* [ 01/21] sh: Fix FDPIC binary loader
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 02/21] tcm_fc: Do not indicate retry capability to initiators Greg Kroah-Hartman
` (21 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Thomas Schwinge, Paul Mundt
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Schwinge <thomas@codesourcery.com>
commit 4a71997a3279a339e7336ea5d0cd27282e2dea44 upstream.
Ensure that the aux table is properly initialized, even when optional features
are missing. Without this, the FDPIC loader did not work. This was meant to
be included in commit d5ab780305bb6d60a7b5a74f18cf84eb6ad153b1.
Signed-off-by: Thomas Schwinge <thomas@codesourcery.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sh/include/asm/elf.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/sh/include/asm/elf.h
+++ b/arch/sh/include/asm/elf.h
@@ -202,9 +202,9 @@ extern void __kernel_vsyscall;
if (vdso_enabled) \
NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
else \
- NEW_AUX_ENT(AT_IGNORE, 0);
+ NEW_AUX_ENT(AT_IGNORE, 0)
#else
-#define VSYSCALL_AUX_ENT
+#define VSYSCALL_AUX_ENT NEW_AUX_ENT(AT_IGNORE, 0)
#endif /* CONFIG_VSYSCALL */
#ifdef CONFIG_SH_FPU
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 02/21] tcm_fc: Do not indicate retry capability to initiators
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
2013-01-19 1:19 ` [ 01/21] sh: Fix FDPIC binary loader Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 03/21] tcm_fc: Do not report target role when target is not defined Greg Kroah-Hartman
` (20 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Mark Rustad, Bhanu Prakash Gollapudi,
Nicholas Bellinger
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <mark.d.rustad@intel.com>
commit f2eeba214bcd0215b7f558cab6420e5fd153042b upstream.
When generating a PRLI response to an initiator, clear the
FCP_SPPF_RETRY bit in the response.
Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Acked by Robert Love <robert.w.love@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/tcm_fc/tfc_sess.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -397,10 +397,10 @@ static int ft_prli_locked(struct fc_rpor
/*
* OR in our service parameters with other provider (initiator), if any.
- * TBD XXX - indicate RETRY capability?
*/
fill:
fcp_parm = ntohl(spp->spp_params);
+ fcp_parm &= ~FCP_SPPF_RETRY;
spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
return FC_SPP_RESP_ACK;
}
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 03/21] tcm_fc: Do not report target role when target is not defined
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
2013-01-19 1:19 ` [ 01/21] sh: Fix FDPIC binary loader Greg Kroah-Hartman
2013-01-19 1:19 ` [ 02/21] tcm_fc: Do not indicate retry capability to initiators Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 04/21] target: Release se_cmd when LUN lookup fails for TMR Greg Kroah-Hartman
` (19 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Mark Rustad, Bhanu Prakash Gollapudi,
Nicholas Bellinger
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rustad <mark.d.rustad@intel.com>
commit edec8dfefa1f372b2dd8197da555352e76a10c03 upstream.
Clear the target role when no target is provided for
the node performing a PRLI.
Signed-off-by: Mark Rustad <mark.d.rustad@intel.com>
Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com>
Acked by Robert Love <robert.w.love@intel.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/tcm_fc/tfc_sess.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -356,11 +356,11 @@ static int ft_prli_locked(struct fc_rpor
tport = ft_tport_create(rdata->local_port);
if (!tport)
- return 0; /* not a target for this local port */
+ goto not_target; /* not a target for this local port */
acl = ft_acl_get(tport->tpg, rdata);
if (!acl)
- return 0;
+ goto not_target; /* no target for this remote */
if (!rspp)
goto fill;
@@ -403,6 +403,12 @@ fill:
fcp_parm &= ~FCP_SPPF_RETRY;
spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
return FC_SPP_RESP_ACK;
+
+not_target:
+ fcp_parm = ntohl(spp->spp_params);
+ fcp_parm &= ~FCP_SPPF_TARG_FCN;
+ spp->spp_params = htonl(fcp_parm);
+ return 0;
}
/**
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 04/21] target: Release se_cmd when LUN lookup fails for TMR
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2013-01-19 1:19 ` [ 03/21] tcm_fc: Do not report target role when target is not defined Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 05/21] s390/time: fix sched_clock() overflow Greg Kroah-Hartman
` (18 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Roland Dreier, Nicholas Bellinger
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <roland@purestorage.com>
commit 5a3b6fc0092c5f8dee7820064ee54d2631d48573 upstream.
When transport_lookup_tmr_lun() fails and we return a task management
response from target_complete_tmr_failure(), we need to call
transport_cmd_check_stop_to_fabric() to release the last ref to the
cmd after calling se_tfo->queue_tm_rsp(), or else we will never remove
the failed TMR from the session command list (and we'll end up waiting
forever when trying to tear down the session).
(nab: Fix minor compile breakage)
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_transport.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1748,6 +1748,8 @@ static void target_complete_tmr_failure(
se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST;
se_cmd->se_tfo->queue_tm_rsp(se_cmd);
+
+ transport_cmd_check_stop_to_fabric(se_cmd);
}
/**
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 05/21] s390/time: fix sched_clock() overflow
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2013-01-19 1:19 ` [ 04/21] target: Release se_cmd when LUN lookup fails for TMR Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 06/21] x86/Sandy Bridge: reserve pages when integrated graphics is present Greg Kroah-Hartman
` (17 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Martin Schwidefsky, Heiko Carstens
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit ed4f20943cd4c7b55105c04daedf8d63ab6d499c upstream.
Converting a 64 Bit TOD format value to nanoseconds means that the value
must be divided by 4.096. In order to achieve that we multiply with 125
and divide by 512.
When used within sched_clock() this triggers an overflow after appr.
417 days. Resulting in a sched_clock() return value that is much smaller
than previously and therefore may cause all sort of weird things in
subsystems that rely on a monotonic sched_clock() behaviour.
To fix this implement a tod_to_ns() helper function which converts TOD
values without overflow and call this function from both places that
open coded the conversion: sched_clock() and kvm_s390_handle_wait().
Reviewed-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/timex.h | 28 ++++++++++++++++++++++++++++
arch/s390/kernel/time.c | 2 +-
arch/s390/kvm/interrupt.c | 2 +-
3 files changed, 30 insertions(+), 2 deletions(-)
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -137,4 +137,32 @@ static inline unsigned long long get_clo
return get_clock_xt() - sched_clock_base_cc;
}
+/**
+ * tod_to_ns - convert a TOD format value to nanoseconds
+ * @todval: to be converted TOD format value
+ * Returns: number of nanoseconds that correspond to the TOD format value
+ *
+ * Converting a 64 Bit TOD format value to nanoseconds means that the value
+ * must be divided by 4.096. In order to achieve that we multiply with 125
+ * and divide by 512:
+ *
+ * ns = (todval * 125) >> 9;
+ *
+ * In order to avoid an overflow with the multiplication we can rewrite this.
+ * With a split todval == 2^32 * th + tl (th upper 32 bits, tl lower 32 bits)
+ * we end up with
+ *
+ * ns = ((2^32 * th + tl) * 125 ) >> 9;
+ * -> ns = (2^23 * th * 125) + ((tl * 125) >> 9);
+ *
+ */
+static inline unsigned long long tod_to_ns(unsigned long long todval)
+{
+ unsigned long long ns;
+
+ ns = ((todval >> 32) << 23) * 125;
+ ns += ((todval & 0xffffffff) * 125) >> 9;
+ return ns;
+}
+
#endif
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -64,7 +64,7 @@ static DEFINE_PER_CPU(struct clock_event
*/
unsigned long long notrace __kprobes sched_clock(void)
{
- return (get_clock_monotonic() * 125) >> 9;
+ return tod_to_ns(get_clock_monotonic());
}
/*
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -390,7 +390,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu
return 0;
}
- sltime = ((vcpu->arch.sie_block->ckc - now)*125)>>9;
+ sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now);
hrtimer_start(&vcpu->arch.ckc_timer, ktime_set (0, sltime) , HRTIMER_MODE_REL);
VCPU_EVENT(vcpu, 5, "enabled wait via clock comparator: %llx ns", sltime);
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 06/21] x86/Sandy Bridge: reserve pages when integrated graphics is present
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2013-01-19 1:19 ` [ 05/21] s390/time: fix sched_clock() overflow Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 07/21] ALSA: usb - fix race in creation of M-Audio Fast track pro driver Greg Kroah-Hartman
` (16 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Jesse Barnes, H. Peter Anvin, CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Barnes <jbarnes@virtuousgeek.org>
commit a9acc5365dbda29f7be2884efb63771dc24bd815 upstream.
SNB graphics devices have a bug that prevent them from accessing certain
memory ranges, namely anything below 1M and in the pages listed in the
table. So reserve those at boot if set detect a SNB gfx device on the
CPU to avoid GPU hangs.
Stephane Marchesin had a similar patch to the page allocator awhile
back, but rather than reserving pages up front, it leaked them at
allocation time.
[ hpa: made a number of stylistic changes, marked arrays as static
const, and made less verbose; use "memblock=debug" for full
verbosity. ]
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Cc: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/setup.c | 78 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 78 insertions(+)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -620,6 +620,81 @@ static __init void reserve_ibft_region(v
static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10;
+static bool __init snb_gfx_workaround_needed(void)
+{
+ int i;
+ u16 vendor, devid;
+ static const u16 snb_ids[] = {
+ 0x0102,
+ 0x0112,
+ 0x0122,
+ 0x0106,
+ 0x0116,
+ 0x0126,
+ 0x010a,
+ };
+
+ /* Assume no if something weird is going on with PCI */
+ if (!early_pci_allowed())
+ return false;
+
+ vendor = read_pci_config_16(0, 2, 0, PCI_VENDOR_ID);
+ if (vendor != 0x8086)
+ return false;
+
+ devid = read_pci_config_16(0, 2, 0, PCI_DEVICE_ID);
+ for (i = 0; i < ARRAY_SIZE(snb_ids); i++)
+ if (devid == snb_ids[i])
+ return true;
+
+ return false;
+}
+
+/*
+ * Sandy Bridge graphics has trouble with certain ranges, exclude
+ * them from allocation.
+ */
+static void __init trim_snb_memory(void)
+{
+ static const unsigned long bad_pages[] = {
+ 0x20050000,
+ 0x20110000,
+ 0x20130000,
+ 0x20138000,
+ 0x40004000,
+ };
+ int i;
+
+ if (!snb_gfx_workaround_needed())
+ return;
+
+ printk(KERN_DEBUG "reserving inaccessible SNB gfx pages\n");
+
+ /*
+ * Reserve all memory below the 1 MB mark that has not
+ * already been reserved.
+ */
+ memblock_reserve(0, 1<<20);
+
+ for (i = 0; i < ARRAY_SIZE(bad_pages); i++) {
+ if (memblock_reserve(bad_pages[i], PAGE_SIZE))
+ printk(KERN_WARNING "failed to reserve 0x%08lx\n",
+ bad_pages[i]);
+ }
+}
+
+/*
+ * Here we put platform-specific memory range workarounds, i.e.
+ * memory known to be corrupt or otherwise in need to be reserved on
+ * specific platforms.
+ *
+ * If this gets used more widely it could use a real dispatch mechanism.
+ */
+static void __init trim_platform_memory_ranges(void)
+{
+ trim_snb_memory();
+}
+
static void __init trim_bios_range(void)
{
/*
@@ -640,6 +715,7 @@ static void __init trim_bios_range(void)
* take them out.
*/
e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
+
sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
}
@@ -919,6 +995,8 @@ void __init setup_arch(char **cmdline_p)
setup_trampolines();
+ trim_platform_memory_ranges();
+
init_gbpages();
/* max_pfn_mapped is updated here */
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 07/21] ALSA: usb - fix race in creation of M-Audio Fast track pro driver
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2013-01-19 1:19 ` [ 06/21] x86/Sandy Bridge: reserve pages when integrated graphics is present Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 08/21] ext4: init pagevec in ext4_da_block_invalidatepages Greg Kroah-Hartman
` (15 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, David Henningsson, Takashi Iwai,
CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit b98ae2729dea161edc96c9d177459b6c28bcbba5 upstream.
A patch in the 3.2 kernel caused regression with hotplugging the
M-Audio Fast track pro, or sound after suspend. I don't have the
device so I haven't done a full analysis, but it seems userspace
(both udev and pulseaudio) got confused when a card was created,
immediately destroyed, and then created again.
However, at least one person in the bug report (martin djfun)
reports that this patch resolves the issue for him. It also leaves
a message in the log:
"snd-usb-audio: probe of 1-1.1:1.1 failed with error -5" which is
a bit misleading. It is better than non-working audio, but maybe
there's a more elegant solution?
BugLink: https://bugs.launchpad.net/bugs/1095315
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -387,11 +387,13 @@ static int snd_usb_fasttrackpro_boot_qui
* rules
*/
err = usb_driver_set_configuration(dev, 2);
- if (err < 0) {
+ if (err < 0)
snd_printdd("error usb_driver_set_configuration: %d\n",
err);
- return -ENODEV;
- }
+ /* Always return an error, so that we stop creating a device
+ that will just be destroyed and recreated with a new
+ configuration */
+ return -ENODEV;
} else
snd_printk(KERN_INFO "usb-audio: Fast Track Pro config OK\n");
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 08/21] ext4: init pagevec in ext4_da_block_invalidatepages
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2013-01-19 1:19 ` [ 07/21] ALSA: usb - fix race in creation of M-Audio Fast track pro driver Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 09/21] r8169: avoid NAPI scheduling delay Greg Kroah-Hartman
` (14 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Lukas Czerner, Carlos Maiolino,
Eric Sandeen, Theodore Tso, CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <sandeen@redhat.com>
commit 66bea92c69477a75a5d37b9bfed5773c92a3c4b4 upstream.
ext4_da_block_invalidatepages is missing a pagevec_init(),
which means that pvec->cold contains random garbage.
This affects whether the page goes to the front or
back of the LRU when ->cold makes it to
free_hot_cold_page()
Reviewed-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1424,6 +1424,8 @@ static void ext4_da_block_invalidatepage
index = mpd->first_page;
end = mpd->next_page - 1;
+
+ pagevec_init(&pvec, 0);
while (index <= end) {
nr_pages = pagevec_lookup(&pvec, mapping, index, PAGEVEC_SIZE);
if (nr_pages == 0)
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 09/21] r8169: avoid NAPI scheduling delay.
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2013-01-19 1:19 ` [ 08/21] ext4: init pagevec in ext4_da_block_invalidatepages Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 10/21] target: Add link_magic for fabric allow_link destination target_items Greg Kroah-Hartman
` (13 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Francois Romieu, Dave Jones,
Marc Dionne, Thomas Gleixner, Hayes Wang, David S. Miller
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francois Romieu <romieu@fr.zoreil.com>
commit 7dbb491878a2c51d372a8890fa45a8ff80358af1 upstream.
While reworking the r8169 driver a few months ago to perform the
smallest amount of work in the irq handler, I took care of avoiding
any irq mask register operation in the slow work dedicated user
context thread. The slow work thread scheduled an extra round of NAPI
work which would ultimately set the irq mask register as required,
thus keeping such irq mask operations in the NAPI handler.
It would eventually race with the irq handler and delay NAPI execution
for - assuming no further irq - a whole ksoftirqd period. Mildly a
problem for rare link changes or corner case PCI events.
The race was always lost after the last bh disabling lock had been
removed from the work thread and people started wondering where those
pesky "NOHZ: local_softirq_pending 08" messages came from.
Actually the irq mask register _can_ be set up directly in the slow
work thread.
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Reported-by: Dave Jones <davej@redhat.com>
Tested-by: Marc Dionne <marc.c.dionne@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
drivers/net/ethernet/realtek/r8169.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5516,11 +5516,7 @@ static void rtl_slow_event_work(struct r
if (status & LinkChg)
__rtl8169_check_link_status(dev, tp, tp->mmio_addr, true);
- napi_disable(&tp->napi);
- rtl_irq_disable(tp);
-
- napi_enable(&tp->napi);
- napi_schedule(&tp->napi);
+ rtl_irq_enable_all(tp);
}
static void rtl_task(struct work_struct *work)
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 10/21] target: Add link_magic for fabric allow_link destination target_items
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2013-01-19 1:19 ` [ 09/21] r8169: avoid NAPI scheduling delay Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 4:13 ` Ben Hutchings
2013-01-19 1:19 ` [ 11/21] intel-iommu: Prevent devices with RMRRs from being placed into SI Domain Greg Kroah-Hartman
` (12 subsequent siblings)
22 siblings, 1 reply; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Sebastian Andrzej Siewior,
Nicholas Bellinger, CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream.
This patch adds [dev,lun]_link_magic value assignment + checks within generic
target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure
destination config_item *target_item sent from configfs_symlink() ->
config_item_operations->allow_link() is the underlying se_device->dev_group
and se_lun->lun_group that we expect to symlink.
Reported-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_device.c | 1 +
drivers/target/target_core_fabric_configfs.c | 12 ++++++++++++
drivers/target/target_core_tpg.c | 1 +
drivers/target/target_core_transport.c | 1 +
include/target/target_core_base.h | 4 ++++
5 files changed, 19 insertions(+)
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -1665,6 +1665,7 @@ int core_dev_setup_virtual_lun0(void)
ret = PTR_ERR(dev);
goto out;
}
+ dev->dev_link_magic = SE_DEV_LINK_MAGIC;
se_dev->se_dev_ptr = dev;
g_lun0_dev = dev;
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -72,6 +72,12 @@ static int target_fabric_mappedlun_link(
struct se_portal_group *se_tpg;
struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s;
int ret = 0, lun_access;
+
+ if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
+ pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
+ " %p to struct lun: %p\n", lun_ci, lun);
+ return -EFAULT;
+ }
/*
* Ensure that the source port exists
*/
@@ -746,6 +752,12 @@ static int target_fabric_port_link(
struct target_fabric_configfs *tf;
int ret;
+ if (dev->dev_link_magic != SE_DEV_LINK_MAGIC) {
+ pr_err("Bad dev->dev_link_magic, not a valid se_dev_ci pointer:"
+ " %p to struct se_device: %p\n", se_dev_ci, dev);
+ return -EFAULT;
+ }
+
tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
se_tpg = container_of(to_config_group(tpg_ci),
struct se_portal_group, tpg_group);
--- a/drivers/target/target_core_tpg.c
+++ b/drivers/target/target_core_tpg.c
@@ -677,6 +677,7 @@ int core_tpg_register(
for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
lun = se_tpg->tpg_lun_list[i];
lun->unpacked_lun = i;
+ lun->lun_link_magic = SE_LUN_LINK_MAGIC;
lun->lun_status = TRANSPORT_LUN_STATUS_FREE;
atomic_set(&lun->lun_acl_count, 0);
init_completion(&lun->lun_shutdown_comp);
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1341,6 +1341,7 @@ struct se_device *transport_add_device_t
dev->se_hba = hba;
dev->se_sub_dev = se_dev;
dev->transport = transport;
+ dev->dev_link_magic = SE_DEV_LINK_MAGIC;
INIT_LIST_HEAD(&dev->dev_list);
INIT_LIST_HEAD(&dev->dev_sep_list);
INIT_LIST_HEAD(&dev->dev_tmr_list);
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -779,6 +779,8 @@ struct se_subsystem_dev {
};
struct se_device {
+#define SE_DEV_LINK_MAGIC 0xfeeddeef
+ u32 dev_link_magic;
/* RELATIVE TARGET PORT IDENTIFER Counter */
u16 dev_rpti_counter;
/* Used for SAM Task Attribute ordering */
@@ -869,6 +871,8 @@ struct se_port_stat_grps {
};
struct se_lun {
+#define SE_LUN_LINK_MAGIC 0xffff7771
+ u32 lun_link_magic;
/* See transport_lun_status_table */
enum transport_lun_status_table lun_status;
u32 lun_access;
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: [ 10/21] target: Add link_magic for fabric allow_link destination target_items
2013-01-19 1:19 ` [ 10/21] target: Add link_magic for fabric allow_link destination target_items Greg Kroah-Hartman
@ 2013-01-19 4:13 ` Ben Hutchings
0 siblings, 0 replies; 25+ messages in thread
From: Ben Hutchings @ 2013-01-19 4:13 UTC (permalink / raw)
To: Nicholas Bellinger
Cc: linux-kernel, stable, alan, Sebastian Andrzej Siewior, CAI Qian,
Greg Kroah-Hartman
[-- Attachment #1: Type: text/plain, Size: 2766 bytes --]
On Fri, 2013-01-18 at 17:19 -0800, Greg Kroah-Hartman wrote:
> 3.4-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Nicholas Bellinger <nab@linux-iscsi.org>
>
> commit 0ff8754981261a80f4b77db2536dfea92c2d4539 upstream.
>
> This patch adds [dev,lun]_link_magic value assignment + checks within generic
> target_fabric_port_link() and target_fabric_mappedlun_link() code to ensure
> destination config_item *target_item sent from configfs_symlink() ->
> config_item_operations->allow_link() is the underlying se_device->dev_group
> and se_lun->lun_group that we expect to symlink.
[...]
> --- a/drivers/target/target_core_fabric_configfs.c
> +++ b/drivers/target/target_core_fabric_configfs.c
> @@ -72,6 +72,12 @@ static int target_fabric_mappedlun_link(
> struct se_portal_group *se_tpg;
> struct config_item *nacl_ci, *tpg_ci, *tpg_ci_s, *wwn_ci, *wwn_ci_s;
> int ret = 0, lun_access;
> +
> + if (lun->lun_link_magic != SE_LUN_LINK_MAGIC) {
> + pr_err("Bad lun->lun_link_magic, not a valid lun_ci pointer:"
> + " %p to struct lun: %p\n", lun_ci, lun);
> + return -EFAULT;
> + }
> /*
> * Ensure that the source port exists
> */
[...]
This is absolutely not a valid way of doing dynamic type checking.
The problem is that these structures:
> --- a/include/target/target_core_base.h
> +++ b/include/target/target_core_base.h
> @@ -779,6 +779,8 @@ struct se_subsystem_dev {
> };
>
> struct se_device {
> +#define SE_DEV_LINK_MAGIC 0xfeeddeef
> + u32 dev_link_magic;
> /* RELATIVE TARGET PORT IDENTIFER Counter */
> u16 dev_rpti_counter;
> /* Used for SAM Task Attribute ordering */
> @@ -869,6 +871,8 @@ struct se_port_stat_grps {
> };
>
> struct se_lun {
> +#define SE_LUN_LINK_MAGIC 0xffff7771
> + u32 lun_link_magic;
> /* See transport_lun_status_table */
> enum transport_lun_status_table lun_status;
> u32 lun_access;
have struct config_group embedded at different places. So you know
where the magic number is for the expected type but if you get an object
of the wrong type then you'll read some other area of memory that might
just happen to have the expected magic number anyway.
It seems like you need a superclass for all the structures exposed
through configfs, to hold the type information. I would suggest that
you define something like:
struct se_config_group {
struct config_group group;
u32 magic;
};
and put that in place of the plain struct config_group. You can then
safely check the magic number before looking at anything in the larger
structure.
Ben.
--
Ben Hutchings
All the simple programs have been written, and all the good names taken.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 25+ messages in thread
* [ 11/21] intel-iommu: Prevent devices with RMRRs from being placed into SI Domain
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2013-01-19 1:19 ` [ 10/21] target: Add link_magic for fabric allow_link destination target_items Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 12/21] igb: release already assigned MSI-X interrupts if setup fails Greg Kroah-Hartman
` (11 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Thomas Mingarelli, Shuah Khan,
Donald Dutile, Alex Williamson, Joerg Roedel, CAI Qian
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Mingarelli <thomas.mingarelli@hp.com>
commit ea2447f700cab264019b52e2b417d689e052dcfd upstream.
This patch is to prevent non-USB devices that have RMRRs associated with them from
being placed into the SI Domain during init. This fixes the issue where the RMRR info
for devices being placed in and out of the SI Domain gets lost.
Signed-off-by: Thomas Mingarelli <thomas.mingarelli@hp.com>
Tested-by: Shuah Khan <shuah.khan@hp.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Joerg Roedel <joro@8bytes.org>
Cc: CAI Qian <caiqian@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2321,8 +2321,39 @@ static int domain_add_dev_info(struct dm
return 0;
}
+static bool device_has_rmrr(struct pci_dev *dev)
+{
+ struct dmar_rmrr_unit *rmrr;
+ int i;
+
+ for_each_rmrr_units(rmrr) {
+ for (i = 0; i < rmrr->devices_cnt; i++) {
+ /*
+ * Return TRUE if this RMRR contains the device that
+ * is passed in.
+ */
+ if (rmrr->devices[i] == dev)
+ return true;
+ }
+ }
+ return false;
+}
+
static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
{
+
+ /*
+ * We want to prevent any device associated with an RMRR from
+ * getting placed into the SI Domain. This is done because
+ * problems exist when devices are moved in and out of domains
+ * and their respective RMRR info is lost. We exempt USB devices
+ * from this process due to their usage of RMRRs that are known
+ * to not be needed after BIOS hand-off to OS.
+ */
+ if (device_has_rmrr(pdev) &&
+ (pdev->class >> 8) != PCI_CLASS_SERIAL_USB)
+ return 0;
+
if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
return 1;
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 12/21] igb: release already assigned MSI-X interrupts if setup fails
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2013-01-19 1:19 ` [ 11/21] intel-iommu: Prevent devices with RMRRs from being placed into SI Domain Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 13/21] drbd: add missing part_round_stats to _drbd_start_io_acct Greg Kroah-Hartman
` (10 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Stefan Assmann, Aaron Brown,
Jeff Kirsher, Abdallah Chatila
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Assmann <sassmann@kpanic.de>
commit 52285b762b3681669215bf1d17ca6143448ab7d3 upstream.
During MSI-X setup the system might run out of vectors. If this happens the
already assigned vectors for this NIC should be freed before trying the
disable MSI-X. Failing to do so results in the following oops.
kernel BUG at drivers/pci/msi.c:341!
[...]
Call Trace:
[<ffffffff8128f39d>] pci_disable_msix+0x3d/0x60
[<ffffffffa037d1ce>] igb_reset_interrupt_capability+0x27/0x5c [igb]
[<ffffffffa037d229>] igb_clear_interrupt_scheme+0x26/0x2d [igb]
[<ffffffffa0384268>] igb_request_irq+0x73/0x297 [igb]
[<ffffffffa0384554>] __igb_open+0xc8/0x223 [igb]
[<ffffffffa0384815>] igb_open+0x13/0x15 [igb]
[<ffffffff8144592f>] __dev_open+0xbf/0x120
[<ffffffff81443e51>] __dev_change_flags+0xa1/0x180
[<ffffffff81445828>] dev_change_flags+0x28/0x70
[<ffffffff814af537>] devinet_ioctl+0x5b7/0x620
[<ffffffff814b01c8>] inet_ioctl+0x88/0xa0
[<ffffffff8142e8a0>] sock_do_ioctl+0x30/0x70
[<ffffffff8142ecf2>] sock_ioctl+0x72/0x270
[<ffffffff8118062c>] do_vfs_ioctl+0x8c/0x340
[<ffffffff81180981>] sys_ioctl+0xa1/0xb0
[<ffffffff815161a9>] system_call_fastpath+0x16/0x1b
Code: 48 89 df e8 1f 40 ed ff 4d 39 e6 49 8b 45 10 75 b6 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f c9 c3 48 8b 7b 20 e8 3e 91 db ff eb ae <0f> 0b eb fe 0f 1f 84 00 00 00 00 00 55 48 89 e5 0f 1f 44 00 00
RIP [<ffffffff8128e144>] free_msi_irqs+0x124/0x130
RSP <ffff880037503bd8>
Signed-off-by: Stefan Assmann <sassmann@kpanic.de>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: Abdallah Chatila <abdallah.chatila@ericsson.com>
---
drivers/net/ethernet/intel/igb/igb_main.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -951,17 +951,18 @@ static int igb_request_msix(struct igb_a
{
struct net_device *netdev = adapter->netdev;
struct e1000_hw *hw = &adapter->hw;
- int i, err = 0, vector = 0;
+ int i, err = 0, vector = 0, free_vector = 0;
err = request_irq(adapter->msix_entries[vector].vector,
igb_msix_other, 0, netdev->name, adapter);
if (err)
- goto out;
- vector++;
+ goto err_out;
for (i = 0; i < adapter->num_q_vectors; i++) {
struct igb_q_vector *q_vector = adapter->q_vector[i];
+ vector++;
+
q_vector->itr_register = hw->hw_addr + E1000_EITR(vector);
if (q_vector->rx.ring && q_vector->tx.ring)
@@ -980,13 +981,22 @@ static int igb_request_msix(struct igb_a
igb_msix_ring, 0, q_vector->name,
q_vector);
if (err)
- goto out;
- vector++;
+ goto err_free;
}
igb_configure_msix(adapter);
return 0;
-out:
+
+err_free:
+ /* free already assigned IRQs */
+ free_irq(adapter->msix_entries[free_vector++].vector, adapter);
+
+ vector--;
+ for (i = 0; i < vector; i++) {
+ free_irq(adapter->msix_entries[free_vector++].vector,
+ adapter->q_vector[i]);
+ }
+err_out:
return err;
}
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 13/21] drbd: add missing part_round_stats to _drbd_start_io_acct
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2013-01-19 1:19 ` [ 12/21] igb: release already assigned MSI-X interrupts if setup fails Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 14/21] xen/grant-table: correctly initialize grant table version 1 Greg Kroah-Hartman
` (9 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Philipp Reisner, Lars Ellenberg,
Raoul Bhatia
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Reisner <philipp.reisner@linbit.com>
commit 72585d2428fa3a0daab02ebad1f41e5ef517dbaa upstream.
Without this, iostat frequently sees bogus svctime and >= 100% "utilization".
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Cc: Raoul Bhatia <raoul@bhatia.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/drbd/drbd_req.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -37,6 +37,7 @@ static void _drbd_start_io_acct(struct d
const int rw = bio_data_dir(bio);
int cpu;
cpu = part_stat_lock();
+ part_round_stats(cpu, &mdev->vdisk->part0);
part_stat_inc(cpu, &mdev->vdisk->part0, ios[rw]);
part_stat_add(cpu, &mdev->vdisk->part0, sectors[rw], bio_sectors(bio));
part_inc_in_flight(&mdev->vdisk->part0, rw);
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 14/21] xen/grant-table: correctly initialize grant table version 1
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2013-01-19 1:19 ` [ 13/21] drbd: add missing part_round_stats to _drbd_start_io_acct Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 15/21] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests Greg Kroah-Hartman
` (8 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Matt Wilson, Ian Campbell,
Konrad Rzeszutek Wilk, Annie Li, xen-devel
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Wilson <msw@amazon.com>
commit d0b4d64aadb9f4a90669848de9ef3819050a98cd upstream.
Commit 85ff6acb075a484780b3d763fdf41596d8fc0970 (xen/granttable: Grant
tables V2 implementation) changed the GREFS_PER_GRANT_FRAME macro from
a constant to a conditional expression. The expression depends on
grant_table_version being appropriately set. Unfortunately, at init
time grant_table_version will be 0. The GREFS_PER_GRANT_FRAME
conditional expression checks for "grant_table_version == 1", and
therefore returns the number of grant references per frame for v2.
This causes gnttab_init() to allocate fewer pages for gnttab_list, as
a frame can old half the number of v2 entries than v1 entries. After
gnttab_resume() is called, grant_table_version is appropriately
set. nr_init_grefs will then be miscalculated and gnttab_free_count
will hold a value larger than the actual number of free gref entries.
If a guest is heavily utilizing improperly initialized v1 grant
tables, memory corruption can occur. One common manifestation is
corruption of the vmalloc list, resulting in a poisoned pointer
derefrence when accessing /proc/meminfo or /proc/vmallocinfo:
[ 40.770064] BUG: unable to handle kernel paging request at 0000200200001407
[ 40.770083] IP: [<ffffffff811a6fb0>] get_vmalloc_info+0x70/0x110
[ 40.770102] PGD 0
[ 40.770107] Oops: 0000 [#1] SMP
[ 40.770114] CPU 10
This patch introduces a static variable, grefs_per_grant_frame, to
cache the calculated value. gnttab_init() now calls
gnttab_request_version() early so that grant_table_version and
grefs_per_grant_frame can be appropriately set. A few BUG_ON()s have
been added to prevent this type of bug from reoccurring in the future.
Signed-off-by: Matt Wilson <msw@amazon.com>
Reviewed-and-Tested-by: Steven Noonan <snoonan@amazon.com>
Acked-by: Ian Campbell <Ian.Campbell@citrix.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Annie Li <annie.li@oracle.com>
Cc: xen-devel@lists.xen.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/grant-table.c | 48 +++++++++++++++++++++++++++-------------------
1 file changed, 29 insertions(+), 19 deletions(-)
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -53,10 +53,6 @@
/* External tools reserve first few grant table entries. */
#define NR_RESERVED_ENTRIES 8
#define GNTTAB_LIST_END 0xffffffff
-#define GREFS_PER_GRANT_FRAME \
-(grant_table_version == 1 ? \
-(PAGE_SIZE / sizeof(struct grant_entry_v1)) : \
-(PAGE_SIZE / sizeof(union grant_entry_v2)))
static grant_ref_t **gnttab_list;
static unsigned int nr_grant_frames;
@@ -151,6 +147,7 @@ static struct gnttab_ops *gnttab_interfa
static grant_status_t *grstatus;
static int grant_table_version;
+static int grefs_per_grant_frame;
static struct gnttab_free_callback *gnttab_free_callback_list;
@@ -679,12 +676,14 @@ static int grow_gnttab_list(unsigned int
unsigned int new_nr_grant_frames, extra_entries, i;
unsigned int nr_glist_frames, new_nr_glist_frames;
+ BUG_ON(grefs_per_grant_frame == 0);
+
new_nr_grant_frames = nr_grant_frames + more_frames;
- extra_entries = more_frames * GREFS_PER_GRANT_FRAME;
+ extra_entries = more_frames * grefs_per_grant_frame;
- nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+ nr_glist_frames = (nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
new_nr_glist_frames =
- (new_nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+ (new_nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
for (i = nr_glist_frames; i < new_nr_glist_frames; i++) {
gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_ATOMIC);
if (!gnttab_list[i])
@@ -692,12 +691,12 @@ static int grow_gnttab_list(unsigned int
}
- for (i = GREFS_PER_GRANT_FRAME * nr_grant_frames;
- i < GREFS_PER_GRANT_FRAME * new_nr_grant_frames - 1; i++)
+ for (i = grefs_per_grant_frame * nr_grant_frames;
+ i < grefs_per_grant_frame * new_nr_grant_frames - 1; i++)
gnttab_entry(i) = i + 1;
gnttab_entry(i) = gnttab_free_head;
- gnttab_free_head = GREFS_PER_GRANT_FRAME * nr_grant_frames;
+ gnttab_free_head = grefs_per_grant_frame * nr_grant_frames;
gnttab_free_count += extra_entries;
nr_grant_frames = new_nr_grant_frames;
@@ -799,7 +798,8 @@ EXPORT_SYMBOL_GPL(gnttab_unmap_refs);
static unsigned nr_status_frames(unsigned nr_grant_frames)
{
- return (nr_grant_frames * GREFS_PER_GRANT_FRAME + SPP - 1) / SPP;
+ BUG_ON(grefs_per_grant_frame == 0);
+ return (nr_grant_frames * grefs_per_grant_frame + SPP - 1) / SPP;
}
static int gnttab_map_frames_v1(unsigned long *frames, unsigned int nr_gframes)
@@ -957,6 +957,7 @@ static void gnttab_request_version(void)
rc = HYPERVISOR_grant_table_op(GNTTABOP_set_version, &gsv, 1);
if (rc == 0 && gsv.version == 2) {
grant_table_version = 2;
+ grefs_per_grant_frame = PAGE_SIZE / sizeof(union grant_entry_v2);
gnttab_interface = &gnttab_v2_ops;
} else if (grant_table_version == 2) {
/*
@@ -969,17 +970,17 @@ static void gnttab_request_version(void)
panic("we need grant tables version 2, but only version 1 is available");
} else {
grant_table_version = 1;
+ grefs_per_grant_frame = PAGE_SIZE / sizeof(struct grant_entry_v1);
gnttab_interface = &gnttab_v1_ops;
}
printk(KERN_INFO "Grant tables using version %d layout.\n",
grant_table_version);
}
-int gnttab_resume(void)
+static int gnttab_setup(void)
{
unsigned int max_nr_gframes;
- gnttab_request_version();
max_nr_gframes = gnttab_max_grant_frames();
if (max_nr_gframes < nr_grant_frames)
return -ENOSYS;
@@ -1002,6 +1003,12 @@ int gnttab_resume(void)
return 0;
}
+int gnttab_resume(void)
+{
+ gnttab_request_version();
+ return gnttab_setup();
+}
+
int gnttab_suspend(void)
{
gnttab_interface->unmap_frames();
@@ -1013,9 +1020,10 @@ static int gnttab_expand(unsigned int re
int rc;
unsigned int cur, extra;
+ BUG_ON(grefs_per_grant_frame == 0);
cur = nr_grant_frames;
- extra = ((req_entries + (GREFS_PER_GRANT_FRAME-1)) /
- GREFS_PER_GRANT_FRAME);
+ extra = ((req_entries + (grefs_per_grant_frame-1)) /
+ grefs_per_grant_frame);
if (cur + extra > gnttab_max_grant_frames())
return -ENOSPC;
@@ -1033,21 +1041,23 @@ int gnttab_init(void)
unsigned int nr_init_grefs;
int ret;
+ gnttab_request_version();
nr_grant_frames = 1;
boot_max_nr_grant_frames = __max_nr_grant_frames();
/* Determine the maximum number of frames required for the
* grant reference free list on the current hypervisor.
*/
+ BUG_ON(grefs_per_grant_frame == 0);
max_nr_glist_frames = (boot_max_nr_grant_frames *
- GREFS_PER_GRANT_FRAME / RPP);
+ grefs_per_grant_frame / RPP);
gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),
GFP_KERNEL);
if (gnttab_list == NULL)
return -ENOMEM;
- nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+ nr_glist_frames = (nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
for (i = 0; i < nr_glist_frames; i++) {
gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL);
if (gnttab_list[i] == NULL) {
@@ -1056,12 +1066,12 @@ int gnttab_init(void)
}
}
- if (gnttab_resume() < 0) {
+ if (gnttab_setup() < 0) {
ret = -ENODEV;
goto ini_nomem;
}
- nr_init_grefs = nr_grant_frames * GREFS_PER_GRANT_FRAME;
+ nr_init_grefs = nr_grant_frames * grefs_per_grant_frame;
for (i = NR_RESERVED_ENTRIES; i < nr_init_grefs - 1; i++)
gnttab_entry(i) = i + 1;
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 15/21] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2013-01-19 1:19 ` [ 14/21] xen/grant-table: correctly initialize grant table version 1 Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 16/21] USB: option: add TP-LINK HSUPA Modem MA180 Greg Kroah-Hartman
` (7 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Frediano Ziglio, Andrew Cooper,
Konrad Rzeszutek Wilk
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Cooper <andrew.cooper3@citrix.com>
commit 9174adbee4a9a49d0139f5d71969852b36720809 upstream.
This fixes CVE-2013-0190 / XSA-40
There has been an error on the xen_failsafe_callback path for failed
iret, which causes the stack pointer to be wrong when entering the
iret_exc error path. This can result in the kernel crashing.
In the classic kernel case, the relevant code looked a little like:
popl %eax # Error code from hypervisor
jz 5f
addl $16,%esp
jmp iret_exc # Hypervisor said iret fault
5: addl $16,%esp
# Hypervisor said segment selector fault
Here, there are two identical addls on either option of a branch which
appears to have been optimised by hoisting it above the jz, and
converting it to an lea, which leaves the flags register unaffected.
In the PVOPS case, the code looks like:
popl_cfi %eax # Error from the hypervisor
lea 16(%esp),%esp # Add $16 before choosing fault path
CFI_ADJUST_CFA_OFFSET -16
jz 5f
addl $16,%esp # Incorrectly adjust %esp again
jmp iret_exc
It is possible unprivileged userspace applications to cause this
behaviour, for example by loading an LDT code selector, then changing
the code selector to be not-present. At this point, there is a race
condition where it is possible for the hypervisor to return back to
userspace from an interrupt, fault on its own iret, and inject a
failsafe_callback into the kernel.
This bug has been present since the introduction of Xen PVOPS support
in commit 5ead97c84 (xen: Core Xen implementation), in 2.6.23.
Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/entry_32.S | 1 -
1 file changed, 1 deletion(-)
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -1074,7 +1074,6 @@ ENTRY(xen_failsafe_callback)
lea 16(%esp),%esp
CFI_ADJUST_CFA_OFFSET -16
jz 5f
- addl $16,%esp
jmp iret_exc
5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */
SAVE_ALL
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 16/21] USB: option: add TP-LINK HSUPA Modem MA180
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2013-01-19 1:19 ` [ 15/21] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 17/21] USB: option: blacklist network interface on ONDA MT8205 4G LTE Greg Kroah-Hartman
` (6 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Greg Kroah-Hartman, alan, Thomas Schäfer, Bjørn Mork
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjørn Mork <bjorn@mork.no>
commit 99beb2e9687ffd61c92a9875141eabe6f57a71b9 upstream.
The driver description files gives these names to the vendor specific
functions on this modem:
Diagnostics VID_2357&PID_0201&MI_00
NMEA VID_2357&PID_0201&MI_01
Modem VID_2357&PID_0201&MI_03
Networkcard VID_2357&PID_0201&MI_04
Reported-by: Thomas Schäfer <tschaefer@t-online.de>
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -449,6 +449,10 @@ static void option_instat_callback(struc
#define PETATEL_VENDOR_ID 0x1ff4
#define PETATEL_PRODUCT_NP10T 0x600e
+/* TP-LINK Incorporated products */
+#define TPLINK_VENDOR_ID 0x2357
+#define TPLINK_PRODUCT_MA180 0x0201
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -1311,6 +1315,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
+ { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 17/21] USB: option: blacklist network interface on ONDA MT8205 4G LTE
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2013-01-19 1:19 ` [ 16/21] USB: option: add TP-LINK HSUPA Modem MA180 Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 18/21] serial:ifx6x60:Delete SPI timer when shut down port Greg Kroah-Hartman
` (5 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Bjørn Mork
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
Signed-off-by: Bjørn Mork <bjorn@mork.no>
commit 2291dff02e5f8c708a46a7c4c888f2c467e26642 upstream.
The driver description files gives these names to the vendor specific
functions on this modem:
Diag VID_19D2&PID_0265&MI_00
NMEA VID_19D2&PID_0265&MI_01
AT cmd VID_19D2&PID_0265&MI_02
Modem VID_19D2&PID_0265&MI_03
Net VID_19D2&PID_0265&MI_04
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -934,7 +934,8 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0254, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
.driver_info = (kernel_ulong_t)&net_intf3_blacklist },
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff), /* ONDA MT8205 */
+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff), /* ZTE MF880 */
.driver_info = (kernel_ulong_t)&net_intf4_blacklist },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0317, 0xff, 0xff, 0xff) },
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 18/21] serial:ifx6x60:Delete SPI timer when shut down port
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2013-01-19 1:19 ` [ 17/21] USB: option: blacklist network interface on ONDA MT8205 4G LTE Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 19/21] tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler Greg Kroah-Hartman
` (4 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Chen Jun, channing
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: chao bi <chao.bi@intel.com>
commit 014b9b4ce84281ccb3d723c792bed19815f3571a upstream.
When shut down SPI port, it's possible that MRDY has been asserted and a SPI
timer was activated waiting for SRDY assert, in the case, it needs to delete
this timer.
Signed-off-by: Chen Jun <jun.d.chen@intel.com>
Signed-off-by: channing <chao.bi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/ifx6x60.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -552,6 +552,7 @@ static void ifx_port_shutdown(struct tty
container_of(port, struct ifx_spi_device, tty_port);
mrdy_set_low(ifx_dev);
+ del_timer(&ifx_dev->spi_timer);
clear_bit(IFX_SPI_STATE_TIMER_PENDING, &ifx_dev->flags);
tasklet_kill(&ifx_dev->io_work_tasklet);
}
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 19/21] tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2013-01-19 1:19 ` [ 18/21] serial:ifx6x60:Delete SPI timer when shut down port Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 20/21] staging: wlan-ng: Fix clamping of returned SSID length Greg Kroah-Hartman
` (3 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Maxime Ripard
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Ripard <maxime.ripard@free-electrons.com>
commit 68e56cb3a068f9c30971c6117fbbd1e32918e49e upstream.
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -79,7 +79,7 @@ static int dw8250_handle_irq(struct uart
} else if ((iir & UART_IIR_BUSY) == UART_IIR_BUSY) {
/* Clear the USR and write the LCR again. */
(void)p->serial_in(p, UART_USR);
- p->serial_out(p, d->last_lcr, UART_LCR);
+ p->serial_out(p, UART_LCR, d->last_lcr);
return 1;
}
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 20/21] staging: wlan-ng: Fix clamping of returned SSID length
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2013-01-19 1:19 ` [ 19/21] tty: 8250_dw: Fix inverted arguments to serial_out in IRQ handler Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 1:19 ` [ 21/21] staging: vt6656: Fix inconsistent structure packing Greg Kroah-Hartman
` (2 subsequent siblings)
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Tormod Volden
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tormod Volden <debian.tormod@gmail.com>
commit 811a37effdb11e54e1ff1ddaa944286c88f58487 upstream.
Commit 2e254212 broke listing of available network names, since it
clamped the length of the returned SSID to WLAN_BSSID_LEN (6) instead of
WLAN_SSID_MAXLEN (32).
https://bugzilla.kernel.org/show_bug.cgi?id=52501
Signed-off-by: Tormod Volden <debian.tormod@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/wlan-ng/prism2mgmt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/wlan-ng/prism2mgmt.c
+++ b/drivers/staging/wlan-ng/prism2mgmt.c
@@ -406,7 +406,7 @@ int prism2mgmt_scan_results(wlandevice_t
/* SSID */
req->ssid.status = P80211ENUM_msgitem_status_data_ok;
req->ssid.data.len = le16_to_cpu(item->ssid.len);
- req->ssid.data.len = min_t(u16, req->ssid.data.len, WLAN_BSSID_LEN);
+ req->ssid.data.len = min_t(u16, req->ssid.data.len, WLAN_SSID_MAXLEN);
memcpy(req->ssid.data.data, item->ssid.data, req->ssid.data.len);
/* supported rates */
^ permalink raw reply [flat|nested] 25+ messages in thread* [ 21/21] staging: vt6656: Fix inconsistent structure packing
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2013-01-19 1:19 ` [ 20/21] staging: wlan-ng: Fix clamping of returned SSID length Greg Kroah-Hartman
@ 2013-01-19 1:19 ` Greg Kroah-Hartman
2013-01-19 18:51 ` [ 00/21] 3.4.27-stable review Shuah Khan
2013-01-20 9:04 ` Satoru Takeuchi
22 siblings, 0 replies; 25+ messages in thread
From: Greg Kroah-Hartman @ 2013-01-19 1:19 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Greg Kroah-Hartman, alan, Ben Hutchings
3.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit 1ee4c55fc9620451b2a825d793042a7e0775391b upstream.
vt6656 has several headers that use the #pragma pack(1) directive to
enable structure packing, but never disable it. The layout of
structures defined in other headers can then depend on which order the
various headers are included in, breaking the One Definition Rule.
In practice this resulted in crashes on x86_64 until the order of header
inclusion was changed for some files in commit 11d404cb56ecd ('staging:
vt6656: fix headers and add cfg80211.'). But we need a proper fix that
won't be affected by future changes to the order of inclusion.
This removes the #pragma pack(1) directives and adds __packed to the
structure definitions for which packing appears to have been intended.
Reported-and-tested-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/vt6656/bssdb.h | 1 -
drivers/staging/vt6656/int.h | 1 -
drivers/staging/vt6656/iocmd.h | 33 ++++++++++++++++-----------------
drivers/staging/vt6656/iowpa.h | 8 +++-----
4 files changed, 19 insertions(+), 24 deletions(-)
--- a/drivers/staging/vt6656/bssdb.h
+++ b/drivers/staging/vt6656/bssdb.h
@@ -92,7 +92,6 @@ typedef struct tagSRSNCapObject {
} SRSNCapObject, *PSRSNCapObject;
// BSS info(AP)
-#pragma pack(1)
typedef struct tagKnownBSS {
// BSS info
BOOL bActive;
--- a/drivers/staging/vt6656/int.h
+++ b/drivers/staging/vt6656/int.h
@@ -34,7 +34,6 @@
#include "device.h"
/*--------------------- Export Definitions -------------------------*/
-#pragma pack(1)
typedef struct tagSINTData {
BYTE byTSR0;
BYTE byPkt0;
--- a/drivers/staging/vt6656/iocmd.h
+++ b/drivers/staging/vt6656/iocmd.h
@@ -95,13 +95,12 @@ typedef enum tagWZONETYPE {
// Ioctl interface structure
// Command structure
//
-#pragma pack(1)
typedef struct tagSCmdRequest {
u8 name[16];
void *data;
u16 wResult;
u16 wCmdCode;
-} SCmdRequest, *PSCmdRequest;
+} __packed SCmdRequest, *PSCmdRequest;
//
// Scan
@@ -111,7 +110,7 @@ typedef struct tagSCmdScan {
u8 ssid[SSID_MAXLEN + 2];
-} SCmdScan, *PSCmdScan;
+} __packed SCmdScan, *PSCmdScan;
//
// BSS Join
@@ -126,7 +125,7 @@ typedef struct tagSCmdBSSJoin {
BOOL bPSEnable;
BOOL bShareKeyAuth;
-} SCmdBSSJoin, *PSCmdBSSJoin;
+} __packed SCmdBSSJoin, *PSCmdBSSJoin;
//
// Zonetype Setting
@@ -137,7 +136,7 @@ typedef struct tagSCmdZoneTypeSet {
BOOL bWrite;
WZONETYPE ZoneType;
-} SCmdZoneTypeSet, *PSCmdZoneTypeSet;
+} __packed SCmdZoneTypeSet, *PSCmdZoneTypeSet;
typedef struct tagSWPAResult {
char ifname[100];
@@ -145,7 +144,7 @@ typedef struct tagSWPAResult {
u8 key_mgmt;
u8 eap_type;
BOOL authenticated;
-} SWPAResult, *PSWPAResult;
+} __packed SWPAResult, *PSWPAResult;
typedef struct tagSCmdStartAP {
@@ -157,7 +156,7 @@ typedef struct tagSCmdStartAP {
BOOL bShareKeyAuth;
u8 byBasicRate;
-} SCmdStartAP, *PSCmdStartAP;
+} __packed SCmdStartAP, *PSCmdStartAP;
typedef struct tagSCmdSetWEP {
@@ -167,7 +166,7 @@ typedef struct tagSCmdSetWEP {
BOOL bWepKeyAvailable[WEP_NKEYS];
u32 auWepKeyLength[WEP_NKEYS];
-} SCmdSetWEP, *PSCmdSetWEP;
+} __packed SCmdSetWEP, *PSCmdSetWEP;
typedef struct tagSBSSIDItem {
@@ -180,14 +179,14 @@ typedef struct tagSBSSIDItem {
BOOL bWEPOn;
u32 uRSSI;
-} SBSSIDItem;
+} __packed SBSSIDItem;
typedef struct tagSBSSIDList {
u32 uItem;
SBSSIDItem sBSSIDList[0];
-} SBSSIDList, *PSBSSIDList;
+} __packed SBSSIDList, *PSBSSIDList;
typedef struct tagSNodeItem {
@@ -208,7 +207,7 @@ typedef struct tagSNodeItem {
u32 uTxAttempts;
u16 wFailureRatio;
-} SNodeItem;
+} __packed SNodeItem;
typedef struct tagSNodeList {
@@ -216,7 +215,7 @@ typedef struct tagSNodeList {
u32 uItem;
SNodeItem sNodeList[0];
-} SNodeList, *PSNodeList;
+} __packed SNodeList, *PSNodeList;
typedef struct tagSCmdLinkStatus {
@@ -229,7 +228,7 @@ typedef struct tagSCmdLinkStatus {
u32 uChannel;
u32 uLinkRate;
-} SCmdLinkStatus, *PSCmdLinkStatus;
+} __packed SCmdLinkStatus, *PSCmdLinkStatus;
//
// 802.11 counter
@@ -247,7 +246,7 @@ typedef struct tagSDot11MIBCount {
u32 ReceivedFragmentCount;
u32 MulticastReceivedFrameCount;
u32 FCSErrorCount;
-} SDot11MIBCount, *PSDot11MIBCount;
+} __packed SDot11MIBCount, *PSDot11MIBCount;
@@ -355,13 +354,13 @@ typedef struct tagSStatMIBCount {
u32 ullTxBroadcastBytes[2];
u32 ullTxMulticastBytes[2];
u32 ullTxDirectedBytes[2];
-} SStatMIBCount, *PSStatMIBCount;
+} __packed SStatMIBCount, *PSStatMIBCount;
typedef struct tagSCmdValue {
u32 dwValue;
-} SCmdValue, *PSCmdValue;
+} __packed SCmdValue, *PSCmdValue;
//
// hostapd & viawget ioctl related
@@ -431,7 +430,7 @@ struct viawget_hostapd_param {
u8 ssid[32];
} scan_req;
} u;
-};
+} __packed;
/*--------------------- Export Classes ----------------------------*/
--- a/drivers/staging/vt6656/iowpa.h
+++ b/drivers/staging/vt6656/iowpa.h
@@ -67,12 +67,11 @@ enum {
-#pragma pack(1)
typedef struct viawget_wpa_header {
u8 type;
u16 req_ie_len;
u16 resp_ie_len;
-} viawget_wpa_header;
+} __packed viawget_wpa_header;
struct viawget_wpa_param {
u32 cmd;
@@ -113,9 +112,8 @@ struct viawget_wpa_param {
u8 *buf;
} scan_results;
} u;
-};
+} __packed;
-#pragma pack(1)
struct viawget_scan_result {
u8 bssid[6];
u8 ssid[32];
@@ -130,7 +128,7 @@ struct viawget_scan_result {
int noise;
int level;
int maxrate;
-};
+} __packed;
/*--------------------- Export Classes ----------------------------*/
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: [ 00/21] 3.4.27-stable review
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2013-01-19 1:19 ` [ 21/21] staging: vt6656: Fix inconsistent structure packing Greg Kroah-Hartman
@ 2013-01-19 18:51 ` Shuah Khan
2013-01-20 9:04 ` Satoru Takeuchi
22 siblings, 0 replies; 25+ messages in thread
From: Shuah Khan @ 2013-01-19 18:51 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, torvalds, akpm, alan
On Fri, Jan 18, 2013 at 6:19 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 3.4.27 release.
> There are 21 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Jan 21 01:05:31 UTC 2013.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.4.27-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Patches applied cleanly to 3.0.y, 3.4.y, and 3.7.y.
Compiled and booted on the following systems:
HP EliteBook 6930p Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz
HP ProBook 6475b AMD A10-4600M APU with Radeon(tm) HD Graphics
Cross-compile tests:
alpha: defconfig passed on all
arm: defconfig passed on all
arm64: not applicable to 3.0.y, 3.4.y. defconfig passed on 3.7.y
c6x: not applicable to 3.0.y, defconfig passed on 3.4.y, and 3.7.y.
mips: defconfig passed on all
mipsel: defconfig passed on all
powerpc: wii_defconfig passed on all
sh: defconfig passed on all
sparc: defconfig passed on all
tile: tilegx_defconfig passed on all
^ permalink raw reply [flat|nested] 25+ messages in thread* Re: [ 00/21] 3.4.27-stable review
2013-01-19 1:19 [ 00/21] 3.4.27-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2013-01-19 18:51 ` [ 00/21] 3.4.27-stable review Shuah Khan
@ 2013-01-20 9:04 ` Satoru Takeuchi
22 siblings, 0 replies; 25+ messages in thread
From: Satoru Takeuchi @ 2013-01-20 9:04 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, stable, torvalds, akpm, alan
At Fri, 18 Jan 2013 17:19:18 -0800,
Greg Kroah-Hartman wrote:
>
> This is the start of the stable review cycle for the 3.4.27 release.
> There are 21 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
This kernel can be built and boot without any problem.
Building a kernel with this kernel also works fine.
- Build Machine: debian wheezy x86_64
CPU: Intel(R) Core(TM) i5-2400 CPU @ 3.10GHz x 4
memory: 8GB
- Test machine: debian wheezy x86_64(KVM guest on the Build Machine)
vCPU: x2
memory: 2GB
I reviewed the following patches and it looks good to me.
> Pseudo-Shortlog of commits:
...
> chao bi <chao.bi@intel.com>
> serial:ifx6x60:Delete SPI timer when shut down port
> Eric Sandeen <sandeen@redhat.com>
> ext4: init pagevec in ext4_da_block_invalidatepages
Thanks,
Satoru
^ permalink raw reply [flat|nested] 25+ messages in thread