* [ 01/80] bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 02/80] bonding: fix race condition in bonding_store_slaves_active Greg Kroah-Hartman
` (80 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sarveshwar Bandi, Eric Dumazet,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
[ Upstream commit 0e376bd0b791ac6ac6bdb051492df0769c840848 ]
Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.
Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1383,6 +1383,8 @@ static void bond_compute_features(struct
struct net_device *bond_dev = bond->dev;
netdev_features_t vlan_features = BOND_VLAN_FEATURES;
unsigned short max_hard_header_len = ETH_HLEN;
+ unsigned int gso_max_size = GSO_MAX_SIZE;
+ u16 gso_max_segs = GSO_MAX_SEGS;
int i;
read_lock(&bond->lock);
@@ -1396,11 +1398,16 @@ static void bond_compute_features(struct
if (slave->dev->hard_header_len > max_hard_header_len)
max_hard_header_len = slave->dev->hard_header_len;
+
+ gso_max_size = min(gso_max_size, slave->dev->gso_max_size);
+ gso_max_segs = min(gso_max_segs, slave->dev->gso_max_segs);
}
done:
bond_dev->vlan_features = vlan_features;
bond_dev->hard_header_len = max_hard_header_len;
+ bond_dev->gso_max_segs = gso_max_segs;
+ netif_set_gso_max_size(bond_dev, gso_max_size);
read_unlock(&bond->lock);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 02/80] bonding: fix race condition in bonding_store_slaves_active
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
2013-01-09 20:34 ` [ 01/80] bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 03/80] sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails Greg Kroah-Hartman
` (79 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Nikolay Aleksandrov, Jay Vosburgh,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "nikolay@redhat.com" <nikolay@redhat.com>
[ Upstream commit e196c0e579902f42cf72414461fb034e5a1ffbf7 ]
Race between bonding_store_slaves_active() and slave manipulation
functions. The bond_for_each_slave use in bonding_store_slaves_active()
is not protected by any synchronization mechanism.
NULL pointer dereference is easy to reach.
Fixed by acquiring the bond->lock for the slave walk.
v2: Make description text < 75 columns
Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
Signed-off-by: Jay Vosburgh <fubar@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_sysfs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1578,6 +1578,7 @@ static ssize_t bonding_store_slaves_acti
goto out;
}
+ read_lock(&bond->lock);
bond_for_each_slave(bond, slave, i) {
if (!bond_is_active_slave(slave)) {
if (new_value)
@@ -1586,6 +1587,7 @@ static ssize_t bonding_store_slaves_acti
slave->inactive = 1;
}
}
+ read_unlock(&bond->lock);
out:
return ret;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 03/80] sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
2013-01-09 20:34 ` [ 01/80] bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices Greg Kroah-Hartman
2013-01-09 20:34 ` [ 02/80] bonding: fix race condition in bonding_store_slaves_active Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 04/80] sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall Greg Kroah-Hartman
` (78 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tommi Rantala, Vlad Yasevich,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommi Rantala <tt.rantala@gmail.com>
[ Upstream commit be364c8c0f17a3dd42707b5a090b318028538eb9 ]
Trinity (the syscall fuzzer) discovered a memory leak in SCTP,
reproducible e.g. with the sendto() syscall by passing invalid
user space pointer in the second argument:
#include <string.h>
#include <arpa/inet.h>
#include <sys/socket.h>
int main(void)
{
int fd;
struct sockaddr_in sa;
fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
if (fd < 0)
return 1;
memset(&sa, 0, sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = inet_addr("127.0.0.1");
sa.sin_port = htons(11111);
sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));
return 0;
}
As far as I can tell, the leak has been around since ~2003.
Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/chunk.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -284,7 +284,7 @@ struct sctp_datamsg *sctp_datamsg_from_u
goto errout;
err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
if (err < 0)
- goto errout;
+ goto errout_chunk_free;
offset += len;
@@ -324,7 +324,7 @@ struct sctp_datamsg *sctp_datamsg_from_u
__skb_pull(chunk->skb, (__u8 *)chunk->chunk_hdr
- (__u8 *)chunk->skb->data);
if (err < 0)
- goto errout;
+ goto errout_chunk_free;
sctp_datamsg_assign(msg, chunk);
list_add_tail(&chunk->frag_list, &msg->chunks);
@@ -332,6 +332,9 @@ struct sctp_datamsg *sctp_datamsg_from_u
return msg;
+errout_chunk_free:
+ sctp_chunk_free(chunk);
+
errout:
list_for_each_safe(pos, temp, &msg->chunks) {
list_del_init(pos);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 04/80] sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2013-01-09 20:34 ` [ 03/80] sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 05/80] ne2000: add the right platform device Greg Kroah-Hartman
` (77 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tommi Rantala, Vlad Yasevich,
Neil Horman, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommi Rantala <tt.rantala@gmail.com>
[ Upstream commit 6e51fe7572590d8d86e93b547fab6693d305fd0d ]
Consider the following program, that sets the second argument to the
sendto() syscall incorrectly:
#include <string.h>
#include <arpa/inet.h>
#include <sys/socket.h>
int main(void)
{
int fd;
struct sockaddr_in sa;
fd = socket(AF_INET, SOCK_STREAM, 132 /*IPPROTO_SCTP*/);
if (fd < 0)
return 1;
memset(&sa, 0, sizeof(sa));
sa.sin_family = AF_INET;
sa.sin_addr.s_addr = inet_addr("127.0.0.1");
sa.sin_port = htons(11111);
sendto(fd, NULL, 1, 0, (struct sockaddr *)&sa, sizeof(sa));
return 0;
}
We get -ENOMEM:
$ strace -e sendto ./demo
sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 ENOMEM (Cannot allocate memory)
Propagate the error code from sctp_user_addto_chunk(), so that we will
tell user space what actually went wrong:
$ strace -e sendto ./demo
sendto(3, NULL, 1, 0, {sa_family=AF_INET, sin_port=htons(11111), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EFAULT (Bad address)
Noticed while running Trinity (the syscall fuzzer).
Signed-off-by: Tommi Rantala <tt.rantala@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/chunk.c | 13 +++++++++----
net/sctp/socket.c | 4 ++--
2 files changed, 11 insertions(+), 6 deletions(-)
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -183,7 +183,7 @@ struct sctp_datamsg *sctp_datamsg_from_u
msg = sctp_datamsg_new(GFP_KERNEL);
if (!msg)
- return NULL;
+ return ERR_PTR(-ENOMEM);
/* Note: Calculate this outside of the loop, so that all fragments
* have the same expiration.
@@ -280,8 +280,11 @@ struct sctp_datamsg *sctp_datamsg_from_u
chunk = sctp_make_datafrag_empty(asoc, sinfo, len, frag, 0);
- if (!chunk)
+ if (!chunk) {
+ err = -ENOMEM;
goto errout;
+ }
+
err = sctp_user_addto_chunk(chunk, offset, len, msgh->msg_iov);
if (err < 0)
goto errout_chunk_free;
@@ -315,8 +318,10 @@ struct sctp_datamsg *sctp_datamsg_from_u
chunk = sctp_make_datafrag_empty(asoc, sinfo, over, frag, 0);
- if (!chunk)
+ if (!chunk) {
+ err = -ENOMEM;
goto errout;
+ }
err = sctp_user_addto_chunk(chunk, offset, over,msgh->msg_iov);
@@ -342,7 +347,7 @@ errout:
sctp_chunk_free(chunk);
}
sctp_datamsg_put(msg);
- return NULL;
+ return ERR_PTR(err);
}
/* Check whether this message has expired. */
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1908,8 +1908,8 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
/* Break the message into multiple chunks of maximum size. */
datamsg = sctp_datamsg_from_user(asoc, sinfo, msg, msg_len);
- if (!datamsg) {
- err = -ENOMEM;
+ if (IS_ERR(datamsg)) {
+ err = PTR_ERR(datamsg);
goto out_free;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 05/80] ne2000: add the right platform device
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2013-01-09 20:34 ` [ 04/80] sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 06/80] irda: sir_dev: Fix copy/paste typo Greg Kroah-Hartman
` (76 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Alan Cox, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <alan@linux.intel.com>
[ Upstream commit da9da01d9199b5bb15289d0859053c9aa3a34ac0 ]
Without this udev doesn't have a way to key the ne device to the platform
device.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/8390/ne.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/8390/ne.c
+++ b/drivers/net/ethernet/8390/ne.c
@@ -813,6 +813,7 @@ static int __init ne_drv_probe(struct pl
dev->irq = irq[this_dev];
dev->mem_end = bad[this_dev];
}
+ SET_NETDEV_DEV(dev, &pdev->dev);
err = do_ne_probe(dev);
if (err) {
free_netdev(dev);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 06/80] irda: sir_dev: Fix copy/paste typo
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2013-01-09 20:34 ` [ 05/80] ne2000: add the right platform device Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:34 ` [ 07/80] ipv4: ip_check_defrag must not modify skb before unsharing Greg Kroah-Hartman
` (75 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Alexander Shiyan, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <shc_work@mail.ru>
[ Upstream commit 2355a62bcbdcc4b567425bab036bfab6ade87eed ]
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/irda/sir_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/irda/sir_dev.c
+++ b/drivers/net/irda/sir_dev.c
@@ -222,7 +222,7 @@ static void sirdev_config_fsm(struct wor
break;
case SIRDEV_STATE_DONGLE_SPEED:
- if (dev->dongle_drv->reset) {
+ if (dev->dongle_drv->set_speed) {
ret = dev->dongle_drv->set_speed(dev, fsm->param);
if (ret < 0) {
fsm->result = ret;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 07/80] ipv4: ip_check_defrag must not modify skb before unsharing
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2013-01-09 20:34 ` [ 06/80] irda: sir_dev: Fix copy/paste typo Greg Kroah-Hartman
@ 2013-01-09 20:34 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 08/80] usb/ipheth: Add iPhone 5 support Greg Kroah-Hartman
` (74 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:34 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Eric Leblond, Johannes Berg,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 1bf3751ec90cc3174e01f0d701e8449ce163d113 ]
ip_check_defrag() might be called from af_packet within the
RX path where shared SKBs are used, so it must not modify
the input SKB before it has unshared it for defragmentation.
Use skb_copy_bits() to get the IP header and only pull in
everything later.
The same is true for the other caller in macvlan as it is
called from dev->rx_handler which can also get a shared SKB.
Reported-by: Eric Leblond <eric@regit.org>
Cc: stable@vger.kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/ip_fragment.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -685,28 +685,27 @@ EXPORT_SYMBOL(ip_defrag);
struct sk_buff *ip_check_defrag(struct sk_buff *skb, u32 user)
{
- const struct iphdr *iph;
+ struct iphdr iph;
u32 len;
if (skb->protocol != htons(ETH_P_IP))
return skb;
- if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+ if (!skb_copy_bits(skb, 0, &iph, sizeof(iph)))
return skb;
- iph = ip_hdr(skb);
- if (iph->ihl < 5 || iph->version != 4)
+ if (iph.ihl < 5 || iph.version != 4)
return skb;
- if (!pskb_may_pull(skb, iph->ihl*4))
- return skb;
- iph = ip_hdr(skb);
- len = ntohs(iph->tot_len);
- if (skb->len < len || len < (iph->ihl * 4))
+
+ len = ntohs(iph.tot_len);
+ if (skb->len < len || len < (iph.ihl * 4))
return skb;
- if (ip_is_fragment(ip_hdr(skb))) {
+ if (ip_is_fragment(&iph)) {
skb = skb_share_check(skb, GFP_ATOMIC);
if (skb) {
+ if (!pskb_may_pull(skb, iph.ihl*4))
+ return skb;
if (pskb_trim_rcsum(skb, len))
return skb;
memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 08/80] usb/ipheth: Add iPhone 5 support
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2013-01-09 20:34 ` [ 07/80] ipv4: ip_check_defrag must not modify skb before unsharing Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 09/80] inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state Greg Kroah-Hartman
` (73 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Jay Purohit, Valdis Kletnieks,
Jan Ceuleers, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Purohit <jspurohit@velocitylimitless.com>
[ Upstream commit af1b85e49089f945deb46258b0fc4bc9910afb22 ]
I noticed that the iPhone ethernet driver did not support
iPhone 5. I quickly added support to it in my kernel, here's
a patch.
Signed-off-by: Jay Purohit <jspurohit@velocitylimitless.com>
Acked-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Signed-off-by: Jan Ceuleers <jan.ceuleers@computer.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ipheth.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -62,6 +62,7 @@
#define USB_PRODUCT_IPAD 0x129a
#define USB_PRODUCT_IPHONE_4_VZW 0x129c
#define USB_PRODUCT_IPHONE_4S 0x12a0
+#define USB_PRODUCT_IPHONE_5 0x12a8
#define IPHETH_USBINTF_CLASS 255
#define IPHETH_USBINTF_SUBCLASS 253
@@ -113,6 +114,10 @@ static struct usb_device_id ipheth_table
USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_4S,
IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
IPHETH_USBINTF_PROTO) },
+ { USB_DEVICE_AND_INTERFACE_INFO(
+ USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_5,
+ IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+ IPHETH_USBINTF_PROTO) },
{ }
};
MODULE_DEVICE_TABLE(usb, ipheth_table);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 09/80] inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2013-01-09 20:35 ` [ 08/80] usb/ipheth: Add iPhone 5 support Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 10/80] inet_diag: validate byte code to prevent oops in inet_diag_bc_run() Greg Kroah-Hartman
` (72 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Neal Cardwell, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit 1c95df85ca49640576de2f0a850925957b547b84 ]
Fix inet_diag to be aware of the fact that AF_INET6 TCP connections
instantiated for IPv4 traffic and in the SYN-RECV state were actually
created with inet_reqsk_alloc(), instead of inet6_reqsk_alloc(). This
means that for such connections inet6_rsk(req) returns a pointer to a
random spot in memory up to roughly 64KB beyond the end of the
request_sock.
With this bug, for a server using AF_INET6 TCP sockets and serving
IPv4 traffic, an inet_diag user like `ss state SYN-RECV` would lead to
inet_diag_fill_req() causing an oops or the export to user space of 16
bytes of kernel memory as a garbage IPv6 address, depending on where
the garbage inet6_rsk(req) pointed.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_diag.c | 53 +++++++++++++++++++++++++++++++++++++--------------
1 file changed, 39 insertions(+), 14 deletions(-)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -44,6 +44,10 @@ struct inet_diag_entry {
u16 dport;
u16 family;
u16 userlocks;
+#if IS_ENABLED(CONFIG_IPV6)
+ struct in6_addr saddr_storage; /* for IPv4-mapped-IPv6 addresses */
+ struct in6_addr daddr_storage; /* for IPv4-mapped-IPv6 addresses */
+#endif
};
#define INET_DIAG_PUT(skb, attrtype, attrlen) \
@@ -586,6 +590,36 @@ static int inet_twsk_diag_dump(struct in
cb->nlh->nlmsg_seq, NLM_F_MULTI, cb->nlh);
}
+/* Get the IPv4, IPv6, or IPv4-mapped-IPv6 local and remote addresses
+ * from a request_sock. For IPv4-mapped-IPv6 we must map IPv4 to IPv6.
+ */
+static inline void inet_diag_req_addrs(const struct sock *sk,
+ const struct request_sock *req,
+ struct inet_diag_entry *entry)
+{
+ struct inet_request_sock *ireq = inet_rsk(req);
+
+#if IS_ENABLED(CONFIG_IPV6)
+ if (sk->sk_family == AF_INET6) {
+ if (req->rsk_ops->family == AF_INET6) {
+ entry->saddr = inet6_rsk(req)->loc_addr.s6_addr32;
+ entry->daddr = inet6_rsk(req)->rmt_addr.s6_addr32;
+ } else if (req->rsk_ops->family == AF_INET) {
+ ipv6_addr_set_v4mapped(ireq->loc_addr,
+ &entry->saddr_storage);
+ ipv6_addr_set_v4mapped(ireq->rmt_addr,
+ &entry->daddr_storage);
+ entry->saddr = entry->saddr_storage.s6_addr32;
+ entry->daddr = entry->daddr_storage.s6_addr32;
+ }
+ } else
+#endif
+ {
+ entry->saddr = &ireq->loc_addr;
+ entry->daddr = &ireq->rmt_addr;
+ }
+}
+
static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
struct request_sock *req, u32 pid, u32 seq,
const struct nlmsghdr *unlh)
@@ -624,8 +658,10 @@ static int inet_diag_fill_req(struct sk_
r->idiag_inode = 0;
#if IS_ENABLED(CONFIG_IPV6)
if (r->idiag_family == AF_INET6) {
- *(struct in6_addr *)r->id.idiag_src = inet6_rsk(req)->loc_addr;
- *(struct in6_addr *)r->id.idiag_dst = inet6_rsk(req)->rmt_addr;
+ struct inet_diag_entry entry;
+ inet_diag_req_addrs(sk, req, &entry);
+ memcpy(r->id.idiag_src, entry.saddr, sizeof(struct in6_addr));
+ memcpy(r->id.idiag_dst, entry.daddr, sizeof(struct in6_addr));
}
#endif
nlh->nlmsg_len = skb_tail_pointer(skb) - b;
@@ -683,18 +719,7 @@ static int inet_diag_dump_reqs(struct sk
continue;
if (bc) {
- entry.saddr =
-#if IS_ENABLED(CONFIG_IPV6)
- (entry.family == AF_INET6) ?
- inet6_rsk(req)->loc_addr.s6_addr32 :
-#endif
- &ireq->loc_addr;
- entry.daddr =
-#if IS_ENABLED(CONFIG_IPV6)
- (entry.family == AF_INET6) ?
- inet6_rsk(req)->rmt_addr.s6_addr32 :
-#endif
- &ireq->rmt_addr;
+ inet_diag_req_addrs(sk, req, &entry);
entry.dport = ntohs(ireq->rmt_port);
if (!inet_diag_bc_run(bc, &entry))
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 10/80] inet_diag: validate byte code to prevent oops in inet_diag_bc_run()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2013-01-09 20:35 ` [ 09/80] inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 11/80] inet_diag: avoid unsafe and nonsensical prefix matches " Greg Kroah-Hartman
` (71 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Neal Cardwell, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit 405c005949e47b6e91359159c24753519ded0c67 ]
Add logic to validate INET_DIAG_BC_S_COND and INET_DIAG_BC_D_COND
operations.
Previously we did not validate the inet_diag_hostcond, address family,
address length, and prefix length. So a malicious user could make the
kernel read beyond the end of the bytecode array by claiming to have a
whole inet_diag_hostcond when the bytecode was not long enough to
contain a whole inet_diag_hostcond of the given address family. Or
they could make the kernel read up to about 27 bytes beyond the end of
a connection address by passing a prefix length that exceeded the
length of addresses of the given family.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_diag.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
1 file changed, 45 insertions(+), 3 deletions(-)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -504,6 +504,44 @@ static int valid_cc(const void *bc, int
return 0;
}
+/* Validate an inet_diag_hostcond. */
+static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
+ int *min_len)
+{
+ int addr_len;
+ struct inet_diag_hostcond *cond;
+
+ /* Check hostcond space. */
+ *min_len += sizeof(struct inet_diag_hostcond);
+ if (len < *min_len)
+ return false;
+ cond = (struct inet_diag_hostcond *)(op + 1);
+
+ /* Check address family and address length. */
+ switch (cond->family) {
+ case AF_UNSPEC:
+ addr_len = 0;
+ break;
+ case AF_INET:
+ addr_len = sizeof(struct in_addr);
+ break;
+ case AF_INET6:
+ addr_len = sizeof(struct in6_addr);
+ break;
+ default:
+ return false;
+ }
+ *min_len += addr_len;
+ if (len < *min_len)
+ return false;
+
+ /* Check prefix length (in bits) vs address length (in bytes). */
+ if (cond->prefix_len > 8 * addr_len)
+ return false;
+
+ return true;
+}
+
static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
{
const void *bc = bytecode;
@@ -511,18 +549,22 @@ static int inet_diag_bc_audit(const void
while (len > 0) {
const struct inet_diag_bc_op *op = bc;
+ int min_len = sizeof(struct inet_diag_bc_op);
//printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len);
switch (op->code) {
- case INET_DIAG_BC_AUTO:
case INET_DIAG_BC_S_COND:
case INET_DIAG_BC_D_COND:
+ if (!valid_hostcond(bc, len, &min_len))
+ return -EINVAL;
+ /* fall through */
+ case INET_DIAG_BC_AUTO:
case INET_DIAG_BC_S_GE:
case INET_DIAG_BC_S_LE:
case INET_DIAG_BC_D_GE:
case INET_DIAG_BC_D_LE:
case INET_DIAG_BC_JMP:
- if (op->no < 4 || op->no > len + 4 || op->no & 3)
+ if (op->no < min_len || op->no > len + 4 || op->no & 3)
return -EINVAL;
if (op->no < len &&
!valid_cc(bytecode, bytecode_len, len - op->no))
@@ -533,7 +575,7 @@ static int inet_diag_bc_audit(const void
default:
return -EINVAL;
}
- if (op->yes < 4 || op->yes > len + 4 || op->yes & 3)
+ if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
return -EINVAL;
bc += op->yes;
len -= op->yes;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 11/80] inet_diag: avoid unsafe and nonsensical prefix matches in inet_diag_bc_run()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2013-01-09 20:35 ` [ 10/80] inet_diag: validate byte code to prevent oops in inet_diag_bc_run() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 12/80] inet_diag: validate port comparison byte code to prevent unsafe reads Greg Kroah-Hartman
` (70 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Neal Cardwell, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit f67caec9068cee426ec23cf9005a1dee2ecad187 ]
Add logic to check the address family of the user-supplied conditional
and the address family of the connection entry. We now do not do
prefix matching of addresses from different address families (AF_INET
vs AF_INET6), except for the previously existing support for having an
IPv4 prefix match an IPv4-mapped IPv6 address (which this commit
maintains as-is).
This change is needed for two reasons:
(1) The addresses are different lengths, so comparing a 128-bit IPv6
prefix match condition to a 32-bit IPv4 connection address can cause
us to unwittingly walk off the end of the IPv4 address and read
garbage or oops.
(2) The IPv4 and IPv6 address spaces are semantically distinct, so a
simple bit-wise comparison of the prefixes is not meaningful, and
would lead to bogus results (except for the IPv4-mapped IPv6 case,
which this commit maintains).
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_diag.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -423,25 +423,31 @@ static int inet_diag_bc_run(const struct
break;
}
- if (cond->prefix_len == 0)
- break;
-
if (op->code == INET_DIAG_BC_S_COND)
addr = entry->saddr;
else
addr = entry->daddr;
+ if (cond->family != AF_UNSPEC &&
+ cond->family != entry->family) {
+ if (entry->family == AF_INET6 &&
+ cond->family == AF_INET) {
+ if (addr[0] == 0 && addr[1] == 0 &&
+ addr[2] == htonl(0xffff) &&
+ bitstring_match(addr + 3,
+ cond->addr,
+ cond->prefix_len))
+ break;
+ }
+ yes = 0;
+ break;
+ }
+
+ if (cond->prefix_len == 0)
+ break;
if (bitstring_match(addr, cond->addr,
cond->prefix_len))
break;
- if (entry->family == AF_INET6 &&
- cond->family == AF_INET) {
- if (addr[0] == 0 && addr[1] == 0 &&
- addr[2] == htonl(0xffff) &&
- bitstring_match(addr + 3, cond->addr,
- cond->prefix_len))
- break;
- }
yes = 0;
break;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 12/80] inet_diag: validate port comparison byte code to prevent unsafe reads
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2013-01-09 20:35 ` [ 11/80] inet_diag: avoid unsafe and nonsensical prefix matches " Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 13/80] b43legacy: Fix firmware loading when driver is built into the kernel Greg Kroah-Hartman
` (69 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Neal Cardwell, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit 5e1f54201cb481f40a04bc47e1bc8c093a189e23 ]
Add logic to verify that a port comparison byte code operation
actually has the second inet_diag_bc_op from which we read the port
for such operations.
Previously the code blindly referenced op[1] without first checking
whether a second inet_diag_bc_op struct could fit there. So a
malicious user could make the kernel read 4 bytes beyond the end of
the bytecode array by claiming to have a whole port comparison byte
code (2 inet_diag_bc_op structs) when in fact the bytecode was not
long enough to hold both.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/inet_diag.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -548,6 +548,17 @@ static bool valid_hostcond(const struct
return true;
}
+/* Validate a port comparison operator. */
+static inline bool valid_port_comparison(const struct inet_diag_bc_op *op,
+ int len, int *min_len)
+{
+ /* Port comparisons put the port in a follow-on inet_diag_bc_op. */
+ *min_len += sizeof(struct inet_diag_bc_op);
+ if (len < *min_len)
+ return false;
+ return true;
+}
+
static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
{
const void *bc = bytecode;
@@ -563,24 +574,30 @@ static int inet_diag_bc_audit(const void
case INET_DIAG_BC_D_COND:
if (!valid_hostcond(bc, len, &min_len))
return -EINVAL;
- /* fall through */
- case INET_DIAG_BC_AUTO:
+ break;
case INET_DIAG_BC_S_GE:
case INET_DIAG_BC_S_LE:
case INET_DIAG_BC_D_GE:
case INET_DIAG_BC_D_LE:
- case INET_DIAG_BC_JMP:
- if (op->no < min_len || op->no > len + 4 || op->no & 3)
- return -EINVAL;
- if (op->no < len &&
- !valid_cc(bytecode, bytecode_len, len - op->no))
+ if (!valid_port_comparison(bc, len, &min_len))
return -EINVAL;
break;
+ case INET_DIAG_BC_AUTO:
+ case INET_DIAG_BC_JMP:
case INET_DIAG_BC_NOP:
break;
default:
return -EINVAL;
}
+
+ if (op->code != INET_DIAG_BC_NOP) {
+ if (op->no < min_len || op->no > len + 4 || op->no & 3)
+ return -EINVAL;
+ if (op->no < len &&
+ !valid_cc(bytecode, bytecode_len, len - op->no))
+ return -EINVAL;
+ }
+
if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
return -EINVAL;
bc += op->yes;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 13/80] b43legacy: Fix firmware loading when driver is built into the kernel
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2013-01-09 20:35 ` [ 12/80] inet_diag: validate port comparison byte code to prevent unsafe reads Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 14/80] b43: fix tx path skb leaks Greg Kroah-Hartman
` (68 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Larry Finger, John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 576d28a7c73013717311cfcb514dbcae27c82eeb upstream.
Recent versions of udev cause synchronous firmware loading from the
probe routine to fail because the request to user space times out.
The original fix for b43legacy (commit a3ea2c7) moved the firmware
load from the probe routine to a work queue, but it still used synchronous
firmware loading. This method is OK when b43legacy is built as a module;
however, it fails when the driver is compiled into the kernel.
This version changes the code to load the initial firmware file
using request_firmware_nowait(). A completion event is used to
hold the work queue until that file is available. The remaining
firmware files are read synchronously.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/b43legacy/b43legacy.h | 5 +++
drivers/net/wireless/b43legacy/main.c | 37 ++++++++++++++++++++++++-----
2 files changed, 36 insertions(+), 6 deletions(-)
--- a/drivers/net/wireless/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/b43legacy/b43legacy.h
@@ -13,6 +13,7 @@
#include <linux/ssb/ssb.h>
#include <linux/ssb/ssb_driver_chipcommon.h>
+#include <linux/completion.h>
#include <net/mac80211.h>
@@ -733,6 +734,10 @@ struct b43legacy_wldev {
/* Firmware data */
struct b43legacy_firmware fw;
+ const struct firmware *fwp; /* needed to pass fw pointer */
+
+ /* completion struct for firmware loading */
+ struct completion fw_load_complete;
/* Devicelist in struct b43legacy_wl (all 802.11 cores) */
struct list_head list;
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -1511,9 +1511,17 @@ static void b43legacy_print_fw_helptext(
"and download the correct firmware (version 3).\n");
}
+static void b43legacy_fw_cb(const struct firmware *firmware, void *context)
+{
+ struct b43legacy_wldev *dev = context;
+
+ dev->fwp = firmware;
+ complete(&dev->fw_load_complete);
+}
+
static int do_request_fw(struct b43legacy_wldev *dev,
const char *name,
- const struct firmware **fw)
+ const struct firmware **fw, bool async)
{
char path[sizeof(modparam_fwpostfix) + 32];
struct b43legacy_fw_header *hdr;
@@ -1526,7 +1534,24 @@ static int do_request_fw(struct b43legac
snprintf(path, ARRAY_SIZE(path),
"b43legacy%s/%s.fw",
modparam_fwpostfix, name);
- err = request_firmware(fw, path, dev->dev->dev);
+ b43legacyinfo(dev->wl, "Loading firmware %s\n", path);
+ if (async) {
+ init_completion(&dev->fw_load_complete);
+ err = request_firmware_nowait(THIS_MODULE, 1, path,
+ dev->dev->dev, GFP_KERNEL,
+ dev, b43legacy_fw_cb);
+ if (err) {
+ b43legacyerr(dev->wl, "Unable to load firmware\n");
+ return err;
+ }
+ /* stall here until fw ready */
+ wait_for_completion(&dev->fw_load_complete);
+ if (!dev->fwp)
+ err = -EINVAL;
+ *fw = dev->fwp;
+ } else {
+ err = request_firmware(fw, path, dev->dev->dev);
+ }
if (err) {
b43legacyerr(dev->wl, "Firmware file \"%s\" not found "
"or load failed.\n", path);
@@ -1578,7 +1603,7 @@ static void b43legacy_request_firmware(s
filename = "ucode4";
else
filename = "ucode5";
- err = do_request_fw(dev, filename, &fw->ucode);
+ err = do_request_fw(dev, filename, &fw->ucode, true);
if (err)
goto err_load;
}
@@ -1587,7 +1612,7 @@ static void b43legacy_request_firmware(s
filename = "pcm4";
else
filename = "pcm5";
- err = do_request_fw(dev, filename, &fw->pcm);
+ err = do_request_fw(dev, filename, &fw->pcm, false);
if (err)
goto err_load;
}
@@ -1605,7 +1630,7 @@ static void b43legacy_request_firmware(s
default:
goto err_no_initvals;
}
- err = do_request_fw(dev, filename, &fw->initvals);
+ err = do_request_fw(dev, filename, &fw->initvals, false);
if (err)
goto err_load;
}
@@ -1625,7 +1650,7 @@ static void b43legacy_request_firmware(s
default:
goto err_no_initvals;
}
- err = do_request_fw(dev, filename, &fw->initvals_band);
+ err = do_request_fw(dev, filename, &fw->initvals_band, false);
if (err)
goto err_load;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 14/80] b43: fix tx path skb leaks
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2013-01-09 20:35 ` [ 13/80] b43legacy: Fix firmware loading when driver is built into the kernel Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 15/80] pnpacpi: fix incorrect TEST_ALPHA() test Greg Kroah-Hartman
` (67 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Felix Fietkau, John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 78f18df4b323d2ac14d6c82e2fc3c8dc4556bccc upstream.
ieee80211_free_txskb() needs to be used instead of dev_kfree_skb_any for
tx packets passed to the driver from mac80211
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/b43/dma.c | 7 +++++--
drivers/net/wireless/b43/main.c | 12 ++++++++----
drivers/net/wireless/b43/pio.c | 4 ++--
3 files changed, 15 insertions(+), 8 deletions(-)
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -409,7 +409,10 @@ static inline
struct b43_dmadesc_meta *meta)
{
if (meta->skb) {
- dev_kfree_skb_any(meta->skb);
+ if (ring->tx)
+ ieee80211_free_txskb(ring->dev->wl->hw, meta->skb);
+ else
+ dev_kfree_skb_any(meta->skb);
meta->skb = NULL;
}
}
@@ -1454,7 +1457,7 @@ int b43_dma_tx(struct b43_wldev *dev, st
if (unlikely(err == -ENOKEY)) {
/* Drop this packet, as we don't have the encryption key
* anymore and must not transmit it unencrypted. */
- dev_kfree_skb_any(skb);
+ ieee80211_free_txskb(dev->wl->hw, skb);
err = 0;
goto out;
}
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3393,7 +3393,7 @@ static void b43_tx_work(struct work_stru
break;
}
if (unlikely(err))
- dev_kfree_skb(skb); /* Drop it */
+ ieee80211_free_txskb(wl->hw, skb);
err = 0;
}
@@ -3414,7 +3414,7 @@ static void b43_op_tx(struct ieee80211_h
if (unlikely(skb->len < 2 + 2 + 6)) {
/* Too short, this can't be a valid frame. */
- dev_kfree_skb_any(skb);
+ ieee80211_free_txskb(hw, skb);
return;
}
B43_WARN_ON(skb_shinfo(skb)->nr_frags);
@@ -4210,8 +4210,12 @@ redo:
/* Drain all TX queues. */
for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
- while (skb_queue_len(&wl->tx_queue[queue_num]))
- dev_kfree_skb(skb_dequeue(&wl->tx_queue[queue_num]));
+ while (skb_queue_len(&wl->tx_queue[queue_num])) {
+ struct sk_buff *skb;
+
+ skb = skb_dequeue(&wl->tx_queue[queue_num]);
+ ieee80211_free_txskb(wl->hw, skb);
+ }
}
b43_mac_suspend(dev);
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -196,7 +196,7 @@ static void b43_pio_cancel_tx_packets(st
for (i = 0; i < ARRAY_SIZE(q->packets); i++) {
pack = &(q->packets[i]);
if (pack->skb) {
- dev_kfree_skb_any(pack->skb);
+ ieee80211_free_txskb(q->dev->wl->hw, pack->skb);
pack->skb = NULL;
}
}
@@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, st
if (unlikely(err == -ENOKEY)) {
/* Drop this packet, as we don't have the encryption key
* anymore and must not transmit it unencrypted. */
- dev_kfree_skb_any(skb);
+ ieee80211_free_txskb(dev->wl->hw, skb);
err = 0;
goto out;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 15/80] pnpacpi: fix incorrect TEST_ALPHA() test
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2013-01-09 20:35 ` [ 14/80] b43: fix tx path skb leaks Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 16/80] SGI-XP: handle non-fatal traps Greg Kroah-Hartman
` (66 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Andrew Morton, Rafael J. Wysocki
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
commit cdc87c5a30f407ed1ce43d8a22261116873d5ef1 upstream.
TEST_ALPHA() is broken and always returns 0.
[akpm@linux-foundation.org: return false for '@' as well, per Bjorn]
Signed-off-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pnp/pnpacpi/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pnp/pnpacpi/core.c
+++ b/drivers/pnp/pnpacpi/core.c
@@ -58,7 +58,7 @@ static inline int __init is_exclusive_de
if (!(('0' <= (c) && (c) <= '9') || ('A' <= (c) && (c) <= 'F'))) \
return 0
#define TEST_ALPHA(c) \
- if (!('@' <= (c) || (c) <= 'Z')) \
+ if (!('A' <= (c) && (c) <= 'Z')) \
return 0
static int __init ispnpidacpi(const char *id)
{
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 16/80] SGI-XP: handle non-fatal traps
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2013-01-09 20:35 ` [ 15/80] pnpacpi: fix incorrect TEST_ALPHA() test Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 17/80] exec: do not leave bprm->interp on stack Greg Kroah-Hartman
` (65 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Robin Holt, Thomas Gleixner,
Ingo Molnar, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Holt <holt@sgi.com>
commit 891348ca0f66206f1dc0e30d63757e3df1ae2d15 upstream.
We found a user code which was raising a divide-by-zero trap. That trap
would lead to XPC connections between system-partitions being torn down
due to the die_chain notifier callouts it received.
This also revealed a different issue where multiple callers into
xpc_die_deactivate() would all attempt to do the disconnect in parallel
which would sometimes lock up but often overwhelm the console on very
large machines as each would print at least one line of output at the
end of the deactivate.
I reviewed all the users of the die_chain notifier and changed the code
to ignore the notifier callouts for reasons which will not actually lead
to a system to continue on to call die().
[akpm@linux-foundation.org: fix ia64]
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/sgi-xp/xpc_main.c | 34 ++++++++++++++++++++++++++++++++--
1 file changed, 32 insertions(+), 2 deletions(-)
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -53,6 +53,10 @@
#include <linux/kthread.h>
#include "xpc.h"
+#ifdef CONFIG_X86_64
+#include <asm/traps.h>
+#endif
+
/* define two XPC debug device structures to be used with dev_dbg() et al */
struct device_driver xpc_dbg_name = {
@@ -1079,6 +1083,9 @@ xpc_system_reboot(struct notifier_block
return NOTIFY_DONE;
}
+/* Used to only allow one cpu to complete disconnect */
+static unsigned int xpc_die_disconnecting;
+
/*
* Notify other partitions to deactivate from us by first disengaging from all
* references to our memory.
@@ -1092,6 +1099,9 @@ xpc_die_deactivate(void)
long keep_waiting;
long wait_to_print;
+ if (cmpxchg(&xpc_die_disconnecting, 0, 1))
+ return;
+
/* keep xpc_hb_checker thread from doing anything (just in case) */
xpc_exiting = 1;
@@ -1159,7 +1169,7 @@ xpc_die_deactivate(void)
* about the lack of a heartbeat.
*/
static int
-xpc_system_die(struct notifier_block *nb, unsigned long event, void *unused)
+xpc_system_die(struct notifier_block *nb, unsigned long event, void *_die_args)
{
#ifdef CONFIG_IA64 /* !!! temporary kludge */
switch (event) {
@@ -1191,7 +1201,27 @@ xpc_system_die(struct notifier_block *nb
break;
}
#else
- xpc_die_deactivate();
+ struct die_args *die_args = _die_args;
+
+ switch (event) {
+ case DIE_TRAP:
+ if (die_args->trapnr == X86_TRAP_DF)
+ xpc_die_deactivate();
+
+ if (((die_args->trapnr == X86_TRAP_MF) ||
+ (die_args->trapnr == X86_TRAP_XF)) &&
+ !user_mode_vm(die_args->regs))
+ xpc_die_deactivate();
+
+ break;
+ case DIE_INT3:
+ case DIE_DEBUG:
+ break;
+ case DIE_OOPS:
+ case DIE_GPF:
+ default:
+ xpc_die_deactivate();
+ }
#endif
return NOTIFY_DONE;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 17/80] exec: do not leave bprm->interp on stack
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2013-01-09 20:35 ` [ 16/80] SGI-XP: handle non-fatal traps Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 18/80] x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops Greg Kroah-Hartman
` (64 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Kees Cook, halfdog, P J P,
Alexander Viro, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit b66c5984017533316fd1951770302649baf1aa33 upstream.
If a series of scripts are executed, each triggering module loading via
unprintable bytes in the script header, kernel stack contents can leak
into the command line.
Normally execution of binfmt_script and binfmt_misc happens recursively.
However, when modules are enabled, and unprintable bytes exist in the
bprm->buf, execution will restart after attempting to load matching
binfmt modules. Unfortunately, the logic in binfmt_script and
binfmt_misc does not expect to get restarted. They leave bprm->interp
pointing to their local stack. This means on restart bprm->interp is
left pointing into unused stack memory which can then be copied into the
userspace argv areas.
After additional study, it seems that both recursion and restart remains
the desirable way to handle exec with scripts, misc, and modules. As
such, we need to protect the changes to interp.
This changes the logic to require allocation for any changes to the
bprm->interp. To avoid adding a new kmalloc to every exec, the default
value is left as-is. Only when passing through binfmt_script or
binfmt_misc does an allocation take place.
For a proof of concept, see DoTest.sh from:
http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: halfdog <me@halfdog.net>
Cc: P J P <ppandit@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/binfmt_misc.c | 5 ++++-
fs/binfmt_script.c | 4 +++-
fs/exec.c | 15 +++++++++++++++
include/linux/binfmts.h | 1 +
4 files changed, 23 insertions(+), 2 deletions(-)
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -176,7 +176,10 @@ static int load_misc_binary(struct linux
goto _error;
bprm->argc ++;
- bprm->interp = iname; /* for binfmt_script */
+ /* Update interp in case binfmt_script needs it. */
+ retval = bprm_change_interp(iname, bprm);
+ if (retval < 0)
+ goto _error;
interp_file = open_exec (iname);
retval = PTR_ERR (interp_file);
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -82,7 +82,9 @@ static int load_script(struct linux_binp
retval = copy_strings_kernel(1, &i_name, bprm);
if (retval) return retval;
bprm->argc++;
- bprm->interp = interp;
+ retval = bprm_change_interp(interp, bprm);
+ if (retval < 0)
+ return retval;
/*
* OK, now restart the process with the interpreter's dentry.
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1206,9 +1206,24 @@ void free_bprm(struct linux_binprm *bprm
mutex_unlock(¤t->signal->cred_guard_mutex);
abort_creds(bprm->cred);
}
+ /* If a binfmt changed the interp, free it. */
+ if (bprm->interp != bprm->filename)
+ kfree(bprm->interp);
kfree(bprm);
}
+int bprm_change_interp(char *interp, struct linux_binprm *bprm)
+{
+ /* If a binfmt changed the interp, free it first. */
+ if (bprm->interp != bprm->filename)
+ kfree(bprm->interp);
+ bprm->interp = kstrdup(interp, GFP_KERNEL);
+ if (!bprm->interp)
+ return -ENOMEM;
+ return 0;
+}
+EXPORT_SYMBOL(bprm_change_interp);
+
/*
* install the new credentials for this executable
*/
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -128,6 +128,7 @@ extern int setup_arg_pages(struct linux_
unsigned long stack_top,
int executable_stack);
extern int bprm_mm_init(struct linux_binprm *bprm);
+extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
extern int copy_strings_kernel(int argc, const char *const *argv,
struct linux_binprm *bprm);
extern int prepare_bprm_creds(struct linux_binprm *bprm);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 18/80] x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2013-01-09 20:35 ` [ 17/80] exec: do not leave bprm->interp on stack Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 19/80] virtio: force vring descriptors to be allocated from lowmem Greg Kroah-Hartman
` (63 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Ondrej Zary, Dmitry Torokhov,
Rafael J. Wysocki, H. Peter Anvin
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Zary <linux@rainbow-software.org>
commit ad68652412276f68ad4fe3e1ecf5ee6880876783 upstream.
Some MSI laptop BIOSes are broken - INT 15h code uses port 92h to enable A20
line but resume code assumes that KBC was used.
The laptop will not resume from S3 otherwise but powers off after a while
and then powers on again stuck with a blank screen.
Fix it by enabling A20 using KBC in i8042_platform_init for x86.
Fixes https://bugzilla.kernel.org/show_bug.cgi?id=12878
Signed-off-by: Ondrej Zary <linux@rainbow-software.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Link: http://lkml.kernel.org/r/201212112218.06551.linux@rainbow-software.org
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -921,6 +921,7 @@ static int __init i8042_platform_init(vo
int retval;
#ifdef CONFIG_X86
+ u8 a20_on = 0xdf;
/* Just return if pre-detection shows no i8042 controller exist */
if (!x86_platform.i8042_detect())
return -ENODEV;
@@ -960,6 +961,14 @@ static int __init i8042_platform_init(vo
if (dmi_check_system(i8042_dmi_dritek_table))
i8042_dritek = true;
+
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+ * resume from S3. So we do it here and hope that nothing breaks.
+ */
+ i8042_command(&a20_on, 0x10d1);
+ i8042_command(NULL, 0x00ff); /* Null command for SMM firmware */
#endif /* CONFIG_X86 */
return retval;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 19/80] virtio: force vring descriptors to be allocated from lowmem
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2013-01-09 20:35 ` [ 18/80] x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 20/80] mm: fix calculation of dirtyable memory Greg Kroah-Hartman
` (62 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Will Deacon, Sasha Levin, Rusty Russell
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit b92b1b89a33c172c075edccf6afb0edc41d851fd upstream.
Virtio devices may attempt to add descriptors to a virtqueue from atomic
context using GFP_ATOMIC allocation. This is problematic because such
allocations can fall outside of the lowmem mapping, causing virt_to_phys
to report bogus physical addresses which are subsequently passed to
userspace via the buffers for the virtual device.
This patch masks out __GFP_HIGH and __GFP_HIGHMEM from the requested
flags when allocating descriptors for a virtqueue. If an atomic
allocation is requested and later fails, we will return -ENOSPC which
will be handled by the driver.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio_ring.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -132,6 +132,13 @@ static int vring_add_indirect(struct vri
unsigned head;
int i;
+ /*
+ * We require lowmem mappings for the descriptors because
+ * otherwise virt_to_phys will give us bogus addresses in the
+ * virtqueue.
+ */
+ gfp &= ~(__GFP_HIGHMEM | __GFP_HIGH);
+
desc = kmalloc((out + in) * sizeof(struct vring_desc), gfp);
if (!desc)
return -ENOMEM;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 20/80] mm: fix calculation of dirtyable memory
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2013-01-09 20:35 ` [ 19/80] virtio: force vring descriptors to be allocated from lowmem Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 21/80] mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED Greg Kroah-Hartman
` (61 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sonny Rao, Puneet Kumar,
Johannes Weiner, Damien Wyart, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sonny Rao <sonnyrao@chromium.org>
commit c8b74c2f6604923de91f8aa6539f8bb934736754 upstream.
The system uses global_dirtyable_memory() to calculate number of
dirtyable pages/pages that can be allocated to the page cache. A bug
causes an underflow thus making the page count look like a big unsigned
number. This in turn confuses the dirty writeback throttling to
aggressively write back pages as they become dirty (usually 1 page at a
time). This generally only affects systems with highmem because the
underflowed count gets subtracted from the global count of dirtyable
memory.
The problem was introduced with v3.2-4896-gab8fabd
Fix is to ensure we don't get an underflowed total of either highmem or
global dirtyable memory.
Signed-off-by: Sonny Rao <sonnyrao@chromium.org>
Signed-off-by: Puneet Kumar <puneetster@chromium.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Tested-by: Damien Wyart <damien.wyart@free.fr>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page-writeback.c | 25 ++++++++++++++++++++-----
1 file changed, 20 insertions(+), 5 deletions(-)
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -187,6 +187,18 @@ static unsigned long highmem_dirtyable_m
zone_reclaimable_pages(z) - z->dirty_balance_reserve;
}
/*
+ * Unreclaimable memory (kernel memory or anonymous memory
+ * without swap) can bring down the dirtyable pages below
+ * the zone's dirty balance reserve and the above calculation
+ * will underflow. However we still want to add in nodes
+ * which are below threshold (negative values) to get a more
+ * accurate calculation but make sure that the total never
+ * underflows.
+ */
+ if ((long)x < 0)
+ x = 0;
+
+ /*
* Make sure that the number of highmem pages is never larger
* than the number of the total dirtyable memory. This can only
* occur in very strange VM situations but we want to make sure
@@ -208,8 +220,8 @@ unsigned long global_dirtyable_memory(vo
{
unsigned long x;
- x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages() -
- dirty_balance_reserve;
+ x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages();
+ x -= min(x, dirty_balance_reserve);
if (!vm_highmem_is_dirtyable)
x -= highmem_dirtyable_memory(x);
@@ -276,9 +288,12 @@ static unsigned long zone_dirtyable_memo
* highmem zone can hold its share of dirty pages, so we don't
* care about vm_highmem_is_dirtyable here.
*/
- return zone_page_state(zone, NR_FREE_PAGES) +
- zone_reclaimable_pages(zone) -
- zone->dirty_balance_reserve;
+ unsigned long nr_pages = zone_page_state(zone, NR_FREE_PAGES) +
+ zone_reclaimable_pages(zone);
+
+ /* don't allow this to underflow */
+ nr_pages -= min(nr_pages, zone->dirty_balance_reserve);
+ return nr_pages;
}
/**
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 21/80] mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2013-01-09 20:35 ` [ 20/80] mm: fix calculation of dirtyable memory Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 22/80] tmpfs mempolicy: fix /proc/mounts corrupting memory Greg Kroah-Hartman
` (60 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Christoffer Dall, Andrea Arcangeli,
Andrew Morton, Will Deacon, Steve Capper, Christoph Lameter,
Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <cdall@cs.columbia.edu>
commit ad4b3fb7ff9940bcdb1e4cd62bd189d10fa636ba upstream.
Unfortunately with !CONFIG_PAGEFLAGS_EXTENDED, (!PageHead) is false, and
(PageHead) is true, for tail pages. If this is indeed the intended
behavior, which I doubt because it breaks cache cleaning on some ARM
systems, then the nomenclature is highly problematic.
This patch makes sure PageHead is only true for head pages and PageTail
is only true for tail pages, and neither is true for non-compound pages.
[ This buglet seems ancient - seems to have been introduced back in Apr
2008 in commit 6a1e7f777f61: "pageflags: convert to the use of new
macros". And the reason nobody noticed is because the PageHead()
tests are almost all about just sanity-checking, and only used on
pages that are actual page heads. The fact that the old code returned
true for tail pages too was thus not really noticeable. - Linus ]
Signed-off-by: Christoffer Dall <cdall@cs.columbia.edu>
Acked-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Will Deacon <Will.Deacon@arm.com>
Cc: Steve Capper <Steve.Capper@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/page-flags.h | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -361,7 +361,7 @@ static inline void ClearPageCompound(str
* pages on the LRU and/or pagecache.
*/
TESTPAGEFLAG(Compound, compound)
-__PAGEFLAG(Head, compound)
+__SETPAGEFLAG(Head, compound) __CLEARPAGEFLAG(Head, compound)
/*
* PG_reclaim is used in combination with PG_compound to mark the
@@ -373,8 +373,14 @@ __PAGEFLAG(Head, compound)
* PG_compound & PG_reclaim => Tail page
* PG_compound & ~PG_reclaim => Head page
*/
+#define PG_head_mask ((1L << PG_compound))
#define PG_head_tail_mask ((1L << PG_compound) | (1L << PG_reclaim))
+static inline int PageHead(struct page *page)
+{
+ return ((page->flags & PG_head_tail_mask) == PG_head_mask);
+}
+
static inline int PageTail(struct page *page)
{
return ((page->flags & PG_head_tail_mask) == PG_head_tail_mask);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 22/80] tmpfs mempolicy: fix /proc/mounts corrupting memory
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2013-01-09 20:35 ` [ 21/80] mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 23/80] ALSA: usb-audio: Avoid autopm calls after disconnection Greg Kroah-Hartman
` (59 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Hugh Dickins, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit f2a07f40dbc603c15f8b06e6ec7f768af67b424f upstream.
Recently I suggested using "mount -o remount,mpol=local /tmp" in NUMA
mempolicy testing. Very nasty. Reading /proc/mounts, /proc/pid/mounts
or /proc/pid/mountinfo may then corrupt one bit of kernel memory, often
in a page table (causing "Bad swap" or "Bad page map" warning or "Bad
pagetable" oops), sometimes in a vm_area_struct or rbnode or somewhere
worse. "mpol=prefer" and "mpol=prefer:Node" are equally toxic.
Recent NUMA enhancements are not to blame: this dates back to 2.6.35,
when commit e17f74af351c "mempolicy: don't call mpol_set_nodemask() when
no_context" skipped mpol_parse_str()'s call to mpol_set_nodemask(),
which used to initialize v.preferred_node, or set MPOL_F_LOCAL in flags.
With slab poisoning, you can then rely on mpol_to_str() to set the bit
for node 0x6b6b, probably in the next page above the caller's stack.
mpol_parse_str() is only called from shmem_parse_options(): no_context
is always true, so call it unused for now, and remove !no_context code.
Set v.nodes or v.preferred_node or MPOL_F_LOCAL as mpol_to_str() might
expect. Then mpol_to_str() can ignore its no_context argument also,
the mpol being appropriately initialized whether contextualized or not.
Rename its no_context unused too, and let subsequent patch remove them
(that's not needed for stable backporting, which would involve rejects).
I don't understand why MPOL_LOCAL is described as a pseudo-policy:
it's a reasonable policy which suffers from a confusing implementation
in terms of MPOL_PREFERRED with MPOL_F_LOCAL. I believe this would be
much more robust if MPOL_LOCAL were recognized in switch statements
throughout, MPOL_F_LOCAL deleted, and MPOL_PREFERRED use the (possibly
empty) nodes mask like everyone else, instead of its preferred_node
variant (I presume an optimization from the days before MPOL_LOCAL).
But that would take me too long to get right and fully tested.
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempolicy.c | 64 +++++++++++++++++++++++----------------------------------
1 file changed, 26 insertions(+), 38 deletions(-)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2344,8 +2344,7 @@ void numa_default_policy(void)
*/
/*
- * "local" is pseudo-policy: MPOL_PREFERRED with MPOL_F_LOCAL flag
- * Used only for mpol_parse_str() and mpol_to_str()
+ * "local" is implemented internally by MPOL_PREFERRED with MPOL_F_LOCAL flag.
*/
#define MPOL_LOCAL MPOL_MAX
static const char * const policy_modes[] =
@@ -2360,28 +2359,21 @@ static const char * const policy_modes[]
#ifdef CONFIG_TMPFS
/**
- * mpol_parse_str - parse string to mempolicy
+ * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
* @str: string containing mempolicy to parse
* @mpol: pointer to struct mempolicy pointer, returned on success.
- * @no_context: flag whether to "contextualize" the mempolicy
+ * @unused: redundant argument, to be removed later.
*
* Format of input:
* <mode>[=<flags>][:<nodelist>]
*
- * if @no_context is true, save the input nodemask in w.user_nodemask in
- * the returned mempolicy. This will be used to "clone" the mempolicy in
- * a specific context [cpuset] at a later time. Used to parse tmpfs mpol
- * mount option. Note that if 'static' or 'relative' mode flags were
- * specified, the input nodemask will already have been saved. Saving
- * it again is redundant, but safe.
- *
* On success, returns 0, else 1
*/
-int mpol_parse_str(char *str, struct mempolicy **mpol, int no_context)
+int mpol_parse_str(char *str, struct mempolicy **mpol, int unused)
{
struct mempolicy *new = NULL;
unsigned short mode;
- unsigned short uninitialized_var(mode_flags);
+ unsigned short mode_flags;
nodemask_t nodes;
char *nodelist = strchr(str, ':');
char *flags = strchr(str, '=');
@@ -2469,24 +2461,23 @@ int mpol_parse_str(char *str, struct mem
if (IS_ERR(new))
goto out;
- if (no_context) {
- /* save for contextualization */
- new->w.user_nodemask = nodes;
- } else {
- int ret;
- NODEMASK_SCRATCH(scratch);
- if (scratch) {
- task_lock(current);
- ret = mpol_set_nodemask(new, &nodes, scratch);
- task_unlock(current);
- } else
- ret = -ENOMEM;
- NODEMASK_SCRATCH_FREE(scratch);
- if (ret) {
- mpol_put(new);
- goto out;
- }
- }
+ /*
+ * Save nodes for mpol_to_str() to show the tmpfs mount options
+ * for /proc/mounts, /proc/pid/mounts and /proc/pid/mountinfo.
+ */
+ if (mode != MPOL_PREFERRED)
+ new->v.nodes = nodes;
+ else if (nodelist)
+ new->v.preferred_node = first_node(nodes);
+ else
+ new->flags |= MPOL_F_LOCAL;
+
+ /*
+ * Save nodes for contextualization: this will be used to "clone"
+ * the mempolicy in a specific context [cpuset] at a later time.
+ */
+ new->w.user_nodemask = nodes;
+
err = 0;
out:
@@ -2506,13 +2497,13 @@ out:
* @buffer: to contain formatted mempolicy string
* @maxlen: length of @buffer
* @pol: pointer to mempolicy to be formatted
- * @no_context: "context free" mempolicy - use nodemask in w.user_nodemask
+ * @unused: redundant argument, to be removed later.
*
* Convert a mempolicy into a string.
* Returns the number of characters in buffer (if positive)
* or an error (negative)
*/
-int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context)
+int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int unused)
{
char *p = buffer;
int l;
@@ -2538,7 +2529,7 @@ int mpol_to_str(char *buffer, int maxlen
case MPOL_PREFERRED:
nodes_clear(nodes);
if (flags & MPOL_F_LOCAL)
- mode = MPOL_LOCAL; /* pseudo-policy */
+ mode = MPOL_LOCAL;
else
node_set(pol->v.preferred_node, nodes);
break;
@@ -2546,10 +2537,7 @@ int mpol_to_str(char *buffer, int maxlen
case MPOL_BIND:
/* Fall through */
case MPOL_INTERLEAVE:
- if (no_context)
- nodes = pol->w.user_nodemask;
- else
- nodes = pol->v.nodes;
+ nodes = pol->v.nodes;
break;
default:
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 23/80] ALSA: usb-audio: Avoid autopm calls after disconnection
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2013-01-09 20:35 ` [ 22/80] tmpfs mempolicy: fix /proc/mounts corrupting memory Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 24/80] ALSA: usb-audio: Fix missing autopm for MIDI input Greg Kroah-Hartman
` (58 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Clemens Ladisch, Takashi Iwai
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 59866da9e4ae54819e3c4e0a8f426bdb0c2ef993 upstream.
Add a similar protection against the disconnection race and the
invalid use of usb instance after disconnection, as well as we've done
for the USB audio PCM.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=51201
Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
Tested-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/midi.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -116,6 +116,7 @@ struct snd_usb_midi {
struct list_head list;
struct timer_list error_timer;
spinlock_t disc_lock;
+ struct rw_semaphore disc_rwsem;
struct mutex mutex;
u32 usb_id;
int next_midi_device;
@@ -1038,6 +1039,12 @@ static void substream_open(struct snd_ra
struct snd_usb_midi* umidi = substream->rmidi->private_data;
struct snd_kcontrol *ctl;
+ down_read(&umidi->disc_rwsem);
+ if (umidi->disconnected) {
+ up_read(&umidi->disc_rwsem);
+ return;
+ }
+
mutex_lock(&umidi->mutex);
if (open) {
if (umidi->opened++ == 0 && umidi->roland_load_ctl) {
@@ -1056,6 +1063,7 @@ static void substream_open(struct snd_ra
}
}
mutex_unlock(&umidi->mutex);
+ up_read(&umidi->disc_rwsem);
}
static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream)
@@ -1076,8 +1084,15 @@ static int snd_usbmidi_output_open(struc
snd_BUG();
return -ENXIO;
}
+
+ down_read(&umidi->disc_rwsem);
+ if (umidi->disconnected) {
+ up_read(&umidi->disc_rwsem);
+ return -ENODEV;
+ }
err = usb_autopm_get_interface(umidi->iface);
port->autopm_reference = err >= 0;
+ up_read(&umidi->disc_rwsem);
if (err < 0 && err != -EACCES)
return -EIO;
substream->runtime->private_data = port;
@@ -1092,8 +1107,10 @@ static int snd_usbmidi_output_close(stru
struct usbmidi_out_port *port = substream->runtime->private_data;
substream_open(substream, 0);
- if (port->autopm_reference)
+ down_read(&umidi->disc_rwsem);
+ if (!umidi->disconnected && port->autopm_reference)
usb_autopm_put_interface(umidi->iface);
+ up_read(&umidi->disc_rwsem);
return 0;
}
@@ -1403,9 +1420,12 @@ void snd_usbmidi_disconnect(struct list_
* a timer may submit an URB. To reliably break the cycle
* a flag under lock must be used
*/
+ down_write(&umidi->disc_rwsem);
spin_lock_irq(&umidi->disc_lock);
umidi->disconnected = 1;
spin_unlock_irq(&umidi->disc_lock);
+ up_write(&umidi->disc_rwsem);
+
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
struct snd_usb_midi_endpoint* ep = &umidi->endpoints[i];
if (ep->out)
@@ -2117,6 +2137,7 @@ int snd_usbmidi_create(struct snd_card *
umidi->usb_protocol_ops = &snd_usbmidi_standard_ops;
init_timer(&umidi->error_timer);
spin_lock_init(&umidi->disc_lock);
+ init_rwsem(&umidi->disc_rwsem);
mutex_init(&umidi->mutex);
umidi->usb_id = USB_ID(le16_to_cpu(umidi->dev->descriptor.idVendor),
le16_to_cpu(umidi->dev->descriptor.idProduct));
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 24/80] ALSA: usb-audio: Fix missing autopm for MIDI input
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2013-01-09 20:35 ` [ 23/80] ALSA: usb-audio: Avoid autopm calls after disconnection Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 25/80] ALSA: hda - Fix the wrong pincaps set in ALC861VD dallas/hp fixup Greg Kroah-Hartman
` (57 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Clemens Ladisch, Takashi Iwai
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit f5f165418cabf2218eb466c0e94693b8b1aee88b upstream.
The commit [88a8516a: ALSA: usbaudio: implement USB autosuspend] added
the support of autopm for USB MIDI output, but it didn't take the MIDI
input into account.
This patch adds the following for fixing the autopm:
- Manage the URB start at the first MIDI input stream open, instead of
the time of instance creation
- Move autopm code to the common substream_open()
- Make snd_usbmidi_input_start/_stop() more robust and add the running
state check
Reviewd-by: Clemens Ladisch <clemens@ladisch.de>
Tested-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/midi.c | 88 ++++++++++++++++++++++++++++---------------------------
1 file changed, 46 insertions(+), 42 deletions(-)
--- a/sound/usb/midi.c
+++ b/sound/usb/midi.c
@@ -126,8 +126,10 @@ struct snd_usb_midi {
struct snd_usb_midi_in_endpoint *in;
} endpoints[MIDI_MAX_ENDPOINTS];
unsigned long input_triggered;
- unsigned int opened;
+ bool autopm_reference;
+ unsigned int opened[2];
unsigned char disconnected;
+ unsigned char input_running;
struct snd_kcontrol *roland_load_ctl;
};
@@ -149,7 +151,6 @@ struct snd_usb_midi_out_endpoint {
struct snd_usb_midi_out_endpoint* ep;
struct snd_rawmidi_substream *substream;
int active;
- bool autopm_reference;
uint8_t cable; /* cable number << 4 */
uint8_t state;
#define STATE_UNKNOWN 0
@@ -1034,36 +1035,58 @@ static void update_roland_altsetting(str
snd_usbmidi_input_start(&umidi->list);
}
-static void substream_open(struct snd_rawmidi_substream *substream, int open)
+static int substream_open(struct snd_rawmidi_substream *substream, int dir,
+ int open)
{
struct snd_usb_midi* umidi = substream->rmidi->private_data;
struct snd_kcontrol *ctl;
+ int err;
down_read(&umidi->disc_rwsem);
if (umidi->disconnected) {
up_read(&umidi->disc_rwsem);
- return;
+ return open ? -ENODEV : 0;
}
mutex_lock(&umidi->mutex);
if (open) {
- if (umidi->opened++ == 0 && umidi->roland_load_ctl) {
- ctl = umidi->roland_load_ctl;
- ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
- snd_ctl_notify(umidi->card,
+ if (!umidi->opened[0] && !umidi->opened[1]) {
+ err = usb_autopm_get_interface(umidi->iface);
+ umidi->autopm_reference = err >= 0;
+ if (err < 0 && err != -EACCES) {
+ mutex_unlock(&umidi->mutex);
+ up_read(&umidi->disc_rwsem);
+ return -EIO;
+ }
+ if (umidi->roland_load_ctl) {
+ ctl = umidi->roland_load_ctl;
+ ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
+ snd_ctl_notify(umidi->card,
SNDRV_CTL_EVENT_MASK_INFO, &ctl->id);
- update_roland_altsetting(umidi);
+ update_roland_altsetting(umidi);
+ }
}
+ umidi->opened[dir]++;
+ if (umidi->opened[1])
+ snd_usbmidi_input_start(&umidi->list);
} else {
- if (--umidi->opened == 0 && umidi->roland_load_ctl) {
- ctl = umidi->roland_load_ctl;
- ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
- snd_ctl_notify(umidi->card,
+ umidi->opened[dir]--;
+ if (!umidi->opened[1])
+ snd_usbmidi_input_stop(&umidi->list);
+ if (!umidi->opened[0] && !umidi->opened[1]) {
+ if (umidi->roland_load_ctl) {
+ ctl = umidi->roland_load_ctl;
+ ctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_INACTIVE;
+ snd_ctl_notify(umidi->card,
SNDRV_CTL_EVENT_MASK_INFO, &ctl->id);
+ }
+ if (umidi->autopm_reference)
+ usb_autopm_put_interface(umidi->iface);
}
}
mutex_unlock(&umidi->mutex);
up_read(&umidi->disc_rwsem);
+ return 0;
}
static int snd_usbmidi_output_open(struct snd_rawmidi_substream *substream)
@@ -1071,7 +1094,6 @@ static int snd_usbmidi_output_open(struc
struct snd_usb_midi* umidi = substream->rmidi->private_data;
struct usbmidi_out_port* port = NULL;
int i, j;
- int err;
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
if (umidi->endpoints[i].out)
@@ -1085,33 +1107,14 @@ static int snd_usbmidi_output_open(struc
return -ENXIO;
}
- down_read(&umidi->disc_rwsem);
- if (umidi->disconnected) {
- up_read(&umidi->disc_rwsem);
- return -ENODEV;
- }
- err = usb_autopm_get_interface(umidi->iface);
- port->autopm_reference = err >= 0;
- up_read(&umidi->disc_rwsem);
- if (err < 0 && err != -EACCES)
- return -EIO;
substream->runtime->private_data = port;
port->state = STATE_UNKNOWN;
- substream_open(substream, 1);
- return 0;
+ return substream_open(substream, 0, 1);
}
static int snd_usbmidi_output_close(struct snd_rawmidi_substream *substream)
{
- struct snd_usb_midi* umidi = substream->rmidi->private_data;
- struct usbmidi_out_port *port = substream->runtime->private_data;
-
- substream_open(substream, 0);
- down_read(&umidi->disc_rwsem);
- if (!umidi->disconnected && port->autopm_reference)
- usb_autopm_put_interface(umidi->iface);
- up_read(&umidi->disc_rwsem);
- return 0;
+ return substream_open(substream, 0, 0);
}
static void snd_usbmidi_output_trigger(struct snd_rawmidi_substream *substream, int up)
@@ -1164,14 +1167,12 @@ static void snd_usbmidi_output_drain(str
static int snd_usbmidi_input_open(struct snd_rawmidi_substream *substream)
{
- substream_open(substream, 1);
- return 0;
+ return substream_open(substream, 1, 1);
}
static int snd_usbmidi_input_close(struct snd_rawmidi_substream *substream)
{
- substream_open(substream, 0);
- return 0;
+ return substream_open(substream, 1, 0);
}
static void snd_usbmidi_input_trigger(struct snd_rawmidi_substream *substream, int up)
@@ -2080,12 +2081,15 @@ void snd_usbmidi_input_stop(struct list_
unsigned int i, j;
umidi = list_entry(p, struct snd_usb_midi, list);
+ if (!umidi->input_running)
+ return;
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i) {
struct snd_usb_midi_endpoint* ep = &umidi->endpoints[i];
if (ep->in)
for (j = 0; j < INPUT_URBS; ++j)
usb_kill_urb(ep->in->urbs[j]);
}
+ umidi->input_running = 0;
}
static void snd_usbmidi_input_start_ep(struct snd_usb_midi_in_endpoint* ep)
@@ -2110,8 +2114,11 @@ void snd_usbmidi_input_start(struct list
int i;
umidi = list_entry(p, struct snd_usb_midi, list);
+ if (umidi->input_running || !umidi->opened[1])
+ return;
for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
+ umidi->input_running = 1;
}
/*
@@ -2250,9 +2257,6 @@ int snd_usbmidi_create(struct snd_card *
}
list_add_tail(&umidi->list, midi_list);
-
- for (i = 0; i < MIDI_MAX_ENDPOINTS; ++i)
- snd_usbmidi_input_start_ep(umidi->endpoints[i].in);
return 0;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 25/80] ALSA: hda - Fix the wrong pincaps set in ALC861VD dallas/hp fixup
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2013-01-09 20:35 ` [ 24/80] ALSA: usb-audio: Fix missing autopm for MIDI input Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 26/80] ALSA: hda - Fix pin configuration of HP Pavilion dv7 Greg Kroah-Hartman
` (56 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Takashi Iwai
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit b78562b10fa66175e30b76073e32a0ad8d92aa83 upstream.
The workaround to force VREF50 for dallas/hp model with ALC861VD
was introduced in commit 8fdcb6fe4204bdb4c6991652717ab5063751414e,
but it contained wrong pincap override bits.
This patch fixes to exclude VREF80 pincap bit correctly.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6520,8 +6520,8 @@ static void alc861vd_fixup_dallas(struct
const struct alc_fixup *fix, int action)
{
if (action == ALC_FIXUP_ACT_PRE_PROBE) {
- snd_hda_override_pin_caps(codec, 0x18, 0x00001714);
- snd_hda_override_pin_caps(codec, 0x19, 0x0000171c);
+ snd_hda_override_pin_caps(codec, 0x18, 0x00000734);
+ snd_hda_override_pin_caps(codec, 0x19, 0x0000073c);
}
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 26/80] ALSA: hda - Fix pin configuration of HP Pavilion dv7
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2013-01-09 20:35 ` [ 25/80] ALSA: hda - Fix the wrong pincaps set in ALC861VD dallas/hp fixup Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 27/80] rtlwifi: fix incorrect use of usb_alloc_coherent with usb_control_msg Greg Kroah-Hartman
` (55 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Takashi Iwai
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 8ae5865ec77c22462c736846a0679947a6953548 upstream.
Fix the quirk entry for HP Pavilion dv7 in order to make the bass
speaker working.
Reported-and-tested-by: Tomas Pospisek <tpo2@sourcepole.ch>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_sigmatel.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1695,7 +1695,7 @@ static const struct snd_pci_quirk stac92
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1658,
"HP", STAC_92HD83XXX_HP_cNB11_INTQUAD),
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1659,
- "HP", STAC_92HD83XXX_HP_cNB11_INTQUAD),
+ "HP Pavilion dv7", STAC_HP_DV7_4000),
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x165A,
"HP", STAC_92HD83XXX_HP_cNB11_INTQUAD),
SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x165B,
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 27/80] rtlwifi: fix incorrect use of usb_alloc_coherent with usb_control_msg
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2013-01-09 20:35 ` [ 26/80] ALSA: hda - Fix pin configuration of HP Pavilion dv7 Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 28/80] p54usb: add USB ID for T-Com Sinus 154 data II Greg Kroah-Hartman
` (54 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Jussi Kivilinna, Larry Finger,
John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
commit 4c3de5920c486b8eefa6187ee6a181864c161100 upstream.
Incorrect use of usb_alloc_coherent memory as input buffer to usb_control_msg
can cause problems in arch DMA code, for example kernel BUG at
'arch/arm/include/asm/dma-mapping.h:321' on ARM (linux-3.4).
Change _usb_writeN_sync use kmalloc'd buffer instead.
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/usb.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -210,17 +210,16 @@ static void _usb_writeN_sync(struct rtl_
u16 index = REALTEK_USB_VENQT_CMD_IDX;
int pipe = usb_sndctrlpipe(udev, 0); /* write_out */
u8 *buffer;
- dma_addr_t dma_addr;
- wvalue = (u16)(addr&0x0000ffff);
- buffer = usb_alloc_coherent(udev, (size_t)len, GFP_ATOMIC, &dma_addr);
+ wvalue = (u16)(addr & 0x0000ffff);
+ buffer = kmalloc(len, GFP_ATOMIC);
if (!buffer)
return;
memcpy(buffer, data, len);
usb_control_msg(udev, pipe, request, reqtype, wvalue,
index, buffer, len, 50);
- usb_free_coherent(udev, (size_t)len, buffer, dma_addr);
+ kfree(buffer);
}
static void _rtl_usb_io_handler_init(struct device *dev,
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 28/80] p54usb: add USB ID for T-Com Sinus 154 data II
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2013-01-09 20:35 ` [ 27/80] rtlwifi: fix incorrect use of usb_alloc_coherent with usb_control_msg Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 29/80] p54usb: add USBIDs for two more p54usb devices Greg Kroah-Hartman
` (53 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tomasz Guszkowski, Christian Lamparter,
John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Guszkowski <tsg@o2.pl>
commit 3194b7fcdf6caea338b5d2c72d76fed80437649c upstream.
Added USB ID for T-Com Sinus 154 data II.
Signed-off-by: Tomasz Guszkowski <tsg@o2.pl>
Acked-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/p54/p54usb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -82,6 +82,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x06a9, 0x000e)}, /* Westell 802.11g USB (A90-211WG-01) */
{USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
{USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
+ {USB_DEVICE(0x083a, 0x4503)}, /* T-Com Sinus 154 data II */
{USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
{USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */
{USB_DEVICE(0x083a, 0xf503)}, /* Accton FD7050E ver 1010ec */
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 29/80] p54usb: add USBIDs for two more p54usb devices
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2013-01-09 20:35 ` [ 28/80] p54usb: add USB ID for T-Com Sinus 154 data II Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 30/80] usb: gadget: midi: free hs descriptors Greg Kroah-Hartman
` (52 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Christian Lamparter, John W. Linville
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <chunkeey@googlemail.com>
commit 4010fe21a315b4223c25376714c6a2b61b722e5c upstream.
This patch adds USBIDs for:
- DrayTek Vigor 530
- Zoom 4410a
It also adds a note about Gemtek WUBI-100GW
and SparkLAN WL-682 USBID conflict [WUBI-100GW
is a ISL3886+NET2280 (LM86 firmare) solution,
whereas WL-682 is a ISL3887 (LM87 firmware)]
device.
Source: <http://www.wikidevi.com/wiki/Intersil/p54/usb/windows>
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/p54/p54usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -47,6 +47,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x0411, 0x0050)}, /* Buffalo WLI2-USB2-G54 */
{USB_DEVICE(0x045e, 0x00c2)}, /* Microsoft MN-710 */
{USB_DEVICE(0x0506, 0x0a11)}, /* 3COM 3CRWE254G72 */
+ {USB_DEVICE(0x0675, 0x0530)}, /* DrayTek Vigor 530 */
{USB_DEVICE(0x06b9, 0x0120)}, /* Thomson SpeedTouch 120g */
{USB_DEVICE(0x0707, 0xee06)}, /* SMC 2862W-G */
{USB_DEVICE(0x07aa, 0x001c)}, /* Corega CG-WLUSB2GT */
@@ -82,6 +83,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x06a9, 0x000e)}, /* Westell 802.11g USB (A90-211WG-01) */
{USB_DEVICE(0x06b9, 0x0121)}, /* Thomson SpeedTouch 121g */
{USB_DEVICE(0x0707, 0xee13)}, /* SMC 2862W-G version 2 */
+ {USB_DEVICE(0x0803, 0x4310)}, /* Zoom 4410a */
{USB_DEVICE(0x083a, 0x4503)}, /* T-Com Sinus 154 data II */
{USB_DEVICE(0x083a, 0x4521)}, /* Siemens Gigaset USB Adapter 54 version 2 */
{USB_DEVICE(0x083a, 0xc501)}, /* Zoom Wireless-G 4410 */
@@ -102,6 +104,7 @@ static struct usb_device_id p54u_table[]
{USB_DEVICE(0x13B1, 0x000C)}, /* Linksys WUSB54AG */
{USB_DEVICE(0x1413, 0x5400)}, /* Telsey 802.11g USB2.0 Adapter */
{USB_DEVICE(0x1435, 0x0427)}, /* Inventel UR054G */
+ /* {USB_DEVICE(0x15a9, 0x0002)}, * Also SparkLAN WL-682 with 3887 */
{USB_DEVICE(0x1668, 0x1050)}, /* Actiontec 802UIG-1 */
{USB_DEVICE(0x1740, 0x1000)}, /* Senao NUB-350 */
{USB_DEVICE(0x2001, 0x3704)}, /* DLink DWL-G122 rev A2 */
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 30/80] usb: gadget: midi: free hs descriptors
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2013-01-09 20:35 ` [ 29/80] p54usb: add USBIDs for two more p54usb devices Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 31/80] usb: gadget: phonet: free requests in pn_bind()s error path Greg Kroah-Hartman
` (51 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sebastian Andrzej Siewior, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit d185039f7982eb82cf8d03b6fb6689587ca5af24 upstream.
The HS descriptors are only created if HS is supported by the UDC but we
never free them.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/f_midi.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/gadget/f_midi.c
+++ b/drivers/usb/gadget/f_midi.c
@@ -416,6 +416,7 @@ static void f_midi_unbind(struct usb_con
midi->id = NULL;
usb_free_descriptors(f->descriptors);
+ usb_free_descriptors(f->hs_descriptors);
kfree(midi);
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 31/80] usb: gadget: phonet: free requests in pn_bind()s error path
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2013-01-09 20:35 ` [ 30/80] usb: gadget: midi: free hs descriptors Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 32/80] usb: gadget: uvc: fix error path in uvc_function_bind() Greg Kroah-Hartman
` (50 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sebastian Andrzej Siewior, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd upstream.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/f_phonet.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -531,7 +531,7 @@ int pn_bind(struct usb_configuration *c,
req = usb_ep_alloc_request(fp->out_ep, GFP_KERNEL);
if (!req)
- goto err;
+ goto err_req;
req->complete = pn_rx_complete;
fp->out_reqv[i] = req;
@@ -540,14 +540,18 @@ int pn_bind(struct usb_configuration *c,
/* Outgoing USB requests */
fp->in_req = usb_ep_alloc_request(fp->in_ep, GFP_KERNEL);
if (!fp->in_req)
- goto err;
+ goto err_req;
INFO(cdev, "USB CDC Phonet function\n");
INFO(cdev, "using %s, OUT %s, IN %s\n", cdev->gadget->name,
fp->out_ep->name, fp->in_ep->name);
return 0;
+err_req:
+ for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
+ usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
err:
+
if (fp->out_ep)
fp->out_ep->driver_data = NULL;
if (fp->in_ep)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 32/80] usb: gadget: uvc: fix error path in uvc_function_bind()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2013-01-09 20:35 ` [ 31/80] usb: gadget: phonet: free requests in pn_bind()s error path Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 33/80] usb: gadget: network: fix bind() error path Greg Kroah-Hartman
` (49 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sebastian Andrzej Siewior,
Laurent Pinchart, Bhupesh Sharma, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 0f9df939385527049c8062a099fbfa1479fe7ce0 upstream.
The "video->minor = -1" assigment is done in V4L2 by
video_register_device() so it is removed here.
Now. uvc_function_bind() calls in error case uvc_function_unbind() for
cleanup. The problem is that uvc_function_unbind() frees the uvc struct
and uvc_bind_config() does as well in error case of usb_add_function().
Removing kfree() in usb_add_function() would make the patch smaller but
it would look odd because the new allocated memory is not cleaned up.
However it is not guaranteed that if we call usb_add_function() we also
get to the bind function.
Therefore the patch extracts the conditional cleanup from
uvc_function_unbind() applies to uvc_function_bind().
uvc_function_unbind() now contains only the complete cleanup which is
required once everything has been registrated.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Cc: Bhupesh Sharma <bhupesh.sharma@st.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/f_uvc.c | 39 +++++++++++++++++++++------------------
1 file changed, 21 insertions(+), 18 deletions(-)
--- a/drivers/usb/gadget/f_uvc.c
+++ b/drivers/usb/gadget/f_uvc.c
@@ -335,7 +335,6 @@ uvc_register_video(struct uvc_device *uv
return -ENOMEM;
video->parent = &cdev->gadget->dev;
- video->minor = -1;
video->fops = &uvc_v4l2_fops;
video->release = video_device_release;
strncpy(video->name, cdev->gadget->name, sizeof(video->name));
@@ -462,23 +461,12 @@ uvc_function_unbind(struct usb_configura
INFO(cdev, "uvc_function_unbind\n");
- if (uvc->vdev) {
- if (uvc->vdev->minor == -1)
- video_device_release(uvc->vdev);
- else
- video_unregister_device(uvc->vdev);
- uvc->vdev = NULL;
- }
-
- if (uvc->control_ep)
- uvc->control_ep->driver_data = NULL;
- if (uvc->video.ep)
- uvc->video.ep->driver_data = NULL;
+ video_unregister_device(uvc->vdev);
+ uvc->control_ep->driver_data = NULL;
+ uvc->video.ep->driver_data = NULL;
- if (uvc->control_req) {
- usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
- kfree(uvc->control_buf);
- }
+ usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ kfree(uvc->control_buf);
kfree(f->descriptors);
kfree(f->hs_descriptors);
@@ -563,7 +551,22 @@ uvc_function_bind(struct usb_configurati
return 0;
error:
- uvc_function_unbind(c, f);
+ if (uvc->vdev)
+ video_device_release(uvc->vdev);
+
+ if (uvc->control_ep)
+ uvc->control_ep->driver_data = NULL;
+ if (uvc->video.ep)
+ uvc->video.ep->driver_data = NULL;
+
+ if (uvc->control_req) {
+ usb_ep_free_request(cdev->gadget->ep0, uvc->control_req);
+ kfree(uvc->control_buf);
+ }
+
+ kfree(f->descriptors);
+ kfree(f->hs_descriptors);
+ kfree(f->ss_descriptors);
return ret;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 33/80] usb: gadget: network: fix bind() error path
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2013-01-09 20:35 ` [ 32/80] usb: gadget: uvc: fix error path in uvc_function_bind() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 34/80] ACPI: do acpisleep dmi check when CONFIG_ACPI_SLEEP is set Greg Kroah-Hartman
` (48 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sebastian Andrzej Siewior,
Tatyana Brokhman, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit e79cc615a9bb44da72c499ccfa2c9c4bbea3aa84 upstream.
I think this is wrong since 72c973dd ("usb: gadget: add
usb_endpoint_descriptor to struct usb_ep"). If we fail to allocate an ep
or bail out early we shouldn't check for the descriptor which is
assigned at ep_enable() time.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Tatyana Brokhman <tlinder@codeaurora.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/f_ecm.c | 4 ++--
drivers/usb/gadget/f_eem.c | 5 ++---
drivers/usb/gadget/f_ncm.c | 4 ++--
drivers/usb/gadget/f_rndis.c | 4 ++--
drivers/usb/gadget/f_subset.c | 4 ++--
5 files changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/usb/gadget/f_ecm.c
+++ b/drivers/usb/gadget/f_ecm.c
@@ -808,9 +808,9 @@ fail:
/* we might as well release our claims on endpoints */
if (ecm->notify)
ecm->notify->driver_data = NULL;
- if (ecm->port.out_ep->desc)
+ if (ecm->port.out_ep)
ecm->port.out_ep->driver_data = NULL;
- if (ecm->port.in_ep->desc)
+ if (ecm->port.in_ep)
ecm->port.in_ep->driver_data = NULL;
ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -319,10 +319,9 @@ fail:
if (f->hs_descriptors)
usb_free_descriptors(f->hs_descriptors);
- /* we might as well release our claims on endpoints */
- if (eem->port.out_ep->desc)
+ if (eem->port.out_ep)
eem->port.out_ep->driver_data = NULL;
- if (eem->port.in_ep->desc)
+ if (eem->port.in_ep)
eem->port.in_ep->driver_data = NULL;
ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
--- a/drivers/usb/gadget/f_ncm.c
+++ b/drivers/usb/gadget/f_ncm.c
@@ -1259,9 +1259,9 @@ fail:
/* we might as well release our claims on endpoints */
if (ncm->notify)
ncm->notify->driver_data = NULL;
- if (ncm->port.out_ep->desc)
+ if (ncm->port.out_ep)
ncm->port.out_ep->driver_data = NULL;
- if (ncm->port.in_ep->desc)
+ if (ncm->port.in_ep)
ncm->port.in_ep->driver_data = NULL;
ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
--- a/drivers/usb/gadget/f_rndis.c
+++ b/drivers/usb/gadget/f_rndis.c
@@ -803,9 +803,9 @@ fail:
/* we might as well release our claims on endpoints */
if (rndis->notify)
rndis->notify->driver_data = NULL;
- if (rndis->port.out_ep->desc)
+ if (rndis->port.out_ep)
rndis->port.out_ep->driver_data = NULL;
- if (rndis->port.in_ep->desc)
+ if (rndis->port.in_ep)
rndis->port.in_ep->driver_data = NULL;
ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
--- a/drivers/usb/gadget/f_subset.c
+++ b/drivers/usb/gadget/f_subset.c
@@ -370,9 +370,9 @@ fail:
usb_free_descriptors(f->hs_descriptors);
/* we might as well release our claims on endpoints */
- if (geth->port.out_ep->desc)
+ if (geth->port.out_ep)
geth->port.out_ep->driver_data = NULL;
- if (geth->port.in_ep->desc)
+ if (geth->port.in_ep)
geth->port.in_ep->driver_data = NULL;
ERROR(cdev, "%s: can't bind, err %d\n", f->name, status);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 34/80] ACPI: do acpisleep dmi check when CONFIG_ACPI_SLEEP is set
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2013-01-09 20:35 ` [ 33/80] usb: gadget: network: fix bind() error path Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 35/80] ACPI / scan: Do not use dummy HID for system bus ACPI nodes Greg Kroah-Hartman
` (47 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Zhang Rui, Rafael J. Wysocki
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <rui.zhang@intel.com>
commit 0ac1b1d7b7424cd6f129b5454b504b3cae746f0e upstream.
The current acpisleep DMI checks only run when CONFIG_SUSPEND is set.
And this may break hibernation on some platforms when CONFIG_SUSPEND
is cleared.
Move acpisleep DMI check into #ifdef CONFIG_ACPI_SLEEP instead.
[rjw: Added acpi_sleep_dmi_check() and rebased on top of earlier
patches adding entries to acpisleep_dmi_table[].]
References: https://bugzilla.kernel.org/show_bug.cgi?id=45921
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/sleep.c | 348 +++++++++++++++++++++++++--------------------------
1 file changed, 177 insertions(+), 171 deletions(-)
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -138,6 +138,180 @@ void __init acpi_old_suspend_ordering(vo
old_suspend_ordering = true;
}
+static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
+{
+ acpi_old_suspend_ordering();
+ return 0;
+}
+
+static int __init init_nvs_nosave(const struct dmi_system_id *d)
+{
+ acpi_nvs_nosave();
+ return 0;
+}
+
+static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Abit KN9 (nForce4 variant)",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "http://www.abit.com.tw/"),
+ DMI_MATCH(DMI_BOARD_NAME, "KN9 Series(NF-CK804)"),
+ },
+ },
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "HP xw4600 Workstation",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP xw4600 Workstation"),
+ },
+ },
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Asus Pundit P1-AH2 (M2N8L motherboard)",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "M2N8L"),
+ },
+ },
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Panasonic CF51-2L",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR,
+ "Matsushita Electric Industrial Co.,Ltd."),
+ DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-FW21E",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW21E"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VPCEB17FX",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB17FX"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-SR11M",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Everex StepNote Series",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VPCEB1Z1E",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB1Z1E"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-NW130D",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-NW130D"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VPCCW29FX",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Averatec AV1020-ED2",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "1000 Series"),
+ },
+ },
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Asus A8N-SLI DELUXE",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "A8N-SLI DELUXE"),
+ },
+ },
+ {
+ .callback = init_old_suspend_ordering,
+ .ident = "Asus A8N-SLI Premium",
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "A8N-SLI Premium"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-SR26GN_P",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR26GN_P"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VPCEB1S1E",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB1S1E"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Sony Vaio VGN-FW520F",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW520F"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Asus K54C",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "K54C"),
+ },
+ },
+ {
+ .callback = init_nvs_nosave,
+ .ident = "Asus K54HR",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+ DMI_MATCH(DMI_PRODUCT_NAME, "K54HR"),
+ },
+ },
+ {},
+};
+
+static void acpi_sleep_dmi_check(void)
+{
+ dmi_check_system(acpisleep_dmi_table);
+}
+
/**
* acpi_pm_freeze - Disable the GPEs and suspend EC transactions.
*/
@@ -227,6 +401,7 @@ static void acpi_pm_end(void)
}
#else /* !CONFIG_ACPI_SLEEP */
#define acpi_target_sleep_state ACPI_STATE_S0
+static inline void acpi_sleep_dmi_check(void) {}
#endif /* CONFIG_ACPI_SLEEP */
#ifdef CONFIG_SUSPEND
@@ -371,175 +546,6 @@ static const struct platform_suspend_ops
.end = acpi_pm_end,
.recover = acpi_pm_finish,
};
-
-static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
-{
- old_suspend_ordering = true;
- return 0;
-}
-
-static int __init init_nvs_nosave(const struct dmi_system_id *d)
-{
- acpi_nvs_nosave();
- return 0;
-}
-
-static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
- {
- .callback = init_old_suspend_ordering,
- .ident = "Abit KN9 (nForce4 variant)",
- .matches = {
- DMI_MATCH(DMI_BOARD_VENDOR, "http://www.abit.com.tw/"),
- DMI_MATCH(DMI_BOARD_NAME, "KN9 Series(NF-CK804)"),
- },
- },
- {
- .callback = init_old_suspend_ordering,
- .ident = "HP xw4600 Workstation",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
- DMI_MATCH(DMI_PRODUCT_NAME, "HP xw4600 Workstation"),
- },
- },
- {
- .callback = init_old_suspend_ordering,
- .ident = "Asus Pundit P1-AH2 (M2N8L motherboard)",
- .matches = {
- DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTek Computer INC."),
- DMI_MATCH(DMI_BOARD_NAME, "M2N8L"),
- },
- },
- {
- .callback = init_old_suspend_ordering,
- .ident = "Panasonic CF51-2L",
- .matches = {
- DMI_MATCH(DMI_BOARD_VENDOR,
- "Matsushita Electric Industrial Co.,Ltd."),
- DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VGN-FW21E",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW21E"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VPCEB17FX",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB17FX"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VGN-SR11M",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Everex StepNote Series",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
- DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VPCEB1Z1E",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB1Z1E"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VGN-NW130D",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-NW130D"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VPCCW29FX",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VPCCW29FX"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Averatec AV1020-ED2",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "AVERATEC"),
- DMI_MATCH(DMI_PRODUCT_NAME, "1000 Series"),
- },
- },
- {
- .callback = init_old_suspend_ordering,
- .ident = "Asus A8N-SLI DELUXE",
- .matches = {
- DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
- DMI_MATCH(DMI_BOARD_NAME, "A8N-SLI DELUXE"),
- },
- },
- {
- .callback = init_old_suspend_ordering,
- .ident = "Asus A8N-SLI Premium",
- .matches = {
- DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
- DMI_MATCH(DMI_BOARD_NAME, "A8N-SLI Premium"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VGN-SR26GN_P",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR26GN_P"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VPCEB1S1E",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VPCEB1S1E"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Sony Vaio VGN-FW520F",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
- DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FW520F"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Asus K54C",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
- DMI_MATCH(DMI_PRODUCT_NAME, "K54C"),
- },
- },
- {
- .callback = init_nvs_nosave,
- .ident = "Asus K54HR",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
- DMI_MATCH(DMI_PRODUCT_NAME, "K54HR"),
- },
- },
- {},
-};
#endif /* CONFIG_SUSPEND */
#ifdef CONFIG_HIBERNATION
@@ -880,13 +886,13 @@ int __init acpi_sleep_init(void)
u8 type_a, type_b;
#ifdef CONFIG_SUSPEND
int i = 0;
-
- dmi_check_system(acpisleep_dmi_table);
#endif
if (acpi_disabled)
return 0;
+ acpi_sleep_dmi_check();
+
sleep_states[ACPI_STATE_S0] = 1;
printk(KERN_INFO PREFIX "(supports S0");
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 35/80] ACPI / scan: Do not use dummy HID for system bus ACPI nodes
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2013-01-09 20:35 ` [ 34/80] ACPI: do acpisleep dmi check when CONFIG_ACPI_SLEEP is set Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 36/80] NFS: Add sequence_priviliged_ops for nfs4_proc_sequence() Greg Kroah-Hartman
` (46 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Rafael J. Wysocki
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 4f5f64cf0cc916220aaa055992e31195470cfe37 upstream.
At one point acpi_device_set_id() checks if acpi_device_hid(device)
returns NULL, but that never happens, so system bus devices with an
empty list of PNP IDs are given the dummy HID ("device") instead of
the "system bus HID" ("LNXSYBUS"). Fix the code to use the right
check.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/scan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1157,7 +1157,7 @@ static void acpi_device_set_id(struct ac
acpi_add_id(device, ACPI_DOCK_HID);
else if (!acpi_ibm_smbus_match(device))
acpi_add_id(device, ACPI_SMBUS_IBM_HID);
- else if (!acpi_device_hid(device) &&
+ else if (list_empty(&device->pnp.ids) &&
ACPI_IS_ROOT_DEVICE(device->parent)) {
acpi_add_id(device, ACPI_BUS_HID); /* \_SB, LNXSYBUS */
strcpy(device->pnp.device_name, ACPI_BUS_DEVICE_NAME);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 36/80] NFS: Add sequence_priviliged_ops for nfs4_proc_sequence()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2013-01-09 20:35 ` [ 35/80] ACPI / scan: Do not use dummy HID for system bus ACPI nodes Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 37/80] NFS: avoid NULL dereference in nfs_destroy_server Greg Kroah-Hartman
` (45 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Bryan Schumaker, Trond Myklebust
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan Schumaker <bjschuma@netapp.com>
commit 6bdb5f213c4344324f600dde885f25768fbd14db upstream.
If I mount an NFS v4.1 server to a single client multiple times and then
run xfstests over each mountpoint I usually get the client into a state
where recovery deadlocks. The server informs the client of a
cb_path_down sequence error, the client then does a
bind_connection_to_session and checks the status of the lease.
I found that bind_connection_to_session sets the NFS4_SESSION_DRAINING
flag on the client, but this flag is never unset before
nfs4_check_lease() reaches nfs4_proc_sequence(). This causes the client
to deadlock, halting all NFS activity to the server. nfs4_proc_sequence()
is only called by the state manager, so I can change it to run in privileged
mode to bypass the NFS4_SESSION_DRAINING check and avoid the deadlock.
Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5739,13 +5739,26 @@ static void nfs41_sequence_prepare(struc
rpc_call_start(task);
}
+static void nfs41_sequence_prepare_privileged(struct rpc_task *task, void *data)
+{
+ rpc_task_set_priority(task, RPC_PRIORITY_PRIVILEGED);
+ nfs41_sequence_prepare(task, data);
+}
+
static const struct rpc_call_ops nfs41_sequence_ops = {
.rpc_call_done = nfs41_sequence_call_done,
.rpc_call_prepare = nfs41_sequence_prepare,
.rpc_release = nfs41_sequence_release,
};
-static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred)
+static const struct rpc_call_ops nfs41_sequence_privileged_ops = {
+ .rpc_call_done = nfs41_sequence_call_done,
+ .rpc_call_prepare = nfs41_sequence_prepare_privileged,
+ .rpc_release = nfs41_sequence_release,
+};
+
+static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred,
+ const struct rpc_call_ops *seq_ops)
{
struct nfs4_sequence_data *calldata;
struct rpc_message msg = {
@@ -5755,7 +5768,7 @@ static struct rpc_task *_nfs41_proc_sequ
struct rpc_task_setup task_setup_data = {
.rpc_client = clp->cl_rpcclient,
.rpc_message = &msg,
- .callback_ops = &nfs41_sequence_ops,
+ .callback_ops = seq_ops,
.flags = RPC_TASK_ASYNC | RPC_TASK_SOFT,
};
@@ -5782,7 +5795,7 @@ static int nfs41_proc_async_sequence(str
if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
return 0;
- task = _nfs41_proc_sequence(clp, cred);
+ task = _nfs41_proc_sequence(clp, cred, &nfs41_sequence_ops);
if (IS_ERR(task))
ret = PTR_ERR(task);
else
@@ -5796,7 +5809,7 @@ static int nfs4_proc_sequence(struct nfs
struct rpc_task *task;
int ret;
- task = _nfs41_proc_sequence(clp, cred);
+ task = _nfs41_proc_sequence(clp, cred, &nfs41_sequence_privileged_ops);
if (IS_ERR(task)) {
ret = PTR_ERR(task);
goto out;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 37/80] NFS: avoid NULL dereference in nfs_destroy_server
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2013-01-09 20:35 ` [ 36/80] NFS: Add sequence_priviliged_ops for nfs4_proc_sequence() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 38/80] NFS: Fix calls to drop_nlink() Greg Kroah-Hartman
` (44 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, NeilBrown, Trond Myklebust
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit f259613a1e4b44a0cf85a5dafd931be96ee7c9e5 upstream.
In rare circumstances, nfs_clone_server() of a v2 or v3 server can get
an error between setting server->destory (to nfs_destroy_server), and
calling nfs_start_lockd (which will set server->nlm_host).
If this happens, nfs_clone_server will call nfs_free_server which
will call nfs_destroy_server and thence nlmclnt_done(NULL). This
causes the NULL to be dereferenced.
So add a guard to only call nlmclnt_done() if ->nlm_host is not NULL.
The other guards there are irrelevant as nlm_host can only be non-NULL
if one of these flags are set - so remove those tests. (Thanks to Trond
for this suggestion).
This is suitable for any stable kernel since 2.6.25.
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/client.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -694,8 +694,7 @@ static int nfs_create_rpc_client(struct
*/
static void nfs_destroy_server(struct nfs_server *server)
{
- if (!(server->flags & NFS_MOUNT_LOCAL_FLOCK) ||
- !(server->flags & NFS_MOUNT_LOCAL_FCNTL))
+ if (server->nlm_host)
nlmclnt_done(server->nlm_host);
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 38/80] NFS: Fix calls to drop_nlink()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2013-01-09 20:35 ` [ 37/80] NFS: avoid NULL dereference in nfs_destroy_server Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 39/80] nfs: fix wrong object type in lockowner_slab Greg Kroah-Hartman
` (43 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Trond Myklebust
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <Trond.Myklebust@netapp.com>
commit 1f018458b30b0d5c535c94e577aa0acbb92e1395 upstream.
It is almost always wrong for NFS to call drop_nlink() after removing a
file. What we really want is to mark the inode's attributes for
revalidation, and we want to ensure that the VFS drops it if we're
reasonably sure that this is the final unlink().
Do the former using the usual cache validity flags, and the latter
by testing if inode->i_nlink == 1, and clearing it in that case.
This also fixes the following warning reported by Neil Brown and
Jeff Layton (among others).
[634155.004438] WARNING:
at /home/abuild/rpmbuild/BUILD/kernel-desktop-3.5.0/lin [634155.004442]
Hardware name: Latitude E6510 [634155.004577] crc_itu_t crc32c_intel
snd_hwdep snd_pcm snd_timer snd soundcor [634155.004609] Pid: 13402, comm:
bash Tainted: G W 3.5.0-36-desktop # [634155.004611] Call Trace:
[634155.004630] [<ffffffff8100444a>] dump_trace+0xaa/0x2b0
[634155.004641] [<ffffffff815a23dc>] dump_stack+0x69/0x6f
[634155.004653] [<ffffffff81041a0b>] warn_slowpath_common+0x7b/0xc0
[634155.004662] [<ffffffff811832e4>] drop_nlink+0x34/0x40
[634155.004687] [<ffffffffa05bb6c3>] nfs_dentry_iput+0x33/0x70 [nfs]
[634155.004714] [<ffffffff8118049e>] dput+0x12e/0x230
[634155.004726] [<ffffffff8116b230>] __fput+0x170/0x230
[634155.004735] [<ffffffff81167c0f>] filp_close+0x5f/0x90
[634155.004743] [<ffffffff81167cd7>] sys_close+0x97/0x100
[634155.004754] [<ffffffff815c3b39>] system_call_fastpath+0x16/0x1b
[634155.004767] [<00007f2a73a0d110>] 0x7f2a73a0d10f
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1219,11 +1219,14 @@ static int nfs_dentry_delete(const struc
}
+/* Ensure that we revalidate inode->i_nlink */
static void nfs_drop_nlink(struct inode *inode)
{
spin_lock(&inode->i_lock);
- if (inode->i_nlink > 0)
- drop_nlink(inode);
+ /* drop the inode if we're reasonably sure this is the last link */
+ if (inode->i_nlink == 1)
+ clear_nlink(inode);
+ NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ATTR;
spin_unlock(&inode->i_lock);
}
@@ -1238,8 +1241,8 @@ static void nfs_dentry_iput(struct dentr
NFS_I(inode)->cache_validity |= NFS_INO_INVALID_DATA;
if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
- drop_nlink(inode);
nfs_complete_unlink(dentry, inode);
+ nfs_drop_nlink(inode);
}
iput(inode);
}
@@ -1800,10 +1803,8 @@ static int nfs_safe_remove(struct dentry
if (inode != NULL) {
nfs_inode_return_delegation(inode);
error = NFS_PROTO(dir)->remove(dir, &dentry->d_name);
- /* The VFS may want to delete this inode */
if (error == 0)
nfs_drop_nlink(inode);
- nfs_mark_for_revalidate(inode);
} else
error = NFS_PROTO(dir)->remove(dir, &dentry->d_name);
if (error == -ENOENT)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 39/80] nfs: fix wrong object type in lockowner_slab
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2013-01-09 20:35 ` [ 38/80] NFS: Fix calls to drop_nlink() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 40/80] nfsd: fix v4 reply caching Greg Kroah-Hartman
` (42 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Yanchuan Nian, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanchuan Nian <ycnian@gmail.com>
commit 3c40794b2dd0f355ef4e6bf8d85af5dcd7da7ece upstream.
The object type in the cache of lockowner_slab is wrong, and it is
better to fix it.
Signed-off-by: Yanchuan Nian <ycnian@gmail.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -2356,7 +2356,7 @@ nfsd4_init_slabs(void)
if (openowner_slab == NULL)
goto out_nomem;
lockowner_slab = kmem_cache_create("nfsd4_lockowners",
- sizeof(struct nfs4_openowner), 0, 0, NULL);
+ sizeof(struct nfs4_lockowner), 0, 0, NULL);
if (lockowner_slab == NULL)
goto out_nomem;
file_slab = kmem_cache_create("nfsd4_files",
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 40/80] nfsd: fix v4 reply caching
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2013-01-09 20:35 ` [ 39/80] nfs: fix wrong object type in lockowner_slab Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 41/80] nfsd4: fix oops on unusual readlike compound Greg Kroah-Hartman
` (41 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 57d276d71aef7d8305ff002a070cb98deb2edced upstream.
Very embarassing: 1091006c5eb15cba56785bd5b498a8d0b9546903 "nfsd: turn
on reply cache for NFSv4" missed a line, effectively leaving the reply
cache off in the v4 case. I thought I'd tested that, but I guess not.
This time, wrote a pynfs test to confirm it works.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfssvc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -650,7 +650,7 @@ nfsd_dispatch(struct svc_rqst *rqstp, __
}
/* Store reply in cache. */
- nfsd_cache_update(rqstp, proc->pc_cachetype, statp + 1);
+ nfsd_cache_update(rqstp, rqstp->rq_cachetype, statp + 1);
return 1;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 41/80] nfsd4: fix oops on unusual readlike compound
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2013-01-09 20:35 ` [ 40/80] nfsd: fix v4 reply caching Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 42/80] nfsd: avoid permission checks on EXCLUSIVE_CREATE replay Greg Kroah-Hartman
` (40 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit d5f50b0c290431c65377c4afa1c764e2c3fe5305 upstream.
If the argument and reply together exceed the maximum payload size, then
a reply with a read-like operation can overlow the rq_pages array.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2920,11 +2920,16 @@ nfsd4_encode_read(struct nfsd4_compoundr
len = maxcount;
v = 0;
while (len > 0) {
- pn = resp->rqstp->rq_resused++;
+ pn = resp->rqstp->rq_resused;
+ if (!resp->rqstp->rq_respages[pn]) { /* ran out of pages */
+ maxcount -= len;
+ break;
+ }
resp->rqstp->rq_vec[v].iov_base =
page_address(resp->rqstp->rq_respages[pn]);
resp->rqstp->rq_vec[v].iov_len =
len < PAGE_SIZE ? len : PAGE_SIZE;
+ resp->rqstp->rq_resused++;
v++;
len -= PAGE_SIZE;
}
@@ -2970,6 +2975,8 @@ nfsd4_encode_readlink(struct nfsd4_compo
return nfserr;
if (resp->xbuf->page_len)
return nfserr_resource;
+ if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
+ return nfserr_resource;
page = page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused++]);
@@ -3019,6 +3026,8 @@ nfsd4_encode_readdir(struct nfsd4_compou
return nfserr;
if (resp->xbuf->page_len)
return nfserr_resource;
+ if (!resp->rqstp->rq_respages[resp->rqstp->rq_resused])
+ return nfserr_resource;
RESERVE_SPACE(NFS4_VERIFIER_SIZE);
savep = p;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 42/80] nfsd: avoid permission checks on EXCLUSIVE_CREATE replay
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2013-01-09 20:35 ` [ 41/80] nfsd4: fix oops on unusual readlike compound Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 43/80] nfs: fix null checking in nfs_get_option_str() Greg Kroah-Hartman
` (39 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, NeilBrown, J. Bruce Fields
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neil Brown <neilb@suse.de>
commit 7007c90fb9fef593b4aeaeee57e6a6754276c97c upstream.
With NFSv4, if we create a file then open it we explicit avoid checking
the permissions on the file during the open because the fact that we
created it ensures we should be allow to open it (the create and the
open should appear to be a single operation).
However if the reply to an EXCLUSIVE create gets lots and the client
resends the create, the current code will perform the permission check -
because it doesn't realise that it did the open already..
This patch should fix this.
Note that I haven't actually seen this cause a problem. I was just
looking at the code trying to figure out a different EXCLUSIVE open
related issue, and this looked wrong.
(Fix confirmed with pynfs 4.0 test OPEN4--bfields)
Signed-off-by: NeilBrown <neilb@suse.de>
[bfields: use OWNER_OVERRIDE and update for 4.1]
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 8 +++++---
fs/nfsd/vfs.c | 10 ++++++++--
2 files changed, 13 insertions(+), 5 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -194,6 +194,7 @@ static __be32
do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
{
struct svc_fh *resfh;
+ int accmode;
__be32 status;
resfh = kmalloc(sizeof(struct svc_fh), GFP_KERNEL);
@@ -253,9 +254,10 @@ do_open_lookup(struct svc_rqst *rqstp, s
/* set reply cache */
fh_copy_shallow(&open->op_openowner->oo_owner.so_replay.rp_openfh,
&resfh->fh_handle);
- if (!open->op_created)
- status = do_open_permission(rqstp, resfh, open,
- NFSD_MAY_NOP);
+ accmode = NFSD_MAY_NOP;
+ if (open->op_created)
+ accmode |= NFSD_MAY_OWNER_OVERRIDE;
+ status = do_open_permission(rqstp, resfh, open, accmode);
set_change_info(&open->op_cinfo, current_fh);
fh_dup2(current_fh, resfh);
out:
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -1477,13 +1477,19 @@ do_nfsd_create(struct svc_rqst *rqstp, s
case NFS3_CREATE_EXCLUSIVE:
if ( dchild->d_inode->i_mtime.tv_sec == v_mtime
&& dchild->d_inode->i_atime.tv_sec == v_atime
- && dchild->d_inode->i_size == 0 )
+ && dchild->d_inode->i_size == 0 ) {
+ if (created)
+ *created = 1;
break;
+ }
case NFS4_CREATE_EXCLUSIVE4_1:
if ( dchild->d_inode->i_mtime.tv_sec == v_mtime
&& dchild->d_inode->i_atime.tv_sec == v_atime
- && dchild->d_inode->i_size == 0 )
+ && dchild->d_inode->i_size == 0 ) {
+ if (created)
+ *created = 1;
goto set_attr;
+ }
/* fallthru */
case NFS3_CREATE_GUARDED:
err = nfserr_exist;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 43/80] nfs: fix null checking in nfs_get_option_str()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2013-01-09 20:35 ` [ 42/80] nfsd: avoid permission checks on EXCLUSIVE_CREATE replay Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 44/80] Input: walkera0701 - fix crash on startup Greg Kroah-Hartman
` (38 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Xi Wang, Trond Myklebust
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xi Wang <xi.wang@gmail.com>
commit e25fbe380c4e3c09afa98bcdcd9d3921443adab8 upstream.
The following null pointer check is broken.
*option = match_strdup(args);
return !option;
The pointer `option' must be non-null, and thus `!option' is always false.
Use `!*option' instead.
The bug was introduced in commit c5cb09b6f8 ("Cleanup: Factor out some
cut-and-paste code.").
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/super.c
+++ b/fs/nfs/super.c
@@ -1138,7 +1138,7 @@ static int nfs_get_option_str(substring_
{
kfree(*option);
*option = match_strdup(args);
- return !option;
+ return !*option;
}
static int nfs_get_option_ul(substring_t args[], unsigned long *option)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 44/80] Input: walkera0701 - fix crash on startup
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2013-01-09 20:35 ` [ 43/80] nfs: fix null checking in nfs_get_option_str() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 45/80] Input: sentelic - only report position of first finger as ST coordinates Greg Kroah-Hartman
` (37 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Peter Popovec, Dmitry Torokhov
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Popovec <popovec@oko.fei.tuke.sk>
commit a455e2985f57e2a71566bb8850094af38b2c932d upstream.
The driver's timer must be set up before enabling IRQ handler, otherwise
bad things may happen.
Reported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Peter Popovec <popovec@fei.tuke.sk>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/walkera0701.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/input/joystick/walkera0701.c
+++ b/drivers/input/joystick/walkera0701.c
@@ -196,6 +196,7 @@ static void walkera0701_close(struct inp
struct walkera_dev *w = input_get_drvdata(dev);
parport_disable_irq(w->parport);
+ hrtimer_cancel(&w->timer);
}
static int walkera0701_connect(struct walkera_dev *w, int parport)
@@ -224,6 +225,9 @@ static int walkera0701_connect(struct wa
if (parport_claim(w->pardevice))
goto init_err1;
+ hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ w->timer.function = timer_handler;
+
w->input_dev = input_allocate_device();
if (!w->input_dev)
goto init_err2;
@@ -254,8 +258,6 @@ static int walkera0701_connect(struct wa
if (err)
goto init_err3;
- hrtimer_init(&w->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
- w->timer.function = timer_handler;
return 0;
init_err3:
@@ -271,7 +273,6 @@ static int walkera0701_connect(struct wa
static void walkera0701_disconnect(struct walkera_dev *w)
{
- hrtimer_cancel(&w->timer);
input_unregister_device(w->input_dev);
parport_release(w->pardevice);
parport_unregister_device(w->pardevice);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 45/80] Input: sentelic - only report position of first finger as ST coordinates
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2013-01-09 20:35 ` [ 44/80] Input: walkera0701 - fix crash on startup Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 46/80] genirq: Always force thread affinity Greg Kroah-Hartman
` (36 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Christophe TORDEUX, Dmitry Torokhov
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe TORDEUX <christophe@tordeux.net>
commit a25461659050b913e114d282bf58823682eb56b6 upstream.
Report only the position of the first finger as absolute non-MT coordinates,
instead of reporting both fingers alternatively. Actual MT events are
unaffected.
This fixes horizontal and improves vertical scrolling with the touchpad.
Signed-off-by: Christophe TORDEUX <christophe@tordeux.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/sentelic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -759,7 +759,7 @@ static psmouse_ret_t fsp_process_byte(st
fsp_set_slot(dev, 0, fgrs > 0, abs_x, abs_y);
fsp_set_slot(dev, 1, false, 0, 0);
}
- if (fgrs > 0) {
+ if (fgrs == 1 || (fgrs == 2 && !(packet[0] & FSP_PB0_MFMC_FGR2))) {
input_report_abs(dev, ABS_X, abs_x);
input_report_abs(dev, ABS_Y, abs_y);
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 46/80] genirq: Always force thread affinity
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2013-01-09 20:35 ` [ 45/80] Input: sentelic - only report position of first finger as ST coordinates Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 47/80] usb: musb: cppi_dma: export cppi_interrupt() Greg Kroah-Hartman
` (35 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Thomas Gleixner
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 04aa530ec04f61875b99c12721162e2964e3318c upstream.
Sankara reported that the genirq core code fails to adjust the
affinity of an interrupt thread in several cases:
1) On request/setup_irq() the call to setup_affinity() happens before
the new action is registered, so the new thread is not notified.
2) For secondary shared interrupts nothing notifies the new thread to
change its affinity.
3) Interrupts which have the IRQ_NO_BALANCE flag set are not moving
the thread either.
Fix this by setting the thread affinity flag right on thread creation
time. This ensures that under all circumstances the thread moves to
the right place. Requires a check in irq_thread_check_affinity for an
existing affinity mask (CONFIG_CPU_MASK_OFFSTACK=y)
Reported-and-tested-by: Sankara Muthukrishnan <sankara.m@gmail.com>
Link: http://lkml.kernel.org/r/alpine.LFD.2.02.1209041738200.2754@ionos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/irq/manage.c | 23 +++++++++++++++++++++--
1 file changed, 21 insertions(+), 2 deletions(-)
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -708,6 +708,7 @@ static void
irq_thread_check_affinity(struct irq_desc *desc, struct irqaction *action)
{
cpumask_var_t mask;
+ bool valid = true;
if (!test_and_clear_bit(IRQTF_AFFINITY, &action->thread_flags))
return;
@@ -722,10 +723,18 @@ irq_thread_check_affinity(struct irq_des
}
raw_spin_lock_irq(&desc->lock);
- cpumask_copy(mask, desc->irq_data.affinity);
+ /*
+ * This code is triggered unconditionally. Check the affinity
+ * mask pointer. For CPU_MASK_OFFSTACK=n this is optimized out.
+ */
+ if (desc->irq_data.affinity)
+ cpumask_copy(mask, desc->irq_data.affinity);
+ else
+ valid = false;
raw_spin_unlock_irq(&desc->lock);
- set_cpus_allowed_ptr(current, mask);
+ if (valid)
+ set_cpus_allowed_ptr(current, mask);
free_cpumask_var(mask);
}
#else
@@ -933,6 +942,16 @@ __setup_irq(unsigned int irq, struct irq
*/
get_task_struct(t);
new->thread = t;
+ /*
+ * Tell the thread to set its affinity. This is
+ * important for shared interrupt handlers as we do
+ * not invoke setup_affinity() for the secondary
+ * handlers as everything is already set up. Even for
+ * interrupts marked with IRQF_NO_BALANCE this is
+ * correct as we want the thread to move to the cpu(s)
+ * on which the requesting code placed the interrupt.
+ */
+ set_bit(IRQTF_AFFINITY, &new->thread_flags);
}
if (!alloc_cpumask_var(&mask, GFP_KERNEL)) {
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 47/80] usb: musb: cppi_dma: export cppi_interrupt()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2013-01-09 20:35 ` [ 46/80] genirq: Always force thread affinity Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 48/80] xhci: Fix conditional check in bandwidth calculation Greg Kroah-Hartman
` (34 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sergei Shtylyov, Felipe Balbi
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <sshtylyov@ru.mvista.com>
commit 8b416b0b25d5d8ddb3a91c1d20e1373582c50405 upstream.
Now that DaVinci glue layer can be modular, we must export cppi_interrupt()
that it may call...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/cppi_dma.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -1313,6 +1313,7 @@ irqreturn_t cppi_interrupt(int irq, void
return IRQ_HANDLED;
}
+EXPORT_SYMBOL_GPL(cppi_interrupt);
/* Instantiate a software object representing a DMA controller. */
struct dma_controller *__init
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 48/80] xhci: Fix conditional check in bandwidth calculation.
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2013-01-09 20:35 ` [ 47/80] usb: musb: cppi_dma: export cppi_interrupt() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 49/80] xHCI: Fix TD Size calculation on 1.0 hosts Greg Kroah-Hartman
` (33 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sarah Sharp, David Binderman
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
commit 392a07ae3316f2b90b39ce41e66d6f6b5c95de90 upstream.
David reports that at drivers/usb/host/xhci.c:2257:
static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
}
The static analyser cppcheck says
[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.
Maybe the original programmer intention was something like
static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}
Fix this.
This patch should be backported to stable kernels as old as 3.2, that
contain the commit 2b69899934c63b7b9432568584fb4c4a2924f40c "xhci: USB
3.0 BW checking."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -2253,7 +2253,7 @@ static bool xhci_is_async_ep(unsigned in
static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
- return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
+ return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}
static unsigned int xhci_get_ss_bw_consumed(struct xhci_bw_info *ep_bw)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 49/80] xHCI: Fix TD Size calculation on 1.0 hosts.
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2013-01-09 20:35 ` [ 48/80] xhci: Fix conditional check in bandwidth calculation Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 50/80] xhci: fix null-pointer dereference when destroying half-built segment rings Greg Kroah-Hartman
` (32 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sarah Sharp, Chintan Mehta,
Shimmer Huang, Bhavik Kothari
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarah Sharp <sarah.a.sharp@linux.intel.com>
commit 4525c0a10dff7ad3669763c28016c7daffc3900e upstream.
The xHCI 1.0 specification made a change to the TD Size field in TRBs.
The value is now the number of packets that remain to be sent in the TD,
not including this TRB. The TD Size value for the last TRB in a TD must
always be zero.
The xHCI function xhci_v1_0_td_remainder() attempts to calculate this,
but it gets it wrong. First, it erroneously reuses the old
xhci_td_remainder function, which will right shift the value by 10. The
xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10.
Second, it does not set the TD size for the last TRB in a TD to zero.
Third, it uses roundup instead of DIV_ROUND_UP. The total packet count
is supposed to be the total number of bytes in this TD, divided by the
max packet size, rounded up. DIV_ROUND_UP is the right function to use
in that case.
With the old code, a TD on an endpoint with max packet size 1024 would
be set up like so:
TRB 1, TRB length = 600 bytes, TD size = 0
TRB 1, TRB length = 200 bytes, TD size = 0
TRB 1, TRB length = 100 bytes, TD size = 0
With the new code, the TD would be set up like this:
TRB 1, TRB length = 600 bytes, TD size = 1
TRB 1, TRB length = 200 bytes, TD size = 1
TRB 1, TRB length = 100 bytes, TD size = 0
This commit should be backported to kernels as old as 3.0, that contain
the commit 4da6e6f247a2601ab9f1e63424e4d944ed4124f3 "xhci 1.0: Update TD
size field format."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Chintan Mehta <chintan.mehta@sibridgetech.com>
Reported-by: Shimmer Huang <shimmering.h@gmail.com>
Tested-by: Bhavik Kothari <bhavik.kothari@sibridgetech.com>
Tested-by: Shimmer Huang <shimmering.h@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 32 +++++++++++++++++++-------------
1 file changed, 19 insertions(+), 13 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3069,11 +3069,11 @@ static u32 xhci_td_remainder(unsigned in
}
/*
- * For xHCI 1.0 host controllers, TD size is the number of packets remaining in
- * the TD (*not* including this TRB).
+ * For xHCI 1.0 host controllers, TD size is the number of max packet sized
+ * packets remaining in the TD (*not* including this TRB).
*
* Total TD packet count = total_packet_count =
- * roundup(TD size in bytes / wMaxPacketSize)
+ * DIV_ROUND_UP(TD size in bytes / wMaxPacketSize)
*
* Packets transferred up to and including this TRB = packets_transferred =
* rounddown(total bytes transferred including this TRB / wMaxPacketSize)
@@ -3081,15 +3081,16 @@ static u32 xhci_td_remainder(unsigned in
* TD size = total_packet_count - packets_transferred
*
* It must fit in bits 21:17, so it can't be bigger than 31.
+ * The last TRB in a TD must have the TD size set to zero.
*/
-
static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
- unsigned int total_packet_count, struct urb *urb)
+ unsigned int total_packet_count, struct urb *urb,
+ unsigned int num_trbs_left)
{
int packets_transferred;
/* One TRB with a zero-length data packet. */
- if (running_total == 0 && trb_buff_len == 0)
+ if (num_trbs_left == 0 || (running_total == 0 && trb_buff_len == 0))
return 0;
/* All the TRB queueing functions don't count the current TRB in
@@ -3098,7 +3099,9 @@ static u32 xhci_v1_0_td_remainder(int ru
packets_transferred = (running_total + trb_buff_len) /
usb_endpoint_maxp(&urb->ep->desc);
- return xhci_td_remainder(total_packet_count - packets_transferred);
+ if ((total_packet_count - packets_transferred) > 31)
+ return 31 << 17;
+ return (total_packet_count - packets_transferred) << 17;
}
static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
@@ -3125,7 +3128,7 @@ static int queue_bulk_sg_tx(struct xhci_
num_trbs = count_sg_trbs_needed(xhci, urb);
num_sgs = urb->num_mapped_sgs;
- total_packet_count = roundup(urb->transfer_buffer_length,
+ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
usb_endpoint_maxp(&urb->ep->desc));
trb_buff_len = prepare_transfer(xhci, xhci->devs[slot_id],
@@ -3208,7 +3211,8 @@ static int queue_bulk_sg_tx(struct xhci_
running_total);
} else {
remainder = xhci_v1_0_td_remainder(running_total,
- trb_buff_len, total_packet_count, urb);
+ trb_buff_len, total_packet_count, urb,
+ num_trbs - 1);
}
length_field = TRB_LEN(trb_buff_len) |
remainder |
@@ -3316,7 +3320,7 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
start_cycle = ep_ring->cycle_state;
running_total = 0;
- total_packet_count = roundup(urb->transfer_buffer_length,
+ total_packet_count = DIV_ROUND_UP(urb->transfer_buffer_length,
usb_endpoint_maxp(&urb->ep->desc));
/* How much data is in the first TRB? */
addr = (u64) urb->transfer_dma;
@@ -3362,7 +3366,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
running_total);
} else {
remainder = xhci_v1_0_td_remainder(running_total,
- trb_buff_len, total_packet_count, urb);
+ trb_buff_len, total_packet_count, urb,
+ num_trbs - 1);
}
length_field = TRB_LEN(trb_buff_len) |
remainder |
@@ -3625,7 +3630,7 @@ static int xhci_queue_isoc_tx(struct xhc
addr = start_addr + urb->iso_frame_desc[i].offset;
td_len = urb->iso_frame_desc[i].length;
td_remain_len = td_len;
- total_packet_count = roundup(td_len,
+ total_packet_count = DIV_ROUND_UP(td_len,
usb_endpoint_maxp(&urb->ep->desc));
/* A zero-length transfer still involves at least one packet. */
if (total_packet_count == 0)
@@ -3704,7 +3709,8 @@ static int xhci_queue_isoc_tx(struct xhc
} else {
remainder = xhci_v1_0_td_remainder(
running_total, trb_buff_len,
- total_packet_count, urb);
+ total_packet_count, urb,
+ (trbs_per_td - j - 1));
}
length_field = TRB_LEN(trb_buff_len) |
remainder |
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 50/80] xhci: fix null-pointer dereference when destroying half-built segment rings
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2013-01-09 20:35 ` [ 49/80] xHCI: Fix TD Size calculation on 1.0 hosts Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 51/80] usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch Greg Kroah-Hartman
` (31 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Julius Werner, Sarah Sharp
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <jwerner@chromium.org>
commit 68e5254adb88bede68285f11fb442a4d34fb550c upstream.
xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
the tail to head at the end (forming a ring). When it bails out for OOM
reasons half-way through, it tries to destroy its half-built list with
xhci_free_segments_for_ring(), even though it is not a ring yet. This
causes a null-pointer dereference upon hitting the last element.
Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
the output parameters to be valid upon this kind of OOM failure, and
calls xhci_ring_free() on them. Since the (incomplete) list/ring should
already be destroyed in that case, this would lead to a use after free.
This patch fixes those issues by having xhci_alloc_segments_for_ring()
destroy its half-built, non-circular list manually and destroying the
invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().
This patch should be backported to kernels as old as 2.6.31, that
contains the commit 0ebbab37422315a5d0cb29792271085bafdf38c0 "USB: xhci:
Ring allocation and initialization."
A separate patch will need to be developed for kernels older than 3.4,
since the ring allocation code was refactored in that kernel.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -205,7 +205,12 @@ static int xhci_alloc_segments_for_ring(
next = xhci_segment_alloc(xhci, cycle_state, flags);
if (!next) {
- xhci_free_segments_for_ring(xhci, *first);
+ prev = *first;
+ while (prev) {
+ next = prev->next;
+ xhci_segment_free(xhci, prev);
+ prev = next;
+ }
return -ENOMEM;
}
xhci_link_segments(xhci, prev, next, type);
@@ -258,7 +263,7 @@ static struct xhci_ring *xhci_ring_alloc
return ring;
fail:
- xhci_ring_free(xhci, ring);
+ kfree(ring);
return NULL;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 51/80] usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2013-01-09 20:35 ` [ 50/80] xhci: fix null-pointer dereference when destroying half-built segment rings Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 52/80] xhci: Add Lynx Point LP to list of Intel switchable hosts Greg Kroah-Hartman
` (30 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Alexis R. Cortes, Sarah Sharp
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Alexis R. Cortes" <alexis.cortes@ti.com>
commit b0e4e606ff6ff26da0f60826e75577b56ba4e463 upstream.
This minor patch creates a more stricter conditional for the Z1 sytems for applying
the Compliance Mode Patch, this to avoid the quirk to be applied to models that
contain a "Z1" in their dmi product string but are different from Z1 systems.
This patch should be backported to stable kernels as old as 3.2, that
contain the commit 71c731a296f1b08a3724bd1b514b64f1bda87a23 "usb: host:
xhci: Fix Compliance Mode on SN65LVPE502CP Hardware"
Signed-off-by: Alexis R. Cortes <alexis.cortes@ti.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -480,7 +480,7 @@ static bool compliance_mode_recovery_tim
if (strstr(dmi_product_name, "Z420") ||
strstr(dmi_product_name, "Z620") ||
strstr(dmi_product_name, "Z820") ||
- strstr(dmi_product_name, "Z1"))
+ strstr(dmi_product_name, "Z1 Workstation"))
return true;
return false;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 52/80] xhci: Add Lynx Point LP to list of Intel switchable hosts
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2013-01-09 20:35 ` [ 51/80] usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 53/80] cgroup: remove incorrect dget/dput() pair in cgroup_create_dir() Greg Kroah-Hartman
` (29 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Russell Webb, Sarah Sharp
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Webb <russell.webb@linux.intel.com>
commit bb1e5dd7113d2fd178d3af9aca8f480ae0468edf upstream.
Like Lynx Point, Lynx Point LP is also switchable. See
1c12443ab8eba71a658fae4572147e56d1f84f66 for more details.
This patch should be backported to stable kernels as old as 3.0,
that contain commit 69e848c2090aebba5698a1620604c7dccb448684
"Intel xhci: Support EHCI/xHCI port switching."
Signed-off-by: Russell Webb <russell.webb@linux.intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-pci.c | 3 ++-
drivers/usb/host/pci-quirks.c | 4 +++-
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -362,7 +362,8 @@ static bool usb_is_intel_switchable_ehci
pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == 0x1E26 ||
pdev->device == 0x8C2D ||
- pdev->device == 0x8C26);
+ pdev->device == 0x8C26 ||
+ pdev->device == 0x9C26);
}
static void ehci_enable_xhci_companion(void)
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -723,6 +723,7 @@ static int handshake(void __iomem *ptr,
}
#define PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI 0x8C31
+#define PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI 0x9C31
bool usb_is_intel_ppt_switchable_xhci(struct pci_dev *pdev)
{
@@ -736,7 +737,8 @@ bool usb_is_intel_lpt_switchable_xhci(st
{
return pdev->class == PCI_CLASS_SERIAL_USB_XHCI &&
pdev->vendor == PCI_VENDOR_ID_INTEL &&
- pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI;
+ (pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_XHCI ||
+ pdev->device == PCI_DEVICE_ID_INTEL_LYNX_POINT_LP_XHCI);
}
bool usb_is_intel_switchable_xhci(struct pci_dev *pdev)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 53/80] cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2013-01-09 20:35 ` [ 52/80] xhci: Add Lynx Point LP to list of Intel switchable hosts Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 54/80] freezer: add missing mbs to freezer_count() and freezer_should_skip() Greg Kroah-Hartman
` (28 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Tejun Heo, Li Zefan
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 175431635ec09b1d1bba04979b006b99e8305a83 upstream.
cgroup_create_dir() does weird dancing with dentry refcnt. On
success, it gets and then puts it achieving nothing. On failure, it
puts but there isn't no matching get anywhere leading to the following
oops if cgroup_create_file() fails for whatever reason.
------------[ cut here ]------------
kernel BUG at /work/os/work/fs/dcache.c:552!
invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
Modules linked in:
CPU 2
Pid: 697, comm: mkdir Not tainted 3.7.0-rc4-work+ #3 Bochs Bochs
RIP: 0010:[<ffffffff811d9c0c>] [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
RSP: 0018:ffff88001a3ebef8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff88000e5b1ef8 RCX: 0000000000000403
RDX: 0000000000000303 RSI: 2000000000000000 RDI: ffff88000e5b1f58
RBP: ffff88001a3ebf18 R08: ffffffff82c76960 R09: 0000000000000001
R10: ffff880015022080 R11: ffd9bed70f48a041 R12: 00000000ffffffea
R13: 0000000000000001 R14: ffff88000e5b1f58 R15: 00007fff57656d60
FS: 00007ff05fcb3800(0000) GS:ffff88001fd00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004046f0 CR3: 000000001315f000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process mkdir (pid: 697, threadinfo ffff88001a3ea000, task ffff880015022080)
Stack:
ffff88001a3ebf48 00000000ffffffea 0000000000000001 0000000000000000
ffff88001a3ebf38 ffffffff811cc889 0000000000000001 ffff88000e5b1ef8
ffff88001a3ebf68 ffffffff811d1fc9 ffff8800198d7f18 ffff880019106ef8
Call Trace:
[<ffffffff811cc889>] done_path_create+0x19/0x50
[<ffffffff811d1fc9>] sys_mkdirat+0x59/0x80
[<ffffffff811d2009>] sys_mkdir+0x19/0x20
[<ffffffff81be1e02>] system_call_fastpath+0x16/0x1b
Code: 00 48 8d 90 18 01 00 00 48 89 93 c0 00 00 00 4c 89 a0 18 01 00 00 48 8b 83 a0 00 00 00 83 80 28 01 00 00 01 e8 e6 6f a0 00 eb 92 <0f> 0b 66 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 49 89 fe 41
RIP [<ffffffff811d9c0c>] dput+0x1dc/0x1e0
RSP <ffff88001a3ebef8>
---[ end trace 1277bcfd9561ddb0 ]---
Fix it by dropping the unnecessary dget/dput() pair.
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup.c | 2 --
1 file changed, 2 deletions(-)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2568,9 +2568,7 @@ static int cgroup_create_dir(struct cgro
dentry->d_fsdata = cgrp;
inc_nlink(parent->d_inode);
rcu_assign_pointer(cgrp->dentry, dentry);
- dget(dentry);
}
- dput(dentry);
return error;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 54/80] freezer: add missing mbs to freezer_count() and freezer_should_skip()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2013-01-09 20:35 ` [ 53/80] cgroup: remove incorrect dget/dput() pair in cgroup_create_dir() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 55/80] x86, amd: Disable way access filter on Piledriver CPUs Greg Kroah-Hartman
` (27 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tejun Heo, Oleg Nesterov,
Rafael J. Wysocki
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit dd67d32dbc5de299d70cc9e10c6c1e29ffa56b92 upstream.
A task is considered frozen enough between freezer_do_not_count() and
freezer_count() and freezers use freezer_should_skip() to test this
condition. This supposedly works because freezer_count() always calls
try_to_freezer() after clearing %PF_FREEZER_SKIP.
However, there currently is nothing which guarantees that
freezer_count() sees %true freezing() after clearing %PF_FREEZER_SKIP
when freezing is in progress, and vice-versa. A task can escape the
freezing condition in effect by freezer_count() seeing !freezing() and
freezer_should_skip() seeing %PF_FREEZER_SKIP.
This patch adds smp_mb()'s to freezer_count() and
freezer_should_skip() such that either %true freezing() is visible to
freezer_count() or !PF_FREEZER_SKIP is visible to
freezer_should_skip().
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/freezer.h | 50 ++++++++++++++++++++++++++++++++++++++++--------
1 file changed, 42 insertions(+), 8 deletions(-)
--- a/include/linux/freezer.h
+++ b/include/linux/freezer.h
@@ -75,28 +75,62 @@ static inline bool cgroup_freezing(struc
*/
-/* Tell the freezer not to count the current task as freezable. */
+/**
+ * freezer_do_not_count - tell freezer to ignore %current
+ *
+ * Tell freezers to ignore the current task when determining whether the
+ * target frozen state is reached. IOW, the current task will be
+ * considered frozen enough by freezers.
+ *
+ * The caller shouldn't do anything which isn't allowed for a frozen task
+ * until freezer_cont() is called. Usually, freezer[_do_not]_count() pair
+ * wrap a scheduling operation and nothing much else.
+ */
static inline void freezer_do_not_count(void)
{
current->flags |= PF_FREEZER_SKIP;
}
-/*
- * Tell the freezer to count the current task as freezable again and try to
- * freeze it.
+/**
+ * freezer_count - tell freezer to stop ignoring %current
+ *
+ * Undo freezer_do_not_count(). It tells freezers that %current should be
+ * considered again and tries to freeze if freezing condition is already in
+ * effect.
*/
static inline void freezer_count(void)
{
current->flags &= ~PF_FREEZER_SKIP;
+ /*
+ * If freezing is in progress, the following paired with smp_mb()
+ * in freezer_should_skip() ensures that either we see %true
+ * freezing() or freezer_should_skip() sees !PF_FREEZER_SKIP.
+ */
+ smp_mb();
try_to_freeze();
}
-/*
- * Check if the task should be counted as freezable by the freezer
+/**
+ * freezer_should_skip - whether to skip a task when determining frozen
+ * state is reached
+ * @p: task in quesion
+ *
+ * This function is used by freezers after establishing %true freezing() to
+ * test whether a task should be skipped when determining the target frozen
+ * state is reached. IOW, if this function returns %true, @p is considered
+ * frozen enough.
*/
-static inline int freezer_should_skip(struct task_struct *p)
+static inline bool freezer_should_skip(struct task_struct *p)
{
- return !!(p->flags & PF_FREEZER_SKIP);
+ /*
+ * The following smp_mb() paired with the one in freezer_count()
+ * ensures that either freezer_count() sees %true freezing() or we
+ * see cleared %PF_FREEZER_SKIP and return %false. This makes it
+ * impossible for a task to slip frozen state testing after
+ * clearing %PF_FREEZER_SKIP.
+ */
+ smp_mb();
+ return p->flags & PF_FREEZER_SKIP;
}
/*
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 55/80] x86, amd: Disable way access filter on Piledriver CPUs
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2013-01-09 20:35 ` [ 54/80] freezer: add missing mbs to freezer_count() and freezer_should_skip() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 56/80] sparc: huge_ptep_set_* functions need to call set_huge_pte_at() Greg Kroah-Hartman
` (26 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Andre Przywara, H. Peter Anvin,
CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andre Przywara <andre.przywara@amd.com>
commit 2bbf0a1427c377350f001fbc6260995334739ad7 upstream.
The Way Access Filter in recent AMD CPUs may hurt the performance of
some workloads, caused by aliasing issues in the L1 cache.
This patch disables it on the affected CPUs.
The issue is similar to that one of last year:
http://lkml.indiana.edu/hypermail/linux/kernel/1107.3/00041.html
This new patch does not replace the old one, we just need another
quirk for newer CPUs.
The performance penalty without the patch depends on the
circumstances, but is a bit less than the last year's 3%.
The workloads affected would be those that access code from the same
physical page under different virtual addresses, so different
processes using the same libraries with ASLR or multiple instances of
PIE-binaries. The code needs to be accessed simultaneously from both
cores of the same compute unit.
More details can be found here:
http://developer.amd.com/Assets/SharedL1InstructionCacheonAMD15hCPU.pdf
CPUs affected are anything with the core known as Piledriver.
That includes the new parts of the AMD A-Series (aka Trinity) and the
just released new CPUs of the FX-Series (aka Vishera).
The model numbering is a bit odd here: FX CPUs have model 2,
A-Series has model 10h, with possible extensions to 1Fh. Hence the
range of model ids.
Signed-off-by: Andre Przywara <osp@andrep.de>
Link: http://lkml.kernel.org/r/1351700450-9277-1-git-send-email-osp@andrep.de
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Signed-off-by: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/amd.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -598,6 +598,20 @@ static void __cpuinit init_amd(struct cp
}
}
+ /*
+ * The way access filter has a performance penalty on some workloads.
+ * Disable it on the affected CPUs.
+ */
+ if ((c->x86 == 0x15) &&
+ (c->x86_model >= 0x02) && (c->x86_model < 0x20)) {
+ u64 val;
+
+ if (!rdmsrl_safe(0xc0011021, &val) && !(val & 0x1E)) {
+ val |= 0x1E;
+ checking_wrmsrl(0xc0011021, val);
+ }
+ }
+
cpu_detect_cache_sizes(c);
/* Multi core CPU? */
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 56/80] sparc: huge_ptep_set_* functions need to call set_huge_pte_at()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2013-01-09 20:35 ` [ 55/80] x86, amd: Disable way access filter on Piledriver CPUs Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 57/80] batman-adv: fix random jitter calculation Greg Kroah-Hartman
` (25 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Dave Kleikamp, David S. Miller,
sparclinux
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Kleikamp <dave.kleikamp@oracle.com>
[ Upstream commit 6cb9c3697585c47977c42c5cc1b9fc49247ac530 ]
Modifying the huge pte's requires that all the underlying pte's be
modified.
Version 2: added missing flush_tlb_page()
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: sparclinux@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/include/asm/hugetlb.h | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/arch/sparc/include/asm/hugetlb.h
+++ b/arch/sparc/include/asm/hugetlb.h
@@ -58,14 +58,20 @@ static inline pte_t huge_pte_wrprotect(p
static inline void huge_ptep_set_wrprotect(struct mm_struct *mm,
unsigned long addr, pte_t *ptep)
{
- ptep_set_wrprotect(mm, addr, ptep);
+ pte_t old_pte = *ptep;
+ set_huge_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
}
static inline int huge_ptep_set_access_flags(struct vm_area_struct *vma,
unsigned long addr, pte_t *ptep,
pte_t pte, int dirty)
{
- return ptep_set_access_flags(vma, addr, ptep, pte, dirty);
+ int changed = !pte_same(*ptep, pte);
+ if (changed) {
+ set_huge_pte_at(vma->vm_mm, addr, ptep, pte);
+ flush_tlb_page(vma, addr);
+ }
+ return changed;
}
static inline pte_t huge_ptep_get(pte_t *ptep)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 57/80] batman-adv: fix random jitter calculation
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2013-01-09 20:35 ` [ 56/80] sparc: huge_ptep_set_* functions need to call set_huge_pte_at() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 58/80] inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock Greg Kroah-Hartman
` (24 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Akinobu Mita, Antonio Quartulli,
Marek Lindner, Simon Wunderlich, David S. Miller, b.a.t.m.a.n,
netdev
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akinobu Mita <akinobu.mita@gmail.com>
[ Upstream commit 143cdd8f33909ff5a153e3f02048738c5964ba26 ]
batadv_iv_ogm_emit_send_time() attempts to calculates a random integer
in the range of 'orig_interval +- BATADV_JITTER' by the below lines.
msecs = atomic_read(&bat_priv->orig_interval) - BATADV_JITTER;
msecs += (random32() % 2 * BATADV_JITTER);
But it actually gets 'orig_interval' or 'orig_interval - BATADV_JITTER'
because '%' and '*' have same precedence and associativity is
left-to-right.
This adds the parentheses at the appropriate position so that it matches
original intension.
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Acked-by: Antonio Quartulli <ordex@autistici.org>
Cc: Marek Lindner <lindner_marek@yahoo.de>
Cc: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Cc: Antonio Quartulli <ordex@autistici.org>
Cc: b.a.t.m.a.n@lists.open-mesh.org
Cc: "David S. Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -72,7 +72,7 @@ static unsigned long bat_iv_ogm_emit_sen
{
return jiffies + msecs_to_jiffies(
atomic_read(&bat_priv->orig_interval) -
- JITTER + (random32() % 2*JITTER));
+ JITTER + (random32() % (2*JITTER)));
}
/* when do we schedule a ogm packet to be sent */
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 58/80] inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2013-01-09 20:35 ` [ 57/80] batman-adv: fix random jitter calculation Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 59/80] net: sched: integer overflow fix Greg Kroah-Hartman
` (23 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Christoph Paasch, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <christoph.paasch@uclouvain.be>
[ Upstream commit e337e24d6624e74a558aa69071e112a65f7b5758 ]
If in either of the above functions inet_csk_route_child_sock() or
__inet_inherit_port() fails, the newsk will not be freed:
unreferenced object 0xffff88022e8a92c0 (size 1592):
comm "softirq", pid 0, jiffies 4294946244 (age 726.160s)
hex dump (first 32 bytes):
0a 01 01 01 0a 01 01 02 00 00 00 00 a7 cc 16 00 ................
02 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8153d190>] kmemleak_alloc+0x21/0x3e
[<ffffffff810ab3e7>] kmem_cache_alloc+0xb5/0xc5
[<ffffffff8149b65b>] sk_prot_alloc.isra.53+0x2b/0xcd
[<ffffffff8149b784>] sk_clone_lock+0x16/0x21e
[<ffffffff814d711a>] inet_csk_clone_lock+0x10/0x7b
[<ffffffff814ebbc3>] tcp_create_openreq_child+0x21/0x481
[<ffffffff814e8fa5>] tcp_v4_syn_recv_sock+0x3a/0x23b
[<ffffffff814ec5ba>] tcp_check_req+0x29f/0x416
[<ffffffff814e8e10>] tcp_v4_do_rcv+0x161/0x2bc
[<ffffffff814eb917>] tcp_v4_rcv+0x6c9/0x701
[<ffffffff814cea9f>] ip_local_deliver_finish+0x70/0xc4
[<ffffffff814cec20>] ip_local_deliver+0x4e/0x7f
[<ffffffff814ce9f8>] ip_rcv_finish+0x1fc/0x233
[<ffffffff814cee68>] ip_rcv+0x217/0x267
[<ffffffff814a7bbe>] __netif_receive_skb+0x49e/0x553
[<ffffffff814a7cc3>] netif_receive_skb+0x50/0x82
This happens, because sk_clone_lock initializes sk_refcnt to 2, and thus
a single sock_put() is not enough to free the memory. Additionally, things
like xfrm, memcg, cookie_values,... may have been initialized.
We have to free them properly.
This is fixed by forcing a call to tcp_done(), ending up in
inet_csk_destroy_sock, doing the final sock_put(). tcp_done() is necessary,
because it ends up doing all the cleanup on xfrm, memcg, cookie_values,
xfrm,...
Before calling tcp_done, we have to set the socket to SOCK_DEAD, to
force it entering inet_csk_destroy_sock. To avoid the warning in
inet_csk_destroy_sock, inet_num has to be set to 0.
As inet_csk_destroy_sock does a dec on orphan_count, we first have to
increase it.
Calling tcp_done() allows us to remove the calls to
tcp_clear_xmit_timer() and tcp_cleanup_congestion_control().
A similar approach is taken for dccp by calling dccp_done().
This is in the kernel since 093d282321 (tproxy: fix hash locking issue
when using port redirection in __inet_inherit_port()), thus since
version >= 2.6.37.
Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/inet_connection_sock.h | 1 +
net/dccp/ipv4.c | 4 ++--
net/dccp/ipv6.c | 3 ++-
net/ipv4/inet_connection_sock.c | 16 ++++++++++++++++
net/ipv4/tcp_ipv4.c | 6 ++----
net/ipv6/tcp_ipv6.c | 3 ++-
6 files changed, 25 insertions(+), 8 deletions(-)
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -317,6 +317,7 @@ extern void inet_csk_reqsk_queue_prune(s
const unsigned long max_rto);
extern void inet_csk_destroy_sock(struct sock *sk);
+extern void inet_csk_prepare_forced_close(struct sock *sk);
/*
* LISTEN is a special case for poll..
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -435,8 +435,8 @@ exit:
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
return NULL;
put_and_exit:
- bh_unlock_sock(newsk);
- sock_put(newsk);
+ inet_csk_prepare_forced_close(newsk);
+ dccp_done(newsk);
goto exit;
}
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -611,7 +611,8 @@ static struct sock *dccp_v6_request_recv
newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
if (__inet_inherit_port(sk, newsk) < 0) {
- sock_put(newsk);
+ inet_csk_prepare_forced_close(newsk);
+ dccp_done(newsk);
goto out;
}
__inet6_hash(newsk, NULL);
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -659,6 +659,22 @@ void inet_csk_destroy_sock(struct sock *
}
EXPORT_SYMBOL(inet_csk_destroy_sock);
+/* This function allows to force a closure of a socket after the call to
+ * tcp/dccp_create_openreq_child().
+ */
+void inet_csk_prepare_forced_close(struct sock *sk)
+{
+ /* sk_clone_lock locked the socket and set refcnt to 2 */
+ bh_unlock_sock(sk);
+ sock_put(sk);
+
+ /* The below has to be done to allow calling inet_csk_destroy_sock */
+ sock_set_flag(sk, SOCK_DEAD);
+ percpu_counter_inc(sk->sk_prot->orphan_count);
+ inet_sk(sk)->inet_num = 0;
+}
+EXPORT_SYMBOL(inet_csk_prepare_forced_close);
+
int inet_csk_listen_start(struct sock *sk, const int nr_table_entries)
{
struct inet_sock *inet = inet_sk(sk);
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1524,10 +1524,8 @@ exit:
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
return NULL;
put_and_exit:
- tcp_clear_xmit_timers(newsk);
- tcp_cleanup_congestion_control(newsk);
- bh_unlock_sock(newsk);
- sock_put(newsk);
+ inet_csk_prepare_forced_close(newsk);
+ tcp_done(newsk);
goto exit;
}
EXPORT_SYMBOL(tcp_v4_syn_recv_sock);
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1411,7 +1411,8 @@ static struct sock * tcp_v6_syn_recv_soc
#endif
if (__inet_inherit_port(sk, newsk) < 0) {
- sock_put(newsk);
+ inet_csk_prepare_forced_close(newsk);
+ tcp_done(newsk);
goto out;
}
__inet6_hash(newsk, NULL);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 59/80] net: sched: integer overflow fix
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2013-01-09 20:35 ` [ 58/80] inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 60/80] tcp: fix MSG_SENDPAGE_NOTLAST logic Greg Kroah-Hartman
` (22 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Stefan Hasko, Eric Dumazet,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Hasko <hasko.stevo@gmail.com>
[ Upstream commit d2fe85da52e89b8012ffad010ef352a964725d5f ]
Fixed integer overflow in function htb_dequeue
Signed-off-by: Stefan Hasko <hasko.stevo@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_htb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -876,7 +876,7 @@ ok:
q->now = psched_get_time();
start_at = jiffies;
- next_event = q->now + 5 * PSCHED_TICKS_PER_SEC;
+ next_event = q->now + 5LLU * PSCHED_TICKS_PER_SEC;
for (level = 0; level < TC_HTB_MAXDEPTH; level++) {
/* common case optimization - skip event handler quickly */
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 60/80] tcp: fix MSG_SENDPAGE_NOTLAST logic
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2013-01-09 20:35 ` [ 59/80] net: sched: integer overflow fix Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 61/80] tcp: implement RFC 5961 3.2 Greg Kroah-Hartman
` (21 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Willy Tarreau, Eric Dumazet,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit ae62ca7b03217be5e74759dc6d7698c95df498b3 ]
commit 35f9c09fe9c72e (tcp: tcp_sendpages() should call tcp_push() once)
added an internal flag : MSG_SENDPAGE_NOTLAST meant to be set on all
frags but the last one for a splice() call.
The condition used to set the flag in pipe_to_sendpage() relied on
splice() user passing the exact number of bytes present in the pipe,
or a smaller one.
But some programs pass an arbitrary high value, and the test fails.
The effect of this bug is a lack of tcp_push() at the end of a
splice(pipe -> socket) call, and possibly very slow or erratic TCP
sessions.
We should both test sd->total_len and fact that another fragment
is in the pipe (pipe->nrbufs > 1)
Many thanks to Willy for providing very clear bug report, bisection
and test programs.
Reported-by: Willy Tarreau <w@1wt.eu>
Bisected-by: Willy Tarreau <w@1wt.eu>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/splice.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -696,8 +696,10 @@ static int pipe_to_sendpage(struct pipe_
return -EINVAL;
more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
- if (sd->len < sd->total_len)
+
+ if (sd->len < sd->total_len && pipe->nrbufs > 1)
more |= MSG_SENDPAGE_NOTLAST;
+
return file->f_op->sendpage(file, buf->page, buf->offset,
sd->len, &pos, more);
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 61/80] tcp: implement RFC 5961 3.2
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2013-01-09 20:35 ` [ 60/80] tcp: fix MSG_SENDPAGE_NOTLAST logic Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 62/80] tcp: implement RFC 5961 4.2 Greg Kroah-Hartman
` (20 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Eric Dumazet, Kiran Kumar Kella,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 282f23c6ee343126156dd41218b22ece96d747e3 ]
Implement the RFC 5691 mitigation against Blind
Reset attack using RST bit.
Idea is to validate incoming RST sequence,
to match RCV.NXT value, instead of previouly accepted
window : (RCV.NXT <= SEG.SEQ < RCV.NXT+RCV.WND)
If sequence is in window but not an exact match, send
a "challenge ACK", so that the other part can resend an
RST with the appropriate sequence.
Add a new sysctl, tcp_challenge_ack_limit, to limit
number of challenge ACK sent per second.
Add a new SNMP counter to count number of challenge acks sent.
(netstat -s | grep TCPChallengeACK)
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/networking/ip-sysctl.txt | 5 +++++
include/linux/snmp.h | 1 +
include/net/tcp.h | 1 +
net/ipv4/proc.c | 1 +
net/ipv4/sysctl_net_ipv4.c | 7 +++++++
net/ipv4/tcp_input.c | 31 ++++++++++++++++++++++++++++++-
6 files changed, 45 insertions(+), 1 deletion(-)
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -537,6 +537,11 @@ tcp_thin_dupack - BOOLEAN
Documentation/networking/tcp-thin.txt
Default: 0
+tcp_challenge_ack_limit - INTEGER
+ Limits number of Challenge ACK sent per second, as recommended
+ in RFC 5961 (Improving TCP's Robustness to Blind In-Window Attacks)
+ Default: 100
+
UDP variables:
udp_mem - vector of 3 INTEGERs: min, pressure, max
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -234,6 +234,7 @@ enum
LINUX_MIB_TCPREQQFULLDROP, /* TCPReqQFullDrop */
LINUX_MIB_TCPRETRANSFAIL, /* TCPRetransFail */
LINUX_MIB_TCPRCVCOALESCE, /* TCPRcvCoalesce */
+ LINUX_MIB_TCPCHALLENGEACK, /* TCPChallengeACK */
__LINUX_MIB_MAX
};
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -252,6 +252,7 @@ extern int sysctl_tcp_max_ssthresh;
extern int sysctl_tcp_cookie_size;
extern int sysctl_tcp_thin_linear_timeouts;
extern int sysctl_tcp_thin_dupack;
+extern int sysctl_tcp_challenge_ack_limit;
extern atomic_long_t tcp_memory_allocated;
extern struct percpu_counter tcp_sockets_allocated;
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -258,6 +258,7 @@ static const struct snmp_mib snmp4_net_l
SNMP_MIB_ITEM("TCPReqQFullDrop", LINUX_MIB_TCPREQQFULLDROP),
SNMP_MIB_ITEM("TCPRetransFail", LINUX_MIB_TCPRETRANSFAIL),
SNMP_MIB_ITEM("TCPRcvCoalesce", LINUX_MIB_TCPRCVCOALESCE),
+ SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
SNMP_MIB_SENTINEL
};
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -590,6 +590,13 @@ static struct ctl_table ipv4_table[] = {
.mode = 0644,
.proc_handler = proc_dointvec
},
+ {
+ .procname = "tcp_challenge_ack_limit",
+ .data = &sysctl_tcp_challenge_ack_limit,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
#ifdef CONFIG_NET_DMA
{
.procname = "tcp_dma_copybreak",
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -88,6 +88,9 @@ int sysctl_tcp_app_win __read_mostly = 3
int sysctl_tcp_adv_win_scale __read_mostly = 1;
EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+/* rfc5961 challenge ack rate limiting */
+int sysctl_tcp_challenge_ack_limit = 100;
+
int sysctl_tcp_stdurg __read_mostly;
int sysctl_tcp_rfc1337 __read_mostly;
int sysctl_tcp_max_orphans __read_mostly = NR_FILE;
@@ -5265,6 +5268,23 @@ out:
}
#endif /* CONFIG_NET_DMA */
+static void tcp_send_challenge_ack(struct sock *sk)
+{
+ /* unprotected vars, we dont care of overwrites */
+ static u32 challenge_timestamp;
+ static unsigned int challenge_count;
+ u32 now = jiffies / HZ;
+
+ if (now != challenge_timestamp) {
+ challenge_timestamp = now;
+ challenge_count = 0;
+ }
+ if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+ tcp_send_ack(sk);
+ }
+}
+
/* Does PAWS and seqno based validation of an incoming segment, flags will
* play significant role here.
*/
@@ -5301,7 +5321,16 @@ static int tcp_validate_incoming(struct
/* Step 2: check RST bit */
if (th->rst) {
- tcp_reset(sk);
+ /* RFC 5961 3.2 :
+ * If sequence number exactly matches RCV.NXT, then
+ * RESET the connection
+ * else
+ * Send a challenge ACK
+ */
+ if (TCP_SKB_CB(skb)->seq == tp->rcv_nxt)
+ tcp_reset(sk);
+ else
+ tcp_send_challenge_ack(sk);
goto discard;
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 62/80] tcp: implement RFC 5961 4.2
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2013-01-09 20:35 ` [ 61/80] tcp: implement RFC 5961 3.2 Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 63/80] tcp: refine SYN handling in tcp_validate_incoming Greg Kroah-Hartman
` (19 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Eric Dumazet, Kiran Kumar Kella,
David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 0c24604b68fc7810d429d6c3657b6f148270e528 ]
Implement the RFC 5691 mitigation against Blind
Reset attack using SYN bit.
Section 4.2 of RFC 5961 advises to send a Challenge ACK and drop
incoming packet, instead of resetting the session.
Add a new SNMP counter to count number of challenge acks sent
in response to SYN packets.
(netstat -s | grep TCPSYNChallenge)
Remove obsolete TCPAbortOnSyn, since we no longer abort a TCP session
because of a SYN flag.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/snmp.h | 2 +-
net/ipv4/proc.c | 2 +-
net/ipv4/tcp_input.c | 32 +++++++++++++++-----------------
3 files changed, 17 insertions(+), 19 deletions(-)
--- a/include/linux/snmp.h
+++ b/include/linux/snmp.h
@@ -208,7 +208,6 @@ enum
LINUX_MIB_TCPDSACKOFOSENT, /* TCPDSACKOfoSent */
LINUX_MIB_TCPDSACKRECV, /* TCPDSACKRecv */
LINUX_MIB_TCPDSACKOFORECV, /* TCPDSACKOfoRecv */
- LINUX_MIB_TCPABORTONSYN, /* TCPAbortOnSyn */
LINUX_MIB_TCPABORTONDATA, /* TCPAbortOnData */
LINUX_MIB_TCPABORTONCLOSE, /* TCPAbortOnClose */
LINUX_MIB_TCPABORTONMEMORY, /* TCPAbortOnMemory */
@@ -235,6 +234,7 @@ enum
LINUX_MIB_TCPRETRANSFAIL, /* TCPRetransFail */
LINUX_MIB_TCPRCVCOALESCE, /* TCPRcvCoalesce */
LINUX_MIB_TCPCHALLENGEACK, /* TCPChallengeACK */
+ LINUX_MIB_TCPSYNCHALLENGE, /* TCPSYNChallenge */
__LINUX_MIB_MAX
};
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -232,7 +232,6 @@ static const struct snmp_mib snmp4_net_l
SNMP_MIB_ITEM("TCPDSACKOfoSent", LINUX_MIB_TCPDSACKOFOSENT),
SNMP_MIB_ITEM("TCPDSACKRecv", LINUX_MIB_TCPDSACKRECV),
SNMP_MIB_ITEM("TCPDSACKOfoRecv", LINUX_MIB_TCPDSACKOFORECV),
- SNMP_MIB_ITEM("TCPAbortOnSyn", LINUX_MIB_TCPABORTONSYN),
SNMP_MIB_ITEM("TCPAbortOnData", LINUX_MIB_TCPABORTONDATA),
SNMP_MIB_ITEM("TCPAbortOnClose", LINUX_MIB_TCPABORTONCLOSE),
SNMP_MIB_ITEM("TCPAbortOnMemory", LINUX_MIB_TCPABORTONMEMORY),
@@ -259,6 +258,7 @@ static const struct snmp_mib snmp4_net_l
SNMP_MIB_ITEM("TCPRetransFail", LINUX_MIB_TCPRETRANSFAIL),
SNMP_MIB_ITEM("TCPRcvCoalesce", LINUX_MIB_TCPRCVCOALESCE),
SNMP_MIB_ITEM("TCPChallengeACK", LINUX_MIB_TCPCHALLENGEACK),
+ SNMP_MIB_ITEM("TCPSYNChallenge", LINUX_MIB_TCPSYNCHALLENGE),
SNMP_MIB_SENTINEL
};
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5288,8 +5288,8 @@ static void tcp_send_challenge_ack(struc
/* Does PAWS and seqno based validation of an incoming segment, flags will
* play significant role here.
*/
-static int tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
- const struct tcphdr *th, int syn_inerr)
+static bool tcp_validate_incoming(struct sock *sk, struct sk_buff *skb,
+ const struct tcphdr *th, int syn_inerr)
{
const u8 *hash_location;
struct tcp_sock *tp = tcp_sk(sk);
@@ -5341,20 +5341,22 @@ static int tcp_validate_incoming(struct
/* step 3: check security and precedence [ignored] */
- /* step 4: Check for a SYN in window. */
- if (th->syn && !before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
+ /* step 4: Check for a SYN
+ * RFC 5691 4.2 : Send a challenge ack
+ */
+ if (th->syn) {
if (syn_inerr)
TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONSYN);
- tcp_reset(sk);
- return -1;
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
+ tcp_send_challenge_ack(sk);
+ goto discard;
}
- return 1;
+ return true;
discard:
__kfree_skb(skb);
- return 0;
+ return false;
}
/*
@@ -5384,7 +5386,6 @@ int tcp_rcv_established(struct sock *sk,
const struct tcphdr *th, unsigned int len)
{
struct tcp_sock *tp = tcp_sk(sk);
- int res;
/*
* Header prediction.
@@ -5564,9 +5565,8 @@ slow_path:
* Standard slow path.
*/
- res = tcp_validate_incoming(sk, skb, th, 1);
- if (res <= 0)
- return -res;
+ if (!tcp_validate_incoming(sk, skb, th, 1))
+ return 0;
step5:
if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
@@ -5876,7 +5876,6 @@ int tcp_rcv_state_process(struct sock *s
struct tcp_sock *tp = tcp_sk(sk);
struct inet_connection_sock *icsk = inet_csk(sk);
int queued = 0;
- int res;
tp->rx_opt.saw_tstamp = 0;
@@ -5931,9 +5930,8 @@ int tcp_rcv_state_process(struct sock *s
return 0;
}
- res = tcp_validate_incoming(sk, skb, th, 0);
- if (res <= 0)
- return -res;
+ if (!tcp_validate_incoming(sk, skb, th, 0))
+ return 0;
/* step 5: check the ACK field */
if (th->ack) {
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 63/80] tcp: refine SYN handling in tcp_validate_incoming
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2013-01-09 20:35 ` [ 62/80] tcp: implement RFC 5961 4.2 Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 64/80] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming() Greg Kroah-Hartman
` (18 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Vijay Subramanian, Eric Dumazet,
Kiran Kumar Kella, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit e371589917011efe6ff8c7dfb4e9e81934ac5855 ]
Followup of commit 0c24604b68fc (tcp: implement RFC 5961 4.2)
As reported by Vijay Subramanian, we should send a challenge ACK
instead of a dup ack if a SYN flag is set on a packet received out of
window.
This permits the ratelimiting to work as intended, and to increase
correct SNMP counters.
Suggested-by: Vijay Subramanian <subramanian.vijay@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Vijay Subramanian <subramanian.vijay@gmail.com>
Cc: Kiran Kumar Kella <kkiran@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5314,8 +5314,11 @@ static bool tcp_validate_incoming(struct
* an acknowledgment should be sent in reply (unless the RST
* bit is set, if so drop the segment and return)".
*/
- if (!th->rst)
+ if (!th->rst) {
+ if (th->syn)
+ goto syn_challenge;
tcp_send_dupack(sk, skb);
+ }
goto discard;
}
@@ -5345,6 +5348,7 @@ static bool tcp_validate_incoming(struct
* RFC 5691 4.2 : Send a challenge ack
*/
if (th->syn) {
+syn_challenge:
if (syn_inerr)
TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNCHALLENGE);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 64/80] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2013-01-09 20:35 ` [ 63/80] tcp: refine SYN handling in tcp_validate_incoming Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 65/80] tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation Greg Kroah-Hartman
` (17 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Eric Dumazet, Neal Cardwell,
Yuchung Cheng, Nandita Dukkipati, H.K. Jerry Chu,
Romain Francoise, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit bd090dfc634ddd711a5fbd0cadc6e0ab4977bcaf ]
We added support for RFC 5961 in latest kernels but TCP fails
to perform exhaustive check of ACK sequence.
We can update our view of peer tsval from a frame that is
later discarded by tcp_ack()
This makes timestamps enabled sessions vulnerable to injection of
a high tsval : peers start an ACK storm, since the victim
sends a dupack each time it receives an ACK from the other peer.
As tcp_validate_incoming() is called before tcp_ack(), we should
not peform tcp_replace_ts_recent() from it, and let callers do it
at the right time.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Nandita Dukkipati <nanditad@google.com>
Cc: H.K. Jerry Chu <hkchu@google.com>
Cc: Romain Francoise <romain@orebokech.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5337,11 +5337,6 @@ static bool tcp_validate_incoming(struct
goto discard;
}
- /* ts_recent update must be made after we are sure that the packet
- * is in window.
- */
- tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
-
/* step 3: check security and precedence [ignored] */
/* step 4: Check for a SYN
@@ -5576,6 +5571,11 @@ step5:
if (th->ack && tcp_ack(sk, skb, FLAG_SLOWPATH) < 0)
goto discard;
+ /* ts_recent update must be made after we are sure that the packet
+ * is in window.
+ */
+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+
tcp_rcv_rtt_measure_ts(sk, skb);
/* Process urgent data. */
@@ -6046,6 +6046,11 @@ int tcp_rcv_state_process(struct sock *s
} else
goto discard;
+ /* ts_recent update must be made after we are sure that the packet
+ * is in window.
+ */
+ tcp_replace_ts_recent(tp, TCP_SKB_CB(skb)->seq);
+
/* step 6: check the URG bit */
tcp_urg(sk, skb, th);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 65/80] tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2013-01-09 20:35 ` [ 64/80] tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming() Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 66/80] ARM: mm: use pteval_t to represent page protection values Greg Kroah-Hartman
` (16 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Eric Dumazet, Neal Cardwell,
Yuchung Cheng, Jerry Chu, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 354e4aa391ed50a4d827ff6fc11e0667d0859b25 ]
RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation]
All TCP stacks MAY implement the following mitigation. TCP stacks
that implement this mitigation MUST add an additional input check to
any incoming segment. The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=
SND.NXT). All incoming segments whose ACK value doesn't satisfy the
above condition MUST be discarded and an ACK sent back.
Move tcp_send_challenge_ack() before tcp_ack() to avoid a forward
declaration.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Jerry Chu <hkchu@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_input.c | 43 +++++++++++++++++++++++++------------------
1 file changed, 25 insertions(+), 18 deletions(-)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3687,6 +3687,24 @@ static int tcp_process_frto(struct sock
return 0;
}
+/* RFC 5961 7 [ACK Throttling] */
+static void tcp_send_challenge_ack(struct sock *sk)
+{
+ /* unprotected vars, we dont care of overwrites */
+ static u32 challenge_timestamp;
+ static unsigned int challenge_count;
+ u32 now = jiffies / HZ;
+
+ if (now != challenge_timestamp) {
+ challenge_timestamp = now;
+ challenge_count = 0;
+ }
+ if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+ tcp_send_ack(sk);
+ }
+}
+
/* This routine deals with incoming acks, but not outgoing ones. */
static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag)
{
@@ -3706,8 +3724,14 @@ static int tcp_ack(struct sock *sk, cons
/* If the ack is older than previous acks
* then we can probably ignore it.
*/
- if (before(ack, prior_snd_una))
+ if (before(ack, prior_snd_una)) {
+ /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */
+ if (before(ack, prior_snd_una - tp->max_window)) {
+ tcp_send_challenge_ack(sk);
+ return -1;
+ }
goto old_ack;
+ }
/* If the ack includes data we haven't sent yet, discard
* this segment (RFC793 Section 3.9).
@@ -5268,23 +5292,6 @@ out:
}
#endif /* CONFIG_NET_DMA */
-static void tcp_send_challenge_ack(struct sock *sk)
-{
- /* unprotected vars, we dont care of overwrites */
- static u32 challenge_timestamp;
- static unsigned int challenge_count;
- u32 now = jiffies / HZ;
-
- if (now != challenge_timestamp) {
- challenge_timestamp = now;
- challenge_count = 0;
- }
- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
- NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
- tcp_send_ack(sk);
- }
-}
-
/* Does PAWS and seqno based validation of an incoming segment, flags will
* play significant role here.
*/
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 66/80] ARM: mm: use pteval_t to represent page protection values
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2013-01-09 20:35 ` [ 65/80] tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:35 ` [ 67/80] ARM: missing ->mmap_sem around find_vma() in swp_emulate.c Greg Kroah-Hartman
` (15 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Nicolas Pitre, Catalin Marinas,
Will Deacon
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 864aa04cd02979c2c755cb28b5f4fe56039171c0 upstream.
When updating the page protection map after calculating the user_pgprot
value, the base protection map is temporarily stored in an unsigned long
type, causing truncation of the protection bits when LPAE is enabled.
This effectively means that calls to mprotect() will corrupt the upper
page attributes, clearing the XN bit unconditionally.
This patch uses pteval_t to store the intermediate protection values,
preserving the upper bits for 64-bit descriptors.
Acked-by: Nicolas Pitre <nico@linaro.org>
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/mmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -497,7 +497,7 @@ static void __init build_mem_type_table(
#endif
for (i = 0; i < 16; i++) {
- unsigned long v = pgprot_val(protection_map[i]);
+ pteval_t v = pgprot_val(protection_map[i]);
protection_map[i] = __pgprot(v | user_pgprot);
}
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 67/80] ARM: missing ->mmap_sem around find_vma() in swp_emulate.c
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2013-01-09 20:35 ` [ 66/80] ARM: mm: use pteval_t to represent page protection values Greg Kroah-Hartman
@ 2013-01-09 20:35 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 68/80] ARM: 7607/1: realview: fix private peripheral memory base for EB rev. B boards Greg Kroah-Hartman
` (14 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Al Viro, Russell King
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@ZenIV.linux.org.uk>
commit 7bf9b7bef881aac820bf1f2e9951a17b09bd7e04 upstream.
find_vma() is *not* safe when somebody else is removing vmas. Not just
the return value might get bogus just as you are getting it (this instance
doesn't try to dereference the resulting vma), the search itself can get
buggered in rather spectacular ways. IOW, ->mmap_sem really, really is
not optional here.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/swp_emulate.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/kernel/swp_emulate.c
+++ b/arch/arm/kernel/swp_emulate.c
@@ -109,10 +109,12 @@ static void set_segfault(struct pt_regs
{
siginfo_t info;
+ down_read(¤t->mm->mmap_sem);
if (find_vma(current->mm, addr) == NULL)
info.si_code = SEGV_MAPERR;
else
info.si_code = SEGV_ACCERR;
+ up_read(¤t->mm->mmap_sem);
info.si_signo = SIGSEGV;
info.si_errno = 0;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 68/80] ARM: 7607/1: realview: fix private peripheral memory base for EB rev. B boards
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2013-01-09 20:35 ` [ 67/80] ARM: missing ->mmap_sem around find_vma() in swp_emulate.c Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 69/80] solos-pci: fix double-free of TX skb in DMA mode Greg Kroah-Hartman
` (13 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Marc Zyngier, Florian Fainelli,
Will Deacon, Russell King
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit e6ee4b2b57a8e0d8e551031173de080b338d3969 upstream.
Commit 34ae6c96a6a7 ("ARM: 7298/1: realview: fix mapping of MPCore
private memory region") accidentally broke the definition for the base
address of the private peripheral region on revision B Realview-EB
boards.
This patch uses the correct address for REALVIEW_EB11MP_PRIV_MEM_BASE.
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Tested-by: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-realview/include/mach/board-eb.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-realview/include/mach/board-eb.h
+++ b/arch/arm/mach-realview/include/mach/board-eb.h
@@ -47,7 +47,7 @@
#define REALVIEW_EB_USB_BASE 0x4F000000 /* USB */
#ifdef CONFIG_REALVIEW_EB_ARM11MP_REVB
-#define REALVIEW_EB11MP_PRIV_MEM_BASE 0x1F000000
+#define REALVIEW_EB11MP_PRIV_MEM_BASE 0x10100000
#define REALVIEW_EB11MP_L220_BASE 0x10102000 /* L220 registers */
#define REALVIEW_EB11MP_SYS_PLD_CTRL1 0xD8 /* Register offset for MPCore sysctl */
#else
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 69/80] solos-pci: fix double-free of TX skb in DMA mode
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2013-01-09 20:36 ` [ 68/80] ARM: 7607/1: realview: fix private peripheral memory base for EB rev. B boards Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 70/80] PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz Greg Kroah-Hartman
` (12 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, David Woodhouse, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw2@infradead.org>
commit cae49ede00ec3d0cda290b03fee55b72b49efc11 upstream.
We weren't clearing card->tx_skb[port] when processing the TX done interrupt.
If there wasn't another skb ready to transmit immediately, this led to a
double-free because we'd free it *again* next time we did have a packet to
send.
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/solos-pci.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -967,10 +967,11 @@ static uint32_t fpga_tx(struct solos_car
for (port = 0; tx_pending; tx_pending >>= 1, port++) {
if (tx_pending & 1) {
struct sk_buff *oldskb = card->tx_skb[port];
- if (oldskb)
+ if (oldskb) {
pci_unmap_single(card->dev, SKB_CB(oldskb)->dma_addr,
oldskb->len, PCI_DMA_TODEVICE);
-
+ card->tx_skb[port] = NULL;
+ }
spin_lock(&card->tx_queue_lock);
skb = skb_dequeue(&card->tx_queue[port]);
if (!skb)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 70/80] PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2013-01-09 20:36 ` [ 69/80] solos-pci: fix double-free of TX skb in DMA mode Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 71/80] Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027] Greg Kroah-Hartman
` (11 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Andy Lutomirski, Bjorn Helgaas,
Chris Ball, Manoj Iyer
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <luto@amacapital.net>
commit 812089e01b9f65f90fc8fc670d8cce72a0e01fbb upstream.
Otherwise it fails like this on cards like the Transcend 16GB SDHC card:
mmc0: new SDHC card at address b368
mmcblk0: mmc0:b368 SDC 15.0 GiB
mmcblk0: error -110 sending status command, retrying
mmcblk0: error -84 transferring data, sector 0, nr 8, cmd response 0x900, card status 0xb0
Tested on my Lenovo x200 laptop.
[bhelgaas: changelog]
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Chris Ball <cjb@laptop.org>
CC: Manoj Iyer <manoj.iyer@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 7 +++++--
include/linux/pci_ids.h | 1 +
2 files changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2708,7 +2708,7 @@ static void ricoh_mmc_fixup_r5c832(struc
if (PCI_FUNC(dev->devfn))
return;
/*
- * RICOH 0xe823 SD/MMC card reader fails to recognize
+ * RICOH 0xe822 and 0xe823 SD/MMC card readers fail to recognize
* certain types of SD/MMC cards. Lowering the SD base
* clock frequency from 200Mhz to 50Mhz fixes this issue.
*
@@ -2719,7 +2719,8 @@ static void ricoh_mmc_fixup_r5c832(struc
* 0xf9 - Key register for 0x150
* 0xfc - key register for 0xe1
*/
- if (dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
+ if (dev->device == PCI_DEVICE_ID_RICOH_R5CE822 ||
+ dev->device == PCI_DEVICE_ID_RICOH_R5CE823) {
pci_write_config_byte(dev, 0xf9, 0xfc);
pci_write_config_byte(dev, 0x150, 0x10);
pci_write_config_byte(dev, 0xf9, 0x00);
@@ -2746,6 +2747,8 @@ static void ricoh_mmc_fixup_r5c832(struc
}
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5C832, ricoh_mmc_fixup_r5c832);
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE822, ricoh_mmc_fixup_r5c832);
+DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE822, ricoh_mmc_fixup_r5c832);
DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
DECLARE_PCI_FIXUP_RESUME_EARLY(PCI_VENDOR_ID_RICOH, PCI_DEVICE_ID_RICOH_R5CE823, ricoh_mmc_fixup_r5c832);
#endif /*CONFIG_MMC_RICOH_MMC*/
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -1565,6 +1565,7 @@
#define PCI_DEVICE_ID_RICOH_RL5C476 0x0476
#define PCI_DEVICE_ID_RICOH_RL5C478 0x0478
#define PCI_DEVICE_ID_RICOH_R5C822 0x0822
+#define PCI_DEVICE_ID_RICOH_R5CE822 0xe822
#define PCI_DEVICE_ID_RICOH_R5CE823 0xe823
#define PCI_DEVICE_ID_RICOH_R5C832 0x0832
#define PCI_DEVICE_ID_RICOH_R5C843 0x0843
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 71/80] Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027]
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2013-01-09 20:36 ` [ 70/80] PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 72/80] Bluetooth: Add missing lock nesting notation Greg Kroah-Hartman
` (10 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Marcos Chaparro, Gustavo Padovan,
Ben Hutchings
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Chaparro <marcos@mrkindustries.com.ar>
commit acd9454433e28c1a365d8b069813c35c1c3a8ac3 upstream.
Added Atheros AR3011 internal bluetooth device found in Sony VAIO VPCEH to the
devices list.
Before this, the bluetooth module was identified as an Foxconn / Hai bluetooth
device [0489:e027], now it claims to be an AtherosAR3011 Bluetooth
[0cf3:3005].
T: Bus=01 Lev=02 Prnt=02 Port=04 Cnt=02 Dev#= 4 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e027 Rev= 0.01
C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
Signed-off-by: Marcos Chaparro <marcos@mrkindustries.com.ar>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/ath3k.c | 1 +
drivers/bluetooth/btusb.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -66,6 +66,7 @@ static struct usb_device_id ath3k_table[
{ USB_DEVICE(0x13d3, 0x3304) },
{ USB_DEVICE(0x0930, 0x0215) },
{ USB_DEVICE(0x0489, 0xE03D) },
+ { USB_DEVICE(0x0489, 0xE027) },
/* Atheros AR9285 Malbec with sflash firmware */
{ USB_DEVICE(0x03F0, 0x311D) },
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -130,6 +130,7 @@ static struct usb_device_id blacklist_ta
{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
/* Atheros AR9285 Malbec with sflash firmware */
{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 72/80] Bluetooth: Add missing lock nesting notation
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2013-01-09 20:36 ` [ 71/80] Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027] Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 73/80] Bluetooth: cancel power_on work when unregistering the device Greg Kroah-Hartman
` (9 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Gustavo Padovan
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
commit dc2a0e20fbc85a71c63aa4330b496fda33f6bf80 upstream.
This patch fixes the following report, it happens when accepting rfcomm
connections:
[ 228.165378] =============================================
[ 228.165378] [ INFO: possible recursive locking detected ]
[ 228.165378] 3.7.0-rc1-00536-gc1d5dc4 #120 Tainted: G W
[ 228.165378] ---------------------------------------------
[ 228.165378] bluetoothd/1341 is trying to acquire lock:
[ 228.165378] (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0000aa0>] bt_accept_dequeue+0xa0/0x180 [bluetooth]
[ 228.165378]
[ 228.165378] but task is already holding lock:
[ 228.165378] (sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM){+.+...}, at:
[<ffffffffa0205118>] rfcomm_sock_accept+0x58/0x2d0 [rfcomm]
[ 228.165378]
[ 228.165378] other info that might help us debug this:
[ 228.165378] Possible unsafe locking scenario:
[ 228.165378]
[ 228.165378] CPU0
[ 228.165378] ----
[ 228.165378] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[ 228.165378] lock(sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM);
[ 228.165378]
[ 228.165378] *** DEADLOCK ***
[ 228.165378]
[ 228.165378] May be due to missing lock nesting notation
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/rfcomm/sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -485,7 +485,7 @@ static int rfcomm_sock_accept(struct soc
long timeo;
int err = 0;
- lock_sock(sk);
+ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
if (sk->sk_type != SOCK_STREAM) {
err = -EINVAL;
@@ -522,7 +522,7 @@ static int rfcomm_sock_accept(struct soc
release_sock(sk);
timeo = schedule_timeout(timeo);
- lock_sock(sk);
+ lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
}
__set_current_state(TASK_RUNNING);
remove_wait_queue(sk_sleep(sk), &wait);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 73/80] Bluetooth: cancel power_on work when unregistering the device
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2013-01-09 20:36 ` [ 72/80] Bluetooth: Add missing lock nesting notation Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 74/80] lib: atomic64: Initialize locks statically to fix early users Greg Kroah-Hartman
` (8 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sasha Levin, Gustavo Padovan
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
commit b9b5ef188e5a2222cfc16ef62a4703080750b451 upstream.
We need to cancel the hci_power_on work in order to avoid it run when we
try to free the hdev.
[ 1434.201149] ------------[ cut here ]------------
[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci
_power_on+0x0/0x90
[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-
20121112-sasha-00018-g2f4ce0e #127
[ 1434.210760] Call Trace:
[ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
[ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
[ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
[ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
[ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
[ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
[ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330
[ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0
[ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
[ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10
[ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60
[ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20
[ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30
[ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
[ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250
[ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
[ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10
[ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0
[ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
[ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17
[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_core.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1866,6 +1866,8 @@ void hci_unregister_dev(struct hci_dev *
for (i = 0; i < NUM_REASSEMBLY; i++)
kfree_skb(hdev->reassembly[i]);
+ cancel_work_sync(&hdev->power_on);
+
if (!test_bit(HCI_INIT, &hdev->flags) &&
!test_bit(HCI_SETUP, &hdev->dev_flags)) {
hci_dev_lock(hdev);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 74/80] lib: atomic64: Initialize locks statically to fix early users
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2013-01-09 20:36 ` [ 73/80] Bluetooth: cancel power_on work when unregistering the device Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 75/80] CRIS: fix I/O macros Greg Kroah-Hartman
` (7 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tony Lindgren, Eric W. Biederman,
Stephen Boyd, Linus Torvalds, Andrew Morton
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <sboyd@codeaurora.org>
commit fcc16882ac4532aaa644bff444f0c5d6228ba71e upstream.
The atomic64 library uses a handful of static spin locks to implement
atomic 64-bit operations on architectures without support for atomic
64-bit instructions.
Unfortunately, the spinlocks are initialized in a pure initcall and that
is too late for the vfs namespace code which wants to use atomic64
operations before the initcall is run.
This became a problem as of commit 8823c079ba71: "vfs: Add setns support
for the mount namespace".
This leads to BUG messages such as:
BUG: spinlock bad magic on CPU#0, swapper/0/0
lock: atomic64_lock+0x240/0x400, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
do_raw_spin_lock+0x158/0x198
_raw_spin_lock_irqsave+0x4c/0x58
atomic64_add_return+0x30/0x5c
alloc_mnt_ns.clone.14+0x44/0xac
create_mnt_ns+0xc/0x54
mnt_init+0x120/0x1d4
vfs_caches_init+0xe0/0x10c
start_kernel+0x29c/0x300
coming out early on during boot when spinlock debugging is enabled.
Fix this by initializing the spinlocks statically at compile time.
Reported-and-tested-by: Vaibhav Bedia <vaibhav.bedia@ti.com>
Tested-by: Tony Lindgren <tony@atomide.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/atomic64.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)
--- a/lib/atomic64.c
+++ b/lib/atomic64.c
@@ -31,7 +31,11 @@
static union {
raw_spinlock_t lock;
char pad[L1_CACHE_BYTES];
-} atomic64_lock[NR_LOCKS] __cacheline_aligned_in_smp;
+} atomic64_lock[NR_LOCKS] __cacheline_aligned_in_smp = {
+ [0 ... (NR_LOCKS - 1)] = {
+ .lock = __RAW_SPIN_LOCK_UNLOCKED(atomic64_lock.lock),
+ },
+};
static inline raw_spinlock_t *lock_addr(const atomic64_t *v)
{
@@ -173,14 +177,3 @@ int atomic64_add_unless(atomic64_t *v, l
return ret;
}
EXPORT_SYMBOL(atomic64_add_unless);
-
-static int init_atomic64_lock(void)
-{
- int i;
-
- for (i = 0; i < NR_LOCKS; ++i)
- raw_spin_lock_init(&atomic64_lock[i].lock);
- return 0;
-}
-
-pure_initcall(init_atomic64_lock);
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 75/80] CRIS: fix I/O macros
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2013-01-09 20:36 ` [ 74/80] lib: atomic64: Initialize locks statically to fix early users Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 76/80] drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield Greg Kroah-Hartman
` (6 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Corey Minyard, Jesper Nilsson,
Mikael Starvik, Geert Uytterhoeven, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <cminyard@mvista.com>
commit c24bf9b4cc6a0f330ea355d73bfdf1dae7e63a05 upstream.
The inb/outb macros for CRIS are broken from a number of points of view,
missing () around parameters and they have an unprotected if statement
in them. This was breaking the compile of IPMI on CRIS and thus I was
being annoyed by build regressions, so I fixed them.
Plus I don't think they would have worked at all, since the data values
were missing "&" and the outsl had a "3" instead of a "4" for the size.
>>From what I can tell, this stuff is not used at all, so this can't be
any more broken than it was before, anyway.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Cc: Jesper Nilsson <jesper.nilsson@axis.com>
Cc: Mikael Starvik <starvik@axis.com>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/cris/include/asm/io.h | 39 +++++++++++++++++++++++++++++++++------
1 file changed, 33 insertions(+), 6 deletions(-)
--- a/arch/cris/include/asm/io.h
+++ b/arch/cris/include/asm/io.h
@@ -133,12 +133,39 @@ static inline void writel(unsigned int b
#define insb(port,addr,count) (cris_iops ? cris_iops->read_io(port,addr,1,count) : 0)
#define insw(port,addr,count) (cris_iops ? cris_iops->read_io(port,addr,2,count) : 0)
#define insl(port,addr,count) (cris_iops ? cris_iops->read_io(port,addr,4,count) : 0)
-#define outb(data,port) if (cris_iops) cris_iops->write_io(port,(void*)(unsigned)data,1,1)
-#define outw(data,port) if (cris_iops) cris_iops->write_io(port,(void*)(unsigned)data,2,1)
-#define outl(data,port) if (cris_iops) cris_iops->write_io(port,(void*)(unsigned)data,4,1)
-#define outsb(port,addr,count) if(cris_iops) cris_iops->write_io(port,(void*)addr,1,count)
-#define outsw(port,addr,count) if(cris_iops) cris_iops->write_io(port,(void*)addr,2,count)
-#define outsl(port,addr,count) if(cris_iops) cris_iops->write_io(port,(void*)addr,3,count)
+static inline void outb(unsigned char data, unsigned int port)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *) &data, 1, 1);
+}
+static inline void outw(unsigned short data, unsigned int port)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *) &data, 2, 1);
+}
+static inline void outl(unsigned int data, unsigned int port)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *) &data, 4, 1);
+}
+static inline void outsb(unsigned int port, const void *addr,
+ unsigned long count)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *)addr, 1, count);
+}
+static inline void outsw(unsigned int port, const void *addr,
+ unsigned long count)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *)addr, 2, count);
+}
+static inline void outsl(unsigned int port, const void *addr,
+ unsigned long count)
+{
+ if (cris_iops)
+ cris_iops->write_io(port, (void *)addr, 4, count);
+}
/*
* Convert a physical pointer to a virtual kernel pointer for /dev/mem
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 76/80] drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2013-01-09 20:36 ` [ 75/80] CRIS: fix I/O macros Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 77/80] drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time Greg Kroah-Hartman
` (5 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Tony Prisk, Edgar Toernig,
Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Prisk <linux@prisktech.co.nz>
commit 532db570e5181abc8f4f7bfa6c77c69ec2240198 upstream.
Control register bitfield for 12H/24H mode is handled incorrectly.
Setting CR_24H actually enables 12H mode. This patch renames the define
and changes the initialization code to correctly set 24H mode.
Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
Cc: Edgar Toernig <froese@gmx.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-vt8500.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/rtc/rtc-vt8500.c
+++ b/drivers/rtc/rtc-vt8500.c
@@ -69,7 +69,7 @@
| ALARM_SEC_BIT)
#define VT8500_RTC_CR_ENABLE (1 << 0) /* Enable RTC */
-#define VT8500_RTC_CR_24H (1 << 1) /* 24h time format */
+#define VT8500_RTC_CR_12H (1 << 1) /* 12h time format */
#define VT8500_RTC_CR_SM_ENABLE (1 << 2) /* Enable periodic irqs */
#define VT8500_RTC_CR_SM_SEC (1 << 3) /* 0: 1Hz/60, 1: 1Hz */
#define VT8500_RTC_CR_CALIB (1 << 4) /* Enable calibration */
@@ -248,7 +248,7 @@ static int __devinit vt8500_rtc_probe(st
}
/* Enable RTC and set it to 24-hour mode */
- writel(VT8500_RTC_CR_ENABLE | VT8500_RTC_CR_24H,
+ writel(VT8500_RTC_CR_ENABLE,
vt8500_rtc->regbase + VT8500_RTC_CR);
vt8500_rtc->rtc = rtc_device_register("vt8500-rtc", &pdev->dev,
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 77/80] drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2013-01-09 20:36 ` [ 76/80] drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 78/80] mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT Greg Kroah-Hartman
` (4 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Edgar Toernig, Tony Prisk,
Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Prisk <linux@prisktech.co.nz>
commit 2f90b68309683f2c5765a1b04ca23d71e51f1494 upstream.
tm_mon is 0..11, whereas vt8500 expects 1..12 for the month field,
causing invalid date errors for January, and causing the day field to
roll over incorrectly.
The century flag is only handled in vt8500_rtc_read_time, but not set in
vt8500_rtc_set_time. This patch corrects the behaviour of the century
flag.
Signed-off-by: Edgar Toernig <froese@gmx.de>
Signed-off-by: Tony Prisk <linux@prisktech.co.nz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-vt8500.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/rtc/rtc-vt8500.c
+++ b/drivers/rtc/rtc-vt8500.c
@@ -118,7 +118,7 @@ static int vt8500_rtc_read_time(struct d
tm->tm_min = bcd2bin((time & TIME_MIN_MASK) >> TIME_MIN_S);
tm->tm_hour = bcd2bin((time & TIME_HOUR_MASK) >> TIME_HOUR_S);
tm->tm_mday = bcd2bin(date & DATE_DAY_MASK);
- tm->tm_mon = bcd2bin((date & DATE_MONTH_MASK) >> DATE_MONTH_S);
+ tm->tm_mon = bcd2bin((date & DATE_MONTH_MASK) >> DATE_MONTH_S) - 1;
tm->tm_year = bcd2bin((date & DATE_YEAR_MASK) >> DATE_YEAR_S)
+ ((date >> DATE_CENTURY_S) & 1 ? 200 : 100);
tm->tm_wday = (time & TIME_DOW_MASK) >> TIME_DOW_S;
@@ -137,8 +137,9 @@ static int vt8500_rtc_set_time(struct de
}
writel((bin2bcd(tm->tm_year - 100) << DATE_YEAR_S)
- | (bin2bcd(tm->tm_mon) << DATE_MONTH_S)
- | (bin2bcd(tm->tm_mday)),
+ | (bin2bcd(tm->tm_mon + 1) << DATE_MONTH_S)
+ | (bin2bcd(tm->tm_mday))
+ | ((tm->tm_year >= 200) << DATE_CENTURY_S),
vt8500_rtc->regbase + VT8500_RTC_DS);
writel((bin2bcd(tm->tm_wday) << TIME_DOW_S)
| (bin2bcd(tm->tm_hour) << TIME_HOUR_S)
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 78/80] mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2013-01-09 20:36 ` [ 77/80] drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 79/80] HID: Add Apple wireless keyboard 2011 ANSI to special driver list Greg Kroah-Hartman
` (3 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Michal Hocko, Mel Gorman, Rik van Riel,
Peter Zijlstra, Andrew Morton, Linus Torvalds
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.cz>
commit 53a59fc67f97374758e63a9c785891ec62324c81 upstream.
Since commit e303297e6c3a ("mm: extended batches for generic
mmu_gather") we are batching pages to be freed until either
tlb_next_batch cannot allocate a new batch or we are done.
This works just fine most of the time but we can get in troubles with
non-preemptible kernel (CONFIG_PREEMPT_NONE or CONFIG_PREEMPT_VOLUNTARY)
on large machines where too aggressive batching might lead to soft
lockups during process exit path (exit_mmap) because there are no
scheduling points down the free_pages_and_swap_cache path and so the
freeing can take long enough to trigger the soft lockup.
The lockup is harmless except when the system is setup to panic on
softlockup which is not that unusual.
The simplest way to work around this issue is to limit the maximum
number of batches in a single mmu_gather. 10k of collected pages should
be safe to prevent from soft lockups (we would have 2ms for one) even if
they are all freed without an explicit scheduling point.
This patch doesn't add any new explicit scheduling points because it
relies on zap_pmd_range during page tables zapping which calls
cond_resched per PMD.
The following lockup has been reported for 3.0 kernel with a huge
process (in order of hundreds gigs but I do know any more details).
BUG: soft lockup - CPU#56 stuck for 22s! [kernel:31053]
Modules linked in: af_packet nfs lockd fscache auth_rpcgss nfs_acl sunrpc mptctl mptbase autofs4 binfmt_misc dm_round_robin dm_multipath bonding cpufreq_conservative cpufreq_userspace cpufreq_powersave pcc_cpufreq mperf microcode fuse loop osst sg sd_mod crc_t10dif st qla2xxx scsi_transport_fc scsi_tgt netxen_nic i7core_edac iTCO_wdt joydev e1000e serio_raw pcspkr edac_core iTCO_vendor_support acpi_power_meter rtc_cmos hpwdt hpilo button container usbhid hid dm_mirror dm_region_hash dm_log linear uhci_hcd ehci_hcd usbcore usb_common scsi_dh_emc scsi_dh_alua scsi_dh_hp_sw scsi_dh_rdac scsi_dh dm_snapshot pcnet32 mii edd dm_mod raid1 ext3 mbcache jbd fan thermal processor thermal_sys hwmon cciss scsi_mod
Supported: Yes
CPU 56
Pid: 31053, comm: kernel Not tainted 3.0.31-0.9-default #1 HP ProLiant DL580 G7
RIP: 0010: _raw_spin_unlock_irqrestore+0x8/0x10
RSP: 0018:ffff883ec1037af0 EFLAGS: 00000206
RAX: 0000000000000e00 RBX: ffffea01a0817e28 RCX: ffff88803ffd9e80
RDX: 0000000000000200 RSI: 0000000000000206 RDI: 0000000000000206
RBP: 0000000000000002 R08: 0000000000000001 R09: ffff887ec724a400
R10: 0000000000000000 R11: dead000000200200 R12: ffffffff8144c26e
R13: 0000000000000030 R14: 0000000000000297 R15: 000000000000000e
FS: 00007ed834282700(0000) GS:ffff88c03f200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 000000000068b240 CR3: 0000003ec13c5000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process kernel (pid: 31053, threadinfo ffff883ec1036000, task ffff883ebd5d4100)
Call Trace:
release_pages+0xc5/0x260
free_pages_and_swap_cache+0x9d/0xc0
tlb_flush_mmu+0x5c/0x80
tlb_finish_mmu+0xe/0x50
exit_mmap+0xbd/0x120
mmput+0x49/0x120
exit_mm+0x122/0x160
do_exit+0x17a/0x430
do_group_exit+0x3d/0xb0
get_signal_to_deliver+0x247/0x480
do_signal+0x71/0x1b0
do_notify_resume+0x98/0xb0
int_signal+0x12/0x17
DWARF2 unwinder stuck at int_signal+0x12/0x17
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Rik van Riel <riel@redhat.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/tlb.h | 9 +++++++++
mm/memory.c | 5 +++++
2 files changed, 14 insertions(+)
--- a/include/asm-generic/tlb.h
+++ b/include/asm-generic/tlb.h
@@ -78,6 +78,14 @@ struct mmu_gather_batch {
#define MAX_GATHER_BATCH \
((PAGE_SIZE - sizeof(struct mmu_gather_batch)) / sizeof(void *))
+/*
+ * Limit the maximum number of mmu_gather batches to reduce a risk of soft
+ * lockups for non-preemptible kernels on huge machines when a lot of memory
+ * is zapped during unmapping.
+ * 10K pages freed at once should be safe even without a preemption point.
+ */
+#define MAX_GATHER_BATCH_COUNT (10000UL/MAX_GATHER_BATCH)
+
/* struct mmu_gather is an opaque type used by the mm code for passing around
* any data needed by arch specific code for tlb_remove_page.
*/
@@ -94,6 +102,7 @@ struct mmu_gather {
struct mmu_gather_batch *active;
struct mmu_gather_batch local;
struct page *__pages[MMU_GATHER_BUNDLE];
+ unsigned int batch_count;
};
#define HAVE_GENERIC_MMU_GATHER
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -182,10 +182,14 @@ static int tlb_next_batch(struct mmu_gat
return 1;
}
+ if (tlb->batch_count == MAX_GATHER_BATCH_COUNT)
+ return 0;
+
batch = (void *)__get_free_pages(GFP_NOWAIT | __GFP_NOWARN, 0);
if (!batch)
return 0;
+ tlb->batch_count++;
batch->next = NULL;
batch->nr = 0;
batch->max = MAX_GATHER_BATCH;
@@ -212,6 +216,7 @@ void tlb_gather_mmu(struct mmu_gather *t
tlb->local.nr = 0;
tlb->local.max = ARRAY_SIZE(tlb->__pages);
tlb->active = &tlb->local;
+ tlb->batch_count = 0;
#ifdef CONFIG_HAVE_RCU_TABLE_FREE
tlb->batch = NULL;
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 79/80] HID: Add Apple wireless keyboard 2011 ANSI to special driver list
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2013-01-09 20:36 ` [ 78/80] mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-09 20:36 ` [ 80/80] can: Do not call dev_put if restart timer is running upon close Greg Kroah-Hartman
` (2 subsequent siblings)
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Ari Pollak, Ben Hutchings, Jiri Kosina
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit f9af7b9edccb87d4d80b58687ab63e58f3b64c4c upstream.
Commit 0a97e1e9f9a6 ('HID: apple: Add Apple wireless keyboard 2011 ANSI PID')
did not update the special driver list in hid-core.c, so hid-generic may
still bind to this device.
Reported-by: Ari Pollak <ari@scvngr.com>
References: http://bugs.debian.org/694546
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1385,6 +1385,7 @@ static const struct hid_device_id hid_ha
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ANSI) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_ISO) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2009_JIS) },
+ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ISO) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_FOUNTAIN_TP_ONLY) },
{ HID_USB_DEVICE(USB_VENDOR_ID_APPLE, USB_DEVICE_ID_APPLE_GEYSER1_TP_ONLY) },
^ permalink raw reply [flat|nested] 83+ messages in thread* [ 80/80] can: Do not call dev_put if restart timer is running upon close
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2013-01-09 20:36 ` [ 79/80] HID: Add Apple wireless keyboard 2011 ANSI to special driver list Greg Kroah-Hartman
@ 2013-01-09 20:36 ` Greg Kroah-Hartman
2013-01-10 18:03 ` [ 00/80] 3.4.25-stable review Shuah Khan
2013-01-11 14:46 ` Satoru Takeuchi
81 siblings, 0 replies; 83+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-09 20:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Alexander Stein, Marc Kleine-Budde
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@systec-electronic.com>
commit ab48b03ec9ae1840a1e427e2375bd0d9d554b4ed upstream.
If the restart timer is running due to BUS-OFF and the device is
disconnected an dev_put will decrease the usage counter to -1 thus
blocking the interface removal, resulting in the following dmesg
lines repeating every 10s:
can: notifier: receive list not found for dev can0
can: notifier: receive list not found for dev can0
can: notifier: receive list not found for dev can0
unregister_netdevice: waiting for can0 to become free. Usage count = -1
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/dev.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -576,8 +576,7 @@ void close_candev(struct net_device *dev
{
struct can_priv *priv = netdev_priv(dev);
- if (del_timer_sync(&priv->restart_timer))
- dev_put(dev);
+ del_timer_sync(&priv->restart_timer);
can_flush_echo_skb(dev);
}
EXPORT_SYMBOL_GPL(close_candev);
^ permalink raw reply [flat|nested] 83+ messages in thread* Re: [ 00/80] 3.4.25-stable review
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2013-01-09 20:36 ` [ 80/80] can: Do not call dev_put if restart timer is running upon close Greg Kroah-Hartman
@ 2013-01-10 18:03 ` Shuah Khan
2013-01-11 14:46 ` Satoru Takeuchi
81 siblings, 0 replies; 83+ messages in thread
From: Shuah Khan @ 2013-01-10 18:03 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, torvalds, akpm, alan
On Wed, Jan 9, 2013 at 1:34 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> Note, there are still a lot of patches submitted for inclusion in the
> stable releases that I have not gotten to yet. I wanted to get this
> release out now, instead of delaying for a week or so while I dig
> through all of the pending patches.
>
> This is the start of the stable review cycle for the 3.4.25 release.
> There are 80 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri Jan 11 20:13:17 UTC 2013.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.25-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Patches applied cleanly to 3.0.y, 3.4.y, and 3.7.y.
Compiled and booted on the following systems:
HP EliteBook 6930p Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics
Cross-compile tests:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.7.y
c6x: not applicable to 3.0.y, defconfig passed on the rest three
mips: defconfig passed on all
mipsel: defconfig passed on all
powerpc: wii_defconfig passed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile: tilegx_defconfig passed on all
-- Shuah
^ permalink raw reply [flat|nested] 83+ messages in thread* Re: [ 00/80] 3.4.25-stable review
2013-01-09 20:34 [ 00/80] 3.4.25-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2013-01-10 18:03 ` [ 00/80] 3.4.25-stable review Shuah Khan
@ 2013-01-11 14:46 ` Satoru Takeuchi
81 siblings, 0 replies; 83+ messages in thread
From: Satoru Takeuchi @ 2013-01-11 14:46 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, torvalds, akpm, alan
At Wed, 9 Jan 2013 12:34:52 -0800,
Greg Kroah-Hartman wrote:
>
> Note, there are still a lot of patches submitted for inclusion in the
> stable releases that I have not gotten to yet. I wanted to get this
> release out now, instead of delaying for a week or so while I dig
> through all of the pending patches.
>
> This is the start of the stable review cycle for the 3.4.25 release.
> There are 80 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
This kernel can be built and boot without any problem.
Building a kernel with this kernel also works fine.
- Build Machine: debian wheezy x86_64
CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
memory: 8GB
- Test machine: debian wheezy x86_64(KVM guest on the Build Machine)
vCPU: x2
memory: 2GB
Thanks,
Satoru
>
> Responses should be made by Fri Jan 11 20:13:17 UTC 2013.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.25-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 3.4.25-rc1
>
> Alexander Stein <alexander.stein@systec-electronic.com>
> can: Do not call dev_put if restart timer is running upon close
>
> Ben Hutchings <ben@decadent.org.uk>
> HID: Add Apple wireless keyboard 2011 ANSI to special driver list
>
> Michal Hocko <mhocko@suse.cz>
> mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT
>
> Tony Prisk <linux@prisktech.co.nz>
> drivers/rtc/rtc-vt8500.c: fix handling of data passed in struct rtc_time
>
> Tony Prisk <linux@prisktech.co.nz>
> drivers/rtc/rtc-vt8500.c: correct handling of CR_24H bitfield
>
> Corey Minyard <cminyard@mvista.com>
> CRIS: fix I/O macros
>
> Stephen Boyd <sboyd@codeaurora.org>
> lib: atomic64: Initialize locks statically to fix early users
>
> Gustavo Padovan <gustavo.padovan@collabora.co.uk>
> Bluetooth: cancel power_on work when unregistering the device
>
> Gustavo Padovan <gustavo.padovan@collabora.co.uk>
> Bluetooth: Add missing lock nesting notation
>
> Marcos Chaparro <marcos@mrkindustries.com.ar>
> Bluetooth: ath3k: Add support for VAIO VPCEH [0489:e027]
>
> Andy Lutomirski <luto@amacapital.net>
> PCI: Reduce Ricoh 0xe822 SD card reader base clock frequency to 50MHz
>
> David Woodhouse <dwmw2@infradead.org>
> solos-pci: fix double-free of TX skb in DMA mode
>
> Will Deacon <will.deacon@arm.com>
> ARM: 7607/1: realview: fix private peripheral memory base for EB rev. B boards
>
> Al Viro <viro@ZenIV.linux.org.uk>
> ARM: missing ->mmap_sem around find_vma() in swp_emulate.c
>
> Will Deacon <will.deacon@arm.com>
> ARM: mm: use pteval_t to represent page protection values
>
> Eric Dumazet <edumazet@google.com>
> tcp: RFC 5961 5.2 Blind Data Injection Attack Mitigation
>
> Eric Dumazet <edumazet@google.com>
> tcp: tcp_replace_ts_recent() should not be called from tcp_validate_incoming()
>
> Eric Dumazet <edumazet@google.com>
> tcp: refine SYN handling in tcp_validate_incoming
>
> Eric Dumazet <edumazet@google.com>
> tcp: implement RFC 5961 4.2
>
> Eric Dumazet <edumazet@google.com>
> tcp: implement RFC 5961 3.2
>
> Eric Dumazet <edumazet@google.com>
> tcp: fix MSG_SENDPAGE_NOTLAST logic
>
> Stefan Hasko <hasko.stevo@gmail.com>
> net: sched: integer overflow fix
>
> Christoph Paasch <christoph.paasch@uclouvain.be>
> inet: Fix kmemleak in tcp_v4/6_syn_recv_sock and dccp_v4/6_request_recv_sock
>
> Akinobu Mita <akinobu.mita@gmail.com>
> batman-adv: fix random jitter calculation
>
> Dave Kleikamp <dave.kleikamp@oracle.com>
> sparc: huge_ptep_set_* functions need to call set_huge_pte_at()
>
> Andre Przywara <andre.przywara@amd.com>
> x86, amd: Disable way access filter on Piledriver CPUs
>
> Tejun Heo <tj@kernel.org>
> freezer: add missing mb's to freezer_count() and freezer_should_skip()
>
> Tejun Heo <tj@kernel.org>
> cgroup: remove incorrect dget/dput() pair in cgroup_create_dir()
>
> Russell Webb <russell.webb@linux.intel.com>
> xhci: Add Lynx Point LP to list of Intel switchable hosts
>
> Alexis R. Cortes <alexis.cortes@ti.com>
> usb: host: xhci: Stricter conditional for Z1 system models for Compliance Mode Patch
>
> Julius Werner <jwerner@chromium.org>
> xhci: fix null-pointer dereference when destroying half-built segment rings
>
> Sarah Sharp <sarah.a.sharp@linux.intel.com>
> xHCI: Fix TD Size calculation on 1.0 hosts.
>
> Sarah Sharp <sarah.a.sharp@linux.intel.com>
> xhci: Fix conditional check in bandwidth calculation.
>
> Sergei Shtylyov <sshtylyov@ru.mvista.com>
> usb: musb: cppi_dma: export cppi_interrupt()
>
> Thomas Gleixner <tglx@linutronix.de>
> genirq: Always force thread affinity
>
> Christophe TORDEUX <christophe@tordeux.net>
> Input: sentelic - only report position of first finger as ST coordinates
>
> Peter Popovec <popovec@oko.fei.tuke.sk>
> Input: walkera0701 - fix crash on startup
>
> Xi Wang <xi.wang@gmail.com>
> nfs: fix null checking in nfs_get_option_str()
>
> Neil Brown <neilb@suse.de>
> nfsd: avoid permission checks on EXCLUSIVE_CREATE replay
>
> J. Bruce Fields <bfields@redhat.com>
> nfsd4: fix oops on unusual readlike compound
>
> J. Bruce Fields <bfields@redhat.com>
> nfsd: fix v4 reply caching
>
> Yanchuan Nian <ycnian@gmail.com>
> nfs: fix wrong object type in lockowner_slab
>
> Trond Myklebust <Trond.Myklebust@netapp.com>
> NFS: Fix calls to drop_nlink()
>
> NeilBrown <neilb@suse.de>
> NFS: avoid NULL dereference in nfs_destroy_server
>
> Bryan Schumaker <bjschuma@netapp.com>
> NFS: Add sequence_priviliged_ops for nfs4_proc_sequence()
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> ACPI / scan: Do not use dummy HID for system bus ACPI nodes
>
> Zhang Rui <rui.zhang@intel.com>
> ACPI: do acpisleep dmi check when CONFIG_ACPI_SLEEP is set
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> usb: gadget: network: fix bind() error path
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> usb: gadget: uvc: fix error path in uvc_function_bind()
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> usb: gadget: phonet: free requests in pn_bind()'s error path
>
> Sebastian Andrzej Siewior <bigeasy@linutronix.de>
> usb: gadget: midi: free hs descriptors
>
> Christian Lamparter <chunkeey@googlemail.com>
> p54usb: add USBIDs for two more p54usb devices
>
> Tomasz Guszkowski <tsg@o2.pl>
> p54usb: add USB ID for T-Com Sinus 154 data II
>
> Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
> rtlwifi: fix incorrect use of usb_alloc_coherent with usb_control_msg
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: hda - Fix pin configuration of HP Pavilion dv7
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: hda - Fix the wrong pincaps set in ALC861VD dallas/hp fixup
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Fix missing autopm for MIDI input
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Avoid autopm calls after disconnection
>
> Hugh Dickins <hughd@google.com>
> tmpfs mempolicy: fix /proc/mounts corrupting memory
>
> Christoffer Dall <cdall@cs.columbia.edu>
> mm: Fix PageHead when !CONFIG_PAGEFLAGS_EXTENDED
>
> Sonny Rao <sonnyrao@chromium.org>
> mm: fix calculation of dirtyable memory
>
> Will Deacon <will.deacon@arm.com>
> virtio: force vring descriptors to be allocated from lowmem
>
> Ondrej Zary <linux@rainbow-software.org>
> x86, 8042: Enable A20 using KBC to fix S3 resume on some MSI laptops
>
> Kees Cook <keescook@chromium.org>
> exec: do not leave bprm->interp on stack
>
> Robin Holt <holt@sgi.com>
> SGI-XP: handle non-fatal traps
>
> Alan Cox <alan@lxorguk.ukuu.org.uk>
> pnpacpi: fix incorrect TEST_ALPHA() test
>
> Felix Fietkau <nbd@openwrt.org>
> b43: fix tx path skb leaks
>
> Larry Finger <Larry.Finger@lwfinger.net>
> b43legacy: Fix firmware loading when driver is built into the kernel
>
> Neal Cardwell <ncardwell@google.com>
> inet_diag: validate port comparison byte code to prevent unsafe reads
>
> Neal Cardwell <ncardwell@google.com>
> inet_diag: avoid unsafe and nonsensical prefix matches in inet_diag_bc_run()
>
> Neal Cardwell <ncardwell@google.com>
> inet_diag: validate byte code to prevent oops in inet_diag_bc_run()
>
> Neal Cardwell <ncardwell@google.com>
> inet_diag: fix oops for IPv4 AF_INET6 TCP SYN-RECV state
>
> Jay Purohit <jspurohit@velocitylimitless.com>
> usb/ipheth: Add iPhone 5 support
>
> Johannes Berg <johannes.berg@intel.com>
> ipv4: ip_check_defrag must not modify skb before unsharing
>
> Alexander Shiyan <shc_work@mail.ru>
> irda: sir_dev: Fix copy/paste typo
>
> Alan Cox <alan@linux.intel.com>
> ne2000: add the right platform device
>
> Tommi Rantala <tt.rantala@gmail.com>
> sctp: fix -ENOMEM result with invalid user space pointer in sendto() syscall
>
> Tommi Rantala <tt.rantala@gmail.com>
> sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space fails
>
> nikolay@redhat.com <nikolay@redhat.com>
> bonding: fix race condition in bonding_store_slaves_active
>
> Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
> bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
>
>
> -------------
>
> Diffstat:
>
> Documentation/networking/ip-sysctl.txt | 5 +
> Makefile | 4 +-
> arch/arm/kernel/swp_emulate.c | 2 +
> arch/arm/mach-realview/include/mach/board-eb.h | 2 +-
> arch/arm/mm/mmu.c | 2 +-
> arch/cris/include/asm/io.h | 39 ++-
> arch/sparc/include/asm/hugetlb.h | 10 +-
> arch/x86/kernel/cpu/amd.c | 14 +
> drivers/acpi/scan.c | 2 +-
> drivers/acpi/sleep.c | 348 +++++++++++++------------
> drivers/atm/solos-pci.c | 5 +-
> drivers/bluetooth/ath3k.c | 1 +
> drivers/bluetooth/btusb.c | 1 +
> drivers/hid/hid-core.c | 1 +
> drivers/input/joystick/walkera0701.c | 7 +-
> drivers/input/mouse/sentelic.c | 2 +-
> drivers/input/serio/i8042-x86ia64io.h | 9 +
> drivers/misc/sgi-xp/xpc_main.c | 34 ++-
> drivers/net/bonding/bond_main.c | 7 +
> drivers/net/bonding/bond_sysfs.c | 2 +
> drivers/net/can/dev.c | 3 +-
> drivers/net/ethernet/8390/ne.c | 1 +
> drivers/net/irda/sir_dev.c | 2 +-
> drivers/net/usb/ipheth.c | 5 +
> drivers/net/wireless/b43/dma.c | 7 +-
> drivers/net/wireless/b43/main.c | 12 +-
> drivers/net/wireless/b43/pio.c | 4 +-
> drivers/net/wireless/b43legacy/b43legacy.h | 5 +
> drivers/net/wireless/b43legacy/main.c | 37 ++-
> drivers/net/wireless/p54/p54usb.c | 4 +
> drivers/net/wireless/rtlwifi/usb.c | 7 +-
> drivers/pci/quirks.c | 7 +-
> drivers/pnp/pnpacpi/core.c | 2 +-
> drivers/rtc/rtc-vt8500.c | 11 +-
> drivers/usb/gadget/f_ecm.c | 4 +-
> drivers/usb/gadget/f_eem.c | 5 +-
> drivers/usb/gadget/f_midi.c | 1 +
> drivers/usb/gadget/f_ncm.c | 4 +-
> drivers/usb/gadget/f_phonet.c | 8 +-
> drivers/usb/gadget/f_rndis.c | 4 +-
> drivers/usb/gadget/f_subset.c | 4 +-
> drivers/usb/gadget/f_uvc.c | 39 +--
> drivers/usb/host/ehci-pci.c | 3 +-
> drivers/usb/host/pci-quirks.c | 4 +-
> drivers/usb/host/xhci-mem.c | 9 +-
> drivers/usb/host/xhci-ring.c | 32 ++-
> drivers/usb/host/xhci.c | 4 +-
> drivers/usb/musb/cppi_dma.c | 1 +
> drivers/virtio/virtio_ring.c | 7 +
> fs/binfmt_misc.c | 5 +-
> fs/binfmt_script.c | 4 +-
> fs/exec.c | 15 ++
> fs/nfs/client.c | 3 +-
> fs/nfs/dir.c | 11 +-
> fs/nfs/nfs4proc.c | 21 +-
> fs/nfs/super.c | 2 +-
> fs/nfsd/nfs4proc.c | 8 +-
> fs/nfsd/nfs4state.c | 2 +-
> fs/nfsd/nfs4xdr.c | 11 +-
> fs/nfsd/nfssvc.c | 2 +-
> fs/nfsd/vfs.c | 10 +-
> fs/splice.c | 4 +-
> include/asm-generic/tlb.h | 9 +
> include/linux/binfmts.h | 1 +
> include/linux/freezer.h | 50 +++-
> include/linux/page-flags.h | 8 +-
> include/linux/pci_ids.h | 1 +
> include/linux/snmp.h | 3 +-
> include/net/inet_connection_sock.h | 1 +
> include/net/tcp.h | 1 +
> kernel/cgroup.c | 2 -
> kernel/irq/manage.c | 23 +-
> lib/atomic64.c | 17 +-
> mm/memory.c | 5 +
> mm/mempolicy.c | 64 ++---
> mm/page-writeback.c | 25 +-
> net/batman-adv/bat_iv_ogm.c | 2 +-
> net/bluetooth/hci_core.c | 2 +
> net/bluetooth/rfcomm/sock.c | 4 +-
> net/dccp/ipv4.c | 4 +-
> net/dccp/ipv6.c | 3 +-
> net/ipv4/inet_connection_sock.c | 16 ++
> net/ipv4/inet_diag.c | 154 ++++++++---
> net/ipv4/ip_fragment.c | 19 +-
> net/ipv4/proc.c | 3 +-
> net/ipv4/sysctl_net_ipv4.c | 7 +
> net/ipv4/tcp_input.c | 93 +++++--
> net/ipv4/tcp_ipv4.c | 6 +-
> net/ipv6/tcp_ipv6.c | 3 +-
> net/sched/sch_htb.c | 2 +-
> net/sctp/chunk.c | 20 +-
> net/sctp/socket.c | 4 +-
> sound/pci/hda/patch_realtek.c | 4 +-
> sound/pci/hda/patch_sigmatel.c | 2 +-
> sound/usb/midi.c | 91 ++++---
> 95 files changed, 993 insertions(+), 487 deletions(-)
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] 83+ messages in thread