* [PATCH 3.16 034/233] uio: add missing error codes
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 046/233] USB: hub: fix non-SS hub-descriptor handling Ben Hutchings
` (232 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 0320a278b9ef80cfa44f74b7f9bb36781695f3ee upstream.
My static checker complains that "ret" could be uninitialized at the
end, which is true but it's more likely that it would be set to zero.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/uio/uio.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -283,12 +283,16 @@ static int uio_dev_add_attributes(struct
map_found = 1;
idev->map_dir = kobject_create_and_add("maps",
&idev->dev->kobj);
- if (!idev->map_dir)
+ if (!idev->map_dir) {
+ ret = -ENOMEM;
goto err_map;
+ }
}
map = kzalloc(sizeof(*map), GFP_KERNEL);
- if (!map)
+ if (!map) {
+ ret = -ENOMEM;
goto err_map_kobj;
+ }
kobject_init(&map->kobj, &map_attr_type);
map->mem = mem;
mem->map = map;
@@ -308,12 +312,16 @@ static int uio_dev_add_attributes(struct
portio_found = 1;
idev->portio_dir = kobject_create_and_add("portio",
&idev->dev->kobj);
- if (!idev->portio_dir)
+ if (!idev->portio_dir) {
+ ret = -ENOMEM;
goto err_portio;
+ }
}
portio = kzalloc(sizeof(*portio), GFP_KERNEL);
- if (!portio)
+ if (!portio) {
+ ret = -ENOMEM;
goto err_portio_kobj;
+ }
kobject_init(&portio->kobj, &portio_attr_type);
portio->port = port;
port->portio = portio;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 046/233] USB: hub: fix non-SS hub-descriptor handling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 034/233] uio: add missing error codes Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 097/233] ext4: fix data corruption for mmap writes Ben Hutchings
` (231 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alan Stern, Johan Hovold, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit bec444cd1c94c48df409a35ad4e5b143c245c3f7 upstream.
Add missing sanity check on the non-SuperSpeed hub-descriptor length in
order to avoid parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes (or a compound-device debug
statement).
Note that we only make sure that the DeviceRemovable field is always
present (and specifically ignore the unused PortPwrCtrlMask field) in
order to continue support any hubs with non-compliant descriptors. As a
further safeguard, the descriptor buffer is also cleared.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/hub.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -363,7 +363,8 @@ static void usb_set_lpm_parameters(struc
}
/* USB 2.0 spec Section 11.24.4.5 */
-static int get_hub_descriptor(struct usb_device *hdev, void *data)
+static int get_hub_descriptor(struct usb_device *hdev,
+ struct usb_hub_descriptor *desc)
{
int i, ret, size;
unsigned dtype;
@@ -379,12 +380,16 @@ static int get_hub_descriptor(struct usb
for (i = 0; i < 3; i++) {
ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0),
USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
- dtype << 8, 0, data, size,
+ dtype << 8, 0, desc, size,
USB_CTRL_GET_TIMEOUT);
if (hub_is_superspeed(hdev)) {
if (ret == size)
return ret;
- } else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
+ } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) {
+ /* Make sure we have the DeviceRemovable field. */
+ size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1;
+ if (ret < size)
+ return -EMSGSIZE;
return ret;
}
}
@@ -1297,7 +1302,7 @@ static int hub_configure(struct usb_hub
}
mutex_init(&hub->status_mutex);
- hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL);
+ hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL);
if (!hub->descriptor) {
ret = -ENOMEM;
goto fail;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 097/233] ext4: fix data corruption for mmap writes
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 034/233] uio: add missing error codes Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 046/233] USB: hub: fix non-SS hub-descriptor handling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 003/233] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Ben Hutchings
` (230 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michael Zimmer, Jan Kara, Theodore Ts'o
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit a056bdaae7a181f7dcc876cfab2f94538e508709 upstream.
mpage_submit_page() can race with another process growing i_size and
writing data via mmap to the written-back page. As mpage_submit_page()
samples i_size too early, it may happen that ext4_bio_write_page()
zeroes out too large tail of the page and thus corrupts user data.
Fix the problem by sampling i_size only after the page has been
write-protected in page tables by clear_page_dirty_for_io() call.
Reported-by: Michael Zimmer <michael@swarm64.com>
Fixes: cb20d5188366f04d96d2e07b1240cc92170ade40
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/inode.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1994,15 +1994,29 @@ static int ext4_writepage(struct page *p
static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page)
{
int len;
- loff_t size = i_size_read(mpd->inode);
+ loff_t size;
int err;
BUG_ON(page->index != mpd->first_page);
+ clear_page_dirty_for_io(page);
+ /*
+ * We have to be very careful here! Nothing protects writeback path
+ * against i_size changes and the page can be writeably mapped into
+ * page tables. So an application can be growing i_size and writing
+ * data through mmap while writeback runs. clear_page_dirty_for_io()
+ * write-protects our page in page tables and the page cannot get
+ * written to again until we release page lock. So only after
+ * clear_page_dirty_for_io() we are safe to sample i_size for
+ * ext4_bio_write_page() to zero-out tail of the written page. We rely
+ * on the barrier provided by TestClearPageDirty in
+ * clear_page_dirty_for_io() to make sure i_size is really sampled only
+ * after page tables are updated.
+ */
+ size = i_size_read(mpd->inode);
if (page->index == size >> PAGE_CACHE_SHIFT)
len = size & ~PAGE_CACHE_MASK;
else
len = PAGE_CACHE_SIZE;
- clear_page_dirty_for_io(page);
err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false);
if (!err)
mpd->wbc->nr_to_write--;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 003/233] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (2 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 097/233] ext4: fix data corruption for mmap writes Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 148/233] HID: usbhid: Add quirks for Mayflash/Dragonrise GameCube and PS3 adapters Ben Hutchings
` (229 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sabrina Dubroca, Steffen Klassert
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
commit 9b3eb54106cf6acd03f07cf0ab01c13676a226c2 upstream.
When CONFIG_XFRM_SUB_POLICY=y, xfrm_dst stores a copy of the flowi for
that dst. Unfortunately, the code that allocates and fills this copy
doesn't care about what type of flowi (flowi, flowi4, flowi6) gets
passed. In multiple code paths (from raw_sendmsg, from TCP when
replying to a FIN, in vxlan, geneve, and gre), the flowi that gets
passed to xfrm is actually an on-stack flowi4, so we end up reading
stuff from the stack past the end of the flowi4 struct.
Since xfrm_dst->origin isn't used anywhere following commit
ca116922afa8 ("xfrm: Eliminate "fl" and "pol" args to
xfrm_bundle_ok()."), just get rid of it. xfrm_dst->partner isn't used
either, so get rid of that too.
Fixes: 9d6ec938019c ("ipv4: Use flowi4 in public route lookup interfaces.")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/xfrm.h | 10 ----------
net/xfrm/xfrm_policy.c | 47 -----------------------------------------------
2 files changed, 57 deletions(-)
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -949,10 +949,6 @@ struct xfrm_dst {
struct flow_cache_object flo;
struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX];
int num_pols, num_xfrms;
-#ifdef CONFIG_XFRM_SUB_POLICY
- struct flowi *origin;
- struct xfrm_selector *partner;
-#endif
u32 xfrm_genid;
u32 policy_genid;
u32 route_mtu_cached;
@@ -968,12 +964,6 @@ static inline void xfrm_dst_destroy(stru
dst_release(xdst->route);
if (likely(xdst->u.dst.xfrm))
xfrm_state_put(xdst->u.dst.xfrm);
-#ifdef CONFIG_XFRM_SUB_POLICY
- kfree(xdst->origin);
- xdst->origin = NULL;
- kfree(xdst->partner);
- xdst->partner = NULL;
-#endif
}
#endif
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1634,43 +1634,6 @@ free_dst:
goto out;
}
-#ifdef CONFIG_XFRM_SUB_POLICY
-static int xfrm_dst_alloc_copy(void **target, const void *src, int size)
-{
- if (!*target) {
- *target = kmalloc(size, GFP_ATOMIC);
- if (!*target)
- return -ENOMEM;
- }
-
- memcpy(*target, src, size);
- return 0;
-}
-#endif
-
-static int xfrm_dst_update_parent(struct dst_entry *dst,
- const struct xfrm_selector *sel)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
- struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
- return xfrm_dst_alloc_copy((void **)&(xdst->partner),
- sel, sizeof(*sel));
-#else
- return 0;
-#endif
-}
-
-static int xfrm_dst_update_origin(struct dst_entry *dst,
- const struct flowi *fl)
-{
-#ifdef CONFIG_XFRM_SUB_POLICY
- struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
- return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl));
-#else
- return 0;
-#endif
-}
-
static int xfrm_expand_policies(const struct flowi *fl, u16 family,
struct xfrm_policy **pols,
int *num_pols, int *num_xfrms)
@@ -1742,16 +1705,6 @@ xfrm_resolve_and_create_bundle(struct xf
xdst = (struct xfrm_dst *)dst;
xdst->num_xfrms = err;
- if (num_pols > 1)
- err = xfrm_dst_update_parent(dst, &pols[1]->selector);
- else
- err = xfrm_dst_update_origin(dst, fl);
- if (unlikely(err)) {
- dst_free(dst);
- XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR);
- return ERR_PTR(err);
- }
-
xdst->num_pols = num_pols;
memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols);
xdst->policy_genid = atomic_read(&pols[0]->genid);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 148/233] HID: usbhid: Add quirks for Mayflash/Dragonrise GameCube and PS3 adapters
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (3 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 003/233] xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 109/233] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() Ben Hutchings
` (228 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Marcel Hasler, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Hasler <mahasler@gmail.com>
commit b2554000f5b5d2a3a368d09c6debf7da64901fcf upstream.
All known gamepad adapters by Mayflash (identified as Dragonrise) need
HID_QUIRK_MULTI_INPUT to split them up into four input devices. Without this
quirk those adapters are falsely recognized as tablets. Fixes bug 115841
(https://bugzilla.kernel.org/show_bug.cgi?id=115841).
Signed-off-by: Marcel Hasler <mahasler@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 6 ++++--
drivers/hid/usbhid/hid-quirks.c | 2 ++
2 files changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -290,8 +290,10 @@
#define USB_VENDOR_ID_DMI 0x0c0b
#define USB_DEVICE_ID_DMI_ENC 0x5fab
-#define USB_VENDOR_ID_DRAGONRISE 0x0079
-#define USB_DEVICE_ID_DRAGONRISE_WIIU 0x1800
+#define USB_VENDOR_ID_DRAGONRISE 0x0079
+#define USB_DEVICE_ID_DRAGONRISE_WIIU 0x1800
+#define USB_DEVICE_ID_DRAGONRISE_PS3 0x1801
+#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE 0x1843
#define USB_VENDOR_ID_DWAV 0x0eef
#define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -82,6 +82,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 109/233] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (4 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 148/233] HID: usbhid: Add quirks for Mayflash/Dragonrise GameCube and PS3 adapters Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 066/233] powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash Ben Hutchings
` (227 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Craig Gallek, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 6e80ac5cc992ab6256c3dae87f7e57db15e1a58c upstream.
xfrm6_find_1stfragopt() may now return an error code and we must
not treat it as a length.
Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Acked-by: Craig Gallek <kraig@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
net/ipv6/xfrm6_mode_ro.c | 2 ++
net/ipv6/xfrm6_mode_transport.c | 2 ++
2 files changed, 4 insertions(+)
--- a/net/ipv6/xfrm6_mode_ro.c
+++ b/net/ipv6/xfrm6_mode_ro.c
@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_s
iph = ipv6_hdr(skb);
hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+ if (hdr_len < 0)
+ return hdr_len;
skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
skb_set_network_header(skb, -x->props.header_len);
skb->transport_header = skb->network_header + hdr_len;
--- a/net/ipv6/xfrm6_mode_transport.c
+++ b/net/ipv6/xfrm6_mode_transport.c
@@ -28,6 +28,8 @@ static int xfrm6_transport_output(struct
iph = ipv6_hdr(skb);
hdr_len = x->type->hdr_offset(x, skb, &prevhdr);
+ if (hdr_len < 0)
+ return hdr_len;
skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data);
skb_set_network_header(skb, -x->props.header_len);
skb->transport_header = skb->network_header + hdr_len;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 066/233] powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (5 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 109/233] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 028/233] kvm: arm/arm64: Force reading uncached stage2 PGD Ben Hutchings
` (226 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Michael Ellerman, Breno Leitao, Paul Mackerras, Balbir Singh
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit e41e53cd4fe331d0d1f06f8e4ed7e2cc63ee2c34 upstream.
virt_addr_valid() is supposed to tell you if it's OK to call virt_to_page() on
an address. What this means in practice is that it should only return true for
addresses in the linear mapping which are backed by a valid PFN.
We are failing to properly check that the address is in the linear mapping,
because virt_to_pfn() will return a valid looking PFN for more or less any
address. That bug is actually caused by __pa(), used in virt_to_pfn().
eg: __pa(0xc000000000010000) = 0x10000 # Good
__pa(0xd000000000010000) = 0x10000 # Bad!
__pa(0x0000000000010000) = 0x10000 # Bad!
This started happening after commit bdbc29c19b26 ("powerpc: Work around gcc
miscompilation of __pa() on 64-bit") (Aug 2013), where we changed the definition
of __pa() to work around a GCC bug. Prior to that we subtracted PAGE_OFFSET from
the value passed to __pa(), meaning __pa() of a 0xd or 0x0 address would give
you something bogus back.
Until we can verify if that GCC bug is no longer an issue, or come up with
another solution, this commit does the minimal fix to make virt_addr_valid()
work, by explicitly checking that the address is in the linear mapping region.
Fixes: bdbc29c19b26 ("powerpc: Work around gcc miscompilation of __pa() on 64-bit")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Paul Mackerras <paulus@ozlabs.org>
Reviewed-by: Balbir Singh <bsingharora@gmail.com>
Tested-by: Breno Leitao <breno.leitao@gmail.com>
[bwh: Backported to 3.16: open-code virt_to_pfn()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/include/asm/page.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
@@ -132,7 +132,19 @@ extern long long virt_phys_offset;
#define virt_to_page(kaddr) pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
#define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT)
+
+#ifdef CONFIG_PPC_BOOK3S_64
+/*
+ * On hash the vmalloc and other regions alias to the kernel region when passed
+ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can
+ * return true for some vmalloc addresses, which is incorrect. So explicitly
+ * check that the address is in the kernel region.
+ */
+#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \
+ pfn_valid(__pa(kaddr) >> PAGE_SHIFT))
+#else
#define virt_addr_valid(kaddr) pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
+#endif
/*
* On Book-E parts we need __va to parse the device tree and we can't
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 028/233] kvm: arm/arm64: Force reading uncached stage2 PGD
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (6 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 066/233] powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 106/233] btrfs: fix memory leak in update_space_info failure path Ben Hutchings
` (225 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Christoffer Dall, Marc Zyngier, Suzuki K Poulose
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream.
Make sure we don't use a cached value of the KVM stage2 PGD while
resetting the PGD.
Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
[bwh: Backported to 3.16:
- s/READ_ONCE/ACCESS_ONCE/
- Adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/kvm/mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -643,7 +643,7 @@ void kvm_free_stage2_pgd(struct kvm *kvm
spin_lock(&kvm->mmu_lock);
if (kvm->arch.pgd) {
unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
- pgd = kvm->arch.pgd;
+ pgd = ACCESS_ONCE(kvm->arch.pgd);
kvm->arch.pgd = NULL;
}
spin_unlock(&kvm->mmu_lock);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 106/233] btrfs: fix memory leak in update_space_info failure path
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (7 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 028/233] kvm: arm/arm64: Force reading uncached stage2 PGD Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 004/233] iio: proximity: as3935: fix iio_trigger_poll issue Ben Hutchings
` (224 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David Sterba, Liu Bo, Jeff Mahoney
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 896533a7da929136d0432713f02a3edffece2826 upstream.
If we fail to add the space_info kobject, we'll leak the memory
for the percpu counter.
Fixes: 6ab0a2029c (btrfs: publish allocation data in sysfs)
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/extent-tree.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3526,6 +3526,7 @@ static int update_space_info(struct btrf
info->space_info_kobj, "%s",
alloc_name(found->flags));
if (ret) {
+ percpu_counter_destroy(&found->total_bytes_pinned);
kfree(found);
return ret;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 004/233] iio: proximity: as3935: fix iio_trigger_poll issue
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (8 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 106/233] btrfs: fix memory leak in update_space_info failure path Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 041/233] usb: r8a66597-hcd: decrease timeout Ben Hutchings
` (223 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jonathan Cameron, Matt Ranostay
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <matt.ranostay@konsulko.com>
commit 9122b54f266ddee09654fe3fbc503c1a60f4a01c upstream.
Using iio_trigger_poll() can oops when multiple interrupts
happen before the first is handled.
Use iio_trigger_poll_chained() instead and use the timestamp
when processed, since it will be in theory be 2 ms max latency.
Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support")
Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
[bwh: Backported to 3.16:
- iio_get_time_ns() doesn't take any parameters
- iio_trigger_poll{,_chained}() do take a time parameter]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/iio/proximity/as3935.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -215,7 +215,7 @@ static irqreturn_t as3935_trigger_handle
st->buffer[0] = val & AS3935_DATA_MASK;
iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer,
- pf->timestamp);
+ iio_get_time_ns());
err_read:
iio_trigger_notify_done(indio_dev->trig);
@@ -238,7 +238,7 @@ static void as3935_event_work(struct wor
switch (val) {
case AS3935_EVENT_INT:
- iio_trigger_poll(st->trig, iio_get_time_ns());
+ iio_trigger_poll_chained(st->trig, iio_get_time_ns());
break;
case AS3935_NOISE_INT:
dev_warn(&st->spi->dev, "noise level is too high");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 041/233] usb: r8a66597-hcd: decrease timeout
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (9 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 004/233] iio: proximity: as3935: fix iio_trigger_poll issue Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 101/233] target/iscsi: Fix indentation in iscsi_target_start_negotiation() Ben Hutchings
` (222 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Chris Brandt
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chris Brandt <chris.brandt@renesas.com>
commit dd14a3e9b92ac6f0918054f9e3477438760a4fa6 upstream.
The timeout for BULK packets was 300ms which is a long time if other
endpoints or devices are waiting for their turn. Changing it to 50ms
greatly increased the overall performance for multi-endpoint devices.
Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/r8a66597-hcd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597
time = 30;
break;
default:
- time = 300;
+ time = 50;
break;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 101/233] target/iscsi: Fix indentation in iscsi_target_start_negotiation()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (10 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 041/233] usb: r8a66597-hcd: decrease timeout Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 021/233] USB: serial: ir-usb: fix big-endian baud-rate debug printk Ben Hutchings
` (221 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Nicholas A. Bellinger, Hannes Reinecke, Bart Van Assche,
Christoph Hellwig
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 1efaa949396b5d9e8d1e6edef7e97e9ce1a97319 upstream.
This patch avoids that smatch complains about inconsistent
indentation in iscsi_target_start_negotiation().
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Nicholas A. Bellinger <nab@linux-iscsi.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/iscsi/iscsi_target_nego.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1251,16 +1251,16 @@ int iscsi_target_start_negotiation(
{
int ret;
- if (conn->sock) {
- struct sock *sk = conn->sock->sk;
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
- write_lock_bh(&sk->sk_callback_lock);
- set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
- write_unlock_bh(&sk->sk_callback_lock);
- }
+ write_lock_bh(&sk->sk_callback_lock);
+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+ write_unlock_bh(&sk->sk_callback_lock);
+ }
- ret = iscsi_target_do_login(conn, login);
- if (ret < 0) {
+ ret = iscsi_target_do_login(conn, login);
+ if (ret < 0) {
cancel_delayed_work_sync(&conn->login_work);
cancel_delayed_work_sync(&conn->login_cleanup_work);
iscsi_target_restore_sock_callbacks(conn);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 021/233] USB: serial: ir-usb: fix big-endian baud-rate debug printk
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (11 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 101/233] target/iscsi: Fix indentation in iscsi_target_start_negotiation() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 088/233] ASoC: Fix use-after-free at card unregistration Ben Hutchings
` (220 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Johan Hovold
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ad0ccac76dcc92c3331f4c94c9fc54f8bf1ab20c upstream.
Add missing endianness conversion when printing the supported baud
rates.
Found using sparse:
warning: restricted __le16 degrades to integer
Fixes: e0d795e4f36c ("usb: irda: cleanup on ir-usb module")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/ir-usb.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -197,6 +197,7 @@ static u8 ir_xbof_change(u8 xbof)
static int ir_startup(struct usb_serial *serial)
{
struct usb_irda_cs_descriptor *irda_desc;
+ int rates;
irda_desc = irda_usb_find_class_desc(serial, 0);
if (!irda_desc) {
@@ -205,18 +206,20 @@ static int ir_startup(struct usb_serial
return -ENODEV;
}
+ rates = le16_to_cpu(irda_desc->wBaudRate);
+
dev_dbg(&serial->dev->dev,
"%s - Baud rates supported:%s%s%s%s%s%s%s%s%s\n",
__func__,
- (irda_desc->wBaudRate & USB_IRDA_BR_2400) ? " 2400" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_9600) ? " 9600" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_19200) ? " 19200" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_38400) ? " 38400" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_57600) ? " 57600" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_115200) ? " 115200" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_576000) ? " 576000" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_1152000) ? " 1152000" : "",
- (irda_desc->wBaudRate & USB_IRDA_BR_4000000) ? " 4000000" : "");
+ (rates & USB_IRDA_BR_2400) ? " 2400" : "",
+ (rates & USB_IRDA_BR_9600) ? " 9600" : "",
+ (rates & USB_IRDA_BR_19200) ? " 19200" : "",
+ (rates & USB_IRDA_BR_38400) ? " 38400" : "",
+ (rates & USB_IRDA_BR_57600) ? " 57600" : "",
+ (rates & USB_IRDA_BR_115200) ? " 115200" : "",
+ (rates & USB_IRDA_BR_576000) ? " 576000" : "",
+ (rates & USB_IRDA_BR_1152000) ? " 1152000" : "",
+ (rates & USB_IRDA_BR_4000000) ? " 4000000" : "");
switch (irda_desc->bmAdditionalBOFs) {
case USB_IRDA_AB_48:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 088/233] ASoC: Fix use-after-free at card unregistration
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (12 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 021/233] USB: serial: ir-usb: fix big-endian baud-rate debug printk Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 132/233] HID: microsoft: Add Surface Power Cover Ben Hutchings
` (219 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mark Brown, Takashi Iwai
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 4efda5f2130da033aeedc5b3205569893b910de2 upstream.
soc_cleanup_card_resources() call snd_card_free() at the last of its
procedure. This turned out to lead to a use-after-free.
PCM runtimes have been already removed via soc_remove_pcm_runtimes(),
while it's dereferenced later in soc_pcm_free() called via
snd_card_free().
The fix is simple: just move the snd_card_free() call to the beginning
of the whole procedure. This also gives another benefit: it
guarantees that all operations have been shut down before actually
releasing the resources, which was racy until now.
Reported-and-tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/soc-core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -2014,6 +2014,9 @@ static int soc_cleanup_card_resources(st
for (i = 0; i < card->num_aux_devs; i++)
soc_remove_aux_dev(card, i);
+ /* free the ALSA card at first; this syncs with pending operations */
+ snd_card_free(card->snd_card);
+
/* remove and free each DAI */
soc_remove_dai_links(card);
@@ -2025,9 +2028,7 @@ static int soc_cleanup_card_resources(st
snd_soc_dapm_free(&card->dapm);
- snd_card_free(card->snd_card);
return 0;
-
}
/* removes a socdev */
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 132/233] HID: microsoft: Add Surface Power Cover
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (13 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 088/233] ASoC: Fix use-after-free at card unregistration Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 094/233] xfs: Fix missed holes in SEEK_HOLE implementation Ben Hutchings
` (218 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Raimund Roth, Raimund Roth
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Raimund Roth <raimundmroth@googlemail.com>
commit 18eec2cd7e9746cd672ada102987534ae16f0f44 upstream.
Adding support for the Microsoft Surface Pro Power Cover.
Signed-off-by: Raimund Roth <raimundmroth@gmail.gom>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 4 +++-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-microsoft.c | 2 ++
drivers/hid/usbhid/hid-quirks.c | 1 +
4 files changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -705,7 +705,8 @@ static void hid_scan_collection(struct h
if (hid->vendor == USB_VENDOR_ID_MICROSOFT &&
(hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
- hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3_JP) &&
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3_JP ||
+ hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
hid->group == HID_GROUP_MULTITOUCH)
hid->group = HID_GROUP_GENERIC;
}
@@ -1859,6 +1860,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
{ HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
{ HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -663,6 +663,7 @@
#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07dc
#define USB_DEVICE_ID_MS_TYPE_COVER_3_JP 0x07dd
+#define USB_DEVICE_ID_MS_POWER_COVER 0x07da
#define USB_VENDOR_ID_MOJO 0x8282
#define USB_DEVICE_ID_RETRO_ADAPTER 0x3201
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -280,6 +280,8 @@ static const struct hid_device_id ms_dev
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP),
.driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER),
+ .driver_data = MS_HIDINPUT },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
.driver_data = MS_PRESENTER },
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -90,6 +90,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 094/233] xfs: Fix missed holes in SEEK_HOLE implementation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (14 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 132/233] HID: microsoft: Add Surface Power Cover Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 142/233] HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2 Ben Hutchings
` (217 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jan Kara, Brian Foster, Darrick J. Wong
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 5375023ae1266553a7baa0845e82917d8803f48c upstream.
XFS SEEK_HOLE implementation could miss a hole in an unwritten extent as
can be seen by the following command:
xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k"
-c "seek -h 0" file
wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (49.312 MiB/sec and 12623.9856 ops/sec)
wrote 8192/8192 bytes at offset 131072
8 KiB, 2 ops; 0.0000 sec (70.383 MiB/sec and 18018.0180 ops/sec)
Whence Result
HOLE 139264
Where we can see that hole at offset 56k was just ignored by SEEK_HOLE
implementation. The bug is in xfs_find_get_desired_pgoff() which does
not properly detect the case when pages are not contiguous.
Fix the problem by properly detecting when found page has larger offset
than expected.
Fixes: d126d43f631f996daeee5006714fed914be32368
Signed-off-by: Jan Kara <jack@suse.cz>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/xfs/xfs_file.c | 29 +++++++++--------------------
1 file changed, 9 insertions(+), 20 deletions(-)
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1079,17 +1079,6 @@ xfs_find_get_desired_pgoff(
break;
}
- /*
- * At lease we found one page. If this is the first time we
- * step into the loop, and if the first page index offset is
- * greater than the given search offset, a hole was found.
- */
- if (type == HOLE_OFF && lastoff == startoff &&
- lastoff < page_offset(pvec.pages[0])) {
- found = true;
- break;
- }
-
for (i = 0; i < nr_pages; i++) {
struct page *page = pvec.pages[i];
loff_t b_offset;
@@ -1101,18 +1090,18 @@ xfs_find_get_desired_pgoff(
* file mapping. However, page->index will not change
* because we have a reference on the page.
*
- * Searching done if the page index is out of range.
- * If the current offset is not reaches the end of
- * the specified search range, there should be a hole
- * between them.
+ * If current page offset is beyond where we've ended,
+ * we've found a hole.
*/
- if (page->index > end) {
- if (type == HOLE_OFF && lastoff < endoff) {
- *offset = lastoff;
- found = true;
- }
+ if (type == HOLE_OFF && lastoff < endoff &&
+ lastoff < page_offset(pvec.pages[i])) {
+ found = true;
+ *offset = lastoff;
goto out;
}
+ /* Searching done if the page index is out of range. */
+ if (page->index > end)
+ goto out;
lock_page(page);
/*
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 142/233] HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (15 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 094/233] xfs: Fix missed holes in SEEK_HOLE implementation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 044/233] USB: usbip: fix nonconforming hub descriptor Ben Hutchings
` (216 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Daniel Bristot de Oliveira, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Bristot de Oliveira <bristot@redhat.com>
commit c14022bfd2eb2d2ece74a405dfbdb02a829c07bc upstream.
The device which identifies itself as a "USB Keykoard" (no typo)
with VID:PID 1a2c:0027 does not seem to be handling the reports
initialization very well.
This results in a "usb_submit_urb(ctrl) failed: -1" message from the
kernel when connected, and a delay before its initialization. It can
also cause the hang the system.
This patch adds the quirk for this device, which causes the delay
to disappear. It is named as "USB Keykoard2" because the "USB Keykoard"
already exists.
Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -811,6 +811,7 @@
#define USB_VENDOR_ID_SEMICO 0x1a2c
#define USB_DEVICE_ID_SEMICO_USB_KEYKOARD 0x0023
+#define USB_DEVICE_ID_SEMICO_USB_KEYKOARD2 0x0027
#define USB_VENDOR_ID_SENNHEISER 0x1395
#define USB_DEVICE_ID_SENNHEISER_BTD500USB 0x002c
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -143,6 +143,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 044/233] USB: usbip: fix nonconforming hub descriptor
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (16 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 142/233] HID: usbhid: enable NO_INIT_REPORTS quirk for Semico USB Keykoard2 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 078/233] usb: chipidea: debug: check before accessing ci_role Ben Hutchings
` (215 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Takahiro Hirofuchi, Shuah Khan, Valentina Manea,
Johan Hovold, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ec963b412a54aac8e527708ecad06a6988a86fb4 upstream.
Fix up the root-hub descriptor to accommodate the variable-length
DeviceRemovable and PortPwrCtrlMask fields, while marking all ports as
removable (and leaving the reserved bit zero unset).
Also add a build-time constraint on VHCI_HC_PORTS which must never be
greater than USB_MAXCHILDREN (but this was only enforced through a
KConfig constant).
This specifically fixes the descriptor layout whenever VHCI_HC_PORTS is
greater than seven (default is 8).
Fixes: 04679b3489e0 ("Staging: USB/IP: add client driver")
Cc: Takahiro Hirofuchi <hirofuchi@users.sourceforge.net>
Cc: Valentina Manea <valentina.manea.m@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16:
- s/VHCI_HC_PORTS/VHCI_NPORTS/
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/usbip/vhci_hcd.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/staging/usbip/vhci_hcd.c
+++ b/drivers/staging/usbip/vhci_hcd.c
@@ -215,13 +215,18 @@ done:
static inline void hub_descriptor(struct usb_hub_descriptor *desc)
{
+ int width;
+
memset(desc, 0, sizeof(*desc));
desc->bDescriptorType = 0x29;
- desc->bDescLength = 9;
desc->wHubCharacteristics = (__constant_cpu_to_le16(0x0001));
+
desc->bNbrPorts = VHCI_NPORTS;
- desc->u.hs.DeviceRemovable[0] = 0xff;
- desc->u.hs.DeviceRemovable[1] = 0xff;
+ BUILD_BUG_ON(VHCI_NPORTS > USB_MAXCHILDREN);
+ width = desc->bNbrPorts / 8 + 1;
+ desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width;
+ memset(&desc->u.hs.DeviceRemovable[0], 0, width);
+ memset(&desc->u.hs.DeviceRemovable[width], 0xff, width);
}
static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 078/233] usb: chipidea: debug: check before accessing ci_role
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (17 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 044/233] USB: usbip: fix nonconforming hub descriptor Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 026/233] dm space map disk: fix some book keeping in the disk space map Ben Hutchings
` (214 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Peter Chen, Michael Thalmeier
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Thalmeier <michael.thalmeier@hale.at>
commit 0340ff83cd4475261e7474033a381bc125b45244 upstream.
ci_role BUGs when the role is >= CI_ROLE_END.
Signed-off-by: Michael Thalmeier <michael.thalmeier@hale.at>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/chipidea/debug.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/chipidea/debug.c
+++ b/drivers/usb/chipidea/debug.c
@@ -286,7 +286,8 @@ static int ci_role_show(struct seq_file
{
struct ci_hdrc *ci = s->private;
- seq_printf(s, "%s\n", ci_role(ci)->name);
+ if (ci->role != CI_ROLE_END)
+ seq_printf(s, "%s\n", ci_role(ci)->name);
return 0;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 026/233] dm space map disk: fix some book keeping in the disk space map
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (18 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 078/233] usb: chipidea: debug: check before accessing ci_role Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 054/233] xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Ben Hutchings
` (213 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Joe Thornber, Mike Snitzer
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream.
When decrementing the reference count for a block, the free count wasn't
being updated if the reference count went to zero.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -140,10 +140,23 @@ static int sm_disk_inc_block(struct dm_s
static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b)
{
+ int r;
+ uint32_t old_count;
enum allocation_event ev;
struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
- return sm_ll_dec(&smd->ll, b, &ev);
+ r = sm_ll_dec(&smd->ll, b, &ev);
+ if (!r && (ev == SM_FREE)) {
+ /*
+ * It's only free if it's also free in the last
+ * transaction.
+ */
+ r = sm_ll_lookup(&smd->old_ll, b, &old_count);
+ if (!r && !old_count)
+ smd->nr_allocated_this_transaction--;
+ }
+
+ return r;
}
static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 054/233] xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (19 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 026/233] dm space map disk: fix some book keeping in the disk space map Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 060/233] serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' Ben Hutchings
` (212 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Mathias Nyman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit a0c16630d35a874e82bdf2088f58ecaca1024315 upstream.
Intel Denverton microserver is Atom based and need the PME and CAS quirks
as well.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-pci.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -45,6 +45,7 @@
#define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8
#define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8
#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8
+#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0
static const char hcd_name[] = "xhci_hcd";
@@ -151,12 +152,14 @@ static void xhci_pci_quirks(struct devic
pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI ||
pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) {
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) {
xhci->quirks |= XHCI_PME_STUCK_QUIRK;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI ||
- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI))
+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI))
xhci->quirks |= XHCI_MISSING_CAS;
if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 060/233] serial: efm32: Fix parity management in 'efm32_uart_console_get_options()'
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (20 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 054/233] xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 064/233] sh_eth: Use platform device for printing before register_netdev() Ben Hutchings
` (211 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Christophe JAILLET, Uwe Kleine-König, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit be40597a1bc173bf9dadccdf5388b956f620ae8f upstream.
UARTn_FRAME_PARITY_ODD is 0x0300
UARTn_FRAME_PARITY_EVEN is 0x0200
So if the UART is configured for EVEN parity, it would be reported as ODD.
Fix it by correctly testing if the 2 bits are set.
Fixes: 3afbd89c9639 ("serial/efm32: add new driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/serial/efm32-uart.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/efm32-uart.c
+++ b/drivers/tty/serial/efm32-uart.c
@@ -27,6 +27,7 @@
#define UARTn_FRAME 0x04
#define UARTn_FRAME_DATABITS__MASK 0x000f
#define UARTn_FRAME_DATABITS(n) ((n) - 3)
+#define UARTn_FRAME_PARITY__MASK 0x0300
#define UARTn_FRAME_PARITY_NONE 0x0000
#define UARTn_FRAME_PARITY_EVEN 0x0200
#define UARTn_FRAME_PARITY_ODD 0x0300
@@ -578,12 +579,16 @@ static void efm32_uart_console_get_optio
16 * (4 + (clkdiv >> 6)));
frame = efm32_uart_read32(efm_port, UARTn_FRAME);
- if (frame & UARTn_FRAME_PARITY_ODD)
+ switch (frame & UARTn_FRAME_PARITY__MASK) {
+ case UARTn_FRAME_PARITY_ODD:
*parity = 'o';
- else if (frame & UARTn_FRAME_PARITY_EVEN)
+ break;
+ case UARTn_FRAME_PARITY_EVEN:
*parity = 'e';
- else
+ break;
+ default:
*parity = 'n';
+ }
*bits = (frame & UARTn_FRAME_DATABITS__MASK) -
UARTn_FRAME_DATABITS(4) + 4;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 064/233] sh_eth: Use platform device for printing before register_netdev()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (21 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 060/233] serial: efm32: Fix parity management in 'efm32_uart_console_get_options()' Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 123/233] powerpc/numa: Fix percpu allocations to be NUMA aware Ben Hutchings
` (210 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Geert Uytterhoeven, David S. Miller, Laurent Pinchart
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 5f5c5449acad0cd3322e53e1ac68c044483b0aa5 upstream.
The MDIO initialization failure message is printed using the network
device, before it has been registered, leading to:
(null): failed to initialise MDIO
Use the platform device instead to fix this:
sh-eth ee700000.ethernet: failed to initialise MDIO
Fixes: daacf03f0bbfefee ("sh_eth: Register MDIO bus before registering the network device")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/renesas/sh_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2897,7 +2897,7 @@ static int sh_eth_drv_probe(struct platf
/* MDIO bus init */
ret = sh_mdio_init(mdp, pd);
if (ret) {
- dev_err(&ndev->dev, "failed to initialise MDIO\n");
+ dev_err(&pdev->dev, "failed to initialise MDIO\n");
goto out_release;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 123/233] powerpc/numa: Fix percpu allocations to be NUMA aware
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (22 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 064/233] sh_eth: Use platform device for printing before register_netdev() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 131/233] HID: sjoy: support Super Joy Box 4 Ben Hutchings
` (209 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michael Ellerman, Nicholas Piggin
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b upstream.
In commit 8c272261194d ("powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID"), we
switched to the generic implementation of cpu_to_node(), which uses a percpu
variable to hold the NUMA node for each CPU.
Unfortunately we neglected to notice that we use cpu_to_node() in the allocation
of our percpu areas, leading to a chicken and egg problem. In practice what
happens is when we are setting up the percpu areas, cpu_to_node() reports that
all CPUs are on node 0, so we allocate all percpu areas on node 0.
This is visible in the dmesg output, as all pcpu allocs being in group 0:
pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07
pcpu-alloc: [0] 08 09 10 11 [0] 12 13 14 15
pcpu-alloc: [0] 16 17 18 19 [0] 20 21 22 23
pcpu-alloc: [0] 24 25 26 27 [0] 28 29 30 31
pcpu-alloc: [0] 32 33 34 35 [0] 36 37 38 39
pcpu-alloc: [0] 40 41 42 43 [0] 44 45 46 47
To fix it we need an early_cpu_to_node() which can run prior to percpu being
setup. We already have the numa_cpu_lookup_table we can use, so just plumb it
in. With the patch dmesg output shows two groups, 0 and 1:
pcpu-alloc: [0] 00 01 02 03 [0] 04 05 06 07
pcpu-alloc: [0] 08 09 10 11 [0] 12 13 14 15
pcpu-alloc: [0] 16 17 18 19 [0] 20 21 22 23
pcpu-alloc: [1] 24 25 26 27 [1] 28 29 30 31
pcpu-alloc: [1] 32 33 34 35 [1] 36 37 38 39
pcpu-alloc: [1] 40 41 42 43 [1] 44 45 46 47
We can also check the data_offset in the paca of various CPUs, with the fix we
see:
CPU 0: data_offset = 0x0ffe8b0000
CPU 24: data_offset = 0x1ffe5b0000
And we can see from dmesg that CPU 24 has an allocation on node 1:
node 0: [mem 0x0000000000000000-0x0000000fffffffff]
node 1: [mem 0x0000001000000000-0x0000001fffffffff]
Fixes: 8c272261194d ("powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/include/asm/topology.h | 14 ++++++++++++++
arch/powerpc/kernel/setup_64.c | 4 ++--
2 files changed, 16 insertions(+), 2 deletions(-)
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topolog
extern int sysfs_add_device_to_node(struct device *dev, int nid);
extern void sysfs_remove_device_from_node(struct device *dev, int nid);
+static inline int early_cpu_to_node(int cpu)
+{
+ int nid;
+
+ nid = numa_cpu_lookup_table[cpu];
+
+ /*
+ * Fall back to node 0 if nid is unset (it should be, except bugs).
+ * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)).
+ */
+ return (nid < 0) ? 0 : nid;
+}
#else
+static inline int early_cpu_to_node(int cpu) { return 0; }
+
static inline void dump_numa_cpu_topology(void) {}
static inline int sysfs_add_device_to_node(struct device *dev, int nid)
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -739,7 +739,7 @@ void ppc64_boot_msg(unsigned int src, co
static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align)
{
- return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align,
+ return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align,
__pa(MAX_DMA_ADDRESS));
}
@@ -750,7 +750,7 @@ static void __init pcpu_fc_free(void *pt
static int pcpu_cpu_distance(unsigned int from, unsigned int to)
{
- if (cpu_to_node(from) == cpu_to_node(to))
+ if (early_cpu_to_node(from) == early_cpu_to_node(to))
return LOCAL_DISTANCE;
else
return REMOTE_DISTANCE;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 131/233] HID: sjoy: support Super Joy Box 4
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (23 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 123/233] powerpc/numa: Fix percpu allocations to be NUMA aware Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 033/233] tcp: eliminate negative reordering in tcp_clean_rtx_queue Ben Hutchings
` (208 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sean Young, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 6e5e9a06a206010eabd19b523fd0833c51afc0b0 upstream.
This device supports force feedback and has two ports.
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 1 +
drivers/hid/hid-sjoy.c | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 -
3 files changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1948,6 +1948,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_3_PRO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_DUAL_BOX_PRO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE_BLUETOOTH) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS4_BLUETOOTH) },
{ HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) },
--- a/drivers/hid/hid-sjoy.c
+++ b/drivers/hid/hid-sjoy.c
@@ -166,6 +166,9 @@ static const struct hid_device_id sjoy_d
{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD),
.driver_data = HID_QUIRK_MULTI_INPUT |
HID_QUIRK_SKIP_OUTPUT_REPORTS },
+ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII),
+ .driver_data = HID_QUIRK_MULTI_INPUT |
+ HID_QUIRK_SKIP_OUTPUT_REPORTS },
{ }
};
MODULE_DEVICE_TABLE(hid, sjoy_devices);
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -52,7 +52,6 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH_2968, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS },
- { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 033/233] tcp: eliminate negative reordering in tcp_clean_rtx_queue
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (24 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 131/233] HID: sjoy: support Super Joy Box 4 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 035/233] uio: fix incorrect memory leak cleanup Ben Hutchings
` (207 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David S. Miller, Soheil Hassas Yeganeh, Eric Dumazet,
Rebecca Isaacs, Neal Cardwell, Yuchung Cheng
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Soheil Hassas Yeganeh <soheil@google.com>
commit bafbb9c73241760023d8981191ddd30bb1c6dbac upstream.
tcp_ack() can call tcp_fragment() which may dededuct the
value tp->fackets_out when MSS changes. When prior_fackets
is larger than tp->fackets_out, tcp_clean_rtx_queue() can
invoke tcp_update_reordering() with negative values. This
results in absurd tp->reodering values higher than
sysctl_tcp_max_reordering.
Note that tcp_update_reordering indeeds sets tp->reordering
to min(sysctl_tcp_max_reordering, metric), but because
the comparison is signed, a negative metric always wins.
Fixes: c7caf8d3ed7a ("[TCP]: Fix reord detection due to snd_una covered holes")
Reported-by: Rebecca Isaacs <risaacs@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/tcp_input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3135,7 +3135,7 @@ static int tcp_clean_rtx_queue(struct so
int delta;
/* Non-retransmitted hole got filled? That's reordering */
- if (reord < prior_fackets)
+ if (reord < prior_fackets && reord <= tp->fackets_out)
tcp_update_reordering(sk, tp->fackets_out - reord, 0);
delta = tcp_is_fack(tp) ? pkts_acked :
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 035/233] uio: fix incorrect memory leak cleanup
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (25 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 033/233] tcp: eliminate negative reordering in tcp_clean_rtx_queue Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 086/233] x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation Ben Hutchings
` (206 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Suman Anna, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Suman Anna <s-anna@ti.com>
commit 0d83539092ddb1ab79b4d65bccb866bf07ea2ccd upstream.
Commit 75f0aef6220d ("uio: fix memory leak") has fixed up some
memory leaks during the failure paths of the addition of uio
attributes, but still is not correct entirely. A kobject_uevent()
failure still needs a kobject_put() and the kobject container
structure allocation failure before the kobject_init() doesn't
need a kobject_put(). Fix this properly.
Fixes: 75f0aef6220d ("uio: fix memory leak")
Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/uio/uio.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -291,7 +291,7 @@ static int uio_dev_add_attributes(struct
map = kzalloc(sizeof(*map), GFP_KERNEL);
if (!map) {
ret = -ENOMEM;
- goto err_map_kobj;
+ goto err_map;
}
kobject_init(&map->kobj, &map_attr_type);
map->mem = mem;
@@ -301,7 +301,7 @@ static int uio_dev_add_attributes(struct
goto err_map_kobj;
ret = kobject_uevent(&map->kobj, KOBJ_ADD);
if (ret)
- goto err_map;
+ goto err_map_kobj;
}
for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
@@ -320,7 +320,7 @@ static int uio_dev_add_attributes(struct
portio = kzalloc(sizeof(*portio), GFP_KERNEL);
if (!portio) {
ret = -ENOMEM;
- goto err_portio_kobj;
+ goto err_portio;
}
kobject_init(&portio->kobj, &portio_attr_type);
portio->port = port;
@@ -331,7 +331,7 @@ static int uio_dev_add_attributes(struct
goto err_portio_kobj;
ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
if (ret)
- goto err_portio;
+ goto err_portio_kobj;
}
return 0;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 086/233] x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (26 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 035/233] uio: fix incorrect memory leak cleanup Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 032/233] ahci: Acer SA5-271 SSD Not Detected Fix Ben Hutchings
` (205 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Benjamin Peterson, Ingo Molnar, Thomas Gleixner,
Peter Zijlstra, Linus Torvalds
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Peterson <bp@benjamin.pe>
commit c9525a3fab63fbe091007494f8b7a06438eea6a7 upstream.
Signed-off-by: Benjamin Peterson <bp@benjamin.pe>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Fixes: 9919cba7ff71147803c988521cc1ceb80e7f0f6d ("watchdog: Update documentation")
Link: http://lkml.kernel.org/r/20170521002016.13258-1-bp@benjamin.pe
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -304,7 +304,7 @@ config SMP
Management" code will be disabled if you say Y here.
See also <file:Documentation/x86/i386/IO-APIC.txt>,
- <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
+ <file:Documentation/lockup-watchdogs.txt> and the SMP-HOWTO available at
<http://www.tldp.org/docs.html#howto>.
If you don't know what to do here, say N.
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 032/233] ahci: Acer SA5-271 SSD Not Detected Fix
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (27 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 086/233] x86/watchdog: Fix Kconfig help text file path reference to lockup watchdog documentation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 126/233] HID: kye: Fix report descriptor for Genius PenSketch M912 Ben Hutchings
` (204 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Damian Ivanov, Tejun Heo, Sui Chen
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sui Chen <suichen6@gmail.com>
commit 8bfd174312629866efa535193d9e563768ff4307 upstream.
(Correction in this resend: fixed function name acer_sa5_271_workaround; fixed
the always-true condition in the function; fixed description.)
On the Acer Switch Alpha 12 (model number: SA5-271), the internal SSD may not
get detected because the port_map and CAP.nr_ports combination causes the driver
to skip the port that is actually connected to the SSD. More specifically,
either all SATA ports are identified as DUMMY, or all ports get ``link down''
and never get up again.
This problem occurs occasionally. When this problem occurs, CAP may hold a
value of 0xC734FF00 or 0xC734FF01 and port_map may hold a value of 0x00 or 0x01.
When this problem does not occur, CAP holds a value of 0xC734FF02 and port_map
may hold a value of 0x07. Overriding the CAP value to 0xC734FF02 and port_map to
0x7 significantly reduces the occurrence of this problem.
Link: https://bugzilla.kernel.org/attachment.cgi?id=253091
Signed-off-by: Sui Chen <suichen6@gmail.com>
Tested-by: Damian Ivanov <damianatorrpm@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/ahci.c | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -1313,6 +1313,40 @@ static inline void ahci_gtf_filter_worka
{}
#endif
+/*
+ * On the Acer Aspire Switch Alpha 12, sometimes all SATA ports are detected
+ * as DUMMY, or detected but eventually get a "link down" and never get up
+ * again. When this happens, CAP.NP may hold a value of 0x00 or 0x01, and the
+ * port_map may hold a value of 0x00.
+ *
+ * Overriding CAP.NP to 0x02 and the port_map to 0x7 will reveal all 3 ports
+ * and can significantly reduce the occurrence of the problem.
+ *
+ * https://bugzilla.kernel.org/show_bug.cgi?id=189471
+ */
+static void acer_sa5_271_workaround(struct ahci_host_priv *hpriv,
+ struct pci_dev *pdev)
+{
+ static const struct dmi_system_id sysids[] = {
+ {
+ .ident = "Acer Switch Alpha 12",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Switch SA5-271")
+ },
+ },
+ { }
+ };
+
+ if (dmi_check_system(sysids)) {
+ dev_info(&pdev->dev, "enabling Acer Switch Alpha 12 workaround\n");
+ if ((hpriv->saved_cap & 0xC734FF00) == 0xC734FF00) {
+ hpriv->port_map = 0x7;
+ hpriv->cap = 0xC734FF02;
+ }
+ }
+}
+
static int ahci_init_interrupts(struct pci_dev *pdev, unsigned int n_ports,
struct ahci_host_priv *hpriv)
{
@@ -1565,6 +1599,10 @@ static int ahci_init_one(struct pci_dev
"online status unreliable, applying workaround\n");
}
+
+ /* Acer SA5-271 workaround modifies private_data */
+ acer_sa5_271_workaround(hpriv, pdev);
+
/* CAP.NP sometimes indicate the index of the last enabled
* port, at other times, that of the last possible port, so
* determining the maximum port number requires looking at
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 126/233] HID: kye: Fix report descriptor for Genius PenSketch M912
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (28 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 032/233] ahci: Acer SA5-271 SSD Not Detected Fix Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 137/233] HID: usbhid: Fix for the WiiU adapter from Mayflash Ben Hutchings
` (203 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Milan Plzik, Nikolai Kondrashov, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Milan Plzik <milan.plzik@gmail.com>
commit feb6faf1e5d46276c5430e36ffb4a6f62bf8d55b upstream.
Genius PenSketch M912 digitizer tablet sends incorrect report descriptor by
default. This patch replaces it with a corrected one.
Signed-off-by: Milan Plzik <milan.plzik@gmail.com>
Reviewed-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 1 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-kye.c | 140 ++++++++++++++++++++++++++++++++++++++++
drivers/hid/usbhid/hid-quirks.c | 1 +
4 files changed, 143 insertions(+)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1804,6 +1804,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912) },
{ HID_USB_DEVICE(USB_VENDOR_ID_LABTEC, USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD) },
{ HID_USB_DEVICE(USB_VENDOR_ID_LCPOWER, USB_DEVICE_ID_LCPOWER_LC1000 ) },
#if IS_ENABLED(CONFIG_HID_LENOVO_TPKBD)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -533,6 +533,7 @@
#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X 0x5011
#define USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2 0x501a
#define USB_DEVICE_ID_KYE_EASYPEN_M610X 0x5013
+#define USB_DEVICE_ID_KYE_PENSKETCH_M912 0x5015
#define USB_VENDOR_ID_LABTEC 0x1020
#define USB_DEVICE_ID_LABTEC_WIRELESS_KEYBOARD 0x0006
--- a/drivers/hid/hid-kye.c
+++ b/drivers/hid/hid-kye.c
@@ -268,6 +268,137 @@ static __u8 easypen_m610x_rdesc_fixed[]
0xC0 /* End Collection */
};
+
+/* Original PenSketch M912 report descriptor size */
+#define PENSKETCH_M912_RDESC_ORIG_SIZE 482
+
+/* Fixed PenSketch M912 report descriptor */
+static __u8 pensketch_m912_rdesc_fixed[] = {
+ 0x05, 0x01, /* Usage Page (Desktop), */
+ 0x08, /* Usage (00h), */
+ 0xA1, 0x01, /* Collection (Application), */
+ 0x85, 0x05, /* Report ID (5), */
+ 0x06, 0x00, 0xFF, /* Usage Page (FF00h), */
+ 0x09, 0x01, /* Usage (01h), */
+ 0x15, 0x81, /* Logical Minimum (-127), */
+ 0x25, 0x7F, /* Logical Maximum (127), */
+ 0x75, 0x08, /* Report Size (8), */
+ 0x95, 0x07, /* Report Count (7), */
+ 0xB1, 0x02, /* Feature (Variable), */
+ 0xC0, /* End Collection, */
+ 0x05, 0x0D, /* Usage Page (Digitizer), */
+ 0x09, 0x02, /* Usage (Pen), */
+ 0xA1, 0x01, /* Collection (Application), */
+ 0x85, 0x10, /* Report ID (16), */
+ 0x09, 0x20, /* Usage (Stylus), */
+ 0xA0, /* Collection (Physical), */
+ 0x09, 0x42, /* Usage (Tip Switch), */
+ 0x09, 0x44, /* Usage (Barrel Switch), */
+ 0x09, 0x46, /* Usage (Tablet Pick), */
+ 0x14, /* Logical Minimum (0), */
+ 0x25, 0x01, /* Logical Maximum (1), */
+ 0x75, 0x01, /* Report Size (1), */
+ 0x95, 0x03, /* Report Count (3), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x95, 0x04, /* Report Count (4), */
+ 0x81, 0x03, /* Input (Constant, Variable), */
+ 0x09, 0x32, /* Usage (In Range), */
+ 0x95, 0x01, /* Report Count (1), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x75, 0x10, /* Report Size (16), */
+ 0x95, 0x01, /* Report Count (1), */
+ 0xA4, /* Push, */
+ 0x05, 0x01, /* Usage Page (Desktop), */
+ 0x55, 0xFD, /* Unit Exponent (-3), */
+ 0x65, 0x13, /* Unit (Inch), */
+ 0x14, /* Logical Minimum (0), */
+ 0x34, /* Physical Minimum (0), */
+ 0x09, 0x30, /* Usage (X), */
+ 0x27, 0x00, 0xF0, 0x00, 0x00, /* Logical Maximum (61440), */
+ 0x46, 0xE0, 0x2E, /* Physical Maximum (12000), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x09, 0x31, /* Usage (Y), */
+ 0x27, 0x00, 0xB4, 0x00, 0x00, /* Logical Maximum (46080), */
+ 0x46, 0x28, 0x23, /* Physical Maximum (9000), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0xB4, /* Pop, */
+ 0x09, 0x30, /* Usage (Tip Pressure), */
+ 0x14, /* Logical Minimum (0), */
+ 0x26, 0xFF, 0x07, /* Logical Maximum (2047), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0xC0, /* End Collection, */
+ 0xC0, /* End Collection, */
+ 0x05, 0x0D, /* Usage Page (Digitizer), */
+ 0x09, 0x21, /* Usage (Puck), */
+ 0xA1, 0x01, /* Collection (Application), */
+ 0x85, 0x11, /* Report ID (17), */
+ 0x09, 0x21, /* Usage (Puck), */
+ 0xA0, /* Collection (Physical), */
+ 0x05, 0x09, /* Usage Page (Button), */
+ 0x75, 0x01, /* Report Size (1), */
+ 0x19, 0x01, /* Usage Minimum (01h), */
+ 0x29, 0x03, /* Usage Maximum (03h), */
+ 0x14, /* Logical Minimum (0), */
+ 0x25, 0x01, /* Logical Maximum (1), */
+ 0x95, 0x03, /* Report Count (3), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x95, 0x04, /* Report Count (4), */
+ 0x81, 0x01, /* Input (Constant), */
+ 0x95, 0x01, /* Report Count (1), */
+ 0x0B, 0x32, 0x00, 0x0D, 0x00, /* Usage (Digitizer In Range), */
+ 0x14, /* Logical Minimum (0), */
+ 0x25, 0x01, /* Logical Maximum (1), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0xA4, /* Push, */
+ 0x05, 0x01, /* Usage Page (Desktop), */
+ 0x75, 0x10, /* Report Size (16), */
+ 0x95, 0x01, /* Report Count (1), */
+ 0x55, 0xFD, /* Unit Exponent (-3), */
+ 0x65, 0x13, /* Unit (Inch), */
+ 0x14, /* Logical Minimum (0), */
+ 0x34, /* Physical Minimum (0), */
+ 0x09, 0x30, /* Usage (X), */
+ 0x27, 0x00, 0xF0, 0x00, 0x00, /* Logical Maximum (61440), */
+ 0x46, 0xE0, 0x2E, /* Physical Maximum (12000), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x09, 0x31, /* Usage (Y), */
+ 0x27, 0x00, 0xB4, 0x00, 0x00, /* Logical Maximum (46080), */
+ 0x46, 0x28, 0x23, /* Physical Maximum (9000), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x09, 0x38, /* Usage (Wheel), */
+ 0x75, 0x08, /* Report Size (8), */
+ 0x95, 0x01, /* Report Count (1), */
+ 0x15, 0xFF, /* Logical Minimum (-1), */
+ 0x25, 0x01, /* Logical Maximum (1), */
+ 0x34, /* Physical Minimum (0), */
+ 0x44, /* Physical Maximum (0), */
+ 0x81, 0x06, /* Input (Variable, Relative), */
+ 0xB4, /* Pop, */
+ 0xC0, /* End Collection, */
+ 0xC0, /* End Collection, */
+ 0x05, 0x0C, /* Usage Page (Consumer), */
+ 0x09, 0x01, /* Usage (Consumer Control), */
+ 0xA1, 0x01, /* Collection (Application), */
+ 0x85, 0x12, /* Report ID (18), */
+ 0x14, /* Logical Minimum (0), */
+ 0x25, 0x01, /* Logical Maximum (1), */
+ 0x75, 0x01, /* Report Size (1), */
+ 0x95, 0x08, /* Report Count (8), */
+ 0x05, 0x0C, /* Usage Page (Consumer), */
+ 0x0A, 0x6A, 0x02, /* Usage (AC Delete), */
+ 0x0A, 0x1A, 0x02, /* Usage (AC Undo), */
+ 0x0A, 0x01, 0x02, /* Usage (AC New), */
+ 0x0A, 0x2F, 0x02, /* Usage (AC Zoom), */
+ 0x0A, 0x25, 0x02, /* Usage (AC Forward), */
+ 0x0A, 0x24, 0x02, /* Usage (AC Back), */
+ 0x0A, 0x2D, 0x02, /* Usage (AC Zoom In), */
+ 0x0A, 0x2E, 0x02, /* Usage (AC Zoom Out), */
+ 0x81, 0x02, /* Input (Variable), */
+ 0x95, 0x30, /* Report Count (48), */
+ 0x81, 0x03, /* Input (Constant, Variable), */
+ 0xC0 /* End Collection */
+};
+
static __u8 *kye_consumer_control_fixup(struct hid_device *hdev, __u8 *rdesc,
unsigned int *rsize, int offset, const char *device_name) {
/*
@@ -335,6 +466,12 @@ static __u8 *kye_report_fixup(struct hid
*rsize = sizeof(easypen_m610x_rdesc_fixed);
}
break;
+ case USB_DEVICE_ID_KYE_PENSKETCH_M912:
+ if (*rsize == PENSKETCH_M912_RDESC_ORIG_SIZE) {
+ rdesc = pensketch_m912_rdesc_fixed;
+ *rsize = sizeof(pensketch_m912_rdesc_fixed);
+ }
+ break;
case USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE:
rdesc = kye_consumer_control_fixup(hdev, rdesc, rsize, 104,
"Genius Gila Gaming Mouse");
@@ -418,6 +555,7 @@ static int kye_probe(struct hid_device *
case USB_DEVICE_ID_KYE_MOUSEPEN_I608X:
case USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2:
case USB_DEVICE_ID_KYE_EASYPEN_M610X:
+ case USB_DEVICE_ID_KYE_PENSKETCH_M912:
ret = kye_tablet_enable(hdev);
if (ret) {
hid_err(hdev, "tablet enabling failed\n");
@@ -457,6 +595,8 @@ static const struct hid_device_id kye_de
USB_DEVICE_ID_GENIUS_GX_IMPERATOR) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KYE,
USB_DEVICE_ID_GENIUS_MANTICORE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_KYE,
+ USB_DEVICE_ID_KYE_PENSKETCH_M912) },
{ }
};
MODULE_DEVICE_TABLE(hid, kye_devices);
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -133,6 +133,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_2, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 137/233] HID: usbhid: Fix for the WiiU adapter from Mayflash
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (29 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 126/233] HID: kye: Fix report descriptor for Genius PenSketch M912 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 079/233] crypto: gcm - wait for crypto op not signal safe Ben Hutchings
` (202 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Felipe Balbi, Jiri Kosina, Oliver Schmitt
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Schmitt <voltumna@gmx.net>
commit b6ad9a26e7c6fae74062baa9b8a7f583a803e092 upstream.
The WiiU adapter from Mayflash (see
http://www.mayflash.com/Products/NINTENDOWiiU/W009.html) is not
working correctly.
The "XInput" mode works fine, the controller is recognized as a xbox
controller. But it is only possible to connect one controller with this method.
In "DInput" mode the device is recognized as some kind of mouse input but no
joystick is created. This commit will change this behavior with
HID_QUIRK_MULTI_INPUT to split the device into 4 input devices so that it will
also create joysticks in /dev/input/js*.
Signed-off-by: Oliver Schmitt <voltumna@gmx.net>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -276,6 +276,7 @@
#define USB_DEVICE_ID_DMI_ENC 0x5fab
#define USB_VENDOR_ID_DRAGONRISE 0x0079
+#define USB_DEVICE_ID_DRAGONRISE_WIIU 0x1800
#define USB_VENDOR_ID_DWAV 0x0eef
#define USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER 0x0001
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,6 +72,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 079/233] crypto: gcm - wait for crypto op not signal safe
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (30 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 137/233] HID: usbhid: Fix for the WiiU adapter from Mayflash Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 116/233] alarmtimer: Rate limit periodic intervals Ben Hutchings
` (201 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Eric Biggers, Gilad Ben-Yossef, Herbert Xu
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Gilad Ben-Yossef <gilad@benyossef.com>
commit f3ad587070d6bd961ab942b3fd7a85d00dfc934b upstream.
crypto_gcm_setkey() was using wait_for_completion_interruptible() to
wait for completion of async crypto op but if a signal occurs it
may return before DMA ops of HW crypto provider finish, thus
corrupting the data buffer that is kfree'ed in this case.
Resolve this by using wait_for_completion() instead.
Reported-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Gilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
crypto/gcm.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/crypto/gcm.c
+++ b/crypto/gcm.c
@@ -146,10 +146,8 @@ static int crypto_gcm_setkey(struct cryp
err = crypto_ablkcipher_encrypt(&data->req);
if (err == -EINPROGRESS || err == -EBUSY) {
- err = wait_for_completion_interruptible(
- &data->result.completion);
- if (!err)
- err = data->result.err;
+ wait_for_completion(&data->result.completion);
+ err = data->result.err;
}
if (err)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 116/233] alarmtimer: Rate limit periodic intervals
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (31 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 079/233] crypto: gcm - wait for crypto op not signal safe Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 025/233] dm thin metadata: call precommit before saving the roots Ben Hutchings
` (200 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Dmitry Vyukov, Peter Zijlstra, John Stultz, syzkaller,
Kostya Serebryany, Thomas Gleixner
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit ff86bf0c65f14346bf2440534f9ba5ac232c39a0 upstream.
The alarmtimer code has another source of potentially rearming itself too
fast. Interval timers with a very samll interval have a similar CPU hog
effect as the previously fixed overflow issue.
The reason is that alarmtimers do not implement the normal protection
against this kind of problem which the other posix timer use:
timer expires -> queue signal -> deliver signal -> rearm timer
This scheme brings the rearming under scheduler control and prevents
permanently firing timers which hog the CPU.
Bringing this scheme to the alarm timer code is a major overhaul because it
lacks all the necessary mechanisms completely.
So for a quick fix limit the interval to one jiffie. This is not
problematic in practice as alarmtimers are usually backed by an RTC for
suspend which have 1 second resolution. It could be therefor argued that
the resolution of this clock should be set to 1 second in general, but
that's outside the scope of this fix.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Kostya Serebryany <kcc@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/r/20170530211655.896767100@linutronix.de
[bwh: Backported to 3.16:
- Use ktime_to_ns()/ktime_set() as ktime_t is not scalar
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/time/alarmtimer.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -614,6 +614,14 @@ static int alarm_timer_set(struct k_itim
/* start the timer */
timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
+
+ /*
+ * Rate limit to the tick as a hot fix to prevent DOS. Will be
+ * mopped up later.
+ */
+ if (ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC)
+ timr->it.alarm.interval = ktime_set(1, 0);
+
exp = timespec_to_ktime(new_setting->it_value);
/* Convert (if necessary) to absolute time */
if (flags != TIMER_ABSTIME) {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 025/233] dm thin metadata: call precommit before saving the roots
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (32 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 116/233] alarmtimer: Rate limit periodic intervals Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 141/233] HID: quirks: Add no_init_reports for AKAI midi controller Ben Hutchings
` (199 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Joe Thornber, Mike Snitzer
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 upstream.
These calls were the wrong way round in __write_initial_superblock.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/dm-thin-metadata.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -484,11 +484,11 @@ static int __write_initial_superblock(st
if (r < 0)
return r;
- r = save_sm_roots(pmd);
+ r = dm_tm_pre_commit(pmd->tm);
if (r < 0)
return r;
- r = dm_tm_pre_commit(pmd->tm);
+ r = save_sm_roots(pmd);
if (r < 0)
return r;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 141/233] HID: quirks: Add no_init_reports for AKAI midi controller
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (33 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 025/233] dm thin metadata: call precommit before saving the roots Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 100/233] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race Ben Hutchings
` (198 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Benjamin Tissoires, Stafford Horne, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stafford Horne <shorne@gmail.com>
commit a382c30c662a31dd8f51cc4b6dad82d39205d50c upstream.
The midi controller times-out while initializing reports, this
causes boot to take an extra 10 seconds. The device descriptor
advertises that it has an internal HID device but seems to not
actually do anything useful.
Signed-off-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -61,6 +61,9 @@
#define USB_VENDOR_ID_AIREN 0x1a2c
#define USB_DEVICE_ID_AIREN_SLIMPLUS 0x0002
+#define USB_VENDOR_ID_AKAI 0x2011
+#define USB_DEVICE_ID_AKAI_MPKMINI2 0x0715
+
#define USB_VENDOR_ID_ALCOR 0x058f
#define USB_DEVICE_ID_ALCOR_USBRS232 0x9720
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -55,6 +55,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 100/233] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (34 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 141/233] HID: quirks: Add no_init_reports for AKAI midi controller Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 122/233] [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' Ben Hutchings
` (197 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Maged Mokhtar, Nicholas Bellinger
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 8f0dfb3d8b1120c61f6e2cc3729290db10772b2d upstream.
There is a iscsi-target/tcp login race in LOGIN_FLAGS_READY
state assignment that can result in frequent errors during
iscsi discovery:
"iSCSI Login negotiation failed."
To address this bug, move the initial LOGIN_FLAGS_READY
assignment ahead of iscsi_target_do_login() when handling
the initial iscsi_target_start_negotiation() request PDU
during connection login.
As iscsi_target_do_login_rx() work_struct callback is
clearing LOGIN_FLAGS_READ_ACTIVE after subsequent calls
to iscsi_target_do_login(), the early sk_data_ready
ahead of the first iscsi_target_do_login() expects
LOGIN_FLAGS_READY to also be set for the initial
login request PDU.
As reported by Maged, this was first obsered using an
MSFT initiator running across multiple VMWare host
virtual machines with iscsi-target/tcp.
Reported-by: Maged Mokhtar <mmokhtar@binarykinetics.com>
Tested-by: Maged Mokhtar <mmokhtar@binarykinetics.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/iscsi/iscsi_target_nego.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -1251,16 +1251,16 @@ int iscsi_target_start_negotiation(
{
int ret;
- ret = iscsi_target_do_login(conn, login);
- if (!ret) {
- if (conn->sock) {
- struct sock *sk = conn->sock->sk;
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
- write_lock_bh(&sk->sk_callback_lock);
- set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
- write_unlock_bh(&sk->sk_callback_lock);
- }
- } else if (ret < 0) {
+ write_lock_bh(&sk->sk_callback_lock);
+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+ write_unlock_bh(&sk->sk_callback_lock);
+ }
+
+ ret = iscsi_target_do_login(conn, login);
+ if (ret < 0) {
cancel_delayed_work_sync(&conn->login_work);
cancel_delayed_work_sync(&conn->login_cleanup_work);
iscsi_target_restore_sock_callbacks(conn);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 122/233] [media] vb2: Fix an off by one error in 'vb2_plane_vaddr'
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (35 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 100/233] iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 043/233] USB: gadget: dummy_hcd: fix hub-descriptor removable fields Ben Hutchings
` (196 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Sakari Ailus, Hans Verkuil, Christophe JAILLET,
Mauro Carvalho Chehab
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 5ebb6dd36c9f5fb37b1077b393c254d70a14cb46 upstream.
We should ensure that 'plane_no' is '< vb->num_planes' as done in
'vb2_plane_cookie' just a few lines below.
Fixes: e23ccc0ad925 ("[media] v4l: add videobuf2 Video for Linux 2 driver framework")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/v4l2-core/videobuf2-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1107,7 +1107,7 @@ EXPORT_SYMBOL_GPL(vb2_create_bufs);
*/
void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no)
{
- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
+ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
return NULL;
return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 043/233] USB: gadget: dummy_hcd: fix hub-descriptor removable fields
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (36 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 122/233] [media] vb2: Fix an off by one error in 'vb2_plane_vaddr' Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 108/233] usb: gadget: f_mass_storage: Serialize wake and sleep execution Ben Hutchings
` (195 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Tatyana Brokhman, Greg Kroah-Hartman, Alan Stern, Johan Hovold
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d81182ce30dbd497a1e7047d7fda2af040347790 upstream.
Flag the first and only port as removable while also leaving the
remaining bits (including the reserved bit zero) unset in accordance
with the specifications:
"Within a byte, if no port exists for a given location, the bit
field representing the port characteristics shall be 0."
Also add a comment marking the legacy PortPwrCtrlMask field.
Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Tatyana Brokhman <tlinder@codeaurora.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/gadget/dummy_hcd.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -1933,7 +1933,7 @@ ss_hub_descriptor(struct usb_hub_descrip
desc->wHubCharacteristics = cpu_to_le16(0x0001);
desc->bNbrPorts = 1;
desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/
- desc->u.ss.DeviceRemovable = 0xffff;
+ desc->u.ss.DeviceRemovable = 0;
}
static inline void hub_descriptor(struct usb_hub_descriptor *desc)
@@ -1943,8 +1943,8 @@ static inline void hub_descriptor(struct
desc->bDescLength = 9;
desc->wHubCharacteristics = cpu_to_le16(0x0001);
desc->bNbrPorts = 1;
- desc->u.hs.DeviceRemovable[0] = 0xff;
- desc->u.hs.DeviceRemovable[1] = 0xff;
+ desc->u.hs.DeviceRemovable[0] = 0;
+ desc->u.hs.DeviceRemovable[1] = 0xff; /* PortPwrCtrlMask */
}
static int dummy_hub_control(
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 108/233] usb: gadget: f_mass_storage: Serialize wake and sleep execution
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (37 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 043/233] USB: gadget: dummy_hcd: fix hub-descriptor removable fields Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 113/233] staging/lustre/lov: remove set_fs() call from lov_getstripe() Ben Hutchings
` (194 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alan Stern, Thinh Nguyen, Felipe Balbi, Thinh Nguyen
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit dc9217b69dd6089dcfeb86ed4b3c671504326087 upstream.
f_mass_storage has a memorry barrier issue with the sleep and wake
functions that can cause a deadlock. This results in intermittent hangs
during MSC file transfer. The host will reset the device after receiving
no response to resume the transfer. This issue is seen when dwc3 is
processing 2 transfer-in-progress events at the same time, invoking
completion handlers for CSW and CBW. Also this issue occurs depending on
the system timing and latency.
To increase the chance to hit this issue, you can force dwc3 driver to
wait and process those 2 events at once by adding a small delay (~100us)
in dwc3_check_event_buf() whenever the request is for CSW and read the
event count again. Avoid debugging with printk and ftrace as extra
delays and memory barrier will mask this issue.
Scenario which can lead to failure:
-----------------------------------
1) The main thread sleeps and waits for the next command in
get_next_command().
2) bulk_in_complete() wakes up main thread for CSW.
3) bulk_out_complete() tries to wake up the running main thread for CBW.
4) thread_wakeup_needed is not loaded with correct value in
sleep_thread().
5) Main thread goes to sleep again.
The pattern is shown below. Note the 2 critical variables.
* common->thread_wakeup_needed
* bh->state
CPU 0 (sleep_thread) CPU 1 (wakeup_thread)
============================== ===============================
bh->state = BH_STATE_FULL;
smp_wmb();
thread_wakeup_needed = 0; thread_wakeup_needed = 1;
smp_rmb();
if (bh->state != BH_STATE_FULL)
sleep again ...
As pointed out by Alan Stern, this is an R-pattern issue. The issue can
be seen when there are two wakeups in quick succession. The
thread_wakeup_needed can be overwritten in sleep_thread, and the read of
the bh->state maybe reordered before the write to thread_wakeup_needed.
This patch applies full memory barrier smp_mb() in both sleep_thread()
and wakeup_thread() to ensure the order which the thread_wakeup_needed
and bh->state are written and loaded.
However, a better solution in the future would be to use wait_queue
method that takes care of managing memory barrier between waker and
waiter.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/gadget/f_mass_storage.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/f_mass_storage.c
+++ b/drivers/usb/gadget/f_mass_storage.c
@@ -400,7 +400,11 @@ static int fsg_set_halt(struct fsg_dev *
/* Caller must hold fsg->lock */
static void wakeup_thread(struct fsg_common *common)
{
- smp_wmb(); /* ensure the write of bh->state is complete */
+ /*
+ * Ensure the reading of thread_wakeup_needed
+ * and the writing of bh->state are completed
+ */
+ smp_mb();
/* Tell the main thread that something has happened */
common->thread_wakeup_needed = 1;
if (common->thread_task)
@@ -621,7 +625,12 @@ static int sleep_thread(struct fsg_commo
}
__set_current_state(TASK_RUNNING);
common->thread_wakeup_needed = 0;
- smp_rmb(); /* ensure the latest bh->state is visible */
+
+ /*
+ * Ensure the writing of thread_wakeup_needed
+ * and the reading of bh->state are completed
+ */
+ smp_mb();
return rc;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 113/233] staging/lustre/lov: remove set_fs() call from lov_getstripe()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (38 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 108/233] usb: gadget: f_mass_storage: Serialize wake and sleep execution Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 061/233] serial: ifx6x60: Remove dangerous spi_driver casts Ben Hutchings
` (193 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Oleg Drokin, Andreas Dilger, Greg Kroah-Hartman,
John L. Hammond, Li Wei
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Drokin <green@linuxhacker.ru>
commit 0a33252e060e97ed3fbdcec9517672f1e91aaef3 upstream.
lov_getstripe() calls set_fs(KERNEL_DS) so that it can handle a struct
lov_user_md pointer from user- or kernel-space. This changes the
behavior of copy_from_user() on SPARC and may result in a misaligned
access exception which in turn oopses the kernel. In fact the
relevant argument to lov_getstripe() is never called with a
kernel-space pointer and so changing the address limits is unnecessary
and so we remove the calls to save, set, and restore the address
limits.
Signed-off-by: John L. Hammond <john.hammond@intel.com>
Reviewed-on: http://review.whamcloud.com/6150
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-3221
Reviewed-by: Andreas Dilger <andreas.dilger@intel.com>
Reviewed-by: Li Wei <wei.g.li@intel.com>
Signed-off-by: Oleg Drokin <green@linuxhacker.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/lustre/lustre/lov/lov_pack.c | 9 ---------
1 file changed, 9 deletions(-)
--- a/drivers/staging/lustre/lustre/lov/lov_pack.c
+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c
@@ -592,18 +592,10 @@ int lov_getstripe(struct obd_export *exp
struct lov_mds_md *lmmk = NULL;
int rc, lmm_size;
int lum_size;
- mm_segment_t seg;
if (!lsm)
return -ENODATA;
- /*
- * "Switch to kernel segment" to allow copying from kernel space by
- * copy_{to,from}_user().
- */
- seg = get_fs();
- set_fs(KERNEL_DS);
-
/* we only need the header part from user space to get lmm_magic and
* lmm_stripe_count, (the header part is common to v1 and v3) */
lum_size = sizeof(struct lov_user_md_v1);
@@ -672,6 +664,5 @@ int lov_getstripe(struct obd_export *exp
obd_free_diskmd(exp, &lmmk);
out_set:
- set_fs(seg);
return rc;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 061/233] serial: ifx6x60: Remove dangerous spi_driver casts
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (39 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 113/233] staging/lustre/lov: remove set_fs() call from lov_getstripe() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 117/233] [media] rc-core: race condition during ir_raw_event_register() Ben Hutchings
` (192 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Geert Uytterhoeven, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert@linux-m68k.org>
commit 9a499db0325b8a8e2368f21fef66705b120f38ba upstream.
Casting spi_driver pointers to "void *" when calling
spi_{,un}register_driver() bypasses all type checking.
Remove the superfluous casts to fix this.
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/serial/ifx6x60.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1381,7 +1381,7 @@ static void __exit ifx_spi_exit(void)
/* unregister */
tty_unregister_driver(tty_drv);
put_tty_driver(tty_drv);
- spi_unregister_driver((void *)&ifx_spi_driver);
+ spi_unregister_driver(&ifx_spi_driver);
unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
}
@@ -1420,7 +1420,7 @@ static int __init ifx_spi_init(void)
goto err_free_tty;
}
- result = spi_register_driver((void *)&ifx_spi_driver);
+ result = spi_register_driver(&ifx_spi_driver);
if (result) {
pr_err("%s: spi_register_driver failed(%d)",
DRVNAME, result);
@@ -1436,7 +1436,7 @@ static int __init ifx_spi_init(void)
return 0;
err_unreg_spi:
- spi_unregister_driver((void *)&ifx_spi_driver);
+ spi_unregister_driver(&ifx_spi_driver);
err_unreg_tty:
tty_unregister_driver(tty_drv);
err_free_tty:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 117/233] [media] rc-core: race condition during ir_raw_event_register()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (40 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 061/233] serial: ifx6x60: Remove dangerous spi_driver casts Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 068/233] selftests/powerpc: Fix TM resched DSCR test with some compilers Ben Hutchings
` (191 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Mauro Carvalho Chehab, Sean Young, kbuild test robot
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sean Young <sean@mess.org>
commit 963761a0b2e85663ee4a5630f72930885a06598a upstream.
A rc device can call ir_raw_event_handle() after rc_allocate_device(),
but before rc_register_device() has completed. This is racey because
rcdev->raw is set before rcdev->raw->thread has a valid value.
Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 3.16: adjust filename, context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/rc/ir-raw.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/media/rc/ir-raw.c
+++ b/drivers/media/rc/ir-raw.c
@@ -220,7 +220,7 @@ void ir_raw_event_handle(struct rc_dev *
{
unsigned long flags;
- if (!dev->raw)
+ if (!dev->raw || !dev->raw->thread)
return;
spin_lock_irqsave(&dev->raw->lock, flags);
@@ -247,6 +247,7 @@ int ir_raw_event_register(struct rc_dev
{
int rc;
struct ir_raw_handler *handler;
+ struct task_struct *thread;
if (!dev)
return -EINVAL;
@@ -264,14 +265,16 @@ int ir_raw_event_register(struct rc_dev
goto out;
spin_lock_init(&dev->raw->lock);
- dev->raw->thread = kthread_run(ir_raw_event_thread, dev->raw,
- "rc%ld", dev->devno);
+ thread = kthread_run(ir_raw_event_thread, dev->raw, "rc%ld",
+ dev->devno);
- if (IS_ERR(dev->raw->thread)) {
- rc = PTR_ERR(dev->raw->thread);
+ if (IS_ERR(thread)) {
+ rc = PTR_ERR(thread);
goto out;
}
+ dev->raw->thread = thread;
+
mutex_lock(&ir_raw_handler_lock);
list_add_tail(&dev->raw->list, &ir_raw_client_list);
list_for_each_entry(handler, &ir_raw_handler_list, list)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 068/233] selftests/powerpc: Fix TM resched DSCR test with some compilers
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (41 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 117/233] [media] rc-core: race condition during ir_raw_event_register() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 139/233] USB: quirks: Apply ALWAYS_POLL to all ELAN devices Ben Hutchings
` (190 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michael Neuling, Michael Ellerman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit fe06fe860250a4f01d0eaf70a2563b1997174a74 upstream.
The tm-resched-dscr test has started failing sometimes, depending on
what compiler it's built with, eg:
test: tm_resched_dscr
Check DSCR TM context switch: tm-resched-dscr: tm-resched-dscr.c:76: test_body: Assertion `rv' failed.
!! child died by signal 6
When it fails we see that the compiler doesn't initialise rv to 1 before
entering the inline asm block. Although that's counter intuitive, it
is allowed because we tell the compiler that the inline asm will write
to rv (using "=r"), meaning the original value is irrelevant.
Marking it as a read/write parameter would presumably work, but it seems
simpler to fix it by setting the initial value of rv in the inline asm.
Fixes: 96d016108640 ("powerpc: Correct DSCR during TM context switch")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/testing/selftests/powerpc/tm/tm-resched-dscr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
+++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c
@@ -45,12 +45,12 @@ int test_body(void)
printf("Check DSCR TM context switch: ");
fflush(stdout);
for (;;) {
- rv = 1;
asm __volatile__ (
/* set a known value into the DSCR */
"ld 3, %[dscr1];"
"mtspr %[sprn_dscr], 3;"
+ "li %[rv], 1;"
/* start and suspend a transaction */
TBEGIN
"beq 1f;"
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 139/233] USB: quirks: Apply ALWAYS_POLL to all ELAN devices
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (42 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 068/233] selftests/powerpc: Fix TM resched DSCR test with some compilers Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 058/233] usb: host: xhci-plat: propagate return value of platform_get_irq() Ben Hutchings
` (189 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Adrien Vergé,
Jiri Kosina, Greg Kroah-Hartman, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Adrien Vergé <adrienverge@gmail.com>
commit 33bd2dd03dd0bfa1130d11062a9e5f40d0cf1d3f upstream.
All ELAN hid devices seem to require the ALWAYS_POLL quirk. Let's use
this quirk for all devices from this vendor, rather than maintaining a
list of all its known product IDs.
Tested-by: Adrien Vergé <adrienverge@gmail.com>
Signed-off-by: Adrien Vergé <adrienverge@gmail.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Reviewed-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 5 -----
drivers/hid/usbhid/hid-quirks.c | 9 +++------
2 files changed, 3 insertions(+), 11 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -301,11 +301,6 @@
#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001
#define USB_VENDOR_ID_ELAN 0x04f3
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN 0x0089
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B 0x009b
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103 0x0103
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c 0x010c
-#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F 0x016f
#define USB_VENDOR_ID_ELECOM 0x056e
#define USB_DEVICE_ID_ELECOM_BM084 0x0061
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -73,11 +73,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
- { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
- { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
- { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
- { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_010c, HID_QUIRK_ALWAYS_POLL },
- { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
@@ -341,7 +337,8 @@ static const struct hid_blacklist *usbhi
for (; hid_blacklist[n].idVendor; n++)
if (hid_blacklist[n].idVendor == idVendor &&
- hid_blacklist[n].idProduct == idProduct)
+ (hid_blacklist[n].idProduct == (__u16) HID_ANY_ID ||
+ hid_blacklist[n].idProduct == idProduct))
bl_entry = &hid_blacklist[n];
if (bl_entry != NULL)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 058/233] usb: host: xhci-plat: propagate return value of platform_get_irq()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (43 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 139/233] USB: quirks: Apply ALWAYS_POLL to all ELAN devices Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 081/233] pinctrl: mxs: atomically switch mux and drive strength config Ben Hutchings
` (188 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Mathias Nyman, Thomas Petazzoni
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
commit 4b148d5144d64ee135b8924350cb0b3a7fd21150 upstream.
platform_get_irq() returns an error code, but the xhci-plat driver
ignores it and always returns -ENODEV. This is not correct, and
prevents -EPROBE_DEFER from being propagated properly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-plat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -109,7 +109,7 @@ static int xhci_plat_probe(struct platfo
irq = platform_get_irq(pdev, 0);
if (irq < 0)
- return -ENODEV;
+ return irq;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 081/233] pinctrl: mxs: atomically switch mux and drive strength config
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (44 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 058/233] usb: host: xhci-plat: propagate return value of platform_get_irq() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 005/233] af_key: Fix slab-out-of-bounds in pfkey_compile_policy Ben Hutchings
` (187 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Walleij, Uwe Kleine-König, Shawn Guo
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit da6c2addf66d7ff7d0b090d6267d4292f951e4e6 upstream.
To set the mux mode of a pin two bits must be set. Up to now this is
implemented using the following idiom:
writel(mask, reg + CLR);
writel(value, reg + SET);
. This however results in the mux mode being 0 between the two writes.
On my machine there is an IC's reset pin connected to LCD_D20. The
bootloader configures this pin as GPIO output-high (i.e. not holding the
IC in reset). When Linux reconfigures the pin to GPIO the short time
LCD_D20 is muxed as LCD_D20 instead of GPIO_1_20 is enough to confuse
the connected IC.
The same problem is present for the pin's drive strength setting which is
reset to low drive strength before using the right value.
So instead of relying on the hardware to modify the register setting
using two writes implement the bit toggling using read-modify-write.
Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Acked-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/pinctrl/pinctrl-mxs.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/pinctrl/pinctrl-mxs.c
+++ b/drivers/pinctrl/pinctrl-mxs.c
@@ -195,6 +195,16 @@ static int mxs_pinctrl_get_func_groups(s
return 0;
}
+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
+{
+ u32 tmp;
+
+ tmp = readl(reg);
+ tmp &= ~(mask << shift);
+ tmp |= value << shift;
+ writel(tmp, reg);
+}
+
static int mxs_pinctrl_enable(struct pinctrl_dev *pctldev, unsigned selector,
unsigned group)
{
@@ -212,8 +222,7 @@ static int mxs_pinctrl_enable(struct pin
reg += bank * 0x20 + pin / 16 * 0x10;
shift = pin % 16 * 2;
- writel(0x3 << shift, reg + CLR);
- writel(g->muxsel[i] << shift, reg + SET);
+ mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
}
return 0;
@@ -280,8 +289,7 @@ static int mxs_pinconf_group_set(struct
/* mA */
if (config & MA_PRESENT) {
shift = pin % 8 * 4;
- writel(0x3 << shift, reg + CLR);
- writel(ma << shift, reg + SET);
+ mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
}
/* vol */
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 005/233] af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (45 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 081/233] pinctrl: mxs: atomically switch mux and drive strength config Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 146/233] HID: support for keyboard - Corsair STRAFE Ben Hutchings
` (186 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Andrey Konovalov, Steffen Klassert
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 upstream.
The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
So we have to multiply this value by eight before we can do
size checks. Otherwise we may get a slab-out-of-bounds when
we memcpy the user sec_ctx.
Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/key/af_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3282,7 +3282,7 @@ static struct xfrm_policy *pfkey_compile
p += pol->sadb_x_policy_len*8;
sec_ctx = (struct sadb_x_sec_ctx *)p;
if (len < pol->sadb_x_policy_len*8 +
- sec_ctx->sadb_x_sec_len) {
+ sec_ctx->sadb_x_sec_len*8) {
*dir = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 146/233] HID: support for keyboard - Corsair STRAFE
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (46 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 005/233] af_key: Fix slab-out-of-bounds in pfkey_compile_policy Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 009/233] netem: fix skb_orphan_partial() Ben Hutchings
` (185 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Marian Krivoš, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marian Krivoš <marian.krivos@gmail.com>
commit 3da30bfc0b0a572a4f977a586edf34cf3dd503c3 upstream.
Add quirk for Corsair STRAFE keyboard, similarly to what we've been
doing for other CORSAIR devices already, in order to avoid long delays
during boot.
[jkosina@suse.cz: reword changelog a little bit]
Signed-off-by: Marian Krivos <marian.krivos@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -247,6 +247,7 @@
#define USB_DEVICE_ID_CORSAIR_K95RGB 0x1b11
#define USB_DEVICE_ID_CORSAIR_M65RGB 0x1b12
#define USB_DEVICE_ID_CORSAIR_K70RGB 0x1b13
+#define USB_DEVICE_ID_CORSAIR_STRAFE 0x1b15
#define USB_DEVICE_ID_CORSAIR_K65RGB 0x1b17
#define USB_VENDOR_ID_CREATIVELABS 0x041e
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -77,6 +77,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K95RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 009/233] netem: fix skb_orphan_partial()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (47 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 146/233] HID: support for keyboard - Corsair STRAFE Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 047/233] USB: hub: fix SS max number of ports Ben Hutchings
` (184 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michael Madsen, David S. Miller, Eric Dumazet
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit f6ba8d33cfbb46df569972e64dbb5bb7e929bfd9 upstream.
I should have known that lowering skb->truesize was dangerous :/
In case packets are not leaving the host via a standard Ethernet device,
but looped back to local sockets, bad things can happen, as reported
by Michael Madsen ( https://bugzilla.kernel.org/show_bug.cgi?id=195713 )
So instead of tweaking skb->truesize, lets change skb->destructor
and keep a reference on the owner socket via its sk_refcnt.
Fixes: f2f872f9272a ("netem: Introduce skb_orphan_partial() helper")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Michael Madsen <mkm@nabto.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: drop changes to the preceding comment and the
fast path, which we don't have]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1654,17 +1654,17 @@ EXPORT_SYMBOL(sock_wfree);
void skb_orphan_partial(struct sk_buff *skb)
{
- /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
- * so we do not completely orphan skb, but transfert all
- * accounted bytes but one, to avoid unexpected reorders.
- */
if (skb->destructor == sock_wfree
#ifdef CONFIG_INET
|| skb->destructor == tcp_wfree
#endif
) {
- atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
- skb->truesize = 1;
+ struct sock *sk = skb->sk;
+
+ if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+ atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+ skb->destructor = sock_efree;
+ }
} else {
skb_orphan(skb);
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 047/233] USB: hub: fix SS max number of ports
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (48 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 009/233] netem: fix skb_orphan_partial() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 039/233] uwb: fix device quirk on big-endian hosts Ben Hutchings
` (183 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alan Stern, Johan Hovold, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 93491ced3c87c94b12220dbac0527e1356702179 upstream.
Add define for the maximum number of ports on a SuperSpeed hub as per
USB 3.1 spec Table 10-5, and use it when verifying the retrieved hub
descriptor.
This specifically avoids benign attempts to update the DeviceRemovable
mask for non-existing ports (should we get that far).
Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/hub.c | 8 +++++++-
include/uapi/linux/usb/ch11.h | 3 +++
2 files changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1316,7 +1316,13 @@ static int hub_configure(struct usb_hub
if (ret < 0) {
message = "can't read hub descriptor";
goto fail;
- } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) {
+ }
+
+ maxchild = USB_MAXCHILDREN;
+ if (hub_is_superspeed(hdev))
+ maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS);
+
+ if (hub->descriptor->bNbrPorts > maxchild) {
message = "hub has too many ports!";
ret = -ENODEV;
goto fail;
--- a/include/uapi/linux/usb/ch11.h
+++ b/include/uapi/linux/usb/ch11.h
@@ -22,6 +22,9 @@
*/
#define USB_MAXCHILDREN 31
+/* See USB 3.1 spec Table 10-5 */
+#define USB_SS_MAXPORTS 15
+
/*
* Hub request types
*/
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 039/233] uwb: fix device quirk on big-endian hosts
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (49 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 047/233] USB: hub: fix SS max number of ports Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 027/233] kvm: arm/arm64: Fix race in resetting stage2 PGD Ben Hutchings
` (182 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Johan Hovold
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream.
Add missing endianness conversion when using the USB device-descriptor
idProduct field to apply a hardware quirk.
Fixes: 1ba47da52712 ("uwb: add the i1480 DFU driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/uwb/i1480/dfu/usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
static
int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
{
+ struct usb_device *udev = interface_to_usbdev(iface);
struct i1480_usb *i1480_usb;
struct i1480 *i1480;
struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface
iface->cur_altsetting->desc.bInterfaceNumber);
goto error;
}
- if (iface->num_altsetting > 1
- && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+ if (iface->num_altsetting > 1 &&
+ le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
/* Need altsetting #1 [HW QUIRK] or EP1 won't work */
result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
if (result < 0)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 027/233] kvm: arm/arm64: Fix race in resetting stage2 PGD
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (50 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 039/233] uwb: fix device quirk on big-endian hosts Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 016/233] usb: serial: option: add Telit ME910 support Ben Hutchings
` (181 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Mark Rutland, Marc Zyngier, Paolo Bonzini,
Christoffer Dall, Alexander Graf, Radim Krčmář,
Suzuki K Poulose
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 6c0d706b563af732adb094c5bf807437e8963e84 upstream.
In kvm_free_stage2_pgd() we check the stage2 PGD before holding
the lock and proceed to take the lock if it is valid. And we unmap
the page tables, followed by releasing the lock. We reset the PGD
only after dropping this lock, which could cause a race condition
where another thread waiting on or even holding the lock, could
potentially see that the PGD is still valid and proceed to perform
a stage2 operation and later encounter a NULL PGD.
[223090.242280] Unable to handle kernel NULL pointer dereference at
virtual address 00000040
[223090.262330] PC is at unmap_stage2_range+0x8c/0x428
[223090.262332] LR is at kvm_unmap_hva_handler+0x2c/0x3c
[223090.262531] Call trace:
[223090.262533] [<ffff0000080adb78>] unmap_stage2_range+0x8c/0x428
[223090.262535] [<ffff0000080adf40>] kvm_unmap_hva_handler+0x2c/0x3c
[223090.262537] [<ffff0000080ace2c>] handle_hva_to_gpa+0xb0/0x104
[223090.262539] [<ffff0000080af988>] kvm_unmap_hva+0x5c/0xbc
[223090.262543] [<ffff0000080a2478>]
kvm_mmu_notifier_invalidate_page+0x50/0x8c
[223090.262547] [<ffff0000082274f8>]
__mmu_notifier_invalidate_page+0x5c/0x84
[223090.262551] [<ffff00000820b700>] try_to_unmap_one+0x1d0/0x4a0
[223090.262553] [<ffff00000820c5c8>] rmap_walk+0x1cc/0x2e0
[223090.262555] [<ffff00000820c90c>] try_to_unmap+0x74/0xa4
[223090.262557] [<ffff000008230ce4>] migrate_pages+0x31c/0x5ac
[223090.262561] [<ffff0000081f869c>] compact_zone+0x3fc/0x7ac
[223090.262563] [<ffff0000081f8ae0>] compact_zone_order+0x94/0xb0
[223090.262564] [<ffff0000081f91c0>] try_to_compact_pages+0x108/0x290
[223090.262569] [<ffff0000081d5108>] __alloc_pages_direct_compact+0x70/0x1ac
[223090.262571] [<ffff0000081d64a0>] __alloc_pages_nodemask+0x434/0x9f4
[223090.262572] [<ffff0000082256f0>] alloc_pages_vma+0x230/0x254
[223090.262574] [<ffff000008235e5c>] do_huge_pmd_anonymous_page+0x114/0x538
[223090.262576] [<ffff000008201bec>] handle_mm_fault+0xd40/0x17a4
[223090.262577] [<ffff0000081fb324>] __get_user_pages+0x12c/0x36c
[223090.262578] [<ffff0000081fb804>] get_user_pages_unlocked+0xa4/0x1b8
[223090.262579] [<ffff0000080a3ce8>] __gfn_to_pfn_memslot+0x280/0x31c
[223090.262580] [<ffff0000080a3dd0>] gfn_to_pfn_prot+0x4c/0x5c
[223090.262582] [<ffff0000080af3f8>] kvm_handle_guest_abort+0x240/0x774
[223090.262584] [<ffff0000080b2bac>] handle_exit+0x11c/0x1ac
[223090.262586] [<ffff0000080ab99c>] kvm_arch_vcpu_ioctl_run+0x31c/0x648
[223090.262587] [<ffff0000080a1d78>] kvm_vcpu_ioctl+0x378/0x768
[223090.262590] [<ffff00000825df5c>] do_vfs_ioctl+0x324/0x5a4
[223090.262591] [<ffff00000825e26c>] SyS_ioctl+0x90/0xa4
[223090.262595] [<ffff000008085d84>] el0_svc_naked+0x38/0x3c
This patch moves the stage2 PGD manipulation under the lock.
Reported-by: Alexander Graf <agraf@suse.de>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/kvm/mmu.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -635,21 +635,21 @@ void stage2_unmap_vm(struct kvm *kvm)
* Walks the level-1 page table pointed to by kvm->arch.pgd and frees all
* underlying level-2 and level-3 tables before freeing the actual level-1 table
* and setting the struct pointer to NULL.
- *
- * Note we don't need locking here as this is only called when the VM is
- * destroyed, which can only be done once.
*/
void kvm_free_stage2_pgd(struct kvm *kvm)
{
- if (kvm->arch.pgd == NULL)
- return;
+ void *pgd = NULL;
spin_lock(&kvm->mmu_lock);
- unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+ if (kvm->arch.pgd) {
+ unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+ pgd = kvm->arch.pgd;
+ kvm->arch.pgd = NULL;
+ }
spin_unlock(&kvm->mmu_lock);
- free_pages((unsigned long)kvm->arch.pgd, S2_PGD_ORDER);
- kvm->arch.pgd = NULL;
+ if (pgd)
+ free_pages((unsigned long)pgd, S2_PGD_ORDER);
}
static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 016/233] usb: serial: option: add Telit ME910 support
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (51 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 027/233] kvm: arm/arm64: Fix race in resetting stage2 PGD Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 151/233] HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar Ben Hutchings
` (180 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Daniele Palmas
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <dnlplm@gmail.com>
commit 40dd46048c155b8f0683f468c950a1c107f77a7c upstream.
This patch adds support for Telit ME910 PID 0x1100.
Signed-off-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/option.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -284,6 +284,7 @@ static void option_instat_callback(struc
#define TELIT_PRODUCT_LE922_USBCFG0 0x1042
#define TELIT_PRODUCT_LE922_USBCFG3 0x1043
#define TELIT_PRODUCT_LE922_USBCFG5 0x1045
+#define TELIT_PRODUCT_ME910 0x1100
#define TELIT_PRODUCT_LE920 0x1200
#define TELIT_PRODUCT_LE910 0x1201
#define TELIT_PRODUCT_LE910_USBCFG4 0x1206
@@ -650,6 +651,11 @@ static const struct option_blacklist_inf
.reserved = BIT(5) | BIT(6),
};
+static const struct option_blacklist_info telit_me910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(3),
+};
+
static const struct option_blacklist_info telit_le910_blacklist = {
.sendsetup = BIT(0),
.reserved = BIT(1) | BIT(2),
@@ -1254,6 +1260,8 @@ static const struct usb_device_id option
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
.driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ .driver_info = (kernel_ulong_t)&telit_me910_blacklist },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
.driver_info = (kernel_ulong_t)&telit_le910_blacklist },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 151/233] HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (52 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 016/233] usb: serial: option: add Telit ME910 support Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 136/233] HID: Add new Microsoft Type Cover 3 product ID Ben Hutchings
` (179 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Marcel Hasler
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marcel Hasler <mahasler@gmail.com>
commit 8aa2cc7e747881d1fd52db28261b201d4e3e5565 upstream.
The DolphinBar by Mayflash (identified as Dragonrise) needs
HID_QUIRK_MULTI_INPUT to split it up into four input devices. Without this
quirk the adapter is falsely recognized as a tablet. See also bug 115841
(https://bugzilla.kernel.org/show_bug.cgi?id=115841).
Signed-off-by: Marcel Hasler <mahasler@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -293,6 +293,7 @@
#define USB_VENDOR_ID_DRAGONRISE 0x0079
#define USB_DEVICE_ID_DRAGONRISE_WIIU 0x1800
#define USB_DEVICE_ID_DRAGONRISE_PS3 0x1801
+#define USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR 0x1803
#define USB_DEVICE_ID_DRAGONRISE_GAMECUBE 0x1843
#define USB_VENDOR_ID_DWAV 0x0eef
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -83,6 +83,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_DOLPHINBAR, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_GAMECUBE, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 136/233] HID: Add new Microsoft Type Cover 3 product ID
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (53 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 151/233] HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 125/233] HID: add quirk for 0x04d9:0xa096 device Ben Hutchings
` (178 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Donavan Lance
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Donavan Lance <shvr@fedoraproject.org>
commit c6956eb70e2549a3c2fa6ee525e02776d293caf4 upstream.
Adds support for Microsoft Type Cover 3 with 0x07e2 product ID.
Signed-off-by: Donavan Lance <shvr@fedoraproject.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 2 ++
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-microsoft.c | 2 ++
drivers/hid/usbhid/hid-quirks.c | 1 +
4 files changed, 6 insertions(+)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -705,6 +705,7 @@ static void hid_scan_collection(struct h
if (hid->vendor == USB_VENDOR_ID_MICROSOFT &&
(hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
@@ -1860,6 +1861,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -662,6 +662,7 @@
#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7
#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 0x07dc
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 0x07e2
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd
#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07de
#define USB_DEVICE_ID_MS_POWER_COVER 0x07da
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -278,6 +278,8 @@ static const struct hid_device_id ms_dev
.driver_data = MS_DUPLICATE_USAGES },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3),
.driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2),
+ .driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP),
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -92,6 +92,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 125/233] HID: add quirk for 0x04d9:0xa096 device
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (54 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 136/233] HID: Add new Microsoft Type Cover 3 product ID Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 140/233] HID: add HID_QUIRK_NOGET to Quanta 3003 too Ben Hutchings
` (177 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Wangzhao Cai
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wangzhao Cai <microcaicai@gmail.com>
commit 30c6fd4277ebab2a32ae5635d34283354b1bc8f2 upstream.
I am using a USB keyborad that give me "usb_submit_urb(ctrl) failed: -1" error
when I plugin it. and I need to wait for 10s for this device to be ready.
By adding this quirks, the usb keyborad is usable right after plugin
Signed-off-by: Wangzhao Cai <microcaicai@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -493,6 +493,7 @@
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A070 0xa070
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A072 0xa072
#define USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081 0xa081
+#define USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096 0xa096
#define USB_VENDOR_ID_IMATION 0x0718
#define USB_DEVICE_ID_DISC_STAKKA 0xd000
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -140,6 +140,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096, HID_QUIRK_NO_INIT_INPUT_REPORTS },
{ 0, 0 }
};
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 140/233] HID: add HID_QUIRK_NOGET to Quanta 3003 too
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (55 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 125/233] HID: add quirk for 0x04d9:0xa096 device Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 071/233] KVM: x86: zero base3 of unusable segments Ben Hutchings
` (176 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Jim lovell, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
commit 962b7a0e77015802f0ceefe6f0e3cad3f10fd4f8 upstream.
dmesg shows a lot of:
[ 1374.890348] hid-multitouch 0003:0408:3003.0007: usb_submit_urb(ctrl) failed: -1
[ 1384.916388] hid-multitouch 0003:0408:3003.0007: usb_submit_urb(ctrl) failed: -1
[ 1384.916432] hid-multitouch 0003:0408:3003.0007: timeout initializing reports
Add the quirk and make the touchscreen happy.
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Tested-by: Jim lovell <jimlovell777@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -772,6 +772,7 @@
#define USB_VENDOR_ID_QUANTA 0x0408
#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH 0x3000
#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001
+#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003
#define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
#define USB_VENDOR_ID_REALTEK 0x0bda
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -107,6 +107,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 071/233] KVM: x86: zero base3 of unusable segments
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (56 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 140/233] HID: add HID_QUIRK_NOGET to Quanta 3003 too Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 012/233] SMB2: Fix share type handling Ben Hutchings
` (175 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Paolo Bonzini, David Hildenbrand, Dan Carpenter,
Radim Krčmář
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Radim Krčmář <rkrcmar@redhat.com>
commit f0367ee1d64d27fa08be2407df5c125442e885e3 upstream.
Static checker noticed that base3 could be used uninitialized if the
segment was not present (useable). Random stack values probably would
not pass VMCS entry checks.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 1aa366163b8b ("KVM: x86 emulator: consolidate segment accessors")
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/x86.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4749,6 +4749,8 @@ static bool emulator_get_segment(struct
if (var.unusable) {
memset(desc, 0, sizeof(*desc));
+ if (base3)
+ *base3 = 0;
return false;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 012/233] SMB2: Fix share type handling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (57 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 071/233] KVM: x86: zero base3 of unusable segments Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 099/233] net: phy: fix marvell phy status reading Ben Hutchings
` (174 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Aurelien Aptel, Christophe JAILLET, Steve French
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit cd1230070ae1c12fd34cf6a557bfa81bf9311009 upstream.
In fs/cifs/smb2pdu.h, we have:
#define SMB2_SHARE_TYPE_DISK 0x01
#define SMB2_SHARE_TYPE_PIPE 0x02
#define SMB2_SHARE_TYPE_PRINT 0x03
Knowing that, with the current code, the SMB2_SHARE_TYPE_PRINT case can
never trigger and printer share would be interpreted as disk share.
So, test the ShareType value for equality instead.
Fixes: faaf946a7d5b ("CIFS: Add tree connect/disconnect capability for SMB2")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/smb2pdu.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -904,15 +904,19 @@ SMB2_tcon(const unsigned int xid, struct
goto tcon_exit;
}
- if (rsp->ShareType & SMB2_SHARE_TYPE_DISK)
+ switch (rsp->ShareType) {
+ case SMB2_SHARE_TYPE_DISK:
cifs_dbg(FYI, "connection to disk share\n");
- else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) {
+ break;
+ case SMB2_SHARE_TYPE_PIPE:
tcon->ipc = true;
cifs_dbg(FYI, "connection to pipe share\n");
- } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) {
- tcon->print = true;
+ break;
+ case SMB2_SHARE_TYPE_PRINT:
+ tcon->ipc = true;
cifs_dbg(FYI, "connection to printer\n");
- } else {
+ break;
+ default:
cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType);
rc = -EOPNOTSUPP;
goto tcon_error_exit;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 099/233] net: phy: fix marvell phy status reading
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (58 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 012/233] SMB2: Fix share type handling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 052/233] usb: chipidea: udc: fix NULL pointer dereference if udc_start failed Ben Hutchings
` (173 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Florian Fainelli, David S. Miller, Andrew Lunn, Russell King
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit 898805e0cdf7fd860ec21bf661d3a0285a3defbd upstream.
The Marvell driver incorrectly provides phydev->lp_advertising as the
logical and of the link partner's advert and our advert. This is
incorrect - this field is supposed to store the link parter's unmodified
advertisment.
This allows ethtool to report the correct link partner auto-negotiation
status.
Fixes: be937f1f89ca ("Marvell PHY m88e1111 driver fix")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/phy/marvell.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -726,8 +726,6 @@ static int marvell_read_status(struct ph
if (adv < 0)
return adv;
- lpa &= adv;
-
if (status & MII_M1011_PHY_STATUS_FULLDUPLEX)
phydev->duplex = DUPLEX_FULL;
else
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 052/233] usb: chipidea: udc: fix NULL pointer dereference if udc_start failed
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (59 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 099/233] net: phy: fix marvell phy status reading Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 010/233] tcp: avoid fragmenting peculiar skbs in SACK Ben Hutchings
` (172 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jisheng Zhang, Peter Chen
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <jszhang@marvell.com>
commit aa1f058d7d9244423b8c5a75b9484b1115df7f02 upstream.
Fix below NULL pointer dereference. we set ci->roles[CI_ROLE_GADGET]
too early in ci_hdrc_gadget_init(), if udc_start() fails due to some
reason, the ci->roles[CI_ROLE_GADGET] check in ci_hdrc_gadget_destroy
can't protect us.
We fix this issue by only setting ci->roles[CI_ROLE_GADGET] if
udc_start() succeed.
[ 1.398550] Unable to handle kernel NULL pointer dereference at
virtual address 00000000
...
[ 1.448600] PC is at dma_pool_free+0xb8/0xf0
[ 1.453012] LR is at dma_pool_free+0x28/0xf0
[ 2.113369] [<ffffff80081817d8>] dma_pool_free+0xb8/0xf0
[ 2.118857] [<ffffff800841209c>] destroy_eps+0x4c/0x68
[ 2.124165] [<ffffff8008413770>] ci_hdrc_gadget_destroy+0x28/0x50
[ 2.130461] [<ffffff800840fa30>] ci_hdrc_probe+0x588/0x7e8
[ 2.136129] [<ffffff8008380fb8>] platform_drv_probe+0x50/0xb8
[ 2.142066] [<ffffff800837f494>] driver_probe_device+0x1fc/0x2a8
[ 2.148270] [<ffffff800837f68c>] __device_attach_driver+0x9c/0xf8
[ 2.154563] [<ffffff800837d570>] bus_for_each_drv+0x58/0x98
[ 2.160317] [<ffffff800837f174>] __device_attach+0xc4/0x138
[ 2.166072] [<ffffff800837f738>] device_initial_probe+0x10/0x18
[ 2.172185] [<ffffff800837e58c>] bus_probe_device+0x94/0xa0
[ 2.177940] [<ffffff800837c560>] device_add+0x3f0/0x560
[ 2.183337] [<ffffff8008380d20>] platform_device_add+0x180/0x240
[ 2.189541] [<ffffff800840f0e8>] ci_hdrc_add_device+0x440/0x4f8
[ 2.195654] [<ffffff8008414194>] ci_hdrc_usb2_probe+0x13c/0x2d8
[ 2.201769] [<ffffff8008380fb8>] platform_drv_probe+0x50/0xb8
[ 2.207705] [<ffffff800837f494>] driver_probe_device+0x1fc/0x2a8
[ 2.213910] [<ffffff800837f5ec>] __driver_attach+0xac/0xb0
[ 2.219575] [<ffffff800837d4b0>] bus_for_each_dev+0x60/0xa0
[ 2.225329] [<ffffff800837ec80>] driver_attach+0x20/0x28
[ 2.230816] [<ffffff800837e880>] bus_add_driver+0x1d0/0x238
[ 2.236571] [<ffffff800837fdb0>] driver_register+0x60/0xf8
[ 2.242237] [<ffffff8008380ef4>] __platform_driver_register+0x44/0x50
[ 2.248891] [<ffffff80086fd440>] ci_hdrc_usb2_driver_init+0x18/0x20
[ 2.255365] [<ffffff8008082950>] do_one_initcall+0x38/0x128
[ 2.261121] [<ffffff80086e0d00>] kernel_init_freeable+0x1ac/0x250
[ 2.267414] [<ffffff800852f0b8>] kernel_init+0x10/0x100
[ 2.272810] [<ffffff8008082680>] ret_from_fork+0x10/0x50
Fixes: 3f124d233e97 ("usb: chipidea: add role init and destroy APIs")
Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/chipidea/udc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/chipidea/udc.c
+++ b/drivers/usb/chipidea/udc.c
@@ -1892,6 +1892,7 @@ static void udc_id_switch_for_host(struc
int ci_hdrc_gadget_init(struct ci_hdrc *ci)
{
struct ci_role_driver *rdrv;
+ int ret;
if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC))
return -ENXIO;
@@ -1904,7 +1905,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *
rdrv->stop = udc_id_switch_for_host;
rdrv->irq = udc_irq;
rdrv->name = "gadget";
- ci->roles[CI_ROLE_GADGET] = rdrv;
- return udc_start(ci);
+ ret = udc_start(ci);
+ if (!ret)
+ ci->roles[CI_ROLE_GADGET] = rdrv;
+
+ return ret;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 010/233] tcp: avoid fragmenting peculiar skbs in SACK
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (60 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 052/233] usb: chipidea: udc: fix NULL pointer dereference if udc_start failed Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 128/233] HID: usbhid: more mice with ALWAYS_POLL Ben Hutchings
` (171 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Neal Cardwell, Yuchung Cheng, Eric Dumazet,
Soheil Hassas Yeganeh, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yuchung Cheng <ycheng@google.com>
commit b451e5d24ba6687c6f0e7319c727a709a1846c06 upstream.
This patch fixes a bug in splitting an SKB during SACK
processing. Specifically if an skb contains multiple
packets and is only partially sacked in the higher sequences,
tcp_match_sack_to_skb() splits the skb and marks the second fragment
as SACKed.
The current code further attempts rounding up the first fragment
to MSS boundaries. But it misses a boundary condition when the
rounded-up fragment size (pkt_len) is exactly skb size. Spliting
such an skb is pointless and causses a kernel warning and aborts
the SACK processing. This patch universally checks such over-split
before calling tcp_fragment to prevent these unnecessary warnings.
Fixes: adb92db857ee ("tcp: Make SACK code to split only at mss boundaries")
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/tcp_input.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1160,13 +1160,14 @@ static int tcp_match_skb_to_sack(struct
*/
if (pkt_len > mss) {
unsigned int new_len = (pkt_len / mss) * mss;
- if (!in_sack && new_len < pkt_len) {
+ if (!in_sack && new_len < pkt_len)
new_len += mss;
- if (new_len >= skb->len)
- return 0;
- }
pkt_len = new_len;
}
+
+ if (pkt_len >= skb->len && !in_sack)
+ return 0;
+
err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC);
if (err < 0)
return err;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 128/233] HID: usbhid: more mice with ALWAYS_POLL
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (61 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 010/233] tcp: avoid fragmenting peculiar skbs in SACK Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 059/233] usb: musb: tusb6010_omap: Do not reset the other direction's packet size Ben Hutchings
` (170 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Oliver Neukum
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.de>
commit 003e817a9ecf6cfded59630858bbf04056d71e9a upstream.
During a stress test these mice kept dropping and reappearing
in runlevel 1 as opposed to 5.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 4 ++++
drivers/hid/usbhid/hid-quirks.c | 4 ++++
2 files changed, 8 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -589,6 +589,9 @@
#define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST 0xc110
#define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
#define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
+#define USB_DEVICE_ID_LOGITECH_MOUSE_C01A 0xc01a
+#define USB_DEVICE_ID_LOGITECH_MOUSE_C05A 0xc05a
+#define USB_DEVICE_ID_LOGITECH_MOUSE_C06A 0xc06a
#define USB_DEVICE_ID_LOGITECH_RUMBLEPAD_CORD 0xc20a
#define USB_DEVICE_ID_LOGITECH_RUMBLEPAD 0xc211
#define USB_DEVICE_ID_LOGITECH_EXTREME_3D 0xc215
@@ -1004,6 +1007,7 @@
#define USB_DEVICE_ID_ZYTRONIC_ZXY100 0x0005
#define USB_VENDOR_ID_PRIMAX 0x0461
+#define USB_DEVICE_ID_PRIMAX_MOUSE_4D22 0x4d22
#define USB_DEVICE_ID_PRIMAX_KEYBOARD 0x4e05
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -84,6 +84,9 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
@@ -97,6 +100,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PRIMAX, USB_DEVICE_ID_PRIMAX_MOUSE_4D22, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 059/233] usb: musb: tusb6010_omap: Do not reset the other direction's packet size
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (62 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 128/233] HID: usbhid: more mice with ALWAYS_POLL Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 102/233] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Ben Hutchings
` (169 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Bin Liu, Tony Lindgren, Greg Kroah-Hartman, Peter Ujfalusi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit 6df2b42f7c040d57d9ecb67244e04e905ab87ac6 upstream.
We have one register for each EP to set the maximum packet size for both
TX and RX.
If for example an RX programming would happen before the previous TX
transfer finishes we would reset the TX packet side.
To fix this issue, only modify the TX or RX part of the register.
Fixes: 550a7375fe72 ("USB: Add MUSB and TUSB support")
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/musb/tusb6010_omap.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -220,6 +220,7 @@ static int tusb_omap_dma_program(struct
u32 dma_remaining;
int src_burst, dst_burst;
u16 csr;
+ u32 psize;
int ch;
s8 dmareq;
s8 sync_dev;
@@ -391,15 +392,19 @@ static int tusb_omap_dma_program(struct
if (chdat->tx) {
/* Send transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~0x7ff;
+ psize |= chdat->transfer_packet_sz;
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_TX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
} else {
/* Receive transfer_packet_sz packets at a time */
- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET,
- chdat->transfer_packet_sz << 16);
+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET);
+ psize &= ~(0x7ff << 16);
+ psize |= (chdat->transfer_packet_sz << 16);
+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize);
musb_writel(ep_conf, TUSB_EP_RX_OFFSET,
TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len));
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 102/233] iscsi-target: Fix initial login PDU asynchronous socket close OOPs
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (63 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 059/233] usb: musb: tusb6010_omap: Do not reset the other direction's packet size Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 070/233] KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation Ben Hutchings
` (168 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Sagi Grimberg, Hannes Reinecke, Nicholas Bellinger,
Varun Prakash, Mike Christie
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 25cdda95fda78d22d44157da15aa7ea34be3c804 upstream.
This patch fixes a OOPs originally introduced by:
commit bb048357dad6d604520c91586334c9c230366a14
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date: Thu Sep 5 14:54:04 2013 -0700
iscsi-target: Add sk->sk_state_change to cleanup after TCP failure
which would trigger a NULL pointer dereference when a TCP connection
was closed asynchronously via iscsi_target_sk_state_change(), but only
when the initial PDU processing in iscsi_target_do_login() from iscsi_np
process context was blocked waiting for backend I/O to complete.
To address this issue, this patch makes the following changes.
First, it introduces some common helper functions used for checking
socket closing state, checking login_flags, and atomically checking
socket closing state + setting login_flags.
Second, it introduces a LOGIN_FLAGS_INITIAL_PDU bit to know when a TCP
connection has dropped via iscsi_target_sk_state_change(), but the
initial PDU processing within iscsi_target_do_login() in iscsi_np
context is still running. For this case, it sets LOGIN_FLAGS_CLOSED,
but doesn't invoke schedule_delayed_work().
The original NULL pointer dereference case reported by MNC is now handled
by iscsi_target_do_login() doing a iscsi_target_sk_check_close() before
transitioning to FFP to determine when the socket has already closed,
or iscsi_target_start_negotiation() if the login needs to exchange
more PDUs (eg: iscsi_target_do_login returned 0) but the socket has
closed. For both of these cases, the cleanup up of remaining connection
resources will occur in iscsi_target_start_negotiation() from iscsi_np
process context once the failure is detected.
Finally, to handle to case where iscsi_target_sk_state_change() is
called after the initial PDU procesing is complete, it now invokes
conn->login_work -> iscsi_target_do_login_rx() to perform cleanup once
existing iscsi_target_sk_check_close() checks detect connection failure.
For this case, the cleanup of remaining connection resources will occur
in iscsi_target_do_login_rx() from delayed workqueue process context
once the failure is detected.
Reported-by: Mike Christie <mchristi@redhat.com>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Tested-by: Mike Christie <mchristi@redhat.com>
Cc: Mike Christie <mchristi@redhat.com>
Reported-by: Hannes Reinecke <hare@suse.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Sagi Grimberg <sagi@grimberg.me>
Cc: Varun Prakash <varun@chelsio.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/iscsi/iscsi_target_nego.c | 194 +++++++++++++++++++++----------
drivers/target/iscsi/iscsi_target_core.h | 1 +
2 files changed, 133 insertions(+), 62 deletions(-)
--- a/drivers/target/iscsi/iscsi_target_nego.c
+++ b/drivers/target/iscsi/iscsi_target_nego.c
@@ -494,14 +494,60 @@ static void iscsi_target_restore_sock_ca
static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *);
-static bool iscsi_target_sk_state_check(struct sock *sk)
+static bool __iscsi_target_sk_check_close(struct sock *sk)
{
if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) {
- pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE,"
+ pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE,"
"returning FALSE\n");
- return false;
+ return true;
}
- return true;
+ return false;
+}
+
+static bool iscsi_target_sk_check_close(struct iscsi_conn *conn)
+{
+ bool state = false;
+
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
+
+ read_lock_bh(&sk->sk_callback_lock);
+ state = (__iscsi_target_sk_check_close(sk) ||
+ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+ read_unlock_bh(&sk->sk_callback_lock);
+ }
+ return state;
+}
+
+static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag)
+{
+ bool state = false;
+
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
+
+ read_lock_bh(&sk->sk_callback_lock);
+ state = test_bit(flag, &conn->login_flags);
+ read_unlock_bh(&sk->sk_callback_lock);
+ }
+ return state;
+}
+
+static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag)
+{
+ bool state = false;
+
+ if (conn->sock) {
+ struct sock *sk = conn->sock->sk;
+
+ write_lock_bh(&sk->sk_callback_lock);
+ state = (__iscsi_target_sk_check_close(sk) ||
+ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags));
+ if (!state)
+ clear_bit(flag, &conn->login_flags);
+ write_unlock_bh(&sk->sk_callback_lock);
+ }
+ return state;
}
static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login)
@@ -541,6 +587,20 @@ static void iscsi_target_do_login_rx(str
pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n",
conn, current->comm, current->pid);
+ /*
+ * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready()
+ * before initial PDU processing in iscsi_target_start_negotiation()
+ * has completed, go ahead and retry until it's cleared.
+ *
+ * Otherwise if the TCP connection drops while this is occuring,
+ * iscsi_target_start_negotiation() will detect the failure, call
+ * cancel_delayed_work_sync(&conn->login_work), and cleanup the
+ * remaining iscsi connection resources from iscsi_np process context.
+ */
+ if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) {
+ schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10));
+ return;
+ }
spin_lock(&tpg->tpg_state_lock);
state = (tpg->tpg_state == TPG_STATE_ACTIVE);
@@ -548,26 +608,12 @@ static void iscsi_target_do_login_rx(str
if (!state) {
pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n");
- iscsi_target_restore_sock_callbacks(conn);
- iscsi_target_login_drop(conn, login);
- iscsit_deaccess_np(np, tpg, tpg_np);
- return;
+ goto err;
}
- if (conn->sock) {
- struct sock *sk = conn->sock->sk;
-
- read_lock_bh(&sk->sk_callback_lock);
- state = iscsi_target_sk_state_check(sk);
- read_unlock_bh(&sk->sk_callback_lock);
-
- if (!state) {
- pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
- iscsi_target_restore_sock_callbacks(conn);
- iscsi_target_login_drop(conn, login);
- iscsit_deaccess_np(np, tpg, tpg_np);
- return;
- }
+ if (iscsi_target_sk_check_close(conn)) {
+ pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n");
+ goto err;
}
conn->login_kworker = current;
@@ -585,34 +631,29 @@ static void iscsi_target_do_login_rx(str
flush_signals(current);
conn->login_kworker = NULL;
- if (rc < 0) {
- iscsi_target_restore_sock_callbacks(conn);
- iscsi_target_login_drop(conn, login);
- iscsit_deaccess_np(np, tpg, tpg_np);
- return;
- }
+ if (rc < 0)
+ goto err;
pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n",
conn, current->comm, current->pid);
rc = iscsi_target_do_login(conn, login);
if (rc < 0) {
- iscsi_target_restore_sock_callbacks(conn);
- iscsi_target_login_drop(conn, login);
- iscsit_deaccess_np(np, tpg, tpg_np);
+ goto err;
} else if (!rc) {
- if (conn->sock) {
- struct sock *sk = conn->sock->sk;
-
- write_lock_bh(&sk->sk_callback_lock);
- clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags);
- write_unlock_bh(&sk->sk_callback_lock);
- }
+ if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE))
+ goto err;
} else if (rc == 1) {
iscsi_target_nego_release(conn);
iscsi_post_login_handler(np, conn, zero_tsih);
iscsit_deaccess_np(np, tpg, tpg_np);
}
+ return;
+
+err:
+ iscsi_target_restore_sock_callbacks(conn);
+ iscsi_target_login_drop(conn, login);
+ iscsit_deaccess_np(np, tpg, tpg_np);
}
static void iscsi_target_do_cleanup(struct work_struct *work)
@@ -660,31 +701,54 @@ static void iscsi_target_sk_state_change
orig_state_change(sk);
return;
}
+ state = __iscsi_target_sk_check_close(sk);
+ pr_debug("__iscsi_target_sk_close_change: state: %d\n", state);
+
if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) {
pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change"
" conn: %p\n", conn);
+ if (state)
+ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
write_unlock_bh(&sk->sk_callback_lock);
orig_state_change(sk);
return;
}
- if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
+ if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) {
pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n",
conn);
write_unlock_bh(&sk->sk_callback_lock);
orig_state_change(sk);
return;
}
+ /*
+ * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED,
+ * but only queue conn->login_work -> iscsi_target_do_login_rx()
+ * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared.
+ *
+ * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close()
+ * will detect the dropped TCP connection from delayed workqueue context.
+ *
+ * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial
+ * iscsi_target_start_negotiation() is running, iscsi_target_do_login()
+ * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation()
+ * via iscsi_target_sk_check_and_clear() is responsible for detecting the
+ * dropped TCP connection in iscsi_np process context, and cleaning up
+ * the remaining iscsi connection resources.
+ */
+ if (state) {
+ pr_debug("iscsi_target_sk_state_change got failed state\n");
+ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags);
+ state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
+ write_unlock_bh(&sk->sk_callback_lock);
- state = iscsi_target_sk_state_check(sk);
- write_unlock_bh(&sk->sk_callback_lock);
-
- pr_debug("iscsi_target_sk_state_change: state: %d\n", state);
+ orig_state_change(sk);
- if (!state) {
- pr_debug("iscsi_target_sk_state_change got failed state\n");
- schedule_delayed_work(&conn->login_cleanup_work, 0);
+ if (!state)
+ schedule_delayed_work(&conn->login_work, 0);
return;
}
+ write_unlock_bh(&sk->sk_callback_lock);
+
orig_state_change(sk);
}
@@ -947,6 +1011,15 @@ static int iscsi_target_do_login(struct
if (iscsi_target_handle_csg_one(conn, login) < 0)
return -1;
if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) {
+ /*
+ * Check to make sure the TCP connection has not
+ * dropped asynchronously while session reinstatement
+ * was occuring in this kthread context, before
+ * transitioning to full feature phase operation.
+ */
+ if (iscsi_target_sk_check_close(conn))
+ return -1;
+
login->tsih = conn->sess->tsih;
login->login_complete = 1;
iscsi_target_restore_sock_callbacks(conn);
@@ -973,21 +1046,6 @@ static int iscsi_target_do_login(struct
break;
}
- if (conn->sock) {
- struct sock *sk = conn->sock->sk;
- bool state;
-
- read_lock_bh(&sk->sk_callback_lock);
- state = iscsi_target_sk_state_check(sk);
- read_unlock_bh(&sk->sk_callback_lock);
-
- if (!state) {
- pr_debug("iscsi_target_do_login() failed state for"
- " conn: %p\n", conn);
- return -1;
- }
- }
-
return 0;
}
@@ -1256,10 +1314,22 @@ int iscsi_target_start_negotiation(
write_lock_bh(&sk->sk_callback_lock);
set_bit(LOGIN_FLAGS_READY, &conn->login_flags);
+ set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags);
write_unlock_bh(&sk->sk_callback_lock);
}
-
+ /*
+ * If iscsi_target_do_login returns zero to signal more PDU
+ * exchanges are required to complete the login, go ahead and
+ * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection
+ * is still active.
+ *
+ * Otherwise if TCP connection dropped asynchronously, go ahead
+ * and perform connection cleanup now.
+ */
ret = iscsi_target_do_login(conn, login);
+ if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU))
+ ret = -1;
+
if (ret < 0) {
cancel_delayed_work_sync(&conn->login_work);
cancel_delayed_work_sync(&conn->login_cleanup_work);
--- a/drivers/target/iscsi/iscsi_target_core.h
+++ b/drivers/target/iscsi/iscsi_target_core.h
@@ -562,6 +562,7 @@ struct iscsi_conn {
#define LOGIN_FLAGS_READ_ACTIVE 1
#define LOGIN_FLAGS_CLOSED 2
#define LOGIN_FLAGS_READY 4
+#define LOGIN_FLAGS_INITIAL_PDU 8
unsigned long login_flags;
struct delayed_work login_work;
struct delayed_work login_cleanup_work;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 070/233] KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (64 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 102/233] iscsi-target: Fix initial login PDU asynchronous socket close OOPs Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 014/233] pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() Ben Hutchings
` (167 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Paolo Bonzini, Moguofang, Wanpeng Li, Radim Krčmář
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit cbfc6c9184ce71b52df4b1d82af5afc81a709178 upstream.
Huawei folks reported a read out-of-bounds vulnerability in kvm pio emulation.
- "inb" instruction to access PIT Mod/Command register (ioport 0x43, write only,
a read should be ignored) in guest can get a random number.
- "rep insb" instruction to access PIT register port 0x43 can control memcpy()
in emulator_pio_in_emulated() to copy max 0x400 bytes but only read 1 bytes,
which will disclose the unimportant kernel memory in host but no crash.
The similar test program below can reproduce the read out-of-bounds vulnerability:
void hexdump(void *mem, unsigned int len)
{
unsigned int i, j;
for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
{
/* print offset */
if(i % HEXDUMP_COLS == 0)
{
printf("0x%06x: ", i);
}
/* print hex data */
if(i < len)
{
printf("%02x ", 0xFF & ((char*)mem)[i]);
}
else /* end of block, just aligning for ASCII dump */
{
printf(" ");
}
/* print ASCII dump */
if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1))
{
for(j = i - (HEXDUMP_COLS - 1); j <= i; j++)
{
if(j >= len) /* end of block, not really printing */
{
putchar(' ');
}
else if(isprint(((char*)mem)[j])) /* printable char */
{
putchar(0xFF & ((char*)mem)[j]);
}
else /* other char */
{
putchar('.');
}
}
putchar('\n');
}
}
}
int main(void)
{
int i;
if (iopl(3))
{
err(1, "set iopl unsuccessfully\n");
return -1;
}
static char buf[0x40];
/* test ioport 0x40,0x41,0x42,0x43,0x44,0x45 */
memset(buf, 0xab, sizeof(buf));
asm volatile("push %rdi;");
asm volatile("mov %0, %%rdi;"::"q"(buf));
asm volatile ("mov $0x40, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("mov $0x41, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("mov $0x42, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("mov $0x43, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("mov $0x44, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("mov $0x45, %rdx;");
asm volatile ("in %dx,%al;");
asm volatile ("stosb;");
asm volatile ("pop %rdi;");
hexdump(buf, 0x40);
printf("\n");
/* ins port 0x40 */
memset(buf, 0xab, sizeof(buf));
asm volatile("push %rdi;");
asm volatile("mov %0, %%rdi;"::"q"(buf));
asm volatile ("mov $0x20, %rcx;");
asm volatile ("mov $0x40, %rdx;");
asm volatile ("rep insb;");
asm volatile ("pop %rdi;");
hexdump(buf, 0x40);
printf("\n");
/* ins port 0x43 */
memset(buf, 0xab, sizeof(buf));
asm volatile("push %rdi;");
asm volatile("mov %0, %%rdi;"::"q"(buf));
asm volatile ("mov $0x20, %rcx;");
asm volatile ("mov $0x43, %rdx;");
asm volatile ("rep insb;");
asm volatile ("pop %rdi;");
hexdump(buf, 0x40);
printf("\n");
return 0;
}
The vcpu->arch.pio_data buffer is used by both in/out instrutions emulation
w/o clear after using which results in some random datas are left over in
the buffer. Guest reads port 0x43 will be ignored since it is write only,
however, the function kernel_pio() can't distigush this ignore from successfully
reads data from device's ioport. There is no new data fill the buffer from
port 0x43, however, emulator_pio_in_emulated() will copy the stale data in
the buffer to the guest unconditionally. This patch fixes it by clearing the
buffer before in instruction emulation to avoid to grant guest the stale data
in the buffer.
In addition, string I/O is not supported for in kernel device. So there is no
iteration to read ioport %RCX times for string I/O. The function kernel_pio()
just reads one round, and then copy the io size * %RCX to the guest unconditionally,
actually it copies the one round ioport data w/ other random datas which are left
over in the vcpu->arch.pio_data buffer to the guest. This patch fixes it by
introducing the string I/O support for in kernel device in order to grant the right
ioport datas to the guest.
Before the patch:
0x000000: fe 38 93 93 ff ff ab ab .8......
0x000008: ab ab ab ab ab ab ab ab ........
0x000010: ab ab ab ab ab ab ab ab ........
0x000018: ab ab ab ab ab ab ab ab ........
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
0x000000: f6 00 00 00 00 00 00 00 ........
0x000008: 00 00 00 00 00 00 00 00 ........
0x000010: 00 00 00 00 4d 51 30 30 ....MQ00
0x000018: 30 30 20 33 20 20 20 20 00 3
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
0x000000: f6 00 00 00 00 00 00 00 ........
0x000008: 00 00 00 00 00 00 00 00 ........
0x000010: 00 00 00 00 4d 51 30 30 ....MQ00
0x000018: 30 30 20 33 20 20 20 20 00 3
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
After the patch:
0x000000: 1e 02 f8 00 ff ff ab ab ........
0x000008: ab ab ab ab ab ab ab ab ........
0x000010: ab ab ab ab ab ab ab ab ........
0x000018: ab ab ab ab ab ab ab ab ........
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
0x000000: d2 e2 d2 df d2 db d2 d7 ........
0x000008: d2 d3 d2 cf d2 cb d2 c7 ........
0x000010: d2 c4 d2 c0 d2 bc d2 b8 ........
0x000018: d2 b4 d2 b0 d2 ac d2 a8 ........
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
0x000000: 00 00 00 00 00 00 00 00 ........
0x000008: 00 00 00 00 00 00 00 00 ........
0x000010: 00 00 00 00 00 00 00 00 ........
0x000018: 00 00 00 00 00 00 00 00 ........
0x000020: ab ab ab ab ab ab ab ab ........
0x000028: ab ab ab ab ab ab ab ab ........
0x000030: ab ab ab ab ab ab ab ab ........
0x000038: ab ab ab ab ab ab ab ab ........
Reported-by: Moguofang <moguofang@huawei.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Moguofang <moguofang@huawei.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/x86.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4523,16 +4523,20 @@ emul_write:
static int kernel_pio(struct kvm_vcpu *vcpu, void *pd)
{
- /* TODO: String I/O for in kernel device */
- int r;
+ int r = 0, i;
- if (vcpu->arch.pio.in)
- r = kvm_io_bus_read(vcpu->kvm, KVM_PIO_BUS, vcpu->arch.pio.port,
- vcpu->arch.pio.size, pd);
- else
- r = kvm_io_bus_write(vcpu->kvm, KVM_PIO_BUS,
- vcpu->arch.pio.port, vcpu->arch.pio.size,
- pd);
+ for (i = 0; i < vcpu->arch.pio.count; i++) {
+ if (vcpu->arch.pio.in)
+ r = kvm_io_bus_read(vcpu->kvm, KVM_PIO_BUS, vcpu->arch.pio.port,
+ vcpu->arch.pio.size, pd);
+ else
+ r = kvm_io_bus_write(vcpu->kvm, KVM_PIO_BUS,
+ vcpu->arch.pio.port, vcpu->arch.pio.size,
+ pd);
+ if (r)
+ break;
+ pd += vcpu->arch.pio.size;
+ }
return r;
}
@@ -4570,6 +4574,8 @@ static int emulator_pio_in_emulated(stru
if (vcpu->arch.pio.count)
goto data_avail;
+ memset(vcpu->arch.pio_data, 0, size * count);
+
ret = emulator_pio_in_out(vcpu, size, port, val, count, true);
if (ret) {
data_avail:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 014/233] pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (65 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 070/233] KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 134/233] HID: microsoft: Add Surface 3 type cover Ben Hutchings
` (166 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Oleg Nesterov, Michal Hocko, Ingo Molnar,
Eric W. Biederman, Peter Zijlstra, Kirill Tkhai, Andrei Vagin,
Serge Hallyn, Andy Lutomirski, Cyrill Gorcunov, Mike Rapoport
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <ktkhai@virtuozzo.com>
commit 3fd37226216620c1a468afa999739d5016fbc349 upstream.
Imagine we have a pid namespace and a task from its parent's pid_ns,
which made setns() to the pid namespace. The task is doing fork(),
while the pid namespace's child reaper is dying. We have the race
between them:
Task from parent pid_ns Child reaper
copy_process() ..
alloc_pid() ..
.. zap_pid_ns_processes()
.. disable_pid_allocation()
.. read_lock(&tasklist_lock)
.. iterate over pids in pid_ns
.. kill tasks linked to pids
.. read_unlock(&tasklist_lock)
write_lock_irq(&tasklist_lock); ..
attach_pid(p, PIDTYPE_PID); ..
.. ..
So, just created task p won't receive SIGKILL signal,
and the pid namespace will be in contradictory state.
Only manual kill will help there, but does the userspace
care about this? I suppose, the most users just inject
a task into a pid namespace and wait a SIGCHLD from it.
The patch fixes the problem. It simply checks for
(pid_ns->nr_hashed & PIDNS_HASH_ADDING) in copy_process().
We do it under the tasklist_lock, and can't skip
PIDNS_HASH_ADDING as noted by Oleg:
"zap_pid_ns_processes() does disable_pid_allocation()
and then takes tasklist_lock to kill the whole namespace.
Given that copy_process() checks PIDNS_HASH_ADDING
under write_lock(tasklist) they can't race;
if copy_process() takes this lock first, the new child will
be killed, otherwise copy_process() can't miss
the change in ->nr_hashed."
If allocation is disabled, we just return -ENOMEM
like it's made for such cases in alloc_pid().
v2: Do not move disable_pid_allocation(), do not
introduce a new variable in copy_process() and simplify
the patch as suggested by Oleg Nesterov.
Account the problem with double irq enabling
found by Eric W. Biederman.
Fixes: c876ad768215 ("pidns: Stop pid allocation when init dies")
Signed-off-by: Kirill Tkhai <ktkhai@virtuozzo.com>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Ingo Molnar <mingo@kernel.org>
CC: Peter Zijlstra <peterz@infradead.org>
CC: Oleg Nesterov <oleg@redhat.com>
CC: Mike Rapoport <rppt@linux.vnet.ibm.com>
CC: Michal Hocko <mhocko@suse.com>
CC: Andy Lutomirski <luto@kernel.org>
CC: "Eric W. Biederman" <ebiederm@xmission.com>
CC: Andrei Vagin <avagin@openvz.org>
CC: Cyrill Gorcunov <gorcunov@openvz.org>
CC: Serge Hallyn <serge@hallyn.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
[bwh: Backported to 3.16: the proper cleanup label is bad_fork_free_pid, not
bad_fork_cancel_cgroup]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/fork.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1444,11 +1444,13 @@ static struct task_struct *copy_process(
*/
recalc_sigpending();
if (signal_pending(current)) {
- spin_unlock(¤t->sighand->siglock);
- write_unlock_irq(&tasklist_lock);
retval = -ERESTARTNOINTR;
goto bad_fork_free_pid;
}
+ if (unlikely(!(ns_of_pid(pid)->nr_hashed & PIDNS_HASH_ADDING))) {
+ retval = -ENOMEM;
+ goto bad_fork_free_pid;
+ }
if (likely(p->pid)) {
ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
@@ -1500,6 +1502,8 @@ static struct task_struct *copy_process(
return p;
bad_fork_free_pid:
+ spin_unlock(¤t->sighand->siglock);
+ write_unlock_irq(&tasklist_lock);
if (pid != &init_struct_pid)
free_pid(pid);
bad_fork_cleanup_io:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 134/233] HID: microsoft: Add Surface 3 type cover
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (66 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 014/233] pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 020/233] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD Ben Hutchings
` (165 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Stephen Just, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Just <stephenjust@gmail.com>
commit 0439de75d32c249bd9f5824ffd5e40c4c2109d77 upstream.
Adding support for the Microsoft Surface 3 (non-pro) Type Cover.
The existing definitions and quirks are actually for the Surface
Pro 3 type covers. I've renamed the old constants to reflect that
they belong to the Surface Pro 3, and added a new constant and
matching code for the Surface 3.
Signed-off-by: Stephen Just <stephenjust@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 8 +++++---
drivers/hid/hid-ids.h | 5 +++--
drivers/hid/hid-microsoft.c | 6 ++++--
drivers/hid/usbhid/hid-quirks.c | 3 ++-
4 files changed, 14 insertions(+), 8 deletions(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -704,8 +704,9 @@ static void hid_scan_collection(struct h
hid->group = HID_GROUP_SENSOR_HUB;
if (hid->vendor == USB_VENDOR_ID_MICROSOFT &&
- (hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
- hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3_JP ||
+ (hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
hid->group == HID_GROUP_MULTITOUCH)
hid->group = HID_GROUP_GENERIC;
@@ -1858,8 +1859,9 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
{ HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -661,8 +661,9 @@
#define USB_DEVICE_ID_MS_SURFACE_PRO_2 0x0799
#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7
#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9
-#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07dc
-#define USB_DEVICE_ID_MS_TYPE_COVER_3_JP 0x07dd
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 0x07dc
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd
+#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07de
#define USB_DEVICE_ID_MS_POWER_COVER 0x07da
#define USB_VENDOR_ID_MOJO 0x8282
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -276,9 +276,11 @@ static const struct hid_device_id ms_dev
.driver_data = MS_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
.driver_data = MS_DUPLICATE_USAGES },
- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3),
+ .driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP),
.driver_data = MS_HIDINPUT },
- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP),
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER),
.driver_data = MS_HIDINPUT },
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -91,8 +91,9 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 020/233] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (67 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 134/233] HID: microsoft: Add Surface 3 type cover Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 030/233] usb: dwc3: gadget: Prevent losing events in event cache Ben Hutchings
` (164 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Malcolm Priestley
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.
EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl
will return invalid data so use rtl92e_readw.
The device is unable to select the right eeprom type.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: use read_nic_word()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -628,7 +628,7 @@ void rtl8192_get_eeprom_size(struct net_
struct r8192_priv *priv = rtllib_priv(dev);
RT_TRACE(COMP_INIT, "===========>%s()\n", __func__);
- curCR = read_nic_dword(dev, EPROM_CMD);
+ curCR = read_nic_word(dev, EPROM_CMD);
RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD,
curCR);
priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 030/233] usb: dwc3: gadget: Prevent losing events in event cache
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (68 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 020/233] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 082/233] block: fix an error code in add_partition() Ben Hutchings
` (163 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Felipe Balbi, Thinh Nguyen, Thinh Nguyen
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit d325a1de49d61ee11aca58a529571c91ecea7879 upstream.
The dwc3 driver can overwite its previous events if its top-half IRQ
handler (TH) gets invoked again before processing the events in the
cache. We see this as a hang in the file transfer and the host will
attempt to reset the device. TH gets the event count and deasserts the
interrupt line by writing DWC3_GEVNTSIZ_INTMASK to DWC3_GEVNTSIZ. If
there's a new event coming between reading the event count and interrupt
deassertion, dwc3 will lose previous pending events. More generally, we
will see 0 event count, which should not affect anything.
This shouldn't be possible in the current dwc3 implementation. However,
through testing and reading the PCIe trace, the TH occasionally still
gets invoked one more time after HW interrupt deassertion. (With PCIe
legacy interrupts, TH is called repeatedly as long as the interrupt line
is asserted). We suspect that there is a small detection delay in the
SW.
To avoid this issue, Check DWC3_EVENT_PENDING flag to determine if the
events are processed in the bottom-half IRQ handler. If not, return
IRQ_HANDLED and don't process new event.
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/dwc3/gadget.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -2761,6 +2761,15 @@ static irqreturn_t dwc3_check_event_buf(
evt = dwc->ev_buffs[buf];
+ /*
+ * With PCIe legacy interrupt, test shows that top-half irq handler can
+ * be called again after HW interrupt deassertion. Check if bottom-half
+ * irq event handler completes before caching new event to prevent
+ * losing events.
+ */
+ if (evt->flags & DWC3_EVENT_PENDING)
+ return IRQ_HANDLED;
+
count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(buf));
count &= DWC3_GEVNTCOUNT_MASK;
if (!count)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 082/233] block: fix an error code in add_partition()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (69 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 030/233] usb: dwc3: gadget: Prevent losing events in event cache Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 017/233] USB: serial: ftdi_sio: fix setting latency for unprivileged users Ben Hutchings
` (162 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jens Axboe, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 7bd897cfce1eb373892d35d7f73201b0f9b221c4 upstream.
We don't set an error code on this path. It means that we return NULL
instead of an error pointer and the caller does a NULL dereference.
Fixes: 6d1d8050b4bc ("block, partition: add partition_meta_info to hd_struct")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
block/partition-generic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -309,8 +309,10 @@ struct hd_struct *add_partition(struct g
if (info) {
struct partition_meta_info *pinfo = alloc_part_info(disk);
- if (!pinfo)
+ if (!pinfo) {
+ err = -ENOMEM;
goto out_free_stats;
+ }
memcpy(pinfo, info, sizeof(*info));
p->info = pinfo;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 017/233] USB: serial: ftdi_sio: fix setting latency for unprivileged users
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (70 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 082/233] block: fix an error code in add_partition() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 023/233] USB: serial: io_ti: fix div-by-zero in set_termios Ben Hutchings
` (161 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Anthony Mallet
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Mallet <anthony.mallet@laas.fr>
commit bb246681b3ed0967489a7401ad528c1aaa1a4c2e upstream.
Commit 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY
flag") enables unprivileged users to set the FTDI latency timer,
but there was a logic flaw that skipped sending the corresponding
USB control message to the device.
Specifically, the device latency timer would not be updated until next
open, something which was later also inadvertently broken by commit
c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port
probe").
A recent commit c6dce2626606 ("USB: serial: ftdi_sio: fix extreme
low-latency setting") disabled the low-latency mode by default so we now
need this fix to allow unprivileged users to again enable it.
Signed-off-by: Anthony Mallet <anthony.mallet@laas.fr>
[johan: amend commit message]
Fixes: 557aaa7ffab6 ("ft232: support the ASYNC_LOW_LATENCY flag")
Fixes: c19db4c9e49a ("USB: ftdi_sio: set device latency timeout at port probe").
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/ftdi_sio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1521,9 +1521,9 @@ static int set_serial_info(struct tty_st
(new_serial.flags & ASYNC_FLAGS));
priv->custom_divisor = new_serial.custom_divisor;
+check_and_exit:
write_latency_timer(port);
-check_and_exit:
if ((old_priv.flags & ASYNC_SPD_MASK) !=
(priv->flags & ASYNC_SPD_MASK)) {
if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 023/233] USB: serial: io_ti: fix div-by-zero in set_termios
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (71 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 017/233] USB: serial: ftdi_sio: fix setting latency for unprivileged users Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 056/233] usb: host: xhci: simplify irq handler return Ben Hutchings
` (160 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 6aeb75e6adfaed16e58780309613a578fe1ee90b upstream.
Fix a division-by-zero in set_termios when debugging is enabled and a
high-enough speed has been requested so that the divisor value becomes
zero.
Instead of just fixing the offending debug statement, cap the baud rate
at the base as a zero divisor value also appears to crash the firmware.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/io_ti.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -2215,8 +2215,11 @@ static void change_port_settings(struct
if (!baud) {
/* pick a default, any default... */
baud = 9600;
- } else
+ } else {
+ /* Avoid a zero divisor. */
+ baud = min(baud, 461550);
tty_encode_baud_rate(tty, baud, baud);
+ }
edge_port->baud_rate = baud;
config->wBaudRate = (__u16)((461550L + baud/2) / baud);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 056/233] usb: host: xhci: simplify irq handler return
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (72 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 023/233] USB: serial: io_ti: fix div-by-zero in set_termios Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 120/233] net: ping: do not abuse udp_poll() Ben Hutchings
` (159 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Mathias Nyman, Felipe Balbi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <felipe.balbi@linux.intel.com>
commit 76a35293b901915c5dcb4a87a4a0da8d7caf39fe upstream.
Instead of having several return points, let's use a local variable and
a single place to return. This makes the code slightly easier to read.
[set ret = IRQ_HANDLED in default working case -Mathias]
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-ring.c | 32 +++++++++++++++++---------------
1 file changed, 17 insertions(+), 15 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2688,27 +2688,28 @@ static int xhci_handle_event(struct xhci
irqreturn_t xhci_irq(struct usb_hcd *hcd)
{
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
- u32 status;
- u64 temp_64;
union xhci_trb *event_ring_deq;
+ irqreturn_t ret = IRQ_NONE;
dma_addr_t deq;
+ u64 temp_64;
+ u32 status;
spin_lock(&xhci->lock);
/* Check if the xHC generated the interrupt, or the irq is shared */
status = readl(&xhci->op_regs->status);
- if (status == 0xffffffff)
- goto hw_died;
-
- if (!(status & STS_EINT)) {
- spin_unlock(&xhci->lock);
- return IRQ_NONE;
+ if (status == 0xffffffff) {
+ ret = IRQ_HANDLED;
+ goto out;
}
+
+ if (!(status & STS_EINT))
+ goto out;
+
if (status & STS_FATAL) {
xhci_warn(xhci, "WARNING: Host System Error\n");
xhci_halt(xhci);
-hw_died:
- spin_unlock(&xhci->lock);
- return IRQ_HANDLED;
+ ret = IRQ_HANDLED;
+ goto out;
}
/*
@@ -2738,9 +2739,8 @@ hw_died:
temp_64 = xhci_read_64(xhci, &xhci->ir_set->erst_dequeue);
xhci_write_64(xhci, temp_64 | ERST_EHB,
&xhci->ir_set->erst_dequeue);
- spin_unlock(&xhci->lock);
-
- return IRQ_HANDLED;
+ ret = IRQ_HANDLED;
+ goto out;
}
event_ring_deq = xhci->event_ring->dequeue;
@@ -2765,10 +2765,12 @@ hw_died:
/* Clear the event handler busy flag (RW1C); event ring is empty. */
temp_64 |= ERST_EHB;
xhci_write_64(xhci, temp_64, &xhci->ir_set->erst_dequeue);
+ ret = IRQ_HANDLED;
+out:
spin_unlock(&xhci->lock);
- return IRQ_HANDLED;
+ return ret;
}
irqreturn_t xhci_msi_irq(int irq, void *hcd)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 120/233] net: ping: do not abuse udp_poll()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (73 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 056/233] usb: host: xhci: simplify irq handler return Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 076/233] ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors Ben Hutchings
` (158 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Sasha Levin, Eric Dumazet, David S. Miller,
Vasiliy Kulikov, Lorenzo Colitti, Solar Designer
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 77d4b1d36926a9b8387c6b53eeba42bcaaffcea3 upstream.
Alexander reported various KASAN messages triggered in recent kernels
The problem is that ping sockets should not use udp_poll() in the first
place, and recent changes in UDP stack finally exposed this old bug.
Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Fixes: 6d0bfe226116 ("net: ipv6: Add IPv6 support to the ping socket.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Sasha Levin <alexander.levin@verizon.com>
Cc: Solar Designer <solar@openwall.com>
Cc: Vasiliy Kulikov <segoon@openwall.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Acked-By: Lorenzo Colitti <lorenzo@google.com>
Tested-By: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/ipv6.h | 1 +
net/ipv4/af_inet.c | 2 +-
net/ipv6/ping.c | 2 +-
net/ipv6/raw.c | 2 +-
4 files changed, 4 insertions(+), 3 deletions(-)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -851,6 +851,7 @@ int inet6_hash_connect(struct inet_timew
*/
extern const struct proto_ops inet6_stream_ops;
extern const struct proto_ops inet6_dgram_ops;
+extern const struct proto_ops inet6_sockraw_ops;
struct group_source_req;
struct group_filter;
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1020,7 +1020,7 @@ static struct inet_protosw inetsw_array[
.type = SOCK_DGRAM,
.protocol = IPPROTO_ICMP,
.prot = &ping_prot,
- .ops = &inet_dgram_ops,
+ .ops = &inet_sockraw_ops,
.flags = INET_PROTOSW_REUSE,
},
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -50,7 +50,7 @@ static struct inet_protosw pingv6_protos
.type = SOCK_DGRAM,
.protocol = IPPROTO_ICMPV6,
.prot = &pingv6_prot,
- .ops = &inet6_dgram_ops,
+ .ops = &inet6_sockraw_ops,
.flags = INET_PROTOSW_REUSE,
};
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1299,7 +1299,7 @@ void raw6_proc_exit(void)
#endif /* CONFIG_PROC_FS */
/* Same as inet6_dgram_ops, sans udp_poll. */
-static const struct proto_ops inet6_sockraw_ops = {
+const struct proto_ops inet6_sockraw_ops = {
.family = PF_INET6,
.owner = THIS_MODULE,
.release = inet6_release,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 076/233] ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (74 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 120/233] net: ping: do not abuse udp_poll() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 029/233] kvm: arm/arm64: Fix use after free of stage2 page table Ben Hutchings
` (157 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Konstantin Khlebnikov, Theodore Ts'o
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit 9651e6b2e20648d04d5e1fe6479a3056047e8781 upstream.
I've got another report about breaking ext4 by ENOMEM error returned from
ext4_mb_load_buddy() caused by memory shortage in memory cgroup.
This time inside ext4_discard_preallocations().
This patch replaces ext4_error() with ext4_warning() where errors returned
from ext4_mb_load_buddy() are not fatal and handled by caller:
* ext4_mb_discard_group_preallocations() - called before generating ENOSPC,
we'll try to discard other group or return ENOSPC into user-space.
* ext4_trim_all_free() - just stop trimming and return ENOMEM from ioctl.
Some callers cannot handle errors, thus __GFP_NOFAIL is used for them:
* ext4_discard_preallocations()
* ext4_mb_discard_lg_preallocations()
Fixes: adb7ef600cc9 ("ext4: use __GFP_NOFAIL in ext4_free_blocks()")
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/mballoc.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3849,7 +3849,8 @@ ext4_mb_discard_group_preallocations(str
err = ext4_mb_load_buddy(sb, group, &e4b);
if (err) {
- ext4_error(sb, "Error loading buddy information for %u", group);
+ ext4_warning(sb, "Error %d loading buddy information for %u",
+ err, group);
put_bh(bitmap_bh);
return 0;
}
@@ -4006,10 +4007,11 @@ repeat:
BUG_ON(pa->pa_type != MB_INODE_PA);
group = ext4_get_group_number(sb, pa->pa_pstart);
- err = ext4_mb_load_buddy(sb, group, &e4b);
+ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+ GFP_NOFS|__GFP_NOFAIL);
if (err) {
- ext4_error(sb, "Error loading buddy information for %u",
- group);
+ ext4_error(sb, "Error %d loading buddy information for %u",
+ err, group);
continue;
}
@@ -4264,11 +4266,14 @@ ext4_mb_discard_lg_preallocations(struct
spin_unlock(&lg->lg_prealloc_lock);
list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) {
+ int err;
group = ext4_get_group_number(sb, pa->pa_pstart);
- if (ext4_mb_load_buddy(sb, group, &e4b)) {
- ext4_error(sb, "Error loading buddy information for %u",
- group);
+ err = ext4_mb_load_buddy_gfp(sb, group, &e4b,
+ GFP_NOFS|__GFP_NOFAIL);
+ if (err) {
+ ext4_error(sb, "Error %d loading buddy information for %u",
+ err, group);
continue;
}
ext4_lock_group(sb, group);
@@ -5107,8 +5112,8 @@ ext4_trim_all_free(struct super_block *s
ret = ext4_mb_load_buddy(sb, group, &e4b);
if (ret) {
- ext4_error(sb, "Error in loading buddy "
- "information for %u", group);
+ ext4_warning(sb, "Error %d loading buddy information for %u",
+ ret, group);
return ret;
}
bitmap = e4b.bd_bitmap;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 029/233] kvm: arm/arm64: Fix use after free of stage2 page table
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (75 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 076/233] ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 072/233] osf_wait4(): fix infoleak Ben Hutchings
` (156 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Marc Zyngier, Paolo Bonzini, Christoffer Dall,
Mark Rutland, andreyknvl, Suzuki K Poulose,
Radim Krčmář
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <suzuki.poulose@arm.com>
commit 0c428a6a9256fcd66817e12db32a50b405ed2e5c upstream.
We yield the kvm->mmu_lock occassionaly while performing an operation
(e.g, unmap or permission changes) on a large area of stage2 mappings.
However this could possibly cause another thread to clear and free up
the stage2 page tables while we were waiting for regaining the lock and
thus the original thread could end up in accessing memory that was
freed. This patch fixes the problem by making sure that the stage2
pagetable is still valid after we regain the lock. The fact that
mmu_notifer->release() could be called twice (via __mmu_notifier_release
and mmu_notifier_unregsister) enhances the possibility of hitting
this race where there are two threads trying to unmap the entire guest
shadow pages.
While at it, cleanup the redudant checks around cond_resched_lock in
stage2_wp_range(), as cond_resched_lock already does the same checks.
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: andreyknvl@google.com
Cc: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
[bwh: Backported to 3.16:
- unmap_range() is also used for hypervisor page tables, so make the check
condition on kvm != NULL
- s/READ_ONCE/ACCESS_ONCE/
- Drop change to stage2_wp_range()
- Adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/kvm/mmu.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -196,6 +196,13 @@ static void unmap_range(struct kvm *kvm,
pgd = pgdp + kvm_pgd_index(addr);
do {
+ /*
+ * Make sure the page table is still active, as another thread
+ * could have possibly freed the page table, while we released
+ * the lock.
+ */
+ if (kvm && !ACCESS_ONCE(kvm->arch.pgd))
+ break;
next = kvm_pgd_addr_end(addr, end);
if (!pgd_none(*pgd))
unmap_puds(kvm, pgd, addr, next);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 072/233] osf_wait4(): fix infoleak
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (76 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 029/233] kvm: arm/arm64: Fix use after free of stage2 page table Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 042/233] usb: r8a66597-hcd: select a different endpoint on timeout Ben Hutchings
` (155 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream.
failing sys_wait4() won't fill struct rusage...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/alpha/kernel/osf_sys.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -1186,8 +1186,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i
if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
return -EFAULT;
- err = 0;
- err |= put_user(status, ustatus);
+ err = put_user(status, ustatus);
+ if (ret < 0)
+ return err ? err : ret;
+
err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 042/233] usb: r8a66597-hcd: select a different endpoint on timeout
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (77 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 072/233] osf_wait4(): fix infoleak Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 049/233] USB: serial: qcserial: add more Lenovo EM74xx device IDs Ben Hutchings
` (154 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Chris Brandt
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chris Brandt <chris.brandt@renesas.com>
commit 1f873d857b6c2fefb4dada952674aa01bcfb92bd upstream.
If multiple endpoints on a single device have pending IN URBs and one
endpoint times out due to NAKs (perfectly legal), select a different
endpoint URB to try.
The existing code only checked to see another device address has pending
URBs and ignores other IN endpoints on the current device address. This
leads to endpoints never getting serviced if one endpoint is using NAK as
a flow control method.
Fixes: 5d3043586db4 ("usb: r8a66597-hcd: host controller driver for R8A6659")
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/r8a66597-hcd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned l
pipe = td->pipe;
pipe_stop(r8a66597, pipe);
+ /* Select a different address or endpoint */
new_td = td;
do {
list_move_tail(&new_td->queue,
@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned l
new_td = td;
break;
}
- } while (td != new_td && td->address == new_td->address);
+ } while (td != new_td && td->address == new_td->address &&
+ td->pipe->info.epnum == new_td->pipe->info.epnum);
start_transfer(r8a66597, new_td);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 049/233] USB: serial: qcserial: add more Lenovo EM74xx device IDs
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (78 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 042/233] usb: r8a66597-hcd: select a different endpoint on timeout Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 040/233] USB: iowarrior: fix info ioctl on big-endian hosts Ben Hutchings
` (153 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Bjørn Mork, Johan Hovold
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit 8d7a10dd323993cc40bd37bce8bc570133b0c396 upstream.
In their infinite wisdom, and never ending quest for end user frustration,
Lenovo has decided to use new USB device IDs for the wwan modules in
their 2017 laptops. The actual hardware is still the Sierra Wireless
EM7455 or EM7430, depending on region.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/qcserial.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -160,6 +160,8 @@ static const struct usb_device_id id_tab
{DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */
{DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */
{DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */
+ {DEVICE_SWI(0x1199, 0x907a)}, /* Sierra Wireless EM74xx QDL */
+ {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */
{DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
{DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
{DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 040/233] USB: iowarrior: fix info ioctl on big-endian hosts
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (79 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 049/233] USB: serial: qcserial: add more Lenovo EM74xx device IDs Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 090/233] net: phy: marvell: Limit errata to 88m1101 Ben Hutchings
` (152 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit dd5ca753fa92fb736b1395db892bd29f78e6d408 upstream.
Drop erroneous le16_to_cpu when returning the USB device speed which is
already in host byte order.
Found using sparse:
warning: cast to restricted __le16
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/iowarrior.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -557,7 +557,7 @@ static long iowarrior_ioctl(struct file
info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice);
/* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */
- info.speed = le16_to_cpu(dev->udev->speed);
+ info.speed = dev->udev->speed;
info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber;
info.report_size = dev->report_size;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 090/233] net: phy: marvell: Limit errata to 88m1101
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (80 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 040/233] USB: iowarrior: fix info ioctl on big-endian hosts Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 008/233] s390/qeth: unbreak OSM and OSN support Ben Hutchings
` (151 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Florian Fainelli, Andrew Lunn, David S. Miller,
Harini Katakam, Daniel Walker
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <andrew@lunn.ch>
commit f2899788353c13891412b273fdff5f02d49aa40f upstream.
The 88m1101 has an errata when configuring autoneg. However, it was
being applied to many other Marvell PHYs as well. Limit its scope to
just the 88m1101.
Fixes: 76884679c644 ("phylib: Add support for Marvell 88e1111S and 88e1145")
Reported-by: Daniel Walker <danielwa@cisco.com>
Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Harini Katakam <harinik@xilinx.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/phy/marvell.c | 66 ++++++++++++++++++++++++++---------------------
1 file changed, 37 insertions(+), 29 deletions(-)
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -152,34 +152,6 @@ static int marvell_config_aneg(struct ph
{
int err;
- /* The Marvell PHY has an errata which requires
- * that certain registers get written in order
- * to restart autonegotiation */
- err = phy_write(phydev, MII_BMCR, BMCR_RESET);
-
- if (err < 0)
- return err;
-
- err = phy_write(phydev, 0x1d, 0x1f);
- if (err < 0)
- return err;
-
- err = phy_write(phydev, 0x1e, 0x200c);
- if (err < 0)
- return err;
-
- err = phy_write(phydev, 0x1d, 0x5);
- if (err < 0)
- return err;
-
- err = phy_write(phydev, 0x1e, 0);
- if (err < 0)
- return err;
-
- err = phy_write(phydev, 0x1e, 0x100);
- if (err < 0)
- return err;
-
err = phy_write(phydev, MII_M1011_PHY_SCR,
MII_M1011_PHY_SCR_AUTO_CROSS);
if (err < 0)
@@ -214,6 +186,42 @@ static int marvell_config_aneg(struct ph
return 0;
}
+static int m88e1101_config_aneg(struct phy_device *phydev)
+{
+ int err;
+
+ /* This Marvell PHY has an errata which requires
+ * that certain registers get written in order
+ * to restart autonegotiation
+ */
+ err = phy_write(phydev, MII_BMCR, BMCR_RESET);
+
+ if (err < 0)
+ return err;
+
+ err = phy_write(phydev, 0x1d, 0x1f);
+ if (err < 0)
+ return err;
+
+ err = phy_write(phydev, 0x1e, 0x200c);
+ if (err < 0)
+ return err;
+
+ err = phy_write(phydev, 0x1d, 0x5);
+ if (err < 0)
+ return err;
+
+ err = phy_write(phydev, 0x1e, 0);
+ if (err < 0)
+ return err;
+
+ err = phy_write(phydev, 0x1e, 0x100);
+ if (err < 0)
+ return err;
+
+ return marvell_config_aneg(phydev);
+}
+
#ifdef CONFIG_OF_MDIO
/*
* Set and/or override some configuration registers based on the
@@ -890,7 +898,7 @@ static struct phy_driver marvell_drivers
.name = "Marvell 88E1101",
.features = PHY_GBIT_FEATURES,
.flags = PHY_HAS_INTERRUPT,
- .config_aneg = &marvell_config_aneg,
+ .config_aneg = &m88e1101_config_aneg,
.read_status = &genphy_read_status,
.ack_interrupt = &marvell_ack_interrupt,
.config_intr = &marvell_config_intr,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 008/233] s390/qeth: unbreak OSM and OSN support
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (81 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 090/233] net: phy: marvell: Limit errata to 88m1101 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 036/233] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Ben Hutchings
` (150 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Julian Wiedmann
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <jwi@linux.vnet.ibm.com>
commit 2d2ebb3ed0c6acfb014f98e427298673a5d07b82 upstream.
commit b4d72c08b358 ("qeth: bridgeport support - basic control")
broke the support for OSM and OSN devices as follows:
As OSM and OSN are L2 only, qeth_core_probe_device() does an early
setup by loading the l2 discipline and calling qeth_l2_probe_device().
In this context, adding the l2-specific bridgeport sysfs attributes
via qeth_l2_create_device_attributes() hits a BUG_ON in fs/sysfs/group.c,
since the basic sysfs infrastructure for the device hasn't been
established yet.
Note that OSN actually has its own unique sysfs attributes
(qeth_osn_devtype), so the additional attributes shouldn't be created
at all.
For OSM, add a new qeth_l2_devtype that contains all the common
and l2-specific sysfs attributes.
When qeth_core_probe_device() does early setup for OSM or OSN, assign
the corresponding devtype so that the ccwgroup probe code creates the
full set of sysfs attributes.
This allows us to skip qeth_l2_create_device_attributes() in case
of an early setup.
Any device that can't do early setup will initially have only the
generic sysfs attributes, and when it's probed later
qeth_l2_probe_device() adds the l2-specific attributes.
If an early-setup device is removed (by calling ccwgroup_ungroup()),
device_unregister() will - using the devtype - delete the
l2-specific attributes before qeth_l2_remove_device() is called.
So make sure to not remove them twice.
What complicates the issue is that qeth_l2_probe_device() and
qeth_l2_remove_device() is also called on a device when its
layer2 attribute changes (ie. its layer mode is switched).
For early-setup devices this wouldn't work properly - we wouldn't
remove the l2-specific attributes when switching to L3.
But switching the layer mode doesn't actually make any sense;
we already decided that the device can only operate in L2!
So just refuse to switch the layer mode on such devices. Note that
OSN doesn't have a layer2 attribute, so we only need to special-case
OSM.
Based on an initial patch by Ursula Braun.
Fixes: b4d72c08b358 ("qeth: bridgeport support - basic control")
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/s390/net/qeth_core.h | 4 ++++
drivers/s390/net/qeth_core_main.c | 17 +++++++++--------
drivers/s390/net/qeth_core_sys.c | 22 ++++++++++++++--------
drivers/s390/net/qeth_l2.h | 2 ++
drivers/s390/net/qeth_l2_main.c | 17 +++++++++++++----
drivers/s390/net/qeth_l2_sys.c | 8 ++++++++
drivers/s390/net/qeth_l3_main.c | 1 +
7 files changed, 51 insertions(+), 20 deletions(-)
--- a/drivers/s390/net/qeth_core.h
+++ b/drivers/s390/net/qeth_core.h
@@ -722,6 +722,7 @@ enum qeth_discipline_id {
};
struct qeth_discipline {
+ const struct device_type *devtype;
void (*start_poll)(struct ccw_device *, int, unsigned long);
qdio_handler_t *input_handler;
qdio_handler_t *output_handler;
@@ -882,6 +883,9 @@ extern struct qeth_discipline qeth_l2_di
extern struct qeth_discipline qeth_l3_discipline;
extern const struct attribute_group *qeth_generic_attr_groups[];
extern const struct attribute_group *qeth_osn_attr_groups[];
+extern const struct attribute_group qeth_device_attr_group;
+extern const struct attribute_group qeth_device_blkt_group;
+extern const struct device_type qeth_generic_devtype;
extern struct workqueue_struct *qeth_wq;
const char *qeth_get_cardname_short(struct qeth_card *);
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5225,10 +5225,12 @@ void qeth_core_free_discipline(struct qe
card->discipline = NULL;
}
-static const struct device_type qeth_generic_devtype = {
+const struct device_type qeth_generic_devtype = {
.name = "qeth_generic",
.groups = qeth_generic_attr_groups,
};
+EXPORT_SYMBOL_GPL(qeth_generic_devtype);
+
static const struct device_type qeth_osn_devtype = {
.name = "qeth_osn",
.groups = qeth_osn_attr_groups,
@@ -5354,23 +5356,22 @@ static int qeth_core_probe_device(struct
goto err_card;
}
- if (card->info.type == QETH_CARD_TYPE_OSN)
- gdev->dev.type = &qeth_osn_devtype;
- else
- gdev->dev.type = &qeth_generic_devtype;
-
switch (card->info.type) {
case QETH_CARD_TYPE_OSN:
case QETH_CARD_TYPE_OSM:
rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2);
if (rc)
goto err_card;
+
+ gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN)
+ ? card->discipline->devtype
+ : &qeth_osn_devtype;
rc = card->discipline->setup(card->gdev);
if (rc)
goto err_disc;
- case QETH_CARD_TYPE_OSD:
- case QETH_CARD_TYPE_OSX:
+ break;
default:
+ gdev->dev.type = &qeth_generic_devtype;
break;
}
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -446,12 +446,16 @@ static ssize_t qeth_dev_layer2_store(str
if (card->options.layer2 == newdis)
goto out;
- else {
- card->info.mac_bits = 0;
- if (card->discipline) {
- card->discipline->remove(card->gdev);
- qeth_core_free_discipline(card);
- }
+ if (card->info.type == QETH_CARD_TYPE_OSM) {
+ /* fixed layer, can't switch */
+ rc = -EOPNOTSUPP;
+ goto out;
+ }
+
+ card->info.mac_bits = 0;
+ if (card->discipline) {
+ card->discipline->remove(card->gdev);
+ qeth_core_free_discipline(card);
}
rc = qeth_core_load_discipline(card, newdis);
@@ -710,10 +714,11 @@ static struct attribute *qeth_blkt_devic
&dev_attr_inter_jumbo.attr,
NULL,
};
-static struct attribute_group qeth_device_blkt_group = {
+const struct attribute_group qeth_device_blkt_group = {
.name = "blkt",
.attrs = qeth_blkt_device_attrs,
};
+EXPORT_SYMBOL_GPL(qeth_device_blkt_group);
static struct attribute *qeth_device_attrs[] = {
&dev_attr_state.attr,
@@ -732,9 +737,10 @@ static struct attribute *qeth_device_att
&dev_attr_hw_trap.attr,
NULL,
};
-static struct attribute_group qeth_device_attr_group = {
+const struct attribute_group qeth_device_attr_group = {
.attrs = qeth_device_attrs,
};
+EXPORT_SYMBOL_GPL(qeth_device_attr_group);
const struct attribute_group *qeth_generic_attr_groups[] = {
&qeth_device_attr_group,
--- a/drivers/s390/net/qeth_l2.h
+++ b/drivers/s390/net/qeth_l2.h
@@ -8,6 +8,8 @@
#include "qeth_core.h"
+extern const struct attribute_group *qeth_l2_attr_groups[];
+
int qeth_l2_create_device_attributes(struct device *);
void qeth_l2_remove_device_attributes(struct device *);
void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card);
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -887,14 +887,21 @@ static int qeth_l2_stop(struct net_devic
return 0;
}
+static const struct device_type qeth_l2_devtype = {
+ .name = "qeth_layer2",
+ .groups = qeth_l2_attr_groups,
+};
+
static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
int rc;
- rc = qeth_l2_create_device_attributes(&gdev->dev);
- if (rc)
- return rc;
+ if (gdev->dev.type == &qeth_generic_devtype) {
+ rc = qeth_l2_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
+ }
INIT_LIST_HEAD(&card->vid_list);
INIT_LIST_HEAD(&card->mc_list);
card->options.layer2 = 1;
@@ -906,7 +913,8 @@ static void qeth_l2_remove_device(struct
{
struct qeth_card *card = dev_get_drvdata(&cgdev->dev);
- qeth_l2_remove_device_attributes(&cgdev->dev);
+ if (cgdev->dev.type == &qeth_generic_devtype)
+ qeth_l2_remove_device_attributes(&cgdev->dev);
qeth_set_allowed_threads(card, 0, 1);
wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0);
@@ -1275,6 +1283,7 @@ static int qeth_l2_control_event(struct
}
struct qeth_discipline qeth_l2_discipline = {
+ .devtype = &qeth_l2_devtype,
.start_poll = qeth_qdio_start_poll,
.input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
.output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
--- a/drivers/s390/net/qeth_l2_sys.c
+++ b/drivers/s390/net/qeth_l2_sys.c
@@ -221,3 +221,11 @@ void qeth_l2_setup_bridgeport_attrs(stru
} else
qeth_bridgeport_an_set(card, 0);
}
+
+const struct attribute_group *qeth_l2_attr_groups[] = {
+ &qeth_device_attr_group,
+ &qeth_device_blkt_group,
+ /* l2 specific, see l2_{create,remove}_device_attributes(): */
+ &qeth_l2_bridgeport_attr_group,
+ NULL,
+};
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3612,6 +3612,7 @@ static int qeth_l3_control_event(struct
}
struct qeth_discipline qeth_l3_discipline = {
+ .devtype = &qeth_generic_devtype,
.start_poll = qeth_qdio_start_poll,
.input_handler = (qdio_handler_t *) qeth_qdio_input_handler,
.output_handler = (qdio_handler_t *) qeth_qdio_output_handler,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 036/233] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (82 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 008/233] s390/qeth: unbreak OSM and OSN support Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 051/233] net: fix compile error in skb_orphan_partial() Ben Hutchings
` (149 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Andrey Korolyov
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Korolyov <andrey@xdel.ru>
commit 5f63424ab7daac840df2b12dd5bcc5b38d50f779 upstream.
This patch adds support for recognition of ARM-USB-TINY(H) devices which
are almost identical to ARM-USB-OCD(H) but lacking separate barrel jack
and serial console.
By suggestion from Johan Hovold it is possible to replace
ftdi_jtag_quirk with a bit more generic construction. Since all
Olimex-ARM debuggers has exactly two ports, we could safely always use
only second port within the debugger family.
Signed-off-by: Andrey Korolyov <andrey@xdel.ru>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/ftdi_sio.c | 8 ++++----
drivers/usb/serial/ftdi_sio_ids.h | 2 ++
2 files changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -822,10 +822,10 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
{ USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) },
+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) },
+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) },
+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) },
{ USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
{ USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID),
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -882,6 +882,8 @@
/* Olimex */
#define OLIMEX_VID 0x15BA
#define OLIMEX_ARM_USB_OCD_PID 0x0003
+#define OLIMEX_ARM_USB_TINY_PID 0x0004
+#define OLIMEX_ARM_USB_TINY_H_PID 0x002a
#define OLIMEX_ARM_USB_OCD_H_PID 0x002b
/*
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 051/233] net: fix compile error in skb_orphan_partial()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (83 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 036/233] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 063/233] drivers: char: mem: Check for address space wraparound with mmap() Ben Hutchings
` (148 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Stephen Rothwell, David S. Miller, Paul Gortmaker,
Randy Dunlap, Eric Dumazet
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 9142e9007f2d7ab58a587a1e1d921b0064a339aa upstream.
If CONFIG_INET is not set, net/core/sock.c can not compile :
net/core/sock.c: In function ‘skb_orphan_partial’:
net/core/sock.c:1810:2: error: implicit declaration of function
‘skb_is_tcp_pure_ack’ [-Werror=implicit-function-declaration]
if (skb_is_tcp_pure_ack(skb))
^
Fix this by always including <net/tcp.h>
Fixes: f6ba8d33cfbb ("netem: fix skb_orphan_partial()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/sock.c | 3 ---
1 file changed, 3 deletions(-)
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -136,10 +136,7 @@
#include <trace/events/sock.h>
-#ifdef CONFIG_INET
#include <net/tcp.h>
-#endif
-
#include <net/busy_poll.h>
static DEFINE_MUTEX(proto_list_mutex);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 063/233] drivers: char: mem: Check for address space wraparound with mmap()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (84 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 051/233] net: fix compile error in skb_orphan_partial() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 145/233] HID: microsoft: Add Surface 4 type cover pro 4 (JP) Ben Hutchings
` (147 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Julius Werner, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <jwerner@chromium.org>
commit b299cde245b0b76c977f4291162cf668e087b408 upstream.
/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).
This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/char/mem.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -329,6 +329,11 @@ static const struct vm_operations_struct
static int mmap_mem(struct file *file, struct vm_area_struct *vma)
{
size_t size = vma->vm_end - vma->vm_start;
+ phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+ /* It's illegal to wrap around the end of the physical address space. */
+ if (offset + (phys_addr_t)size < offset)
+ return -EINVAL;
if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
return -EINVAL;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 145/233] HID: microsoft: Add Surface 4 type cover pro 4 (JP)
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (85 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 063/233] drivers: char: mem: Check for address space wraparound with mmap() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 119/233] ipv6: Fix leak in ipv6_gso_segment() Ben Hutchings
` (146 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Yuta Kobayashi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yuta Kobayashi <alu.ula@outlook.com>
commit b490a8537df60d449199e162417da74ee9262515 upstream.
Adding support for the Microsoft Surface 4 Type Cover Pro (JP).
Signed-off-by: Yuta Kobayashi <alu.ula@outlook.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 2 ++
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-microsoft.c | 2 ++
drivers/hid/usbhid/hid-quirks.c | 1 +
4 files changed, 6 insertions(+)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -707,6 +707,7 @@ static void hid_scan_collection(struct h
(hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
hid->group == HID_GROUP_MULTITOUCH)
@@ -1863,6 +1864,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -672,6 +672,7 @@
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 0x07dc
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 0x07e2
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP 0x07e9
#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07de
#define USB_DEVICE_ID_MS_POWER_COVER 0x07da
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -282,6 +282,8 @@ static const struct hid_device_id ms_dev
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP),
.driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP),
+ .driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER),
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -99,6 +99,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 119/233] ipv6: Fix leak in ipv6_gso_segment().
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (86 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 145/233] HID: microsoft: Add Surface 4 type cover pro 4 (JP) Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 015/233] PowerCap: Fix an error code in powercap_register_zone() Ben Hutchings
` (145 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
commit e3e86b5119f81e5e2499bea7ea1ebe8ac6aab789 upstream.
If ip6_find_1stfragopt() fails and we return an error we have to free
up 'segs' because nobody else is going to.
Fixes: 2423496af35d ("ipv6: Prevent overrun when parsing v6 header options")
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv6/ip6_offload.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -144,8 +144,10 @@ static struct sk_buff *ipv6_gso_segment(
if (udpfrag) {
int err = ip6_find_1stfragopt(skb, &prevhdr);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb_list(segs);
return ERR_PTR(err);
+ }
fptr = (struct frag_hdr *)((u8 *)ipv6h + err);
fptr->frag_off = htons(offset);
if (skb->next != NULL)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 015/233] PowerCap: Fix an error code in powercap_register_zone()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (87 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 119/233] ipv6: Fix leak in ipv6_gso_segment() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 037/233] USB: ene_usb6250: fix DMA to the stack Ben Hutchings
` (144 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Rafael J. Wysocki, Srinivas Pandruvada, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 216c4e9db4c9d1d2a382b42880442dc632cd47d9 upstream.
In the current code we accidentally return the successful result from
idr_alloc() instead of a negative error pointer. The caller is looking
for an error pointer and so it treats the returned value as a valid
pointer.
This one might be a bit serious because if it lets people get around the
kernel's protection for remapping NULL. I'm not sure.
Fixes: 75d2364ea0ca (PowerCap: Add class driver)
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/powercap/powercap_sys.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/powercap/powercap_sys.c
+++ b/drivers/powercap/powercap_sys.c
@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_
power_zone->id = result;
idr_init(&power_zone->idr);
+ result = -ENOMEM;
power_zone->name = kstrdup(name, GFP_KERNEL);
if (!power_zone->name)
goto err_name_alloc;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 037/233] USB: ene_usb6250: fix DMA to the stack
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (88 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 015/233] PowerCap: Fix an error code in powercap_register_zone() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 103/233] iscsi-target: Always wait for kthread_should_stop() before kthread exit Ben Hutchings
` (143 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Alan Stern
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 628c2893d44876ddd11602400c70606ade62e129 upstream.
The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on
the stack, which doesn't work with vmapped stacks. This patch fixes
the problem by allocating a separate 512-byte buffer at probe time and
using it for all of the offending I/O operations.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/storage/ene_ub6250.c | 90 ++++++++++++++++++++++++----------------
1 file changed, 55 insertions(+), 35 deletions(-)
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -443,6 +443,10 @@ struct ms_lib_ctrl {
#define SD_BLOCK_LEN 9
struct ene_ub6250_info {
+
+ /* I/O bounce buffer */
+ u8 *bbuf;
+
/* for 6250 code */
struct SD_STATUS SD_Status;
struct MS_STATUS MS_Status;
@@ -490,8 +494,11 @@ static int ene_load_bincode(struct us_da
static void ene_ub6250_info_destructor(void *extra)
{
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
if (!extra)
return;
+ kfree(info->bbuf);
}
static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -855,8 +862,9 @@ static int ms_read_readpage(struct us_da
u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
int result;
- u8 ExtBuf[4];
u32 bn = PhyBlockAddr * 0x20 + PageNum;
/* printk(KERN_INFO "MS --- MS_ReaderReadPage,
@@ -899,7 +907,7 @@ static int ms_read_readpage(struct us_da
bcb->CDB[2] = (unsigned char)(PhyBlockAddr>>16);
bcb->CDB[6] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
@@ -908,9 +916,9 @@ static int ms_read_readpage(struct us_da
ExtraDat->status0 = 0x10; /* Not yet,fireware support */
ExtraDat->status1 = 0x00; /* Not yet,fireware support */
- ExtraDat->ovrflg = ExtBuf[0];
- ExtraDat->mngflg = ExtBuf[1];
- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+ ExtraDat->ovrflg = bbuf[0];
+ ExtraDat->mngflg = bbuf[1];
+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]);
return USB_STOR_TRANSPORT_GOOD;
}
@@ -1336,8 +1344,9 @@ static int ms_lib_read_extra(struct us_d
u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
int result;
- u8 ExtBuf[4];
/* printk("MS_LibReadExtra --- PhyBlock = %x, PageNum = %x\n", PhyBlock, PageNum); */
memset(bcb, 0, sizeof(struct bulk_cb_wrap));
@@ -1352,7 +1361,7 @@ static int ms_lib_read_extra(struct us_d
bcb->CDB[2] = (unsigned char)(PhyBlock>>16);
bcb->CDB[6] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
@@ -1360,9 +1369,9 @@ static int ms_lib_read_extra(struct us_d
ExtraDat->intr = 0x80; /* Not yet, waiting for fireware support */
ExtraDat->status0 = 0x10; /* Not yet, waiting for fireware support */
ExtraDat->status1 = 0x00; /* Not yet, waiting for fireware support */
- ExtraDat->ovrflg = ExtBuf[0];
- ExtraDat->mngflg = ExtBuf[1];
- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+ ExtraDat->ovrflg = bbuf[0];
+ ExtraDat->mngflg = bbuf[1];
+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]);
return USB_STOR_TRANSPORT_GOOD;
}
@@ -1566,9 +1575,9 @@ static int ms_lib_scan_logicalblocknumbe
u16 PhyBlock, newblk, i;
u16 LogStart, LogEnde;
struct ms_lib_type_extdat extdat;
- u8 buf[0x200];
u32 count = 0, index = 0;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1582,14 +1591,16 @@ static int ms_lib_scan_logicalblocknumbe
}
if (count == PhyBlock) {
- ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+ ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+ bbuf);
count += 0x80;
}
index = (PhyBlock % 0x80) * 4;
- extdat.ovrflg = buf[index];
- extdat.mngflg = buf[index+1];
- extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+ extdat.ovrflg = bbuf[index];
+ extdat.mngflg = bbuf[index+1];
+ extdat.logadr = memstick_logaddr(bbuf[index+2],
+ bbuf[index+3]);
if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2072,9 +2083,9 @@ static int ene_ms_init(struct us_data *u
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
int result;
- u8 buf[0x200];
u16 MSP_BlockSize, MSP_UserAreaBlocks;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
printk(KERN_INFO "transport --- ENE_MSInit\n");
@@ -2093,13 +2104,13 @@ static int ene_ms_init(struct us_data *u
bcb->CDB[0] = 0xF1;
bcb->CDB[1] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD) {
printk(KERN_ERR "Execution MS Init Code Fail !!\n");
return USB_STOR_TRANSPORT_ERROR;
}
/* the same part to test ENE */
- info->MS_Status = *(struct MS_STATUS *)&buf[0];
+ info->MS_Status = *(struct MS_STATUS *) bbuf;
if (info->MS_Status.Insert && info->MS_Status.Ready) {
printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert);
@@ -2108,15 +2119,15 @@ static int ene_ms_init(struct us_data *u
printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG);
printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
if (info->MS_Status.IsMSPro) {
- MSP_BlockSize = (buf[6] << 8) | buf[7];
- MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+ MSP_BlockSize = (bbuf[6] << 8) | bbuf[7];
+ MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
} else {
ms_card_init(us); /* Card is MS (to ms.c)*/
}
usb_stor_dbg(us, "MS Init Code OK !!\n");
} else {
- usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+ usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
return USB_STOR_TRANSPORT_ERROR;
}
@@ -2126,9 +2137,9 @@ static int ene_ms_init(struct us_data *u
static int ene_sd_init(struct us_data *us)
{
int result;
- u8 buf[0x200];
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
usb_stor_dbg(us, "transport --- ENE_SDInit\n");
/* SD Init Part-1 */
@@ -2162,17 +2173,17 @@ static int ene_sd_init(struct us_data *u
bcb->Flags = US_BULK_FLAG_IN;
bcb->CDB[0] = 0xF1;
- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD) {
usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
return USB_STOR_TRANSPORT_ERROR;
}
- info->SD_Status = *(struct SD_STATUS *)&buf[0];
+ info->SD_Status = *(struct SD_STATUS *) bbuf;
if (info->SD_Status.Insert && info->SD_Status.Ready) {
struct SD_STATUS *s = &info->SD_Status;
- ene_get_card_status(us, (unsigned char *)&buf);
+ ene_get_card_status(us, bbuf);
usb_stor_dbg(us, "Insert = %x\n", s->Insert);
usb_stor_dbg(us, "Ready = %x\n", s->Ready);
usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC);
@@ -2180,7 +2191,7 @@ static int ene_sd_init(struct us_data *u
usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed);
usb_stor_dbg(us, "WtP = %x\n", s->WtP);
} else {
- usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+ usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
return USB_STOR_TRANSPORT_ERROR;
}
return USB_STOR_TRANSPORT_GOOD;
@@ -2190,13 +2201,15 @@ static int ene_sd_init(struct us_data *u
static int ene_init(struct us_data *us)
{
int result;
- u8 misc_reg03 = 0;
+ u8 misc_reg03;
struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+ u8 *bbuf = info->bbuf;
- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+ result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
+ misc_reg03 = bbuf[0];
if (misc_reg03 & 0x01) {
if (!info->SD_Status.Ready) {
result = ene_sd_init(us);
@@ -2312,8 +2325,9 @@ static int ene_ub6250_probe(struct usb_i
const struct usb_device_id *id)
{
int result;
- u8 misc_reg03 = 0;
+ u8 misc_reg03;
struct us_data *us;
+ struct ene_ub6250_info *info;
result = usb_stor_probe1(&us, intf, id,
(id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list);
@@ -2321,11 +2335,16 @@ static int ene_ub6250_probe(struct usb_i
return result;
/* FIXME: where should the code alloc extra buf ? */
- if (!us->extra) {
- us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
- if (!us->extra)
- return -ENOMEM;
- us->extra_destructor = ene_ub6250_info_destructor;
+ us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+ if (!us->extra)
+ return -ENOMEM;
+ us->extra_destructor = ene_ub6250_info_destructor;
+
+ info = (struct ene_ub6250_info *)(us->extra);
+ info->bbuf = kmalloc(512, GFP_KERNEL);
+ if (!info->bbuf) {
+ kfree(us->extra);
+ return -ENOMEM;
}
us->transport_name = "ene_ub6250";
@@ -2337,12 +2356,13 @@ static int ene_ub6250_probe(struct usb_i
return result;
/* probe card type */
- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+ result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
if (result != USB_STOR_XFER_GOOD) {
usb_stor_disconnect(intf);
return USB_STOR_TRANSPORT_ERROR;
}
+ misc_reg03 = info->bbuf[0];
if (!(misc_reg03 & 0x01)) {
pr_info("ums_eneub6250: The driver only supports SD/MS card. "
"To use SM card, please build driver/staging/keucr\n");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 103/233] iscsi-target: Always wait for kthread_should_stop() before kthread exit
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (89 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 037/233] USB: ene_usb6250: fix DMA to the stack Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 127/233] HID: uclogic: Set quirks from inside the driver Ben Hutchings
` (142 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nicholas Bellinger, Jiang Yi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Yi <jiangyilism@gmail.com>
commit 5e0cf5e6c43b9e19fc0284f69e5cd2b4a47523b0 upstream.
There are three timing problems in the kthread usages of iscsi_target_mod:
- np_thread of struct iscsi_np
- rx_thread and tx_thread of struct iscsi_conn
In iscsit_close_connection(), it calls
send_sig(SIGINT, conn->tx_thread, 1);
kthread_stop(conn->tx_thread);
In conn->tx_thread, which is iscsi_target_tx_thread(), when it receive
SIGINT the kthread will exit without checking the return value of
kthread_should_stop().
So if iscsi_target_tx_thread() exit right between send_sig(SIGINT...)
and kthread_stop(...), the kthread_stop() will try to stop an already
stopped kthread.
This is invalid according to the documentation of kthread_stop().
(Fix -ECONNRESET logout handling in iscsi_target_tx_thread and
early iscsi_target_rx_thread failure case - nab)
Signed-off-by: Jiang Yi <jiangyilism@gmail.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/iscsi/iscsi_target.c | 30 ++++++++++++++++++++++++------
drivers/target/iscsi/iscsi_target_erl0.c | 6 +++++-
drivers/target/iscsi/iscsi_target_erl0.h | 2 +-
drivers/target/iscsi/iscsi_target_login.c | 4 ++++
4 files changed, 34 insertions(+), 8 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3931,6 +3931,8 @@ int iscsi_target_tx_thread(void *arg)
{
int ret = 0;
struct iscsi_conn *conn = arg;
+ bool conn_freed = false;
+
/*
* Allow ourselves to be interrupted by SIGINT so that a
* connection recovery / failure event can be triggered externally.
@@ -3956,12 +3958,14 @@ get_immediate:
goto transport_err;
ret = iscsit_handle_response_queue(conn);
- if (ret == 1)
+ if (ret == 1) {
goto get_immediate;
- else if (ret == -ECONNRESET)
+ } else if (ret == -ECONNRESET) {
+ conn_freed = true;
goto out;
- else if (ret < 0)
+ } else if (ret < 0) {
goto transport_err;
+ }
}
transport_err:
@@ -3971,8 +3975,13 @@ transport_err:
* responsible for cleaning up the early connection failure.
*/
if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
- iscsit_take_action_for_connection_exit(conn);
+ iscsit_take_action_for_connection_exit(conn, &conn_freed);
out:
+ if (!conn_freed) {
+ while (!kthread_should_stop()) {
+ msleep(100);
+ }
+ }
return 0;
}
@@ -4073,6 +4082,8 @@ int iscsi_target_rx_thread(void *arg)
u32 checksum = 0, digest = 0;
struct iscsi_conn *conn = arg;
struct kvec iov;
+ bool conn_freed = false;
+
/*
* Allow ourselves to be interrupted by SIGINT so that a
* connection recovery / failure event can be triggered externally.
@@ -4084,7 +4095,7 @@ int iscsi_target_rx_thread(void *arg)
*/
rc = wait_for_completion_interruptible(&conn->rx_login_comp);
if (rc < 0 || iscsi_target_check_conn_state(conn))
- return 0;
+ goto out;
if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
struct completion comp;
@@ -4169,7 +4180,15 @@ int iscsi_target_rx_thread(void *arg)
transport_err:
if (!signal_pending(current))
atomic_set(&conn->transport_failed, 1);
- iscsit_take_action_for_connection_exit(conn);
+ iscsit_take_action_for_connection_exit(conn, &conn_freed);
+
+out:
+ if (!conn_freed) {
+ while (!kthread_should_stop()) {
+ msleep(100);
+ }
+ }
+
return 0;
}
--- a/drivers/target/iscsi/iscsi_target_erl0.c
+++ b/drivers/target/iscsi/iscsi_target_erl0.c
@@ -935,8 +935,10 @@ static void iscsit_handle_connection_cle
}
}
-void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn)
+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed)
{
+ *conn_freed = false;
+
spin_lock_bh(&conn->state_lock);
if (atomic_read(&conn->connection_exit)) {
spin_unlock_bh(&conn->state_lock);
@@ -947,6 +949,7 @@ void iscsit_take_action_for_connection_e
if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) {
spin_unlock_bh(&conn->state_lock);
iscsit_close_connection(conn);
+ *conn_freed = true;
return;
}
@@ -960,6 +963,7 @@ void iscsit_take_action_for_connection_e
spin_unlock_bh(&conn->state_lock);
iscsit_handle_connection_cleanup(conn);
+ *conn_freed = true;
}
/*
--- a/drivers/target/iscsi/iscsi_target_erl0.h
+++ b/drivers/target/iscsi/iscsi_target_erl0.h
@@ -9,7 +9,7 @@ extern int iscsit_stop_time2retain_timer
extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *);
extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int);
extern void iscsit_fall_back_to_erl0(struct iscsi_session *);
-extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *);
+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *);
extern int iscsit_recover_from_unknown_opcode(struct iscsi_conn *);
#endif /*** ISCSI_TARGET_ERL0_H ***/
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1496,5 +1496,9 @@ int iscsi_target_login_thread(void *arg)
break;
}
+ while (!kthread_should_stop()) {
+ msleep(100);
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 127/233] HID: uclogic: Set quirks from inside the driver
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (90 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 103/233] iscsi-target: Always wait for kthread_should_stop() before kthread exit Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 050/233] of: fdt: add missing allocation-failure check Ben Hutchings
` (141 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Nikolai Kondrashov, Benjamin Tissoires, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
commit 70b69cfb88467988116c4863056495fa3615271a upstream.
Based on a patch from: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com>
Most of the tablets handled by hid-uclogic already use MULTI_INPUT.
For the ones which are not quirked in usbhid/hidquirks, they have a
custom report descriptor which contains only one report per HID
interface. For those tablets HID_QUIRK_MULTI_INPUT is transparent.
According to https://github.com/DIGImend/tablets, the only problematic
tablet currently handled by hid-uclogic is the TWHA60 v3. This tablet
presents different report descriptors from the ones currently quirked.
This is not a problem per se, given that this tablet is not supported
currently in this version (it needs the same command as a Huion to
start forwarding events).
Reviewed-by: Nikolai Kondrashov <spbnick@gmail.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-uclogic.c | 27 +++++++++++++++++++++++++++
drivers/hid/usbhid/hid-quirks.c | 4 ----
2 files changed, 27 insertions(+), 4 deletions(-)
--- a/drivers/hid/hid-uclogic.c
+++ b/drivers/hid/hid-uclogic.c
@@ -626,6 +626,32 @@ static __u8 *uclogic_report_fixup(struct
return rdesc;
}
+static int uclogic_probe(struct hid_device *hdev,
+ const struct hid_device_id *id)
+{
+ int rc;
+
+ /*
+ * libinput requires the pad interface to be on a different node
+ * than the pen, so use QUIRK_MULTI_INPUT for all tablets.
+ */
+ hdev->quirks |= HID_QUIRK_MULTI_INPUT;
+
+ rc = hid_parse(hdev);
+ if (rc) {
+ hid_err(hdev, "parse failed\n");
+ return rc;
+ }
+
+ rc = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
+ if (rc) {
+ hid_err(hdev, "hw start failed\n");
+ return rc;
+ }
+
+ return 0;
+}
+
static const struct hid_device_id uclogic_devices[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC,
USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
@@ -648,6 +674,7 @@ MODULE_DEVICE_TABLE(hid, uclogic_devices
static struct hid_driver uclogic_driver = {
.name = "uclogic",
.id_table = uclogic_devices,
+ .probe = uclogic_probe,
.report_fixup = uclogic_report_fixup,
};
module_hid_driver(uclogic_driver);
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -112,12 +112,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209, HID_QUIRK_MULTI_INPUT },
- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U, HID_QUIRK_MULTI_INPUT },
- { USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP8060U, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 050/233] of: fdt: add missing allocation-failure check
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (91 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 127/233] HID: uclogic: Set quirks from inside the driver Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 077/233] i2c: i2c-tiny-usb: fix buffer not being DMA capable Ben Hutchings
` (140 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Rob Herring
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 49e67dd17649b60b4d54966e18ec9c80198227f0 upstream.
The memory allocator passed to __unflatten_device_tree() (e.g. a wrapped
kzalloc) can fail so add the missing sanity check to avoid dereferencing
a NULL pointer.
Fixes: fe14042358fa ("of/flattree: Refactor unflatten_device_tree and add fdt_unflatten_tree")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/of/fdt.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -380,6 +380,9 @@ static void __unflatten_device_tree(void
/* Allocate memory for the expanded device tree */
mem = dt_alloc(size + 4, __alignof__(struct device_node));
+ if (!mem)
+ return NULL;
+
memset(mem, 0, size);
*(__be32 *)(mem + size) = cpu_to_be32(0xdeadbeef);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 077/233] i2c: i2c-tiny-usb: fix buffer not being DMA capable
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (92 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 050/233] of: fdt: add missing allocation-failure check Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 092/233] drm/radeon: Unbreak HPD handling for r600+ Ben Hutchings
` (139 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Till Harbaum, Sebastian Reichel, Greg Kroah-Hartman, Wolfram Sang
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
commit 5165da5923d6c7df6f2927b0113b2e4d9288661e upstream.
Since v4.9 i2c-tiny-usb generates the below call trace
and longer works, since it can't communicate with the
USB device. The reason is, that since v4.9 the USB
stack checks, that the buffer it should transfer is DMA
capable. This was a requirement since v2.2 days, but it
usually worked nevertheless.
[ 17.504959] ------------[ cut here ]------------
[ 17.505488] WARNING: CPU: 0 PID: 93 at drivers/usb/core/hcd.c:1587 usb_hcd_map_urb_for_dma+0x37c/0x570
[ 17.506545] transfer buffer not dma capable
[ 17.507022] Modules linked in:
[ 17.507370] CPU: 0 PID: 93 Comm: i2cdetect Not tainted 4.11.0-rc8+ #10
[ 17.508103] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 17.509039] Call Trace:
[ 17.509320] ? dump_stack+0x5c/0x78
[ 17.509714] ? __warn+0xbe/0xe0
[ 17.510073] ? warn_slowpath_fmt+0x5a/0x80
[ 17.510532] ? nommu_map_sg+0xb0/0xb0
[ 17.510949] ? usb_hcd_map_urb_for_dma+0x37c/0x570
[ 17.511482] ? usb_hcd_submit_urb+0x336/0xab0
[ 17.511976] ? wait_for_completion_timeout+0x12f/0x1a0
[ 17.512549] ? wait_for_completion_timeout+0x65/0x1a0
[ 17.513125] ? usb_start_wait_urb+0x65/0x160
[ 17.513604] ? usb_control_msg+0xdc/0x130
[ 17.514061] ? usb_xfer+0xa4/0x2a0
[ 17.514445] ? __i2c_transfer+0x108/0x3c0
[ 17.514899] ? i2c_transfer+0x57/0xb0
[ 17.515310] ? i2c_smbus_xfer_emulated+0x12f/0x590
[ 17.515851] ? _raw_spin_unlock_irqrestore+0x11/0x20
[ 17.516408] ? i2c_smbus_xfer+0x125/0x330
[ 17.516876] ? i2c_smbus_xfer+0x125/0x330
[ 17.517329] ? i2cdev_ioctl_smbus+0x1c1/0x2b0
[ 17.517824] ? i2cdev_ioctl+0x75/0x1c0
[ 17.518248] ? do_vfs_ioctl+0x9f/0x600
[ 17.518671] ? vfs_write+0x144/0x190
[ 17.519078] ? SyS_ioctl+0x74/0x80
[ 17.519463] ? entry_SYSCALL_64_fastpath+0x1e/0xad
[ 17.519959] ---[ end trace d047c04982f5ac50 ]---
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.co.uk>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Till Harbaum <till@harbaum.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/i2c/busses/i2c-tiny-usb.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *
int value, int index, void *data, int len)
{
struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+ void *dmadata = kmalloc(len, GFP_KERNEL);
+ int ret;
+
+ if (!dmadata)
+ return -ENOMEM;
/* do control transfer */
- return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
+ ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
- USB_DIR_IN, value, index, data, len, 2000);
+ USB_DIR_IN, value, index, dmadata, len, 2000);
+
+ memcpy(data, dmadata, len);
+ kfree(dmadata);
+ return ret;
}
static int usb_write(struct i2c_adapter *adapter, int cmd,
int value, int index, void *data, int len)
{
struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data;
+ void *dmadata = kmemdup(data, len, GFP_KERNEL);
+ int ret;
+
+ if (!dmadata)
+ return -ENOMEM;
/* do control transfer */
- return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
+ ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
- value, index, data, len, 2000);
+ value, index, dmadata, len, 2000);
+
+ kfree(dmadata);
+ return ret;
}
static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 092/233] drm/radeon: Unbreak HPD handling for r600+
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (93 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 077/233] i2c: i2c-tiny-usb: fix buffer not being DMA capable Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 062/233] serial: ifx6x60: fix use-after-free on module unload Ben Hutchings
` (138 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Deucher, Christian König, Lyude
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lyude <lyude@redhat.com>
commit 3d18e33735a02b1a90aecf14410bf3edbfd4d3dc upstream.
We end up reading the interrupt register for HPD5, and then writing it
to HPD6 which on systems without anything using HPD5 results in
permanently disabling hotplug on one of the display outputs after the
first time we acknowledge a hotplug interrupt from the GPU.
This code is really bad. But for now, let's just fix this. I will
hopefully have a large patch series to refactor all of this soon.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Lyude <lyude@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.16: drop the DC_HPD6_RX_INTERRUPT cases]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -7334,7 +7334,7 @@ static inline void cik_irq_ack(struct ra
WREG32(DC_HPD5_INT_CONTROL, tmp);
}
if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
- tmp = RREG32(DC_HPD5_INT_CONTROL);
+ tmp = RREG32(DC_HPD6_INT_CONTROL);
tmp |= DC_HPDx_INT_ACK;
WREG32(DC_HPD6_INT_CONTROL, tmp);
}
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -4692,7 +4692,7 @@ static void evergreen_irq_ack(struct rad
WREG32(DC_HPD5_INT_CONTROL, tmp);
}
if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
- tmp = RREG32(DC_HPD5_INT_CONTROL);
+ tmp = RREG32(DC_HPD6_INT_CONTROL);
tmp |= DC_HPDx_INT_ACK;
WREG32(DC_HPD6_INT_CONTROL, tmp);
}
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -3725,7 +3725,7 @@ static void r600_irq_ack(struct radeon_d
WREG32(DC_HPD5_INT_CONTROL, tmp);
}
if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
- tmp = RREG32(DC_HPD5_INT_CONTROL);
+ tmp = RREG32(DC_HPD6_INT_CONTROL);
tmp |= DC_HPDx_INT_ACK;
WREG32(DC_HPD6_INT_CONTROL, tmp);
}
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -6071,7 +6071,7 @@ static inline void si_irq_ack(struct rad
WREG32(DC_HPD5_INT_CONTROL, tmp);
}
if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
- tmp = RREG32(DC_HPD5_INT_CONTROL);
+ tmp = RREG32(DC_HPD6_INT_CONTROL);
tmp |= DC_HPDx_INT_ACK;
WREG32(DC_HPD6_INT_CONTROL, tmp);
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 062/233] serial: ifx6x60: fix use-after-free on module unload
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (94 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 092/233] drm/radeon: Unbreak HPD handling for r600+ Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 087/233] netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize Ben Hutchings
` (137 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jun Chen, Greg Kroah-Hartman, Johan Hovold
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1e948479b3d63e3ac0ecca13cbf4921c7d17c168 upstream.
Make sure to deregister the SPI driver before releasing the tty driver
to avoid use-after-free in the SPI remove callback where the tty
devices are deregistered.
Fixes: 72d4724ea54c ("serial: ifx6x60: Add modem power off function in the platform reboot process")
Cc: Jun Chen <jun.d.chen@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/serial/ifx6x60.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -1379,9 +1379,9 @@ static struct spi_driver ifx_spi_driver
static void __exit ifx_spi_exit(void)
{
/* unregister */
+ spi_unregister_driver(&ifx_spi_driver);
tty_unregister_driver(tty_drv);
put_tty_driver(tty_drv);
- spi_unregister_driver(&ifx_spi_driver);
unregister_reboot_notifier(&ifx_modem_reboot_notifier_block);
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 087/233] netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (95 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 062/233] serial: ifx6x60: fix use-after-free on module unload Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 110/233] slub/memcg: cure the brainless abuse of sysfs attributes Ben Hutchings
` (136 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pablo Neira Ayuso, Liping Zhang
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Liping Zhang <zlpnobody@gmail.com>
commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1 upstream.
If nf_conntrack_htable_size was adjusted by the user during the ct
dump operation, we may invoke nf_ct_put twice for the same ct, i.e.
the "last" ct. This will cause the ct will be freed but still linked
in hash buckets.
It's very easy to reproduce the problem by the following commands:
# while : ; do
echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets
done
# while : ; do
conntrack -L
done
# iperf -s 127.0.0.1 &
# iperf -c 127.0.0.1 -P 60 -t 36000
After a while, the system will hang like this:
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184]
NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382]
...
So at last if we find cb->args[1] is equal to "last", this means hash
resize happened, then we can set cb->args[1] to 0 to fix the above
issue.
Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping")
Signed-off-by: Liping Zhang <zlpnobody@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/netfilter/nf_conntrack_netlink.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -827,8 +827,13 @@ restart:
}
out:
local_bh_enable();
- if (last)
+ if (last) {
+ /* nf ct hash resize happened, now clear the leftover. */
+ if ((struct nf_conn *)cb->args[1] == last)
+ cb->args[1] = 0;
+
nf_ct_put(last);
+ }
return skb->len;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 110/233] slub/memcg: cure the brainless abuse of sysfs attributes
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (96 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 087/233] netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 045/233] USB: hub: fix SS hub-descriptor handling Ben Hutchings
` (135 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Johannes Weiner, Thomas Gleixner, Christoph Hellwig,
David Rientjes, Steven Rostedt, Pekka Enberg, Linus Torvalds,
Peter Zijlstra, Christoph Lameter, Joonsoo Kim, Michal Hocko
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 478fe3037b2278d276d4cd9cd0ab06c4cb2e9b32 upstream.
memcg_propagate_slab_attrs() abuses the sysfs attribute file functions
to propagate settings from the root kmem_cache to a newly created
kmem_cache. It does that with:
attr->show(root, buf);
attr->store(new, buf, strlen(bug);
Aside of being a lazy and absurd hackery this is broken because it does
not check the return value of the show() function.
Some of the show() functions return 0 w/o touching the buffer. That
means in such a case the store function is called with the stale content
of the previous show(). That causes nonsense like invoking
kmem_cache_shrink() on a newly created kmem_cache. In the worst case it
would cause handing in an uninitialized buffer.
This should be rewritten proper by adding a propagate() callback to
those slub_attributes which must be propagated and avoid that insane
conversion to and from ASCII, but that's too large for a hot fix.
Check at least the return value of the show() function, so calling
store() with stale content is prevented.
Steven said:
"It can cause a deadlock with get_online_cpus() that has been uncovered
by recent cpu hotplug and lockdep changes that Thomas and Peter have
been doing.
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(cpu_hotplug.lock);
lock(slab_mutex);
lock(cpu_hotplug.lock);
lock(slab_mutex);
*** DEADLOCK ***"
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1705201244540.2255@nanos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reported-by: Steven Rostedt <rostedt@goodmis.org>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/slub.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5066,6 +5066,7 @@ static void memcg_propagate_slab_attrs(s
char mbuf[64];
char *buf;
struct slab_attribute *attr = to_slab_attr(slab_attrs[i]);
+ ssize_t len;
if (!attr || !attr->store || !attr->show)
continue;
@@ -5090,8 +5091,9 @@ static void memcg_propagate_slab_attrs(s
buf = buffer;
}
- attr->show(root_cache, buf);
- attr->store(s, buf, strlen(buf));
+ len = attr->show(root_cache, buf);
+ if (len > 0)
+ attr->store(s, buf, len);
}
if (buffer)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 045/233] USB: hub: fix SS hub-descriptor handling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (97 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 110/233] slub/memcg: cure the brainless abuse of sysfs attributes Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 096/233] net: ethernet: ax88796: don't call free_irq without request_irq first Ben Hutchings
` (134 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Alan Stern, Johan Hovold, John Youn
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 2c25a2c818023df64463aac3288a9f969491e507 upstream.
A SuperSpeed hub descriptor does not have any variable-length fields so
bail out when reading a short descriptor.
This avoids parsing and leaking two bytes of uninitialised slab data
through sysfs removable-attributes.
Fixes: dbe79bbe9dcb ("USB 3.0 Hub Changes")
Cc: John Youn <John.Youn@synopsys.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/hub.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -381,8 +381,12 @@ static int get_hub_descriptor(struct usb
USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB,
dtype << 8, 0, data, size,
USB_CTRL_GET_TIMEOUT);
- if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2))
+ if (hub_is_superspeed(hdev)) {
+ if (ret == size)
+ return ret;
+ } else if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) {
return ret;
+ }
}
return -EINVAL;
}
@@ -1301,7 +1305,7 @@ static int hub_configure(struct usb_hub
/* Request the entire hub descriptor.
* hub->descriptor can handle USB_MAXCHILDREN ports,
- * but the hub can/will return fewer bytes here.
+ * but a (non-SS) hub can/will return fewer bytes here.
*/
ret = get_hub_descriptor(hdev, hub->descriptor);
if (ret < 0) {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 096/233] net: ethernet: ax88796: don't call free_irq without request_irq first
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (98 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 045/233] USB: hub: fix SS hub-descriptor handling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 089/233] scsi: qla2xxx: don't disable a not previously enabled PCI device Ben Hutchings
` (133 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Uwe Kleine-König, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit 82533ad9a1ce3a7a6863849a552c2cc041b55e0d upstream.
The function ax_init_dev (which is called only from the driver's .probe
function) calls free_irq in the error path without having requested the
irq in the first place. So drop the free_irq call in the error path.
Fixes: 825a2ff1896e ("AX88796 network driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/8390/ax88796.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/8390/ax88796.c
+++ b/drivers/net/ethernet/8390/ax88796.c
@@ -786,13 +786,13 @@ static int ax_init_dev(struct net_device
ret = ax_mii_init(dev);
if (ret)
- goto out_irq;
+ goto err_out;
ax_NS8390_init(dev, 0);
ret = register_netdev(dev);
if (ret)
- goto out_irq;
+ goto err_out;
netdev_info(dev, "%dbit, irq %d, %lx, MAC: %pM\n",
ei_local->word16 ? 16 : 8, dev->irq, dev->base_addr,
@@ -800,9 +800,6 @@ static int ax_init_dev(struct net_device
return 0;
- out_irq:
- /* cleanup irq */
- free_irq(dev->irq, dev);
err_out:
return ret;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 089/233] scsi: qla2xxx: don't disable a not previously enabled PCI device
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (99 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 096/233] net: ethernet: ax88796: don't call free_irq without request_irq first Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 121/233] tags: honor COMPILED_SOURCE with apart output directory Ben Hutchings
` (132 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Bart Van Assche, Giridhar Malavali, Martin K. Petersen,
Johannes Thumshirn
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <jthumshirn@suse.de>
commit ddff7ed45edce4a4c92949d3c61cd25d229c4a14 upstream.
When pci_enable_device() or pci_enable_device_mem() fail in
qla2x00_probe_one() we bail out but do a call to
pci_disable_device(). This causes the dev_WARN_ON() in
pci_disable_device() to trigger, as the device wasn't enabled
previously.
So instead of taking the 'probe_out' error path we can directly return
*iff* one of the pci_enable_device() calls fails.
Additionally rename the 'probe_out' goto label's name to the more
descriptive 'disable_device'.
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Fixes: e315cd28b9ef ("[SCSI] qla2xxx: Code changes for qla data structure refactoring")
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Giridhar Malavali <giridhar.malavali@cavium.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2362,10 +2362,10 @@ qla2x00_probe_one(struct pci_dev *pdev,
if (mem_only) {
if (pci_enable_device_mem(pdev))
- goto probe_out;
+ return ret;
} else {
if (pci_enable_device(pdev))
- goto probe_out;
+ return ret;
}
/* This may fail but that's ok */
@@ -2375,7 +2375,7 @@ qla2x00_probe_one(struct pci_dev *pdev,
if (!ha) {
ql_log_pci(ql_log_fatal, pdev, 0x0009,
"Unable to allocate memory for ha.\n");
- goto probe_out;
+ goto disable_device;
}
ql_dbg_pci(ql_dbg_init, pdev, 0x000a,
"Memory allocated for ha=%p.\n", ha);
@@ -2972,7 +2972,7 @@ iospace_config_failed:
kfree(ha);
ha = NULL;
-probe_out:
+disable_device:
pci_disable_device(pdev);
return ret;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 121/233] tags: honor COMPILED_SOURCE with apart output directory
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (100 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 089/233] scsi: qla2xxx: don't disable a not previously enabled PCI device Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 048/233] mac80211: strictly check mesh address extension mode Ben Hutchings
` (131 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Masahiro Yamada, Robert Jarzmik
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Robert Jarzmik <robert.jarzmik@free.fr>
commit cbf52a3e6a8a92beec6e0c70abf4111cd8f8faf7 upstream.
When the kernel is compiled with an "O=" argument, the object files are
not in the source tree, but in the build tree.
This patch fixes O= build by looking for object files in the build tree.
Fixes: 923e02ecf3f8 ("scripts/tags.sh: Support compiled source")
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
scripts/tags.sh | 1 +
1 file changed, 1 insertion(+)
--- a/scripts/tags.sh
+++ b/scripts/tags.sh
@@ -106,6 +106,7 @@ all_compiled_sources()
case "$i" in
*.[cS])
j=${i/\.[cS]/\.o}
+ j="${j#$tree}"
if [ -e $j ]; then
echo $i
fi
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 048/233] mac80211: strictly check mesh address extension mode
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (101 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 121/233] tags: honor COMPILED_SOURCE with apart output directory Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 001/233] iio: proximity: as3935: recalibrate RCO after resume Ben Hutchings
` (130 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johannes Berg, Rajkumar Manoharan
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
commit 5667c86acf021e6dcf02584408b4484a273ac68f upstream.
Mesh forwarding path checks for address extension mode to fetch
appropriate proxied address and MPP address. Existing condition
that looks for 6 address format is not strict enough so that
frames with improper values are processed and invalid entries
are added into MPP table. Fix that by adding a stricter check before
processing the packet.
Per IEEE Std 802.11s-2011 spec. Table 7-6g1 lists address extension
mode 0x3 as reserved one. And also Table Table 9-13 does not specify
0x3 as valid address field.
Fixes: 9b395bc3be1c ("mac80211: verify that skb data is present")
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.16: add mesh_flags variable in ieee80211_data_to_8023(),
added separately upstream]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/rx.c | 3 ++-
net/wireless/util.c | 10 ++++++----
2 files changed, 8 insertions(+), 5 deletions(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2108,7 +2108,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
if (is_multicast_ether_addr(hdr->addr1)) {
mpp_addr = hdr->addr3;
proxied_addr = mesh_hdr->eaddr1;
- } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
+ } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+ MESH_FLAGS_AE_A5_A6) {
/* has_a4 already checked in ieee80211_rx_mesh_check */
mpp_addr = hdr->addr4;
proxied_addr = mesh_hdr->eaddr2;
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -401,12 +401,15 @@ int ieee80211_data_to_8023(struct sk_buf
if (iftype == NL80211_IFTYPE_MESH_POINT) {
struct ieee80211s_hdr *meshdr =
(struct ieee80211s_hdr *) (skb->data + hdrlen);
+ u8 mesh_flags;
+
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
- if (meshdr->flags & MESH_FLAGS_AE_A4)
+ mesh_flags = meshdr->flags & MESH_FLAGS_AE;
+ if (mesh_flags == MESH_FLAGS_AE_A4)
return -1;
- if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
+ if (mesh_flags == MESH_FLAGS_AE_A5_A6) {
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
dst, ETH_ALEN);
@@ -427,12 +430,15 @@ int ieee80211_data_to_8023(struct sk_buf
if (iftype == NL80211_IFTYPE_MESH_POINT) {
struct ieee80211s_hdr *meshdr =
(struct ieee80211s_hdr *) (skb->data + hdrlen);
+ u8 mesh_flags;
+
/* make sure meshdr->flags is on the linear part */
if (!pskb_may_pull(skb, hdrlen + 1))
return -1;
- if (meshdr->flags & MESH_FLAGS_AE_A5_A6)
+ mesh_flags = meshdr->flags & MESH_FLAGS_AE;
+ if (mesh_flags == MESH_FLAGS_AE_A5_A6)
return -1;
- if (meshdr->flags & MESH_FLAGS_AE_A4)
+ if (mesh_flags == MESH_FLAGS_AE_A4)
skb_copy_bits(skb, hdrlen +
offsetof(struct ieee80211s_hdr, eaddr1),
src, ETH_ALEN);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 001/233] iio: proximity: as3935: recalibrate RCO after resume
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (102 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 048/233] mac80211: strictly check mesh address extension mode Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 080/233] ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 Ben Hutchings
` (129 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Matt Ranostay, George McCollister, Jonathan Cameron
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <matt.ranostay@konsulko.com>
commit 6272c0de13abf1480f701d38288f28a11b4301c4 upstream.
According to the datasheet the RCO must be recalibrated
on every power-on-reset. Also remove mutex locking in the
calibration function since callers other than the probe
function (which doesn't need it) will have a lock.
Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support")
Cc: George McCollister <george.mccollister@gmail.com>
Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/iio/proximity/as3935.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -263,8 +263,6 @@ static irqreturn_t as3935_interrupt_hand
static void calibrate_as3935(struct as3935_state *st)
{
- mutex_lock(&st->lock);
-
/* mask disturber interrupt bit */
as3935_write(st, AS3935_INT, BIT(5));
@@ -274,8 +272,6 @@ static void calibrate_as3935(struct as39
mdelay(2);
as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV));
-
- mutex_unlock(&st->lock);
}
#ifdef CONFIG_PM_SLEEP
@@ -312,6 +308,8 @@ static int as3935_resume(struct spi_devi
val &= ~AS3935_AFE_PWR_BIT;
ret = as3935_write(st, AS3935_AFE_GAIN, val);
+ calibrate_as3935(st);
+
err_resume:
mutex_unlock(&st->lock);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 080/233] ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (103 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 001/233] iio: proximity: as3935: recalibrate RCO after resume Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 115/233] alarmtimer: Prevent overflow of relative timers Ben Hutchings
` (128 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alexander Tsoy, Takashi Iwai
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Tsoy <alexander@tsoy.me>
commit 1fc2e41f7af4572b07190f9dec28396b418e9a36 upstream.
This model is actually called 92XXM2-8 in Windows driver. But since pin
configs for M22 and M28 are identical, just reuse M22 quirk.
Fixes external microphone (tested) and probably docking station ports
(not tested).
Signed-off-by: Alexander Tsoy <alexander@tsoy.me>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/pci/hda/patch_sigmatel.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1570,6 +1570,8 @@ static const struct snd_pci_quirk stac92
"Dell Inspiron 1501", STAC_9200_DELL_M26),
SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6,
"unknown Dell", STAC_9200_DELL_M26),
+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201,
+ "Dell Latitude D430", STAC_9200_DELL_M22),
/* Panasonic */
SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC),
/* Gateway machines needs EAPD to be set on resume */
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 115/233] alarmtimer: Prevent overflow of relative timers
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (104 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 080/233] ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 149/233] HID: microsoft: Add Surface 4 type cover pro 4 not JP versions Ben Hutchings
` (127 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Peter Zijlstra, John Stultz, syzkaller, Kostya Serebryany,
Andrey Konovalov, Thomas Gleixner, Dmitry Vyukov
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit f4781e76f90df7aec400635d73ea4c35ee1d4765 upstream.
Andrey reported a alartimer related RCU stall while fuzzing the kernel with
syzkaller.
The reason for this is an overflow in ktime_add() which brings the
resulting time into negative space and causes immediate expiry of the
timer. The following rearm with a small interval does not bring the timer
back into positive space due to the same issue.
This results in a permanent firing alarmtimer which hogs the CPU.
Use ktime_add_safe() instead which detects the overflow and clamps the
result to KTIME_SEC_MAX.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Kostya Serebryany <kcc@google.com>
Cc: syzkaller <syzkaller@googlegroups.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/r/20170530211655.802921648@linutronix.de
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/time/alarmtimer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -342,7 +342,7 @@ int alarm_start_relative(struct alarm *a
{
struct alarm_base *base = &alarm_bases[alarm->type];
- start = ktime_add(start, base->gettime());
+ start = ktime_add_safe(start, base->gettime());
return alarm_start(alarm, start);
}
EXPORT_SYMBOL_GPL(alarm_start_relative);
@@ -428,7 +428,7 @@ u64 alarm_forward(struct alarm *alarm, k
overrun++;
}
- alarm->node.expires = ktime_add(alarm->node.expires, interval);
+ alarm->node.expires = ktime_add_safe(alarm->node.expires, interval);
return overrun;
}
EXPORT_SYMBOL_GPL(alarm_forward);
@@ -620,7 +620,7 @@ static int alarm_timer_set(struct k_itim
ktime_t now;
now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
- exp = ktime_add(now, exp);
+ exp = ktime_add_safe(now, exp);
}
alarm_start(&timr->it.alarm.alarmtimer, exp);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 149/233] HID: microsoft: Add Surface 4 type cover pro 4 not JP versions
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (105 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 115/233] alarmtimer: Prevent overflow of relative timers Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 069/233] batman-adv: Fix rx packet/bytes stats on local ARP reply Ben Hutchings
` (126 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Daniel Keller, Jiri Kosina, Jeff Farthing
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Keller <daniel.keller@gcd.de>
commit 2ae3986b84e9d325bc92a1efbcf0c6b0f5016b35 upstream.
Adding support for not JP versions of the Microsoft Surface 4 Type Cover Pro
[jkosina@suse.cz: The identical patch has been sent by Jeff Farthing, so I am
including his signoff as well]
Signed-off-by: Jeff Farthing <jeff@jfarthing.com>
Signed-off-by: Daniel Keller <daniel.keller@gcd.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 4 ++++
drivers/hid/hid-ids.h | 2 ++
drivers/hid/hid-microsoft.c | 4 ++++
drivers/hid/usbhid/hid-quirks.c | 2 ++
4 files changed, 12 insertions(+)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -707,6 +707,8 @@ static void hid_scan_collection(struct h
(hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_4 ||
+ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_2 ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP ||
hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 ||
hid->product == USB_DEVICE_ID_MS_POWER_COVER) &&
@@ -1864,6 +1866,8 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -678,6 +678,8 @@
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 0x07dc
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 0x07e2
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_4 0x07e4
+#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_2 0x07e8
#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP 0x07e9
#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07de
#define USB_DEVICE_ID_MS_POWER_COVER 0x07da
--- a/drivers/hid/hid-microsoft.c
+++ b/drivers/hid/hid-microsoft.c
@@ -282,6 +282,10 @@ static const struct hid_device_id ms_dev
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP),
.driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4),
+ .driver_data = MS_HIDINPUT },
+ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_2),
+ .driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP),
.driver_data = MS_HIDINPUT },
{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3),
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -103,6 +103,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_4_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 069/233] batman-adv: Fix rx packet/bytes stats on local ARP reply
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (106 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 149/233] HID: microsoft: Add Surface 4 type cover pro 4 not JP versions Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 143/233] HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk Ben Hutchings
` (125 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sven Eckelmann, Simon Wunderlich
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 36d4d68cd658d914ef73ac845705c4a89e7d9e2f upstream.
The stats are generated by batadv_interface_stats and must not be stored
directly in the net_device stats member variable. The batadv_priv
bat_counters information is assembled when ndo_get_stats is called. The
stats previously stored in net_device::stats is then overwritten.
The batman-adv counters must therefore be increased when an ARP packet is
answered locally via the distributed arp table.
Fixes: c384ea3ec930 ("batman-adv: Distributed ARP Table - add snooping functions for ARP messages")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/batman-adv/distributed-arp-table.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -969,8 +969,9 @@ bool batadv_dat_snoop_outgoing_arp_reque
skb_reset_mac_header(skb_new);
skb_new->protocol = eth_type_trans(skb_new,
bat_priv->soft_iface);
- bat_priv->stats.rx_packets++;
- bat_priv->stats.rx_bytes += skb->len + ETH_HLEN + hdr_size;
+ batadv_inc_counter(bat_priv, BATADV_CNT_RX);
+ batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES,
+ skb->len + ETH_HLEN + hdr_size);
bat_priv->soft_iface->last_rx = jiffies;
netif_rx(skb_new);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 143/233] HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (107 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 069/233] batman-adv: Fix rx packet/bytes stats on local ARP reply Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 105/233] btrfs: use correct types for page indices in btrfs_page_exists_in_range Ben Hutchings
` (124 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jiri Kosina, Nazar Mokrynskyi, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nazar Mokrynskyi <nazar@mokrynskyi.com>
commit 567a44ecb44eb2584ddb93e962cfb133ce77e0bb upstream.
Needed for v2 of the device firmware, otherwise kernel will stuck for few
seconds and throw "usb_submit_urb(ctrl) failed: -1" early on system boot.
Signed-off-by: Nazar Mokrynskyi <nazar@mokrynskyi.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -243,6 +243,7 @@
#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
#define USB_VENDOR_ID_CREATIVELABS 0x041e
+#define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51 0x322c
#define USB_DEVICE_ID_PRODIKEYS_PCMIDI 0x2801
#define USB_VENDOR_ID_CVTOUCH 0x1ff7
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,6 +72,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 105/233] btrfs: use correct types for page indices in btrfs_page_exists_in_range
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (108 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 143/233] HID: Fix boot delay for Creative SB Omni Surround 5.1 with quirk Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 018/233] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory Ben Hutchings
` (123 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Liu Bo, David Sterba
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <dsterba@suse.com>
commit cc2b702c52094b637a351d7491ac5200331d0445 upstream.
Variables start_idx and end_idx are supposed to hold a page index
derived from the file offsets. The int type is not the right one though,
offsets larger than 1 << 44 will get silently trimmed off the high bits.
(1 << 44 is 16TiB)
What can go wrong, if start is below the boundary and end gets trimmed:
- if there's a page after start, we'll find it (radix_tree_gang_lookup_slot)
- the final check "if (page->index <= end_idx)" will unexpectedly fail
The function will return false, ie. "there's no page in the range",
although there is at least one.
btrfs_page_exists_in_range is used to prevent races in:
* in hole punching, where we make sure there are not pages in the
truncated range, otherwise we'll wait for them to finish and redo
truncation, but we're going to replace the pages with holes anyway so
the only problem is the intermediate state
* lock_extent_direct: we want to make sure there are no pages before we
lock and start DIO, to prevent stale data reads
For practical occurence of the bug, there are several constaints. The
file must be quite large, the affected range must cross the 16TiB
boundary and the internal state of the file pages and pending operations
must match. Also, we must not have started any ordered data in the
range, otherwise we don't even reach the buggy function check.
DIO locking tries hard in several places to avoid deadlocks with
buffered IO and avoids waiting for ranges. The worst consequence seems
to be stale data read.
CC: Liu Bo <bo.li.liu@oracle.com>
Fixes: fc4adbff823f7 ("btrfs: Drop EXTENT_UPTODATE check in hole punching and direct locking")
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/inode.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -6821,8 +6821,8 @@ bool btrfs_page_exists_in_range(struct i
int found = false;
void **pagep = NULL;
struct page *page = NULL;
- int start_idx;
- int end_idx;
+ unsigned long start_idx;
+ unsigned long end_idx;
start_idx = start >> PAGE_CACHE_SHIFT;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 018/233] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (109 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 105/233] btrfs: use correct types for page indices in btrfs_page_exists_in_range Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 147/233] HID: add quirk for Akai MIDImix Ben Hutchings
` (122 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Malcolm Priestley
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit baabd567f87be05330faa5140f72a91960e7405a upstream.
The driver attempts to alter memory that is mapped to PCI device.
This is because tx_fwinfo_8190pci points to skb->data
Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1172,8 +1172,7 @@ void rtl8192_tx_fill_desc(struct net_de
struct cb_desc *cb_desc, struct sk_buff *skb)
{
struct r8192_priv *priv = rtllib_priv(dev);
- dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
- PCI_DMA_TODEVICE);
+ dma_addr_t mapping;
struct tx_fwinfo_8190pci *pTxFwInfo = NULL;
pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
memset(pTxFwInfo, 0, sizeof(struct tx_fwinfo_8190pci));
@@ -1184,8 +1183,6 @@ void rtl8192_tx_fill_desc(struct net_de
pTxFwInfo->TxRate,
cb_desc);
- if (pci_dma_mapping_error(priv->pdev, mapping))
- RT_TRACE(COMP_ERR, "DMA Mapping error\n");
if (cb_desc->bAMPDUEnable) {
pTxFwInfo->AllowAggregation = 1;
pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1220,6 +1217,14 @@ void rtl8192_tx_fill_desc(struct net_de
}
memset((u8 *)pdesc, 0, 12);
+
+ mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+ PCI_DMA_TODEVICE);
+ if (pci_dma_mapping_error(priv->pdev, mapping)) {
+ RT_TRACE(COMP_ERR, "DMA Mapping error\n");
+ return;
+ }
+
pdesc->LINIP = 0;
pdesc->CmdInit = 1;
pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 147/233] HID: add quirk for Akai MIDImix.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (110 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 018/233] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 114/233] drivers: char: mem: Fix wraparound check to allow mappings up to the end Ben Hutchings
` (121 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Steinar H. Gunderson, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>
commit 4973ca9a01e2354b159acedec1b9b8eb8de02ab7 upstream.
The Akai MIDImix (09e8:0031) is a MIDI fader controller that speaks
regular MIDI and works well with Linux. However, initialization gets
delayed due to reports timeout:
[3643645.631124] hid-generic 0003:09E8:0031.0020: timeout initializing reports
[3643645.632416] hid-generic 0003:09E8:0031.0020: hiddev0: USB HID v1.11 Device [AKAI MIDI Mix] on usb-0000:00:14.0-2/input0
Adding "usbhid.quirks=0x09e8:0x0031:0x20000000" on the kernel
command line makes the issues go away.
Signed-off-by: Steinar H. Gunderson <sgunderson@bigfoot.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -64,6 +64,9 @@
#define USB_VENDOR_ID_AKAI 0x2011
#define USB_DEVICE_ID_AKAI_MPKMINI2 0x0715
+#define USB_VENDOR_ID_AKAI_09E8 0x09E8
+#define USB_DEVICE_ID_AKAI_09E8_MIDIMIX 0x0031
+
#define USB_VENDOR_ID_ALCOR 0x058f
#define USB_DEVICE_ID_ALCOR_USBRS232 0x9720
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -56,6 +56,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 114/233] drivers: char: mem: Fix wraparound check to allow mappings up to the end
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (111 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 147/233] HID: add quirk for Akai MIDImix Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 019/233] staging: rtl8192e: fix 2 byte alignment of register BSSIDR Ben Hutchings
` (120 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nico Huber, Julius Werner, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <jwerner@chromium.org>
commit 32829da54d9368103a2f03269a5120aa9ee4d5da upstream.
A recent fix to /dev/mem prevents mappings from wrapping around the end
of physical address space. However, the check was written in a way that
also prevents a mapping reaching just up to the end of physical address
space, which may be a valid use case (especially on 32-bit systems).
This patch fixes it by checking the last mapped address (instead of the
first address behind that) for overflow.
Fixes: b299cde245 ("drivers: char: mem: Check for address space wraparound with mmap()")
Reported-by: Nico Huber <nico.h@gmx.de>
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/char/mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -332,7 +332,7 @@ static int mmap_mem(struct file *file, s
phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
/* It's illegal to wrap around the end of the physical address space. */
- if (offset + (phys_addr_t)size < offset)
+ if (offset + (phys_addr_t)size - 1 < offset)
return -EINVAL;
if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 019/233] staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (112 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 114/233] drivers: char: mem: Fix wraparound check to allow mappings up to the end Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 024/233] KVM: x86: Fix load damaged SSEx MXCSR register Ben Hutchings
` (119 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Malcolm Priestley, Greg Kroah-Hartman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Malcolm Priestley <tvboxspy@gmail.com>
commit 867510bde14e7b7fc6dd0f50b48f6753cfbd227a upstream.
BSSIDR has two byte alignment on PCI ioremap correct the write
by swapping to 16 bits first.
This fixes a problem that the device associates fail because
the filter is not set correctly.
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: keep using write_nic_{word,dword}()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -100,8 +100,9 @@ void rtl8192e_SetHwReg(struct net_device
switch (variable) {
case HW_VAR_BSSID:
- write_nic_dword(dev, BSSIDR, ((u32 *)(val))[0]);
- write_nic_word(dev, BSSIDR+2, ((u16 *)(val+2))[0]);
+ /* BSSIDR 2 byte alignment */
+ write_nic_word(dev, BSSIDR, *(u16 *)val);
+ write_nic_dword(dev, BSSIDR + 2, *(u32 *)(val + 2));
break;
case HW_VAR_MEDIA_STATUS:
@@ -965,8 +966,8 @@ static void rtl8192_net_update(struct ne
rtl8192_config_rate(dev, &rate_config);
priv->dot11CurrentPreambleMode = PREAMBLE_AUTO;
priv->basic_rate = rate_config &= 0x15f;
- write_nic_dword(dev, BSSIDR, ((u32 *)net->bssid)[0]);
- write_nic_word(dev, BSSIDR+4, ((u16 *)net->bssid)[2]);
+ write_nic_word(dev, BSSIDR, *(u16 *)net->bssid);
+ write_nic_dword(dev, BSSIDR + 2, *(u32 *)(net->bssid + 2));
if (priv->rtllib->iw_mode == IW_MODE_ADHOC) {
write_nic_word(dev, ATIMWND, 2);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 024/233] KVM: x86: Fix load damaged SSEx MXCSR register
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (113 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 019/233] staging: rtl8192e: fix 2 byte alignment of register BSSIDR Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 055/233] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Ben Hutchings
` (118 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Radim Krčmář,
Paolo Bonzini, Wanpeng Li, Andrey Konovalov
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit a575813bfe4bc15aba511a5e91e61d242bff8b9d upstream.
Reported by syzkaller:
BUG: unable to handle kernel paging request at ffffffffc07f6a2e
IP: report_bug+0x94/0x120
PGD 348e12067
P4D 348e12067
PUD 348e14067
PMD 3cbd84067
PTE 80000003f7e87161
Oops: 0003 [#1] SMP
CPU: 2 PID: 7091 Comm: kvm_load_guest_ Tainted: G OE 4.11.0+ #8
task: ffff92fdfb525400 task.stack: ffffbda6c3d04000
RIP: 0010:report_bug+0x94/0x120
RSP: 0018:ffffbda6c3d07b20 EFLAGS: 00010202
do_trap+0x156/0x170
do_error_trap+0xa3/0x170
? kvm_load_guest_fpu.part.175+0x12a/0x170 [kvm]
? mark_held_locks+0x79/0xa0
? retint_kernel+0x10/0x10
? trace_hardirqs_off_thunk+0x1a/0x1c
do_invalid_op+0x20/0x30
invalid_op+0x1e/0x30
RIP: 0010:kvm_load_guest_fpu.part.175+0x12a/0x170 [kvm]
? kvm_load_guest_fpu.part.175+0x1c/0x170 [kvm]
kvm_arch_vcpu_ioctl_run+0xed6/0x1b70 [kvm]
kvm_vcpu_ioctl+0x384/0x780 [kvm]
? kvm_vcpu_ioctl+0x384/0x780 [kvm]
? sched_clock+0x13/0x20
? __do_page_fault+0x2a0/0x550
do_vfs_ioctl+0xa4/0x700
? up_read+0x1f/0x40
? __do_page_fault+0x2a0/0x550
SyS_ioctl+0x79/0x90
entry_SYSCALL_64_fastpath+0x23/0xc2
SDM mentioned that "The MXCSR has several reserved bits, and attempting to write
a 1 to any of these bits will cause a general-protection exception(#GP) to be
generated". The syzkaller forks' testcase overrides xsave area w/ random values
and steps on the reserved bits of MXCSR register. The damaged MXCSR register
values of guest will be restored to SSEx MXCSR register before vmentry. This
patch fixes it by catching userspace override MXCSR register reserved bits w/
random values and bails out immediately.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kernel/i387.c | 1 +
arch/x86/kvm/x86.c | 9 +++++++--
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/i387.c
+++ b/arch/x86/kernel/i387.c
@@ -115,6 +115,7 @@ void unlazy_fpu(struct task_struct *tsk)
EXPORT_SYMBOL(unlazy_fpu);
unsigned int mxcsr_feature_mask __read_mostly = 0xffffffffu;
+EXPORT_SYMBOL_GPL(mxcsr_feature_mask);
unsigned int xstate_size;
EXPORT_SYMBOL_GPL(xstate_size);
static struct i387_fxsave_struct fx_scratch;
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3110,11 +3110,14 @@ static void kvm_vcpu_ioctl_x86_get_xsave
}
}
+#define XSAVE_MXCSR_OFFSET 24
+
static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu,
struct kvm_xsave *guest_xsave)
{
u64 xstate_bv =
*(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)];
+ u32 mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)];
if (cpu_has_xsave) {
/*
@@ -3122,12 +3125,14 @@ static int kvm_vcpu_ioctl_x86_set_xsave(
* CPUID leaf 0xD, index 0, EDX:EAX. This is for compatibility
* with old userspace.
*/
- if (xstate_bv & ~kvm_supported_xcr0())
+ if (xstate_bv & ~kvm_supported_xcr0() ||
+ mxcsr & ~mxcsr_feature_mask)
return -EINVAL;
memcpy(&vcpu->arch.guest_fpu.state->xsave,
guest_xsave->region, vcpu->arch.guest_xstate_size);
} else {
- if (xstate_bv & ~XSTATE_FPSSE)
+ if (xstate_bv & ~XSTATE_FPSSE ||
+ mxcsr & ~mxcsr_feature_mask)
return -EINVAL;
memcpy(&vcpu->arch.guest_fpu.state->fxsave,
guest_xsave->region, sizeof(struct i387_fxsave_struct));
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 055/233] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (114 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 024/233] KVM: x86: Fix load damaged SSEx MXCSR register Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 093/233] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() Ben Hutchings
` (117 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Mathias Nyman, Peter Chen
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <peter.chen@nxp.com>
commit 7480d912d549f414e0ce39331870899e89a5598c upstream.
According to xHCI ch4.20 Scratchpad Buffers, the Scratchpad
Buffer needs to be zeroed.
...
The following operations take place to allocate
Scratchpad Buffers to the xHC:
...
b. Software clears the Scratchpad Buffer to '0'
Signed-off-by: Peter Chen <peter.chen@nxp.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1709,7 +1709,7 @@ static int scratchpad_alloc(struct xhci_
xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma);
for (i = 0; i < num_sp; i++) {
dma_addr_t dma;
- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma,
+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma,
flags);
if (!buf)
goto fail_sp5;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 093/233] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (115 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 055/233] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 091/233] drm/radeon/ci: disable mclk switching for high refresh rates (v2) Ben Hutchings
` (116 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jan Kara, Darrick J. Wong, Eryu Guan
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eryu Guan <eguan@redhat.com>
commit 8affebe16d79ebefb1d9d6d56a46dc89716f9453 upstream.
xfs_find_get_desired_pgoff() is used to search for offset of hole or
data in page range [index, end] (both inclusive), and the max number
of pages to search should be at least one, if end == index.
Otherwise the only page is missed and no hole or data is found,
which is not correct.
When block size is smaller than page size, this can be demonstrated
by preallocating a file with size smaller than page size and writing
data to the last block. E.g. run this xfs_io command on a 1k block
size XFS on x86_64 host.
# xfs_io -fc "falloc 0 3k" -c "pwrite 2k 1k" \
-c "seek -d 0" /mnt/xfs/testfile
wrote 1024/1024 bytes at offset 2048
1 KiB, 1 ops; 0.0000 sec (33.675 MiB/sec and 34482.7586 ops/sec)
Whence Result
DATA EOF
Data at offset 2k was missed, and lseek(2) returned ENXIO.
This is uncovered by generic/285 subtest 07 and 08 on ppc64 host,
where pagesize is 64k. Because a recent change to generic/285
reduced the preallocated file size to smaller than 64k.
Signed-off-by: Eryu Guan <eguan@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/xfs/xfs_file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1052,7 +1052,7 @@ xfs_find_get_desired_pgoff(
unsigned nr_pages;
unsigned int i;
- want = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+ want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
want);
/*
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 091/233] drm/radeon/ci: disable mclk switching for high refresh rates (v2)
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (116 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 093/233] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 067/233] watchdog: bcm281xx: Fix use of uninitialized spinlock Ben Hutchings
` (115 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Christian König, Alex Deucher
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 58d7e3e427db1bd68f33025519a9468140280a75 upstream.
Even if the vblank period would allow it, it still seems to
be problematic on some cards.
v2: fix logic inversion (Nils)
bug: https://bugs.freedesktop.org/show_bug.cgi?id=96868
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/ci_dpm.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -733,6 +733,12 @@ bool ci_dpm_vblank_too_short(struct rade
u32 vblank_time = r600_dpm_get_vblank_time(rdev);
u32 switch_limit = pi->mem_gddr5 ? 450 : 300;
+ /* disable mclk switching if the refresh is >120Hz, even if the
+ * blanking period would allow it
+ */
+ if (r600_dpm_get_vrefresh(rdev) > 120)
+ return true;
+
if (vblank_time < switch_limit)
return true;
else
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 067/233] watchdog: bcm281xx: Fix use of uninitialized spinlock.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (117 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 091/233] drm/radeon/ci: disable mclk switching for high refresh rates (v2) Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 065/233] watchdog: pcwd_usb: fix NULL-deref at probe Ben Hutchings
` (114 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Florian Fainelli, Guenter Roeck, Eric Anholt, Wim Van Sebroeck
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Anholt <eric@anholt.net>
commit fedf266f9955d9a019643cde199a2fd9a0259f6f upstream.
The bcm_kona_wdt_set_resolution_reg() call takes the spinlock, so
initialize it earlier. Fixes a warning at boot with lock debugging
enabled.
Fixes: 6adb730dc208 ("watchdog: bcm281xx: Watchdog Driver")
Signed-off-by: Eric Anholt <eric@anholt.net>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/watchdog/bcm_kona_wdt.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/watchdog/bcm_kona_wdt.c
+++ b/drivers/watchdog/bcm_kona_wdt.c
@@ -299,6 +299,8 @@ static int bcm_kona_wdt_probe(struct pla
if (!wdt)
return -ENOMEM;
+ spin_lock_init(&wdt->lock);
+
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
wdt->base = devm_ioremap_resource(dev, res);
if (IS_ERR(wdt->base))
@@ -311,7 +313,6 @@ static int bcm_kona_wdt_probe(struct pla
return ret;
}
- spin_lock_init(&wdt->lock);
platform_set_drvdata(pdev, wdt);
watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 065/233] watchdog: pcwd_usb: fix NULL-deref at probe
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (118 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 067/233] watchdog: bcm281xx: Fix use of uninitialized spinlock Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter Ben Hutchings
` (113 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Wim Van Sebroeck, Johan Hovold, Guenter Roeck
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/watchdog/pcwd_usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_int
return -ENODEV;
}
+ if (iface_desc->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
/* check out the endpoint: it has to be Interrupt & IN */
endpoint = &iface_desc->endpoint[0].desc;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (119 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 065/233] watchdog: pcwd_usb: fix NULL-deref at probe Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-10 11:33 ` Tomasz Kramkowski
2017-09-09 21:47 ` [PATCH 3.16 138/233] HID: usbhid: add Logitech G710+ keyboard quirk NOGET Ben Hutchings
` (112 subsequent siblings)
233 siblings, 1 reply; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jiri Kosina, Tomasz Kramkowski, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Kramkowski <tk@the-tk.com>
commit 9547837bdccb4af127528b36a73377150658b4ac upstream.
The (1292:4745) Innomedia INNEX GENESIS/ATARI adapter needs
HID_QUIRK_MULTI_INPUT to split the device up into two controllers
instead of inputs from both being merged into one.
Signed-off-by: Tomasz Kramkowski <tk@the-tk.com>
Acked-By: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -522,6 +522,9 @@
#define USB_VENDOR_ID_IRTOUCHSYSTEMS 0x6615
#define USB_DEVICE_ID_IRTOUCH_INFRARED_USB 0x0070
+#define USB_VENDOR_ID_INNOMEDIA 0x1292
+#define USB_DEVICE_ID_INNEX_GENESIS_ATARI 0x4745
+
#define USB_VENDOR_ID_JABRA 0x0b0e
#define USB_DEVICE_ID_JABRA_SPEAK_410 0x0412
#define USB_DEVICE_ID_JABRA_SPEAK_510 0x0420
@@ -545,6 +548,7 @@
#define USB_DEVICE_ID_KEYTOUCH_IEC 0x3333
#define USB_VENDOR_ID_KYE 0x0458
+
#define USB_DEVICE_ID_KYE_ERGO_525V 0x0087
#define USB_DEVICE_ID_GENIUS_GILA_GAMING_MOUSE 0x0138
#define USB_DEVICE_ID_GENIUS_MANTICORE 0x0153
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -169,6 +169,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_MULTIPLE_1781, USB_DEVICE_ID_RAPHNET_4NES4SNES_OLD, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_INNOMEDIA, USB_DEVICE_ID_INNEX_GENESIS_ATARI, HID_QUIRK_MULTI_INPUT },
{ 0, 0 }
};
^ permalink raw reply [flat|nested] 237+ messages in thread* Re: [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
2017-09-09 21:47 ` [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter Ben Hutchings
@ 2017-09-10 11:33 ` Tomasz Kramkowski
2017-09-15 17:09 ` Ben Hutchings
0 siblings, 1 reply; 237+ messages in thread
From: Tomasz Kramkowski @ 2017-09-10 11:33 UTC (permalink / raw)
To: Ben Hutchings
Cc: linux-kernel, stable, akpm, Jiri Kosina, Benjamin Tissoires,
Valtteri Heikkilä
On Sat, Sep 09, 2017 at 10:47:14PM +0100, Ben Hutchings wrote:
> 3.16.48-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Tomasz Kramkowski <tk@the-tk.com>
>
> commit 9547837bdccb4af127528b36a73377150658b4ac upstream.
>
> The (1292:4745) Innomedia INNEX GENESIS/ATARI adapter needs
> HID_QUIRK_MULTI_INPUT to split the device up into two controllers
> instead of inputs from both being merged into one.
>
> Signed-off-by: Tomasz Kramkowski <tk@the-tk.com>
> Acked-By: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> [bwh: Backported to 3.16: adjust context]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---- snip ----
Hi,
Unfortunately this quirk will not make the device mentioned in the commit
work on its own.
This fix was an additional fix on top of another more fundamental fix
which made the device, and others like it, operational. This fix was
included in commit:
Valtteri Heikkilä (1):
HID: reject input outside logical range only if null state is set
[3f3752705dbd50b66b66ad7b4d54fe33d2f746ed]
This patch does not appear in your shortlog for this submission and it
doesn't appear when I search linux-stable as of v3.16.47.
Additionally, the following patch might also be helpful in ensuring
the correct operation of the aforementioned device (and other devices
like it):
Tomasz Kramkowski (1):
HID: clamp input to logical range if no null state
[c3883fe06488a483658ba5d849b70e49bee15e7c]
However, if the above patches are not appropriate for backporting
to stable then I have absolutely nothing against my patch not being
backported either. My patch alone will not make the device operate in
a useful manner.
Thank you for considering my patch for the 3.16 stable tree and have a
nice day,
--
Tomasz Kramkowski
^ permalink raw reply [flat|nested] 237+ messages in thread* Re: [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter
2017-09-10 11:33 ` Tomasz Kramkowski
@ 2017-09-15 17:09 ` Ben Hutchings
0 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-15 17:09 UTC (permalink / raw)
To: Tomasz Kramkowski
Cc: linux-kernel, stable, akpm, Jiri Kosina, Benjamin Tissoires,
Valtteri Heikkilä
[-- Attachment #1: Type: text/plain, Size: 2503 bytes --]
On Sun, 2017-09-10 at 12:33 +0100, Tomasz Kramkowski wrote:
> On Sat, Sep 09, 2017 at 10:47:14PM +0100, Ben Hutchings wrote:
> > 3.16.48-rc1 review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Tomasz Kramkowski <tk@the-tk.com>
> >
> > commit 9547837bdccb4af127528b36a73377150658b4ac upstream.
> >
> > The (1292:4745) Innomedia INNEX GENESIS/ATARI adapter needs
> > HID_QUIRK_MULTI_INPUT to split the device up into two controllers
> > instead of inputs from both being merged into one.
> >
> > Signed-off-by: Tomasz Kramkowski <tk@the-tk.com>
> > Acked-By: Benjamin Tissoires <benjamin.tissoires@redhat.com>
> > Signed-off-by: Jiri Kosina <jkosina@suse.cz>
> > [bwh: Backported to 3.16: adjust context]
> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> > ---- snip ----
>
> Hi,
>
> Unfortunately this quirk will not make the device mentioned in the commit
> work on its own.
>
> This fix was an additional fix on top of another more fundamental fix
> which made the device, and others like it, operational.
OK, I'm dropping this now and will consider adding the complete set of
fixes in a later update. Perhaps you could send this list as a new
message to stable@vger.kernel.org if you're interested in adding
support for this device to stable branches.
Ben.
> This fix was included in commit:
>
> Valtteri Heikkilä (1):
> HID: reject input outside logical range only if null state is set
> [3f3752705dbd50b66b66ad7b4d54fe33d2f746ed]
>
> This patch does not appear in your shortlog for this submission and it
> doesn't appear when I search linux-stable as of v3.16.47.
>
> Additionally, the following patch might also be helpful in ensuring
> the correct operation of the aforementioned device (and other devices
> like it):
>
> Tomasz Kramkowski (1):
> HID: clamp input to logical range if no null state
> [c3883fe06488a483658ba5d849b70e49bee15e7c]
>
> However, if the above patches are not appropriate for backporting
> to stable then I have absolutely nothing against my patch not being
> backported either. My patch alone will not make the device operate in
> a useful manner.
>
> Thank you for considering my patch for the 3.16 stable tree and have a
> nice day,
>
--
Ben Hutchings
Kids! Bringing about Armageddon can be dangerous. Do not attempt it
in
your own home. - Terry Pratchett and Neil Gaiman, `Good Omens'
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 237+ messages in thread
* [PATCH 3.16 138/233] HID: usbhid: add Logitech G710+ keyboard quirk NOGET
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (120 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 153/233] HID: usbhid: add quirk for innomedia INNEX GENESIS/ATARI adapter Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 073/233] ext4: fix SEEK_HOLE Ben Hutchings
` (111 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jimmy Berry, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Berry <jimmy@boombatower.com>
commit 0d51571d51ea8eb72b903b2a4f3f43a38e7bc718 upstream.
Without quirk keyboard repeats '6' until volume control is used since it
indicates the key is pressed without ever releasing.
Signed-off-by: Jimmy Berry <jimmy@boombatower.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -591,6 +591,7 @@
#define USB_DEVICE_ID_LOGITECH_HARMONY_FIRST 0xc110
#define USB_DEVICE_ID_LOGITECH_HARMONY_LAST 0xc14f
#define USB_DEVICE_ID_LOGITECH_HARMONY_PS3 0x0306
+#define USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS 0xc24d
#define USB_DEVICE_ID_LOGITECH_MOUSE_C01A 0xc01a
#define USB_DEVICE_ID_LOGITECH_MOUSE_C05A 0xc05a
#define USB_DEVICE_ID_LOGITECH_MOUSE_C06A 0xc06a
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -85,6 +85,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_G710_PLUS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 073/233] ext4: fix SEEK_HOLE
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (121 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 138/233] HID: usbhid: add Logitech G710+ keyboard quirk NOGET Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 038/233] USB: core: replace %p with %pK Ben Hutchings
` (110 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Zheng Liu, Theodore Ts'o, Jan Kara
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 7d95eddf313c88b24f99d4ca9c2411a4b82fef33 upstream.
Currently, SEEK_HOLE implementation in ext4 may both return that there's
a hole at some offset although that offset already has data and skip
some holes during a search for the next hole. The first problem is
demostrated by:
xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "seek -h 0" file
wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (2.054 GiB/sec and 538461.5385 ops/sec)
Whence Result
HOLE 0
Where we can see that SEEK_HOLE wrongly returned offset 0 as containing
a hole although we have written data there. The second problem can be
demonstrated by:
xfs_io -c "falloc 0 256k" -c "pwrite 0 56k" -c "pwrite 128k 8k"
-c "seek -h 0" file
wrote 57344/57344 bytes at offset 0
56 KiB, 14 ops; 0.0000 sec (1.978 GiB/sec and 518518.5185 ops/sec)
wrote 8192/8192 bytes at offset 131072
8 KiB, 2 ops; 0.0000 sec (2 GiB/sec and 500000.0000 ops/sec)
Whence Result
HOLE 139264
Where we can see that hole at offsets 56k..128k has been ignored by the
SEEK_HOLE call.
The underlying problem is in the ext4_find_unwritten_pgoff() which is
just buggy. In some cases it fails to update returned offset when it
finds a hole (when no pages are found or when the first found page has
higher index than expected), in some cases conditions for detecting hole
are just missing (we fail to detect a situation where indices of
returned pages are not contiguous).
Fix ext4_find_unwritten_pgoff() to properly detect non-contiguous page
indices and also handle all cases where we got less pages then expected
in one place and handle it properly there.
Fixes: c8c0df241cc2719b1262e627f999638411934f60
CC: Zheng Liu <wenqing.lz@taobao.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/file.c | 50 ++++++++++++++------------------------------------
1 file changed, 14 insertions(+), 36 deletions(-)
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -307,47 +307,27 @@ static int ext4_find_unwritten_pgoff(str
num = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
(pgoff_t)num);
- if (nr_pages == 0) {
- if (whence == SEEK_DATA)
- break;
-
- BUG_ON(whence != SEEK_HOLE);
- /*
- * If this is the first time to go into the loop and
- * offset is not beyond the end offset, it will be a
- * hole at this offset
- */
- if (lastoff == startoff || lastoff < endoff)
- found = 1;
+ if (nr_pages == 0)
break;
- }
-
- /*
- * If this is the first time to go into the loop and
- * offset is smaller than the first page offset, it will be a
- * hole at this offset.
- */
- if (lastoff == startoff && whence == SEEK_HOLE &&
- lastoff < page_offset(pvec.pages[0])) {
- found = 1;
- break;
- }
for (i = 0; i < nr_pages; i++) {
struct page *page = pvec.pages[i];
struct buffer_head *bh, *head;
/*
- * If the current offset is not beyond the end of given
- * range, it will be a hole.
+ * If current offset is smaller than the page offset,
+ * there is a hole at this offset.
*/
- if (lastoff < endoff && whence == SEEK_HOLE &&
- page->index > end) {
+ if (whence == SEEK_HOLE && lastoff < endoff &&
+ lastoff < page_offset(pvec.pages[i])) {
found = 1;
*offset = lastoff;
goto out;
}
+ if (page->index > end)
+ goto out;
+
lock_page(page);
if (unlikely(page->mapping != inode->i_mapping)) {
@@ -387,20 +367,18 @@ static int ext4_find_unwritten_pgoff(str
unlock_page(page);
}
- /*
- * The no. of pages is less than our desired, that would be a
- * hole in there.
- */
- if (nr_pages < num && whence == SEEK_HOLE) {
- found = 1;
- *offset = lastoff;
+ /* The no. of pages is less than our desired, we are done. */
+ if (nr_pages < num)
break;
- }
index = pvec.pages[i - 1]->index + 1;
pagevec_release(&pvec);
} while (index <= end);
+ if (whence == SEEK_HOLE && lastoff < endoff) {
+ found = 1;
+ *offset = lastoff;
+ }
out:
pagevec_release(&pvec);
return found;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 038/233] USB: core: replace %p with %pK
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (122 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 073/233] ext4: fix SEEK_HOLE Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 085/233] dmaengine: ep93xx: Always start from BASE0 Ben Hutchings
` (109 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Vamsi Krishna Samavedam
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.
Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.
echo 0 > /proc/sys/kernel/kptr_restrict
[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: drop changes in proc_reapurb*(), usbdev_do_ioctl()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -373,11 +373,11 @@ static void snoop_urb(struct usb_device
if (userurb) { /* Async */
if (when == SUBMIT)
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"length %u\n",
userurb, ep, t, d, length);
else
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"actual_length %u status %d\n",
userurb, ep, t, d, length,
timeout_or_status);
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1648,7 +1648,7 @@ int usb_hcd_unlink_urb (struct urb *urb,
if (retval == 0)
retval = -EINPROGRESS;
else if (retval != -EIDRM && retval != -EBUSY)
- dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+ dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
urb, retval);
usb_put_dev(udev);
}
@@ -1813,7 +1813,7 @@ rescan:
/* kick hcd */
unlink1(hcd, urb, -ESHUTDOWN);
dev_dbg (hcd->self.controller,
- "shutdown urb %p ep%d%s%s\n",
+ "shutdown urb %pK ep%d%s%s\n",
urb, usb_endpoint_num(&ep->desc),
is_in ? "in" : "out",
({ char *s;
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -336,7 +336,7 @@ int usb_submit_urb(struct urb *urb, gfp_
if (!urb || !urb->complete)
return -EINVAL;
if (urb->hcpriv) {
- WARN_ONCE(1, "URB %p submitted while active\n", urb);
+ WARN_ONCE(1, "URB %pK submitted while active\n", urb);
return -EBUSY;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 085/233] dmaengine: ep93xx: Always start from BASE0
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (123 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 038/233] USB: core: replace %p with %pK Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 144/233] HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, K70RGB, K65RGB) Ben Hutchings
` (108 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Vinod Koul, Alexander Sverdlin
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@gmail.com>
commit 0037ae47812b1f431cc602100d1d51f37d77b61e upstream.
The current buffer is being reset to zero on device_free_chan_resources()
but not on device_terminate_all(). It could happen that HW is restarted and
expects BASE0 to be used, but the driver is not synchronized and will start
from BASE1. One solution is to reset the buffer explicitly in
m2p_hw_setup().
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/dma/ep93xx_dma.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/dma/ep93xx_dma.c
+++ b/drivers/dma/ep93xx_dma.c
@@ -325,6 +325,8 @@ static int m2p_hw_setup(struct ep93xx_dm
| M2P_CONTROL_ENABLE;
m2p_set_control(edmac, control);
+ edmac->buffer = 0;
+
return 0;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 144/233] HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, K70RGB, K65RGB)
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (124 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 085/233] dmaengine: ep93xx: Always start from BASE0 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 095/233] tcp: avoid fastopen API to be used on AF_UNSPEC Ben Hutchings
` (107 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Trent Lloyd, SUGNIAUX Wilfried
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Trent Lloyd <trent@lloyd.id.au>
commit 282bf1fe6dca4b768d6bedc14aea1b82c36241c1 upstream.
These devices feature multiple interfaces/endpoints: a legacy BIOS/boot
interface (endpoint 0x81), as well as 2 corsair-specific keyboard interfaces
(endpoint 0x82, 0x83 IN/0x03 OUT) and an RGB LED control interface (endpoint
0x84 IN/0x04 OUT)
Because the extra 3 interfaces are not of subclass USB_INTERFACE_SUBCLASS_BOOT,
HID_QUIRK_NOGET is not automatically set on them and a 10s timeout per-endpoint
(30s per device) occurs initialising reports on boot. We configure
HID_QUIRK_NO_INIT_REPORTS for these devices.
Additionally the left-side G1-G18 macro keys on the K95RGB generate output on
the un-opened 0x82/0x83 endpoints which causes the keyboard to stop responding
waiting for this event to be collected. We enable HID_QUIRK_ALWAYS_POLL to
prevent this situation from occurring.
Signed-off-by: Trent Lloyd <trent@lloyd.id.au>
Tested-by: SUGNIAUX Wilfried <wsu@ppharm2k20.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 7 +++++++
drivers/hid/usbhid/hid-quirks.c | 5 +++++
2 files changed, 12 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -242,6 +242,13 @@
#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+#define USB_VENDOR_ID_CORSAIR 0x1b1c
+#define USB_DEVICE_ID_CORSAIR_K70R 0x1b09
+#define USB_DEVICE_ID_CORSAIR_K95RGB 0x1b11
+#define USB_DEVICE_ID_CORSAIR_M65RGB 0x1b12
+#define USB_DEVICE_ID_CORSAIR_K70RGB 0x1b13
+#define USB_DEVICE_ID_CORSAIR_K65RGB 0x1b17
+
#define USB_VENDOR_ID_CREATIVELABS 0x041e
#define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51 0x322c
#define USB_DEVICE_ID_PRODIKEYS_PCMIDI 0x2801
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -72,6 +72,11 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70R, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_M65RGB, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K95RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 095/233] tcp: avoid fastopen API to be used on AF_UNSPEC
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (125 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 144/233] HID: usbhid: quirks for Corsair RGB keyboard & mice (K70R, K95RGB, M65RGB, K70RGB, K65RGB) Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 011/233] net: irda: irda-usb: fix firmware name on big-endian hosts Ben Hutchings
` (106 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Wei Wang, David S. Miller, Eric Dumazet, Vegard Nossum
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
commit ba615f675281d76fd19aa03558777f81fb6b6084 upstream.
Fastopen API should be used to perform fastopen operations on the TCP
socket. It does not make sense to use fastopen API to perform disconnect
by calling it with AF_UNSPEC. The fastopen data path is also prone to
race conditions and bugs when using with AF_UNSPEC.
One issue reported and analyzed by Vegard Nossum is as follows:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Thread A: Thread B:
------------------------------------------------------------------------
sendto()
- tcp_sendmsg()
- sk_stream_memory_free() = 0
- goto wait_for_sndbuf
- sk_stream_wait_memory()
- sk_wait_event() // sleep
| sendto(flags=MSG_FASTOPEN, dest_addr=AF_UNSPEC)
| - tcp_sendmsg()
| - tcp_sendmsg_fastopen()
| - __inet_stream_connect()
| - tcp_disconnect() //because of AF_UNSPEC
| - tcp_transmit_skb()// send RST
| - return 0; // no reconnect!
| - sk_stream_wait_connect()
| - sock_error()
| - xchg(&sk->sk_err, 0)
| - return -ECONNRESET
- ... // wake up, see sk->sk_err == 0
- skb_entail() on TCP_CLOSE socket
If the connection is reopened then we will send a brand new SYN packet
after thread A has already queued a buffer. At this point I think the
socket internal state (sequence numbers etc.) becomes messed up.
When the new connection is closed, the FIN-ACK is rejected because the
sequence number is outside the window. The other side tries to
retransmit,
but __tcp_retransmit_skb() calls tcp_trim_head() on an empty skb which
corrupts the skb data length and hits a BUG() in copy_and_csum_bits().
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Hence, this patch adds a check for AF_UNSPEC in the fastopen data path
and return EOPNOTSUPP to user if such case happens.
Fixes: cf60af03ca4e7 ("tcp: Fast Open client - sendmsg(MSG_FASTOPEN)")
Reported-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/tcp.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1054,9 +1054,12 @@ static int tcp_sendmsg_fastopen(struct s
int *copied, size_t size)
{
struct tcp_sock *tp = tcp_sk(sk);
+ struct sockaddr *uaddr = msg->msg_name;
int err, flags;
- if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE))
+ if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) ||
+ (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) &&
+ uaddr->sa_family == AF_UNSPEC))
return -EOPNOTSUPP;
if (tp->fastopen_req != NULL)
return -EALREADY; /* Another Fast Open is in progress */
@@ -1069,7 +1072,7 @@ static int tcp_sendmsg_fastopen(struct s
tp->fastopen_req->size = size;
flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0;
- err = __inet_stream_connect(sk->sk_socket, msg->msg_name,
+ err = __inet_stream_connect(sk->sk_socket, uaddr,
msg->msg_namelen, flags);
*copied = tp->fastopen_req->copied;
tcp_free_fastopen_req(tp);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 011/233] net: irda: irda-usb: fix firmware name on big-endian hosts
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (126 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 095/233] tcp: avoid fastopen API to be used on AF_UNSPEC Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 152/233] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL Ben Hutchings
` (105 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Johan Hovold, Nick Fedchik
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 75cf067953d5ee543b3bda90bbfcbee5e1f94ae8 upstream.
Add missing endianness conversion when using the USB device-descriptor
bcdDevice field to construct a firmware file name.
Fixes: 8ef80aef118e ("[IRDA]: irda-usb.c: STIR421x cleanups")
Cc: Nick Fedchik <nfedchik@atlantic-link.com.ua>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/irda/irda-usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1082,7 +1082,7 @@ static int stir421x_patch_device(struct
* are "42101001.sb" or "42101002.sb"
*/
sprintf(stir421x_fw_name, "4210%4X.sb",
- self->usbdev->descriptor.bcdDevice);
+ le16_to_cpu(self->usbdev->descriptor.bcdDevice));
ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev);
if (ret < 0)
return ret;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 152/233] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (127 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 011/233] net: irda: irda-usb: fix firmware name on big-endian hosts Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 124/233] kvm: async_pf: fix rcu_irq_enter() with irqs enabled Ben Hutchings
` (104 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Colin Ian King
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit ed9ab4287f96e66340e0390e2c583f2f9110cba0 upstream.
Quirking the following AMI USB device with ALWAYS_POLL fixes an AMI
virtual keyboard and mouse from not responding and timing out when
it is attached to a ppc64el Power 8 system and when we have some
rapid open/closes on the mouse device.
usb 1-3: new high-speed USB device number 2 using xhci_hcd
usb 1-3: New USB device found, idVendor=046b, idProduct=ff01
usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-3: Product: Virtual Hub
usb 1-3: Manufacturer: American Megatrends Inc.
usb 1-3: SerialNumber: serial
usb 1-3.3: new high-speed USB device number 3 using xhci_hcd
usb 1-3.3: New USB device found, idVendor=046b, idProduct=ff31
usb 1-3.3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-3.3: Product: Virtual HardDisk Device
usb 1-3.3: Manufacturer: American Megatrends Inc.
usb 1-3.4: new low-speed USB device number 4 using xhci_hcd
usb 1-3.4: New USB device found, idVendor=046b, idProduct=ff10
usb 1-3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 1-3.4: Product: Virtual Keyboard and Mouse
usb 1-3.4: Manufacturer: American Megatrends Inc.
With the quirk I have not been able to trigger the issue with
half an hour of saturation soak testing.
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -73,6 +73,9 @@
#define USB_VENDOR_ID_ALPS 0x0433
#define USB_DEVICE_ID_IBM_GAMEPAD 0x1101
+#define USB_VENDOR_ID_AMI 0x046b
+#define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10
+
#define USB_VENDOR_ID_ANTON 0x1130
#define USB_DEVICE_ID_ANTON_TOUCH_PAD 0x3101
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -57,6 +57,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_AKAI, USB_DEVICE_ID_AKAI_MPKMINI2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_AKAI_09E8, USB_DEVICE_ID_AKAI_09E8_MIDIMIX, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_AMI, USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS124U, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 124/233] kvm: async_pf: fix rcu_irq_enter() with irqs enabled
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (128 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 152/233] HID: usbhid: Quirk a AMI virtual mouse and keyboard with ALWAYS_POLL Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 007/233] s390/qeth: handle sysfs error during initialization Ben Hutchings
` (103 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Paolo Bonzini, Paul E. McKenney, Wanpeng Li,
Radim Krčmář,
Ross Zwisler
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit bbaf0e2b1c1b4f88abd6ef49576f0efb1734eae5 upstream.
native_safe_halt enables interrupts, and you just shouldn't
call rcu_irq_enter() with interrupts enabled. Reorder the
call with the following local_irq_disable() to respect the
invariant.
Reported-by: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Tested-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kernel/kvm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -160,8 +160,8 @@ void kvm_async_pf_task_wait(u32 token)
*/
rcu_irq_exit();
native_safe_halt();
- rcu_irq_enter();
local_irq_disable();
+ rcu_irq_enter();
}
}
if (!n.halted)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 007/233] s390/qeth: handle sysfs error during initialization
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (129 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 124/233] kvm: async_pf: fix rcu_irq_enter() with irqs enabled Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 013/233] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Ben Hutchings
` (102 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Julian Wiedmann, David S. Miller, Ursula Braun
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <ubraun@linux.vnet.ibm.com>
commit 9111e7880ccf419548c7b0887df020b08eadb075 upstream.
When setting up the device from within the layer discipline's
probe routine, creating the layer-specific sysfs attributes can fail.
Report this error back to the caller, and handle it by
releasing the layer discipline.
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
[jwi: updated commit msg, moved an OSN change to a subsequent patch]
Signed-off-by: Julian Wiedmann <jwi@linux.vnet.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/s390/net/qeth_core_main.c | 4 +++-
drivers/s390/net/qeth_core_sys.c | 2 ++
drivers/s390/net/qeth_l2_main.c | 5 ++++-
drivers/s390/net/qeth_l3_main.c | 5 ++++-
4 files changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -5426,8 +5426,10 @@ static int qeth_core_set_online(struct c
if (rc)
goto err;
rc = card->discipline->setup(card->gdev);
- if (rc)
+ if (rc) {
+ qeth_core_free_discipline(card);
goto err;
+ }
}
rc = card->discipline->set_online(gdev);
err:
--- a/drivers/s390/net/qeth_core_sys.c
+++ b/drivers/s390/net/qeth_core_sys.c
@@ -459,6 +459,8 @@ static ssize_t qeth_dev_layer2_store(str
goto out;
rc = card->discipline->setup(card->gdev);
+ if (rc)
+ qeth_core_free_discipline(card);
out:
mutex_unlock(&card->discipline_mutex);
return rc ? rc : count;
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -890,8 +890,11 @@ static int qeth_l2_stop(struct net_devic
static int qeth_l2_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
- qeth_l2_create_device_attributes(&gdev->dev);
+ rc = qeth_l2_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
INIT_LIST_HEAD(&card->vid_list);
INIT_LIST_HEAD(&card->mc_list);
card->options.layer2 = 1;
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3317,8 +3317,11 @@ static int qeth_l3_setup_netdev(struct q
static int qeth_l3_probe_device(struct ccwgroup_device *gdev)
{
struct qeth_card *card = dev_get_drvdata(&gdev->dev);
+ int rc;
- qeth_l3_create_device_attributes(&gdev->dev);
+ rc = qeth_l3_create_device_attributes(&gdev->dev);
+ if (rc)
+ return rc;
card->options.layer2 = 0;
card->info.hwtrap = 0;
return 0;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 013/233] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (130 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 007/233] s390/qeth: handle sysfs error during initialization Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 083/233] libceph: NULL deref on crush_decode() error path Ben Hutchings
` (101 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Vovo Yang, Eric W. Biederman, Guenter Roeck
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit b9a985db98961ae1ba0be169f19df1c567e4ffe0 upstream.
The code can potentially sleep for an indefinite amount of time in
zap_pid_ns_processes triggering the hung task timeout, and increasing
the system average. This is undesirable. Sleep with a task state of
TASK_INTERRUPTIBLE instead of TASK_UNINTERRUPTIBLE to remove these
undesirable side effects.
Apparently under heavy load this has been allowing Chrome to trigger
the hung time task timeout error and cause ChromeOS to reboot.
Reported-by: Vovo Yang <vovoy@google.com>
Reported-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Fixes: 6347e9009104 ("pidns: guarantee that the pidns init will be the last pidns process reaped")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/pid_namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/pid_namespace.c
+++ b/kernel/pid_namespace.c
@@ -234,7 +234,7 @@ void zap_pid_ns_processes(struct pid_nam
* Make sure they all go away, see free_pid().
*/
for (;;) {
- set_current_state(TASK_UNINTERRUPTIBLE);
+ set_current_state(TASK_INTERRUPTIBLE);
if (pid_ns->nr_hashed == init_pids)
break;
schedule();
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 083/233] libceph: NULL deref on crush_decode() error path
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (131 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 013/233] pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 111/233] mm/migrate: fix refcount handling when !hugepage_migration_supported() Ben Hutchings
` (100 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ilya Dryomov, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 upstream.
If there is not enough space then ceph_decode_32_safe() does a goto bad.
We need to return an error code in that situation. The current code
returns ERR_PTR(0) which is NULL. The callers are not expecting that
and it results in a NULL dereference.
Fixes: f24e9980eb86 ("ceph: OSD client")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ceph/osdmap.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -270,6 +270,7 @@ static struct crush_map *crush_decode(vo
u32 yes;
struct crush_rule *r;
+ err = -EINVAL;
ceph_decode_32_safe(p, end, yes, bad);
if (!yes) {
dout("crush_decode NO rule %d off %x %p to %p\n",
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 111/233] mm/migrate: fix refcount handling when !hugepage_migration_supported()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (132 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 083/233] libceph: NULL deref on crush_decode() error path Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 053/233] tracing/kprobes: Enforce kprobes teardown after testing Ben Hutchings
` (99 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Torvalds, Mel Gorman, Manoj Iyer, Wanpeng Li,
Joonsoo Kim, Punit Agrawal, Naoya Horiguchi, Christoph Lameter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Punit Agrawal <punit.agrawal@arm.com>
commit 30809f559a0d348c2dfd7ab05e9a451e2384962e upstream.
On failing to migrate a page, soft_offline_huge_page() performs the
necessary update to the hugepage ref-count.
But when !hugepage_migration_supported() , unmap_and_move_hugepage()
also decrements the page ref-count for the hugepage. The combined
behaviour leaves the ref-count in an inconsistent state.
This leads to soft lockups when running the overcommitted hugepage test
from mce-tests suite.
Soft offlining pfn 0x83ed600 at process virtual address 0x400000000000
soft offline: 0x83ed600: migration failed 1, type 1fffc00000008008 (uptodate|head)
INFO: rcu_preempt detected stalls on CPUs/tasks:
Tasks blocked on level-0 rcu_node (CPUs 0-7): P2715
(detected by 7, t=5254 jiffies, g=963, c=962, q=321)
thugetlb_overco R running task 0 2715 2685 0x00000008
Call trace:
dump_backtrace+0x0/0x268
show_stack+0x24/0x30
sched_show_task+0x134/0x180
rcu_print_detail_task_stall_rnp+0x54/0x7c
rcu_check_callbacks+0xa74/0xb08
update_process_times+0x34/0x60
tick_sched_handle.isra.7+0x38/0x70
tick_sched_timer+0x4c/0x98
__hrtimer_run_queues+0xc0/0x300
hrtimer_interrupt+0xac/0x228
arch_timer_handler_phys+0x3c/0x50
handle_percpu_devid_irq+0x8c/0x290
generic_handle_irq+0x34/0x50
__handle_domain_irq+0x68/0xc0
gic_handle_irq+0x5c/0xb0
Address this by changing the putback_active_hugepage() in
soft_offline_huge_page() to putback_movable_pages().
This only triggers on systems that enable memory failure handling
(ARCH_SUPPORTS_MEMORY_FAILURE) but not hugepage migration
(!ARCH_ENABLE_HUGEPAGE_MIGRATION).
I imagine this wasn't triggered as there aren't many systems running
this configuration.
[akpm@linux-foundation.org: remove dead comment, per Naoya]
Link: http://lkml.kernel.org/r/20170525135146.32011-1-punit.agrawal@arm.com
Reported-by: Manoj Iyer <manoj.iyer@canonical.com>
Tested-by: Manoj Iyer <manoj.iyer@canonical.com>
Suggested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Punit Agrawal <punit.agrawal@arm.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/memory-failure.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1551,12 +1551,8 @@ static int soft_offline_huge_page(struct
if (ret) {
pr_info("soft offline: %#lx: migration failed %d, type %lx\n",
pfn, ret, page->flags);
- /*
- * We know that soft_offline_huge_page() tries to migrate
- * only one hugepage pointed to by hpage, so we need not
- * run through the pagelist here.
- */
- putback_active_hugepage(hpage);
+ if (!list_empty(&pagelist))
+ putback_movable_pages(&pagelist);
if (ret > 0)
ret = -EIO;
} else {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 053/233] tracing/kprobes: Enforce kprobes teardown after testing
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (133 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 111/233] mm/migrate: fix refcount handling when !hugepage_migration_supported() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 022/233] USB: serial: mct_u232: fix big-endian baud-rate handling Ben Hutchings
` (98 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Thomas Gleixner, Masami Hiramatsu, Steven Rostedt (VMware)
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.
Enabling the tracer selftest triggers occasionally the warning in
text_poke(), which warns when the to be modified page is not marked
reserved.
The reason is that the tracer selftest installs kprobes on functions marked
__init for testing. These probes are removed after the tests, but that
removal schedules the delayed kprobes_optimizer work, which will do the
actual text poke. If the work is executed after the init text is freed,
then the warning triggers. The bug can be reproduced reliably when the work
delay is increased.
Flush the optimizer work and wait for the optimizing/unoptimizing lists to
become empty before returning from the kprobes tracer selftest. That
ensures that all operations which were queued due to the probes removal
have completed.
Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 6274de498 ("kprobes: Support delayed unoptimizing")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -327,7 +327,9 @@ extern int proc_kprobes_optimization_han
int write, void __user *buffer,
size_t *length, loff_t *ppos);
#endif
-
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
#endif /* CONFIG_OPTPROBES */
#ifdef CONFIG_KPROBES_ON_FTRACE
extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -563,7 +563,7 @@ static void kprobe_optimizer(struct work
}
/* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
{
mutex_lock(&kprobe_mutex);
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1484,6 +1484,11 @@ static __init int kprobe_trace_self_test
end:
release_all_trace_kprobes();
+ /*
+ * Wait for the optimizer work to finish. Otherwise it might fiddle
+ * with probes in already freed __init text.
+ */
+ wait_for_kprobe_optimizer();
if (warn)
pr_cont("NG: Some tests are failed. Please check them.\n");
else
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 022/233] USB: serial: mct_u232: fix big-endian baud-rate handling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (134 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 053/233] tracing/kprobes: Enforce kprobes teardown after testing Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 133/233] HID: microsoft: Add quirk for MS Surface Type/Touch cover Ben Hutchings
` (97 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johan Hovold, Greg Kroah-Hartman, Pete Zaitcev
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 26cede343656c0bc2c33cdc783771282405c7fb2 upstream.
Drop erroneous cpu_to_le32 when setting the baud rate, something which
corrupted the divisor on big-endian hosts.
Found using sparse:
warning: incorrect type in argument 1 (different base types)
expected unsigned int [unsigned] [usertype] val
got restricted __le32 [usertype] <noident>
Fixes: af2ac1a091bc ("USB: serial mct_usb232: move DMA buffers to heap")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-By: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/mct_u232.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct
return -ENOMEM;
divisor = mct_u232_calculate_baud_rate(serial, value, &speed);
- put_unaligned_le32(cpu_to_le32(divisor), buf);
+ put_unaligned_le32(divisor, buf);
rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0),
MCT_U232_SET_BAUD_RATE_REQUEST,
MCT_U232_SET_REQUEST_TYPE,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 133/233] HID: microsoft: Add quirk for MS Surface Type/Touch cover
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (135 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 022/233] USB: serial: mct_u232: fix big-endian baud-rate handling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 135/233] HID: quirks: add QUIRK_NOGET for an other TPV touchscreen Ben Hutchings
` (96 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Reyad Attiyat, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Reyad Attiyat <reyad.attiyat@gmail.com>
commit c5b2b809cee8db018ac68566fe2114c175d79b5b upstream.
The newer firmware on MS Surface 2 tablets causes the type and touch cover keyboards to timeout when waiting for reports.
The quirk HID_QUIRK_NO_INIT_REPORTS allows them to function normally.
Signed-off-by: Reyad Attiyat <reyad.attiyat@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/usbhid/hid-quirks.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -88,6 +88,9 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 135/233] HID: quirks: add QUIRK_NOGET for an other TPV touchscreen
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (136 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 133/233] HID: microsoft: Add quirk for MS Surface Type/Touch cover Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 150/233] HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD Ben Hutchings
` (95 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jiri Kosina, Blaine Lee, Benjamin Tissoires
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
commit c9b57724b38d4c1555ee49418be3d76801e3327c upstream.
Looks like 0x8882 needs the same quirk than 0x8883.
Given that both devices claim they are "TPV OpticalTouchScreen" rename
the 0x8883 to add its PID in the #define.
Reported-by: Blaine Lee <blaine.j.lee@medtronic.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 ++-
drivers/hid/usbhid/hid-quirks.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -909,7 +909,8 @@
#define USB_DEVICE_ID_TOUCHPACK_RTS 0x1688
#define USB_VENDOR_ID_TPV 0x25aa
-#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN 0x8883
+#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882 0x8882
+#define USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883 0x8883
#define USB_VENDOR_ID_TURBOX 0x062a
#define USB_DEVICE_ID_TURBOX_KEYBOARD 0x0201
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -119,7 +119,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8883, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 150/233] HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (137 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 135/233] HID: quirks: add QUIRK_NOGET for an other TPV touchscreen Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 107/233] bnx2x: Fix Multi-Cos Ben Hutchings
` (94 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Wood, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Wood <thetewood@gmail.com>
commit f83f90cf7ba68deb09406ea9da80852a64c4db29 upstream.
The Futaba TOSD-5711BB VFD crashes when the initial HID report is requested,
register the display in hid-ids and tell hid-quirks to not do the init.
Signed-off-by: Alex Wood <thetewood@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -337,6 +337,9 @@
#define USB_VENDOR_ID_FLATFROG 0x25b5
#define USB_DEVICE_ID_MULTITOUCH_3200 0x0002
+#define USB_VENDOR_ID_FUTABA 0x0547
+#define USB_DEVICE_ID_LED_DISPLAY 0x7000
+
#define USB_VENDOR_ID_ESSENTIAL_REALITY 0x0d7f
#define USB_DEVICE_ID_ESSENTIAL_REALITY_P5 0x0100
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -88,6 +88,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_FUTABA, USB_DEVICE_ID_LED_DISPLAY, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 107/233] bnx2x: Fix Multi-Cos
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (138 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 150/233] HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 031/233] btrfs: fix incorrect error return ret being passed to mapping_set_error Ben Hutchings
` (93 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Mintz, Yuval
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Mintz, Yuval" <Yuval.Mintz@cavium.com>
commit 3968d38917eb9bd0cd391265f6c9c538d9b33ffa upstream.
Apparently multi-cos isn't working for bnx2x quite some time -
driver implements ndo_select_queue() to allow queue-selection
for FCoE, but the regular L2 flow would cause it to modulo the
fallback's result by the number of queues.
The fallback would return a queue matching the needed tc
[via __skb_tx_hash()], but since the modulo is by the number of TSS
queues where number of TCs is not accounted, transmission would always
be done by a queue configured into using TC0.
Fixes: ada7c19e6d27 ("bnx2x: use XPS if possible for bnx2x_select_queue instead of pure hash")
Signed-off-by: Yuval Mintz <Yuval.Mintz@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -1914,7 +1914,7 @@ u16 bnx2x_select_queue(struct net_device
}
/* select a non-FCoE queue */
- return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp);
+ return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos);
}
void bnx2x_set_num_queues(struct bnx2x *bp)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 031/233] btrfs: fix incorrect error return ret being passed to mapping_set_error
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (139 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 107/233] bnx2x: Fix Multi-Cos Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 057/233] USB: xhci: fix lock-inversion problem Ben Hutchings
` (92 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Colin Ian King, Liu Bo, David Sterba
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit bff5baf8aa37a97293725a16c03f49872249c07e upstream.
The setting of return code ret should be based on the error code
passed into function end_extent_writepage and not on ret. Thanks
to Liu Bo for spotting this mistake in the original fix I submitted.
Detected by CoverityScan, CID#1414312 ("Logically dead code")
Fixes: 5dca6eea91653e ("Btrfs: mark mapping with error flag to report errors to userspace")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/btrfs/extent_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2368,7 +2368,7 @@ int end_extent_writepage(struct page *pa
if (!uptodate) {
ClearPageUptodate(page);
SetPageError(page);
- ret = ret < 0 ? ret : -EIO;
+ ret = err < 0 ? err : -EIO;
mapping_set_error(page->mapping, ret);
}
return 0;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 057/233] USB: xhci: fix lock-inversion problem
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (140 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 031/233] btrfs: fix incorrect error return ret being passed to mapping_set_error Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 112/233] mlock: fix mlock count can not decrease in race condition Ben Hutchings
` (91 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alan Stern, Greg Kroah-Hartman, Mathias Nyman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 63aea0dbab90a2461faaae357cbc8cfd6c8de9fe upstream.
With threaded interrupts, bottom-half handlers are called with
interrupts enabled. Therefore they can't safely use spin_lock(); they
have to use spin_lock_irqsave(). Lockdep warns about a violation
occurring in xhci_irq():
=========================================================
[ INFO: possible irq lock inversion dependency detected ]
4.11.0-rc8-dbg+ #1 Not tainted
---------------------------------------------------------
swapper/7/0 just changed the state of lock:
(&(&ehci->lock)->rlock){-.-...}, at: [<ffffffffa0130a69>]
ehci_hrtimer_func+0x29/0xc0 [ehci_hcd]
but this lock took another, HARDIRQ-unsafe lock in the past:
(hcd_urb_list_lock){+.....}
and interrupts could create inverse lock ordering between them.
other info that might help us debug this:
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(hcd_urb_list_lock);
local_irq_disable();
lock(&(&ehci->lock)->rlock);
lock(hcd_urb_list_lock);
<Interrupt>
lock(&(&ehci->lock)->rlock);
*** DEADLOCK ***
no locks held by swapper/7/0.
the shortest dependencies between 2nd lock and 1st lock:
-> (hcd_urb_list_lock){+.....} ops: 252 {
HARDIRQ-ON-W at:
__lock_acquire+0x602/0x1280
lock_acquire+0xd5/0x1c0
_raw_spin_lock+0x2f/0x40
usb_hcd_unlink_urb_from_ep+0x1b/0x60 [usbcore]
xhci_giveback_urb_in_irq.isra.45+0x70/0x1b0 [xhci_hcd]
finish_td.constprop.60+0x1d8/0x2e0 [xhci_hcd]
xhci_irq+0xdd6/0x1fa0 [xhci_hcd]
usb_hcd_irq+0x26/0x40 [usbcore]
irq_forced_thread_fn+0x2f/0x70
irq_thread+0x149/0x1d0
kthread+0x113/0x150
ret_from_fork+0x2e/0x40
This patch fixes the problem.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-ring.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2690,11 +2690,12 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
struct xhci_hcd *xhci = hcd_to_xhci(hcd);
union xhci_trb *event_ring_deq;
irqreturn_t ret = IRQ_NONE;
+ unsigned long flags;
dma_addr_t deq;
u64 temp_64;
u32 status;
- spin_lock(&xhci->lock);
+ spin_lock_irqsave(&xhci->lock, flags);
/* Check if the xHC generated the interrupt, or the irq is shared */
status = readl(&xhci->op_regs->status);
if (status == 0xffffffff) {
@@ -2768,7 +2769,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd
ret = IRQ_HANDLED;
out:
- spin_unlock(&xhci->lock);
+ spin_unlock_irqrestore(&xhci->lock, flags);
return ret;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 112/233] mlock: fix mlock count can not decrease in race condition
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (141 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 057/233] USB: xhci: fix lock-inversion problem Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 129/233] HID: usbhid: yet another mouse with ALWAYS_POLL Ben Hutchings
` (90 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Torvalds, Xishi Qiu, Johannes Weiner, Mel Gorman,
Michal Hocko, Joern Engel, zhongjiang, Kefeng Wang,
Michel Lespinasse, Hanjun Guo, Rik van Riel, Hugh Dickins,
Vlastimil Babka, Yisheng Xie
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yisheng Xie <xieyisheng1@huawei.com>
commit 70feee0e1ef331b22cc51f383d532a0d043fbdcc upstream.
Kefeng reported that when running the follow test, the mlock count in
meminfo will increase permanently:
[1] testcase
linux:~ # cat test_mlockal
grep Mlocked /proc/meminfo
for j in `seq 0 10`
do
for i in `seq 4 15`
do
./p_mlockall >> log &
done
sleep 0.2
done
# wait some time to let mlock counter decrease and 5s may not enough
sleep 5
grep Mlocked /proc/meminfo
linux:~ # cat p_mlockall.c
#include <sys/mman.h>
#include <stdlib.h>
#include <stdio.h>
#define SPACE_LEN 4096
int main(int argc, char ** argv)
{
int ret;
void *adr = malloc(SPACE_LEN);
if (!adr)
return -1;
ret = mlockall(MCL_CURRENT | MCL_FUTURE);
printf("mlcokall ret = %d\n", ret);
ret = munlockall();
printf("munlcokall ret = %d\n", ret);
free(adr);
return 0;
}
In __munlock_pagevec() we should decrement NR_MLOCK for each page where
we clear the PageMlocked flag. Commit 1ebb7cc6a583 ("mm: munlock: batch
NR_MLOCK zone state updates") has introduced a bug where we don't
decrement NR_MLOCK for pages where we clear the flag, but fail to
isolate them from the lru list (e.g. when the pages are on some other
cpu's percpu pagevec). Since PageMlocked stays cleared, the NR_MLOCK
accounting gets permanently disrupted by this.
Fix it by counting the number of page whose PageMlock flag is cleared.
Fixes: 1ebb7cc6a583 (" mm: munlock: batch NR_MLOCK zone state updates")
Link: http://lkml.kernel.org/r/1495678405-54569-1-git-send-email-xieyisheng1@huawei.com
Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
Reported-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Tested-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Joern Engel <joern@logfs.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Michel Lespinasse <walken@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Xishi Qiu <qiuxishi@huawei.com>
Cc: zhongjiang <zhongjiang@huawei.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/mlock.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -326,7 +326,7 @@ static void __munlock_pagevec(struct pag
{
int i;
int nr = pagevec_count(pvec);
- int delta_munlocked;
+ int delta_munlocked = -nr;
struct pagevec pvec_putback;
int pgrescued = 0;
@@ -346,6 +346,8 @@ static void __munlock_pagevec(struct pag
continue;
else
__munlock_isolation_failed(page);
+ } else {
+ delta_munlocked++;
}
/*
@@ -357,7 +359,6 @@ static void __munlock_pagevec(struct pag
pagevec_add(&pvec_putback, pvec->pages[i]);
pvec->pages[i] = NULL;
}
- delta_munlocked = -nr + pagevec_count(&pvec_putback);
__mod_zone_page_state(zone, NR_MLOCK, delta_munlocked);
spin_unlock_irq(&zone->lru_lock);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 129/233] HID: usbhid: yet another mouse with ALWAYS_POLL
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (142 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 112/233] mlock: fix mlock count can not decrease in race condition Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 130/233] HID: usbhid: Add a quirk for raphnet multi-gamepad adapters Ben Hutchings
` (89 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Oliver Neukum, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.de>
commit 43faadfe96d3f049f4ae2c4090d2e57b9aafb995 upstream.
The device exists with two device IDs instead of one as previously
believed.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 ++-
drivers/hid/usbhid/hid-quirks.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -458,7 +458,8 @@
#define USB_DEVICE_ID_UGCI_FIGHTING 0x0030
#define USB_VENDOR_ID_HP 0x03f0
-#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE 0x0a4a
+#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a
+#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a
#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
#define USB_VENDOR_ID_HUION 0x256c
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -81,7 +81,8 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A, HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C01A, HID_QUIRK_ALWAYS_POLL },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 130/233] HID: usbhid: Add a quirk for raphnet multi-gamepad adapters
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (143 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 129/233] HID: usbhid: yet another mouse with ALWAYS_POLL Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 074/233] ext4: keep existing extra fields when inode expands Ben Hutchings
` (88 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Raphael Assenat, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Assenat <raph@raphnet.net>
commit d6ea2f88ac3659b799d8079a4fbda4f8faf6ff90 upstream.
The raphnet.net 4nes4snes and 2nes2snes multi-joystick adapters use a single
HID report descriptor with one report ID per controller. This has the effect
that the inputs of otherwise independent game controllers get packed in one
large joystick device.
With this patch each controller gets its own /dev/input/jsX device, which is
more natural and less confusing than having all inputs going to the same place.
Signed-off-by: Raphael Assenat <raph@raphnet.net>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 7 +++++++
drivers/hid/usbhid/hid-quirks.c | 3 +++
2 files changed, 10 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1015,4 +1015,11 @@
#define USB_VENDOR_ID_RISO_KAGAKU 0x1294 /* Riso Kagaku Corp. */
#define USB_DEVICE_ID_RI_KA_WEBMAIL 0x1320 /* Webmail Notifier */
+#define USB_VENDOR_ID_MULTIPLE_1781 0x1781
+#define USB_DEVICE_ID_RAPHNET_4NES4SNES_OLD 0x0a8d
+
+#define USB_VENDOR_ID_DRACAL_RAPHNET 0x289b
+#define USB_DEVICE_ID_RAPHNET_2NES2SNES 0x0002
+#define USB_DEVICE_ID_RAPHNET_4NES4SNES 0x0003
+
#endif
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -143,6 +143,9 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096, HID_QUIRK_NO_INIT_INPUT_REPORTS },
+ { USB_VENDOR_ID_MULTIPLE_1781, USB_DEVICE_ID_RAPHNET_4NES4SNES_OLD, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES, HID_QUIRK_MULTI_INPUT },
{ 0, 0 }
};
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 074/233] ext4: keep existing extra fields when inode expands
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (144 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 130/233] HID: usbhid: Add a quirk for raphnet multi-gamepad adapters Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 118/233] fs/ufs: Set UFS default maximum bytes per file Ben Hutchings
` (87 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Konstantin Khlebnikov, Theodore Ts'o
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit 887a9730614727c4fff7cb756711b190593fc1df upstream.
ext4_expand_extra_isize() should clear only space between old and new
size.
Fixes: 6dd4ee7cab7e # v2.6.23
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/inode.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5055,8 +5055,9 @@ static int ext4_expand_extra_isize(struc
/* No extended attributes present */
if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) {
- memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0,
- new_extra_isize);
+ memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
+ EXT4_I(inode)->i_extra_isize, 0,
+ new_extra_isize - EXT4_I(inode)->i_extra_isize);
EXT4_I(inode)->i_extra_isize = new_extra_isize;
return 0;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 118/233] fs/ufs: Set UFS default maximum bytes per file
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (145 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 074/233] ext4: keep existing extra fields when inode expands Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 084/233] drm/gma500/psb: Actually use VBT mode when it is found Ben Hutchings
` (86 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Torvalds, Richard Narron, Al Viro, Will B, Theodore Ts'o
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Richard Narron <comet.berkeley@gmail.com>
commit 239e250e4acbc0104d514307029c0839e834a51a upstream.
This fixes a problem with reading files larger than 2GB from a UFS-2
file system:
https://bugzilla.kernel.org/show_bug.cgi?id=195721
The incorrect UFS s_maxsize limit became a problem as of commit
c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()")
which started using s_maxbytes to avoid a page index overflow in
do_generic_file_read().
That caused files to be truncated on UFS-2 file systems because the
default maximum file size is 2GB (MAX_NON_LFS) and UFS didn't update it.
Here I simply increase the default to a common value used by other file
systems.
Signed-off-by: Richard Narron <comet.berkeley@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Will B <will.brokenbourgh2877@gmail.com>
Cc: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ufs/super.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -835,9 +835,8 @@ static int ufs_fill_super(struct super_b
uspi->s_dirblksize = UFS_SECTOR_SIZE;
super_block_offset=UFS_SBLOCK;
- /* Keep 2Gig file limit. Some UFS variants need to override
- this but as I don't know which I'll let those in the know loosen
- the rules */
+ sb->s_maxbytes = MAX_LFS_FILESIZE;
+
switch (sbi->s_mount_opt & UFS_MOUNT_UFSTYPE) {
case UFS_MOUNT_UFSTYPE_44BSD:
UFSD("ufstype=44bsd\n");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 084/233] drm/gma500/psb: Actually use VBT mode when it is found
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (146 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 118/233] fs/ufs: Set UFS default maximum bytes per file Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 006/233] netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Ben Hutchings
` (85 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Patrik Jakobsson
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
commit 82bc9a42cf854fdf63155759c0aa790bd1f361b0 upstream.
With LVDS we were incorrectly picking the pre-programmed mode instead of
the prefered mode provided by VBT. Make sure we pick the VBT mode if
one is provided. It is likely that the mode read-out code is still wrong
but this patch fixes the immediate problem on most machines.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=78562
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170418114332.12183-1-patrik.r.jakobsson@gmail.com
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/gma500/psb_intel_lvds.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c
+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c
@@ -783,20 +783,23 @@ void psb_intel_lvds_init(struct drm_devi
if (scan->type & DRM_MODE_TYPE_PREFERRED) {
mode_dev->panel_fixed_mode =
drm_mode_duplicate(dev, scan);
+ DRM_DEBUG_KMS("Using mode from DDC\n");
goto out; /* FIXME: check for quirks */
}
}
/* Failed to get EDID, what about VBT? do we need this? */
- if (mode_dev->vbt_mode)
+ if (dev_priv->lfp_lvds_vbt_mode) {
mode_dev->panel_fixed_mode =
- drm_mode_duplicate(dev, mode_dev->vbt_mode);
+ drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode);
- if (!mode_dev->panel_fixed_mode)
- if (dev_priv->lfp_lvds_vbt_mode)
- mode_dev->panel_fixed_mode =
- drm_mode_duplicate(dev,
- dev_priv->lfp_lvds_vbt_mode);
+ if (mode_dev->panel_fixed_mode) {
+ mode_dev->panel_fixed_mode->type |=
+ DRM_MODE_TYPE_PREFERRED;
+ DRM_DEBUG_KMS("Using mode from VBT\n");
+ goto out;
+ }
+ }
/*
* If we didn't get EDID, try checking if the panel is already turned
@@ -813,6 +816,7 @@ void psb_intel_lvds_init(struct drm_devi
if (mode_dev->panel_fixed_mode) {
mode_dev->panel_fixed_mode->type |=
DRM_MODE_TYPE_PREFERRED;
+ DRM_DEBUG_KMS("Using pre-programmed mode\n");
goto out; /* FIXME: check for quirks */
}
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 006/233] netxen_nic: set rcode to the return status from the call to netxen_issue_cmd
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (147 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 084/233] drm/gma500/psb: Actually use VBT mode when it is found Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 098/233] ext4: fix fdatasync(2) after extent manipulation operations Ben Hutchings
` (84 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Colin Ian King, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 0fe20fafd1791f993806d417048213ec57b81045 upstream.
Currently rcode is being initialized to NX_RCODE_SUCCESS and later it
is checked to see if it is not NX_RCODE_SUCCESS which is never true. It
appears that there is an unintentional missing assignment of rcode from
the return of the call to netxen_issue_cmd() that was dropped in
an earlier fix, so add it in.
Detected by CoverityScan, CID#401900 ("Logically dead code")
Fixes: 2dcd5d95ad6b2 ("netxen_nic: fix cdrp race condition")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c
@@ -249,7 +249,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter
cmd.req.arg3 = 0;
if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE)
- netxen_issue_cmd(adapter, &cmd);
+ rcode = netxen_issue_cmd(adapter, &cmd);
if (rcode != NX_RCODE_SUCCESS)
return -EIO;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 098/233] ext4: fix fdatasync(2) after extent manipulation operations
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (148 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 006/233] netxen_nic: set rcode to the return status from the call to netxen_issue_cmd Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 002/233] iio: proximity: as3935: fix AS3935_INT mask Ben Hutchings
` (83 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jan Kara, Theodore Ts'o
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 67a7d5f561f469ad2fa5154d2888258ab8e6df7c upstream.
Currently, extent manipulation operations such as hole punch, range
zeroing, or extent shifting do not record the fact that file data has
changed and thus fdatasync(2) has a work to do. As a result if we crash
e.g. after a punch hole and fdatasync, user can still possibly see the
punched out data after journal replay. Test generic/392 fails due to
these problems.
Fix the problem by properly marking that file data has changed in these
operations.
Fixes: a4bb6b64e39abc0e41ca077725f2a72c868e7622
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.16: drop change in ext4_insert_range()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -4883,6 +4883,8 @@ static long ext4_zero_range(struct file
/* Zero out partial block at the edges of the range */
ret = ext4_zero_partial_blocks(handle, inode, offset, len);
+ if (ret >= 0)
+ ext4_update_inode_fsync_trans(handle, inode, 1);
if (file->f_flags & O_SYNC)
ext4_handle_sync(handle);
@@ -5505,6 +5507,7 @@ int ext4_collapse_range(struct inode *in
ext4_handle_sync(handle);
inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
ext4_mark_inode_dirty(handle, inode);
+ ext4_update_inode_fsync_trans(handle, inode, 1);
out_stop:
ext4_journal_stop(handle);
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3781,6 +3781,8 @@ int ext4_punch_hole(struct inode *inode,
inode->i_mtime = inode->i_ctime = ext4_current_time(inode);
ext4_mark_inode_dirty(handle, inode);
+ if (ret >= 0)
+ ext4_update_inode_fsync_trans(handle, inode, 1);
out_stop:
ext4_journal_stop(handle);
out_dio:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 002/233] iio: proximity: as3935: fix AS3935_INT mask
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (149 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 098/233] ext4: fix fdatasync(2) after extent manipulation operations Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 104/233] powerpc/spufs: Fix coredump of SPU contexts Ben Hutchings
` (82 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Matt Ranostay, Jonathan Cameron
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Matt Ranostay <matt.ranostay@konsulko.com>
commit 275292d3a3d62670b1b13484707b74e5239b4bb0 upstream.
AS3935 interrupt mask has been incorrect so valid lightning events
would never trigger an buffer event. Also noise interrupt should be
BIT(0).
Fixes: 24ddb0e4bba4 ("iio: Add AS3935 lightning sensor support")
Signed-off-by: Matt Ranostay <matt.ranostay@konsulko.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/iio/proximity/as3935.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -40,9 +40,9 @@
#define AS3935_AFE_PWR_BIT BIT(0)
#define AS3935_INT 0x03
-#define AS3935_INT_MASK 0x07
+#define AS3935_INT_MASK 0x0f
#define AS3935_EVENT_INT BIT(3)
-#define AS3935_NOISE_INT BIT(1)
+#define AS3935_NOISE_INT BIT(0)
#define AS3935_DATA 0x07
#define AS3935_DATA_MASK 0x3F
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 104/233] powerpc/spufs: Fix coredump of SPU contexts
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (150 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 002/233] iio: proximity: as3935: fix AS3935_INT mask Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 075/233] ext4: use __GFP_NOFAIL in ext4_free_blocks() Ben Hutchings
` (81 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jeremy Kerr, Michael Ellerman
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
commit 99acc9bede06bbb2662aafff51f5b9e529fa845e upstream.
If a process dumps core while it has SPU contexts active then we have
code to also dump information about the SPU contexts.
Unfortunately it's been broken for 3 1/2 years, and we didn't notice. In
commit 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") the nread
variable was removed and rc used instead. That means when the loop exits
successfully, rc has the number of bytes read, but it's then used as the
return value for the function, which should return 0 on success.
So fix it by setting rc = 0 before returning in the success case.
Fixes: 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Acked-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/platforms/cell/spufs/coredump.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -174,6 +174,8 @@ static int spufs_arch_write_note(struct
if (!dump_skip(cprm,
roundup(cprm->written - total + sz, 4) - cprm->written))
goto Eio;
+
+ rc = 0;
out:
free_page((unsigned long)buf);
return rc;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 075/233] ext4: use __GFP_NOFAIL in ext4_free_blocks()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (151 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 104/233] powerpc/spufs: Fix coredump of SPU contexts Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 173/233] rcu: Move preemption disabling out of __srcu_read_lock() Ben Hutchings
` (80 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Theodore Ts'o, Konstantin Khlebnikov
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit adb7ef600cc9d9d15ecc934cc26af5c1379777df upstream.
This might be unexpected but pages allocated for sbi->s_buddy_cache are
charged to current memory cgroup. So, GFP_NOFS allocation could fail if
current task has been killed by OOM or if current memory cgroup has no
free memory left. Block allocator cannot handle such failures here yet.
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ext4/mballoc.c | 47 ++++++++++++++++++++++++++++-------------------
1 file changed, 28 insertions(+), 19 deletions(-)
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -814,7 +814,7 @@ static void mb_regenerate_buddy(struct e
* for this page; do not hold this lock when calling this routine!
*/
-static int ext4_mb_init_cache(struct page *page, char *incore)
+static int ext4_mb_init_cache(struct page *page, char *incore, gfp_t gfp)
{
ext4_group_t ngroups;
int blocksize;
@@ -847,7 +847,7 @@ static int ext4_mb_init_cache(struct pag
/* allocate buffer_heads to read bitmaps */
if (groups_per_page > 1) {
i = sizeof(struct buffer_head *) * groups_per_page;
- bh = kzalloc(i, GFP_NOFS);
+ bh = kzalloc(i, gfp);
if (bh == NULL) {
err = -ENOMEM;
goto out;
@@ -972,7 +972,7 @@ out:
* are on the same page e4b->bd_buddy_page is NULL and return value is 0.
*/
static int ext4_mb_get_buddy_page_lock(struct super_block *sb,
- ext4_group_t group, struct ext4_buddy *e4b)
+ ext4_group_t group, struct ext4_buddy *e4b, gfp_t gfp)
{
struct inode *inode = EXT4_SB(sb)->s_buddy_cache;
int block, pnum, poff;
@@ -991,7 +991,7 @@ static int ext4_mb_get_buddy_page_lock(s
block = group * 2;
pnum = block / blocks_per_page;
poff = block % blocks_per_page;
- page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+ page = find_or_create_page(inode->i_mapping, pnum, gfp);
if (!page)
return -ENOMEM;
BUG_ON(page->mapping != inode->i_mapping);
@@ -1005,7 +1005,7 @@ static int ext4_mb_get_buddy_page_lock(s
block++;
pnum = block / blocks_per_page;
- page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+ page = find_or_create_page(inode->i_mapping, pnum, gfp);
if (!page)
return -ENOMEM;
BUG_ON(page->mapping != inode->i_mapping);
@@ -1031,7 +1031,7 @@ static void ext4_mb_put_buddy_page_lock(
* calling this routine!
*/
static noinline_for_stack
-int ext4_mb_init_group(struct super_block *sb, ext4_group_t group)
+int ext4_mb_init_group(struct super_block *sb, ext4_group_t group, gfp_t gfp)
{
struct ext4_group_info *this_grp;
@@ -1051,7 +1051,7 @@ int ext4_mb_init_group(struct super_bloc
* The call to ext4_mb_get_buddy_page_lock will mark the
* page accessed.
*/
- ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b);
+ ret = ext4_mb_get_buddy_page_lock(sb, group, &e4b, gfp);
if (ret || !EXT4_MB_GRP_NEED_INIT(this_grp)) {
/*
* somebody initialized the group
@@ -1061,7 +1061,7 @@ int ext4_mb_init_group(struct super_bloc
}
page = e4b.bd_bitmap_page;
- ret = ext4_mb_init_cache(page, NULL);
+ ret = ext4_mb_init_cache(page, NULL, gfp);
if (ret)
goto err;
if (!PageUptodate(page)) {
@@ -1080,7 +1080,7 @@ int ext4_mb_init_group(struct super_bloc
}
/* init buddy cache */
page = e4b.bd_buddy_page;
- ret = ext4_mb_init_cache(page, e4b.bd_bitmap);
+ ret = ext4_mb_init_cache(page, e4b.bd_bitmap, gfp);
if (ret)
goto err;
if (!PageUptodate(page)) {
@@ -1098,8 +1098,8 @@ err:
* calling this routine!
*/
static noinline_for_stack int
-ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
- struct ext4_buddy *e4b)
+ext4_mb_load_buddy_gfp(struct super_block *sb, ext4_group_t group,
+ struct ext4_buddy *e4b, gfp_t gfp)
{
int blocks_per_page;
int block;
@@ -1129,7 +1129,7 @@ ext4_mb_load_buddy(struct super_block *s
* we need full data about the group
* to make a good selection
*/
- ret = ext4_mb_init_group(sb, group);
+ ret = ext4_mb_init_group(sb, group, gfp);
if (ret)
return ret;
}
@@ -1157,11 +1157,11 @@ ext4_mb_load_buddy(struct super_block *s
* wait for it to initialize.
*/
page_cache_release(page);
- page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+ page = find_or_create_page(inode->i_mapping, pnum, gfp);
if (page) {
BUG_ON(page->mapping != inode->i_mapping);
if (!PageUptodate(page)) {
- ret = ext4_mb_init_cache(page, NULL);
+ ret = ext4_mb_init_cache(page, NULL, gfp);
if (ret) {
unlock_page(page);
goto err;
@@ -1193,11 +1193,12 @@ ext4_mb_load_buddy(struct super_block *s
if (page == NULL || !PageUptodate(page)) {
if (page)
page_cache_release(page);
- page = find_or_create_page(inode->i_mapping, pnum, GFP_NOFS);
+ page = find_or_create_page(inode->i_mapping, pnum, gfp);
if (page) {
BUG_ON(page->mapping != inode->i_mapping);
if (!PageUptodate(page)) {
- ret = ext4_mb_init_cache(page, e4b->bd_bitmap);
+ ret = ext4_mb_init_cache(page, e4b->bd_bitmap,
+ gfp);
if (ret) {
unlock_page(page);
goto err;
@@ -1236,6 +1237,12 @@ err:
return ret;
}
+static int ext4_mb_load_buddy(struct super_block *sb, ext4_group_t group,
+ struct ext4_buddy *e4b)
+{
+ return ext4_mb_load_buddy_gfp(sb, group, e4b, GFP_NOFS);
+}
+
static void ext4_mb_unload_buddy(struct ext4_buddy *e4b)
{
if (e4b->bd_bitmap_page)
@@ -2029,7 +2036,7 @@ static int ext4_mb_good_group(struct ext
/* We only do this if the grp has never been initialized */
if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
- int ret = ext4_mb_init_group(ac->ac_sb, group);
+ int ret = ext4_mb_init_group(ac->ac_sb, group, GFP_NOFS);
if (ret)
return 0;
}
@@ -4797,7 +4804,9 @@ do_more:
#endif
trace_ext4_mballoc_free(sb, inode, block_group, bit, count_clusters);
- err = ext4_mb_load_buddy(sb, block_group, &e4b);
+ /* __GFP_NOFAIL: retry infinitely, ignore TIF_MEMDIE and memcg limit. */
+ err = ext4_mb_load_buddy_gfp(sb, block_group, &e4b,
+ GFP_NOFS|__GFP_NOFAIL);
if (err)
goto error_return;
@@ -5210,7 +5219,7 @@ int ext4_trim_fs(struct super_block *sb,
grp = ext4_get_group_info(sb, group);
/* We only do this if the grp has never been initialized */
if (unlikely(EXT4_MB_GRP_NEED_INIT(grp))) {
- ret = ext4_mb_init_group(sb, group);
+ ret = ext4_mb_init_group(sb, group, GFP_NOFS);
if (ret)
break;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 173/233] rcu: Move preemption disabling out of __srcu_read_lock()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (152 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 075/233] ext4: use __GFP_NOFAIL in ext4_free_blocks() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 191/233] mac80211/wpa: use constant time memory comparison for MACs Ben Hutchings
` (79 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul E. McKenney, Josh Triplett
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
commit 49f5903b473c5f63f3b57856d1bd4593db0a2eef upstream.
Currently, __srcu_read_lock() cannot be invoked from restricted
environments because it contains calls to preempt_disable() and
preempt_enable(), both of which can invoke lockdep, which is a bad
idea in some restricted execution modes. This commit therefore moves
the preempt_disable() and preempt_enable() from __srcu_read_lock()
to srcu_read_lock(). It also inserts the preempt_disable() and
preempt_enable() around the call to __srcu_read_lock() in do_exit().
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
[bwh: Backported to 3.16:
- Drop changes in do_exit()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -217,8 +217,11 @@ static inline int srcu_read_lock_held(st
*/
static inline int srcu_read_lock(struct srcu_struct *sp) __acquires(sp)
{
- int retval = __srcu_read_lock(sp);
+ int retval;
+ preempt_disable();
+ retval = __srcu_read_lock(sp);
+ preempt_enable();
rcu_lock_acquire(&(sp)->dep_map);
return retval;
}
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -297,11 +297,9 @@ int __srcu_read_lock(struct srcu_struct
int idx;
idx = ACCESS_ONCE(sp->completed) & 0x1;
- preempt_disable();
ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
smp_mb(); /* B */ /* Avoid leaking the critical section. */
ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
- preempt_enable();
return idx;
}
EXPORT_SYMBOL_GPL(__srcu_read_lock);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 191/233] mac80211/wpa: use constant time memory comparison for MACs
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (153 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 173/233] rcu: Move preemption disabling out of __srcu_read_lock() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 154/233] HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB Ben Hutchings
` (78 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Johannes Berg, Johannes Berg, linux-wireless, Jason A. Donenfeld
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Jason A. Donenfeld" <Jason@zx2c4.com>
commit 98c67d187db7808b1f3c95f2110dd4392d034182 upstream.
Otherwise, we enable all sorts of forgeries via timing attack.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-wireless@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.16: drop changes in
ieee80211_crypto_aes_{cmac_256,mac}_decrypt()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/wpa.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -16,6 +16,7 @@
#include <asm/unaligned.h>
#include <net/mac80211.h>
#include <crypto/aes.h>
+#include <crypto/algapi.h>
#include "ieee80211_i.h"
#include "michael.h"
@@ -147,7 +148,7 @@ ieee80211_rx_h_michael_mic_verify(struct
data_len = skb->len - hdrlen - MICHAEL_MIC_LEN;
key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY];
michael_mic(key, hdr, data, data_len, mic);
- if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0)
+ if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN))
goto mic_fail;
/* remove Michael MIC from payload */
@@ -768,7 +769,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct
bip_aad(skb, aad);
ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad,
skb->data + 24, skb->len - 24, mic);
- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) {
+ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) {
key->u.aes_cmac.icverrors++;
return RX_DROP_UNUSABLE;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 154/233] HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (154 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 191/233] mac80211/wpa: use constant time memory comparison for MACs Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 165/233] perf script: Fix outdated comment for perf-trace-python Ben Hutchings
` (77 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Oscar Campos, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oscar Campos <oscar.campos@member.fsf.org>
commit deaba636997557fce46ca7bcb509bff5ea1b0558 upstream.
Add quirks for several corsair gaming devices to avoid long delays on
report initialization
Supported devices:
- Corsair K65RGB Rapidfire Gaming Keyboard
- Corsair K70RGB Rapidfire Gaming Keyboard
- Corsair Scimitar Pro RGB Gaming Mouse
Signed-off-by: Oscar Campos <oscar.campos@member.fsf.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 3 +++
2 files changed, 6 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -255,6 +255,9 @@
#define USB_DEVICE_ID_CORSAIR_K70RGB 0x1b13
#define USB_DEVICE_ID_CORSAIR_STRAFE 0x1b15
#define USB_DEVICE_ID_CORSAIR_K65RGB 0x1b17
+#define USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE 0x1b38
+#define USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE 0x1b39
+#define USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB 0x1b3e
#define USB_VENDOR_ID_CREATIVELABS 0x041e
#define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51 0x322c
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -80,6 +80,9 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS },
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
+ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 165/233] perf script: Fix outdated comment for perf-trace-python
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (155 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 154/233] HID: corsair: support for K65-K70 Rapidfire and Scimitar Pro RGB Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 168/233] perf script python: Updated trace_unhandled() signature Ben Hutchings
` (76 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Arnaldo Carvalho de Melo, SeongJae Park,
Alexander Shishkin, Peter Zijlstra, Thomas Gleixner
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit c76132dc5182776b98e946d674cb41c421661ea9 upstream.
Script generated by the '--gen-script' option contains an outdated
comment. It mentions a 'perf-trace-python' document while it has been
renamed to 'perf-script-python'. Fix it.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 133dc4c39c57 ("perf: Rename 'perf trace' to 'perf script'")
Link: http://lkml.kernel.org/r/20170530111827.21732-2-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/util/scripting-engines/trace-event-python.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -563,7 +563,7 @@ static int python_generate_script(struct
fprintf(ofp, "# be retrieved using Python functions of the form "
"common_*(context).\n");
- fprintf(ofp, "# See the perf-trace-python Documentation for the list "
+ fprintf(ofp, "# See the perf-script-python Documentation for the list "
"of available functions.\n\n");
fprintf(ofp, "import os\n");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 168/233] perf script python: Updated trace_unhandled() signature
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (156 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 165/233] perf script: Fix outdated comment for perf-trace-python Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 220/233] net: prevent sign extension in dev_get_stats() Ben Hutchings
` (75 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Pierre Tardy, SeongJae Park, Arnaldo Carvalho de Melo,
Peter Zijlstra, Alexander Shishkin
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit 1bf8d5a4a5da19b1f6e7958fe67db4118fa7a1c1 upstream.
Default function signature of trace_unhandled() got changed to include a
field dict, but its documentation, perf-script-python.txt has not been
updated. Fix it.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Pierre Tardy <tardyp@gmail.com>
Fixes: c02514850d67 ("perf scripts python: Give field dict to unhandled callback")
Link: http://lkml.kernel.org/r/20170530111827.21732-6-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/Documentation/perf-script-python.txt | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -149,10 +149,8 @@ def raw_syscalls__sys_enter(event_name,
print "id=%d, args=%s\n" % \
(id, args),
-def trace_unhandled(event_name, context, common_cpu, common_secs, common_nsecs,
- common_pid, common_comm):
- print_header(event_name, common_cpu, common_secs, common_nsecs,
- common_pid, common_comm)
+def trace_unhandled(event_name, context, event_fields_dict):
+ print ' '.join(['%s=%s'%(k,str(v))for k,v in sorted(event_fields_dict.items())])
def print_header(event_name, cpu, secs, nsecs, pid, comm):
print "%-20s %5u %05u.%09u %8u %-20s " % \
@@ -550,8 +548,7 @@ def trace_end():
of common arguments are passed into it:
----
-def trace_unhandled(event_name, context, common_cpu, common_secs,
- common_nsecs, common_pid, common_comm):
+def trace_unhandled(event_name, context, event_fields_dict):
pass
----
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 220/233] net: prevent sign extension in dev_get_stats()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (157 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 168/233] perf script python: Updated trace_unhandled() signature Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 155/233] HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch Ben Hutchings
` (74 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Eric Dumazet, David S. Miller, Jarod Wilson
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 6f64ec74515925cced6df4571638b5a099a49aae upstream.
Similar to the fix provided by Dominik Heidler in commit
9b3dc0a17d73 ("l2tp: cast l2tp traffic counter to unsigned")
we need to take care of 32bit kernels in dev_get_stats().
When using atomic_long_read(), we add a 'long' to u64 and
might misinterpret high order bit, unless we cast to unsigned.
Fixes: caf586e5f23ce ("net: add a core netdev->rx_dropped counter")
Fixes: 015f0688f57ca ("net: net: add a core netdev->tx_dropped counter")
Fixes: 6e7333d315a76 ("net: add rx_nohandler stat counter")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jarod Wilson <jarod@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: only {rx,tx}_dropped are updated here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6509,8 +6509,8 @@ struct rtnl_link_stats64 *dev_get_stats(
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
- storage->rx_dropped += atomic_long_read(&dev->rx_dropped);
- storage->tx_dropped += atomic_long_read(&dev->tx_dropped);
+ storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped);
+ storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped);
return storage;
}
EXPORT_SYMBOL(dev_get_stats);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 155/233] HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (158 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 220/233] net: prevent sign extension in dev_get_stats() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 161/233] net: ethoc: enable NAPI before poll may be scheduled Ben Hutchings
` (73 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Vasilis Liaskovitis, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Vasilis Liaskovitis <vliaskovitis@suse.com>
commit d529a4ad91efcf68b65440c6555895fd7ad5a08e upstream.
Like other switches, the Aten CS-1758 KVM switch needs a quirk to avoid
spewing errors:
[12599018.071059] usb 5-2: input irq status -75 received
[12599018.079053] usb 5-2: input irq status -75 received
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 1 +
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -175,6 +175,7 @@
#define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
#define USB_DEVICE_ID_ATEN_CS682 0x2213
#define USB_DEVICE_ID_ATEN_CS692 0x8021
+#define USB_DEVICE_ID_ATEN_CS1758 0x2220
#define USB_VENDOR_ID_ATMEL 0x03eb
#define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -65,6 +65,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS1758, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 161/233] net: ethoc: enable NAPI before poll may be scheduled
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (159 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 155/233] HID: usbhid: Add HID_QUIRK_NOGET for Aten CS-1758 KVM switch Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 167/233] perf script python: Fix wrong code snippets in documentation Ben Hutchings
` (72 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David S. Miller, Max Filippov, Florian Fainelli, Tobias Klauser
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit d220b942a4b6a0640aee78841608f4aa5e8e185e upstream.
ethoc_reset enables device interrupts, ethoc_interrupt may schedule a
NAPI poll before NAPI is enabled in the ethoc_open, which results in
device being unable to send or receive anything until it's closed and
reopened. In case the device is flooded with ingress packets it may be
unable to recover at all.
Move napi_enable above ethoc_reset in the ethoc_open to fix that.
Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Tobias Klauser <tklauser@distanz.ch>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/ethoc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -706,6 +706,8 @@ static int ethoc_open(struct net_device
if (ret)
return ret;
+ napi_enable(&priv->napi);
+
ethoc_init_ring(priv, dev->mem_start);
ethoc_reset(priv);
@@ -718,7 +720,6 @@ static int ethoc_open(struct net_device
}
phy_start(priv->phy);
- napi_enable(&priv->napi);
if (netif_msg_ifup(priv)) {
dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n",
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 167/233] perf script python: Fix wrong code snippets in documentation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (160 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 161/233] net: ethoc: enable NAPI before poll may be scheduled Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 231/233] xen: fix bio vec merging Ben Hutchings
` (71 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Alexander Shishkin, Peter Zijlstra,
Arnaldo Carvalho de Melo, SeongJae Park, Frederic Weisbecker,
Tom Zanussi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit 26ddb8722df865aa67fbe459107d2f3f8e5c6829 upstream.
This commit fixes wrong code snippets for trace_begin() and trace_end()
function example definition.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Zanussi <tzanussi@gmail.com>
Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation")
Link: http://lkml.kernel.org/r/20170530111827.21732-5-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/Documentation/perf-script-python.txt | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -532,7 +532,7 @@ can implement a set of optional function
gives scripts a chance to do setup tasks:
----
-def trace_begin:
+def trace_begin():
pass
----
@@ -541,7 +541,7 @@ def trace_begin:
as display results:
----
-def trace_end:
+def trace_end():
pass
----
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 231/233] xen: fix bio vec merging
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (161 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 167/233] perf script python: Fix wrong code snippets in documentation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 188/233] KVM: PPC: Book3S HV: Context-switch EBB registers properly Ben Hutchings
` (70 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Konrad Rzeszutek Wilk, Roger Pau Monne,
Jan H. Schönherr, Juergen Gross
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Roger Pau Monne <roger.pau@citrix.com>
commit 462cdace790ac2ed6aad1b19c9c0af0143b6aab0 upstream.
The current test for bio vec merging is not fully accurate and can be
tricked into merging bios when certain grant combinations are used.
The result of these malicious bio merges is a bio that extends past
the memory page used by any of the originating bios.
Take into account the following scenario, where a guest creates two
grant references that point to the same mfn, ie: grant 1 -> mfn A,
grant 2 -> mfn A.
These references are then used in a PV block request, and mapped by
the backend domain, thus obtaining two different pfns that point to
the same mfn, pfn B -> mfn A, pfn C -> mfn A.
If those grants happen to be used in two consecutive sectors of a disk
IO operation becoming two different bios in the backend domain, the
checks in xen_biovec_phys_mergeable will succeed, because bfn1 == bfn2
(they both point to the same mfn). However due to the bio merging,
the backend domain will end up with a bio that expands past mfn A into
mfn A + 1.
Fix this by making sure the check in xen_biovec_phys_mergeable takes
into account the offset and the length of the bio, this basically
replicates whats done in __BIOVEC_PHYS_MERGEABLE using mfns (bus
addresses). While there also remove the usage of
__BIOVEC_PHYS_MERGEABLE, since that's already checked by the callers
of xen_biovec_phys_mergeable.
Reported-by: "Jan H. Schönherr" <jschoenh@amazon.de>
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
[bwh: Backported to 3.16:
- s/bfn/mfn/g
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/xen/biomerge.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/xen/biomerge.c
+++ b/drivers/xen/biomerge.c
@@ -9,7 +9,6 @@ bool xen_biovec_phys_mergeable(const str
unsigned long mfn1 = pfn_to_mfn(page_to_pfn(vec1->bv_page));
unsigned long mfn2 = pfn_to_mfn(page_to_pfn(vec2->bv_page));
- return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) &&
- ((mfn1 == mfn2) || ((mfn1+1) == mfn2));
+ return mfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == mfn2;
}
EXPORT_SYMBOL(xen_biovec_phys_mergeable);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 188/233] KVM: PPC: Book3S HV: Context-switch EBB registers properly
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (162 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 231/233] xen: fix bio vec merging Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 162/233] drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve() Ben Hutchings
` (69 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul Mackerras
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <paulus@ozlabs.org>
commit ca8efa1df1d15a1795a2da57f9f6aada6ed6b946 upstream.
This adds code to save the values of three SPRs (special-purpose
registers) used by userspace to control event-based branches (EBBs),
which are essentially interrupts that get delivered directly to
userspace. These registers are loaded up with guest values when
entering the guest, and their values are saved when exiting the
guest, but we were not saving the host values and restoring them
before going back to userspace.
On POWER8 this would only affect userspace programs which explicitly
request the use of EBBs and also use the KVM_RUN ioctl, since the
only source of EBBs on POWER8 is the PMU, and there is an explicit
enable bit in the PMU registers (and those PMU registers do get
properly context-switched between host and guest). On POWER9 there
is provision for externally-generated EBBs, and these are not subject
to the control in the PMU registers.
Since these registers only affect userspace, we can save them when
we first come in from userspace and restore them before returning to
userspace, rather than saving/restoring the host values on every
guest entry/exit. Similarly, we don't need to worry about their
values on offline secondary threads since they execute in the context
of the idle task, which never executes in userspace.
Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08)
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1795,6 +1795,7 @@ static int kvmppc_vcpu_run_hv(struct kvm
{
int r;
int srcu_idx;
+ unsigned long ebb_regs[3] = {}; /* shut up GCC */
if (!vcpu->arch.sane) {
run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
@@ -1823,6 +1824,14 @@ static int kvmppc_vcpu_run_hv(struct kvm
flush_fp_to_thread(current);
flush_altivec_to_thread(current);
flush_vsx_to_thread(current);
+
+ /* Save userspace EBB register values */
+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+ ebb_regs[0] = mfspr(SPRN_EBBHR);
+ ebb_regs[1] = mfspr(SPRN_EBBRR);
+ ebb_regs[2] = mfspr(SPRN_BESCR);
+ }
+
vcpu->arch.wqp = &vcpu->arch.vcore->wq;
vcpu->arch.pgdir = current->mm->pgd;
vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST;
@@ -1842,6 +1851,13 @@ static int kvmppc_vcpu_run_hv(struct kvm
}
} while (is_kvmppc_resume_guest(r));
+ /* Restore userspace EBB register values */
+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) {
+ mtspr(SPRN_EBBHR, ebb_regs[0]);
+ mtspr(SPRN_EBBRR, ebb_regs[1]);
+ mtspr(SPRN_BESCR, ebb_regs[2]);
+ }
+
out:
vcpu->arch.state = KVMPPC_VCPU_NOTREADY;
atomic_dec(&vcpu->kvm->arch.vcpus_running);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 162/233] drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (163 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 188/233] KVM: PPC: Book3S HV: Context-switch EBB registers properly Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 229/233] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() Ben Hutchings
` (68 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sinclair Yeh, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit f0c62e9878024300319ba2438adc7b06c6b9c448 upstream.
If vmalloc() fails then we need to a bit of cleanup before returning.
Fixes: fb1d9738ca05 ("drm/vmwgfx: Add DRM driver for VMware Virtual GPU")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -385,6 +385,8 @@ void *vmw_fifo_reserve(struct vmw_privat
return fifo_state->static_buffer;
else {
fifo_state->dynamic_buffer = vmalloc(bytes);
+ if (!fifo_state->dynamic_buffer)
+ goto out_err;
return fifo_state->dynamic_buffer;
}
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 229/233] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (164 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 162/233] drm/vmwgfx: Handle vmalloc() failure in vmw_local_fifo_reserve() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 207/233] CIFS: Improve readdir verbosity Ben Hutchings
` (67 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Arend van Spriel, David S. Miller,
freenerguo(郭大兴)
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arend van Spriel <arend.vanspriel@broadcom.com>
commit 8f44c9a41386729fea410e688959ddaa9d51be7c upstream.
The lower level nl80211 code in cfg80211 ensures that "len" is between
25 and NL80211_ATTR_FRAME (2304). We subtract DOT11_MGMT_HDR_LEN (24) from
"len" so thats's max of 2280. However, the action_frame->data[] buffer is
only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can
overflow.
memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
le16_to_cpu(action_frame->len));
Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
Reported-by: "freenerguo(郭大兴)" <freenerguo@tencent.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -4119,6 +4119,11 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
GFP_KERNEL);
} else if (ieee80211_is_action(mgmt->frame_control)) {
+ if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
+ brcmf_err("invalid action frame length\n");
+ err = -EINVAL;
+ goto exit;
+ }
af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
if (af_params == NULL) {
brcmf_err("unable to allocate frame\n");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 207/233] CIFS: Improve readdir verbosity
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (165 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 229/233] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 203/233] drm/radeon: add a PX quirk for another K53TK variant Ben Hutchings
` (66 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pavel Shilovsky, Steve French
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilov@microsoft.com>
commit dcd87838c06f05ab7650b249ebf0d5b57ae63e1e upstream.
Downgrade the loglevel for SMB2 to prevent filling the log
with messages if e.g. readdir was interrupted. Also make SMB2
and SMB1 codepaths do the same logging during readdir.
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/smb1ops.c | 9 +++++++--
fs/cifs/smb2ops.c | 4 ++--
2 files changed, 9 insertions(+), 4 deletions(-)
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -856,8 +856,13 @@ cifs_query_dir_first(const unsigned int
struct cifs_fid *fid, __u16 search_flags,
struct cifs_search_info *srch_inf)
{
- return CIFSFindFirst(xid, tcon, path, cifs_sb,
- &fid->netfid, search_flags, srch_inf, true);
+ int rc;
+
+ rc = CIFSFindFirst(xid, tcon, path, cifs_sb,
+ &fid->netfid, search_flags, srch_inf, true);
+ if (rc)
+ cifs_dbg(FYI, "find first failed=%d\n", rc);
+ return rc;
}
static int
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -729,7 +729,7 @@ smb2_query_dir_first(const unsigned int
rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL);
kfree(utf16_path);
if (rc) {
- cifs_dbg(VFS, "open dir failed\n");
+ cifs_dbg(FYI, "open dir failed rc=%d\n", rc);
return rc;
}
@@ -739,7 +739,7 @@ smb2_query_dir_first(const unsigned int
rc = SMB2_query_directory(xid, tcon, fid->persistent_fid,
fid->volatile_fid, 0, srch_inf);
if (rc) {
- cifs_dbg(VFS, "query directory failed\n");
+ cifs_dbg(FYI, "query directory failed rc=%d\n", rc);
SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid);
}
return rc;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 203/233] drm/radeon: add a PX quirk for another K53TK variant
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (166 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 207/233] CIFS: Improve readdir verbosity Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 193/233] xfrm: NULL dereference on allocation failure Ben Hutchings
` (65 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Deucher
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 4eb59793cca00b0e629b6d55b5abb5acb82c5868 upstream.
Disable PX on these systems.
bug: https://bugs.freedesktop.org/show_bug.cgi?id=101491
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/radeon_device.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -128,6 +128,10 @@ static struct radeon_px_quirk radeon_px_
* https://bugzilla.kernel.org/show_bug.cgi?id=51381
*/
{ PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
+ /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU
+ * https://bugs.freedesktop.org/show_bug.cgi?id=101491
+ */
+ { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX },
/* macbook pro 8.2 */
{ PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP },
{ 0, 0, 0, 0, 0 },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 193/233] xfrm: NULL dereference on allocation failure
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (167 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 203/233] drm/radeon: add a PX quirk for another K53TK variant Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 228/233] ptrace: use fsuid, fsgid, effective creds for fs access checks Ben Hutchings
` (64 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Steffen Klassert, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit e747f64336fc15e1c823344942923195b800aa1e upstream.
The default error code in pfkey_msg2xfrm_state() is -ENOBUFS. We
added a new call to security_xfrm_state_alloc() which sets "err" to zero
so there several places where we can return ERR_PTR(0) if kmalloc()
fails. The caller is expecting error pointers so it leads to a NULL
dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/key/af_key.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1156,6 +1156,7 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
+ err = -ENOBUFS;
key = ext_hdrs[SADB_EXT_KEY_AUTH - 1];
if (sa->sadb_sa_auth) {
int keysize = 0;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 228/233] ptrace: use fsuid, fsgid, effective creds for fs access checks
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (168 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 193/233] xfrm: NULL dereference on allocation failure Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 221/233] ALSA: hda - set input_path bitmap to zero after moving it to new place Ben Hutchings
` (63 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Oleg Nesterov, Al Viro, Linus Torvalds, Jann Horn,
Andy Lutomirski, Eric W. Biederman, Willy Tarreau,
Andy Shevchenko, Casey Schaufler, Ingo Molnar, James Morris,
Serge E. Hallyn, Kees Cook
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jann@thejh.net>
commit caaee6234d05a58c5b4d05e7bf766131b810a657 upstream.
By checking the effective credentials instead of the real UID / permitted
capabilities, ensure that the calling process actually intended to use its
credentials.
To ensure that all ptrace checks use the correct caller credentials (e.g.
in case out-of-tree code or newly added code omits the PTRACE_MODE_*CREDS
flag), use two new flags and require one of them to be set.
The problem was that when a privileged task had temporarily dropped its
privileges, e.g. by calling setreuid(0, user_uid), with the intent to
perform following syscalls with the credentials of a user, it still passed
ptrace access checks that the user would not be able to pass.
While an attacker should not be able to convince the privileged task to
perform a ptrace() syscall, this is a problem because the ptrace access
check is reused for things in procfs.
In particular, the following somewhat interesting procfs entries only rely
on ptrace access checks:
/proc/$pid/stat - uses the check for determining whether pointers
should be visible, useful for bypassing ASLR
/proc/$pid/maps - also useful for bypassing ASLR
/proc/$pid/cwd - useful for gaining access to restricted
directories that contain files with lax permissions, e.g. in
this scenario:
lrwxrwxrwx root root /proc/13020/cwd -> /root/foobar
drwx------ root root /root
drwxr-xr-x root root /root/foobar
-rw-r--r-- root root /root/foobar/secret
Therefore, on a system where a root-owned mode 6755 binary changes its
effective credentials as described and then dumps a user-specified file,
this could be used by an attacker to reveal the memory layout of root's
processes or reveal the contents of files he is not allowed to access
(through /proc/$pid/cwd).
[akpm@linux-foundation.org: fix warning]
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Morris <james.l.morris@oracle.com>
Cc: "Serge E. Hallyn" <serge.hallyn@ubuntu.com>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16:
- Update mm_access() calls in fs/proc/task_{,no}mmu.c too
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -391,7 +391,7 @@ static int do_task_stat(struct seq_file
state = *get_task_state(task);
vsize = eip = esp = 0;
- permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
+ permitted = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS | PTRACE_MODE_NOAUDIT);
mm = get_task_mm(task);
if (mm) {
vsize = task_vsize(mm);
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -207,7 +207,7 @@ static int proc_pid_cmdline(struct task_
static int proc_pid_auxv(struct task_struct *task, char *buffer)
{
- struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ);
+ struct mm_struct *mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
int res = PTR_ERR(mm);
if (mm && !IS_ERR(mm)) {
unsigned int nwords = 0;
@@ -236,7 +236,8 @@ static int proc_pid_wchan(struct task_st
wchan = get_wchan(task);
- if (wchan && ptrace_may_access(task, PTRACE_MODE_READ) && !lookup_symbol_name(wchan, symname))
+ if (wchan && ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)
+ && !lookup_symbol_name(wchan, symname))
return sprintf(buffer, "%s", symname);
else
return sprintf(buffer, "0");
@@ -248,7 +249,7 @@ static int lock_trace(struct task_struct
int err = mutex_lock_killable(&task->signal->cred_guard_mutex);
if (err)
return err;
- if (!ptrace_may_access(task, PTRACE_MODE_ATTACH)) {
+ if (!ptrace_may_access(task, PTRACE_MODE_ATTACH_FSCREDS)) {
mutex_unlock(&task->signal->cred_guard_mutex);
return -EPERM;
}
@@ -522,7 +523,7 @@ static int proc_fd_access_allowed(struct
*/
task = get_proc_task(inode);
if (task) {
- allowed = ptrace_may_access(task, PTRACE_MODE_READ);
+ allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
put_task_struct(task);
}
return allowed;
@@ -557,7 +558,7 @@ static bool has_pid_permissions(struct p
return true;
if (in_group_p(pid->pid_gid))
return true;
- return ptrace_may_access(task, PTRACE_MODE_READ);
+ return ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);
}
@@ -672,7 +673,7 @@ static int __mem_open(struct inode *inod
if (!task)
return -ESRCH;
- mm = mm_access(task, mode);
+ mm = mm_access(task, mode | PTRACE_MODE_FSCREDS);
put_task_struct(task);
if (IS_ERR(mm))
@@ -1729,7 +1730,7 @@ static int map_files_d_revalidate(struct
if (!task)
goto out_notask;
- mm = mm_access(task, PTRACE_MODE_READ);
+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
if (IS_ERR_OR_NULL(mm))
goto out;
@@ -1864,7 +1865,7 @@ static struct dentry *proc_map_files_loo
goto out;
result = -EACCES;
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto out_put_task;
result = -ENOENT;
@@ -1921,7 +1922,7 @@ proc_map_files_readdir(struct file *file
goto out;
ret = -EACCES;
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto out_put_task;
ret = 0;
@@ -2400,7 +2401,7 @@ static int do_io_accounting(struct task_
if (result)
return result;
- if (!ptrace_may_access(task, PTRACE_MODE_READ)) {
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS)) {
result = -EACCES;
goto out_unlock;
}
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -119,7 +119,7 @@ static void *proc_ns_follow_link(struct
if (!task)
goto out;
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto out_put_task;
ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns.ns_ops);
@@ -152,7 +152,7 @@ static int proc_ns_readlink(struct dentr
if (!task)
goto out;
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS))
goto out_put_task;
res = -ENOENT;
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -56,7 +56,29 @@ extern void exit_ptrace(struct task_stru
#define PTRACE_MODE_READ 0x01
#define PTRACE_MODE_ATTACH 0x02
#define PTRACE_MODE_NOAUDIT 0x04
-/* Returns true on success, false on denial. */
+#define PTRACE_MODE_FSCREDS 0x08
+#define PTRACE_MODE_REALCREDS 0x10
+
+/* shorthands for READ/ATTACH and FSCREDS/REALCREDS combinations */
+#define PTRACE_MODE_READ_FSCREDS (PTRACE_MODE_READ | PTRACE_MODE_FSCREDS)
+#define PTRACE_MODE_READ_REALCREDS (PTRACE_MODE_READ | PTRACE_MODE_REALCREDS)
+#define PTRACE_MODE_ATTACH_FSCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_FSCREDS)
+#define PTRACE_MODE_ATTACH_REALCREDS (PTRACE_MODE_ATTACH | PTRACE_MODE_REALCREDS)
+
+/**
+ * ptrace_may_access - check whether the caller is permitted to access
+ * a target task.
+ * @task: target task
+ * @mode: selects type of access and caller credentials
+ *
+ * Returns true on success, false on denial.
+ *
+ * One of the flags PTRACE_MODE_FSCREDS and PTRACE_MODE_REALCREDS must
+ * be set in @mode to specify whether the access was requested through
+ * a filesystem syscall (should use effective capabilities and fsuid
+ * of the caller) or through an explicit syscall such as
+ * process_vm_writev or ptrace (and should use the real credentials).
+ */
extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
static inline int ptrace_reparented(struct task_struct *child)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3247,7 +3247,7 @@ find_lively_task_by_vpid(pid_t vpid)
/* Reuse ptrace permission checks for now. */
err = -EACCES;
- if (!ptrace_may_access(task, PTRACE_MODE_READ))
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS))
goto errout;
return task;
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2797,7 +2797,7 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
}
ret = -EPERM;
- if (!ptrace_may_access(p, PTRACE_MODE_READ))
+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
goto err_unlock;
head = p->robust_list;
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -155,7 +155,7 @@ COMPAT_SYSCALL_DEFINE3(get_robust_list,
}
ret = -EPERM;
- if (!ptrace_may_access(p, PTRACE_MODE_READ))
+ if (!ptrace_may_access(p, PTRACE_MODE_READ_REALCREDS))
goto err_unlock;
head = p->compat_robust_list;
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -122,8 +122,8 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t
&task2->signal->cred_guard_mutex);
if (ret)
goto err;
- if (!ptrace_may_access(task1, PTRACE_MODE_READ) ||
- !ptrace_may_access(task2, PTRACE_MODE_READ)) {
+ if (!ptrace_may_access(task1, PTRACE_MODE_READ_REALCREDS) ||
+ !ptrace_may_access(task2, PTRACE_MODE_READ_REALCREDS)) {
ret = -EPERM;
goto err_unlock;
}
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -231,6 +231,14 @@ static int ptrace_has_cap(struct user_na
static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
{
const struct cred *cred = current_cred(), *tcred;
+ int dumpable = 0;
+ kuid_t caller_uid;
+ kgid_t caller_gid;
+
+ if (!(mode & PTRACE_MODE_FSCREDS) == !(mode & PTRACE_MODE_REALCREDS)) {
+ WARN(1, "denying ptrace access check without PTRACE_MODE_*CREDS\n");
+ return -EPERM;
+ }
/* May we inspect the given task?
* This check is used both for attaching with ptrace
@@ -240,18 +248,33 @@ static int __ptrace_may_access(struct ta
* because setting up the necessary parent/child relationship
* or halting the specified task is impossible.
*/
- int dumpable = 0;
+
/* Don't let security modules deny introspection */
if (same_thread_group(task, current))
return 0;
rcu_read_lock();
+ if (mode & PTRACE_MODE_FSCREDS) {
+ caller_uid = cred->fsuid;
+ caller_gid = cred->fsgid;
+ } else {
+ /*
+ * Using the euid would make more sense here, but something
+ * in userland might rely on the old behavior, and this
+ * shouldn't be a security problem since
+ * PTRACE_MODE_REALCREDS implies that the caller explicitly
+ * used a syscall that requests access to another process
+ * (and not a filesystem syscall to procfs).
+ */
+ caller_uid = cred->uid;
+ caller_gid = cred->gid;
+ }
tcred = __task_cred(task);
- if (uid_eq(cred->uid, tcred->euid) &&
- uid_eq(cred->uid, tcred->suid) &&
- uid_eq(cred->uid, tcred->uid) &&
- gid_eq(cred->gid, tcred->egid) &&
- gid_eq(cred->gid, tcred->sgid) &&
- gid_eq(cred->gid, tcred->gid))
+ if (uid_eq(caller_uid, tcred->euid) &&
+ uid_eq(caller_uid, tcred->suid) &&
+ uid_eq(caller_uid, tcred->uid) &&
+ gid_eq(caller_gid, tcred->egid) &&
+ gid_eq(caller_gid, tcred->sgid) &&
+ gid_eq(caller_gid, tcred->gid))
goto ok;
if (ptrace_has_cap(tcred->user_ns, mode))
goto ok;
@@ -318,7 +341,7 @@ static int ptrace_attach(struct task_str
goto out;
task_lock(task);
- retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
+ retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH_REALCREDS);
task_unlock(task);
if (retval)
goto unlock_creds;
--- a/mm/process_vm_access.c
+++ b/mm/process_vm_access.c
@@ -197,7 +197,7 @@ static ssize_t process_vm_rw_core(pid_t
goto free_proc_pages;
}
- mm = mm_access(task, PTRACE_MODE_ATTACH);
+ mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS);
if (!mm || IS_ERR(mm)) {
rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
/*
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -142,12 +142,17 @@ int cap_ptrace_access_check(struct task_
{
int ret = 0;
const struct cred *cred, *child_cred;
+ const kernel_cap_t *caller_caps;
rcu_read_lock();
cred = current_cred();
child_cred = __task_cred(child);
+ if (mode & PTRACE_MODE_FSCREDS)
+ caller_caps = &cred->cap_effective;
+ else
+ caller_caps = &cred->cap_permitted;
if (cred->user_ns == child_cred->user_ns &&
- cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+ cap_issubset(child_cred->cap_permitted, *caller_caps))
goto out;
if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
goto out;
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -165,7 +165,7 @@ static void *m_start(struct seq_file *m,
if (!priv->task)
return ERR_PTR(-ESRCH);
- mm = mm_access(priv->task, PTRACE_MODE_READ);
+ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
if (!mm || IS_ERR(mm))
return mm;
down_read(&mm->mmap_sem);
@@ -1188,7 +1188,7 @@ static ssize_t pagemap_read(struct file
if (!pm.buffer)
goto out_task;
- mm = mm_access(task, PTRACE_MODE_READ);
+ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
ret = PTR_ERR(mm);
if (!mm || IS_ERR(mm))
goto out_free;
--- a/fs/proc/task_nommu.c
+++ b/fs/proc/task_nommu.c
@@ -216,7 +216,7 @@ static void *m_start(struct seq_file *m,
if (!priv->task)
return ERR_PTR(-ESRCH);
- mm = mm_access(priv->task, PTRACE_MODE_READ);
+ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
if (!mm || IS_ERR(mm)) {
put_task_struct(priv->task);
priv->task = NULL;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 221/233] ALSA: hda - set input_path bitmap to zero after moving it to new place
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (169 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 228/233] ptrace: use fsuid, fsgid, effective creds for fs access checks Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 178/233] fix ufs_isblockset() Ben Hutchings
` (62 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Hui Wang, Takashi Iwai
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
commit a8f20fd25bdce81a8e41767c39f456d346b63427 upstream.
Recently we met a problem, the codec has valid adcs and input pins,
and they can form valid input paths, but the driver does not build
valid controls for them like "Mic boost", "Capture Volume" and
"Capture Switch".
Through debugging, I found the driver needs to shrink the invalid
adcs and input paths for this machine, so it will move the whole
column bitmap value to the previous column, after moving it, the
driver forgets to set the original column bitmap value to zero, as a
result, the driver will invalidate the path whose index value is the
original colume bitmap value. After executing this function, all
valid input paths are invalidated by a mistake, there are no any
valid input paths, so the driver won't build controls for them.
Fixes: 3a65bcdc577a ("ALSA: hda - Fix inconsistent input_paths after ADC reduction")
Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/pci/hda/hda_generic.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -3039,6 +3039,7 @@ static int check_dyn_adc_switch(struct h
spec->input_paths[i][nums]);
spec->input_paths[i][nums] =
spec->input_paths[i][n];
+ spec->input_paths[i][n] = 0;
}
}
nums++;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 178/233] fix ufs_isblockset()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (170 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 221/233] ALSA: hda - set input_path bitmap to zero after moving it to new place Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 158/233] arm64: KVM: Preserve RES1 bits in SCTLR_EL2 Ben Hutchings
` (61 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 414cf7186dbec29bd946c138d6b5c09da5955a08 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ufs/util.h | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/fs/ufs/util.h
+++ b/fs/ufs/util.h
@@ -473,15 +473,19 @@ static inline unsigned _ubh_find_last_ze
static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi,
struct ufs_buffer_head * ubh, unsigned begin, unsigned block)
{
+ u8 mask;
switch (uspi->s_fpb) {
case 8:
return (*ubh_get_addr (ubh, begin + block) == 0xff);
case 4:
- return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2)));
+ mask = 0x0f << ((block & 0x01) << 2);
+ return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask;
case 2:
- return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1)));
+ mask = 0x03 << ((block & 0x03) << 1);
+ return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask;
case 1:
- return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07)));
+ mask = 0x01 << (block & 0x07);
+ return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask;
}
return 0;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 158/233] arm64: KVM: Preserve RES1 bits in SCTLR_EL2
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (171 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 178/233] fix ufs_isblockset() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 180/233] ufs: set correct ->s_maxsize Ben Hutchings
` (60 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Christoffer Dall, Marc Zyngier
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <marc.zyngier@arm.com>
commit d68c1f7fd1b7148dab5fe658321d511998969f2d upstream.
__do_hyp_init has the rather bad habit of ignoring RES1 bits and
writing them back as zero. On a v8.0-8.2 CPU, this doesn't do anything
bad, but may end-up being pretty nasty on future revisions of the
architecture.
Let's preserve those bits so that we don't have to fix this later on.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
[bwh: Backported to 3.16:
- s/ELx/EL2/
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -89,6 +89,11 @@
#define SCTLR_EL2_C (1 << 2)
#define SCTLR_EL2_A (1 << 1)
#define SCTLR_EL2_M 1
+
+#define SCTLR_EL2_RES1 ((1 << 4) | (1 << 5) | (1 << 11) | (1 << 16) | \
+ (1 << 16) | (1 << 18) | (1 << 22) | (1 << 23) | \
+ (1 << 28) | (1 << 29))
+
#define SCTLR_EL2_FLAGS (SCTLR_EL2_M | SCTLR_EL2_A | SCTLR_EL2_C | \
SCTLR_EL2_SA | SCTLR_EL2_I)
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -84,10 +84,12 @@ __do_hyp_init:
tlbi alle2
dsb sy
- mrs x4, sctlr_el2
- and x4, x4, #SCTLR_EL2_EE // preserve endianness of EL2
- ldr x5, =SCTLR_EL2_FLAGS
- orr x4, x4, x5
+ /*
+ * Preserve all the RES1 bits while setting the default flags,
+ * as well as the EE bit on BE.
+ */
+ ldr x4, =(SCTLR_EL2_RES1 | SCTLR_EL2_FLAGS)
+CPU_BE( orr x4, x4, #SCTLR_EL2_EE)
msr sctlr_el2, x4
isb
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 180/233] ufs: set correct ->s_maxsize
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (172 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 158/233] arm64: KVM: Preserve RES1 bits in SCTLR_EL2 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 199/233] swap: cond_resched in swap_cgroup_prepare() Ben Hutchings
` (59 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 6b0d144fa758869bdd652c50aa41aaf601232550 upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ufs/super.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -767,6 +767,23 @@ static void ufs_put_super(struct super_b
return;
}
+static u64 ufs_max_bytes(struct super_block *sb)
+{
+ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
+ int bits = uspi->s_apbshift;
+ u64 res;
+
+ if (bits > 21)
+ res = ~0ULL;
+ else
+ res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) +
+ (1LL << (3*bits));
+
+ if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift))
+ return MAX_LFS_FILESIZE;
+ return res << uspi->s_bshift;
+}
+
static int ufs_fill_super(struct super_block *sb, void *data, int silent)
{
struct ufs_sb_info * sbi;
@@ -1233,6 +1250,7 @@ magic_found:
"fast symlink size (%u)\n", uspi->s_maxsymlinklen);
uspi->s_maxsymlinklen = maxsymlen;
}
+ sb->s_maxbytes = ufs_max_bytes(sb);
sb->s_max_links = UFS_LINK_MAX;
inode = ufs_iget(sb, UFS_ROOTINO);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 199/233] swap: cond_resched in swap_cgroup_prepare()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (173 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 180/233] ufs: set correct ->s_maxsize Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 156/233] HID: Add quirk for Dell PIXART OEM mouse Ben Hutchings
` (58 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Vladimir Davydov, Linus Torvalds, Yu Zhao, Michal Hocko
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yu Zhao <yuzhao@google.com>
commit ef70762948dde012146926720b70e79736336764 upstream.
I saw need_resched() warnings when swapping on large swapfile (TBs)
because continuously allocating many pages in swap_cgroup_prepare() took
too long.
We already cond_resched when freeing page in swap_cgroup_swapoff(). Do
the same for the page allocation.
Link: http://lkml.kernel.org/r/20170604200109.17606-1-yuzhao@google.com
Signed-off-by: Yu Zhao <yuzhao@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Vladimir Davydov <vdavydov.dev@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/page_cgroup.c | 3 +++
1 file changed, 3 insertions(+)
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -368,6 +368,9 @@ static int swap_cgroup_prepare(int type)
if (!page)
goto not_enough_page;
ctrl->map[idx] = page;
+
+ if (!(idx % SWAP_CLUSTER_MAX))
+ cond_resched();
}
return 0;
not_enough_page:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 156/233] HID: Add quirk for Dell PIXART OEM mouse
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (174 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 199/233] swap: cond_resched in swap_cgroup_prepare() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 174/233] srcu: Allow use of Classic SRCU from both process and interrupt context Ben Hutchings
` (57 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Sebastian Parschauer, Jiri Kosina
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Parschauer <sparschauer@suse.de>
commit 3db28271f0feae129262d30e41384a7c4c767987 upstream.
This mouse is also known under other IDs. It needs the quirk
ALWAYS_POLL or will disconnect in runlevel 1 or 3.
Signed-off-by: Sebastian Parschauer <sparschauer@suse.de>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/usbhid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -290,6 +290,9 @@
#define USB_VENDOR_ID_DEALEXTREAME 0x10c5
#define USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701 0x819a
+#define USB_VENDOR_ID_DELL 0x413c
+#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a
+
#define USB_VENDOR_ID_DELORME 0x1163
#define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100
#define USB_DEVICE_ID_DELORME_EM_LT20 0x0200
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -85,6 +85,7 @@ static const struct hid_blacklist {
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_SCIMITAR_PRO_RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL },
{ USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT },
{ USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_PS3, HID_QUIRK_MULTI_INPUT },
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 174/233] srcu: Allow use of Classic SRCU from both process and interrupt context
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (175 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 156/233] HID: Add quirk for Dell PIXART OEM mouse Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 182/233] l2tp: cast l2tp traffic counter to unsigned Ben Hutchings
` (56 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Paolo Bonzini, Paul E. McKenney, Linu Cherian, Linus Torvalds, kvm
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit 1123a6041654e8f889014659593bad4168e542c2 upstream.
Linu Cherian reported a WARN in cleanup_srcu_struct() when shutting
down a guest running iperf on a VFIO assigned device. This happens
because irqfd_wakeup() calls srcu_read_lock(&kvm->irq_srcu) in interrupt
context, while a worker thread does the same inside kvm_set_irq(). If the
interrupt happens while the worker thread is executing __srcu_read_lock(),
updates to the Classic SRCU ->lock_count[] field or the Tree SRCU
->srcu_lock_count[] field can be lost.
The docs say you are not supposed to call srcu_read_lock() and
srcu_read_unlock() from irq context, but KVM interrupt injection happens
from (host) interrupt context and it would be nice if SRCU supported the
use case. KVM is using SRCU here not really for the "sleepable" part,
but rather due to its IPI-free fast detection of grace periods. It is
therefore not desirable to switch back to RCU, which would effectively
revert commit 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING",
2014-01-16).
However, the docs are overly conservative. You can have an SRCU instance
only has users in irq context, and you can mix process and irq context
as long as process context users disable interrupts. In addition,
__srcu_read_unlock() actually uses this_cpu_dec() on both Tree SRCU and
Classic SRCU. For those two implementations, only srcu_read_lock()
is unsafe.
When Classic SRCU's __srcu_read_unlock() was changed to use this_cpu_dec(),
in commit 5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via
this_cpu_dec()", 2012-11-29), __srcu_read_lock() did two increments.
Therefore it kept __this_cpu_inc(), with preempt_disable/enable in
the caller. Tree SRCU however only does one increment, so on most
architectures it is more efficient for __srcu_read_lock() to use
this_cpu_inc(), and any performance differences appear to be down in
the noise.
Fixes: 719d93cd5f5c ("kvm/irqchip: Speed up KVM_SET_GSI_ROUTING")
Reported-by: Linu Cherian <linuc.decode@gmail.com>
Suggested-by: Linu Cherian <linuc.decode@gmail.com>
Cc: kvm@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
[bwh: Backported to 3.16: __srcu_read_lock() still updates two different
counters. So follow what _this_cpu_generic_to_op() does and use
raw_local_irq_{save,restore}() and raw_cpu_ptr().]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/linux/srcu.h
+++ b/include/linux/srcu.h
@@ -219,9 +219,7 @@ static inline int srcu_read_lock(struct
{
int retval;
- preempt_disable();
retval = __srcu_read_lock(sp);
- preempt_enable();
rcu_lock_acquire(&(sp)->dep_map);
return retval;
}
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -289,17 +289,20 @@ EXPORT_SYMBOL_GPL(cleanup_srcu_struct);
/*
* Counts the new reader in the appropriate per-CPU element of the
- * srcu_struct. Must be called from process context.
+ * srcu_struct.
* Returns an index that must be passed to the matching srcu_read_unlock().
*/
int __srcu_read_lock(struct srcu_struct *sp)
{
+ unsigned long flags;
int idx;
idx = ACCESS_ONCE(sp->completed) & 0x1;
- ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
+ raw_local_irq_save(flags);
+ ACCESS_ONCE(raw_cpu_ptr(sp->per_cpu_ref)->c[idx]) += 1;
smp_mb(); /* B */ /* Avoid leaking the critical section. */
- ACCESS_ONCE(this_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
+ ACCESS_ONCE(raw_cpu_ptr(sp->per_cpu_ref)->seq[idx]) += 1;
+ raw_local_irq_restore(flags);
return idx;
}
EXPORT_SYMBOL_GPL(__srcu_read_lock);
@@ -308,7 +311,6 @@ EXPORT_SYMBOL_GPL(__srcu_read_lock);
* Removes the count for the old reader from the appropriate per-CPU
* element of the srcu_struct. Note that this may well be a different
* CPU than that which was incremented by the corresponding srcu_read_lock().
- * Must be called from process context.
*/
void __srcu_read_unlock(struct srcu_struct *sp, int idx)
{
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 182/233] l2tp: cast l2tp traffic counter to unsigned
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (176 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 174/233] srcu: Allow use of Classic SRCU from both process and interrupt context Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 184/233] configfs: Fix race between create_link and configfs_rmdir Ben Hutchings
` (55 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tom Parkin, Dominik Heidler, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dominik Heidler <dheidler@suse.de>
commit 9b3dc0a17d7388c4fb83736ca45253a93e994ce4 upstream.
This fixes a counter problem on 32bit systems:
When the rx_bytes counter reached 2 GiB, it jumpd to (2^64 Bytes - 2GiB) Bytes.
rtnl_link_stats64 has __u64 type and atomic_long_read returns
atomic_long_t which is signed. Due to the conversation
we get an incorrect value on 32bit systems if the MSB of
the atomic_long_t value is set.
CC: Tom Parkin <tparkin@katalix.com>
Fixes: 7b7c0719cd7a ("l2tp: avoid deadlock in l2tp stats update")
Signed-off-by: Dominik Heidler <dheidler@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_eth.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -111,12 +111,13 @@ static struct rtnl_link_stats64 *l2tp_et
{
struct l2tp_eth *priv = netdev_priv(dev);
- stats->tx_bytes = atomic_long_read(&priv->tx_bytes);
- stats->tx_packets = atomic_long_read(&priv->tx_packets);
- stats->tx_dropped = atomic_long_read(&priv->tx_dropped);
- stats->rx_bytes = atomic_long_read(&priv->rx_bytes);
- stats->rx_packets = atomic_long_read(&priv->rx_packets);
- stats->rx_errors = atomic_long_read(&priv->rx_errors);
+ stats->tx_bytes = (unsigned long) atomic_long_read(&priv->tx_bytes);
+ stats->tx_packets = (unsigned long) atomic_long_read(&priv->tx_packets);
+ stats->tx_dropped = (unsigned long) atomic_long_read(&priv->tx_dropped);
+ stats->rx_bytes = (unsigned long) atomic_long_read(&priv->rx_bytes);
+ stats->rx_packets = (unsigned long) atomic_long_read(&priv->rx_packets);
+ stats->rx_errors = (unsigned long) atomic_long_read(&priv->rx_errors);
+
return stats;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 184/233] configfs: Fix race between create_link and configfs_rmdir
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (177 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 182/233] l2tp: cast l2tp traffic counter to unsigned Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 208/233] i2c: imx: Use correct function to write to register Ben Hutchings
` (54 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Nicholas Bellinger, Bryant G. Ly, Christoph Hellwig
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit ba80aa909c99802c428682c352b0ee0baac0acd3 upstream.
This patch closes a long standing race in configfs between
the creation of a new symlink in create_link(), while the
symlink target's config_item is being concurrently removed
via configfs_rmdir().
This can happen because the symlink target's reference
is obtained by config_item_get() in create_link() before
the CONFIGFS_USET_DROPPING bit set by configfs_detach_prep()
during configfs_rmdir() shutdown is actually checked..
This originally manifested itself on ppc64 on v4.8.y under
heavy load using ibmvscsi target ports with Novalink API:
[ 7877.289863] rpadlpar_io: slot U8247.22L.212A91A-V1-C8 added
[ 7879.893760] ------------[ cut here ]------------
[ 7879.893768] WARNING: CPU: 15 PID: 17585 at ./include/linux/kref.h:46 config_item_get+0x7c/0x90 [configfs]
[ 7879.893811] CPU: 15 PID: 17585 Comm: targetcli Tainted: G O 4.8.17-customv2.22 #12
[ 7879.893812] task: c00000018a0d3400 task.stack: c0000001f3b40000
[ 7879.893813] NIP: d000000002c664ec LR: d000000002c60980 CTR: c000000000b70870
[ 7879.893814] REGS: c0000001f3b43810 TRAP: 0700 Tainted: G O (4.8.17-customv2.22)
[ 7879.893815] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28222242 XER: 00000000
[ 7879.893820] CFAR: d000000002c664bc SOFTE: 1
GPR00: d000000002c60980 c0000001f3b43a90 d000000002c70908 c0000000fbc06820
GPR04: c0000001ef1bd900 0000000000000004 0000000000000001 0000000000000000
GPR08: 0000000000000000 0000000000000001 d000000002c69560 d000000002c66d80
GPR12: c000000000b70870 c00000000e798700 c0000001f3b43ca0 c0000001d4949d40
GPR16: c00000014637e1c0 0000000000000000 0000000000000000 c0000000f2392940
GPR20: c0000001f3b43b98 0000000000000041 0000000000600000 0000000000000000
GPR24: fffffffffffff000 0000000000000000 d000000002c60be0 c0000001f1dac490
GPR28: 0000000000000004 0000000000000000 c0000001ef1bd900 c0000000f2392940
[ 7879.893839] NIP [d000000002c664ec] config_item_get+0x7c/0x90 [configfs]
[ 7879.893841] LR [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893842] Call Trace:
[ 7879.893844] [c0000001f3b43ac0] [d000000002c60980] check_perm+0x80/0x2e0 [configfs]
[ 7879.893847] [c0000001f3b43b10] [c000000000329770] do_dentry_open+0x2c0/0x460
[ 7879.893849] [c0000001f3b43b70] [c000000000344480] path_openat+0x210/0x1490
[ 7879.893851] [c0000001f3b43c80] [c00000000034708c] do_filp_open+0xfc/0x170
[ 7879.893853] [c0000001f3b43db0] [c00000000032b5bc] do_sys_open+0x1cc/0x390
[ 7879.893856] [c0000001f3b43e30] [c000000000009584] system_call+0x38/0xec
[ 7879.893856] Instruction dump:
[ 7879.893858] 409d0014 38210030 e8010010 7c0803a6 4e800020 3d220000 e94981e0 892a0000
[ 7879.893861] 2f890000 409effe0 39200001 992a0000 <0fe00000> 4bffffd0 60000000 60000000
[ 7879.893866] ---[ end trace 14078f0b3b5ad0aa ]---
To close this race, go ahead and obtain the symlink's target
config_item reference only after the existing CONFIGFS_USET_DROPPING
check succeeds.
This way, if configfs_rmdir() wins create_link() will return -ENONET,
and if create_link() wins configfs_rmdir() will return -EBUSY.
Reported-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Tested-by: Bryant G. Ly <bryantly@linux.vnet.ibm.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/configfs/symlink.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/configfs/symlink.c
+++ b/fs/configfs/symlink.c
@@ -83,14 +83,13 @@ static int create_link(struct config_ite
ret = -ENOMEM;
sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL);
if (sl) {
- sl->sl_target = config_item_get(item);
spin_lock(&configfs_dirent_lock);
if (target_sd->s_type & CONFIGFS_USET_DROPPING) {
spin_unlock(&configfs_dirent_lock);
- config_item_put(item);
kfree(sl);
return -ENOENT;
}
+ sl->sl_target = config_item_get(item);
list_add(&sl->sl_list, &target_sd->s_links);
spin_unlock(&configfs_dirent_lock);
ret = configfs_create_link(sl, parent_item->ci_dentry,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 208/233] i2c: imx: Use correct function to write to register
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (178 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 184/233] configfs: Fix race between create_link and configfs_rmdir Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 224/233] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Ben Hutchings
` (53 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Michail Georgios Etairidis, Fugang Duan, Wolfram Sang,
Uwe Kleine-König
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michail Georgios Etairidis <m.etairidis@beck-ipc.com>
commit 6c782a5ea56a799658e213a78dc1455264938afa upstream.
The i2c-imx driver incorrectly uses readb()/writeb() to read and
write to the appropriate registers when performing a repeated start.
The appropriate imx_i2c_read_reg()/imx_i2c_write_reg() functions
should be used instead. Performing a repeated start results in
a kernel panic. The platform is imx.
Signed-off-by: Michail G Etairidis <m.etairidis@beck-ipc.com>
Fixes: ce1a78840ff7 ("i2c: imx: add DMA support for freescale i2c driver")
Fixes: 054b62d9f25c ("i2c: imx: fix the i2c bus hang issue when do repeat restart")
Acked-by: Fugang Duan <fugang.duan@nxp.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
[bwh: Backported to 3.16: drop changes in i2c_imx_dma_read()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -542,9 +542,9 @@ static int i2c_imx_read(struct imx_i2c_s
* the first read operation, otherwise the first read cost
* one extra clock cycle.
*/
- temp = readb(i2c_imx->base + IMX_I2C_I2CR);
+ temp = imx_i2c_read_reg(i2c_imx, IMX_I2C_I2CR);
temp |= I2CR_MTX;
- writeb(temp, i2c_imx->base + IMX_I2C_I2CR);
+ imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2CR);
}
} else if (i == (msgs->len - 2)) {
dev_dbg(&i2c_imx->adapter.dev,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 224/233] MIPS: pm-cps: Drop manual cache-line alignment of ready_count
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (179 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 208/233] i2c: imx: Use correct function to write to register Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 195/233] KVM: PPC: Book3S HV: Preserve userspace HTM state properly Ben Hutchings
` (52 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, linux-mips, Paul Burton, Ralf Baechle, Bryan O'Donoghue
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit 161c51ccb7a6faf45ffe09aa5cf1ad85ccdad503 upstream.
We allocate memory for a ready_count variable per-CPU, which is accessed
via a cached non-coherent TLB mapping to perform synchronisation between
threads within the core using LL/SC instructions. In order to ensure
that the variable is contained within its own data cache line we
allocate 2 lines worth of memory & align the resulting pointer to a line
boundary. This is however unnecessary, since kmalloc is guaranteed to
return memory which is at least cache-line aligned (see
ARCH_DMA_MINALIGN). Stop the redundant manual alignment.
Besides cleaning up the code & avoiding needless work, this has the side
effect of avoiding an arithmetic error found by Bryan on 64 bit systems
due to the 32 bit size of the former dlinesz. This led the ready_count
variable to have its upper 32b cleared erroneously for MIPS64 kernels,
causing problems when ready_count was later used on MIPS64 via cpuidle.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: 3179d37ee1ed ("MIPS: pm-cps: add PM state entry code for CPS systems")
Reported-by: Bryan O'Donoghue <bryan.odonoghue@imgtec.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@imgtec.com>
Tested-by: Bryan O'Donoghue <bryan.odonoghue@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15383/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/kernel/pm-cps.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
--- a/arch/mips/kernel/pm-cps.c
+++ b/arch/mips/kernel/pm-cps.c
@@ -55,7 +55,6 @@ DECLARE_BITMAP(state_support, CPS_PM_STA
* state. Actually per-core rather than per-CPU.
*/
static DEFINE_PER_CPU_ALIGNED(u32*, ready_count);
-static DEFINE_PER_CPU_ALIGNED(void*, ready_count_alloc);
/* Indicates online CPUs coupled with the current CPU */
static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled);
@@ -616,7 +615,6 @@ static int __init cps_gen_core_entries(u
{
enum cps_pm_state state;
unsigned core = cpu_data[cpu].core;
- unsigned dlinesz = cpu_data[cpu].dcache.linesz;
void *entry_fn, *core_rc;
for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) {
@@ -636,16 +634,11 @@ static int __init cps_gen_core_entries(u
}
if (!per_cpu(ready_count, core)) {
- core_rc = kmalloc(dlinesz * 2, GFP_KERNEL);
+ core_rc = kmalloc(sizeof(u32), GFP_KERNEL);
if (!core_rc) {
pr_err("Failed allocate core %u ready_count\n", core);
return -ENOMEM;
}
- per_cpu(ready_count_alloc, core) = core_rc;
-
- /* Ensure ready_count is aligned to a cacheline boundary */
- core_rc += dlinesz - 1;
- core_rc = (void *)((unsigned long)core_rc & ~(dlinesz - 1));
per_cpu(ready_count, core) = core_rc;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 195/233] KVM: PPC: Book3S HV: Preserve userspace HTM state properly
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (180 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 224/233] MIPS: pm-cps: Drop manual cache-line alignment of ready_count Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 160/233] arm: KVM: Allow unaligned accesses at HYP Ben Hutchings
` (51 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul Mackerras
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <paulus@ozlabs.org>
commit 46a704f8409f79fd66567ad3f8a7304830a84293 upstream.
If userspace attempts to call the KVM_RUN ioctl when it has hardware
transactional memory (HTM) enabled, the values that it has put in the
HTM-related SPRs TFHAR, TFIAR and TEXASR will get overwritten by
guest values. To fix this, we detect this condition and save those
SPR values in the thread struct, and disable HTM for the task. If
userspace goes to access those SPRs or the HTM facility in future,
a TM-unavailable interrupt will occur and the handler will reload
those SPRs and re-enable HTM.
If userspace has started a transaction and suspended it, we would
currently lose the transactional state in the guest entry path and
would almost certainly get a "TM Bad Thing" interrupt, which would
cause the host to crash. To avoid this, we detect this case and
return from the KVM_RUN ioctl with an EINVAL error, with the KVM
exit reason set to KVM_EXIT_FAIL_ENTRY.
Fixes: b005255e12a3 ("KVM: PPC: Book3S HV: Context-switch new POWER8 SPRs", 2014-01-08)
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/kvm/book3s_hv.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/arch/powerpc/kvm/book3s_hv.c
+++ b/arch/powerpc/kvm/book3s_hv.c
@@ -1802,6 +1802,27 @@ static int kvmppc_vcpu_run_hv(struct kvm
return -EINVAL;
}
+ /*
+ * Don't allow entry with a suspended transaction, because
+ * the guest entry/exit code will lose it.
+ * If the guest has TM enabled, save away their TM-related SPRs
+ * (they will get restored by the TM unavailable interrupt).
+ */
+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM
+ if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs &&
+ (current->thread.regs->msr & MSR_TM)) {
+ if (MSR_TM_ACTIVE(current->thread.regs->msr)) {
+ run->exit_reason = KVM_EXIT_FAIL_ENTRY;
+ run->fail_entry.hardware_entry_failure_reason = 0;
+ return -EINVAL;
+ }
+ current->thread.tm_tfhar = mfspr(SPRN_TFHAR);
+ current->thread.tm_tfiar = mfspr(SPRN_TFIAR);
+ current->thread.tm_texasr = mfspr(SPRN_TEXASR);
+ current->thread.regs->msr &= ~MSR_TM;
+ }
+#endif
+
kvmppc_core_prepare_to_enter(vcpu);
/* No need to go into the guest when all we'll do is come back out */
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 160/233] arm: KVM: Allow unaligned accesses at HYP
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (181 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 195/233] KVM: PPC: Book3S HV: Preserve userspace HTM state properly Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 196/233] i2c: ismt: fix wrong device address when unmap the data buffer Ben Hutchings
` (50 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Marc Zyngier, Christoffer Dall
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <marc.zyngier@arm.com>
commit 33b5c38852b29736f3b472dd095c9a18ec22746f upstream.
We currently have the HSCTLR.A bit set, trapping unaligned accesses
at HYP, but we're not really prepared to deal with it.
Since the rest of the kernel is pretty happy about that, let's follow
its example and set HSCTLR.A to zero. Modern CPUs don't really care.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/kvm/init.S | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/arch/arm/kvm/init.S
+++ b/arch/arm/kvm/init.S
@@ -109,7 +109,6 @@ __do_hyp_init:
@ - Write permission implies XN: disabled
@ - Instruction cache: enabled
@ - Data/Unified cache: enabled
- @ - Memory alignment checks: enabled
@ - MMU: enabled (this code must be run from an identity mapping)
mrc p15, 4, r0, c1, c0, 0 @ HSCR
ldr r2, =HSCTLR_MASK
@@ -117,8 +116,8 @@ __do_hyp_init:
mrc p15, 0, r1, c1, c0, 0 @ SCTLR
ldr r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C)
and r1, r1, r2
- ARM( ldr r2, =(HSCTLR_M | HSCTLR_A) )
- THUMB( ldr r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE) )
+ ARM( ldr r2, =(HSCTLR_M) )
+ THUMB( ldr r2, =(HSCTLR_M | HSCTLR_TE) )
orr r1, r1, r2
orr r0, r0, r1
isb
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 196/233] i2c: ismt: fix wrong device address when unmap the data buffer
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (182 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 160/233] arm: KVM: Allow unaligned accesses at HYP Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 230/233] xfrm: policy: check policy direction value Ben Hutchings
` (49 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Wolfram Sang, Liwei Song, Andy Shevchenko
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Liwei Song <liwei.song@windriver.com>
commit 17e83549e199d89aace7788a9f11c108671eecf5 upstream.
Fix the following kernel bug:
kernel BUG at drivers/iommu/intel-iommu.c:3260!
invalid opcode: 0000 [#5] PREEMPT SMP
Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016
task: ffff880175389950 ti: ffff880176bec000 task.ti: ffff880176bec000
RIP: 0010:[<ffffffff8150a83b>] [<ffffffff8150a83b>] intel_unmap+0x25b/0x260
RSP: 0018:ffff880176bef5e8 EFLAGS: 00010296
RAX: 0000000000000024 RBX: ffff8800773c7c88 RCX: 000000000000ce04
RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000009
RBP: ffff880176bef638 R08: 0000000000000010 R09: 0000000000000004
R10: ffff880175389c78 R11: 0000000000000a4f R12: ffff8800773c7868
R13: 00000000ffffac88 R14: ffff8800773c7818 R15: 0000000000000001
FS: 00007fef21258700(0000) GS:ffff88017b5c0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000066d6d8 CR3: 000000007118c000 CR4: 00000000003406e0
Stack:
00000000ffffac88 ffffffff8199867f ffff880176bef5f8 ffff880100000030
ffff880176bef668 ffff8800773c7c88 ffff880178288098 ffff8800772c0010
ffff8800773c7818 0000000000000001 ffff880176bef648 ffffffff8150a86e
Call Trace:
[<ffffffff8199867f>] ? printk+0x46/0x48
[<ffffffff8150a86e>] intel_unmap_page+0xe/0x10
[<ffffffffa039d99b>] ismt_access+0x27b/0x8fa [i2c_ismt]
[<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
[<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
[<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
[<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
[<ffffffff8143dfd0>] ? pci_bus_read_dev_vendor_id+0xf0/0xf0
[<ffffffff8172b36c>] i2c_smbus_xfer+0xec/0x4b0
[<ffffffff810aa4d5>] ? vprintk_emit+0x345/0x530
[<ffffffffa038936b>] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev]
[<ffffffff810aa829>] ? vprintk_default+0x29/0x40
[<ffffffffa0389b33>] i2cdev_ioctl+0x63/0x1ec [i2c_dev]
[<ffffffff811b04c8>] do_vfs_ioctl+0x328/0x5d0
[<ffffffff8119d8ec>] ? vfs_write+0x11c/0x190
[<ffffffff8109d449>] ? rt_up_read+0x19/0x20
[<ffffffff811b07f1>] SyS_ioctl+0x81/0xa0
[<ffffffff819a351b>] system_call_fastpath+0x16/0x6e
This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter.
After finished I2C block read/write, when unmap the data buffer,
a wrong device address was pass to dma_unmap_single().
To fix this, give dma_unmap_single() the "dev" parameter, just like
what dma_map_single() does, then unmap can find the right devices.
Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller")
Signed-off-by: Liwei Song <liwei.song@windriver.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/i2c/busses/i2c-ismt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -586,7 +586,7 @@ static int ismt_access(struct i2c_adapte
/* unmap the data buffer */
if (dma_size != 0)
- dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
+ dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
if (unlikely(!ret)) {
dev_err(dev, "completion wait timed out\n");
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 230/233] xfrm: policy: check policy direction value
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (183 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 196/233] i2c: ismt: fix wrong device address when unmap the data buffer Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 214/233] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Ben Hutchings
` (48 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, bo Zhang, Steffen Klassert, Vladis Dronov
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Vladis Dronov <vdronov@redhat.com>
commit 7bab09631c2a303f87a7eb7e3d69e888673b9b7e upstream.
The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
as an array index. This can lead to an out-of-bound access, kernel lockup and
DoS. Add a check for the 'dir' value.
This fixes CVE-2017-11600.
References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
Fixes: 80c9abaabf42 ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Reported-by: "bo Zhang" <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/xfrm/xfrm_policy.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3123,9 +3123,15 @@ int xfrm_migrate(const struct xfrm_selec
struct xfrm_state *x_new[XFRM_MAX_DEPTH];
struct xfrm_migrate *mp;
+ /* Stage 0 - sanity checks */
if ((err = xfrm_migrate_check(m, num_migrate)) < 0)
goto out;
+ if (dir >= XFRM_POLICY_MAX) {
+ err = -EINVAL;
+ goto out;
+ }
+
/* Stage 1 - find policy */
if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) {
err = -ENOENT;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 214/233] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (184 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 230/233] xfrm: policy: check policy direction value Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 211/233] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER Ben Hutchings
` (47 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, zheng li
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: zheng li <james.z.li@ericsson.com>
commit 0a28cfd51e17f4f0a056bcf66bfbe492c3b99f38 upstream.
There is an inconsistent conditional judgement in __ip_append_data and
ip_finish_output functions, the variable length in __ip_append_data just
include the length of application's payload and udp header, don't include
the length of ip header, but in ip_finish_output use
(skb->len > ip_skb_dst_mtu(skb)) as judgement, and skb->len include the
length of ip header.
That causes some particular application's udp payload whose length is
between (MTU - IP Header) and MTU were fragmented by ip_fragment even
though the rst->dev support UFO feature.
Add the length of ip header to length in __ip_append_data to keep
consistent conditional judgement as ip_finish_output for ip fragment.
Signed-off-by: Zheng Li <james.z.li@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context to apply after "udp: consistently apply
ufo or fragmentation"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/ip_output.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -886,7 +886,7 @@ static int __ip_append_data(struct sock
cork->length += length;
if ((skb && skb_is_gso(skb)) ||
- ((length > mtu) &&
+ (((length + fragheaderlen) > mtu) &&
(skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 211/233] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (185 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 214/233] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 175/233] KEYS: fix dereferencing NULL payload with nonzero length Ben Hutchings
` (46 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, jeffy, WANG Cong, David S. Miller, David Ahern
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 76da0704507bbc51875013f6557877ab308cfd0a upstream.
In commit 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
I assumed NETDEV_REGISTER and NETDEV_UNREGISTER are paired,
unfortunately, as reported by jeffy, netdev_wait_allrefs()
could rebroadcast NETDEV_UNREGISTER event until all refs are
gone.
We have to add an additional check to avoid this corner case.
For netdev_wait_allrefs() dev->reg_state is NETREG_UNREGISTERED,
for dev_change_net_namespace(), dev->reg_state is
NETREG_REGISTERED. So check for dev->reg_state != NETREG_UNREGISTERED.
Fixes: 242d3a49a2a1 ("ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf")
Reported-by: jeffy <jeffy.chen@rock-chips.com>
Cc: David Ahern <dsahern@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv6/route.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2835,7 +2835,11 @@ static int ip6_route_dev_notify(struct n
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
- } else if (event == NETDEV_UNREGISTER) {
+ } else if (event == NETDEV_UNREGISTER &&
+ dev->reg_state != NETREG_UNREGISTERED) {
+ /* NETDEV_UNREGISTER could be fired for multiple times by
+ * netdev_wait_allrefs(). Make sure we only call this once.
+ */
in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 175/233] KEYS: fix dereferencing NULL payload with nonzero length
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (186 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 211/233] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 201/233] signal: Only reschedule timers on signals timers have sent Ben Hutchings
` (45 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David Howells, James Morris, Eric Biggers
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 5649645d725c73df4302428ee4e02c869248b4c5 upstream.
sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a
NULL payload with nonzero length to be passed to the key type's
->preparse(), ->instantiate(), and/or ->update() methods. Various key
types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did
not handle this case, allowing an unprivileged user to trivially cause a
NULL pointer dereference (kernel oops) if one of these key types was
present. Fix it by doing the copy_from_user() when 'plen' is nonzero
rather than when '_payload' is non-NULL, causing the syscall to fail
with EFAULT as expected when an invalid buffer is specified.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
security/keys/keyctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -97,7 +97,7 @@ SYSCALL_DEFINE5(add_key, const char __us
payload = NULL;
vm = false;
- if (_payload) {
+ if (plen) {
ret = -ENOMEM;
payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN);
if (!payload) {
@@ -331,7 +331,7 @@ long keyctl_update_key(key_serial_t id,
/* pull the payload in if one was supplied */
payload = NULL;
- if (_payload) {
+ if (plen) {
ret = -ENOMEM;
payload = kmalloc(plen, GFP_KERNEL);
if (!payload)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 201/233] signal: Only reschedule timers on signals timers have sent
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (187 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 175/233] KEYS: fix dereferencing NULL payload with nonzero length Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 218/233] lib/cmdline.c: fix get_options() overflow while parsing ranges Ben Hutchings
` (44 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Eric W. Biederman, Thomas Gleixner
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Eric W. Biederman" <ebiederm@xmission.com>
commit 57db7e4a2d92c2d3dfbca4ef8057849b2682436b upstream.
Thomas Gleixner wrote:
> The CRIU support added a 'feature' which allows a user space task to send
> arbitrary (kernel) signals to itself. The changelog says:
>
> The kernel prevents sending of siginfo with positive si_code, because
> these codes are reserved for kernel. I think we can allow a task to
> send such a siginfo to itself. This operation should not be dangerous.
>
> Quite contrary to that claim, it turns out that it is outright dangerous
> for signals with info->si_code == SI_TIMER. The following code sequence in
> a user space task allows to crash the kernel:
>
> id = timer_create(CLOCK_XXX, ..... signo = SIGX);
> timer_set(id, ....);
> info->si_signo = SIGX;
> info->si_code = SI_TIMER:
> info->_sifields._timer._tid = id;
> info->_sifields._timer._sys_private = 2;
> rt_[tg]sigqueueinfo(..., SIGX, info);
> sigemptyset(&sigset);
> sigaddset(&sigset, SIGX);
> rt_sigtimedwait(sigset, info);
>
> For timers based on CLOCK_PROCESS_CPUTIME_ID, CLOCK_THREAD_CPUTIME_ID this
> results in a kernel crash because sigwait() dequeues the signal and the
> dequeue code observes:
>
> info->si_code == SI_TIMER && info->_sifields._timer._sys_private != 0
>
> which triggers the following callchain:
>
> do_schedule_next_timer() -> posix_cpu_timer_schedule() -> arm_timer()
>
> arm_timer() executes a list_add() on the timer, which is already armed via
> the timer_set() syscall. That's a double list add which corrupts the posix
> cpu timer list. As a consequence the kernel crashes on the next operation
> touching the posix cpu timer list.
>
> Posix clocks which are internally implemented based on hrtimers are not
> affected by this because hrtimer_start() can handle already armed timers
> nicely, but it's a reliable way to trigger the WARN_ON() in
> hrtimer_forward(), which complains about calling that function on an
> already armed timer.
This problem has existed since the posix timer code was merged into
2.5.63. A few releases earlier in 2.5.60 ptrace gained the ability to
inject not just a signal (which linux has supported since 1.0) but the
full siginfo of a signal.
The core problem is that the code will reschedule in response to
signals getting dequeued not just for signals the timers sent but
for other signals that happen to a si_code of SI_TIMER.
Avoid this confusion by testing to see if the queued signal was
preallocated as all timer signals are preallocated, and so far
only the timer code preallocates signals.
Move the check for if a timer needs to be rescheduled up into
collect_signal where the preallocation check must be performed,
and pass the result back to dequeue_signal where the code reschedules
timers. This makes it clear why the code cares about preallocated
timers.
Reported-by: Thomas Gleixner <tglx@linutronix.de>
History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
Reference: 66dd34ad31e5 ("signal: allow to send any siginfo to itself")
Reference: 1669ce53e2ff ("Add PTRACE_GETSIGINFO and PTRACE_SETSIGINFO")
Fixes: db8b50ba75f2 ("[PATCH] POSIX clocks & timers")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/signal.c | 20 ++++++++++++++------
1 file changed, 14 insertions(+), 6 deletions(-)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -543,7 +543,8 @@ unblock_all_signals(void)
spin_unlock_irqrestore(¤t->sighand->siglock, flags);
}
-static void collect_signal(int sig, struct sigpending *list, siginfo_t *info)
+static void collect_signal(int sig, struct sigpending *list, siginfo_t *info,
+ bool *resched_timer)
{
struct sigqueue *q, *first = NULL;
@@ -565,6 +566,12 @@ static void collect_signal(int sig, stru
still_pending:
list_del_init(&first->list);
copy_siginfo(info, &first->info);
+
+ *resched_timer =
+ (first->flags & SIGQUEUE_PREALLOC) &&
+ (info->si_code == SI_TIMER) &&
+ (info->si_sys_private);
+
__sigqueue_free(first);
} else {
/*
@@ -581,7 +588,7 @@ still_pending:
}
static int __dequeue_signal(struct sigpending *pending, sigset_t *mask,
- siginfo_t *info)
+ siginfo_t *info, bool *resched_timer)
{
int sig = next_signal(pending, mask);
@@ -595,7 +602,7 @@ static int __dequeue_signal(struct sigpe
}
}
- collect_signal(sig, pending, info);
+ collect_signal(sig, pending, info, resched_timer);
}
return sig;
@@ -609,15 +616,16 @@ static int __dequeue_signal(struct sigpe
*/
int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info)
{
+ bool resched_timer = false;
int signr;
/* We only dequeue private signals from ourselves, we don't let
* signalfd steal them
*/
- signr = __dequeue_signal(&tsk->pending, mask, info);
+ signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer);
if (!signr) {
signr = __dequeue_signal(&tsk->signal->shared_pending,
- mask, info);
+ mask, info, &resched_timer);
/*
* itimer signal ?
*
@@ -662,7 +670,7 @@ int dequeue_signal(struct task_struct *t
*/
current->jobctl |= JOBCTL_STOP_DEQUEUED;
}
- if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) {
+ if (resched_timer) {
/*
* Release the siglock to ensure proper locking order
* of timer locks outside of siglocks. Note, we leave
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 218/233] lib/cmdline.c: fix get_options() overflow while parsing ranges
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (188 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 201/233] signal: Only reschedule timers on signals timers have sent Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 206/233] rtnetlink: add IFLA_GROUP to ifla_policy Ben Hutchings
` (43 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jonathan Corbet, Ilya Matveychikov, Linus Torvalds
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Matveychikov <matvejchikov@gmail.com>
commit a91e0f680bcd9e10c253ae8b62462a38bd48f09f upstream.
When using get_options() it's possible to specify a range of numbers,
like 1-100500. The problem is that it doesn't track array size while
calling internally to get_range() which iterates over the range and
fills the memory with numbers.
Link: http://lkml.kernel.org/r/2613C75C-B04D-4BFF-82A6-12F97BA0F620@gmail.com
Signed-off-by: Ilya V. Matveychikov <matvejchikov@gmail.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
lib/cmdline.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/lib/cmdline.c
+++ b/lib/cmdline.c
@@ -22,14 +22,14 @@
* the values[M, M+1, ..., N] into the ints array in get_options.
*/
-static int get_range(char **str, int *pint)
+static int get_range(char **str, int *pint, int n)
{
int x, inc_counter, upper_range;
(*str)++;
upper_range = simple_strtol((*str), NULL, 0);
inc_counter = upper_range - *pint;
- for (x = *pint; x < upper_range; x++)
+ for (x = *pint; n && x < upper_range; x++, n--)
*pint++ = x;
return inc_counter;
}
@@ -96,7 +96,7 @@ char *get_options(const char *str, int n
break;
if (res == 3) {
int range_nums;
- range_nums = get_range((char **)&str, ints + i);
+ range_nums = get_range((char **)&str, ints + i, nints - i);
if (range_nums < 0)
break;
/*
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 206/233] rtnetlink: add IFLA_GROUP to ifla_policy
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (189 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 218/233] lib/cmdline.c: fix get_options() overflow while parsing ranges Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 172/233] net: emac: fix reset timeout with AR8035 phy Ben Hutchings
` (42 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Serhey Popovych
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Serhey Popovych <serhe.popovych@gmail.com>
commit db833d40ad3263b2ee3b59a1ba168bb3cfed8137 upstream.
Network interface groups support added while ago, however
there is no IFLA_GROUP attribute description in policy
and netlink message size calculations until now.
Add IFLA_GROUP attribute to the policy.
Fixes: cbda10fa97d7 ("net_device: add support for network device groups")
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/core/rtnetlink.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -859,6 +859,7 @@ static noinline size_t if_nlmsg_size(con
+ nla_total_size(1) /* IFLA_OPERSTATE */
+ nla_total_size(1) /* IFLA_LINKMODE */
+ nla_total_size(4) /* IFLA_CARRIER_CHANGES */
+ + nla_total_size(4) /* IFLA_GROUP */
+ nla_total_size(ext_filter_mask
& RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+ rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
@@ -1197,6 +1198,7 @@ static const struct nla_policy ifla_poli
[IFLA_NUM_RX_QUEUES] = { .type = NLA_U32 },
[IFLA_PHYS_PORT_ID] = { .type = NLA_BINARY, .len = MAX_PHYS_PORT_ID_LEN },
[IFLA_CARRIER_CHANGES] = { .type = NLA_U32 }, /* ignored */
+ [IFLA_GROUP] = { .type = NLA_U32 },
};
static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 172/233] net: emac: fix reset timeout with AR8035 phy
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (190 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 206/233] rtnetlink: add IFLA_GROUP to ifla_policy Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 159/233] arm64: KVM: Allow unaligned accesses at EL2 Ben Hutchings
` (41 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andrew Lunn, David S. Miller, Russell Senior,
Christian Lamparter, Chris Blake
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 19d90ece81da802207a9b91ce95a29fbdc40626e upstream.
This patch fixes a problem where the AR8035 PHY can't be
detected on an Cisco Meraki MR24, if the ethernet cable is
not connected on boot.
Russell Senior provided steps to reproduce the issue:
|Disconnect ethernet cable, apply power, wait until device has booted,
|plug in ethernet, check for interfaces, no eth0 is listed.
|
|This appears to be a problem during probing of the AR8035 Phy chip.
|When ethernet has no link, the phy detection fails, and eth0 is not
|created. Plugging ethernet later has no effect, because there is no
|interface as far as the kernel is concerned. The relevant part of
|the boot log looks like this:
|this is the failing case:
|
|[ 0.876611] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
|[ 0.882532] /plb/opb/ethernet@ef600c00: reset timeout
|[ 0.888546] /plb/opb/ethernet@ef600c00: can't find PHY!
|and the succeeding case:
|
|[ 0.876672] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode
|[ 0.883952] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:..
|[ 0.890822] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01)
Based on the comment and the commit message of
commit 23fbb5a87c56 ("emac: Fix EMAC soft reset on 460EX/GT").
This is because the AR8035 PHY doesn't provide the TX Clock,
if the ethernet cable is not attached. This causes the reset
to timeout and the PHY detection code in emac_init_phy() is
unable to detect the AR8035 PHY. As a result, the emac driver
bails out early and the user left with no ethernet.
In order to stay compatible with existing configurations, the driver
tries the current reset approach at first. Only if the first attempt
timed out, it does perform one more retry with the clock temporarily
switched to the internal source for just the duration of the reset.
LEDE-Bug: #687 <https://bugs.lede-project.org/index.php?do=details&task_id=687>
Cc: Chris Blake <chrisrblake93@gmail.com>
Reported-by: Russell Senior <russell@personaltelco.net>
Fixes: 23fbb5a87c56e98 ("emac: Fix EMAC soft reset on 460EX/GT")
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/ibm/emac/core.c | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/ibm/emac/core.c
+++ b/drivers/net/ethernet/ibm/emac/core.c
@@ -349,6 +349,7 @@ static int emac_reset(struct emac_instan
{
struct emac_regs __iomem *p = dev->emacp;
int n = 20;
+ bool __maybe_unused try_internal_clock = false;
DBG(dev, "reset" NL);
@@ -361,6 +362,7 @@ static int emac_reset(struct emac_instan
}
#ifdef CONFIG_PPC_DCR_NATIVE
+do_retry:
/*
* PPC460EX/GT Embedded Processor Advanced User's Manual
* section 28.10.1 Mode Register 0 (EMACx_MR0) states:
@@ -368,10 +370,19 @@ static int emac_reset(struct emac_instan
* of the EMAC. If none is present, select the internal clock
* (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1).
* After a soft reset, select the external clock.
+ *
+ * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the
+ * ethernet cable is not attached. This causes the reset to timeout
+ * and the PHY detection code in emac_init_phy() is unable to
+ * communicate and detect the AR8035-A PHY. As a result, the emac
+ * driver bails out early and the user has no ethernet.
+ * In order to stay compatible with existing configurations, the
+ * driver will temporarily switch to the internal clock, after
+ * the first reset fails.
*/
if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
- if (dev->phy_address == 0xffffffff &&
- dev->phy_map == 0xffffffff) {
+ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+ dev->phy_map == 0xffffffff)) {
/* No PHY: select internal loop clock before reset */
dcri_clrset(SDR0, SDR0_ETH_CFG,
0, SDR0_ETH_CFG_ECS << dev->cell_index);
@@ -389,8 +400,15 @@ static int emac_reset(struct emac_instan
#ifdef CONFIG_PPC_DCR_NATIVE
if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) {
- if (dev->phy_address == 0xffffffff &&
- dev->phy_map == 0xffffffff) {
+ if (!n && !try_internal_clock) {
+ /* first attempt has timed out. */
+ n = 20;
+ try_internal_clock = true;
+ goto do_retry;
+ }
+
+ if (try_internal_clock || (dev->phy_address == 0xffffffff &&
+ dev->phy_map == 0xffffffff)) {
/* No PHY: restore external clock source after reset */
dcri_clrset(SDR0, SDR0_ETH_CFG,
SDR0_ETH_CFG_ECS << dev->cell_index, 0);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 159/233] arm64: KVM: Allow unaligned accesses at EL2
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (191 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 172/233] net: emac: fix reset timeout with AR8035 phy Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 198/233] mm/memory-failure.c: use compound_head() flags for huge pages Ben Hutchings
` (40 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Christoffer Dall, Marc Zyngier, Alexander Graf
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <marc.zyngier@arm.com>
commit 78fd6dcf11468a5a131b8365580d0c613bcc02cb upstream.
We currently have the SCTLR_EL2.A bit set, trapping unaligned accesses
at EL2, but we're not really prepared to deal with it. So far, this
has been unnoticed, until GCC 7 started emitting those (in particular
64bit writes on a 32bit boundary).
Since the rest of the kernel is pretty happy about that, let's follow
its example and set SCTLR_EL2.A to zero. Modern CPUs don't really
care.
Reported-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
[bwh: Backported to 3.16: s/ELx/EL2/]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm64/kvm/hyp-init.S | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/arch/arm64/kvm/hyp-init.S
+++ b/arch/arm64/kvm/hyp-init.S
@@ -86,9 +86,10 @@ __do_hyp_init:
/*
* Preserve all the RES1 bits while setting the default flags,
- * as well as the EE bit on BE.
+ * as well as the EE bit on BE. Drop the A flag since the compiler
+ * is allowed to generate unaligned accesses.
*/
- ldr x4, =(SCTLR_EL2_RES1 | SCTLR_EL2_FLAGS)
+ ldr x4, =(SCTLR_EL2_RES1 | (SCTLR_EL2_FLAGS & ~SCTLR_EL2_A))
CPU_BE( orr x4, x4, #SCTLR_EL2_EE)
msr sctlr_el2, x4
isb
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 198/233] mm/memory-failure.c: use compound_head() flags for huge pages
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (192 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 159/233] arm64: KVM: Allow unaligned accesses at EL2 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 164/233] perf probe: Fix examples section of documentation Ben Hutchings
` (39 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Punit Agrawal, James Morse, Linus Torvalds, Naoya Horiguchi
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: James Morse <james.morse@arm.com>
commit 7258ae5c5a2ce2f5969e8b18b881be40ab55433d upstream.
memory_failure() chooses a recovery action function based on the page
flags. For huge pages it uses the tail page flags which don't have
anything interesting set, resulting in:
> Memory failure: 0x9be3b4: Unknown page state
> Memory failure: 0x9be3b4: recovery action for unknown page: Failed
Instead, save a copy of the head page's flags if this is a huge page,
this means if there are no relevant flags for this tail page, we use the
head pages flags instead. This results in the me_huge_page() recovery
action being called:
> Memory failure: 0x9b7969: recovery action for huge page: Delayed
For hugepages that have not yet been allocated, this allows the hugepage
to be dequeued.
Fixes: 524fca1e7356 ("HWPOISON: fix misjudgement of page_action() for errors on mlocked pages")
Link: http://lkml.kernel.org/r/20170524130204.21845-1-james.morse@arm.com
Signed-off-by: James Morse <james.morse@arm.com>
Tested-by: Punit Agrawal <punit.agrawal@arm.com>
Acked-by: Punit Agrawal <punit.agrawal@arm.com>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/memory-failure.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -1179,7 +1179,10 @@ int memory_failure(unsigned long pfn, in
* page_remove_rmap() in try_to_unmap_one(). So to determine page status
* correctly, we save a copy of the page flags at this time.
*/
- page_flags = p->flags;
+ if (PageHuge(p))
+ page_flags = hpage->flags;
+ else
+ page_flags = p->flags;
/*
* unpoison always clear PG_hwpoison inside page lock
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 164/233] perf probe: Fix examples section of documentation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (193 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 198/233] mm/memory-failure.c: use compound_head() flags for huge pages Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 176/233] target: Fix kref->refcount underflow in transport_cmd_finish_abort Ben Hutchings
` (38 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Masami Hiramatsu, Peter Zijlstra, Arnaldo Carvalho de Melo,
Taeung Song, SeongJae Park
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit d89269a89ebb6a74512f3f40e89cd12017f60a75 upstream.
An example in perf-probe documentation for pattern of function name
based probe addition is not providing example command for that case.
This commit fixes the example to give appropriate example command.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Taeung Song <treeze.taeung@gmail.com>
Fixes: ee391de876ae ("perf probe: Update perf probe document")
Link: http://lkml.kernel.org/r/20170507103642.30560-1-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/Documentation/perf-probe.txt | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/tools/perf/Documentation/perf-probe.txt
+++ b/tools/perf/Documentation/perf-probe.txt
@@ -182,9 +182,13 @@ Add a probe on schedule() function 12th
or
./perf probe --add='schedule:12 cpu'
- this will add one or more probes which has the name start with "schedule".
+Add one or more probes which has the name start with "schedule".
- Add probes on lines in schedule() function which calls update_rq_clock().
+ ./perf probe schedule*
+ or
+ ./perf probe --add='schedule*'
+
+Add probes on lines in schedule() function which calls update_rq_clock().
./perf probe 'schedule;update_rq_clock*'
or
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 176/233] target: Fix kref->refcount underflow in transport_cmd_finish_abort
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (194 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 164/233] perf probe: Fix examples section of documentation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 166/233] perf script: Fix documentation errors Ben Hutchings
` (37 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Gary Guo, Sagi Grimberg, Nicholas Bellinger,
Bart Van Assche, Hannes Reinecke, Chu Yuan Lin, Himanshu Madhani,
Mike Christie, Christoph Hellwig
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 73d4e580ccc5c3e05cea002f18111f66c9c07034 upstream.
This patch fixes a se_cmd->cmd_kref underflow during CMD_T_ABORTED
when a fabric driver drops it's second reference from below the
target_core_tmr.c based callers of transport_cmd_finish_abort().
Recently with the conversion of kref to refcount_t, this bug was
manifesting itself as:
[705519.601034] refcount_t: underflow; use-after-free.
[705519.604034] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 20116.512 msecs
[705539.719111] ------------[ cut here ]------------
[705539.719117] WARNING: CPU: 3 PID: 26510 at lib/refcount.c:184 refcount_sub_and_test+0x33/0x51
Since the original kref atomic_t based kref_put() didn't check for
underflow and only invoked the final callback when zero was reached,
this bug did not manifest in practice since all se_cmd memory is
using preallocated tags.
To address this, go ahead and propigate the existing return from
transport_put_cmd() up via transport_cmd_finish_abort(), and
change transport_cmd_finish_abort() + core_tmr_handle_tas_abort()
callers to only do their local target_put_sess_cmd() if necessary.
Reported-by: Bart Van Assche <bart.vanassche@sandisk.com>
Tested-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Mike Christie <mchristi@redhat.com>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Tested-by: Gary Guo <ghg@datera.io>
Tested-by: Chu Yuan Lin <cyl@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/target/target_core_internal.h | 2 +-
drivers/target/target_core_tmr.c | 16 ++++++++--------
drivers/target/target_core_transport.c | 9 ++++++---
3 files changed, 15 insertions(+), 12 deletions(-)
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -92,7 +92,7 @@ int init_se_kmem_caches(void);
void release_se_kmem_caches(void);
u32 scsi_get_new_index(scsi_index_t);
void transport_subsystem_check_init(void);
-void transport_cmd_finish_abort(struct se_cmd *, int);
+int transport_cmd_finish_abort(struct se_cmd *, int);
unsigned char *transport_dump_cmd_direction(struct se_cmd *);
void transport_dump_dev_state(struct se_device *, char *, int *);
void transport_dump_dev_info(struct se_device *, struct se_lun *,
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -82,7 +82,7 @@ void core_tmr_release_req(
kfree(tmr);
}
-static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
+static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
{
unsigned long flags;
bool remove = true, send_tas;
@@ -98,7 +98,7 @@ static void core_tmr_handle_tas_abort(st
transport_send_task_abort(cmd);
}
- transport_cmd_finish_abort(cmd, remove);
+ return transport_cmd_finish_abort(cmd, remove);
}
static int target_check_cdb_and_preempt(struct list_head *list,
@@ -195,8 +195,8 @@ void core_tmr_abort_task(
cancel_work_sync(&se_cmd->work);
transport_wait_for_tasks(se_cmd);
- transport_cmd_finish_abort(se_cmd, true);
- target_put_sess_cmd(se_sess, se_cmd);
+ if (!transport_cmd_finish_abort(se_cmd, true))
+ target_put_sess_cmd(se_sess, se_cmd);
printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
" ref_tag: %d\n", ref_tag);
@@ -296,8 +296,8 @@ static void core_tmr_drain_tmr_list(
cancel_work_sync(&cmd->work);
transport_wait_for_tasks(cmd);
- transport_cmd_finish_abort(cmd, 1);
- target_put_sess_cmd(cmd->se_sess, cmd);
+ if (!transport_cmd_finish_abort(cmd, 1))
+ target_put_sess_cmd(cmd->se_sess, cmd);
}
}
@@ -395,8 +395,8 @@ static void core_tmr_drain_state_list(
cancel_work_sync(&cmd->work);
transport_wait_for_tasks(cmd);
- core_tmr_handle_tas_abort(cmd, tas);
- target_put_sess_cmd(cmd->se_sess, cmd);
+ if (!core_tmr_handle_tas_abort(cmd, tas))
+ target_put_sess_cmd(cmd->se_sess, cmd);
}
}
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -600,9 +600,10 @@ static void transport_lun_remove_cmd(str
percpu_ref_put(&lun->lun_ref);
}
-void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
+int transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
{
bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
+ int ret = 0;
if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
transport_lun_remove_cmd(cmd);
@@ -614,9 +615,11 @@ void transport_cmd_finish_abort(struct s
cmd->se_tfo->aborted_task(cmd);
if (transport_cmd_check_stop_to_fabric(cmd))
- return;
+ return 1;
if (remove && ack_kref)
- transport_put_cmd(cmd);
+ ret = transport_put_cmd(cmd);
+
+ return ret;
}
static void target_complete_failure_work(struct work_struct *work)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 166/233] perf script: Fix documentation errors
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (195 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 176/233] target: Fix kref->refcount underflow in transport_cmd_finish_abort Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 171/233] MIPS: kprobes: flush_insn_slot should flush only if probe initialised Ben Hutchings
` (36 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Arnaldo Carvalho de Melo, SeongJae Park, Tom Zanussi,
Frederic Weisbecker, Alexander Shishkin, Peter Zijlstra
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit 34d4453dac257be53c21abf2f713c992fb692b5c upstream.
This commit fixes two errors in documents for perf-script-python and
perf-script-perl as below:
- /sys/kernel/debug/tracing events -> /sys/kernel/debug/tracing/events/
- trace_handled -> trace_unhandled
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Zanussi <tzanussi@gmail.com>
Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation")
Link: http://lkml.kernel.org/r/20170530111827.21732-3-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/Documentation/perf-script-perl.txt | 2 +-
tools/perf/Documentation/perf-script-python.txt | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
--- a/tools/perf/Documentation/perf-script-perl.txt
+++ b/tools/perf/Documentation/perf-script-perl.txt
@@ -39,7 +39,7 @@ EVENT HANDLERS
When perf script is invoked using a trace script, a user-defined
'handler function' is called for each event in the trace. If there's
no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
next event is processed.
Most of the event's field values are passed as arguments to the
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -321,7 +321,7 @@ So those are the essential steps in writ
process can be generalized to any tracepoint or set of tracepoints
you're interested in - basically find the tracepoint(s) you're
interested in by looking at the list of available events shown by
-'perf list' and/or look in /sys/kernel/debug/tracing events for
+'perf list' and/or look in /sys/kernel/debug/tracing/events/ for
detailed event and field info, record the corresponding trace data
using 'perf record', passing it the list of interesting events,
generate a skeleton script using 'perf script -g python' and modify the
@@ -437,7 +437,7 @@ EVENT HANDLERS
When perf script is invoked using a trace script, a user-defined
'handler function' is called for each event in the trace. If there's
no handler function defined for a given event type, the event is
-ignored (or passed to a 'trace_handled' function, see below) and the
+ignored (or passed to a 'trace_unhandled' function, see below) and the
next event is processed.
Most of the event's field values are passed as arguments to the
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 171/233] MIPS: kprobes: flush_insn_slot should flush only if probe initialised
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (196 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 166/233] perf script: Fix documentation errors Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 205/233] ipv6: Do not leak throw route references Ben Hutchings
` (35 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, linux-mips, Ralf Baechle, Marcin Nowakowski
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
commit 698b851073ddf5a894910d63ca04605e0473414e upstream.
When ftrace is used with kprobes, it is possible for a kprobe to contain
an invalid location (ie. only initialised to 0 and not to a specific
location in the code). Trying to perform a cache flush on such location
leads to a crash r4k_flush_icache_range().
Fixes: c1bf207d6ee1 ("MIPS: kprobe: Add support.")
Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/16296/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/include/asm/kprobes.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/mips/include/asm/kprobes.h
+++ b/arch/mips/include/asm/kprobes.h
@@ -40,7 +40,8 @@ typedef union mips_instruction kprobe_op
#define flush_insn_slot(p) \
do { \
- flush_icache_range((unsigned long)p->addr, \
+ if (p->addr) \
+ flush_icache_range((unsigned long)p->addr, \
(unsigned long)p->addr + \
(MAX_INSN_SIZE * sizeof(kprobe_opcode_t))); \
} while (0)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 205/233] ipv6: Do not leak throw route references
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (197 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 171/233] MIPS: kprobes: flush_insn_slot should flush only if probe initialised Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 190/233] mac80211: don't look at the PM bit of BAR frames Ben Hutchings
` (34 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Serhey Popovych, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Serhey Popovych <serhe.popovych@gmail.com>
commit 07f615574f8ac499875b21c1142f26308234a92c upstream.
While commit 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
does good job on error propagation to the fib_rules_lookup()
in fib rules core framework that also corrects throw routes
handling, it does not solve route reference leakage problem
happened when we return -EAGAIN to the fib_rules_lookup()
and leave routing table entry referenced in arg->result.
If rule with matched throw route isn't last matched in the
list we overwrite arg->result losing reference on throw
route stored previously forever.
We also partially revert commit ab997ad40839 ("ipv6: fix the
incorrect return value of throw route") since we never return
routing table entry with dst.error == -EAGAIN when
CONFIG_IPV6_MULTIPLE_TABLES is on. Also there is no point
to check for RTF_REJECT flag since it is always set throw
route.
Fixes: 73ba57bfae4a ("ipv6: fix backtracking for throw routes")
Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: commit ab997ad40839 was never applied here and does
not need to be reverted]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -105,7 +105,8 @@ static int fib6_rule_action(struct fib_r
flp6->saddr = saddr;
}
err = rt->dst.error;
- goto out;
+ if (err != -EAGAIN)
+ goto out;
}
again:
ip6_rt_put(rt);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 190/233] mac80211: don't look at the PM bit of BAR frames
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (198 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 205/233] ipv6: Do not leak throw route references Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 217/233] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL Ben Hutchings
` (33 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Emmanuel Grumbach, Johannes Berg
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
commit 769dc04db3ed8484798aceb015b94deacc2ba557 upstream.
When a peer sends a BAR frame with PM bit clear, we should
not modify its PM state as madated by the spec in
802.11-20012 10.2.1.2.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/rx.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1287,12 +1287,16 @@ ieee80211_rx_h_sta_process(struct ieee80
*/
if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
!ieee80211_has_morefrags(hdr->frame_control) &&
+ !ieee80211_is_back_req(hdr->frame_control) &&
!(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
(rx->sdata->vif.type == NL80211_IFTYPE_AP ||
rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
- /* PM bit is only checked in frames where it isn't reserved,
+ /*
+ * PM bit is only checked in frames where it isn't reserved,
* in AP mode it's reserved in non-bufferable management frames
* (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
+ * BAR frames should be ignored as specified in
+ * IEEE 802.11-2012 10.2.1.2.
*/
(!ieee80211_is_mgmt(hdr->frame_control) ||
ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 217/233] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (199 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 190/233] mac80211: don't look at the PM bit of BAR frames Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 177/233] can: gs_usb: fix memory leak in gs_cmd_reset() Ben Hutchings
` (32 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ian Kent, Linus Torvalds, NeilBrown
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit 9fa4eb8e490a28de40964b1b0e583d8db4c7e57c upstream.
If a positive status is passed with the AUTOFS_DEV_IOCTL_FAIL ioctl,
autofs4_d_automount() will return
ERR_PTR(status)
with that status to follow_automount(), which will then dereference an
invalid pointer.
So treat a positive status the same as zero, and map to ENOENT.
See comment in systemd src/core/automount.c::automount_send_ready().
Link: http://lkml.kernel.org/r/871sqwczx5.fsf@notabene.neil.brown.name
Signed-off-by: NeilBrown <neilb@suse.com>
Cc: Ian Kent <raven@themaw.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/autofs4/dev-ioctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -331,7 +331,7 @@ static int autofs_dev_ioctl_fail(struct
int status;
token = (autofs_wqt_t) param->fail.token;
- status = param->fail.status ? param->fail.status : -ENOENT;
+ status = param->fail.status < 0 ? param->fail.status : -ENOENT;
return autofs4_wait_release(sbi, token, status);
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 177/233] can: gs_usb: fix memory leak in gs_cmd_reset()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (200 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 217/233] autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 232/233] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 Ben Hutchings
` (31 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Marc Kleine-Budde, Maximilian Schneider
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 5cda3ee5138e91ac369ed9d0b55eab0dab077686 upstream.
This patch adds the missing kfree() in gs_cmd_reset() to free the
memory that is not used anymore after usb_control_msg().
Cc: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/can/usb/gs_usb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -246,6 +246,8 @@ static int gs_cmd_reset(struct gs_usb *g
sizeof(*dm),
1000);
+ kfree(dm);
+
return rc;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 232/233] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (201 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 177/233] can: gs_usb: fix memory leak in gs_cmd_reset() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 192/233] xfrm: Oops on error in pfkey_msg2xfrm_state() Ben Hutchings
` (30 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Wei Wang, Andrey Konovalov, Yuchung Cheng, David S. Miller,
Eric Dumazet, Neal Cardwell
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
commit 499350a5a6e7512d9ed369ed63a4244b6536f4f8 upstream.
When tcp_disconnect() is called, inet_csk_delack_init() sets
icsk->icsk_ack.rcv_mss to 0.
This could potentially cause tcp_recvmsg() => tcp_cleanup_rbuf() =>
__tcp_select_window() call path to have division by 0 issue.
So this patch initializes rcv_mss to TCP_MIN_MSS instead of 0.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/tcp.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2364,6 +2364,10 @@ int tcp_disconnect(struct sock *sk, int
tcp_set_ca_state(sk, TCP_CA_Open);
tcp_clear_retrans(tp);
inet_csk_delack_init(sk);
+ /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
+ * issue in __tcp_select_window()
+ */
+ icsk->icsk_ack.rcv_mss = TCP_MIN_MSS;
tcp_init_send_head(sk);
memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
__sk_dst_reset(sk);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 192/233] xfrm: Oops on error in pfkey_msg2xfrm_state()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (202 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 232/233] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 194/233] IB/ipoib: Fix memory leak in create child syscall Ben Hutchings
` (29 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Steffen Klassert, Dan Carpenter
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 1e3d0c2c70cd3edb5deed186c5f5c75f2b84a633 upstream.
There are some missing error codes here so we accidentally return NULL
instead of an error pointer. It results in a NULL pointer dereference.
Fixes: df71837d5024 ("[LSM-IPSec]: Security association restriction.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/key/af_key.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1167,8 +1167,10 @@ static struct xfrm_state * pfkey_msg2xfr
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL);
- if (!x->aalg)
+ if (!x->aalg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->aalg->alg_name, a->name);
x->aalg->alg_key_len = 0;
if (key) {
@@ -1187,8 +1189,10 @@ static struct xfrm_state * pfkey_msg2xfr
goto out;
}
x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL);
- if (!x->calg)
+ if (!x->calg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->calg->alg_name, a->name);
x->props.calgo = sa->sadb_sa_encrypt;
} else {
@@ -1202,8 +1206,10 @@ static struct xfrm_state * pfkey_msg2xfr
if (key)
keysize = (key->sadb_key_bits + 7) / 8;
x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL);
- if (!x->ealg)
+ if (!x->ealg) {
+ err = -ENOMEM;
goto out;
+ }
strcpy(x->ealg->alg_name, a->name);
x->ealg->alg_key_len = 0;
if (key) {
@@ -1247,8 +1253,10 @@ static struct xfrm_state * pfkey_msg2xfr
struct xfrm_encap_tmpl *natt;
x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL);
- if (!x->encap)
+ if (!x->encap) {
+ err = -ENOMEM;
goto out;
+ }
natt = x->encap;
n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1];
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 194/233] IB/ipoib: Fix memory leak in create child syscall
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (203 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 192/233] xfrm: Oops on error in pfkey_msg2xfrm_state() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 223/233] ARM: 8685/1: ensure memblock-limit is pmd-aligned Ben Hutchings
` (28 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Leon Romanovsky, Feras Daoud, Doug Ledford
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Feras Daoud <ferasda@mellanox.com>
commit 4542d66bb26f2d021c70a78e46f183c6675fc4c9 upstream.
The flow of creating a new child goes through ipoib_vlan_add
which allocates a new interface and checks the rtnl_lock.
If the lock is taken, restart_syscall will be called to restart
the system call again. In this case we are not releasing the
already allocated interface, causing a leak.
Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support")
Signed-off-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -133,13 +133,14 @@ int ipoib_vlan_add(struct net_device *pd
snprintf(intf_name, sizeof intf_name, "%s.%04x",
ppriv->dev->name, pkey);
- priv = ipoib_intf_alloc(intf_name);
- if (!priv)
- return -ENOMEM;
if (!rtnl_trylock())
return restart_syscall();
+ priv = ipoib_intf_alloc(intf_name);
+ if (!priv)
+ return -ENOMEM;
+
down_write(&ppriv->vlan_rwsem);
/*
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 223/233] ARM: 8685/1: ensure memblock-limit is pmd-aligned
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (204 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 194/233] IB/ipoib: Fix memory leak in create child syscall Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 183/233] KVM: async_pf: avoid async pf injection when in guest mode Ben Hutchings
` (27 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Doug Berger, Mark Rutland, Russell King
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <opendmb@gmail.com>
commit 9e25ebfe56ece7541cd10a20d715cbdd148a2e06 upstream.
The pmd containing memblock_limit is cleared by prepare_page_table()
which creates the opportunity for early_alloc() to allocate unmapped
memory if memblock_limit is not pmd aligned causing a boot-time hang.
Commit 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM")
attempted to resolve this problem, but there is a path through the
adjust_lowmem_bounds() routine where if all memory regions start and
end on pmd-aligned addresses the memblock_limit will be set to
arm_lowmem_limit.
Since arm_lowmem_limit can be affected by the vmalloc early parameter,
the value of arm_lowmem_limit may not be pmd-aligned. This commit
corrects this oversight such that memblock_limit is always rounded
down to pmd-alignment.
Fixes: 965278dcb8ab ("ARM: 8356/1: mm: handle non-pmd-aligned end of RAM")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/mm/mmu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -1142,15 +1142,15 @@ void __init sanity_check_meminfo(void)
high_memory = __va(arm_lowmem_limit - 1) + 1;
+ if (!memblock_limit)
+ memblock_limit = arm_lowmem_limit;
+
/*
* Round the memblock limit down to a pmd size. This
* helps to ensure that we will allocate memory from the
* last full pmd, which should be mapped.
*/
- if (memblock_limit)
- memblock_limit = round_down(memblock_limit, PMD_SIZE);
- if (!memblock_limit)
- memblock_limit = arm_lowmem_limit;
+ memblock_limit = round_down(memblock_limit, PMD_SIZE);
memblock_set_current_limit(memblock_limit);
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 183/233] KVM: async_pf: avoid async pf injection when in guest mode
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (205 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 223/233] ARM: 8685/1: ensure memblock-limit is pmd-aligned Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 157/233] KVM: nVMX: Fix exception injection Ben Hutchings
` (26 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Wanpeng Li, Paolo Bonzini, Radim Krčmář
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit 9bc1f09f6fa76fdf31eb7d6a4a4df43574725f93 upstream.
INFO: task gnome-terminal-:1734 blocked for more than 120 seconds.
Not tainted 4.12.0-rc4+ #8
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
gnome-terminal- D 0 1734 1015 0x00000000
Call Trace:
__schedule+0x3cd/0xb30
schedule+0x40/0x90
kvm_async_pf_task_wait+0x1cc/0x270
? __vfs_read+0x37/0x150
? prepare_to_swait+0x22/0x70
do_async_page_fault+0x77/0xb0
? do_async_page_fault+0x77/0xb0
async_page_fault+0x28/0x30
This is triggered by running both win7 and win2016 on L1 KVM simultaneously,
and then gives stress to memory on L1, I can observed this hang on L1 when
at least ~70% swap area is occupied on L0.
This is due to async pf was injected to L2 which should be injected to L1,
L2 guest starts receiving pagefault w/ bogus %cr2(apf token from the host
actually), and L1 guest starts accumulating tasks stuck in D state in
kvm_async_pf_task_wait() since missing PAGE_READY async_pfs.
This patch fixes the hang by doing async pf when executing L1 guest.
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/mmu.c | 7 +++++--
arch/x86/kvm/mmu.h | 1 +
arch/x86/kvm/x86.c | 3 +--
3 files changed, 7 insertions(+), 4 deletions(-)
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3292,12 +3292,15 @@ static int kvm_arch_setup_async_pf(struc
return kvm_setup_async_pf(vcpu, gva, gfn_to_hva(vcpu->kvm, gfn), &arch);
}
-static bool can_do_async_pf(struct kvm_vcpu *vcpu)
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu)
{
if (unlikely(!irqchip_in_kernel(vcpu->kvm) ||
kvm_event_needs_reinjection(vcpu)))
return false;
+ if (is_guest_mode(vcpu))
+ return false;
+
return kvm_x86_ops->interrupt_allowed(vcpu);
}
@@ -3311,7 +3314,7 @@ static bool try_async_pf(struct kvm_vcpu
if (!async)
return false; /* *pfn has correct page already */
- if (!prefault && can_do_async_pf(vcpu)) {
+ if (!prefault && kvm_can_do_async_pf(vcpu)) {
trace_kvm_try_async_get_page(gva, gfn);
if (kvm_find_async_pf_gfn(vcpu, gfn)) {
trace_kvm_async_pf_doublefault(gva, gfn);
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -79,6 +79,7 @@ int handle_mmio_page_fault_common(struct
void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context);
void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, struct kvm_mmu *context,
bool execonly);
+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu);
static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm)
{
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -7612,8 +7612,7 @@ bool kvm_arch_can_inject_async_page_pres
if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED))
return true;
else
- return !kvm_event_needs_reinjection(vcpu) &&
- kvm_x86_ops->interrupt_allowed(vcpu);
+ return kvm_can_do_async_pf(vcpu);
}
void kvm_arch_register_noncoherent_dma(struct kvm *kvm)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 157/233] KVM: nVMX: Fix exception injection
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (206 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 183/233] KVM: async_pf: avoid async pf injection when in guest mode Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 181/233] excessive checks in ufs_write_failed() and ufs_evict_inode() Ben Hutchings
` (25 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Radim Krčmář, Paolo Bonzini, Wanpeng Li
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit d4912215d1031e4fb3d1038d2e1857218dba0d0a upstream.
WARNING: CPU: 3 PID: 2840 at arch/x86/kvm/vmx.c:10966 nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel]
CPU: 3 PID: 2840 Comm: qemu-system-x86 Tainted: G OE 4.12.0-rc3+ #23
RIP: 0010:nested_vmx_vmexit+0xdcd/0xde0 [kvm_intel]
Call Trace:
? kvm_check_async_pf_completion+0xef/0x120 [kvm]
? rcu_read_lock_sched_held+0x79/0x80
vmx_queue_exception+0x104/0x160 [kvm_intel]
? vmx_queue_exception+0x104/0x160 [kvm_intel]
kvm_arch_vcpu_ioctl_run+0x1171/0x1ce0 [kvm]
? kvm_arch_vcpu_load+0x47/0x240 [kvm]
? kvm_arch_vcpu_load+0x62/0x240 [kvm]
kvm_vcpu_ioctl+0x384/0x7b0 [kvm]
? kvm_vcpu_ioctl+0x384/0x7b0 [kvm]
? __fget+0xf3/0x210
do_vfs_ioctl+0xa4/0x700
? __fget+0x114/0x210
SyS_ioctl+0x79/0x90
do_syscall_64+0x81/0x220
entry_SYSCALL64_slow_path+0x25/0x25
This is triggered occasionally by running both win7 and win2016 in L2, in
addition, EPT is disabled on both L1 and L2. It can't be reproduced easily.
Commit 0b6ac343fc (KVM: nVMX: Correct handling of exception injection) mentioned
that "KVM wants to inject page-faults which it got to the guest. This function
assumes it is called with the exit reason in vmcs02 being a #PF exception".
Commit e011c663 (KVM: nVMX: Check all exceptions for intercept during delivery to
L2) allows to check all exceptions for intercept during delivery to L2. However,
there is no guarantee the exit reason is exception currently, when there is an
external interrupt occurred on host, maybe a time interrupt for host which should
not be injected to guest, and somewhere queues an exception, then the function
nested_vmx_check_exception() will be called and the vmexit emulation codes will
try to emulate the "Acknowledge interrupt on exit" behavior, the warning is
triggered.
Reusing the exit reason from the L2->L0 vmexit is wrong in this case,
the reason must always be EXCEPTION_NMI when injecting an exception into
L1 as a nested vmexit.
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Fixes: e011c663b9c7 ("KVM: nVMX: Check all exceptions for intercept during delivery to L2")
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/vmx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2001,7 +2001,7 @@ static int nested_vmx_check_exception(st
if (!(vmcs12->exception_bitmap & (1u << nr)))
return 0;
- nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason,
+ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI,
vmcs_read32(VM_EXIT_INTR_INFO),
vmcs_readl(EXIT_QUALIFICATION));
return 1;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 181/233] excessive checks in ufs_write_failed() and ufs_evict_inode()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (207 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 157/233] KVM: nVMX: Fix exception injection Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 226/233] MIPS: Avoid accidental raw backtrace Ben Hutchings
` (24 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit babef37dccbaa49249a22bae9150686815d7be71 upstream.
As it is, short copy in write() to append-only file will fail
to truncate the excessive allocated blocks. As the matter of
fact, all checks in ufs_truncate_blocks() are either redundant
or wrong for that caller. As for the only other caller
(ufs_evict_inode()), we only need the file type checks there.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.16:
- No functions need to be renamed
- Adjust filenames, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/ufs/inode.c
+++ b/fs/ufs/inode.c
@@ -894,7 +894,10 @@ void ufs_evict_inode(struct inode * inod
ufs_update_inode(inode, IS_SYNC(inode));
old_i_size = inode->i_size;
inode->i_size = 0;
- if (inode->i_blocks && ufs_truncate(inode, old_i_size))
+ if (inode->i_blocks &&
+ (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
+ S_ISLNK(inode->i_mode)) &&
+ ufs_truncate(inode, old_i_size))
ufs_warning(inode->i_sb, __func__, "ufs_truncate failed\n");
unlock_ufs(inode->i_sb);
}
--- a/fs/ufs/truncate.c
+++ b/fs/ufs/truncate.c
@@ -451,12 +451,6 @@ int ufs_truncate(struct inode *inode, lo
inode->i_ino, (unsigned long long)i_size_read(inode),
(unsigned long long)old_i_size);
- if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) ||
- S_ISLNK(inode->i_mode)))
- return -EINVAL;
- if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
- return -EPERM;
-
err = ufs_alloc_lastblock(inode);
if (err) {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 226/233] MIPS: Avoid accidental raw backtrace
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (208 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 181/233] excessive checks in ufs_write_failed() and ufs_evict_inode() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 213/233] powerpc/64: Initialise thread_info for emergency stacks Ben Hutchings
` (23 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, linux-mips, Ralf Baechle, James Hogan
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: James Hogan <james.hogan@imgtec.com>
commit 854236363370995a609a10b03e35fd3dc5e9e4a1 upstream.
Since commit 81a76d7119f6 ("MIPS: Avoid using unwind_stack() with
usermode") show_backtrace() invokes the raw backtracer when
cp0_status & ST0_KSU indicates user mode to fix issues on EVA kernels
where user and kernel address spaces overlap.
However this is used by show_stack() which creates its own pt_regs on
the stack and leaves cp0_status uninitialised in most of the code paths.
This results in the non deterministic use of the raw back tracer
depending on the previous stack content.
show_stack() deals exclusively with kernel mode stacks anyway, so
explicitly initialise regs.cp0_status to KSU_KERNEL (i.e. 0) to ensure
we get a useful backtrace.
Fixes: 81a76d7119f6 ("MIPS: Avoid using unwind_stack() with usermode")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/16656/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/kernel/traps.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -190,6 +190,8 @@ void show_stack(struct task_struct *task
{
struct pt_regs regs;
mm_segment_t old_fs = get_fs();
+
+ regs.cp0_status = KSU_KERNEL;
if (sp) {
regs.regs[29] = (unsigned long)sp;
regs.regs[31] = 0;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 213/233] powerpc/64: Initialise thread_info for emergency stacks
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (209 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 226/233] MIPS: Avoid accidental raw backtrace Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 200/233] mm: numa: avoid waiting on freed migrated pages Ben Hutchings
` (22 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Abdul Haleem, Michael Ellerman, Nicholas Piggin
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <npiggin@gmail.com>
commit 34f19ff1b5a0d11e46df479623d6936460105c9f upstream.
Emergency stacks have their thread_info mostly uninitialised, which in
particular means garbage preempt_count values.
Emergency stack code runs with interrupts disabled entirely, and is
used very rarely, so this has been unnoticed so far. It was found by a
proposed new powerpc watchdog that takes a soft-NMI directly from the
masked_interrupt handler and using the emergency stack. That crashed
at BUG_ON(in_nmi()) in nmi_enter(). preempt_count()s were found to be
garbage.
To fix this, zero the entire THREAD_SIZE allocation, and initialize
the thread_info.
Reported-by: Abdul Haleem <abdhalee@linux.vnet.ibm.com>
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
[mpe: Move it all into setup_64.c, use a function not a macro. Fix
crashes on Cell by setting preempt_count to 0 not HARDIRQ_OFFSET]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[bwh: Backported to 3.16:
- There are only two emergency stacks
- No need to call klp_init_thread_info()
- Add the ti variable in emergency_stack_init()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/kernel/setup_64.c | 31 ++++++++++++++++++++++++++++---
1 file changed, 28 insertions(+), 3 deletions(-)
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -615,6 +615,23 @@ static void __init exc_lvl_early_init(vo
#endif
/*
+ * Emergency stacks are used for a range of things, from asynchronous
+ * NMIs (system reset, machine check) to synchronous, process context.
+ * We set preempt_count to zero, even though that isn't necessarily correct. To
+ * get the right value we'd need to copy it from the previous thread_info, but
+ * doing that might fault causing more problems.
+ * TODO: what to do with accounting?
+ */
+static void emerg_stack_init_thread_info(struct thread_info *ti, int cpu)
+{
+ ti->task = NULL;
+ ti->cpu = cpu;
+ ti->preempt_count = 0;
+ ti->local_flags = 0;
+ ti->flags = 0;
+}
+
+/*
* Stack space used when we detect a bad kernel stack pointer, and
* early in SMP boots before relocation is enabled. Exclusive emergency
* stack for machine checks.
@@ -632,18 +649,29 @@ static void __init emergency_stack_init(
* Since we use these as temporary stacks during secondary CPU
* bringup, we need to get at them in real mode. This means they
* must also be within the RMO region.
+ *
+ * The IRQ stacks allocated elsewhere in this file are zeroed and
+ * initialized in kernel/irq.c. These are initialized here in order
+ * to have emergency stacks available as early as possible.
*/
limit = min(safe_stack_limit(), ppc64_rma_size);
for_each_possible_cpu(i) {
unsigned long sp;
+ struct thread_info *ti;
sp = memblock_alloc_base(THREAD_SIZE, THREAD_SIZE, limit);
+ ti = __va(sp);
+ memset(ti, 0, THREAD_SIZE);
+ emerg_stack_init_thread_info(ti, i);
sp += THREAD_SIZE;
paca[i].emergency_sp = __va(sp);
#ifdef CONFIG_PPC_BOOK3S_64
/* emergency stack for machine check exception handling. */
sp = memblock_alloc_base(THREAD_SIZE, THREAD_SIZE, limit);
+ ti = __va(sp);
+ memset(ti, 0, THREAD_SIZE);
+ emerg_stack_init_thread_info(ti, i);
sp += THREAD_SIZE;
paca[i].mc_emergency_sp = __va(sp);
#endif
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 200/233] mm: numa: avoid waiting on freed migrated pages
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (210 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 213/233] powerpc/64: Initialise thread_info for emergency stacks Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 225/233] MIPS: Fix IRQ tracing & lockdep when rescheduling Ben Hutchings
` (21 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Vlastimil Babka, Will Deacon, Mark Rutland, Linus Torvalds,
Kirill A. Shutemov, Mel Gorman, Steve Capper
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 3c226c637b69104f6b9f1c6ec5b08d7b741b3229 upstream.
In do_huge_pmd_numa_page(), we attempt to handle a migrating thp pmd by
waiting until the pmd is unlocked before we return and retry. However,
we can race with migrate_misplaced_transhuge_page():
// do_huge_pmd_numa_page // migrate_misplaced_transhuge_page()
// Holds 0 refs on page // Holds 2 refs on page
vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
/* ... */
if (pmd_trans_migrating(*vmf->pmd)) {
page = pmd_page(*vmf->pmd);
spin_unlock(vmf->ptl);
ptl = pmd_lock(mm, pmd);
if (page_count(page) != 2)) {
/* roll back */
}
/* ... */
mlock_migrate_page(new_page, page);
/* ... */
spin_unlock(ptl);
put_page(page);
put_page(page); // page freed here
wait_on_page_locked(page);
goto out;
}
This can result in the freed page having its waiters flag set
unexpectedly, which trips the PAGE_FLAGS_CHECK_AT_PREP checks in the
page alloc/free functions. This has been observed on arm64 KVM guests.
We can avoid this by having do_huge_pmd_numa_page() take a reference on
the page before dropping the pmd lock, mirroring what we do in
__migration_entry_wait().
When we hit the race, migrate_misplaced_transhuge_page() will see the
reference and abort the migration, as it may do today in other cases.
Fixes: b8916634b77bffb2 ("mm: Prevent parallel splits during THP migration")
Link: http://lkml.kernel.org/r/1497349722-6731-2-git-send-email-will.deacon@arm.com
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Steve Capper <steve.capper@arm.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1284,8 +1284,12 @@ int do_huge_pmd_numa_page(struct mm_stru
* check_same as the page may no longer be mapped.
*/
if (unlikely(pmd_trans_migrating(*pmdp))) {
+ page = pmd_page(pmd);
+ if (!get_page_unless_zero(page))
+ goto out_unlock;
spin_unlock(ptl);
wait_migrate_huge_page(vma->anon_vma, pmdp);
+ put_page(page);
goto out;
}
@@ -1321,9 +1325,12 @@ int do_huge_pmd_numa_page(struct mm_stru
/* Migration could have started since the pmd_trans_migrating check */
if (!page_locked) {
+ page_nid = -1;
+ if (!get_page_unless_zero(page))
+ goto out_unlock;
spin_unlock(ptl);
wait_on_page_locked(page);
- page_nid = -1;
+ put_page(page);
goto out;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 225/233] MIPS: Fix IRQ tracing & lockdep when rescheduling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (211 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 200/233] mm: numa: avoid waiting on freed migrated pages Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 187/233] genirq: Release resources in __setup_irq() error path Ben Hutchings
` (20 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ralf Baechle, linux-mips, Paul Burton
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit d8550860d910c6b7b70f830f59003b33daaa52c9 upstream.
When the scheduler sets TIF_NEED_RESCHED & we call into the scheduler
from arch/mips/kernel/entry.S we disable interrupts. This is true
regardless of whether we reach work_resched from syscall_exit_work,
resume_userspace or by looping after calling schedule(). Although we
disable interrupts in these paths we don't call trace_hardirqs_off()
before calling into C code which may acquire locks, and we therefore
leave lockdep with an inconsistent view of whether interrupts are
disabled or not when CONFIG_PROVE_LOCKING & CONFIG_DEBUG_LOCKDEP are
both enabled.
Without tracing this interrupt state lockdep will print warnings such
as the following once a task returns from a syscall via
syscall_exit_partial with TIF_NEED_RESCHED set:
[ 49.927678] ------------[ cut here ]------------
[ 49.934445] WARNING: CPU: 0 PID: 1 at kernel/locking/lockdep.c:3687 check_flags.part.41+0x1dc/0x1e8
[ 49.946031] DEBUG_LOCKS_WARN_ON(current->hardirqs_enabled)
[ 49.946355] CPU: 0 PID: 1 Comm: init Not tainted 4.10.0-00439-gc9fd5d362289-dirty #197
[ 49.963505] Stack : 0000000000000000 ffffffff81bb5d6a 0000000000000006 ffffffff801ce9c4
[ 49.974431] 0000000000000000 0000000000000000 0000000000000000 000000000000004a
[ 49.985300] ffffffff80b7e487 ffffffff80a24498 a8000000ff160000 ffffffff80ede8b8
[ 49.996194] 0000000000000001 0000000000000000 0000000000000000 0000000077c8030c
[ 50.007063] 000000007fd8a510 ffffffff801cd45c 0000000000000000 a8000000ff127c88
[ 50.017945] 0000000000000000 ffffffff801cf928 0000000000000001 ffffffff80a24498
[ 50.028827] 0000000000000000 0000000000000001 0000000000000000 0000000000000000
[ 50.039688] 0000000000000000 a8000000ff127bd0 0000000000000000 ffffffff805509bc
[ 50.050575] 00000000140084e0 0000000000000000 0000000000000000 0000000000040a00
[ 50.061448] 0000000000000000 ffffffff8010e1b0 0000000000000000 ffffffff805509bc
[ 50.072327] ...
[ 50.076087] Call Trace:
[ 50.079869] [<ffffffff8010e1b0>] show_stack+0x80/0xa8
[ 50.086577] [<ffffffff805509bc>] dump_stack+0x10c/0x190
[ 50.093498] [<ffffffff8015dde0>] __warn+0xf0/0x108
[ 50.099889] [<ffffffff8015de34>] warn_slowpath_fmt+0x3c/0x48
[ 50.107241] [<ffffffff801c15b4>] check_flags.part.41+0x1dc/0x1e8
[ 50.114961] [<ffffffff801c239c>] lock_is_held_type+0x8c/0xb0
[ 50.122291] [<ffffffff809461b8>] __schedule+0x8c0/0x10f8
[ 50.129221] [<ffffffff80946a60>] schedule+0x30/0x98
[ 50.135659] [<ffffffff80106278>] work_resched+0x8/0x34
[ 50.142397] ---[ end trace 0cb4f6ef5b99fe21 ]---
[ 50.148405] possible reason: unannotated irqs-off.
[ 50.154600] irq event stamp: 400463
[ 50.159566] hardirqs last enabled at (400463): [<ffffffff8094edc8>] _raw_spin_unlock_irqrestore+0x40/0xa8
[ 50.171981] hardirqs last disabled at (400462): [<ffffffff8094eb98>] _raw_spin_lock_irqsave+0x30/0xb0
[ 50.183897] softirqs last enabled at (400450): [<ffffffff8016580c>] __do_softirq+0x4ac/0x6a8
[ 50.195015] softirqs last disabled at (400425): [<ffffffff80165e78>] irq_exit+0x110/0x128
Fix this by using the TRACE_IRQS_OFF macro to call trace_hardirqs_off()
when CONFIG_TRACE_IRQFLAGS is enabled. This is done before invoking
schedule() following the work_resched label because:
1) Interrupts are disabled regardless of the path we take to reach
work_resched() & schedule().
2) Performing the tracing here avoids the need to do it in paths which
disable interrupts but don't call out to C code before hitting a
path which uses the RESTORE_SOME macro that will call
trace_hardirqs_on() or trace_hardirqs_off() as appropriate.
We call trace_hardirqs_on() using the TRACE_IRQS_ON macro before calling
syscall_trace_leave() for similar reasons, ensuring that lockdep has a
consistent view of state after we re-enable interrupts.
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15385/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/kernel/entry.S | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -10,6 +10,7 @@
#include <asm/asm.h>
#include <asm/asmmacro.h>
+#include <asm/irqflags.h>
#include <asm/regdef.h>
#include <asm/mipsregs.h>
#include <asm/stackframe.h>
@@ -118,6 +119,7 @@ work_pending:
andi t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS
beqz t0, work_notifysig
work_resched:
+ TRACE_IRQS_OFF
jal schedule
local_irq_disable # make sure need_resched and
@@ -154,6 +156,7 @@ syscall_exit_work:
beqz t0, work_pending # trace bit set?
local_irq_enable # could let syscall_trace_leave()
# call schedule() instead
+ TRACE_IRQS_ON
move a0, sp
jal syscall_trace_leave
b resume_userspace
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 187/233] genirq: Release resources in __setup_irq() error path
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (212 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 225/233] MIPS: Fix IRQ tracing & lockdep when rescheduling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 170/233] KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation Ben Hutchings
` (19 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Heiner Kallweit, Thomas Gleixner
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <hkallweit1@gmail.com>
commit fa07ab72cbb0d843429e61bf179308aed6cbe0dd upstream.
In case __irq_set_trigger() fails the resources requested via
irq_request_resources() are not released.
Add the missing release call into the error handling path.
Fixes: c1bacbae8192 ("genirq: Provide irq_request/release_resources chip callbacks")
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/655538f5-cb20-a892-ff15-fbd2dd1fa4ec@gmail.com
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/irq/manage.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -1174,8 +1174,10 @@ __setup_irq(unsigned int irq, struct irq
ret = __irq_set_trigger(desc, irq,
new->flags & IRQF_TRIGGER_MASK);
- if (ret)
+ if (ret) {
+ irq_release_resources(desc);
goto out_mask;
+ }
}
desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 170/233] KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (213 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 187/233] genirq: Release resources in __setup_irq() error path Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 185/233] cpufreq: conservative: Allow down_threshold to take values from 1 to 10 Ben Hutchings
` (18 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Wanpeng Li, Paolo Bonzini, Moguofang, Radim Krčmář
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit a3641631d14571242eec0d30c9faa786cbf52d44 upstream.
If "i" is the last element in the vcpu->arch.cpuid_entries[] array, it
potentially can be exploited the vulnerability. this will out-of-bounds
read and write. Luckily, the effect is small:
/* when no next entry is found, the current entry[i] is reselected */
for (j = i + 1; ; j = (j + 1) % nent) {
struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
if (ej->function == e->function) {
It reads ej->maxphyaddr, which is user controlled. However...
ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
After cpuid_entries there is
int maxphyaddr;
struct x86_emulate_ctxt emulate_ctxt; /* 16-byte aligned */
So we have:
- cpuid_entries at offset 1B50 (6992)
- maxphyaddr at offset 27D0 (6992 + 3200 = 10192)
- padding at 27D4...27DF
- emulate_ctxt at 27E0
And it writes in the padding. Pfew, writing the ops field of emulate_ctxt
would have been much worse.
This patch fixes it by modding the index to avoid the out-of-bounds
access. Worst case, i == j and ej->function == e->function,
the loop can bail out.
Reported-by: Moguofang <moguofang@huawei.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Radim Krčmář <rkrcmar@redhat.com>
Cc: Guofang Mo <moguofang@huawei.com>
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kvm/cpuid.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -671,18 +671,20 @@ out:
static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i)
{
struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i];
- int j, nent = vcpu->arch.cpuid_nent;
+ struct kvm_cpuid_entry2 *ej;
+ int j = i;
+ int nent = vcpu->arch.cpuid_nent;
e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT;
/* when no next entry is found, the current entry[i] is reselected */
- for (j = i + 1; ; j = (j + 1) % nent) {
- struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j];
- if (ej->function == e->function) {
- ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
- return j;
- }
- }
- return 0; /* silence gcc, even though control never reaches here */
+ do {
+ j = (j + 1) % nent;
+ ej = &vcpu->arch.cpuid_entries[j];
+ } while (ej->function != e->function);
+
+ ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT;
+
+ return j;
}
/* find an entry with matching function, matching index (if needed), and that
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 185/233] cpufreq: conservative: Allow down_threshold to take values from 1 to 10
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (214 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 170/233] KVM: cpuid: Fix read/write out-of-bounds vulnerability in cpuid emulation Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 202/233] Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list Ben Hutchings
` (17 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Rafael J. Wysocki, Tomasz Wilczyński, Viresh Kumar
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Wilczyński <twilczynski@naver.com>
commit b8e11f7d2791bd9320be1c6e772a60b2aa093e45 upstream.
Commit 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency
decrease checking) removed the 10 point substraction when comparing the
load against down_threshold but did not remove the related limit for the
down_threshold value. As a result, down_threshold lower than 11 is not
allowed even though values from 1 to 10 do work correctly too. The
comment ("cannot be lower than 11 otherwise freq will not fall") also
does not apply after removing the substraction.
For this reason, allow down_threshold to take any value from 1 to 99
and fix the related comment.
Fixes: 27ed3cd2ebf4 (cpufreq: conservative: Fix the logic in frequency decrease checking)
Signed-off-by: Tomasz Wilczyński <twilczynski@naver.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/cpufreq/cpufreq_conservative.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -204,8 +204,8 @@ static ssize_t store_down_threshold(stru
int ret;
ret = sscanf(buf, "%u", &input);
- /* cannot be lower than 11 otherwise freq will not fall */
- if (ret != 1 || input < 11 || input > 100 ||
+ /* cannot be lower than 1 otherwise freq will not fall */
+ if (ret != 1 || input < 1 || input > 100 ||
input >= cs_tuners->up_threshold)
return -EINVAL;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 202/233] Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (215 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 185/233] cpufreq: conservative: Allow down_threshold to take values from 1 to 10 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 186/233] usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk Ben Hutchings
` (16 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dmitry Torokhov, Daniel Drake
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Drake <drake@endlessm.com>
commit 817ae460c784f32cd45e60b2b1b21378c3c6a847 upstream.
Without this quirk, the touchpad is not responsive on this product, with
the following message repeated in the logs:
psmouse serio1: bad data from KBC - timeout
Add it to the notimeout list alongside other similar Fujitsu laptops.
Signed-off-by: Daniel Drake <drake@endlessm.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -687,6 +687,13 @@ static const struct dmi_system_id __init
DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
},
},
+ {
+ /* Fujitsu UH554 laptop */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"),
+ },
+ },
{ }
};
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 186/233] usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (216 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 202/233] Input: i8042 - add Fujitsu Lifebook AH544 to notimeout list Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 209/233] ipv6: initialize route null entry in addrconf_init() Ben Hutchings
` (15 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Mathias Nyman, Corentin Labbe
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Corentin Labbe <clabbe.montjoie@gmail.com>
commit d2f48f05cd2a2a0a708fbfa45f1a00a87660d937 upstream.
When plugging an USB webcam I see the following message:
[106385.615559] xhci_hcd 0000:04:00.0: WARN Successful completion on short TX: needs XHCI_TRUST_TX_LENGTH quirk?
[106390.583860] handle_tx_event: 913 callbacks suppressed
With this patch applied, I get no more printing of this message.
Signed-off-by: Corentin Labbe <clabbe.montjoie@gmail.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci-pci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -182,6 +182,9 @@ static void xhci_pci_quirks(struct devic
if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
pdev->device == 0x1042)
xhci->quirks |= XHCI_BROKEN_STREAMS;
+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+ pdev->device == 0x1142)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
if (xhci->quirks & XHCI_RESET_ON_RESUME)
xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 209/233] ipv6: initialize route null entry in addrconf_init()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (217 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 186/233] usb: xhci: ASMedia ASM1042A chipset need shorts TX quirk Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 197/233] powerpc/kprobes: Pause function_graph tracing during jprobes handling Ben Hutchings
` (14 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Andrey Konovalov, WANG Cong, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 2f460933f58eee3393aba64f0f6d14acb08d1724 upstream.
Andrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev
since it is always NULL.
This is clearly wrong, we have code to initialize it to loopback_dev,
unfortunately the order is still not correct.
loopback_dev is registered very early during boot, we lose a chance
to re-initialize it in notifier. addrconf_init() is called after
ip6_route_init(), which means we have no chance to correct it.
Fix it by moving this initialization explicitly after
ipv6_add_dev(init_net.loopback_dev) in addrconf_init().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/ip6_route.h | 1 +
net/ipv6/addrconf.c | 2 ++
net/ipv6/route.c | 26 +++++++++++++++-----------
3 files changed, 18 insertions(+), 11 deletions(-)
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -69,6 +69,7 @@ struct dst_entry *ip6_route_output(struc
struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
int flags);
+void ip6_route_init_special_entries(void);
int ip6_route_init(void);
void ip6_route_cleanup(void);
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5382,6 +5382,8 @@ int __init addrconf_init(void)
if (err)
goto errlo;
+ ip6_route_init_special_entries();
+
for (i = 0; i < IN6_ADDR_HSIZE; i++)
INIT_HLIST_HEAD(&inet6_addr_lst[i]);
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3141,6 +3141,21 @@ static struct notifier_block ip6_route_d
.priority = 0,
};
+void __init ip6_route_init_special_entries(void)
+{
+ /* Registering of the loopback is done before this portion of code,
+ * the loopback reference in rt6_info will not be taken, do it
+ * manually for init_net */
+ init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+ init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+ #endif
+}
+
int __init ip6_route_init(void)
{
int ret;
@@ -3166,17 +3181,6 @@ int __init ip6_route_init(void)
ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
- /* Registering of the loopback is done before this portion of code,
- * the loopback reference in rt6_info will not be taken, do it
- * manually for init_net */
- init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- #ifdef CONFIG_IPV6_MULTIPLE_TABLES
- init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
- init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
- #endif
ret = fib6_init();
if (ret)
goto out_register_subsys;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 197/233] powerpc/kprobes: Pause function_graph tracing during jprobes handling
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (218 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 209/233] ipv6: initialize route null entry in addrconf_init() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 169/233] perf script python: Remove dups in documentation examples Ben Hutchings
` (13 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Masami Hiramatsu, Steven Rostedt (VMware),
Michael Ellerman, Naveen N. Rao
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
commit a9f8553e935f26cb5447f67e280946b0923cd2dc upstream.
This fixes a crash when function_graph and jprobes are used together.
This is essentially commit 237d28db036e ("ftrace/jprobes/x86: Fix
conflict between jprobes and function graph tracing"), but for powerpc.
Jprobes breaks function_graph tracing since the jprobe hook needs to use
jprobe_return(), which never returns back to the hook, but instead to
the original jprobe'd function. The solution is to momentarily pause
function_graph tracing before invoking the jprobe hook and re-enable it
when returning back to the original jprobe'd function.
Fixes: 6794c78243bf ("powerpc64: port of the function graph tracer")
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/powerpc/kernel/kprobes.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/arch/powerpc/kernel/kprobes.c
+++ b/arch/powerpc/kernel/kprobes.c
@@ -514,6 +514,15 @@ int __kprobes setjmp_pre_handler(struct
#endif
#endif
+ /*
+ * jprobes use jprobe_return() which skips the normal return
+ * path of the function, and this messes up the accounting of the
+ * function graph tracer.
+ *
+ * Pause function graph tracing while performing the jprobe function.
+ */
+ pause_graph_tracing();
+
return 1;
}
@@ -536,6 +545,8 @@ int __kprobes longjmp_break_handler(stru
* saved regs...
*/
memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs));
+ /* It's OK to start function graph tracing again */
+ unpause_graph_tracing();
preempt_enable_no_resched();
return 1;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 169/233] perf script python: Remove dups in documentation examples
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (219 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 197/233] powerpc/kprobes: Pause function_graph tracing during jprobes handling Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 227/233] tracing/kprobes: Allow to create probe with a module name starting with a digit Ben Hutchings
` (12 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, SeongJae Park, Tom Zanussi, Frederic Weisbecker,
Arnaldo Carvalho de Melo, Peter Zijlstra, Alexander Shishkin
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit 14fc42fa1b3e7ea5160c84d0e686a3a0c1ffe619 upstream.
Few shell command examples in perf-script-python.txt has few nitpicks
include:
- tools/perf/scripts/python directory listing command is unnecessarily
repeated.
- few examples contain additional information in command prompt
unnecessarily and inconsistently.
This commit fixes them to enhance readability of the document.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Zanussi <tzanussi@gmail.com>
Fixes: cff68e582237 ("perf/scripts: Add perf-trace-python Documentation")
Link: http://lkml.kernel.org/r/20170530111827.21732-4-sj38.park@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/Documentation/perf-script-python.txt | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/tools/perf/Documentation/perf-script-python.txt
+++ b/tools/perf/Documentation/perf-script-python.txt
@@ -332,7 +332,7 @@ right place, you can have your script li
scripts listed by the 'perf script -l' command e.g.:
----
-root@tropicana:~# perf script -l
+# perf script -l
List of available trace scripts:
wakeup-latency system-wide min/max/avg wakeup latency
rw-by-file <comm> r/w activity for a program, by file
@@ -381,8 +381,6 @@ source tree:
----
# ls -al kernel-source/tools/perf/scripts/python
-
-root@tropicana:/home/trz/src/tip# ls -al tools/perf/scripts/python
total 32
drwxr-xr-x 4 trz trz 4096 2010-01-26 22:30 .
drwxr-xr-x 4 trz trz 4096 2010-01-26 22:29 ..
@@ -397,7 +395,7 @@ otherwise your script won't show up at r
should show a new entry for your script:
----
-root@tropicana:~# perf script -l
+# perf script -l
List of available trace scripts:
wakeup-latency system-wide min/max/avg wakeup latency
rw-by-file <comm> r/w activity for a program, by file
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 227/233] tracing/kprobes: Allow to create probe with a module name starting with a digit
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (220 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 169/233] perf script python: Remove dups in documentation examples Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 219/233] tcp: reset sk_rx_dst in tcp_disconnect() Ben Hutchings
` (11 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Sabrina Dubroca, Steven Rostedt (VMware), Masami Hiramatsu
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
commit 9e52b32567126fe146f198971364f68d3bc5233f upstream.
Always try to parse an address, since kstrtoul() will safely fail when
given a symbol as input. If that fails (which will be the case for a
symbol), try to parse a symbol instead.
This allows creating a probe such as:
p:probe/vlan_gro_receive 8021q:vlan_gro_receive+0
Which is necessary for this command to work:
perf probe -m 8021q -a vlan_gro_receive
Link: http://lkml.kernel.org/r/fd72d666f45b114e2c5b9cf7e27b91de1ec966f1.1498122881.git.sd@queasysnail.net
Fixes: 413d37d1e ("tracing: Add kprobe-based event tracer")
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
[bwh: Backported to 3.16: preserve the check that an addresses isn't used for
a kretprobe]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/trace/trace_kprobe.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -671,24 +671,21 @@ static int create_trace_kprobe(int argc,
pr_info("Probe point is not specified.\n");
return -EINVAL;
}
- if (isdigit(argv[1][0])) {
+
+ /* try to parse an address. if that fails, try to read the
+ * input as a symbol. */
+ if (!kstrtoul(argv[1], 0, (unsigned long *)&addr)) {
if (is_return) {
pr_info("Return probe point must be a symbol.\n");
return -EINVAL;
}
- /* an address specified */
- ret = kstrtoul(&argv[1][0], 0, (unsigned long *)&addr);
- if (ret) {
- pr_info("Failed to parse address.\n");
- return ret;
- }
} else {
/* a symbol specified */
symbol = argv[1];
/* TODO: support .init module functions */
ret = traceprobe_split_symbol_offset(symbol, &offset);
if (ret) {
- pr_info("Failed to parse symbol.\n");
+ pr_info("Failed to parse either an address or a symbol.\n");
return ret;
}
if (offset && is_return) {
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 219/233] tcp: reset sk_rx_dst in tcp_disconnect()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (221 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 227/233] tracing/kprobes: Allow to create probe with a module name starting with a digit Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 163/233] Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled Ben Hutchings
` (10 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andrei Vagin, David S. Miller, Kevin Xu, WANG Cong
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit d747a7a51b00984127a88113cdbbc26f91e9d815 upstream.
We have to reset the sk->sk_rx_dst when we disconnect a TCP
connection, because otherwise when we re-connect it this
dst reference is simply overridden in tcp_finish_connect().
This fixes a dst leak which leads to a loopback dev refcnt
leak. It is a long-standing bug, Kevin reported a very similar
(if not same) bug before. Thanks to Andrei for providing such
a reliable reproducer which greatly narrows down the problem.
Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.")
Reported-by: Andrei Vagin <avagin@gmail.com>
Reported-by: Kevin Xu <kaiwen.xu@hulu.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/tcp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2367,6 +2367,8 @@ int tcp_disconnect(struct sock *sk, int
tcp_init_send_head(sk);
memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
__sk_dst_reset(sk);
+ dst_release(sk->sk_rx_dst);
+ sk->sk_rx_dst = NULL;
WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 163/233] Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (222 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 219/233] tcp: reset sk_rx_dst in tcp_disconnect() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 189/233] selinux: fix double free in selinux_parse_opts_str() Ben Hutchings
` (9 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ulrik De Bie, Dmitry Torokhov, Arjan Opmeer
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ulrik De Bie <ulrik.debie-os@e2big.org>
commit 47eb0c8b4d9eb6368941c6a9bb443f00847a46d7 upstream.
The Lifebook E546 and E557 touchpad were also not functioning and
worked after running:
echo "1" > /sys/devices/platform/i8042/serio2/crc_enabled
Add them to the list of machines that need this workaround.
Signed-off-by: Ulrik De Bie <ulrik.debie-os@e2big.org>
Reviewed-by: Arjan Opmeer <arjan@opmeer.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/input/mouse/elantech.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1036,8 +1036,10 @@ static int elantech_get_resolution_v4(st
* Asus UX32VD 0x361f02 00, 15, 0e clickpad
* Avatar AVIU-145A2 0x361f00 ? clickpad
* Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons
+ * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons
* Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons
* Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons
+ * Fujitsu LIFEBOOK E557 0x570f01 40, 14, 0c 2 hw buttons
* Gigabyte U2442 0x450f01 58, 17, 0c 2 hw buttons
* Lenovo L430 0x350f02 b9, 15, 0c 2 hw buttons (*)
* Samsung NF210 0x150b00 78, 14, 0a 2 hw buttons
@@ -1397,6 +1399,13 @@ static const struct dmi_system_id elante
},
},
{
+ /* Fujitsu LIFEBOOK E546 does not work with crc_enabled == 0 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"),
+ },
+ },
+ {
/* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
@@ -1418,6 +1427,13 @@ static const struct dmi_system_id elante
},
},
{
+ /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"),
+ },
+ },
+ {
/* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 189/233] selinux: fix double free in selinux_parse_opts_str()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (223 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 163/233] Input: elantech - add Fujitsu Lifebook E546/E557 to force crc_enabled Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 204/233] drm/radeon: add a quirk for Toshiba Satellite L20-183 Ben Hutchings
` (8 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Dmitry Vyukov, Paul Moore, James Morris, Tetsuo Handa
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <paul@paul-moore.com>
commit 023f108dcc187e34ef864bf10ed966cf25e14e2a upstream.
This patch is based on a discussion generated by an earlier patch
from Tetsuo Handa:
* https://marc.info/?t=149035659300001&r=1&w=2
The double free problem involves the mnt_opts field of the
security_mnt_opts struct, selinux_parse_opts_str() frees the memory
on error, but doesn't set the field to NULL so if the caller later
attempts to call security_free_mnt_opts() we trigger the problem.
In order to play it safe we change selinux_parse_opts_str() to call
security_free_mnt_opts() on error instead of free'ing the memory
directly. This should ensure that everything is handled correctly,
regardless of what the caller may do.
Fixes: e0007529893c1c06 ("LSM/SELinux: Interfaces to allow FS to control mount options")
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
security/selinux/hooks.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1000,10 +1000,8 @@ static int selinux_parse_opts_str(char *
goto out_err;
opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
- if (!opts->mnt_opts_flags) {
- kfree(opts->mnt_opts);
+ if (!opts->mnt_opts_flags)
goto out_err;
- }
if (fscontext) {
opts->mnt_opts[num_mnt_opts] = fscontext;
@@ -1026,6 +1024,7 @@ static int selinux_parse_opts_str(char *
return 0;
out_err:
+ security_free_mnt_opts(opts);
kfree(context);
kfree(defcontext);
kfree(fscontext);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 204/233] drm/radeon: add a quirk for Toshiba Satellite L20-183
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (224 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 189/233] selinux: fix double free in selinux_parse_opts_str() Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 215/233] net: account for current skb length when deciding about UFO Ben Hutchings
` (7 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Deucher, Przemek
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit acfd6ee4fa7ebeee75511825fe02be3f7ac1d668 upstream.
Fixes resume from suspend.
bug: https://bugzilla.kernel.org/show_bug.cgi?id=196121
Reported-by: Przemek <soprwa@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/radeon_combios.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -3394,6 +3394,13 @@ void radeon_combios_asic_init(struct drm
rdev->pdev->subsystem_vendor == 0x103c &&
rdev->pdev->subsystem_device == 0x280a)
return;
+ /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume
+ * - it hangs on resume inside the dynclk 1 table.
+ */
+ if (rdev->family == CHIP_RS400 &&
+ rdev->pdev->subsystem_vendor == 0x1179 &&
+ rdev->pdev->subsystem_device == 0xff31)
+ return;
/* DYN CLK 1 */
table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 215/233] net: account for current skb length when deciding about UFO
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (225 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 204/233] drm/radeon: add a quirk for Toshiba Satellite L20-183 Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 212/233] ipv6: avoid unregistering inet6_dev for loopback Ben Hutchings
` (6 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Vlad Yasevich, David S. Miller, Michal Kubeček
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubeček <mkubecek@suse.cz>
commit a5cb659bbc1c8644efa0c3138a757a1e432a4880 upstream.
Our customer encountered stuck NFS writes for blocks starting at specific
offsets w.r.t. page boundary caused by networking stack sending packets via
UFO enabled device with wrong checksum. The problem can be reproduced by
composing a long UDP datagram from multiple parts using MSG_MORE flag:
sendto(sd, buff, 1000, MSG_MORE, ...);
sendto(sd, buff, 1000, MSG_MORE, ...);
sendto(sd, buff, 3000, 0, ...);
Assume this packet is to be routed via a device with MTU 1500 and
NETIF_F_UFO enabled. When second sendto() gets into __ip_append_data(),
this condition is tested (among others) to decide whether to call
ip_ufo_append_data():
((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))
At the moment, we already have skb with 1028 bytes of data which is not
marked for GSO so that the test is false (fragheaderlen is usually 20).
Thus we append second 1000 bytes to this skb without invoking UFO. Third
sendto(), however, has sufficient length to trigger the UFO path so that we
end up with non-UFO skb followed by a UFO one. Later on, udp_send_skb()
uses udp_csum() to calculate the checksum but that assumes all fragments
have correct checksum in skb->csum which is not true for UFO fragments.
When checking against MTU, we need to add skb->len to length of new segment
if we already have a partially filled skb and fragheaderlen only if there
isn't one.
In the IPv6 case, skb can only be null if this is the first segment so that
we have to use headersize (length of the first IPv6 header) rather than
fragheaderlen (length of IPv6 header of further fragments) for skb == NULL.
Fixes: e89e9cf539a2 ("[IPv4/IPv6]: UFO Scatter-gather approach")
Fixes: e4c5e13aa45c ("ipv6: Should use consistent conditional judgement for
ip6 fragment between __ip6_append_data and ip6_finish_output")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Vlad Yasevich <vyasevic@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
- Move headersize out of the if-statement in ip6_append_data() so it can be
used for this
- Adjust context to apply after "udp: consistently apply ufo or fragmentation"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/ip_output.c | 3 ++-
net/ipv6/ip6_output.c | 2 +-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -886,7 +886,7 @@ static int __ip_append_data(struct sock
cork->length += length;
if ((skb && skb_is_gso(skb)) ||
- (((length + fragheaderlen) > mtu) &&
+ (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
(skb_queue_len(queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1146,7 +1146,7 @@ int ip6_append_data(struct sock *sk, int
struct ipv6_pinfo *np = inet6_sk(sk);
struct inet_cork *cork;
struct sk_buff *skb, *skb_prev = NULL;
- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu;
+ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, headersize;
int exthdrlen;
int dst_exthdrlen;
int hh_len;
@@ -1236,15 +1236,14 @@ int ip6_append_data(struct sock *sk, int
(opt ? opt->opt_nflen : 0);
maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
sizeof(struct frag_hdr);
+ headersize = sizeof(struct ipv6hdr) +
+ (opt ? opt->opt_flen + opt->opt_nflen : 0) +
+ (dst_allfrag(&rt->dst) ?
+ sizeof(struct frag_hdr) : 0) +
+ rt->rt6i_nfheader_len;
if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
- unsigned int maxnonfragsize, headersize;
-
- headersize = sizeof(struct ipv6hdr) +
- (opt ? opt->opt_flen + opt->opt_nflen : 0) +
- (dst_allfrag(&rt->dst) ?
- sizeof(struct frag_hdr) : 0) +
- rt->rt6i_nfheader_len;
+ unsigned int maxnonfragsize;
if (ip6_sk_ignore_df(sk))
maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
@@ -1292,7 +1291,7 @@ emsgsize:
skb = skb_peek_tail(&sk->sk_write_queue);
cork->length += length;
if ((skb && skb_is_gso(skb)) ||
- (((length + fragheaderlen) > mtu) &&
+ (((length + (skb ? skb->len : headersize)) > mtu) &&
(skb_queue_len(&sk->sk_write_queue) <= 1) &&
(sk->sk_protocol == IPPROTO_UDP) &&
(rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 212/233] ipv6: avoid unregistering inet6_dev for loopback
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (226 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 215/233] net: account for current skb length when deciding about UFO Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 233/233] Sanitize 'move_pages()' permission checks Ben Hutchings
` (5 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David S. Miller, WANG Cong, Andrey Konovalov,
Daniel Lezcano, David Ahern
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 60abc0be96e00ca71bac083215ac91ad2e575096 upstream.
The per netns loopback_dev->ip6_ptr is unregistered and set to
NULL when its mtu is set to smaller than IPV6_MIN_MTU, this
leads to that we could set rt->rt6i_idev NULL after a
rt6_uncached_list_flush_dev() and then crash after another
call.
In this case we should just bring its inet6_dev down, rather
than unregistering it, at least prior to commit 176c39af29bc
("netns: fix addrconf_ifdown kernel panic") we always
override the case for loopback.
Thanks a lot to Andrey for finding a reliable reproducer.
Fixes: 176c39af29bc ("netns: fix addrconf_ifdown kernel panic")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Daniel Lezcano <dlezcano@fr.ibm.com>
Cc: David Ahern <dsahern@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: David Ahern <dsahern@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: the NETDEV_CHANGEMTU case used to fall-through to the
NETDEV_DOWN case here, so replace that with a separate call to addrconf_ifdown()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2823,6 +2823,7 @@ static int addrconf_notify(struct notifi
{
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct inet6_dev *idev = __in6_dev_get(dev);
+ struct net *net = dev_net(dev);
int run_pending = 0;
int err;
@@ -2916,7 +2917,7 @@ static int addrconf_notify(struct notifi
* IPV6_MIN_MTU stop IPv6 on this interface.
*/
if (dev->mtu < IPV6_MIN_MTU)
- addrconf_ifdown(dev, 1);
+ addrconf_ifdown(dev, dev != net->loopback_dev);
}
break;
@@ -2937,6 +2938,8 @@ static int addrconf_notify(struct notifi
* if MTU under IPV6_MIN_MTU.
* Stop IPv6 on this interface.
*/
+ addrconf_ifdown(dev, dev != net->loopback_dev);
+ break;
case NETDEV_DOWN:
case NETDEV_UNREGISTER:
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 233/233] Sanitize 'move_pages()' permission checks
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (227 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 212/233] ipv6: avoid unregistering inet6_dev for loopback Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 216/233] net: dp83640: Avoid NULL pointer dereference Ben Hutchings
` (4 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Willy Tarreau, Eric W. Biederman, Otto Ebeling, Linus Torvalds
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit 197e7e521384a23b9e585178f3f11c9fa08274b9 upstream.
The 'move_paghes()' system call was introduced long long ago with the
same permission checks as for sending a signal (except using
CAP_SYS_NICE instead of CAP_SYS_KILL for the overriding capability).
That turns out to not be a great choice - while the system call really
only moves physical page allocations around (and you need other
capabilities to do a lot of it), you can check the return value to map
out some the virtual address choices and defeat ASLR of a binary that
still shares your uid.
So change the access checks to the more common 'ptrace_may_access()'
model instead.
This tightens the access checks for the uid, and also effectively
changes the CAP_SYS_NICE check to CAP_SYS_PTRACE, but it's unlikely that
anybody really _uses_ this legacy system call any more (we hav ebetter
NUMA placement models these days), so I expect nobody to notice.
Famous last words.
Reported-by: Otto Ebeling <otto.ebeling@iki.fi>
Acked-by: Eric W. Biederman <ebiederm@xmission.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/migrate.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -38,6 +38,7 @@
#include <linux/gfp.h>
#include <linux/balloon_compaction.h>
#include <linux/mmu_notifier.h>
+#include <linux/ptrace.h>
#include <asm/tlbflush.h>
@@ -1484,7 +1485,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
const int __user *, nodes,
int __user *, status, int, flags)
{
- const struct cred *cred = current_cred(), *tcred;
struct task_struct *task;
struct mm_struct *mm;
int err;
@@ -1508,14 +1508,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
/*
* Check if this process has the right to modify the specified
- * process. The right exists if the process has administrative
- * capabilities, superuser privileges or the same
- * userid as the target process.
- */
- tcred = __task_cred(task);
- if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) &&
- !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) &&
- !capable(CAP_SYS_NICE)) {
+ * process. Use the regular "ptrace_may_access()" checks.
+ */
+ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) {
rcu_read_unlock();
err = -EPERM;
goto out;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 216/233] net: dp83640: Avoid NULL pointer dereference.
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (228 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 233/233] Sanitize 'move_pages()' permission checks Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 179/233] ufs: restore maintaining ->i_blocks Ben Hutchings
` (3 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Richard Cochran, David S. Miller
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Richard Cochran <richardcochran@gmail.com>
commit db9d8b29d19d2801793e4419f4c6272bf8951c62 upstream.
The function, skb_complete_tx_timestamp(), used to allow passing in a
NULL pointer for the time stamps, but that was changed in commit
62bccb8cdb69051b95a55ab0c489e3cab261c8ef ("net-timestamp: Make the
clone operation stand-alone from phy timestamping"), and the existing
call sites, all of which are in the dp83640 driver, were fixed up.
Even though the kernel-doc was subsequently updated in commit
7a76a021cd5a292be875fbc616daf03eab1e6996 ("net-timestamp: Update
skb_complete_tx_timestamp comment"), still a bug fix from Manfred
Rudigier came into the driver using the old semantics. Probably
Manfred derived that patch from an older kernel version.
This fix should be applied to the stable trees as well.
Fixes: 81e8f2e930fe ("net: dp83640: Fix tx timestamp overflow handling.")
Signed-off-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/phy/dp83640.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -802,7 +802,7 @@ static void decode_txts(struct dp83640_p
if (overflow) {
pr_debug("tx timestamp queue overflow, count %d\n", overflow);
while (skb) {
- skb_complete_tx_timestamp(skb, NULL);
+ kfree_skb(skb);
skb = skb_dequeue(&dp83640->tx_queue);
}
return;
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 179/233] ufs: restore maintaining ->i_blocks
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (229 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 216/233] net: dp83640: Avoid NULL pointer dereference Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 210/233] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf Ben Hutchings
` (2 subsequent siblings)
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Al Viro
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit eb315d2ae614493fd1ebb026c75a80573d84f7ad upstream.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.16: open-code i_blocksize()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/stat.c | 1 +
fs/ufs/balloc.c | 26 +++++++++++++++++++++++++-
2 files changed, 26 insertions(+), 1 deletion(-)
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -456,6 +456,7 @@ void __inode_add_bytes(struct inode *ino
inode->i_bytes -= 512;
}
}
+EXPORT_SYMBOL(__inode_add_bytes);
void inode_add_bytes(struct inode *inode, loff_t bytes)
{
--- a/fs/ufs/balloc.c
+++ b/fs/ufs/balloc.c
@@ -81,7 +81,8 @@ void ufs_free_fragments(struct inode *in
ufs_error (sb, "ufs_free_fragments",
"bit already cleared for fragment %u", i);
}
-
+
+ inode_sub_bytes(inode, count << uspi->s_fshift);
fs32_add(sb, &ucg->cg_cs.cs_nffree, count);
uspi->cs_total.cs_nffree += count;
fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count);
@@ -183,6 +184,7 @@ do_more:
ufs_error(sb, "ufs_free_blocks", "freeing free fragment");
}
ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
+ inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift);
if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
ufs_clusteracct (sb, ucpi, blkno, 1);
@@ -490,6 +492,20 @@ u64 ufs_new_fragments(struct inode *inod
return 0;
}
+static bool try_add_frags(struct inode *inode, unsigned frags)
+{
+ unsigned size = frags << inode->i_blkbits;
+ spin_lock(&inode->i_lock);
+ __inode_add_bytes(inode, size);
+ if (unlikely((u32)inode->i_blocks != inode->i_blocks)) {
+ __inode_sub_bytes(inode, size);
+ spin_unlock(&inode->i_lock);
+ return false;
+ }
+ spin_unlock(&inode->i_lock);
+ return true;
+}
+
static u64 ufs_add_fragments(struct inode *inode, u64 fragment,
unsigned oldcount, unsigned newcount)
{
@@ -526,6 +542,9 @@ static u64 ufs_add_fragments(struct inod
for (i = oldcount; i < newcount; i++)
if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i))
return 0;
+
+ if (!try_add_frags(inode, count))
+ return 0;
/*
* Block can be extended
*/
@@ -643,6 +662,7 @@ cg_found:
ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i);
i = uspi->s_fpb - count;
+ inode_sub_bytes(inode, i << uspi->s_fshift);
fs32_add(sb, &ucg->cg_cs.cs_nffree, i);
uspi->cs_total.cs_nffree += i;
fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i);
@@ -653,6 +673,8 @@ cg_found:
result = ufs_bitmap_search (sb, ucpi, goal, allocsize);
if (result == INVBLOCK)
return 0;
+ if (!try_add_frags(inode, count))
+ return 0;
for (i = 0; i < count; i++)
ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i);
@@ -712,6 +734,8 @@ norot:
return INVBLOCK;
ucpi->c_rotor = result;
gotit:
+ if (!try_add_frags(inode, uspi->s_fpb))
+ return 0;
blkno = ufs_fragstoblks(result);
ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno);
if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 210/233] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (230 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 179/233] ufs: restore maintaining ->i_blocks Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-09 21:47 ` [PATCH 3.16 222/233] net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() Ben Hutchings
2017-09-10 14:32 ` [PATCH 3.16 000/233] 3.16.48-rc1 review Guenter Roeck
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, WANG Cong, David Ahern
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
commit 242d3a49a2a1a71d8eb9f953db1bcaa9d698ce00 upstream.
For each netns (except init_net), we initialize its null entry
in 3 places:
1) The template itself, as we use kmemdup()
2) Code around dst_init_metrics() in ip6_route_net_init()
3) ip6_route_dev_notify(), which is supposed to initialize it after
loopback registers
Unfortunately the last one still happens in a wrong order because
we expect to initialize net->ipv6.ip6_null_entry->rt6i_idev to
net->loopback_dev's idev, thus we have to do that after we add
idev to loopback. However, this notifier has priority == 0 same as
ipv6_dev_notf, and ipv6_dev_notf is registered after
ip6_route_dev_notifier so it is called actually after
ip6_route_dev_notifier. This is similar to commit 2f460933f58e
("ipv6: initialize route null entry in addrconf_init()") which
fixes init_net.
Fix it by picking a smaller priority for ip6_route_dev_notifier.
Also, we have to release the refcnt accordingly when unregistering
loopback_dev because device exit functions are called before subsys
exit functions.
Acked-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/addrconf.h | 2 ++
net/ipv6/addrconf.c | 1 +
net/ipv6/route.c | 13 +++++++++++--
3 files changed, 14 insertions(+), 2 deletions(-)
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -19,6 +19,8 @@
#define ADDRCONF_TIMER_FUZZ (HZ / 4)
#define ADDRCONF_TIMER_FUZZ_MAX (HZ)
+#define ADDRCONF_NOTIFY_PRIORITY 0
+
#include <linux/in.h>
#include <linux/in6.h>
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2971,6 +2971,7 @@ static int addrconf_notify(struct notifi
*/
static struct notifier_block ipv6_dev_notf = {
.notifier_call = addrconf_notify,
+ .priority = ADDRCONF_NOTIFY_PRIORITY,
};
static void addrconf_type_change(struct net_device *dev, unsigned long event)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2823,7 +2823,10 @@ static int ip6_route_dev_notify(struct n
struct net_device *dev = netdev_notifier_info_to_dev(ptr);
struct net *net = dev_net(dev);
- if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
+ if (!(dev->flags & IFF_LOOPBACK))
+ return NOTIFY_OK;
+
+ if (event == NETDEV_REGISTER) {
net->ipv6.ip6_null_entry->dst.dev = dev;
net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -2832,6 +2835,12 @@ static int ip6_route_dev_notify(struct n
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
+ } else if (event == NETDEV_UNREGISTER) {
+ in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev);
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev);
+ in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev);
+#endif
}
return NOTIFY_OK;
@@ -3138,7 +3147,7 @@ static struct pernet_operations ip6_rout
static struct notifier_block ip6_route_dev_notifier = {
.notifier_call = ip6_route_dev_notify,
- .priority = 0,
+ .priority = ADDRCONF_NOTIFY_PRIORITY - 10,
};
void __init ip6_route_init_special_entries(void)
^ permalink raw reply [flat|nested] 237+ messages in thread* [PATCH 3.16 222/233] net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (231 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 210/233] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf Ben Hutchings
@ 2017-09-09 21:47 ` Ben Hutchings
2017-09-10 14:32 ` [PATCH 3.16 000/233] 3.16.48-rc1 review Guenter Roeck
233 siblings, 0 replies; 237+ messages in thread
From: Ben Hutchings @ 2017-09-09 21:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Michal Kubeček
3.16.48-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kubeček <mkubecek@suse.cz>
commit e44699d2c28067f69698ccb68dd3ddeacfebc434 upstream.
Recently I started seeing warnings about pages with refcount -1. The
problem was traced to packets being reused after their head was merged into
a GRO packet by skb_gro_receive(). While bisecting the issue pointed to
commit c21b48cc1bbf ("net: adjust skb->truesize in ___pskb_trim()") and
I have never seen it on a kernel with it reverted, I believe the real
problem appeared earlier when the option to merge head frag in GRO was
implemented.
Handling NAPI_GRO_FREE_STOLEN_HEAD state was only added to GRO_MERGED_FREE
branch of napi_skb_finish() so that if the driver uses napi_gro_frags()
and head is merged (which in my case happens after the skb_condense()
call added by the commit mentioned above), the skb is reused including the
head that has been merged. As a result, we release the page reference
twice and eventually end up with negative page refcount.
To fix the problem, handle NAPI_GRO_FREE_STOLEN_HEAD in napi_frags_finish()
the same way it's done in napi_skb_finish().
Fixes: d7e8883cfcf4 ("net: make GRO aware of skb->head_frag")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: The necessary cleanup is just kmem_cache_free(),
so don't bother adding a function for this.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4166,10 +4166,16 @@ static gro_result_t napi_frags_finish(st
break;
case GRO_DROP:
- case GRO_MERGED_FREE:
napi_reuse_skb(napi, skb);
break;
+ case GRO_MERGED_FREE:
+ if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD)
+ kmem_cache_free(skbuff_head_cache, skb);
+ else
+ napi_reuse_skb(napi, skb);
+ break;
+
case GRO_MERGED:
break;
}
^ permalink raw reply [flat|nested] 237+ messages in thread* Re: [PATCH 3.16 000/233] 3.16.48-rc1 review
2017-09-09 21:47 [PATCH 3.16 000/233] 3.16.48-rc1 review Ben Hutchings
` (232 preceding siblings ...)
2017-09-09 21:47 ` [PATCH 3.16 222/233] net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish() Ben Hutchings
@ 2017-09-10 14:32 ` Guenter Roeck
233 siblings, 0 replies; 237+ messages in thread
From: Guenter Roeck @ 2017-09-10 14:32 UTC (permalink / raw)
To: Ben Hutchings, linux-kernel, stable; +Cc: torvalds, akpm
On 09/09/2017 02:47 PM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.16.48 release.
> There are 233 patches in this series, which will be posted as responses
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Sep 12 12:00:00 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 136 pass: 136 fail: 0
Qemu test results:
total: 107 pass: 107 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 237+ messages in thread