pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n",
PTR_ERR(realdn), dn, in, ceph_vinop(in));
+ dput(dn);
dn = realdn; /* note realdn contains the error */
goto out;
} else if (realdn) {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 052/130] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 051/130] ceph: fix dentry leak in splice_dentry() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 053/130] selftests/x86/sigreturn: Do minor cleanups Greg Kroah-Hartman
` (75 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Borislav Petkov,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit ec348020566009d3da9b99f07c05814d13969c78 ]
When I wrote the sigreturn test, I didn't realize that AMD's busted
IRET behavior was different from Intel's busted IRET behavior:
On AMD CPUs, the CPU leaks the high 32 bits of the kernel stack pointer
to certain userspace contexts. Gee, thanks. There's very little
the kernel can do about it. Modify the test so it passes.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/86e7fd3564497f657de30a36da4505799eebef01.1530076529.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/x86/sigreturn.c | 46 ++++++++++++++++++++------------
1 file changed, 29 insertions(+), 17 deletions(-)
--- a/tools/testing/selftests/x86/sigreturn.c
+++ b/tools/testing/selftests/x86/sigreturn.c
@@ -612,19 +612,38 @@ static int test_valid_sigreturn(int cs_b
greg_t req = requested_regs[i], res = resulting_regs[i];
if (i == REG_TRAPNO || i == REG_IP)
continue; /* don't care */
- if (i == REG_SP) {
- printf("\tSP: %llx -> %llx\n", (unsigned long long)req,
- (unsigned long long)res);
+ if (i == REG_SP) {
/*
- * In many circumstances, the high 32 bits of rsp
- * are zeroed. For example, we could be a real
- * 32-bit program, or we could hit any of a number
- * of poorly-documented IRET or segmented ESP
- * oddities. If this happens, it's okay.
+ * If we were using a 16-bit stack segment, then
+ * the kernel is a bit stuck: IRET only restores
+ * the low 16 bits of ESP/RSP if SS is 16-bit.
+ * The kernel uses a hack to restore bits 31:16,
+ * but that hack doesn't help with bits 63:32.
+ * On Intel CPUs, bits 63:32 end up zeroed, and, on
+ * AMD CPUs, they leak the high bits of the kernel
+ * espfix64 stack pointer. There's very little that
+ * the kernel can do about it.
+ *
+ * Similarly, if we are returning to a 32-bit context,
+ * the CPU will often lose the high 32 bits of RSP.
*/
- if (res == (req & 0xFFFFFFFF))
- continue; /* OK; not expected to work */
+
+ if (res == req)
+ continue;
+
+ if (cs_bits != 64 && ((res ^ req) & 0xFFFFFFFF) == 0) {
+ printf("[NOTE]\tSP: %llx -> %llx\n",
+ (unsigned long long)req,
+ (unsigned long long)res);
+ continue;
+ }
+
+ printf("[FAIL]\tSP mismatch: requested 0x%llx; got 0x%llx\n",
+ (unsigned long long)requested_regs[i],
+ (unsigned long long)resulting_regs[i]);
+ nerrs++;
+ continue;
}
bool ignore_reg = false;
@@ -663,13 +682,6 @@ static int test_valid_sigreturn(int cs_b
}
if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
- /*
- * SP is particularly interesting here. The
- * usual cause of failures is that we hit the
- * nasty IRET case of returning to a 16-bit SS,
- * in which case bits 16:31 of the *kernel*
- * stack pointer persist in ESP.
- */
printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
i, (unsigned long long)requested_regs[i],
(unsigned long long)resulting_regs[i]);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 053/130] selftests/x86/sigreturn: Do minor cleanups
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 052/130] selftests/x86/sigreturn/64: Fix spurious failures on AMD CPUs Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 054/130] ARM: dts: da850: Fix interrups property for gpio Greg Kroah-Hartman
` (74 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andy Lutomirski, Borislav Petkov,
Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Ingo Molnar,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@kernel.org>
[ Upstream commit e8a445dea219c32727016af14f847d2e8f7ebec8 ]
We have short names for the requested and resulting register values.
Use them instead of spelling out the whole register entry for each
case.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/bb3bc1f923a2f6fe7912d22a1068fe29d6033d38.1530076529.git.luto@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/x86/sigreturn.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/tools/testing/selftests/x86/sigreturn.c
+++ b/tools/testing/selftests/x86/sigreturn.c
@@ -610,6 +610,7 @@ static int test_valid_sigreturn(int cs_b
*/
for (int i = 0; i < NGREG; i++) {
greg_t req = requested_regs[i], res = resulting_regs[i];
+
if (i == REG_TRAPNO || i == REG_IP)
continue; /* don't care */
@@ -673,18 +674,18 @@ static int test_valid_sigreturn(int cs_b
#endif
/* Sanity check on the kernel */
- if (i == REG_CX && requested_regs[i] != resulting_regs[i]) {
+ if (i == REG_CX && req != res) {
printf("[FAIL]\tCX (saved SP) mismatch: requested 0x%llx; got 0x%llx\n",
- (unsigned long long)requested_regs[i],
- (unsigned long long)resulting_regs[i]);
+ (unsigned long long)req,
+ (unsigned long long)res);
nerrs++;
continue;
}
- if (requested_regs[i] != resulting_regs[i] && !ignore_reg) {
+ if (req != res && !ignore_reg) {
printf("[FAIL]\tReg %d mismatch: requested 0x%llx; got 0x%llx\n",
- i, (unsigned long long)requested_regs[i],
- (unsigned long long)resulting_regs[i]);
+ i, (unsigned long long)req,
+ (unsigned long long)res);
nerrs++;
}
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 054/130] ARM: dts: da850: Fix interrups property for gpio
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 053/130] selftests/x86/sigreturn: Do minor cleanups Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 055/130] dmaengine: pl330: report BURST residue granularity Greg Kroah-Hartman
` (73 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Keerthy, Sekhar Nori, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keerthy <j-keerthy@ti.com>
[ Upstream commit 3eb1b955cd7ed1e621ace856710006c2a8a7f231 ]
The intc #interrupt-cells is equal to 1. Currently gpio
node has 2 cells per IRQ which is wrong. Remove the additional
cell for each of the interrupts.
Signed-off-by: Keerthy <j-keerthy@ti.com>
Fixes: 2e38b946dc54 ("ARM: davinci: da850: add GPIO DT node")
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/da850.dtsi | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/arch/arm/boot/dts/da850.dtsi
+++ b/arch/arm/boot/dts/da850.dtsi
@@ -377,11 +377,7 @@
gpio-controller;
#gpio-cells = <2>;
reg = <0x226000 0x1000>;
- interrupts = <42 IRQ_TYPE_EDGE_BOTH
- 43 IRQ_TYPE_EDGE_BOTH 44 IRQ_TYPE_EDGE_BOTH
- 45 IRQ_TYPE_EDGE_BOTH 46 IRQ_TYPE_EDGE_BOTH
- 47 IRQ_TYPE_EDGE_BOTH 48 IRQ_TYPE_EDGE_BOTH
- 49 IRQ_TYPE_EDGE_BOTH 50 IRQ_TYPE_EDGE_BOTH>;
+ interrupts = <42 43 44 45 46 47 48 49 50>;
ti,ngpio = <144>;
ti,davinci-gpio-unbanked = <0>;
status = "disabled";
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 055/130] dmaengine: pl330: report BURST residue granularity
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 054/130] ARM: dts: da850: Fix interrups property for gpio Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 056/130] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() Greg Kroah-Hartman
` (72 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Vinod Koul, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit e3f329c600033f011a978a8bc4ddb1e2e94c4f4d ]
The reported residue is already calculated in BURST unit granularity, so
advertise this capability properly to other devices in the system.
Fixes: aee4d1fac887 ("dmaengine: pl330: improve pl330_tx_status() function")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/pl330.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -2951,7 +2951,7 @@ pl330_probe(struct amba_device *adev, co
pd->src_addr_widths = PL330_DMA_BUSWIDTHS;
pd->dst_addr_widths = PL330_DMA_BUSWIDTHS;
pd->directions = BIT(DMA_DEV_TO_MEM) | BIT(DMA_MEM_TO_DEV);
- pd->residue_granularity = DMA_RESIDUE_GRANULARITY_SEGMENT;
+ pd->residue_granularity = DMA_RESIDUE_GRANULARITY_BURST;
pd->max_burst = ((pl330->quirks & PL330_QUIRK_BROKEN_NO_FLUSHP) ?
1 : PL330_MAX_BURST);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 056/130] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 055/130] dmaengine: pl330: report BURST residue granularity Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 057/130] md/raid10: fix that replacement cannot complete recovery after reassemble Greg Kroah-Hartman
` (71 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Vinod Koul, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit c4c2b7644cc9a41f17a8cc8904efe3f66ae4c7ed ]
The d->chans[] array has d->dma_requests elements so the > should be
>= here.
Fixes: 8e6152bc660e ("dmaengine: Add hisilicon k3 DMA engine driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/k3dma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/dma/k3dma.c
+++ b/drivers/dma/k3dma.c
@@ -792,7 +792,7 @@ static struct dma_chan *k3_of_dma_simple
struct k3_dma_dev *d = ofdma->of_dma_data;
unsigned int request = dma_spec->args[0];
- if (request > d->dma_requests)
+ if (request >= d->dma_requests)
return NULL;
return dma_get_slave_channel(&(d->chans[request].vc.chan));
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 057/130] md/raid10: fix that replacement cannot complete recovery after reassemble
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 056/130] dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 058/130] nl80211: relax ht operation checks for mesh Greg Kroah-Hartman
` (70 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Chen, Alex Wu,
Chung-Chiang Cheng, BingJing Chang, Shaohua Li, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: BingJing Chang <bingjingc@synology.com>
[ Upstream commit bda3153998f3eb2cafa4a6311971143628eacdbc ]
During assemble, the spare marked for replacement is not checked.
conf->fullsync cannot be updated to be 1. As a result, recovery will
treat it as a clean array. All recovering sectors are skipped. Original
device is replaced with the not-recovered spare.
mdadm -C /dev/md0 -l10 -n4 -pn2 /dev/loop[0123]
mdadm /dev/md0 -a /dev/loop4
mdadm /dev/md0 --replace /dev/loop0
mdadm -S /dev/md0 # stop array during recovery
mdadm -A /dev/md0 /dev/loop[01234]
After reassemble, you can see recovery go on, but it completes
immediately. In fact, recovery is not actually processed.
To solve this problem, we just add the missing logics for replacment
spares. (In raid1.c or raid5.c, they have already been checked.)
Reported-by: Alex Chen <alexchen@synology.com>
Reviewed-by: Alex Wu <alexwu@synology.com>
Reviewed-by: Chung-Chiang Cheng <cccheng@synology.com>
Signed-off-by: BingJing Chang <bingjingc@synology.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -3734,6 +3734,13 @@ static int raid10_run(struct mddev *mdde
disk->rdev->saved_raid_disk < 0)
conf->fullsync = 1;
}
+
+ if (disk->replacement &&
+ !test_bit(In_sync, &disk->replacement->flags) &&
+ disk->replacement->saved_raid_disk < 0) {
+ conf->fullsync = 1;
+ }
+
disk->recovery_disabled = mddev->recovery_disabled - 1;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 058/130] nl80211: relax ht operation checks for mesh
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 057/130] md/raid10: fix that replacement cannot complete recovery after reassemble Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 059/130] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes Greg Kroah-Hartman
` (69 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Masashi Honma, Bob Copeland,
Johannes Berg, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Copeland <me@bobcopeland.com>
[ Upstream commit 188f60ab8e787fcbb5ac9d64ede23a0070231f09 ]
Commit 9757235f451c, "nl80211: correct checks for
NL80211_MESHCONF_HT_OPMODE value") relaxed the range for the HT
operation field in meshconf, while also adding checks requiring
the non-greenfield and non-ht-sta bits to be set in certain
circumstances. The latter bit is actually reserved for mesh BSSes
according to Table 9-168 in 802.11-2016, so in fact it should not
be set.
wpa_supplicant sets these bits because the mesh and AP code share
the same implementation, but authsae does not. As a result, some
meshconf updates from authsae which set only the NONHT_MIXED
protection bits were being rejected.
In order to avoid breaking userspace by changing the rules again,
simply accept the values with or without the bits set, and mask
off the reserved bit to match the spec.
While in here, update the 802.11-2012 reference to 802.11-2016.
Fixes: 9757235f451c ("nl80211: correct checks for NL80211_MESHCONF_HT_OPMODE value")
Cc: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Bob Copeland <bobcopeland@fb.com>
Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
Reviewed-by: Masashi Honma <masashi.honma@gmail.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/nl80211.c | 19 +++----------------
1 file changed, 3 insertions(+), 16 deletions(-)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5847,7 +5847,7 @@ do { \
nl80211_check_s32);
/*
* Check HT operation mode based on
- * IEEE 802.11 2012 8.4.2.59 HT Operation element.
+ * IEEE 802.11-2016 9.4.2.57 HT Operation element.
*/
if (tb[NL80211_MESHCONF_HT_OPMODE]) {
ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
@@ -5857,22 +5857,9 @@ do { \
IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
return -EINVAL;
- if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
- (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
- return -EINVAL;
+ /* NON_HT_STA bit is reserved, but some programs set it */
+ ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
- switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
- case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
- case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
- if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
- return -EINVAL;
- break;
- case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
- case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
- if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
- return -EINVAL;
- break;
- }
cfg->ht_opmode = ht_opmode;
mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 059/130] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 058/130] nl80211: relax ht operation checks for mesh Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 060/130] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes Greg Kroah-Hartman
` (68 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit dd209ef809080ced903e7747ee3ef640c923a1d2 ]
Fix following issues related to planar YUV pixel format configuration:
- NV16/61 modes were incorrectly programmed as NV12/21,
- YVU420 was programmed as YUV420 on source,
- YVU420 and YUV422 were programmed as YUV420 on output.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_gsc.c | 29 ++++++++++++++++++++---------
drivers/gpu/drm/exynos/regs-gsc.h | 1 +
2 files changed, 21 insertions(+), 9 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_gsc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gsc.c
@@ -532,21 +532,25 @@ static int gsc_src_set_fmt(struct device
GSC_IN_CHROMA_ORDER_CRCB);
break;
case DRM_FORMAT_NV21:
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_2P);
+ break;
case DRM_FORMAT_NV61:
- cfg |= (GSC_IN_CHROMA_ORDER_CRCB |
- GSC_IN_YUV420_2P);
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV422_2P);
break;
case DRM_FORMAT_YUV422:
cfg |= GSC_IN_YUV422_3P;
break;
case DRM_FORMAT_YUV420:
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_3P);
+ break;
case DRM_FORMAT_YVU420:
- cfg |= GSC_IN_YUV420_3P;
+ cfg |= (GSC_IN_CHROMA_ORDER_CRCB | GSC_IN_YUV420_3P);
break;
case DRM_FORMAT_NV12:
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV420_2P);
+ break;
case DRM_FORMAT_NV16:
- cfg |= (GSC_IN_CHROMA_ORDER_CBCR |
- GSC_IN_YUV420_2P);
+ cfg |= (GSC_IN_CHROMA_ORDER_CBCR | GSC_IN_YUV422_2P);
break;
default:
dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
@@ -806,18 +810,25 @@ static int gsc_dst_set_fmt(struct device
GSC_OUT_CHROMA_ORDER_CRCB);
break;
case DRM_FORMAT_NV21:
- case DRM_FORMAT_NV61:
cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_2P);
break;
+ case DRM_FORMAT_NV61:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV422_2P);
+ break;
case DRM_FORMAT_YUV422:
+ cfg |= GSC_OUT_YUV422_3P;
+ break;
case DRM_FORMAT_YUV420:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_3P);
+ break;
case DRM_FORMAT_YVU420:
- cfg |= GSC_OUT_YUV420_3P;
+ cfg |= (GSC_OUT_CHROMA_ORDER_CRCB | GSC_OUT_YUV420_3P);
break;
case DRM_FORMAT_NV12:
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV420_2P);
+ break;
case DRM_FORMAT_NV16:
- cfg |= (GSC_OUT_CHROMA_ORDER_CBCR |
- GSC_OUT_YUV420_2P);
+ cfg |= (GSC_OUT_CHROMA_ORDER_CBCR | GSC_OUT_YUV422_2P);
break;
default:
dev_err(ippdrv->dev, "invalid target yuv order 0x%x.\n", fmt);
--- a/drivers/gpu/drm/exynos/regs-gsc.h
+++ b/drivers/gpu/drm/exynos/regs-gsc.h
@@ -138,6 +138,7 @@
#define GSC_OUT_YUV420_3P (3 << 4)
#define GSC_OUT_YUV422_1P (4 << 4)
#define GSC_OUT_YUV422_2P (5 << 4)
+#define GSC_OUT_YUV422_3P (6 << 4)
#define GSC_OUT_YUV444 (7 << 4)
#define GSC_OUT_TILE_TYPE_MASK (1 << 2)
#define GSC_OUT_TILE_C_16x8 (0 << 2)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 060/130] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 059/130] drm/exynos: gsc: Fix support for NV16/61, YUV420/YVU420 and YUV422 modes Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 061/130] drm/exynos: decon5433: Fix WINCONx reset value Greg Kroah-Hartman
` (67 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit ab337fc274a1957ff0771f19e826c736253f7c39 ]
Set per-plane global alpha to maximum value to get proper blending of
XRGB and ARGB planes. This fixes the strange order of overlapping planes.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -291,8 +291,8 @@ static void decon_update_plane(struct ex
COORDINATE_Y(state->crtc.y + state->crtc.h - 1);
writel(val, ctx->addr + DECON_VIDOSDxB(win));
- val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
- VIDOSD_Wx_ALPHA_B_F(0x0);
+ val = VIDOSD_Wx_ALPHA_R_F(0xff) | VIDOSD_Wx_ALPHA_G_F(0xff) |
+ VIDOSD_Wx_ALPHA_B_F(0xff);
writel(val, ctx->addr + DECON_VIDOSDxC(win));
val = VIDOSD_Wx_ALPHA_R_F(0x0) | VIDOSD_Wx_ALPHA_G_F(0x0) |
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 061/130] drm/exynos: decon5433: Fix WINCONx reset value
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 060/130] drm/exynos: decon5433: Fix per-plane global alpha for XRGB modes Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 062/130] bpf, s390: fix potential memleak when later bpf_jit_prog fails Greg Kroah-Hartman
` (66 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 7b7aa62c05eac9789c208b946f515983a9255d8d ]
The only bits that should be preserved in decon_win_set_fmt() is
WINCONx_ENWIN_F. All other bits depends on the selected pixel formats and
are set by the mentioned function.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c
@@ -199,7 +199,7 @@ static void decon_win_set_pixfmt(struct
unsigned long val;
val = readl(ctx->addr + DECON_WINCONx(win));
- val &= ~WINCONx_BPPMODE_MASK;
+ val &= WINCONx_ENWIN_F;
switch (fb->pixel_format) {
case DRM_FORMAT_XRGB1555:
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 062/130] bpf, s390: fix potential memleak when later bpf_jit_prog fails
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 061/130] drm/exynos: decon5433: Fix WINCONx reset value Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:52 ` [PATCH 4.9 063/130] PCI: xilinx: Add missing of_node_put() Greg Kroah-Hartman
` (65 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Borkmann, Martin Schwidefsky,
Alexei Starovoitov, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
[ Upstream commit f605ce5eb26ac934fb8106d75d46a2c875a2bf23 ]
If we would ever fail in the bpf_jit_prog() pass that writes the
actual insns to the image after we got header via bpf_jit_binary_alloc()
then we also need to make sure to free it through bpf_jit_binary_free()
again when bailing out. Given we had prior bpf_jit_prog() passes to
initially probe for clobbered registers, program size and to fill in
addrs arrray for jump targets, this is more of a theoretical one,
but at least make sure this doesn't break with future changes.
Fixes: 054623105728 ("s390/bpf: Add s390x eBPF JIT compiler backend")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/net/bpf_jit_comp.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -1386,6 +1386,7 @@ struct bpf_prog *bpf_int_jit_compile(str
goto free_addrs;
}
if (bpf_jit_prog(&jit, fp)) {
+ bpf_jit_binary_free(header);
fp = orig_fp;
goto free_addrs;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 063/130] PCI: xilinx: Add missing of_node_put()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 062/130] bpf, s390: fix potential memleak when later bpf_jit_prog fails Greg Kroah-Hartman
@ 2018-08-23 7:52 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 064/130] PCI: xilinx-nwl: " Greg Kroah-Hartman
` (64 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:52 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Lorenzo Pieralisi,
Bjorn Helgaas, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <hofrat@osadl.org>
[ Upstream commit 8c3f9bd851a4d3acf0a0f222d4e9e41c0cd1ea8e ]
The call to of_get_next_child() returns a node pointer with refcount
incremented thus it must be explicitly decremented here after the last
usage.
Fixes: 8961def56845 ("PCI: xilinx: Add Xilinx AXI PCIe Host Bridge IP driver")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[lorenzo.pieralisi@arm.com: reworked commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-xilinx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/host/pcie-xilinx.c
+++ b/drivers/pci/host/pcie-xilinx.c
@@ -527,6 +527,7 @@ static int xilinx_pcie_init_irq_domain(s
port->leg_domain = irq_domain_add_linear(pcie_intc_node, 4,
&intx_domain_ops,
port);
+ of_node_put(pcie_intc_node);
if (!port->leg_domain) {
dev_err(dev, "Failed to get a INTx IRQ domain\n");
return -ENODEV;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 064/130] PCI: xilinx-nwl: Add missing of_node_put()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2018-08-23 7:52 ` [PATCH 4.9 063/130] PCI: xilinx: Add missing of_node_put() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 065/130] bnx2x: Fix receiving tx-timeout in error or recovery state Greg Kroah-Hartman
` (63 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nicholas Mc Guire, Lorenzo Pieralisi,
Bjorn Helgaas, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <hofrat@osadl.org>
[ Upstream commit 342639d996f18bc0a4db2f42a84230c0a966dc94 ]
The call to of_get_next_child() returns a node pointer with
refcount incremented thus it must be explicitly decremented
here after the last usage.
Fixes: ab597d35ef11 ("PCI: xilinx-nwl: Add support for Xilinx NWL PCIe Host Controller")
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
[lorenzo.pieralisi@arm.com: updated commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-xilinx-nwl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/host/pcie-xilinx-nwl.c
+++ b/drivers/pci/host/pcie-xilinx-nwl.c
@@ -532,7 +532,7 @@ static int nwl_pcie_init_irq_domain(stru
INTX_NUM,
&legacy_domain_ops,
pcie);
-
+ of_node_put(legacy_intc_node);
if (!pcie->legacy_irq_domain) {
dev_err(dev, "failed to create IRQ domain\n");
return -ENOMEM;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 065/130] bnx2x: Fix receiving tx-timeout in error or recovery state.
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 064/130] PCI: xilinx-nwl: " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 066/130] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value Greg Kroah-Hartman
` (62 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudarsana Reddy Kalluru, Ariel Elior,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudarsana Reddy Kalluru <sudarsana.kalluru@cavium.com>
[ Upstream commit 484c016d9392786ce5c74017c206c706f29f823d ]
Driver performs the internal reload when it receives tx-timeout event from
the OS. Internal reload might fail in some scenarios e.g., fatal HW issues.
In such cases OS still see the link, which would result in undesirable
functionalities such as re-generation of tx-timeouts.
The patch addresses this issue by indicating the link-down to OS when
tx-timeout is detected, and keeping the link in down state till the
internal reload is successful.
Please consider applying it to 'net' branch.
Signed-off-by: Sudarsana Reddy Kalluru <Sudarsana.Kalluru@cavium.com>
Signed-off-by: Ariel Elior <ariel.elior@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 1 +
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 ++++++
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 6 ++++++
3 files changed, 13 insertions(+)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -1529,6 +1529,7 @@ struct bnx2x {
struct link_vars link_vars;
u32 link_cnt;
struct bnx2x_link_report_data last_reported_link;
+ bool force_link_down;
struct mdio_if_info mdio;
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1265,6 +1265,11 @@ void __bnx2x_link_report(struct bnx2x *b
{
struct bnx2x_link_report_data cur_data;
+ if (bp->force_link_down) {
+ bp->link_vars.link_up = 0;
+ return;
+ }
+
/* reread mf_cfg */
if (IS_PF(bp) && !CHIP_IS_E1(bp))
bnx2x_read_mf_cfg(bp);
@@ -2822,6 +2827,7 @@ int bnx2x_nic_load(struct bnx2x *bp, int
bp->pending_max = 0;
}
+ bp->force_link_down = false;
if (bp->port.pmf) {
rc = bnx2x_initial_phy_init(bp, load_mode);
if (rc)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -10279,6 +10279,12 @@ static void bnx2x_sp_rtnl_task(struct wo
bp->sp_rtnl_state = 0;
smp_mb();
+ /* Immediately indicate link as down */
+ bp->link_vars.link_up = 0;
+ bp->force_link_down = true;
+ netif_carrier_off(bp->dev);
+ BNX2X_ERR("Indicating link is down due to Tx-timeout\n");
+
bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
bnx2x_nic_load(bp, LOAD_NORMAL);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 066/130] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 065/130] bnx2x: Fix receiving tx-timeout in error or recovery state Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 068/130] objtool: Support GCC 8 -fnoreorder-functions Greg Kroah-Hartman
` (61 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jiang, Dan Williams, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit c1985cefd844e26bd19673a6df8d8f0b1918c2db ]
cmd_rc is passed in by reference to the acpi_nfit_ctl() function and the
caller expects a value returned. However, when the package is pass through
via the ND_CMD_CALL command, cmd_rc is not touched. Make sure cmd_rc is
always set.
Fixes: aef253382266 ("libnvdimm, nfit: centralize command status translation")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -201,6 +201,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
const u8 *uuid;
int rc, i;
+ *cmd_rc = -EINVAL;
func = cmd;
if (cmd == ND_CMD_CALL) {
call_pkg = buf;
@@ -288,6 +289,7 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
* If we return an error (like elsewhere) then caller wouldn't
* be able to rely upon data returned to make calculation.
*/
+ *cmd_rc = 0;
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 068/130] objtool: Support GCC 8 -fnoreorder-functions
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 066/130] acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 069/130] ipvlan: call dev_change_flags when ipvlan mode is reset Greg Kroah-Hartman
` (60 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Allan Xavier,
Andy Lutomirski, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Linus Torvalds, Peter Zijlstra, Thomas Gleixner,
Ingo Molnar, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
[ Upstream commit 08b393d01c88aff27347ed2b1b354eb4db2f1532 ]
Since the following commit:
cd77849a69cf ("objtool: Fix GCC 8 cold subfunction detection for aliased functions")
... if the kernel is built with EXTRA_CFLAGS='-fno-reorder-functions',
objtool can get stuck in an infinite loop.
That flag causes the new GCC 8 cold subfunctions to be placed in .text
instead of .text.unlikely. But it also has an unfortunate quirk: in the
symbol table, the subfunction (e.g., nmi_panic.cold.7) is nested inside
the parent (nmi_panic).
That function overlap confuses objtool, and causes it to get into an
infinite loop in next_insn_same_func(). Here's Allan's description of
the loop:
"Objtool iterates through the instructions in nmi_panic using
next_insn_same_func. Once it reaches the end of nmi_panic at 0x534 it
jumps to 0x528 as that's the start of nmi_panic.cold.7. However, since
the instructions starting at 0x528 are still associated with nmi_panic
objtool will get stuck in a loop, continually jumping back to 0x528
after reaching 0x534."
Fix it by shortening the length of the parent function so that the
functions no longer overlap.
Reported-and-analyzed-by: Allan Xavier <allan.x.xavier@oracle.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Allan Xavier <allan.x.xavier@oracle.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/9e704c52bee651129b036be14feda317ae5606ae.1530136978.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/objtool/elf.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -302,19 +302,34 @@ static int read_symbols(struct elf *elf)
continue;
sym->pfunc = sym->cfunc = sym;
coldstr = strstr(sym->name, ".cold.");
- if (coldstr) {
- coldstr[0] = '\0';
- pfunc = find_symbol_by_name(elf, sym->name);
- coldstr[0] = '.';
+ if (!coldstr)
+ continue;
+
+ coldstr[0] = '\0';
+ pfunc = find_symbol_by_name(elf, sym->name);
+ coldstr[0] = '.';
+
+ if (!pfunc) {
+ WARN("%s(): can't find parent function",
+ sym->name);
+ goto err;
+ }
- if (!pfunc) {
- WARN("%s(): can't find parent function",
- sym->name);
- goto err;
- }
+ sym->pfunc = pfunc;
+ pfunc->cfunc = sym;
- sym->pfunc = pfunc;
- pfunc->cfunc = sym;
+ /*
+ * Unfortunately, -fnoreorder-functions puts the child
+ * inside the parent. Remove the overlap so we can
+ * have sane assumptions.
+ *
+ * Note that pfunc->len now no longer matches
+ * pfunc->sym.st_size.
+ */
+ if (sym->sec == pfunc->sec &&
+ sym->offset >= pfunc->offset &&
+ sym->offset + sym->len == pfunc->offset + pfunc->len) {
+ pfunc->len -= sym->len;
}
}
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 069/130] ipvlan: call dev_change_flags when ipvlan mode is reset
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 068/130] objtool: Support GCC 8 -fnoreorder-functions Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 070/130] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos Greg Kroah-Hartman
` (59 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianlin Shi, Stefano Brivio,
Sabrina Dubroca, Hangbin Liu, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 5dc2d3996a8b221c20dd0900bdad45031a572530 ]
After we change the ipvlan mode from l3 to l2, or vice versa, we only
reset IFF_NOARP flag, but don't flush the ARP table cache, which will
cause eth->h_dest to be equal to eth->h_source in ipvlan_xmit_mode_l2().
Then the message will not come out of host.
Here is the reproducer on local host:
ip link set eth1 up
ip addr add 192.168.1.1/24 dev eth1
ip link add link eth1 ipvlan1 type ipvlan mode l3
ip netns add net1
ip link set ipvlan1 netns net1
ip netns exec net1 ip link set ipvlan1 up
ip netns exec net1 ip addr add 192.168.2.1/24 dev ipvlan1
ip route add 192.168.2.0/24 via 192.168.1.2
ping 192.168.2.2 -c 2
ip netns exec net1 ip link set ipvlan1 type ipvlan mode l2
ping 192.168.2.2 -c 2
Add the same configuration on remote host. After we set the mode to l2,
we could find that the src/dst MAC addresses are the same on eth1:
21:26:06.648565 00:b7:13:ad:d3:05 > 00:b7:13:ad:d3:05, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 58356, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.2.1 > 192.168.2.2: ICMP echo request, id 22686, seq 1, length 64
Fix this by calling dev_change_flags(), which will call netdevice notifier
with flag change info.
v2:
a) As pointed out by Wang Cong, check return value for dev_change_flags() when
change dev flags.
b) As suggested by Stefano and Sabrina, move flags setting before l3mdev_ops.
So we don't need to redo ipvlan_{, un}register_nf_hook() again in err path.
Reported-by: Jianlin Shi <jishi@redhat.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Fixes: 2ad7bf3638411 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipvlan/ipvlan_main.c | 36 ++++++++++++++++++++++++++++--------
1 file changed, 28 insertions(+), 8 deletions(-)
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -63,10 +63,23 @@ static int ipvlan_set_port_mode(struct i
{
struct ipvl_dev *ipvlan;
struct net_device *mdev = port->dev;
- int err = 0;
+ unsigned int flags;
+ int err;
ASSERT_RTNL();
if (port->mode != nval) {
+ list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
+ flags = ipvlan->dev->flags;
+ if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S) {
+ err = dev_change_flags(ipvlan->dev,
+ flags | IFF_NOARP);
+ } else {
+ err = dev_change_flags(ipvlan->dev,
+ flags & ~IFF_NOARP);
+ }
+ if (unlikely(err))
+ goto fail;
+ }
if (nval == IPVLAN_MODE_L3S) {
/* New mode is L3S */
err = ipvlan_register_nf_hook();
@@ -74,21 +87,28 @@ static int ipvlan_set_port_mode(struct i
mdev->l3mdev_ops = &ipvl_l3mdev_ops;
mdev->priv_flags |= IFF_L3MDEV_MASTER;
} else
- return err;
+ goto fail;
} else if (port->mode == IPVLAN_MODE_L3S) {
/* Old mode was L3S */
mdev->priv_flags &= ~IFF_L3MDEV_MASTER;
ipvlan_unregister_nf_hook();
mdev->l3mdev_ops = NULL;
}
- list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
- if (nval == IPVLAN_MODE_L3 || nval == IPVLAN_MODE_L3S)
- ipvlan->dev->flags |= IFF_NOARP;
- else
- ipvlan->dev->flags &= ~IFF_NOARP;
- }
port->mode = nval;
}
+ return 0;
+
+fail:
+ /* Undo the flags changes that have been done so far. */
+ list_for_each_entry_continue_reverse(ipvlan, &port->ipvlans, pnode) {
+ flags = ipvlan->dev->flags;
+ if (port->mode == IPVLAN_MODE_L3 ||
+ port->mode == IPVLAN_MODE_L3S)
+ dev_change_flags(ipvlan->dev, flags | IFF_NOARP);
+ else
+ dev_change_flags(ipvlan->dev, flags & ~IFF_NOARP);
+ }
+
return err;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 070/130] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 069/130] ipvlan: call dev_change_flags when ipvlan mode is reset Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 071/130] ARM: imx_v6_v7_defconfig: Select ULPI support Greg Kroah-Hartman
` (58 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Gerecke, Jiri Kosina, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <killertofu@gmail.com>
[ Upstream commit 3b8d573586d1b9dee33edf6cb6f2ca05f4bca568 ]
The touch sensors on the 2nd-gen Intuos tablets don't use a 4096x4096
sensor like other similar tablets (3rd-gen Bamboo, Intuos5, etc.).
The incorrect maximum XY values don't normally affect userspace since
touch input from these devices is typically relative rather than
absolute. It does, however, cause problems when absolute distances
need to be measured, e.g. for gesture recognition. Since the resolution
of the touch sensor on these devices is 10 units / mm (versus 100 for
the pen sensor), the proper maximum values can be calculated by simply
dividing by 10.
Fixes: b5fd2a3e92 ("Input: wacom - add support for three new Intuos devices")
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2429,8 +2429,14 @@ void wacom_setup_device_quirks(struct wa
if (features->type >= INTUOSHT && features->type <= BAMBOO_PT)
features->device_type |= WACOM_DEVICETYPE_PAD;
- features->x_max = 4096;
- features->y_max = 4096;
+ if (features->type == INTUOSHT2) {
+ features->x_max = features->x_max / 10;
+ features->y_max = features->y_max / 10;
+ }
+ else {
+ features->x_max = 4096;
+ features->y_max = 4096;
+ }
}
else if (features->pktlen == WACOM_PKGLEN_BBTOUCH) {
features->device_type |= WACOM_DEVICETYPE_PAD;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 071/130] ARM: imx_v6_v7_defconfig: Select ULPI support
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 070/130] HID: wacom: Correct touch maximum XY of 2nd-gen Intuos Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 072/130] ARM: imx_v4_v5_defconfig: " Greg Kroah-Hartman
` (57 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Smirnov, Fabio Estevam,
Shawn Guo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
[ Upstream commit 157bcc06094c3c5800d3f4676527047b79b618e7 ]
Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
USB ULPI can be functional on some boards like imx51-babbge.
This fixes a kernel hang in 4.18-rc1 on i.mx51-babbage, caused by commit
03e6275ae381 ("usb: chipidea: Fix ULPI on imx51").
Suggested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/imx_v6_v7_defconfig | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/configs/imx_v6_v7_defconfig
+++ b/arch/arm/configs/imx_v6_v7_defconfig
@@ -271,6 +271,7 @@ CONFIG_USB_STORAGE=y
CONFIG_USB_CHIPIDEA=y
CONFIG_USB_CHIPIDEA_UDC=y
CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_ULPI=y
CONFIG_USB_SERIAL=m
CONFIG_USB_SERIAL_GENERIC=y
CONFIG_USB_SERIAL_FTDI_SIO=m
@@ -307,6 +308,7 @@ CONFIG_USB_GADGETFS=m
CONFIG_USB_FUNCTIONFS=m
CONFIG_USB_MASS_STORAGE=m
CONFIG_USB_G_SERIAL=m
+CONFIG_USB_ULPI_BUS=y
CONFIG_MMC=y
CONFIG_MMC_SDHCI=y
CONFIG_MMC_SDHCI_PLTFM=y
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 072/130] ARM: imx_v4_v5_defconfig: Select ULPI support
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 071/130] ARM: imx_v6_v7_defconfig: Select ULPI support Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 074/130] kasan: fix shadow_size calculation error in kasan_module_alloc Greg Kroah-Hartman
` (56 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@nxp.com>
[ Upstream commit 2ceb2780b790b74bc408a949f6aedbad8afa693e ]
Select CONFIG_USB_CHIPIDEA_ULPI and CONFIG_USB_ULPI_BUS so that
USB ULPI can be functional on some boards like that use ULPI
interface.
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/imx_v4_v5_defconfig | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/configs/imx_v4_v5_defconfig
+++ b/arch/arm/configs/imx_v4_v5_defconfig
@@ -145,9 +145,11 @@ CONFIG_USB_STORAGE=y
CONFIG_USB_CHIPIDEA=y
CONFIG_USB_CHIPIDEA_UDC=y
CONFIG_USB_CHIPIDEA_HOST=y
+CONFIG_USB_CHIPIDEA_ULPI=y
CONFIG_NOP_USB_XCEIV=y
CONFIG_USB_GADGET=y
CONFIG_USB_ETH=m
+CONFIG_USB_ULPI_BUS=y
CONFIG_MMC=y
CONFIG_MMC_SDHCI=y
CONFIG_MMC_SDHCI_PLTFM=y
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 074/130] kasan: fix shadow_size calculation error in kasan_module_alloc
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 072/130] ARM: imx_v4_v5_defconfig: " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 075/130] smsc75xx: Add workaround for gigabit link up hardware errata Greg Kroah-Hartman
` (55 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhen Lei, Dmitriy Vyukov,
Andrey Ryabinin, Alexander Potapenko, Hanjun Guo, Libin,
Andrew Morton, Linus Torvalds, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <thunder.leizhen@huawei.com>
[ Upstream commit 1e8e18f694a52d703665012ca486826f64bac29d ]
There is a special case that the size is "(N << KASAN_SHADOW_SCALE_SHIFT)
Pages plus X", the value of X is [1, KASAN_SHADOW_SCALE_SIZE-1]. The
operation "size >> KASAN_SHADOW_SCALE_SHIFT" will drop X, and the
roundup operation can not retrieve the missed one page. For example:
size=0x28006, PAGE_SIZE=0x1000, KASAN_SHADOW_SCALE_SHIFT=3, we will get
shadow_size=0x5000, but actually we need 6 pages.
shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT, PAGE_SIZE);
This can lead to a kernel crash when kasan is enabled and the value of
mod->core_layout.size or mod->init_layout.size is like above. Because
the shadow memory of X has not been allocated and mapped.
move_module:
ptr = module_alloc(mod->core_layout.size);
...
memset(ptr, 0, mod->core_layout.size); //crashed
Unable to handle kernel paging request at virtual address ffff0fffff97b000
......
Call trace:
__asan_storeN+0x174/0x1a8
memset+0x24/0x48
layout_and_allocate+0xcd8/0x1800
load_module+0x190/0x23e8
SyS_finit_module+0x148/0x180
Link: http://lkml.kernel.org/r/1529659626-12660-1-git-send-email-thunder.leizhen@huawei.com
Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com>
Reviewed-by: Dmitriy Vyukov <dvyukov@google.com>
Acked-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Libin <huawei.libin@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kasan/kasan.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -660,12 +660,13 @@ void kasan_kfree_large(const void *ptr)
int kasan_module_alloc(void *addr, size_t size)
{
void *ret;
+ size_t scaled_size;
size_t shadow_size;
unsigned long shadow_start;
shadow_start = (unsigned long)kasan_mem_to_shadow(addr);
- shadow_size = round_up(size >> KASAN_SHADOW_SCALE_SHIFT,
- PAGE_SIZE);
+ scaled_size = (size + KASAN_SHADOW_MASK) >> KASAN_SHADOW_SCALE_SHIFT;
+ shadow_size = round_up(scaled_size, PAGE_SIZE);
if (WARN_ON(!PAGE_ALIGNED(shadow_start)))
return -EINVAL;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 075/130] smsc75xx: Add workaround for gigabit link up hardware errata.
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 074/130] kasan: fix shadow_size calculation error in kasan_module_alloc Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 076/130] samples/bpf: add missing <linux/if_vlan.h> Greg Kroah-Hartman
` (54 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yuiko Oshino, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuiko Oshino <yuiko.oshino@microchip.com>
[ Upstream commit d461e3da905332189aad546b2ad9adbe6071c7cc ]
In certain conditions, the device may not be able to link in gigabit mode. This software workaround ensures that the device will not enter the failure state.
Fixes: d0cad871703b898a442e4049c532ec39168e5b57 ("SMSC75XX USB 2.0 Gigabit Ethernet Devices")
Signed-off-by: Yuiko Oshino <yuiko.oshino@microchip.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/smsc75xx.c | 62 +++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 62 insertions(+)
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -82,6 +82,9 @@ static bool turbo_mode = true;
module_param(turbo_mode, bool, 0644);
MODULE_PARM_DESC(turbo_mode, "Enable multiple frames per Rx transaction");
+static int smsc75xx_link_ok_nopm(struct usbnet *dev);
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev);
+
static int __must_check __smsc75xx_read_reg(struct usbnet *dev, u32 index,
u32 *data, int in_pm)
{
@@ -852,6 +855,9 @@ static int smsc75xx_phy_initialize(struc
return -EIO;
}
+ /* phy workaround for gig link */
+ smsc75xx_phy_gig_workaround(dev);
+
smsc75xx_mdio_write(dev->net, dev->mii.phy_id, MII_ADVERTISE,
ADVERTISE_ALL | ADVERTISE_CSMA | ADVERTISE_PAUSE_CAP |
ADVERTISE_PAUSE_ASYM);
@@ -990,6 +996,62 @@ static int smsc75xx_wait_ready(struct us
return -EIO;
}
+static int smsc75xx_phy_gig_workaround(struct usbnet *dev)
+{
+ struct mii_if_info *mii = &dev->mii;
+ int ret = 0, timeout = 0;
+ u32 buf, link_up = 0;
+
+ /* Set the phy in Gig loopback */
+ smsc75xx_mdio_write(dev->net, mii->phy_id, MII_BMCR, 0x4040);
+
+ /* Wait for the link up */
+ do {
+ link_up = smsc75xx_link_ok_nopm(dev);
+ usleep_range(10000, 20000);
+ timeout++;
+ } while ((!link_up) && (timeout < 1000));
+
+ if (timeout >= 1000) {
+ netdev_warn(dev->net, "Timeout waiting for PHY link up\n");
+ return -EIO;
+ }
+
+ /* phy reset */
+ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n", ret);
+ return ret;
+ }
+
+ buf |= PMT_CTL_PHY_RST;
+
+ ret = smsc75xx_write_reg(dev, PMT_CTL, buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to write PMT_CTL: %d\n", ret);
+ return ret;
+ }
+
+ timeout = 0;
+ do {
+ usleep_range(10000, 20000);
+ ret = smsc75xx_read_reg(dev, PMT_CTL, &buf);
+ if (ret < 0) {
+ netdev_warn(dev->net, "Failed to read PMT_CTL: %d\n",
+ ret);
+ return ret;
+ }
+ timeout++;
+ } while ((buf & PMT_CTL_PHY_RST) && (timeout < 100));
+
+ if (timeout >= 100) {
+ netdev_warn(dev->net, "timeout waiting for PHY Reset\n");
+ return -EIO;
+ }
+
+ return 0;
+}
+
static int smsc75xx_reset(struct usbnet *dev)
{
struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 076/130] samples/bpf: add missing <linux/if_vlan.h>
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 075/130] smsc75xx: Add workaround for gigabit link up hardware errata Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 077/130] samples/bpf: Check the error of write() and read() Greg Kroah-Hartman
` (53 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Taeung Song, David S. Miller,
Daniel Borkmann, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeung Song <treeze.taeung@gmail.com>
[ Upstream commit 4d5d33a085335ef469c9a87792bcaaaa8e64d8c4 ]
This fixes build error regarding redefinition:
CLANG-bpf samples/bpf/parse_varlen.o
samples/bpf/parse_varlen.c:111:8: error: redefinition of 'vlan_hdr'
struct vlan_hdr {
^
./include/linux/if_vlan.h:38:8: note: previous definition is here
So remove duplicate 'struct vlan_hdr' in sample code and include if_vlan.h
Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
samples/bpf/parse_varlen.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/samples/bpf/parse_varlen.c
+++ b/samples/bpf/parse_varlen.c
@@ -6,6 +6,7 @@
*/
#define KBUILD_MODNAME "foo"
#include <linux/if_ether.h>
+#include <linux/if_vlan.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/in.h>
@@ -108,11 +109,6 @@ static int parse_ipv6(void *data, uint64
return 0;
}
-struct vlan_hdr {
- uint16_t h_vlan_TCI;
- uint16_t h_vlan_encapsulated_proto;
-};
-
SEC("varlen")
int handle_ingress(struct __sk_buff *skb)
{
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 077/130] samples/bpf: Check the error of write() and read()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 076/130] samples/bpf: add missing <linux/if_vlan.h> Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 078/130] ieee802154: 6lowpan: set IFLA_LINK Greg Kroah-Hartman
` (52 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Laight, Taeung Song,
David S. Miller, Daniel Borkmann, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taeung Song <treeze.taeung@gmail.com>
[ Upstream commit 02a2f000a3629274bfad60bfc4de9edec49e63e7 ]
test_task_rename() and test_urandom_read()
can be failed during write() and read(),
So check the result of them.
Reviewed-by: David Laight <David.Laight@ACULAB.COM>
Signed-off-by: Taeung Song <treeze.taeung@gmail.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
samples/bpf/test_overhead_user.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
--- a/samples/bpf/test_overhead_user.c
+++ b/samples/bpf/test_overhead_user.c
@@ -6,6 +6,7 @@
*/
#define _GNU_SOURCE
#include <sched.h>
+#include <errno.h>
#include <stdio.h>
#include <sys/types.h>
#include <asm/unistd.h>
@@ -44,8 +45,13 @@ static void test_task_rename(int cpu)
exit(1);
}
start_time = time_get_ns();
- for (i = 0; i < MAX_CNT; i++)
- write(fd, buf, sizeof(buf));
+ for (i = 0; i < MAX_CNT; i++) {
+ if (write(fd, buf, sizeof(buf)) < 0) {
+ printf("task rename failed: %s\n", strerror(errno));
+ close(fd);
+ return;
+ }
+ }
printf("task_rename:%d: %lld events per sec\n",
cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
close(fd);
@@ -63,8 +69,13 @@ static void test_urandom_read(int cpu)
exit(1);
}
start_time = time_get_ns();
- for (i = 0; i < MAX_CNT; i++)
- read(fd, buf, sizeof(buf));
+ for (i = 0; i < MAX_CNT; i++) {
+ if (read(fd, buf, sizeof(buf)) < 0) {
+ printf("failed to read from /dev/urandom: %s\n", strerror(errno));
+ close(fd);
+ return;
+ }
+ }
printf("urandom_read:%d: %lld events per sec\n",
cpu, MAX_CNT * 1000000000ll / (time_get_ns() - start_time));
close(fd);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 078/130] ieee802154: 6lowpan: set IFLA_LINK
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 077/130] samples/bpf: Check the error of write() and read() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 079/130] netfilter: x_tables: set module owner for icmp(6) matches Greg Kroah-Hartman
` (51 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lubomir Rintel, Alexander Aring,
Stefan Schmidt, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lubomir Rintel <lkundrak@v3.sk>
[ Upstream commit b30c122c0bbb0a1dc413085e177ea09467e65fdb ]
Otherwise NetworkManager (and iproute alike) is not able to identify the
parent IEEE 802.15.4 interface of a 6LoWPAN link.
Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
Acked-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ieee802154/6lowpan/core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/ieee802154/6lowpan/core.c
+++ b/net/ieee802154/6lowpan/core.c
@@ -90,12 +90,18 @@ static int lowpan_neigh_construct(struct
return 0;
}
+static int lowpan_get_iflink(const struct net_device *dev)
+{
+ return lowpan_802154_dev(dev)->wdev->ifindex;
+}
+
static const struct net_device_ops lowpan_netdev_ops = {
.ndo_init = lowpan_dev_init,
.ndo_start_xmit = lowpan_xmit,
.ndo_open = lowpan_open,
.ndo_stop = lowpan_stop,
.ndo_neigh_construct = lowpan_neigh_construct,
+ .ndo_get_iflink = lowpan_get_iflink,
};
static void lowpan_setup(struct net_device *ldev)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 079/130] netfilter: x_tables: set module owner for icmp(6) matches
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 078/130] ieee802154: 6lowpan: set IFLA_LINK Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 080/130] ipv6: make ipv6_renew_options() interrupt/kernel safe Greg Kroah-Hartman
` (50 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit d376bef9c29b3c65aeee4e785fffcd97ef0a9a81 ]
nft_compat relies on xt_request_find_match to increment
refcount of the module that provides the match/target.
The (builtin) icmp matches did't set the module owner so it
was possible to rmmod ip(6)tables while icmp extensions were still in use.
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/ip_tables.c | 1 +
net/ipv6/netfilter/ip6_tables.c | 1 +
2 files changed, 2 insertions(+)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1913,6 +1913,7 @@ static struct xt_match ipt_builtin_mt[]
.checkentry = icmp_checkentry,
.proto = IPPROTO_ICMP,
.family = NFPROTO_IPV4,
+ .me = THIS_MODULE,
},
};
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1934,6 +1934,7 @@ static struct xt_match ip6t_builtin_mt[]
.checkentry = icmp6_checkentry,
.proto = IPPROTO_ICMPV6,
.family = NFPROTO_IPV6,
+ .me = THIS_MODULE,
},
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 080/130] ipv6: make ipv6_renew_options() interrupt/kernel safe
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 079/130] netfilter: x_tables: set module owner for icmp(6) matches Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 081/130] net: qrtr: Broadcast messages only from control port Greg Kroah-Hartman
` (49 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Al Viro, Paul Moore, David S. Miller,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit a9ba23d48dbc6ffd08426bb10f05720e0b9f5c14 ]
At present the ipv6_renew_options_kern() function ends up calling into
access_ok() which is problematic if done from inside an interrupt as
access_ok() calls WARN_ON_IN_IRQ() on some (all?) architectures
(x86-64 is affected). Example warning/backtrace is shown below:
WARNING: CPU: 1 PID: 3144 at lib/usercopy.c:11 _copy_from_user+0x85/0x90
...
Call Trace:
<IRQ>
ipv6_renew_option+0xb2/0xf0
ipv6_renew_options+0x26a/0x340
ipv6_renew_options_kern+0x2c/0x40
calipso_req_setattr+0x72/0xe0
netlbl_req_setattr+0x126/0x1b0
selinux_netlbl_inet_conn_request+0x80/0x100
selinux_inet_conn_request+0x6d/0xb0
security_inet_conn_request+0x32/0x50
tcp_conn_request+0x35f/0xe00
? __lock_acquire+0x250/0x16c0
? selinux_socket_sock_rcv_skb+0x1ae/0x210
? tcp_rcv_state_process+0x289/0x106b
tcp_rcv_state_process+0x289/0x106b
? tcp_v6_do_rcv+0x1a7/0x3c0
tcp_v6_do_rcv+0x1a7/0x3c0
tcp_v6_rcv+0xc82/0xcf0
ip6_input_finish+0x10d/0x690
ip6_input+0x45/0x1e0
? ip6_rcv_finish+0x1d0/0x1d0
ipv6_rcv+0x32b/0x880
? ip6_make_skb+0x1e0/0x1e0
__netif_receive_skb_core+0x6f2/0xdf0
? process_backlog+0x85/0x250
? process_backlog+0x85/0x250
? process_backlog+0xec/0x250
process_backlog+0xec/0x250
net_rx_action+0x153/0x480
__do_softirq+0xd9/0x4f7
do_softirq_own_stack+0x2a/0x40
</IRQ>
...
While not present in the backtrace, ipv6_renew_option() ends up calling
access_ok() via the following chain:
access_ok()
_copy_from_user()
copy_from_user()
ipv6_renew_option()
The fix presented in this patch is to perform the userspace copy
earlier in the call chain such that it is only called when the option
data is actually coming from userspace; that place is
do_ipv6_setsockopt(). Not only does this solve the problem seen in
the backtrace above, it also allows us to simplify the code quite a
bit by removing ipv6_renew_options_kern() completely. We also take
this opportunity to cleanup ipv6_renew_options()/ipv6_renew_option()
a small amount as well.
This patch is heavily based on a rough patch by Al Viro. I've taken
his original patch, converted a kmemdup() call in do_ipv6_setsockopt()
to a memdup_user() call, made better use of the e_inval jump target in
the same function, and cleaned up the use ipv6_renew_option() by
ipv6_renew_options().
CC: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/ipv6.h | 9 ---
net/ipv6/calipso.c | 9 +--
net/ipv6/exthdrs.c | 111 ++++++++++++-----------------------------------
net/ipv6/ipv6_sockglue.c | 27 ++++++++---
4 files changed, 53 insertions(+), 103 deletions(-)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -312,14 +312,7 @@ struct ipv6_txoptions *ipv6_dup_options(
struct ipv6_txoptions *ipv6_renew_options(struct sock *sk,
struct ipv6_txoptions *opt,
int newtype,
- struct ipv6_opt_hdr __user *newopt,
- int newoptlen);
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk,
- struct ipv6_txoptions *opt,
- int newtype,
- struct ipv6_opt_hdr *newopt,
- int newoptlen);
+ struct ipv6_opt_hdr *newopt);
struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
struct ipv6_txoptions *opt);
--- a/net/ipv6/calipso.c
+++ b/net/ipv6/calipso.c
@@ -799,8 +799,7 @@ static int calipso_opt_update(struct soc
{
struct ipv6_txoptions *old = txopt_get(inet6_sk(sk)), *txopts;
- txopts = ipv6_renew_options_kern(sk, old, IPV6_HOPOPTS,
- hop, hop ? ipv6_optlen(hop) : 0);
+ txopts = ipv6_renew_options(sk, old, IPV6_HOPOPTS, hop);
txopt_put(old);
if (IS_ERR(txopts))
return PTR_ERR(txopts);
@@ -1222,8 +1221,7 @@ static int calipso_req_setattr(struct re
if (IS_ERR(new))
return PTR_ERR(new);
- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
- new, new ? ipv6_optlen(new) : 0);
+ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
kfree(new);
@@ -1260,8 +1258,7 @@ static void calipso_req_delattr(struct r
if (calipso_opt_del(req_inet->ipv6_opt->hopopt, &new))
return; /* Nothing to do */
- txopts = ipv6_renew_options_kern(sk, req_inet->ipv6_opt, IPV6_HOPOPTS,
- new, new ? ipv6_optlen(new) : 0);
+ txopts = ipv6_renew_options(sk, req_inet->ipv6_opt, IPV6_HOPOPTS, new);
if (!IS_ERR(txopts)) {
txopts = xchg(&req_inet->ipv6_opt, txopts);
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -760,29 +760,21 @@ ipv6_dup_options(struct sock *sk, struct
}
EXPORT_SYMBOL_GPL(ipv6_dup_options);
-static int ipv6_renew_option(void *ohdr,
- struct ipv6_opt_hdr __user *newopt, int newoptlen,
- int inherit,
- struct ipv6_opt_hdr **hdr,
- char **p)
+static void ipv6_renew_option(int renewtype,
+ struct ipv6_opt_hdr **dest,
+ struct ipv6_opt_hdr *old,
+ struct ipv6_opt_hdr *new,
+ int newtype, char **p)
{
- if (inherit) {
- if (ohdr) {
- memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
- *hdr = (struct ipv6_opt_hdr *)*p;
- *p += CMSG_ALIGN(ipv6_optlen(*hdr));
- }
- } else {
- if (newopt) {
- if (copy_from_user(*p, newopt, newoptlen))
- return -EFAULT;
- *hdr = (struct ipv6_opt_hdr *)*p;
- if (ipv6_optlen(*hdr) > newoptlen)
- return -EINVAL;
- *p += CMSG_ALIGN(newoptlen);
- }
- }
- return 0;
+ struct ipv6_opt_hdr *src;
+
+ src = (renewtype == newtype ? new : old);
+ if (!src)
+ return;
+
+ memcpy(*p, src, ipv6_optlen(src));
+ *dest = (struct ipv6_opt_hdr *)*p;
+ *p += CMSG_ALIGN(ipv6_optlen(*dest));
}
/**
@@ -808,13 +800,11 @@ static int ipv6_renew_option(void *ohdr,
*/
struct ipv6_txoptions *
ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
- int newtype,
- struct ipv6_opt_hdr __user *newopt, int newoptlen)
+ int newtype, struct ipv6_opt_hdr *newopt)
{
int tot_len = 0;
char *p;
struct ipv6_txoptions *opt2;
- int err;
if (opt) {
if (newtype != IPV6_HOPOPTS && opt->hopopt)
@@ -827,8 +817,8 @@ ipv6_renew_options(struct sock *sk, stru
tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
}
- if (newopt && newoptlen)
- tot_len += CMSG_ALIGN(newoptlen);
+ if (newopt)
+ tot_len += CMSG_ALIGN(ipv6_optlen(newopt));
if (!tot_len)
return NULL;
@@ -843,29 +833,19 @@ ipv6_renew_options(struct sock *sk, stru
opt2->tot_len = tot_len;
p = (char *)(opt2 + 1);
- err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
- newtype != IPV6_HOPOPTS,
- &opt2->hopopt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
- newtype != IPV6_RTHDRDSTOPTS,
- &opt2->dst0opt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
- newtype != IPV6_RTHDR,
- (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
- if (err)
- goto out;
-
- err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
- newtype != IPV6_DSTOPTS,
- &opt2->dst1opt, &p);
- if (err)
- goto out;
+ ipv6_renew_option(IPV6_HOPOPTS, &opt2->hopopt,
+ (opt ? opt->hopopt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_RTHDRDSTOPTS, &opt2->dst0opt,
+ (opt ? opt->dst0opt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_RTHDR,
+ (struct ipv6_opt_hdr **)&opt2->srcrt,
+ (opt ? (struct ipv6_opt_hdr *)opt->srcrt : NULL),
+ newopt, newtype, &p);
+ ipv6_renew_option(IPV6_DSTOPTS, &opt2->dst1opt,
+ (opt ? opt->dst1opt : NULL),
+ newopt, newtype, &p);
opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
(opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
@@ -873,37 +853,6 @@ ipv6_renew_options(struct sock *sk, stru
opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
return opt2;
-out:
- sock_kfree_s(sk, opt2, opt2->tot_len);
- return ERR_PTR(err);
-}
-
-/**
- * ipv6_renew_options_kern - replace a specific ext hdr with a new one.
- *
- * @sk: sock from which to allocate memory
- * @opt: original options
- * @newtype: option type to replace in @opt
- * @newopt: new option of type @newtype to replace (kernel-mem)
- * @newoptlen: length of @newopt
- *
- * See ipv6_renew_options(). The difference is that @newopt is
- * kernel memory, rather than user memory.
- */
-struct ipv6_txoptions *
-ipv6_renew_options_kern(struct sock *sk, struct ipv6_txoptions *opt,
- int newtype, struct ipv6_opt_hdr *newopt,
- int newoptlen)
-{
- struct ipv6_txoptions *ret_val;
- const mm_segment_t old_fs = get_fs();
-
- set_fs(KERNEL_DS);
- ret_val = ipv6_renew_options(sk, opt, newtype,
- (struct ipv6_opt_hdr __user *)newopt,
- newoptlen);
- set_fs(old_fs);
- return ret_val;
}
struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -390,6 +390,12 @@ static int do_ipv6_setsockopt(struct soc
case IPV6_DSTOPTS:
{
struct ipv6_txoptions *opt;
+ struct ipv6_opt_hdr *new = NULL;
+
+ /* hop-by-hop / destination options are privileged option */
+ retv = -EPERM;
+ if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
+ break;
/* remove any sticky options header with a zero option
* length, per RFC3542.
@@ -401,17 +407,22 @@ static int do_ipv6_setsockopt(struct soc
else if (optlen < sizeof(struct ipv6_opt_hdr) ||
optlen & 0x7 || optlen > 8 * 255)
goto e_inval;
-
- /* hop-by-hop / destination options are privileged option */
- retv = -EPERM;
- if (optname != IPV6_RTHDR && !ns_capable(net->user_ns, CAP_NET_RAW))
- break;
+ else {
+ new = memdup_user(optval, optlen);
+ if (IS_ERR(new)) {
+ retv = PTR_ERR(new);
+ break;
+ }
+ if (unlikely(ipv6_optlen(new) > optlen)) {
+ kfree(new);
+ goto e_inval;
+ }
+ }
opt = rcu_dereference_protected(np->opt,
lockdep_sock_is_held(sk));
- opt = ipv6_renew_options(sk, opt, optname,
- (struct ipv6_opt_hdr __user *)optval,
- optlen);
+ opt = ipv6_renew_options(sk, opt, optname, new);
+ kfree(new);
if (IS_ERR(opt)) {
retv = PTR_ERR(opt);
break;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 081/130] net: qrtr: Broadcast messages only from control port
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 080/130] ipv6: make ipv6_renew_options() interrupt/kernel safe Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 082/130] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool Greg Kroah-Hartman
` (48 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arun Kumar Neelakantam,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arun Kumar Neelakantam <aneela@codeaurora.org>
[ Upstream commit fdf5fd3975666804118e62c69de25dc85cc0909c ]
The broadcast node id should only be sent with the control port id.
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/qrtr/qrtr.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/qrtr/qrtr.c
+++ b/net/qrtr/qrtr.c
@@ -621,6 +621,10 @@ static int qrtr_sendmsg(struct socket *s
node = NULL;
if (addr->sq_node == QRTR_NODE_BCAST) {
enqueue_fn = qrtr_bcast_enqueue;
+ if (addr->sq_port != QRTR_PORT_CTRL) {
+ release_sock(sk);
+ return -ENOTCONN;
+ }
} else if (addr->sq_node == ipc->us.sq_node) {
enqueue_fn = qrtr_local_enqueue;
} else {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 082/130] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 081/130] net: qrtr: Broadcast messages only from control port Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 083/130] sh_eth: fix invalid context bug while changing link options " Greg Kroah-Hartman
` (47 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 53a710b5044d8475faa6813000b6dd659400ef7b ]
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however the helper function is
called in atomic context.
The bug can be reproduced by running "ethtool -r" command, the bug
is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 10 +---------
1 file changed, 1 insertion(+), 9 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2079,18 +2079,10 @@ static void sh_eth_get_regs(struct net_d
static int sh_eth_nway_reset(struct net_device *ndev)
{
- struct sh_eth_private *mdp = netdev_priv(ndev);
- unsigned long flags;
- int ret;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&mdp->lock, flags);
- ret = phy_start_aneg(ndev->phydev);
- spin_unlock_irqrestore(&mdp->lock, flags);
-
- return ret;
+ return phy_start_aneg(ndev->phydev);
}
static u32 sh_eth_get_msglevel(struct net_device *ndev)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 083/130] sh_eth: fix invalid context bug while changing link options by ethtool
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 082/130] sh_eth: fix invalid context bug while calling auto-negotiation by ethtool Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 084/130] ravb: fix invalid context bug while calling auto-negotiation " Greg Kroah-Hartman
` (46 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 5cb3f52a11e18628fc4bee76dd14b1f0b76349de ]
The change fixes sleep in atomic context bug, which is encountered
every time when link settings are changed by ethtool.
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however that helper function is
called in atomic context under a grabbed spinlock, because
phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
replaced phy_ethtool_sset() helpers from phylib.
Now duplex mode setting is enforced in sh_eth_adjust_link() only,
also now RX/TX is disabled when link is put down or modifications
to E-MAC registers ECMR and GECMR are expected for both cases of
checked and ignored link status pin state from E-MAC interrupt handler.
For reference the change is a partial rework of commit 1e1b812bbe10
("sh_eth: fix handling of no LINK signal").
Fixes: dc19e4e5e02f ("sh: sh_eth: Add support ethtool")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 49 ++++++++++------------------------
1 file changed, 15 insertions(+), 34 deletions(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1743,8 +1743,15 @@ static void sh_eth_adjust_link(struct ne
{
struct sh_eth_private *mdp = netdev_priv(ndev);
struct phy_device *phydev = ndev->phydev;
+ unsigned long flags;
int new_state = 0;
+ spin_lock_irqsave(&mdp->lock, flags);
+
+ /* Disable TX and RX right over here, if E-MAC change is ignored */
+ if (mdp->cd->no_psr || mdp->no_ether_link)
+ sh_eth_rcv_snd_disable(ndev);
+
if (phydev->link) {
if (phydev->duplex != mdp->duplex) {
new_state = 1;
@@ -1763,18 +1770,21 @@ static void sh_eth_adjust_link(struct ne
sh_eth_modify(ndev, ECMR, ECMR_TXF, 0);
new_state = 1;
mdp->link = phydev->link;
- if (mdp->cd->no_psr || mdp->no_ether_link)
- sh_eth_rcv_snd_enable(ndev);
}
} else if (mdp->link) {
new_state = 1;
mdp->link = 0;
mdp->speed = 0;
mdp->duplex = -1;
- if (mdp->cd->no_psr || mdp->no_ether_link)
- sh_eth_rcv_snd_disable(ndev);
}
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+ if ((mdp->cd->no_psr || mdp->no_ether_link) && phydev->link)
+ sh_eth_rcv_snd_enable(ndev);
+
+ mmiowb();
+ spin_unlock_irqrestore(&mdp->lock, flags);
+
if (new_state && netif_msg_link(mdp))
phy_print_status(phydev);
}
@@ -1856,39 +1866,10 @@ static int sh_eth_get_link_ksettings(str
static int sh_eth_set_link_ksettings(struct net_device *ndev,
const struct ethtool_link_ksettings *cmd)
{
- struct sh_eth_private *mdp = netdev_priv(ndev);
- unsigned long flags;
- int ret;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&mdp->lock, flags);
-
- /* disable tx and rx */
- sh_eth_rcv_snd_disable(ndev);
-
- ret = phy_ethtool_ksettings_set(ndev->phydev, cmd);
- if (ret)
- goto error_exit;
-
- if (cmd->base.duplex == DUPLEX_FULL)
- mdp->duplex = 1;
- else
- mdp->duplex = 0;
-
- if (mdp->cd->set_duplex)
- mdp->cd->set_duplex(ndev);
-
-error_exit:
- mdelay(1);
-
- /* enable tx and rx */
- sh_eth_rcv_snd_enable(ndev);
-
- spin_unlock_irqrestore(&mdp->lock, flags);
-
- return ret;
+ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
}
/* If it is ever necessary to increase SH_ETH_REG_DUMP_MAX_REGS, the
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 084/130] ravb: fix invalid context bug while calling auto-negotiation by ethtool
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 083/130] sh_eth: fix invalid context bug while changing link options " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 085/130] ravb: fix invalid context bug while changing link options " Greg Kroah-Hartman
` (45 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 0973a4dd79fe56a3beecfcff675ba4c01df0b0c1 ]
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however the helper function is
called in atomic context.
The bug can be reproduced by running "ethtool -r" command, the bug
is reported if CONFIG_DEBUG_ATOMIC_SLEEP build option is enabled.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1122,15 +1122,10 @@ error_exit:
static int ravb_nway_reset(struct net_device *ndev)
{
- struct ravb_private *priv = netdev_priv(ndev);
int error = -ENODEV;
- unsigned long flags;
- if (ndev->phydev) {
- spin_lock_irqsave(&priv->lock, flags);
+ if (ndev->phydev)
error = phy_start_aneg(ndev->phydev);
- spin_unlock_irqrestore(&priv->lock, flags);
- }
return error;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 085/130] ravb: fix invalid context bug while changing link options by ethtool
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 084/130] ravb: fix invalid context bug while calling auto-negotiation " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 086/130] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume Greg Kroah-Hartman
` (44 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vladimir Zapolskiy, Sergei Shtylyov,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
[ Upstream commit 05925e52a7d379192a5fdff2c33710f573190ead ]
The change fixes sleep in atomic context bug, which is encountered
every time when link settings are changed by ethtool.
Since commit 35b5f6b1a82b ("PHYLIB: Locking fixes for PHY I/O
potentially sleeping") phy_start_aneg() function utilizes a mutex
to serialize changes to phy state, however that helper function is
called in atomic context under a grabbed spinlock, because
phy_start_aneg() is called by phy_ethtool_ksettings_set() and by
replaced phy_ethtool_sset() helpers from phylib.
Now duplex mode setting is enforced in ravb_adjust_link() only, also
now RX/TX is disabled when link is put down or modifications to E-MAC
registers ECMR and GECMR are expected for both cases of checked and
ignored link status pin state from E-MAC interrupt handler.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Reviewed-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 49 +++++++++----------------------
1 file changed, 15 insertions(+), 34 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -955,6 +955,13 @@ static void ravb_adjust_link(struct net_
struct ravb_private *priv = netdev_priv(ndev);
struct phy_device *phydev = ndev->phydev;
bool new_state = false;
+ unsigned long flags;
+
+ spin_lock_irqsave(&priv->lock, flags);
+
+ /* Disable TX and RX right over here, if E-MAC change is ignored */
+ if (priv->no_avb_link)
+ ravb_rcv_snd_disable(ndev);
if (phydev->link) {
if (phydev->duplex != priv->duplex) {
@@ -972,18 +979,21 @@ static void ravb_adjust_link(struct net_
ravb_modify(ndev, ECMR, ECMR_TXF, 0);
new_state = true;
priv->link = phydev->link;
- if (priv->no_avb_link)
- ravb_rcv_snd_enable(ndev);
}
} else if (priv->link) {
new_state = true;
priv->link = 0;
priv->speed = 0;
priv->duplex = -1;
- if (priv->no_avb_link)
- ravb_rcv_snd_disable(ndev);
}
+ /* Enable TX and RX right over here, if E-MAC change is ignored */
+ if (priv->no_avb_link && phydev->link)
+ ravb_rcv_snd_enable(ndev);
+
+ mmiowb();
+ spin_unlock_irqrestore(&priv->lock, flags);
+
if (new_state && netif_msg_link(priv))
phy_print_status(phydev);
}
@@ -1085,39 +1095,10 @@ static int ravb_get_link_ksettings(struc
static int ravb_set_link_ksettings(struct net_device *ndev,
const struct ethtool_link_ksettings *cmd)
{
- struct ravb_private *priv = netdev_priv(ndev);
- unsigned long flags;
- int error;
-
if (!ndev->phydev)
return -ENODEV;
- spin_lock_irqsave(&priv->lock, flags);
-
- /* Disable TX and RX */
- ravb_rcv_snd_disable(ndev);
-
- error = phy_ethtool_ksettings_set(ndev->phydev, cmd);
- if (error)
- goto error_exit;
-
- if (cmd->base.duplex == DUPLEX_FULL)
- priv->duplex = 1;
- else
- priv->duplex = 0;
-
- ravb_set_duplex(ndev);
-
-error_exit:
- mdelay(1);
-
- /* Enable TX and RX */
- ravb_rcv_snd_enable(ndev);
-
- mmiowb();
- spin_unlock_irqrestore(&priv->lock, flags);
-
- return error;
+ return phy_ethtool_ksettings_set(ndev->phydev, cmd);
}
static int ravb_nway_reset(struct net_device *ndev)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 086/130] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 085/130] ravb: fix invalid context bug while changing link options " Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 087/130] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used Greg Kroah-Hartman
` (43 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Mack, Robert Jarzmik, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <daniel@zonque.org>
[ Upstream commit 0c1049dcb4ceec640d8bd797335bcbebdcab44d2 ]
PXA3xx platforms have 56 interrupts that are stored in two ICMR
registers. The code in pxa_irq_suspend() and pxa_irq_resume() however
does a simple division by 32 which only leads to one register being
saved at suspend and restored at resume time. The NAND interrupt
setting, for instance, is lost.
Fix this by using DIV_ROUND_UP() instead.
Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-pxa/irq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-pxa/irq.c
+++ b/arch/arm/mach-pxa/irq.c
@@ -185,7 +185,7 @@ static int pxa_irq_suspend(void)
{
int i;
- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
void __iomem *base = irq_base(i);
saved_icmr[i] = __raw_readl(base + ICMR);
@@ -204,7 +204,7 @@ static void pxa_irq_resume(void)
{
int i;
- for (i = 0; i < pxa_internal_irq_nr / 32; i++) {
+ for (i = 0; i < DIV_ROUND_UP(pxa_internal_irq_nr, 32); i++) {
void __iomem *base = irq_base(i);
__raw_writel(saved_icmr[i], base + ICMR);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 087/130] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 086/130] ARM: pxa: irq: fix handling of ICMR registers in suspend/resume Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 088/130] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
` (42 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Davide Caratti, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <dcaratti@redhat.com>
[ Upstream commit 38230a3e0e0933bbcf5df6fa469ba0667f667568 ]
the control action in the common member of struct tcf_tunnel_key must be a
valid value, as it can contain the chain index when 'goto chain' is used.
Ensure that the control action can be read as x->tcfa_action, when x is a
pointer to struct tc_action and x->ops->type is TCA_ACT_TUNNEL_KEY, to
prevent the following command:
# tc filter add dev $h2 ingress protocol ip pref 1 handle 101 flower \
> $tcflags dst_mac $h2mac action tunnel_key unset goto chain 1
from causing a NULL dereference when a matching packet is received:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
PGD 80000001097ac067 P4D 80000001097ac067 PUD 103b0a067 PMD 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 3491 Comm: mausezahn Tainted: G E 4.18.0-rc2.auguri+ #421
Hardware name: Hewlett-Packard HP Z220 CMT Workstation/1790, BIOS K51 v01.58 02/07/2013
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Call Trace:
<IRQ>
fl_classify+0x1ad/0x1c0 [cls_flower]
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? __update_load_avg_se.isra.47+0x1ca/0x1d0
? update_load_avg+0x665/0x690
? update_load_avg+0x665/0x690
? kmem_cache_alloc+0x38/0x1c0
tcf_classify+0x89/0x140
__netif_receive_skb_core+0x5ea/0xb70
? enqueue_entity+0xd0/0x270
? process_backlog+0x97/0x150
process_backlog+0x97/0x150
net_rx_action+0x14b/0x3e0
__do_softirq+0xde/0x2b4
do_softirq_own_stack+0x2a/0x40
</IRQ>
do_softirq.part.18+0x49/0x50
__local_bh_enable_ip+0x49/0x50
__dev_queue_xmit+0x4ab/0x8a0
? wait_woken+0x80/0x80
? packet_sendmsg+0x38f/0x810
? __dev_queue_xmit+0x8a0/0x8a0
packet_sendmsg+0x38f/0x810
sock_sendmsg+0x36/0x40
__sys_sendto+0x10e/0x140
? do_vfs_ioctl+0xa4/0x630
? syscall_trace_enter+0x1df/0x2e0
? __audit_syscall_exit+0x22a/0x290
__x64_sys_sendto+0x24/0x30
do_syscall_64+0x5b/0x180
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fd67e18dc93
Code: 48 8b 0d 18 83 20 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 59 c7 20 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 2b f7 ff ff 48 89 04 24
RSP: 002b:00007ffe0189b748 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000020ca010 RCX: 00007fd67e18dc93
RDX: 0000000000000062 RSI: 00000000020ca322 RDI: 0000000000000003
RBP: 00007ffe0189b780 R08: 00007ffe0189b760 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000062
R13: 00000000020ca322 R14: 00007ffe0189b760 R15: 0000000000000003
Modules linked in: act_tunnel_key act_gact cls_flower sch_ingress vrf veth act_csum(E) xt_CHECKSUM iptable_mangle ipt_MASQUERADE iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack ipt_REJECT nf_reject_ipv4 tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_rapl snd_hda_codec_hdmi x86_pkg_temp_thermal intel_powerclamp snd_hda_codec_realtek coretemp snd_hda_codec_generic kvm_intel kvm irqbypass snd_hda_intel crct10dif_pclmul crc32_pclmul hp_wmi ghash_clmulni_intel pcbc snd_hda_codec aesni_intel sparse_keymap rfkill snd_hda_core snd_hwdep snd_seq crypto_simd iTCO_wdt gpio_ich iTCO_vendor_support wmi_bmof cryptd mei_wdt glue_helper snd_seq_device snd_pcm pcspkr snd_timer snd i2c_i801 lpc_ich sg soundcore wmi mei_me
mei ie31200_edac nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ahci crc32c_intel libahci serio_raw sfc libata mtd drm ixgbe mdio i2c_core e1000e dca
CR2: 0000000000000000
---[ end trace 1ab8b5b5d4639dfc ]---
RIP: 0010:tcf_action_exec+0xb8/0x100
Code: 00 00 00 20 74 1d 83 f8 03 75 09 49 83 c4 08 4d 39 ec 75 bc 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 49 8b 97 a8 00 00 00 <48> 8b 12 48 89 55 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3
RSP: 0018:ffff95145ea03c40 EFLAGS: 00010246
RAX: 0000000020000001 RBX: ffff9514499e5800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000
RBP: ffff95145ea03e60 R08: 0000000000000000 R09: ffff95145ea03c9c
R10: ffff95145ea03c78 R11: 0000000000000008 R12: ffff951456a69800
R13: ffff951456a69808 R14: 0000000000000001 R15: ffff95144965ee40
FS: 00007fd67ee11740(0000) GS:ffff95145ea00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001038a2006 CR4: 00000000001606f0
Kernel panic - not syncing: Fatal exception in interrupt
Kernel Offset: 0x11400000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Fixes: d0f6dd8a914f ("net/sched: Introduce act_tunnel_key")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tc_act/tc_tunnel_key.h | 1 -
net/sched/act_tunnel_key.c | 6 +++---
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/include/net/tc_act/tc_tunnel_key.h
+++ b/include/net/tc_act/tc_tunnel_key.h
@@ -16,7 +16,6 @@
struct tcf_tunnel_key_params {
struct rcu_head rcu;
int tcft_action;
- int action;
struct metadata_dst *tcft_enc_metadata;
};
--- a/net/sched/act_tunnel_key.c
+++ b/net/sched/act_tunnel_key.c
@@ -39,7 +39,7 @@ static int tunnel_key_act(struct sk_buff
tcf_lastuse_update(&t->tcf_tm);
bstats_cpu_update(this_cpu_ptr(t->common.cpu_bstats), skb);
- action = params->action;
+ action = READ_ONCE(t->tcf_action);
switch (params->tcft_action) {
case TCA_TUNNEL_KEY_ACT_RELEASE:
@@ -170,7 +170,7 @@ static int tunnel_key_init(struct net *n
params_old = rtnl_dereference(t->params);
- params_new->action = parm->action;
+ t->tcf_action = parm->action;
params_new->tcft_action = parm->t_action;
params_new->tcft_enc_metadata = metadata;
@@ -242,13 +242,13 @@ static int tunnel_key_dump(struct sk_buf
.index = t->tcf_index,
.refcnt = t->tcf_refcnt - ref,
.bindcnt = t->tcf_bindcnt - bind,
+ .action = t->tcf_action,
};
struct tcf_t tm;
params = rtnl_dereference(t->params);
opt.t_action = params->tcft_action;
- opt.action = params->action;
if (nla_put(skb, TCA_TUNNEL_KEY_PARMS, sizeof(opt), &opt))
goto nla_put_failure;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 088/130] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 087/130] net/sched: act_tunnel_key: fix NULL dereference when goto chain is used Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 089/130] ieee802154: at86rf230: use __func__ macro for debug messages Greg Kroah-Hartman
` (41 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 20f330452ad8814f2289a589baf65e21270879a7 ]
The check is valid but it does not warrant to crash the kernel. A
WARN_ON() is good enough here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/at86rf230.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -941,7 +941,7 @@ at86rf230_xmit(struct ieee802154_hw *hw,
static int
at86rf230_ed(struct ieee802154_hw *hw, u8 *level)
{
- BUG_ON(!level);
+ WARN_ON(!level);
*level = 0xbe;
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 089/130] ieee802154: at86rf230: use __func__ macro for debug messages
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 088/130] ieee802154: at86rf230: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 090/130] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
` (40 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 8a81388ec27c4c0adbdecd20e67bb5f411ab46b2 ]
Instead of having the function name hard-coded (it might change and we
forgot to update them in the debug output) we can use __func__ instead
and also shorter the line so we do not need to break it. Also fix an
extra blank line while being here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/at86rf230.c | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/drivers/net/ieee802154/at86rf230.c
+++ b/drivers/net/ieee802154/at86rf230.c
@@ -1117,8 +1117,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
if (changed & IEEE802154_AFILT_SADDR_CHANGED) {
u16 addr = le16_to_cpu(filt->short_addr);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for saddr\n");
+ dev_vdbg(&lp->spi->dev, "%s called for saddr\n", __func__);
__at86rf230_write(lp, RG_SHORT_ADDR_0, addr);
__at86rf230_write(lp, RG_SHORT_ADDR_1, addr >> 8);
}
@@ -1126,8 +1125,7 @@ at86rf230_set_hw_addr_filt(struct ieee80
if (changed & IEEE802154_AFILT_PANID_CHANGED) {
u16 pan = le16_to_cpu(filt->pan_id);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for pan id\n");
+ dev_vdbg(&lp->spi->dev, "%s called for pan id\n", __func__);
__at86rf230_write(lp, RG_PAN_ID_0, pan);
__at86rf230_write(lp, RG_PAN_ID_1, pan >> 8);
}
@@ -1136,15 +1134,13 @@ at86rf230_set_hw_addr_filt(struct ieee80
u8 i, addr[8];
memcpy(addr, &filt->ieee_addr, 8);
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for IEEE addr\n");
+ dev_vdbg(&lp->spi->dev, "%s called for IEEE addr\n", __func__);
for (i = 0; i < 8; i++)
__at86rf230_write(lp, RG_IEEE_ADDR_0 + i, addr[i]);
}
if (changed & IEEE802154_AFILT_PANC_CHANGED) {
- dev_vdbg(&lp->spi->dev,
- "at86rf230_set_hw_addr_filt called for panc change\n");
+ dev_vdbg(&lp->spi->dev, "%s called for panc change\n", __func__);
if (filt->pan_coord)
at86rf230_write_subreg(lp, SR_AACK_I_AM_COORD, 1);
else
@@ -1248,7 +1244,6 @@ at86rf230_set_cca_mode(struct ieee802154
return at86rf230_write_subreg(lp, SR_CCA_MODE, val);
}
-
static int
at86rf230_set_cca_ed_level(struct ieee802154_hw *hw, s32 mbm)
{
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 090/130] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 089/130] ieee802154: at86rf230: use __func__ macro for debug messages Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 091/130] drm/armada: fix colorkey mode property Greg Kroah-Hartman
` (39 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stefan Schmidt, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Schmidt <stefan@datenfreihafen.org>
[ Upstream commit 8f2fbc6c60ff213369e06a73610fc882a42fdf20 ]
The check is valid but it does not warrant to crash the kernel. A
WARN_ON() is good enough here.
Found by checkpatch.
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ieee802154/fakelb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ieee802154/fakelb.c
+++ b/drivers/net/ieee802154/fakelb.c
@@ -49,7 +49,7 @@ struct fakelb_phy {
static int fakelb_hw_ed(struct ieee802154_hw *hw, u8 *level)
{
- BUG_ON(!level);
+ WARN_ON(!level);
*level = 0xbe;
return 0;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 091/130] drm/armada: fix colorkey mode property
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 090/130] ieee802154: fakelb: switch from BUG_ON() to WARN_ON() on problem Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 092/130] netfilter: nf_conntrack: Fix possible possible crash on module loading Greg Kroah-Hartman
` (38 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
[ Upstream commit d378859a667edc99e3473704847698cae97ca2b1 ]
The colorkey mode property was not correctly disabling the colorkeying
when "disabled" mode was selected. Arrange for this to work as one
would expect.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/armada_hw.h | 1 +
drivers/gpu/drm/armada/armada_overlay.c | 30 ++++++++++++++++++++++--------
2 files changed, 23 insertions(+), 8 deletions(-)
--- a/drivers/gpu/drm/armada/armada_hw.h
+++ b/drivers/gpu/drm/armada/armada_hw.h
@@ -160,6 +160,7 @@ enum {
CFG_ALPHAM_GRA = 0x1 << 16,
CFG_ALPHAM_CFG = 0x2 << 16,
CFG_ALPHA_MASK = 0xff << 8,
+#define CFG_ALPHA(x) ((x) << 8)
CFG_PIXCMD_MASK = 0xff,
};
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -27,6 +27,7 @@ struct armada_ovl_plane_properties {
uint16_t contrast;
uint16_t saturation;
uint32_t colorkey_mode;
+ uint32_t colorkey_enable;
};
struct armada_ovl_plane {
@@ -62,11 +63,13 @@ armada_ovl_update_attr(struct armada_ovl
writel_relaxed(0x00002000, dcrtc->base + LCD_SPU_CBSH_HUE);
spin_lock_irq(&dcrtc->irq_lock);
- armada_updatel(prop->colorkey_mode | CFG_ALPHAM_GRA,
- CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
- dcrtc->base + LCD_SPU_DMA_CTRL1);
-
- armada_updatel(ADV_GRACOLORKEY, 0, dcrtc->base + LCD_SPU_ADV_REG);
+ armada_updatel(prop->colorkey_mode,
+ CFG_CKMODE_MASK | CFG_ALPHAM_MASK | CFG_ALPHA_MASK,
+ dcrtc->base + LCD_SPU_DMA_CTRL1);
+ if (dcrtc->variant->has_spu_adv_reg)
+ armada_updatel(prop->colorkey_enable,
+ ADV_GRACOLORKEY | ADV_VIDCOLORKEY,
+ dcrtc->base + LCD_SPU_ADV_REG);
spin_unlock_irq(&dcrtc->irq_lock);
}
@@ -340,8 +343,17 @@ static int armada_ovl_plane_set_property
dplane->prop.colorkey_vb |= K2B(val);
update_attr = true;
} else if (property == priv->colorkey_mode_prop) {
- dplane->prop.colorkey_mode &= ~CFG_CKMODE_MASK;
- dplane->prop.colorkey_mode |= CFG_CKMODE(val);
+ if (val == CKMODE_DISABLE) {
+ dplane->prop.colorkey_mode =
+ CFG_CKMODE(CKMODE_DISABLE) |
+ CFG_ALPHAM_CFG | CFG_ALPHA(255);
+ dplane->prop.colorkey_enable = 0;
+ } else {
+ dplane->prop.colorkey_mode =
+ CFG_CKMODE(val) |
+ CFG_ALPHAM_GRA | CFG_ALPHA(0);
+ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
+ }
update_attr = true;
} else if (property == priv->brightness_prop) {
dplane->prop.brightness = val - 256;
@@ -470,7 +482,9 @@ int armada_overlay_plane_create(struct d
dplane->prop.colorkey_yr = 0xfefefe00;
dplane->prop.colorkey_ug = 0x01010100;
dplane->prop.colorkey_vb = 0x01010100;
- dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB);
+ dplane->prop.colorkey_mode = CFG_CKMODE(CKMODE_RGB) |
+ CFG_ALPHAM_GRA | CFG_ALPHA(0);
+ dplane->prop.colorkey_enable = ADV_GRACOLORKEY;
dplane->prop.brightness = 0;
dplane->prop.contrast = 0x4000;
dplane->prop.saturation = 0x4000;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 092/130] netfilter: nf_conntrack: Fix possible possible crash on module loading.
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 091/130] drm/armada: fix colorkey mode property Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 093/130] ARC: Improve cmpxchg syscall implementation Greg Kroah-Hartman
` (37 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Ryabinin, Pablo Neira Ayuso,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
[ Upstream commit 2045cdfa1b40d66f126f3fd05604fc7c754f0022 ]
Loading the nf_conntrack module with doubled hashsize parameter, i.e.
modprobe nf_conntrack hashsize=12345 hashsize=12345
causes NULL-ptr deref.
If 'hashsize' specified twice, the nf_conntrack_set_hashsize() function
will be called also twice.
The first nf_conntrack_set_hashsize() call will set the
'nf_conntrack_htable_size' variable:
nf_conntrack_set_hashsize()
...
/* On boot, we can set this without any fancy locking. */
if (!nf_conntrack_htable_size)
return param_set_uint(val, kp);
But on the second invocation, the nf_conntrack_htable_size is already set,
so the nf_conntrack_set_hashsize() will take a different path and call
the nf_conntrack_hash_resize() function. Which will crash on the attempt
to dereference 'nf_conntrack_hash' pointer:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
RIP: 0010:nf_conntrack_hash_resize+0x255/0x490 [nf_conntrack]
Call Trace:
nf_conntrack_set_hashsize+0xcd/0x100 [nf_conntrack]
parse_args+0x1f9/0x5a0
load_module+0x1281/0x1a50
__se_sys_finit_module+0xbe/0xf0
do_syscall_64+0x7c/0x390
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this, by checking !nf_conntrack_hash instead of
!nf_conntrack_htable_size. nf_conntrack_hash will be initialized only
after the module loaded, so the second invocation of the
nf_conntrack_set_hashsize() won't crash, it will just reinitialize
nf_conntrack_htable_size again.
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1822,7 +1822,7 @@ int nf_conntrack_set_hashsize(const char
return -EOPNOTSUPP;
/* On boot, we can set this without any fancy locking. */
- if (!nf_conntrack_htable_size)
+ if (!nf_conntrack_hash)
return param_set_uint(val, kp);
rc = kstrtouint(val, 0, &hashsize);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 093/130] ARC: Improve cmpxchg syscall implementation
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 092/130] netfilter: nf_conntrack: Fix possible possible crash on module loading Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 094/130] bnxt_en: Always set output parameters in bnxt_get_max_rings() Greg Kroah-Hartman
` (36 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Max Filippov, linux-arch,
Alexey Brodkin, Peter Zijlstra, Vineet Gupta, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit e8708786d4fe21c043d38d760f768949a3d71185 ]
This is used in configs lacking hardware atomics to emulate atomic r-m-w
for user space, implemented by disabling preemption in kernel.
However there are issues in current implementation:
1. Process not terminated if invalid user pointer passed:
i.e. __get_user() failed.
2. The reason for this patch was __put_user() failure not being handled
either, specifically for the COW break scenario.
The zero page is initially wired up and read from __get_user()
succeeds. A subsequent write by __put_user() induces a
Protection Violation, but COW can't finish as Linux page fault
handler is disabled due to preempt disable.
And what's worse is we silently return the stale value to user space.
Fix this specific case by re-enabling preemption and explicitly
fixing up the fault and retrying the whole sequence over.
Cc: Max Filippov <jcmvbkbc@gmail.com>
Cc: linux-arch@vger.kernel.org
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
[vgupta: rewrote the changelog]
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/kernel/process.c | 47 +++++++++++++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 11 deletions(-)
--- a/arch/arc/kernel/process.c
+++ b/arch/arc/kernel/process.c
@@ -44,7 +44,8 @@ SYSCALL_DEFINE0(arc_gettls)
SYSCALL_DEFINE3(arc_usr_cmpxchg, int *, uaddr, int, expected, int, new)
{
struct pt_regs *regs = current_pt_regs();
- int uval = -EFAULT;
+ u32 uval;
+ int ret;
/*
* This is only for old cores lacking LLOCK/SCOND, which by defintion
@@ -57,23 +58,47 @@ SYSCALL_DEFINE3(arc_usr_cmpxchg, int *,
/* Z indicates to userspace if operation succeded */
regs->status32 &= ~STATUS_Z_MASK;
- if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
- return -EFAULT;
+ ret = access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr));
+ if (!ret)
+ goto fail;
+again:
preempt_disable();
- if (__get_user(uval, uaddr))
- goto done;
+ ret = __get_user(uval, uaddr);
+ if (ret)
+ goto fault;
- if (uval == expected) {
- if (!__put_user(new, uaddr))
- regs->status32 |= STATUS_Z_MASK;
- }
+ if (uval != expected)
+ goto out;
-done:
- preempt_enable();
+ ret = __put_user(new, uaddr);
+ if (ret)
+ goto fault;
+
+ regs->status32 |= STATUS_Z_MASK;
+out:
+ preempt_enable();
return uval;
+
+fault:
+ preempt_enable();
+
+ if (unlikely(ret != -EFAULT))
+ goto fail;
+
+ down_read(¤t->mm->mmap_sem);
+ ret = fixup_user_fault(current, current->mm, (unsigned long) uaddr,
+ FAULT_FLAG_WRITE, NULL);
+ up_read(¤t->mm->mmap_sem);
+
+ if (likely(!ret))
+ goto again;
+
+fail:
+ force_sig(SIGSEGV, current);
+ return ret;
}
void arch_cpu_idle(void)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 094/130] bnxt_en: Always set output parameters in bnxt_get_max_rings().
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 093/130] ARC: Improve cmpxchg syscall implementation Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 095/130] bnxt_en: Fix for system hang if request_irq fails Greg Kroah-Hartman
` (35 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michael Chan, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <michael.chan@broadcom.com>
[ Upstream commit 78f058a4aa0f2280dc4d45d2c4a95728398ef857 ]
The current code returns -ENOMEM and does not bother to set the output
parameters to 0 when no rings are available. Some callers, such as
bnxt_get_channels() will display garbage ring numbers when that happens.
Fix it by always setting the output parameters.
Fixes: 6e6c5a57fbe1 ("bnxt_en: Modify bnxt_get_max_rings() to support shared or non shared rings.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6862,11 +6862,11 @@ int bnxt_get_max_rings(struct bnxt *bp,
int rx, tx, cp;
_bnxt_get_max_rings(bp, &rx, &tx, &cp);
+ *max_rx = rx;
+ *max_tx = tx;
if (!rx || !tx || !cp)
return -ENOMEM;
- *max_rx = rx;
- *max_tx = tx;
return bnxt_trim_rings(bp, max_rx, max_tx, cp, shared);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 095/130] bnxt_en: Fix for system hang if request_irq fails
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 094/130] bnxt_en: Always set output parameters in bnxt_get_max_rings() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 096/130] perf llvm-utils: Remove bashism from kernel include fetch script Greg Kroah-Hartman
` (34 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vikas Gupta, Michael Chan,
David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vikas Gupta <vikas.gupta@broadcom.com>
[ Upstream commit c58387ab1614f6d7fb9e244f214b61e7631421fc ]
Fix bug in the error code path when bnxt_request_irq() returns failure.
bnxt_disable_napi() should not be called in this error path because
NAPI has not been enabled yet.
Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5560,7 +5560,7 @@ static int __bnxt_open_nic(struct bnxt *
rc = bnxt_request_irq(bp);
if (rc) {
netdev_err(bp->dev, "bnxt_request_irq err: %x\n", rc);
- goto open_err;
+ goto open_err_irq;
}
}
@@ -5593,6 +5593,8 @@ static int __bnxt_open_nic(struct bnxt *
open_err:
bnxt_disable_napi(bp);
+
+open_err_irq:
bnxt_del_napi(bp);
open_err_free_mem:
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 096/130] perf llvm-utils: Remove bashism from kernel include fetch script
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 095/130] bnxt_en: Fix for system hang if request_irq fails Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 097/130] nfit: fix unchecked dereference in acpi_nfit_ctl Greg Kroah-Hartman
` (33 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kim Phillips, Alexander Shishkin,
Hendrik Brueckner, Jiri Olsa, Michael Petlan, Namhyung Kim,
Peter Zijlstra, Sandipan Das, Thomas Richter,
Arnaldo Carvalho de Melo, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@arm.com>
[ Upstream commit f6432b9f65001651412dbc3589d251534822d4ab ]
Like system(), popen() calls /bin/sh, which may/may not be bash.
Script when run on dash and encounters the line, yields:
exit: Illegal number: -1
checkbashisms report on script content:
possible bashism (exit|return with negative status code):
exit -1
Remove the bashism and use the more portable non-zero failure
status code 1.
Signed-off-by: Kim Phillips <kim.phillips@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sandipan Das <sandipan@linux.vnet.ibm.com>
Cc: Thomas Richter <tmricht@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/20180629124652.8d0af7e2281fd3fd8262cacc@arm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/util/llvm-utils.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/tools/perf/util/llvm-utils.c
+++ b/tools/perf/util/llvm-utils.c
@@ -260,16 +260,16 @@ static const char *kinc_fetch_script =
"#!/usr/bin/env sh\n"
"if ! test -d \"$KBUILD_DIR\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"if ! test -f \"$KBUILD_DIR/include/generated/autoconf.h\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"TMPDIR=`mktemp -d`\n"
"if test -z \"$TMPDIR\"\n"
"then\n"
-" exit -1\n"
+" exit 1\n"
"fi\n"
"cat << EOF > $TMPDIR/Makefile\n"
"obj-y := dummy.o\n"
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 097/130] nfit: fix unchecked dereference in acpi_nfit_ctl
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 096/130] perf llvm-utils: Remove bashism from kernel include fetch script Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 098/130] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path Greg Kroah-Hartman
` (32 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Jiang, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
[ Upstream commit ee6581ceba7f8314b81b2f2a81f1cf3f67c679e2 ]
Incremental patch to fix the unchecked dereference in acpi_nfit_ctl.
Reported by Dan Carpenter:
"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to
always return a value" from Jun 28, 2018, leads to the following
Smatch complaint:
drivers/acpi/nfit/core.c:578 acpi_nfit_ctl()
warn: variable dereferenced before check 'cmd_rc' (see line 411)
drivers/acpi/nfit/core.c
410
411 *cmd_rc = -EINVAL;
^^^^^^^^^^^^^^^^^^
Patch adds unchecked dereference.
Fixes: c1985cefd844 ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value")
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/nfit/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/acpi/nfit/core.c
+++ b/drivers/acpi/nfit/core.c
@@ -201,7 +201,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
const u8 *uuid;
int rc, i;
- *cmd_rc = -EINVAL;
+ if (cmd_rc)
+ *cmd_rc = -EINVAL;
func = cmd;
if (cmd == ND_CMD_CALL) {
call_pkg = buf;
@@ -289,7 +290,8 @@ int acpi_nfit_ctl(struct nvdimm_bus_desc
* If we return an error (like elsewhere) then caller wouldn't
* be able to rely upon data returned to make calculation.
*/
- *cmd_rc = 0;
+ if (cmd_rc)
+ *cmd_rc = 0;
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 098/130] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 097/130] nfit: fix unchecked dereference in acpi_nfit_ctl Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 099/130] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot Greg Kroah-Hartman
` (31 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kamal Heib, Leon Romanovsky,
Jason Gunthorpe, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamal Heib <kamalheib1@gmail.com>
[ Upstream commit d63c46734c545ad0488761059004a65c46efdde3 ]
Fix memory leak in the error path of mlx5_ib_create_srq() by making sure
to free the allocated srq.
Fixes: c2b37f76485f ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
Signed-off-by: Kamal Heib <kamalheib1@gmail.com>
Acked-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/srq.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/infiniband/hw/mlx5/srq.c
+++ b/drivers/infiniband/hw/mlx5/srq.c
@@ -268,18 +268,24 @@ struct ib_srq *mlx5_ib_create_srq(struct
desc_size = sizeof(struct mlx5_wqe_srq_next_seg) +
srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg);
- if (desc_size == 0 || srq->msrq.max_gs > desc_size)
- return ERR_PTR(-EINVAL);
+ if (desc_size == 0 || srq->msrq.max_gs > desc_size) {
+ err = -EINVAL;
+ goto err_srq;
+ }
desc_size = roundup_pow_of_two(desc_size);
desc_size = max_t(size_t, 32, desc_size);
- if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg))
- return ERR_PTR(-EINVAL);
+ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) {
+ err = -EINVAL;
+ goto err_srq;
+ }
srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) /
sizeof(struct mlx5_wqe_data_seg);
srq->msrq.wqe_shift = ilog2(desc_size);
buf_size = srq->msrq.max * desc_size;
- if (buf_size < desc_size)
- return ERR_PTR(-EINVAL);
+ if (buf_size < desc_size) {
+ err = -EINVAL;
+ goto err_srq;
+ }
in.type = init_attr->srq_type;
if (pd->uobject)
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 099/130] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 098/130] RDMA/mlx5: Fix memory leak in mlx5_ib_create_srq() error path Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 100/130] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores Greg Kroah-Hartman
` (30 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Agner, Steven Rostedt (VMware),
Russell King, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
[ Upstream commit b4c7e2bd2eb4764afe3af9409ff3b1b87116fa30 ]
Dynamic ftrace requires modifying the code segments that are usually
set to read-only. To do this, a per arch function is called both before
and after the ftrace modifications are performed. The "before" function
will set kernel code text to read-write to allow for ftrace to make the
modifications, and the "after" function will set the kernel code text
back to "read-only" to keep the kernel code text protected.
The issue happens when dynamic ftrace is tested at boot up. The test is
done before the kernel code text has been set to read-only. But the
"before" and "after" calls are still performed. The "after" call will
change the kernel code text to read-only prematurely, and other boot
code that expects this code to be read-write will fail.
The solution is to add a variable that is set when the kernel code text
is expected to be converted to read-only, and make the ftrace "before"
and "after" calls do nothing if that variable is not yet set. This is
similar to the x86 solution from commit 162396309745 ("ftrace, x86:
make kernel text writable only for conversions").
Link: http://lkml.kernel.org/r/20180620212906.24b7b66e@vmware.local.home
Reported-by: Stefan Agner <stefan@agner.ch>
Tested-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/init.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -722,19 +722,28 @@ int __mark_rodata_ro(void *unused)
return 0;
}
+static int kernel_set_to_readonly __read_mostly;
+
void mark_rodata_ro(void)
{
+ kernel_set_to_readonly = 1;
stop_machine(__mark_rodata_ro, NULL, NULL);
}
void set_kernel_text_rw(void)
{
+ if (!kernel_set_to_readonly)
+ return;
+
set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), false,
current->active_mm);
}
void set_kernel_text_ro(void)
{
+ if (!kernel_set_to_readonly)
+ return;
+
set_section_perms(ro_perms, ARRAY_SIZE(ro_perms), true,
current->active_mm);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 100/130] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 099/130] ARM: 8780/1: ftrace: Only set kernel memory back to read-only after boot Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 101/130] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller Greg Kroah-Hartman
` (29 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Tony Lindgren, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 2f8b5b21830aea95989a6e67d8a971297272a086 ]
Call secure services to enable ACTLR[0] (Enable invalidates of BTB with
ICIALLU) when branch hardening is enabled for kernel.
On GP devices OMAP5/DRA7, there is no possibility to update secure
side since "secure world" is ROM and there are no override mechanisms
possible. On HS devices, appropriate PPA should do the workarounds as
well.
However, the configuration is only done for secondary core, since it is
expected that firmware/bootloader will have enabled the required
configuration for the primary boot core (note: bootloaders typically
will NOT enable secondary processors, since it has no need to do so).
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap-smp.c | 41 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
--- a/arch/arm/mach-omap2/omap-smp.c
+++ b/arch/arm/mach-omap2/omap-smp.c
@@ -104,6 +104,45 @@ void omap5_erratum_workaround_801819(voi
static inline void omap5_erratum_workaround_801819(void) { }
#endif
+#ifdef CONFIG_HARDEN_BRANCH_PREDICTOR
+/*
+ * Configure ACR and enable ACTLR[0] (Enable invalidates of BTB with
+ * ICIALLU) to activate the workaround for secondary Core.
+ * NOTE: it is assumed that the primary core's configuration is done
+ * by the boot loader (kernel will detect a misconfiguration and complain
+ * if this is not done).
+ *
+ * In General Purpose(GP) devices, ACR bit settings can only be done
+ * by ROM code in "secure world" using the smc call and there is no
+ * option to update the "firmware" on such devices. This also works for
+ * High security(HS) devices, as a backup option in case the
+ * "update" is not done in the "security firmware".
+ */
+static void omap5_secondary_harden_predictor(void)
+{
+ u32 acr, acr_mask;
+
+ asm volatile ("mrc p15, 0, %0, c1, c0, 1" : "=r" (acr));
+
+ /*
+ * ACTLR[0] (Enable invalidates of BTB with ICIALLU)
+ */
+ acr_mask = BIT(0);
+
+ /* Do we already have it done.. if yes, skip expensive smc */
+ if ((acr & acr_mask) == acr_mask)
+ return;
+
+ acr |= acr_mask;
+ omap_smc1(OMAP5_DRA7_MON_SET_ACR_INDEX, acr);
+
+ pr_debug("%s: ARM ACR setup for CVE_2017_5715 applied on CPU%d\n",
+ __func__, smp_processor_id());
+}
+#else
+static inline void omap5_secondary_harden_predictor(void) { }
+#endif
+
static void omap4_secondary_init(unsigned int cpu)
{
/*
@@ -126,6 +165,8 @@ static void omap4_secondary_init(unsigne
set_cntfreq();
/* Configure ACR to disable streaming WA for 801819 */
omap5_erratum_workaround_801819();
+ /* Enable ACR to allow for ICUALLU workaround */
+ omap5_secondary_harden_predictor();
}
/*
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 101/130] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 100/130] ARM: DRA7/OMAP5: Enable ACTLR[0] (Enable invalidates of BTB) for secondary cores Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 102/130] ixgbe: Be more careful when modifying MAC filters Greg Kroah-Hartman
` (28 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam Ford, Tony Lindgren, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <aford173@gmail.com>
[ Upstream commit 923847413f7316b5ced3491769b3fefa6c56a79a ]
The AM3517 has a different OTG controller location than the OMAP3,
which is included from omap3.dtsi. This results in a hwmod error.
Since the AM3517 has a different OTG controller address, this patch
disabes one that is isn't available.
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am3517.dtsi | 5 +++++
1 file changed, 5 insertions(+)
--- a/arch/arm/boot/dts/am3517.dtsi
+++ b/arch/arm/boot/dts/am3517.dtsi
@@ -74,6 +74,11 @@
};
};
+/* Table Table 5-79 of the TRM shows 480ab000 is reserved */
+&usb_otg_hs {
+ status = "disabled";
+};
+
&iva {
status = "disabled";
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 102/130] ixgbe: Be more careful when modifying MAC filters
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 101/130] ARM: dts: am3517.dtsi: Disable reference to OMAP3 OTG controller Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 103/130] tools: build: Use HOSTLDFLAGS with fixdep Greg Kroah-Hartman
` (27 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Duyck, Shannon Nelson,
Andrew Bowers, Jeff Kirsher, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Duyck <alexander.h.duyck@intel.com>
[ Upstream commit d14c780c11fbc10f66c43e7b64eefe87ca442bd3 ]
This change makes it so that we are much more explicit about the ordering
of updates to the receive address register (RAR) table. Prior to this patch
I believe we may have been updating the table while entries were still
active, or possibly allowing for reordering of things since we weren't
explicitly flushing writes to either the lower or upper portion of the
register prior to accessing the other half.
Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Reviewed-by: Shannon Nelson <shannon.nelson@oracle.com>
Tested-by: Andrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -1847,7 +1847,12 @@ s32 ixgbe_set_rar_generic(struct ixgbe_h
if (enable_addr != 0)
rar_high |= IXGBE_RAH_AV;
+ /* Record lower 32 bits of MAC address and then make
+ * sure that write is flushed to hardware before writing
+ * the upper 16 bits and setting the valid bit.
+ */
IXGBE_WRITE_REG(hw, IXGBE_RAL(index), rar_low);
+ IXGBE_WRITE_FLUSH(hw);
IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
return 0;
@@ -1879,8 +1884,13 @@ s32 ixgbe_clear_rar_generic(struct ixgbe
rar_high = IXGBE_READ_REG(hw, IXGBE_RAH(index));
rar_high &= ~(0x0000FFFF | IXGBE_RAH_AV);
- IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
+ /* Clear the address valid bit and upper 16 bits of the address
+ * before clearing the lower bits. This way we aren't updating
+ * a live filter.
+ */
IXGBE_WRITE_REG(hw, IXGBE_RAH(index), rar_high);
+ IXGBE_WRITE_FLUSH(hw);
+ IXGBE_WRITE_REG(hw, IXGBE_RAL(index), 0);
/* clear VMDq pool/queue selection for this RAR */
hw->mac.ops.clear_vmdq(hw, index, IXGBE_CLEAR_VMDQ_ALL);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 103/130] tools: build: Use HOSTLDFLAGS with fixdep
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 102/130] ixgbe: Be more careful when modifying MAC filters Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 104/130] packet: reset network header if packet shorter than ll reserved space Greg Kroah-Hartman
` (26 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laura Abbott, Jiri Olsa,
Masahiro Yamada, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@redhat.com>
[ Upstream commit 8b247a92ebd0cda7dec49a6f771d9c4950f3d3ad ]
The final link of fixdep uses LDFLAGS but not the existing HOSTLDFLAGS.
Fix this.
Signed-off-by: Laura Abbott <labbott@redhat.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/build/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/build/Makefile
+++ b/tools/build/Makefile
@@ -42,7 +42,7 @@ $(OUTPUT)fixdep-in.o: FORCE
$(Q)$(MAKE) $(build)=fixdep
$(OUTPUT)fixdep: $(OUTPUT)fixdep-in.o
- $(QUIET_LINK)$(HOSTCC) $(LDFLAGS) -o $@ $<
+ $(QUIET_LINK)$(HOSTCC) $(HOSTLDFLAGS) -o $@ $<
FORCE:
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 104/130] packet: reset network header if packet shorter than ll reserved space
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 103/130] tools: build: Use HOSTLDFLAGS with fixdep Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 105/130] qlogic: check kstrtoul() for errors Greg Kroah-Hartman
` (25 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Willem de Bruijn, David S. Miller,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
[ Upstream commit 993675a3100b16a4c80dfd70cbcde8ea7127b31d ]
If variable length link layer headers result in a packet shorter
than dev->hard_header_len, reset the network header offset. Else
skb->mac_len may exceed skb->len after skb_mac_reset_len.
packet_sendmsg_spkt already has similar logic.
Fixes: b84bbaf7a6c8 ("packet: in packet_snd start writing at link layer allocation")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2917,6 +2917,8 @@ static int packet_snd(struct socket *soc
goto out_free;
} else if (reserve) {
skb_reserve(skb, -reserve);
+ if (len < reserve)
+ skb_reset_network_header(skb);
}
/* Returns -EFAULT on error */
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 105/130] qlogic: check kstrtoul() for errors
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 104/130] packet: reset network header if packet shorter than ll reserved space Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 106/130] tcp: remove DELAYED ACK events in DCTCP Greg Kroah-Hartman
` (24 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 5fc853cc01c68f84984ecc2d5fd777ecad78240f ]
We accidentally left out the error handling for kstrtoul().
Fixes: a520030e326a ("qlcnic: Implement flash sysfs callback for 83xx adapter")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sysfs.c
@@ -1128,6 +1128,8 @@ static ssize_t qlcnic_83xx_sysfs_flash_w
struct qlcnic_adapter *adapter = dev_get_drvdata(dev);
ret = kstrtoul(buf, 16, &data);
+ if (ret)
+ return ret;
switch (data) {
case QLC_83XX_FLASH_SECTOR_ERASE_CMD:
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 106/130] tcp: remove DELAYED ACK events in DCTCP
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 105/130] qlogic: check kstrtoul() for errors Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 107/130] pinctrl: nsp: off by ones in nsp_pinmux_enable() Greg Kroah-Hartman
` (23 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yuchung Cheng, Eric Dumazet,
Neal Cardwell, Lawrence Brakmo, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <ycheng@google.com>
[ Upstream commit a69258f7aa2623e0930212f09c586fd06674ad79 ]
After fixing the way DCTCP tracking delayed ACKs, the delayed-ACK
related callbacks are no longer needed
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Lawrence Brakmo <brakmo@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 2 --
net/ipv4/tcp_dctcp.c | 25 -------------------------
net/ipv4/tcp_output.c | 4 ----
3 files changed, 31 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -850,8 +850,6 @@ enum tcp_ca_event {
CA_EVENT_LOSS, /* loss timeout */
CA_EVENT_ECN_NO_CE, /* ECT set, but not CE marked */
CA_EVENT_ECN_IS_CE, /* received CE marked IP packet */
- CA_EVENT_DELAYED_ACK, /* Delayed ack is sent */
- CA_EVENT_NON_DELAYED_ACK,
};
/* Information about inbound ACK, passed to cong_ops->in_ack_event() */
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -55,7 +55,6 @@ struct dctcp {
u32 dctcp_alpha;
u32 next_seq;
u32 ce_state;
- u32 delayed_ack_reserved;
u32 loss_cwnd;
};
@@ -96,7 +95,6 @@ static void dctcp_init(struct sock *sk)
ca->dctcp_alpha = min(dctcp_alpha_on_init, DCTCP_MAX_ALPHA);
- ca->delayed_ack_reserved = 0;
ca->loss_cwnd = 0;
ca->ce_state = 0;
@@ -230,25 +228,6 @@ static void dctcp_state(struct sock *sk,
}
}
-static void dctcp_update_ack_reserved(struct sock *sk, enum tcp_ca_event ev)
-{
- struct dctcp *ca = inet_csk_ca(sk);
-
- switch (ev) {
- case CA_EVENT_DELAYED_ACK:
- if (!ca->delayed_ack_reserved)
- ca->delayed_ack_reserved = 1;
- break;
- case CA_EVENT_NON_DELAYED_ACK:
- if (ca->delayed_ack_reserved)
- ca->delayed_ack_reserved = 0;
- break;
- default:
- /* Don't care for the rest. */
- break;
- }
-}
-
static void dctcp_cwnd_event(struct sock *sk, enum tcp_ca_event ev)
{
switch (ev) {
@@ -258,10 +237,6 @@ static void dctcp_cwnd_event(struct sock
case CA_EVENT_ECN_NO_CE:
dctcp_ce_state_1_to_0(sk);
break;
- case CA_EVENT_DELAYED_ACK:
- case CA_EVENT_NON_DELAYED_ACK:
- dctcp_update_ack_reserved(sk, ev);
- break;
default:
/* Don't care for the rest. */
break;
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -3444,8 +3444,6 @@ void tcp_send_delayed_ack(struct sock *s
int ato = icsk->icsk_ack.ato;
unsigned long timeout;
- tcp_ca_event(sk, CA_EVENT_DELAYED_ACK);
-
if (ato > TCP_DELACK_MIN) {
const struct tcp_sock *tp = tcp_sk(sk);
int max_ato = HZ / 2;
@@ -3502,8 +3500,6 @@ void __tcp_send_ack(struct sock *sk, u32
if (sk->sk_state == TCP_CLOSE)
return;
- tcp_ca_event(sk, CA_EVENT_NON_DELAYED_ACK);
-
/* We are not putting this on the write queue, so
* tcp_transmit_skb() will set the ownership to this
* sock.
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 107/130] pinctrl: nsp: off by ones in nsp_pinmux_enable()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 106/130] tcp: remove DELAYED ACK events in DCTCP Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 108/130] pinctrl: nsp: Fix potential NULL dereference Greg Kroah-Hartman
` (22 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ray Jui,
Linus Walleij, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit f90a21c898db58eaea14b8ad7e9af3b9e15e5f8a ]
The > comparisons should be >= or else we read beyond the end of the
pinctrl->functions[] array.
Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -460,8 +460,8 @@ static int nsp_pinmux_enable(struct pinc
const struct nsp_pin_function *func;
const struct nsp_pin_group *grp;
- if (grp_select > pinctrl->num_groups ||
- func_select > pinctrl->num_functions)
+ if (grp_select >= pinctrl->num_groups ||
+ func_select >= pinctrl->num_functions)
return -EINVAL;
func = &pinctrl->functions[func_select];
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 108/130] pinctrl: nsp: Fix potential NULL dereference
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 107/130] pinctrl: nsp: off by ones in nsp_pinmux_enable() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 109/130] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() Greg Kroah-Hartman
` (21 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wei Yongjun, Ray Jui, Linus Walleij,
Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit c29e9da56bebb4c2c794e871b0dc0298bbf08142 ]
platform_get_resource() may fail and return NULL, so we should
better check it's return value to avoid a NULL pointer dereference
a bit later in the code.
This is detected by Coccinelle semantic patch.
@@
expression pdev, res, n, t, e, e1, e2;
@@
res = platform_get_resource(pdev, t, n);
+ if (!res)
+ return -EINVAL;
... when != res == NULL
e = devm_ioremap_nocache(e1, res->start, e2);
Fixes: cc4fa83f66e9 ("pinctrl: nsp: add pinmux driver support for Broadcom NSP SoC")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/bcm/pinctrl-nsp-mux.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
+++ b/drivers/pinctrl/bcm/pinctrl-nsp-mux.c
@@ -577,6 +577,8 @@ static int nsp_pinmux_probe(struct platf
return PTR_ERR(pinctrl->base0);
res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+ if (!res)
+ return -EINVAL;
pinctrl->base1 = devm_ioremap_nocache(&pdev->dev, res->start,
resource_size(res));
if (!pinctrl->base1) {
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 109/130] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 108/130] pinctrl: nsp: Fix potential NULL dereference Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 110/130] net/ethernet/freescale/fman: fix cross-build error Greg Kroah-Hartman
` (20 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Ben Skeggs, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 7f073d011f93e92d4d225526b9ab6b8b0bbd6613 ]
The bo array has req->nr_buffers elements so the > should be >= so we
don't read beyond the end of the array.
Fixes: a1606a9596e5 ("drm/nouveau: new gem pushbuf interface, bump to 0.0.16")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_gem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -601,7 +601,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
struct nouveau_bo *nvbo;
uint32_t data;
- if (unlikely(r->bo_index > req->nr_buffers)) {
+ if (unlikely(r->bo_index >= req->nr_buffers)) {
NV_PRINTK(err, cli, "reloc bo index invalid\n");
ret = -EINVAL;
break;
@@ -611,7 +611,7 @@ nouveau_gem_pushbuf_reloc_apply(struct n
if (b->presumed.valid)
continue;
- if (unlikely(r->reloc_bo_index > req->nr_buffers)) {
+ if (unlikely(r->reloc_bo_index >= req->nr_buffers)) {
NV_PRINTK(err, cli, "reloc container bo index invalid\n");
ret = -EINVAL;
break;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 110/130] net/ethernet/freescale/fman: fix cross-build error
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 109/130] drm/nouveau/gem: off by one bugs in nouveau_gem_pushbuf_reloc_apply() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 111/130] net: usb: rtl8150: demote allmulti message to dev_dbg() Greg Kroah-Hartman
` (19 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Madalin Bucur, netdev,
linuxppc-dev, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c133459765fae249ba482f62e12f987aec4376f0 ]
CC [M] drivers/net/ethernet/freescale/fman/fman.o
In file included from ../drivers/net/ethernet/freescale/fman/fman.c:35:
../include/linux/fsl/guts.h: In function 'guts_set_dmacr':
../include/linux/fsl/guts.h:165:2: error: implicit declaration of function 'clrsetbits_be32' [-Werror=implicit-function-declaration]
clrsetbits_be32(&guts->dmacr, 3 << shift, device << shift);
^~~~~~~~~~~~~~~
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Madalin Bucur <madalin.bucur@nxp.com>
Cc: netdev@vger.kernel.org
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/fsl/guts.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/fsl/guts.h
+++ b/include/linux/fsl/guts.h
@@ -16,6 +16,7 @@
#define __FSL_GUTS_H__
#include <linux/types.h>
+#include <linux/io.h>
/**
* Global Utility Registers.
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 111/130] net: usb: rtl8150: demote allmulti message to dev_dbg()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 110/130] net/ethernet/freescale/fman: fix cross-build error Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 112/130] PCI: versatile: Fix I/O space page leak Greg Kroah-Hartman
` (18 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Lechner, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <david@lechnology.com>
[ Upstream commit 3a9b0455062ffb9d2f6cd4473a76e3456f318c9f ]
This driver can spam the kernel log with multiple messages of:
net eth0: eth0: allmulti set
Usually 4 or 8 at a time (probably because of using ConnMan).
This message doesn't seem useful, so let's demote it from dev_info()
to dev_dbg().
Signed-off-by: David Lechner <david@lechnology.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/rtl8150.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -681,7 +681,7 @@ static void rtl8150_set_multicast(struct
(netdev->flags & IFF_ALLMULTI)) {
rx_creg &= 0xfffe;
rx_creg |= 0x0002;
- dev_info(&netdev->dev, "%s: allmulti set\n", netdev->name);
+ dev_dbg(&netdev->dev, "%s: allmulti set\n", netdev->name);
} else {
/* ~RX_MULTICAST, ~RX_PROMISCUOUS */
rx_creg &= 0x00fc;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 112/130] PCI: versatile: Fix I/O space page leak
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 111/130] net: usb: rtl8150: demote allmulti message to dev_dbg() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 113/130] net: qca_spi: Avoid packet drop during initial sync Greg Kroah-Hartman
` (17 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Lorenzo Pieralisi,
Bjorn Helgaas, Linus Walleij, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ]
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
Hardware name: Renesas Condor board based on r8a77980 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : ioremap_page_range+0x370/0x3c8
lr : ioremap_page_range+0x40/0x3c8
sp : ffff000008da39e0
x29: ffff000008da39e0 x28: 00e8000000000f07
x27: ffff7dfffee00000 x26: 0140000000000000
x25: ffff7dfffef00000 x24: 00000000000fe100
x23: ffff80007b906000 x22: ffff000008ab8000
x21: ffff000008bb1d58 x20: ffff7dfffef00000
x19: ffff800009c30fb8 x18: 0000000000000001
x17: 00000000000152d0 x16: 00000000014012d0
x15: 0000000000000000 x14: 0720072007200720
x13: 0720072007200720 x12: 0720072007200720
x11: 0720072007300730 x10: 00000000000000ae
x9 : 0000000000000000 x8 : ffff7dffff000000
x7 : 0000000000000000 x6 : 0000000000000100
x5 : 0000000000000000 x4 : 000000007b906000
x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
x1 : 0000000040000000 x0 : 00e80000fe100f07
Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
Call trace:
ioremap_page_range+0x370/0x3c8
pci_remap_iospace+0x7c/0xac
pci_parse_request_of_pci_ranges+0x13c/0x190
rcar_pcie_probe+0x4c/0xb04
platform_drv_probe+0x50/0xbc
driver_probe_device+0x21c/0x308
__device_attach_driver+0x98/0xc8
bus_for_each_drv+0x54/0x94
__device_attach+0xc4/0x12c
device_initial_probe+0x10/0x18
bus_probe_device+0x90/0x98
deferred_probe_work_func+0xb0/0x150
process_one_work+0x12c/0x29c
worker_thread+0x200/0x3fc
kthread+0x108/0x134
ret_from_fork+0x10/0x18
Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.
The Versatile PCI controller driver has the same issue.
Replace pci_remap_iospace() with the devm_ managed version to fix the bug.
Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pci-versatile.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/host/pci-versatile.c
+++ b/drivers/pci/host/pci-versatile.c
@@ -89,7 +89,7 @@ static int versatile_pci_parse_request_o
switch (resource_type(res)) {
case IORESOURCE_IO:
- err = pci_remap_iospace(res, iobase);
+ err = devm_pci_remap_iospace(dev, res, iobase);
if (err) {
dev_warn(dev, "error %d: failed to map resource %pR\n",
err, res);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 113/130] net: qca_spi: Avoid packet drop during initial sync
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 112/130] PCI: versatile: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 114/130] net: qca_spi: Make sure the QCA7000 reset is triggered Greg Kroah-Hartman
` (16 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ]
As long as the synchronization with the QCA7000 isn't finished, we
cannot accept packets from the upper layers. So let the SPI thread
enable the TX queue after sync and avoid unwanted packet drop.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -635,7 +635,7 @@ qcaspi_netdev_open(struct net_device *de
return ret;
}
- netif_start_queue(qca->net_dev);
+ /* SPI thread takes care of TX queue */
return 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 114/130] net: qca_spi: Make sure the QCA7000 reset is triggered
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 113/130] net: qca_spi: Avoid packet drop during initial sync Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 115/130] net: qca_spi: Fix log level if probe fails Greg Kroah-Hartman
` (15 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ]
In case the SPI thread is not running, a simple reset of sync
state won't fix the transmit timeout. We also need to wake up the kernel
thread.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: ed7d42e24eff ("net: qca_spi: fix transmit queue timeout handling")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -739,6 +739,9 @@ qcaspi_netdev_tx_timeout(struct net_devi
qca->net_dev->stats.tx_errors++;
/* Trigger tx queue flush and QCA7000 reset */
qca->sync = QCASPI_SYNC_UNKNOWN;
+
+ if (qca->spi_thread)
+ wake_up_process(qca->spi_thread);
}
static int
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 115/130] net: qca_spi: Fix log level if probe fails
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 114/130] net: qca_spi: Make sure the QCA7000 reset is triggered Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 117/130] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
` (14 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stefan Wahren, David S. Miller, Sasha Levin
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit 50973993260a6934f0a00da53d9b746cfbea89ab ]
In cases the probing fails the log level of the messages should
be an error.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -868,22 +868,22 @@ qca_spi_probe(struct spi_device *spi)
if ((qcaspi_clkspeed < QCASPI_CLK_SPEED_MIN) ||
(qcaspi_clkspeed > QCASPI_CLK_SPEED_MAX)) {
- dev_info(&spi->dev, "Invalid clkspeed: %d\n",
- qcaspi_clkspeed);
+ dev_err(&spi->dev, "Invalid clkspeed: %d\n",
+ qcaspi_clkspeed);
return -EINVAL;
}
if ((qcaspi_burst_len < QCASPI_BURST_LEN_MIN) ||
(qcaspi_burst_len > QCASPI_BURST_LEN_MAX)) {
- dev_info(&spi->dev, "Invalid burst len: %d\n",
- qcaspi_burst_len);
+ dev_err(&spi->dev, "Invalid burst len: %d\n",
+ qcaspi_burst_len);
return -EINVAL;
}
if ((qcaspi_pluggable < QCASPI_PLUGGABLE_MIN) ||
(qcaspi_pluggable > QCASPI_PLUGGABLE_MAX)) {
- dev_info(&spi->dev, "Invalid pluggable: %d\n",
- qcaspi_pluggable);
+ dev_err(&spi->dev, "Invalid pluggable: %d\n",
+ qcaspi_pluggable);
return -EINVAL;
}
@@ -944,8 +944,8 @@ qca_spi_probe(struct spi_device *spi)
}
if (register_netdev(qcaspi_devs)) {
- dev_info(&spi->dev, "Unable to register net device %s\n",
- qcaspi_devs->name);
+ dev_err(&spi->dev, "Unable to register net device %s\n",
+ qcaspi_devs->name);
free_netdev(qcaspi_devs);
return -EFAULT;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 117/130] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 115/130] net: qca_spi: Fix log level if probe fails Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 118/130] ext4: fix spectre gadget in ext4_mb_regular_allocator() Greg Kroah-Hartman
` (13 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Paolo Bonzini,
David Hildenbrand, Sudip Mukherjee
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.
A comment warning against this bug is there, but the code is not doing what
the comment says. Therefore it is possible that an EPOLLHUP races against
irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown,
and if that runs soon enough, you get a use-after-free.
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/eventfd.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct
if (events & POLLIN)
schedule_work(&irqfd->inject);
- /*
- * do not drop the file until the irqfd is fully initialized, otherwise
- * we might race against the POLLHUP
- */
- fdput(f);
#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS
if (kvm_arch_has_irq_bypass()) {
irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct
#endif
srcu_read_unlock(&kvm->irq_srcu, idx);
+
+ /*
+ * do not drop the file until the irqfd is fully initialized, otherwise
+ * we might race against the POLLHUP
+ */
+ fdput(f);
return 0;
fail:
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 118/130] ext4: fix spectre gadget in ext4_mb_regular_allocator()
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 117/130] KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 120/130] xfrm_user: prevent leaking 2 bytes of kernel memory Greg Kroah-Hartman
` (12 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Jeremy Cline, Theodore Tso
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Cline <jcline@redhat.com>
commit 1a5d5e5d51e75a5bca67dadbcea8c841934b7b85 upstream.
'ac->ac_g_ex.fe_len' is a user-controlled value which is used in the
derivation of 'ac->ac_2order'. 'ac->ac_2order', in turn, is used to
index arrays which makes it a potential spectre gadget. Fix this by
sanitizing the value assigned to 'ac->ac2_order'. This covers the
following accesses found with the help of smatch:
* fs/ext4/mballoc.c:1896 ext4_mb_simple_scan_group() warn: potential
spectre issue 'grp->bb_counters' [w] (local cap)
* fs/ext4/mballoc.c:445 mb_find_buddy() warn: potential spectre issue
'EXT4_SB(e4b->bd_sb)->s_mb_offsets' [r] (local cap)
* fs/ext4/mballoc.c:446 mb_find_buddy() warn: potential spectre issue
'EXT4_SB(e4b->bd_sb)->s_mb_maxs' [r] (local cap)
Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/mballoc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -26,6 +26,7 @@
#include <linux/log2.h>
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/nospec.h>
#include <linux/backing-dev.h>
#include <trace/events/ext4.h>
@@ -2144,7 +2145,8 @@ ext4_mb_regular_allocator(struct ext4_al
* This should tell if fe_len is exactly power of 2
*/
if ((ac->ac_g_ex.fe_len & (~(1 << (i - 1)))) == 0)
- ac->ac_2order = i - 1;
+ ac->ac_2order = array_index_nospec(i - 1,
+ sb->s_blocksize_bits + 2);
}
/* if stream allocation is enabled, use global goal */
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 120/130] xfrm_user: prevent leaking 2 bytes of kernel memory
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 118/130] ext4: fix spectre gadget in ext4_mb_regular_allocator() Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 121/130] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state Greg Kroah-Hartman
` (11 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot,
Steffen Klassert, Herbert Xu
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 45c180bc29babbedd6b8c01b975780ef44d9d09c upstream.
struct xfrm_userpolicy_type has two holes, so we should not
use C99 style initializer.
KMSAN report:
BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:140 [inline]
BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571
CPU: 1 PID: 4520 Comm: syz-executor841 Not tainted 4.17.0+ #5
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x185/0x1d0 lib/dump_stack.c:113
kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117
kmsan_internal_check_memory+0x138/0x1f0 mm/kmsan/kmsan.c:1211
kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1253
copyout lib/iov_iter.c:140 [inline]
_copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571
copy_to_iter include/linux/uio.h:106 [inline]
skb_copy_datagram_iter+0x422/0xfa0 net/core/datagram.c:431
skb_copy_datagram_msg include/linux/skbuff.h:3268 [inline]
netlink_recvmsg+0x6f1/0x1900 net/netlink/af_netlink.c:1959
sock_recvmsg_nosec net/socket.c:802 [inline]
sock_recvmsg+0x1d6/0x230 net/socket.c:809
___sys_recvmsg+0x3fe/0x810 net/socket.c:2279
__sys_recvmmsg+0x58e/0xe30 net/socket.c:2391
do_sys_recvmmsg+0x2a6/0x3e0 net/socket.c:2472
__do_sys_recvmmsg net/socket.c:2485 [inline]
__se_sys_recvmmsg net/socket.c:2481 [inline]
__x64_sys_recvmmsg+0x15d/0x1c0 net/socket.c:2481
do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446ce9
RSP: 002b:00007fc307918db8 EFLAGS: 00000293 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00000000006dbc24 RCX: 0000000000446ce9
RDX: 000000000000000a RSI: 0000000020005040 RDI: 0000000000000003
RBP: 00000000006dbc20 R08: 0000000020004e40 R09: 0000000000000000
R10: 0000000040000000 R11: 0000000000000293 R12: 0000000000000000
R13: 00007ffc8d2df32f R14: 00007fc3079199c0 R15: 0000000000000001
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline]
kmsan_save_stack mm/kmsan/kmsan.c:294 [inline]
kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685
kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:527
__msan_memcpy+0x109/0x160 mm/kmsan/kmsan_instr.c:413
__nla_put lib/nlattr.c:569 [inline]
nla_put+0x276/0x340 lib/nlattr.c:627
copy_to_user_policy_type net/xfrm/xfrm_user.c:1678 [inline]
dump_one_policy+0xbe1/0x1090 net/xfrm/xfrm_user.c:1708
xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013
xfrm_dump_policy+0x1c0/0x2a0 net/xfrm/xfrm_user.c:1749
netlink_dump+0x9b5/0x1550 net/netlink/af_netlink.c:2226
__netlink_dump_start+0x1131/0x1270 net/netlink/af_netlink.c:2323
netlink_dump_start include/linux/netlink.h:214 [inline]
xfrm_user_rcv_msg+0x8a3/0x9b0 net/xfrm/xfrm_user.c:2577
netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448
xfrm_netlink_rcv+0xb2/0xf0 net/xfrm/xfrm_user.c:2598
netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336
netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg net/socket.c:639 [inline]
___sys_sendmsg+0xec8/0x1320 net/socket.c:2117
__sys_sendmsg net/socket.c:2155 [inline]
__do_sys_sendmsg net/socket.c:2164 [inline]
__se_sys_sendmsg net/socket.c:2162 [inline]
__x64_sys_sendmsg+0x331/0x460 net/socket.c:2162
do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Local variable description: ----upt.i@dump_one_policy
Variable was created at:
dump_one_policy+0x78/0x1090 net/xfrm/xfrm_user.c:1689
xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013
Byte 130 of 137 is uninitialized
Memory access starts at ffff88019550407f
Fixes: c0144beaeca42 ("[XFRM] netlink: Use nla_put()/NLA_PUT() variantes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_user.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1628,9 +1628,11 @@ static inline size_t userpolicy_type_att
#ifdef CONFIG_XFRM_SUB_POLICY
static int copy_to_user_policy_type(u8 type, struct sk_buff *skb)
{
- struct xfrm_userpolicy_type upt = {
- .type = type,
- };
+ struct xfrm_userpolicy_type upt;
+
+ /* Sadly there are two holes in struct xfrm_userpolicy_type */
+ memset(&upt, 0, sizeof(upt));
+ upt.type = type;
return nla_put(skb, XFRMA_POLICY_TYPE, sizeof(upt), &upt);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 121/130] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 120/130] xfrm_user: prevent leaking 2 bytes of kernel memory Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:53 ` [PATCH 4.9 122/130] packet: refine ring v3 block size test to hold one frame Greg Kroah-Hartman
` (10 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+6f18401420df260e37ed,
Florian Westphal, Pablo Neira Ayuso
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 6613b6173dee098997229caf1f3b961c49da75e6 upstream.
When first DCCP packet is SYNC or SYNCACK, we insert a new conntrack
that has an un-initialized timeout value, i.e. such entry could be
reaped at any time.
Mark them as INVALID and only ignore SYNC/SYNCACK when connection had
an old state.
Reported-by: syzbot+6f18401420df260e37ed@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_proto_dccp.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/net/netfilter/nf_conntrack_proto_dccp.c
+++ b/net/netfilter/nf_conntrack_proto_dccp.c
@@ -244,14 +244,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
* We currently ignore Sync packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
[DCCP_PKT_SYNCACK] = {
/*
* We currently ignore SyncAck packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
},
[CT_DCCP_ROLE_SERVER] = {
@@ -372,14 +372,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D
* We currently ignore Sync packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
[DCCP_PKT_SYNCACK] = {
/*
* We currently ignore SyncAck packets
*
* sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */
- sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
+ sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG,
},
},
};
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 122/130] packet: refine ring v3 block size test to hold one frame
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 121/130] netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state Greg Kroah-Hartman
@ 2018-08-23 7:53 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.9 124/130] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
` (9 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:53 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Willem de Bruijn, David S. Miller
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
commit 4576cd469d980317c4edd9173f8b694aa71ea3a3 upstream.
TPACKET_V3 stores variable length frames in fixed length blocks.
Blocks must be able to store a block header, optional private space
and at least one minimum sized frame.
Frames, even for a zero snaplen packet, store metadata headers and
optional reserved space.
In the block size bounds check, ensure that the frame of the
chosen configuration fits. This includes sockaddr_ll and optional
tp_reserve.
Syzbot was able to construct a ring with insuffient room for the
sockaddr_ll in the header of a zero-length frame, triggering an
out-of-bounds write in dev_parse_header.
Convert the comparison to less than, as zero is a valid snap len.
This matches the test for minimum tp_frame_size immediately below.
Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Fixes: eb73190f4fbe ("net/packet: refine check for priv area size")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4275,6 +4275,8 @@ static int packet_set_ring(struct sock *
}
if (req->tp_block_nr) {
+ unsigned int min_frame_size;
+
/* Sanity tests and some calculations */
err = -EBUSY;
if (unlikely(rb->pg_vec))
@@ -4297,12 +4299,12 @@ static int packet_set_ring(struct sock *
goto out;
if (unlikely(!PAGE_ALIGNED(req->tp_block_size)))
goto out;
+ min_frame_size = po->tp_hdrlen + po->tp_reserve;
if (po->tp_version >= TPACKET_V3 &&
- req->tp_block_size <=
- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
+ req->tp_block_size <
+ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + min_frame_size)
goto out;
- if (unlikely(req->tp_frame_size < po->tp_hdrlen +
- po->tp_reserve))
+ if (unlikely(req->tp_frame_size < min_frame_size))
goto out;
if (unlikely(req->tp_frame_size & (TPACKET_ALIGNMENT - 1)))
goto out;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 124/130] PCI: OF: Fix I/O space page leak
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2018-08-23 7:53 ` [PATCH 4.9 122/130] packet: refine ring v3 block size test to hold one frame Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 11:08 ` Sergei Shtylyov
2018-08-23 7:54 ` [PATCH 4.9 125/130] PCI: hotplug: Dont leak pci_slot on registration failure Greg Kroah-Hartman
` (8 subsequent siblings)
126 siblings, 1 reply; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergei Shtylyov, Lorenzo Pieralisi,
Bjorn Helgaas, Linus Walleij
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
Hardware name: Renesas Condor board based on r8a77980 (DT)
Workqueue: events deferred_probe_work_func
pstate: 80000005 (Nzcv daif -PAN -UAO)
pc : ioremap_page_range+0x370/0x3c8
lr : ioremap_page_range+0x40/0x3c8
sp : ffff000008da39e0
x29: ffff000008da39e0 x28: 00e8000000000f07
x27: ffff7dfffee00000 x26: 0140000000000000
x25: ffff7dfffef00000 x24: 00000000000fe100
x23: ffff80007b906000 x22: ffff000008ab8000
x21: ffff000008bb1d58 x20: ffff7dfffef00000
x19: ffff800009c30fb8 x18: 0000000000000001
x17: 00000000000152d0 x16: 00000000014012d0
x15: 0000000000000000 x14: 0720072007200720
x13: 0720072007200720 x12: 0720072007200720
x11: 0720072007300730 x10: 00000000000000ae
x9 : 0000000000000000 x8 : ffff7dffff000000
x7 : 0000000000000000 x6 : 0000000000000100
x5 : 0000000000000000 x4 : 000000007b906000
x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
x1 : 0000000040000000 x0 : 00e80000fe100f07
Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
Call trace:
ioremap_page_range+0x370/0x3c8
pci_remap_iospace+0x7c/0xac
pci_parse_request_of_pci_ranges+0x13c/0x190
rcar_pcie_probe+0x4c/0xb04
platform_drv_probe+0x50/0xbc
driver_probe_device+0x21c/0x308
__device_attach_driver+0x98/0xc8
bus_for_each_drv+0x54/0x94
__device_attach+0xc4/0x12c
device_initial_probe+0x10/0x18
bus_probe_device+0x90/0x98
deferred_probe_work_func+0xb0/0x150
process_one_work+0x12c/0x29c
worker_thread+0x200/0x3fc
kthread+0x108/0x134
ret_from_fork+0x10/0x18
Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's
probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
the probe was retried, finally causing the BUG due to trying to remap
already remapped pages.
Introduce the devm_pci_remap_iospace() managed API and replace the
pci_remap_iospace() call with it to fix the bug.
Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
[lorenzo.pieralisi@arm.com: split commit/updated the commit log]
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
[Backport just for the new api which other patches need - gregkh]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
include/linux/pci.h | 2 ++
2 files changed, 40 insertions(+)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3436,6 +3436,44 @@ char * __weak __init pcibios_setup(char
return str;
}
+static void devm_pci_unmap_iospace(struct device *dev, void *ptr)
+{
+ struct resource **res = ptr;
+
+ pci_unmap_iospace(*res);
+}
+
+/**
+ * devm_pci_remap_iospace - Managed pci_remap_iospace()
+ * @dev: Generic device to remap IO address for
+ * @res: Resource describing the I/O space
+ * @phys_addr: physical address of range to be mapped
+ *
+ * Managed pci_remap_iospace(). Map is automatically unmapped on driver
+ * detach.
+ */
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr)
+{
+ const struct resource **ptr;
+ int error;
+
+ ptr = devres_alloc(devm_pci_unmap_iospace, sizeof(*ptr), GFP_KERNEL);
+ if (!ptr)
+ return -ENOMEM;
+
+ error = pci_remap_iospace(res, phys_addr);
+ if (error) {
+ devres_free(ptr);
+ } else {
+ *ptr = res;
+ devres_add(dev, ptr);
+ }
+
+ return error;
+}
+EXPORT_SYMBOL(devm_pci_remap_iospace);
+
/**
* pcibios_set_master - enable PCI bus-mastering for device dev
* @dev: the PCI device to enable
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -1190,6 +1190,8 @@ int pci_register_io_range(phys_addr_t ad
unsigned long pci_address_to_pio(phys_addr_t addr);
phys_addr_t pci_pio_to_address(unsigned long pio);
int pci_remap_iospace(const struct resource *res, phys_addr_t phys_addr);
+int devm_pci_remap_iospace(struct device *dev, const struct resource *res,
+ phys_addr_t phys_addr);
void pci_unmap_iospace(struct resource *res);
static inline pci_bus_addr_t pci_bus_address(struct pci_dev *pdev, int bar)
^ permalink raw reply [flat|nested] 130+ messages in thread* Re: [PATCH 4.9 124/130] PCI: OF: Fix I/O space page leak
2018-08-23 7:54 ` [PATCH 4.9 124/130] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 11:08 ` Sergei Shtylyov
0 siblings, 0 replies; 130+ messages in thread
From: Sergei Shtylyov @ 2018-08-23 11:08 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Lorenzo Pieralisi, Bjorn Helgaas, Linus Walleij
On 08/23/2018 10:54 AM, Greg Kroah-Hartman wrote:
> 4.9-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
>
> commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
>
> When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY
> driver was left disabled, the kernel crashed with this BUG:
>
> kernel BUG at lib/ioremap.c:72!
> Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092
> Hardware name: Renesas Condor board based on r8a77980 (DT)
> Workqueue: events deferred_probe_work_func
> pstate: 80000005 (Nzcv daif -PAN -UAO)
> pc : ioremap_page_range+0x370/0x3c8
> lr : ioremap_page_range+0x40/0x3c8
> sp : ffff000008da39e0
> x29: ffff000008da39e0 x28: 00e8000000000f07
> x27: ffff7dfffee00000 x26: 0140000000000000
> x25: ffff7dfffef00000 x24: 00000000000fe100
> x23: ffff80007b906000 x22: ffff000008ab8000
> x21: ffff000008bb1d58 x20: ffff7dfffef00000
> x19: ffff800009c30fb8 x18: 0000000000000001
> x17: 00000000000152d0 x16: 00000000014012d0
> x15: 0000000000000000 x14: 0720072007200720
> x13: 0720072007200720 x12: 0720072007200720
> x11: 0720072007300730 x10: 00000000000000ae
> x9 : 0000000000000000 x8 : ffff7dffff000000
> x7 : 0000000000000000 x6 : 0000000000000100
> x5 : 0000000000000000 x4 : 000000007b906000
> x3 : ffff80007c61a880 x2 : ffff7dfffeefffff
> x1 : 0000000040000000 x0 : 00e80000fe100f07
> Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval))
> Call trace:
> ioremap_page_range+0x370/0x3c8
> pci_remap_iospace+0x7c/0xac
> pci_parse_request_of_pci_ranges+0x13c/0x190
> rcar_pcie_probe+0x4c/0xb04
> platform_drv_probe+0x50/0xbc
> driver_probe_device+0x21c/0x308
> __device_attach_driver+0x98/0xc8
> bus_for_each_drv+0x54/0x94
> __device_attach+0xc4/0x12c
> device_initial_probe+0x10/0x18
> bus_probe_device+0x90/0x98
> deferred_probe_work_func+0xb0/0x150
> process_one_work+0x12c/0x29c
> worker_thread+0x200/0x3fc
> kthread+0x108/0x134
> ret_from_fork+0x10/0x18
> Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
>
> It turned out that pci_remap_iospace() wasn't undone when the driver's
> probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER,
> the probe was retried, finally causing the BUG due to trying to remap
> already remapped pages.
>
> Introduce the devm_pci_remap_iospace() managed API and replace the
> pci_remap_iospace() call with it to fix the bug.
>
> Fixes: dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")
> Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
> [lorenzo.pieralisi@arm.com: split commit/updated the commit log]
> Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> [Backport just for the new api which other patches need - gregkh]
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++
> include/linux/pci.h | 2 ++
> 2 files changed, 40 insertions(+)
Again, you missed a change to drivers/pci/host/pci-host-common.c (and
also drivers/pci/host/pcie-rcar.c which wasn't using the generic code back
then)...
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 130+ messages in thread
* [PATCH 4.9 125/130] PCI: hotplug: Dont leak pci_slot on registration failure
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 124/130] PCI: OF: Fix I/O space page leak Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.9 126/130] PCI: Skip MPS logic for Virtual Functions (VFs) Greg Kroah-Hartman
` (7 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas,
Greg Kroah-Hartman
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 4ce6435820d1f1cc2c2788e232735eb244bcc8a3 upstream.
If addition of sysfs files fails on registration of a hotplug slot, the
struct pci_slot as well as the entry in the slot_list is leaked. The
issue has been present since the hotplug core was introduced in 2002:
https://git.kernel.org/tglx/history/c/a8a2069f432c
Perhaps the idea was that even though sysfs addition fails, the slot
should still be usable. But that's not how drivers use the interface,
they abort probe if a non-zero value is returned.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.4.15+
Cc: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pci_hotplug_core.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/pci/hotplug/pci_hotplug_core.c
+++ b/drivers/pci/hotplug/pci_hotplug_core.c
@@ -455,8 +455,17 @@ int __pci_hp_register(struct hotplug_slo
list_add(&slot->slot_list, &pci_hotplug_slot_list);
result = fs_add_slot(pci_slot);
+ if (result)
+ goto err_list_del;
+
kobject_uevent(&pci_slot->kobj, KOBJ_ADD);
dbg("Added slot %s to the list\n", name);
+ goto out;
+
+err_list_del:
+ list_del(&slot->slot_list);
+ pci_slot->hotplug = NULL;
+ pci_destroy_slot(pci_slot);
out:
mutex_unlock(&pci_hp_mutex);
return result;
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 126/130] PCI: Skip MPS logic for Virtual Functions (VFs)
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 125/130] PCI: hotplug: Dont leak pci_slot on registration failure Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.9 127/130] PCI: pciehp: Fix use-after-free on unplug Greg Kroah-Hartman
` (6 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Myron Stowe, Bjorn Helgaas,
Keith Busch, Sinan Kaya, Dongdong Liu, Jon Mason
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myron Stowe <myron.stowe@redhat.com>
commit 3dbe97efe8bf450b183d6dee2305cbc032e6b8a4 upstream.
PCIe r4.0, sec 9.3.5.4, "Device Control Register", shows both
Max_Payload_Size (MPS) and Max_Read_request_Size (MRRS) to be 'RsvdP' for
VFs. Just prior to the table it states:
"PF and VF functionality is defined in Section 7.5.3.4 except where
noted in Table 9-16. For VF fields marked 'RsvdP', the PF setting
applies to the VF."
All of which implies that with respect to Max_Payload_Size Supported
(MPSS), MPS, and MRRS values, we should not be paying any attention to the
VF's fields, but rather only to the PF's. Only looking at the PF's fields
also logically makes sense as it's the sole physical interface to the PCIe
bus.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=200527
Fixes: 27d868b5e6cf ("PCI: Set MPS to match upstream bridge")
Signed-off-by: Myron Stowe <myron.stowe@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # 4.3+
Cc: Keith Busch <keith.busch@intel.com>
Cc: Sinan Kaya <okaya@kernel.org>
Cc: Dongdong Liu <liudongdong3@huawei.com>
Cc: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/probe.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -1363,6 +1363,10 @@ static void pci_configure_mps(struct pci
if (!pci_is_pcie(dev) || !bridge || !pci_is_pcie(bridge))
return;
+ /* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */
+ if (dev->is_virtfn)
+ return;
+
mps = pcie_get_mps(dev);
p_mps = pcie_get_mps(bridge);
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 127/130] PCI: pciehp: Fix use-after-free on unplug
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 126/130] PCI: Skip MPS logic for Virtual Functions (VFs) Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.9 128/130] PCI: pciehp: Fix unprotected list iteration in IRQ handler Greg Kroah-Hartman
` (5 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 281e878eab191cce4259abbbf1a0322e3adae02c upstream.
When pciehp is unbound (e.g. on unplug of a Thunderbolt device), the
hotplug_slot struct is deregistered and thus freed before freeing the
IRQ. The IRQ handler and the work items it schedules print the slot
name referenced from the freed structure in various informational and
debug log messages, each time resulting in a quadruple dereference of
freed pointers (hotplug_slot -> pci_slot -> kobject -> name).
At best the slot name is logged as "(null)", at worst kernel memory is
exposed in logs or the driver crashes:
pciehp 0000:10:00.0:pcie204: Slot((null)): Card not present
An attacker may provoke the bug by unplugging multiple devices on a
Thunderbolt daisy chain at once. Unplugging can also be simulated by
powering down slots via sysfs. The bug is particularly easy to trigger
in poll mode.
It has been present since the driver's introduction in 2004:
https://git.kernel.org/tglx/history/c/c16b4b14d980
Fix by rearranging teardown such that the IRQ is freed first. Run the
work items queued by the IRQ handler to completion before freeing the
hotplug_slot struct by draining the work queue from the ->release_slot
callback which is invoked by pci_hp_deregister().
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org # v2.6.4
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pciehp.h | 1 +
drivers/pci/hotplug/pciehp_core.c | 7 +++++++
drivers/pci/hotplug/pciehp_hpc.c | 5 ++---
3 files changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -132,6 +132,7 @@ int pciehp_unconfigure_device(struct slo
void pciehp_queue_pushbutton_work(struct work_struct *work);
struct controller *pcie_init(struct pcie_device *dev);
int pcie_init_notification(struct controller *ctrl);
+void pcie_shutdown_notification(struct controller *ctrl);
int pciehp_enable_slot(struct slot *p_slot);
int pciehp_disable_slot(struct slot *p_slot);
void pcie_reenable_notification(struct controller *ctrl);
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -76,6 +76,12 @@ static int reset_slot(struct hotplug_slo
*/
static void release_slot(struct hotplug_slot *hotplug_slot)
{
+ struct slot *slot = hotplug_slot->private;
+
+ /* queued work needs hotplug_slot name */
+ cancel_delayed_work(&slot->work);
+ drain_workqueue(slot->wq);
+
kfree(hotplug_slot->ops);
kfree(hotplug_slot->info);
kfree(hotplug_slot);
@@ -278,6 +284,7 @@ static void pciehp_remove(struct pcie_de
{
struct controller *ctrl = get_service_data(dev);
+ pcie_shutdown_notification(ctrl);
cleanup_slot(ctrl);
pciehp_release_ctrl(ctrl);
}
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -786,7 +786,7 @@ int pcie_init_notification(struct contro
return 0;
}
-static void pcie_shutdown_notification(struct controller *ctrl)
+void pcie_shutdown_notification(struct controller *ctrl)
{
if (ctrl->notification_enabled) {
pcie_disable_notification(ctrl);
@@ -821,7 +821,7 @@ abort:
static void pcie_cleanup_slot(struct controller *ctrl)
{
struct slot *slot = ctrl->slot;
- cancel_delayed_work(&slot->work);
+
destroy_workqueue(slot->wq);
kfree(slot);
}
@@ -902,7 +902,6 @@ abort:
void pciehp_release_ctrl(struct controller *ctrl)
{
- pcie_shutdown_notification(ctrl);
pcie_cleanup_slot(ctrl);
kfree(ctrl);
}
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 128/130] PCI: pciehp: Fix unprotected list iteration in IRQ handler
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 127/130] PCI: pciehp: Fix use-after-free on unplug Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 7:54 ` [PATCH 4.9 130/130] reiserfs: fix broken xattr handling (heap corruption, bad retval) Greg Kroah-Hartman
` (4 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Bjorn Helgaas
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 1204e35bedf4e5015cda559ed8c84789a6dae24e upstream.
Commit b440bde74f04 ("PCI: Add pci_ignore_hotplug() to ignore hotplug
events for a device") iterates over the devices on a hotplug port's
subordinate bus in pciehp's IRQ handler without acquiring pci_bus_sem.
It is thus possible for a user to cause a crash by concurrently
manipulating the device list, e.g. by disabling slot power via sysfs
on a different CPU or by initiating a remove/rescan via sysfs.
This can't be fixed by acquiring pci_bus_sem because it may sleep.
The simplest fix is to avoid the list iteration altogether and just
check the ignore_hotplug flag on the port itself. This works because
pci_ignore_hotplug() sets the flag both on the device as well as on its
parent bridge.
We do lose the ability to print the name of the device blocking hotplug
in the debug message, but that's probably bearable.
Fixes: b440bde74f04 ("PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/hotplug/pciehp_hpc.c | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -562,8 +562,6 @@ static irqreturn_t pciehp_isr(int irq, v
{
struct controller *ctrl = (struct controller *)dev_id;
struct pci_dev *pdev = ctrl_dev(ctrl);
- struct pci_bus *subordinate = pdev->subordinate;
- struct pci_dev *dev;
struct slot *slot = ctrl->slot;
u16 status, events;
u8 present;
@@ -611,14 +609,9 @@ static irqreturn_t pciehp_isr(int irq, v
wake_up(&ctrl->queue);
}
- if (subordinate) {
- list_for_each_entry(dev, &subordinate->devices, bus_list) {
- if (dev->ignore_hotplug) {
- ctrl_dbg(ctrl, "ignoring hotplug event %#06x (%s requested no hotplug)\n",
- events, pci_name(dev));
- return IRQ_HANDLED;
- }
- }
+ if (pdev->ignore_hotplug) {
+ ctrl_dbg(ctrl, "ignoring hotplug event %#06x\n", events);
+ return IRQ_HANDLED;
}
/* Check Attention Button Pressed */
^ permalink raw reply [flat|nested] 130+ messages in thread* [PATCH 4.9 130/130] reiserfs: fix broken xattr handling (heap corruption, bad retval)
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 128/130] PCI: pciehp: Fix unprotected list iteration in IRQ handler Greg Kroah-Hartman
@ 2018-08-23 7:54 ` Greg Kroah-Hartman
2018-08-23 18:09 ` [PATCH 4.9 000/130] 4.9.124-stable review Nathan Chancellor
` (3 subsequent siblings)
126 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 7:54 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jann Horn, Jeff Mahoney,
Eric Biggers, Al Viro, Andrew Morton, Linus Torvalds
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit a13f085d111e90469faf2d9965eb39b11c114d7e upstream.
This fixes the following issues:
- When a buffer size is supplied to reiserfs_listxattr() such that each
individual name fits, but the concatenation of all names doesn't fit,
reiserfs_listxattr() overflows the supplied buffer. This leads to a
kernel heap overflow (verified using KASAN) followed by an out-of-bounds
usercopy and is therefore a security bug.
- When a buffer size is supplied to reiserfs_listxattr() such that a
name doesn't fit, -ERANGE should be returned. But reiserfs instead just
truncates the list of names; I have verified that if the only xattr on a
file has a longer name than the supplied buffer length, listxattr()
incorrectly returns zero.
With my patch applied, -ERANGE is returned in both cases and the memory
corruption doesn't happen anymore.
Credit for making me clean this code up a bit goes to Al Viro, who pointed
out that the ->actor calling convention is suboptimal and should be
changed.
Link: http://lkml.kernel.org/r/20180802151539.5373-1-jannh@google.com
Fixes: 48b32a3553a5 ("reiserfs: use generic xattr handlers")
Signed-off-by: Jann Horn <jannh@google.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
Cc: Eric Biggers <ebiggers@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/reiserfs/xattr.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/reiserfs/xattr.c
+++ b/fs/reiserfs/xattr.c
@@ -791,8 +791,10 @@ static int listxattr_filler(struct dir_c
return 0;
size = namelen + 1;
if (b->buf) {
- if (size > b->size)
+ if (b->pos + size > b->size) {
+ b->pos = -ERANGE;
return -ERANGE;
+ }
memcpy(b->buf + b->pos, name, namelen);
b->buf[b->pos + namelen] = 0;
}
^ permalink raw reply [flat|nested] 130+ messages in thread* Re: [PATCH 4.9 000/130] 4.9.124-stable review
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2018-08-23 7:54 ` [PATCH 4.9 130/130] reiserfs: fix broken xattr handling (heap corruption, bad retval) Greg Kroah-Hartman
@ 2018-08-23 18:09 ` Nathan Chancellor
2018-08-23 20:50 ` Greg Kroah-Hartman
2018-08-23 19:18 ` Shuah Khan
` (2 subsequent siblings)
126 siblings, 1 reply; 130+ messages in thread
From: Nathan Chancellor @ 2018-08-23 18:09 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Thu, Aug 23, 2018 at 09:51:56AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.124 release.
> There are 130 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:48:45 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.124-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Merged, compiled with -Werror, and installed onto my OnePlus 6.
No initial issues noticed in dmesg or general usage.
Thanks!
Nathan
^ permalink raw reply [flat|nested] 130+ messages in thread* Re: [PATCH 4.9 000/130] 4.9.124-stable review
2018-08-23 18:09 ` [PATCH 4.9 000/130] 4.9.124-stable review Nathan Chancellor
@ 2018-08-23 20:50 ` Greg Kroah-Hartman
0 siblings, 0 replies; 130+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 20:50 UTC (permalink / raw)
To: Nathan Chancellor
Cc: linux-kernel, torvalds, akpm, linux, shuah, patches,
ben.hutchings, lkft-triage, stable
On Thu, Aug 23, 2018 at 11:09:01AM -0700, Nathan Chancellor wrote:
> On Thu, Aug 23, 2018 at 09:51:56AM +0200, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.9.124 release.
> > There are 130 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sat Aug 25 07:48:45 UTC 2018.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.124-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Merged, compiled with -Werror, and installed onto my OnePlus 6.
>
> No initial issues noticed in dmesg or general usage.
Wonderful, thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 130+ messages in thread
* Re: [PATCH 4.9 000/130] 4.9.124-stable review
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2018-08-23 18:09 ` [PATCH 4.9 000/130] 4.9.124-stable review Nathan Chancellor
@ 2018-08-23 19:18 ` Shuah Khan
2018-08-23 20:11 ` Guenter Roeck
2018-08-24 5:26 ` Naresh Kamboju
126 siblings, 0 replies; 130+ messages in thread
From: Shuah Khan @ 2018-08-23 19:18 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 08/23/2018 01:51 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.124 release.
> There are 130 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:48:45 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.124-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 130+ messages in thread* Re: [PATCH 4.9 000/130] 4.9.124-stable review
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2018-08-23 19:18 ` Shuah Khan
@ 2018-08-23 20:11 ` Guenter Roeck
2018-08-24 5:26 ` Naresh Kamboju
126 siblings, 0 replies; 130+ messages in thread
From: Guenter Roeck @ 2018-08-23 20:11 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Thu, Aug 23, 2018 at 09:51:56AM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.9.124 release.
> There are 130 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:48:45 UTC 2018.
> Anything received after that time might be too late.
>
Build results:
total: 148 pass: 148 fail: 0
Qemu test results:
total: 289 pass: 289 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 130+ messages in thread* Re: [PATCH 4.9 000/130] 4.9.124-stable review
2018-08-23 7:51 [PATCH 4.9 000/130] 4.9.124-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2018-08-23 20:11 ` Guenter Roeck
@ 2018-08-24 5:26 ` Naresh Kamboju
126 siblings, 0 replies; 130+ messages in thread
From: Naresh Kamboju @ 2018-08-24 5:26 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: open list, Linus Torvalds, Andrew Morton, Guenter Roeck,
Shuah Khan, patches, Ben Hutchings, lkft-triage, linux- stable
On 23 August 2018 at 13:21, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 4.9.124 release.
> There are 130 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat Aug 25 07:48:45 UTC 2018.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.124-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.9.124-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: d8c335b8a13deabf0c024b9728d62d686a2a9d0f
git describe: v4.9.123-131-gd8c335b8a13d
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.123-131-gd8c335b8a13d
No regressions (compared to build v4.9.122)
Ran 12411 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- juno-r2 - arm64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 130+ messages in thread