* [PATCH 3.10 001/143] carl9170: fix sending URBs with wrong type when using full-speed
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 008/143] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan() Greg Kroah-Hartman
` (133 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ronald Wahl, John W. Linville
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <ronald.wahl@raritan.com>
commit 671796dd96b6cd85b75fba9d3007bcf7e5f7c309 upstream.
The driver assumes that endpoint 4 is always an interrupt endpoint.
Unfortunately the type differs between high-speed and full-speed
configurations while in the former case it is indeed an interrupt
endpoint this is not true for the latter case - here it is a bulk
endpoint. When sending URBs with the wrong type the kernel will
generate a warning message including backtrace. In this specific
case there will be a huge amount of warnings which can bring the system
to freeze.
To fix this we are now sending URBs to endpoint 4 using the type
found in the endpoint descriptor.
A side note: The carl9170 firmware currently specifies endpoint 4 as
interrupt endpoint even in the full-speed configuration but this has
no relevance because before this firmware is loaded the endpoint type
is as described above and after the firmware is running the stick is not
reenumerated and so the old descriptor is used.
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/carl9170/carl9170.h | 1
drivers/net/wireless/ath/carl9170/usb.c | 31 +++++++++++++++++++++++----
2 files changed, 28 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/ath/carl9170/carl9170.h
+++ b/drivers/net/wireless/ath/carl9170/carl9170.h
@@ -253,6 +253,7 @@ struct ar9170 {
atomic_t rx_work_urbs;
atomic_t rx_pool_urbs;
kernel_ulong_t features;
+ bool usb_ep_cmd_is_bulk;
/* firmware settings */
struct completion fw_load_wait;
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -621,9 +621,16 @@ int __carl9170_exec_cmd(struct ar9170 *a
goto err_free;
}
- usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
- AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
- carl9170_usb_cmd_complete, ar, 1);
+ if (ar->usb_ep_cmd_is_bulk)
+ usb_fill_bulk_urb(urb, ar->udev,
+ usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
+ cmd, cmd->hdr.len + 4,
+ carl9170_usb_cmd_complete, ar);
+ else
+ usb_fill_int_urb(urb, ar->udev,
+ usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
+ cmd, cmd->hdr.len + 4,
+ carl9170_usb_cmd_complete, ar, 1);
if (free_buf)
urb->transfer_flags |= URB_FREE_BUFFER;
@@ -1032,9 +1039,10 @@ static void carl9170_usb_firmware_step2(
static int carl9170_usb_probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
+ struct usb_endpoint_descriptor *ep;
struct ar9170 *ar;
struct usb_device *udev;
- int err;
+ int i, err;
err = usb_reset_device(interface_to_usbdev(intf));
if (err)
@@ -1050,6 +1058,21 @@ static int carl9170_usb_probe(struct usb
ar->intf = intf;
ar->features = id->driver_info;
+ /* We need to remember the type of endpoint 4 because it differs
+ * between high- and full-speed configuration. The high-speed
+ * configuration specifies it as interrupt and the full-speed
+ * configuration as bulk endpoint. This information is required
+ * later when sending urbs to that endpoint.
+ */
+ for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
+ ep = &intf->cur_altsetting->endpoint[i].desc;
+
+ if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
+ usb_endpoint_dir_out(ep) &&
+ usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
+ ar->usb_ep_cmd_is_bulk = true;
+ }
+
usb_set_intfdata(intf, ar);
SET_IEEE80211_DEV(ar->hw, &intf->dev);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 008/143] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan().
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 001/143] carl9170: fix sending URBs with wrong type when using full-speed Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 009/143] drm/ttm: Choose a pool to shrink correctly " Greg Kroah-Hartman
` (132 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Dave Airlie
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit 11e504cc705e8ccb06ac93a276e11b5e8fee4d40 upstream.
list_empty(&_manager->pools) being false before taking _manager->lock
does not guarantee that _manager->npools != 0 after taking _manager->lock
because _manager->npools is updated under _manager->lock.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1016,6 +1016,8 @@ static int ttm_dma_pool_mm_shrink(struct
return 0;
mutex_lock(&_manager->lock);
+ if (!_manager->npools)
+ goto out;
pool_offset = pool_offset % _manager->npools;
list_for_each_entry(p, &_manager->pools, pools) {
unsigned nr_free;
@@ -1033,6 +1035,7 @@ static int ttm_dma_pool_mm_shrink(struct
p->pool->dev_name, p->pool->name, current->pid,
nr_free, shrink_pages);
}
+out:
mutex_unlock(&_manager->lock);
/* return estimated number of unused pages in pool */
return ttm_dma_pool_get_num_unused_pages();
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 009/143] drm/ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan().
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 001/143] carl9170: fix sending URBs with wrong type when using full-speed Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 008/143] drm/ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan() Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 010/143] drm/radeon: load the lm63 driver for an lm64 thermal chip Greg Kroah-Hartman
` (131 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tetsuo Handa, Dave Airlie
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit 46c2df68f03a236b30808bba361f10900c88d95e upstream.
We can use "unsigned int" instead of "atomic_t" by updating start_pool
variable under _manager->lock. This patch will make it possible to avoid
skipping when choosing a pool to shrink in round-robin style, after next
patch changes mutex_lock(_manager->lock) to !mutex_trylock(_manager->lork).
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ttm/ttm_page_alloc_dma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc_dma.c
@@ -1006,9 +1006,9 @@ EXPORT_SYMBOL_GPL(ttm_dma_unpopulate);
static int ttm_dma_pool_mm_shrink(struct shrinker *shrink,
struct shrink_control *sc)
{
- static atomic_t start_pool = ATOMIC_INIT(0);
+ static unsigned start_pool;
unsigned idx = 0;
- unsigned pool_offset = atomic_add_return(1, &start_pool);
+ unsigned pool_offset;
unsigned shrink_pages = sc->nr_to_scan;
struct device_pools *p;
@@ -1018,7 +1018,7 @@ static int ttm_dma_pool_mm_shrink(struct
mutex_lock(&_manager->lock);
if (!_manager->npools)
goto out;
- pool_offset = pool_offset % _manager->npools;
+ pool_offset = ++start_pool % _manager->npools;
list_for_each_entry(p, &_manager->pools, pools) {
unsigned nr_free;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 010/143] drm/radeon: load the lm63 driver for an lm64 thermal chip.
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 009/143] drm/ttm: Choose a pool to shrink correctly " Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 011/143] drm/i915: read HEAD register back in init_ring_common() to enforce ordering Greg Kroah-Hartman
` (130 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 5dc355325b648dc9b4cf3bea4d968de46fd59215 upstream.
Looks like the lm63 driver supports the lm64 as well.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1908,7 +1908,7 @@ static const char *thermal_controller_na
"adm1032",
"adm1030",
"max6649",
- "lm64",
+ "lm63", /* lm64 */
"f75375",
"asc7xxx",
};
@@ -1919,7 +1919,7 @@ static const char *pp_lib_thermal_contro
"adm1032",
"adm1030",
"max6649",
- "lm64",
+ "lm63", /* lm64 */
"f75375",
"RV6xx",
"RV770",
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 011/143] drm/i915: read HEAD register back in init_ring_common() to enforce ordering
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 010/143] drm/radeon: load the lm63 driver for an lm64 thermal chip Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 012/143] pata_scc: propagate return value of scc_wait_after_reset Greg Kroah-Hartman
` (129 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jiri Kosina, Daniel Vetter
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit ece4a17d237a79f63fbfaf3f724a12b6d500555c upstream.
Withtout this, ring initialization fails reliabily during resume with
[drm:init_ring_common] *ERROR* render ring initialization failed ctl 0001f001 head ffffff8804 tail 00000000 start 000e4000
This is not a complete fix, but it is verified to make the ring
initialization failures during resume much less likely.
We were not able to root-cause this bug (likely HW-specific to Gen4 chips)
yet. This is therefore used as a ducttape before problem is fully
understood and proper fix created, so that people don't suffer from
completely unusable systems in the meantime.
The discussion and debugging is happening at
https://bugs.freedesktop.org/show_bug.cgi?id=76554
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_ringbuffer.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -396,6 +396,9 @@ static int init_ring_common(struct intel
}
}
+ /* Enforce ordering by reading HEAD register back */
+ I915_READ_HEAD(ring);
+
/* Initialize the ring. This must happen _after_ we've cleared the ring
* registers with the above sequence (the readback of the HEAD registers
* also enforces ordering), otherwise the hw might lose the new ring
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 012/143] pata_scc: propagate return value of scc_wait_after_reset
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 011/143] drm/i915: read HEAD register back in init_ring_common() to enforce ordering Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 013/143] ahci: Add Device IDs for Intel 9 Series PCH Greg Kroah-Hartman
` (128 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arjun Sreedharan, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arjun Sreedharan <arjun024@gmail.com>
commit 4dc7c76cd500fa78c64adfda4b070b870a2b993c upstream.
scc_bus_softreset not necessarily should return zero.
Propagate the error code.
Signed-off-by: Arjun Sreedharan <arjun024@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/pata_scc.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/drivers/ata/pata_scc.c
+++ b/drivers/ata/pata_scc.c
@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct a
* Note: Original code is ata_bus_softreset().
*/
-static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+static int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
unsigned long deadline)
{
struct ata_ioports *ioaddr = &ap->ioaddr;
@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(st
udelay(20);
out_be32(ioaddr->ctl_addr, ap->ctl);
- scc_wait_after_reset(&ap->link, devmask, deadline);
-
- return 0;
+ return scc_wait_after_reset(&ap->link, devmask, deadline);
}
/**
@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link
{
struct ata_port *ap = link->ap;
unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS;
- unsigned int devmask = 0, err_mask;
+ unsigned int devmask = 0;
+ int rc;
u8 err;
DPRINTK("ENTER\n");
@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link
/* issue bus reset */
DPRINTK("about to softreset, devmask=%x\n", devmask);
- err_mask = scc_bus_softreset(ap, devmask, deadline);
- if (err_mask) {
- ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", err_mask);
+ rc = scc_bus_softreset(ap, devmask, deadline);
+ if (rc) {
+ ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", rc);
return -EIO;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 013/143] ahci: Add Device IDs for Intel 9 Series PCH
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 012/143] pata_scc: propagate return value of scc_wait_after_reset Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 014/143] ahci: add pcid for Marvel 0x9182 controller Greg Kroah-Hartman
` (127 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Ralston, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <james.d.ralston@intel.com>
commit 1b071a0947dbce5c184c12262e02540fbc493457 upstream.
This patch adds the AHCI mode SATA Device IDs for the Intel 9 Series PCH.
Signed-off-by: James Ralston <james.d.ralston@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -304,6 +304,14 @@ static const struct pci_device_id ahci_p
{ PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
{ PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
{ PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
+ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
+ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
/* JMicron 360/1/3/5/6, match class to avoid IDE function */
{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 014/143] ahci: add pcid for Marvel 0x9182 controller
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 013/143] ahci: Add Device IDs for Intel 9 Series PCH Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 015/143] ibmveth: Fix endian issues with rx_no_buffer statistic Greg Kroah-Hartman
` (126 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Murali Karicheri, Tejun Heo,
Santosh Shilimkar
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Murali Karicheri <m-karicheri2@ti.com>
commit c5edfff9db6f4d2c35c802acb4abe0df178becee upstream.
Keystone K2E EVM uses Marvel 0x9182 controller. This requires support
for the ID in the ahci driver.
Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Santosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ahci.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -449,6 +449,8 @@ static const struct pci_device_id ahci_p
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */
+ { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 */
{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
.driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 015/143] ibmveth: Fix endian issues with rx_no_buffer statistic
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 014/143] ahci: add pcid for Marvel 0x9182 controller Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 016/143] arm64: flush TLS registers during exec Greg Kroah-Hartman
` (125 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Anton Blanchard, David S. Miller
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit cbd5228199d8be45d895d9d0cc2b8ce53835fc21 upstream.
Hidden away in the last 8 bytes of the buffer_list page is a solitary
statistic. It needs to be byte swapped or else ethtool -S will
produce numbers that terrify the user.
Since we do this in multiple places, create a helper function with a
comment explaining what is going on.
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/ibm/ibmveth.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/ibm/ibmveth.c
+++ b/drivers/net/ethernet/ibm/ibmveth.c
@@ -293,6 +293,18 @@ failure:
atomic_add(buffers_added, &(pool->available));
}
+/*
+ * The final 8 bytes of the buffer list is a counter of frames dropped
+ * because there was not a buffer in the buffer list capable of holding
+ * the frame.
+ */
+static void ibmveth_update_rx_no_buffer(struct ibmveth_adapter *adapter)
+{
+ __be64 *p = adapter->buffer_list_addr + 4096 - 8;
+
+ adapter->rx_no_buffer = be64_to_cpup(p);
+}
+
/* replenish routine */
static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
{
@@ -308,8 +320,7 @@ static void ibmveth_replenish_task(struc
ibmveth_replenish_buffer_pool(adapter, pool);
}
- adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);
}
/* empty and free ana buffer pool - also used to do cleanup in error paths */
@@ -689,8 +700,7 @@ static int ibmveth_close(struct net_devi
free_irq(netdev->irq, netdev);
- adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) +
- 4096 - 8);
+ ibmveth_update_rx_no_buffer(adapter);
ibmveth_cleanup(adapter);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 016/143] arm64: flush TLS registers during exec
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 015/143] ibmveth: Fix endian issues with rx_no_buffer statistic Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 017/143] i2c: at91: add bound checking on SMBus block length bytes Greg Kroah-Hartman
` (124 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nathan Lynch, Will Deacon
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit eb35bdd7bca29a13c8ecd44e6fd747a84ce675db upstream.
Nathan reports that we leak TLS information from the parent context
during an exec, as we don't clear the TLS registers when flushing the
thread state.
This patch updates the flushing code so that we:
(1) Unconditionally zero the tpidr_el0 register (since this is fully
context switched for native tasks and zeroed for compat tasks)
(2) Zero the tp_value state in thread_info before clearing the
tpidrr0_el0 register for compat tasks (since this is only writable
by the set_tls compat syscall and therefore not fully switched).
A missing compiler barrier is also added to the compat set_tls syscall.
Acked-by: Nathan Lynch <Nathan_Lynch@mentor.com>
Reported-by: Nathan Lynch <Nathan_Lynch@mentor.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/process.c | 18 ++++++++++++++++++
arch/arm64/kernel/sys_compat.c | 6 ++++++
2 files changed, 24 insertions(+)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -172,9 +172,27 @@ void exit_thread(void)
{
}
+static void tls_thread_flush(void)
+{
+ asm ("msr tpidr_el0, xzr");
+
+ if (is_compat_task()) {
+ current->thread.tp_value = 0;
+
+ /*
+ * We need to ensure ordering between the shadow state and the
+ * hardware state, so that we don't corrupt the hardware state
+ * with a stale shadow state during context switch.
+ */
+ barrier();
+ asm ("msr tpidrro_el0, xzr");
+ }
+}
+
void flush_thread(void)
{
fpsimd_flush_thread();
+ tls_thread_flush();
flush_ptrace_hw_breakpoint(current);
}
--- a/arch/arm64/kernel/sys_compat.c
+++ b/arch/arm64/kernel/sys_compat.c
@@ -79,6 +79,12 @@ long compat_arm_syscall(struct pt_regs *
case __ARM_NR_compat_set_tls:
current->thread.tp_value = regs->regs[0];
+
+ /*
+ * Protect against register corruption from context switch.
+ * See comment in tls_thread_flush.
+ */
+ barrier();
asm ("msr tpidrro_el0, %0" : : "r" (regs->regs[0]));
return 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 017/143] i2c: at91: add bound checking on SMBus block length bytes
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 016/143] arm64: flush TLS registers during exec Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 018/143] i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer Greg Kroah-Hartman
` (123 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marek Roszko, Ludovic Desroches,
Wolfram Sang
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Roszko <mark.roszko@gmail.com>
commit 75b81f339c6af43f6f4a1b3eabe0603321dade65 upstream.
The driver was not bound checking the received length byte to ensure it was within the
the buffer size that is allocated for SMBus blocks. This resulted in buffer overflows
whenever an invalid length byte was received.
It also failed to ensure the length byte was not zero. If it received zero, it would end up
in an infinite loop as the at91_twi_read_next_byte function returned immediately without
allowing RHR to be read to clear the RXRDY interrupt.
Tested agaisnt a SMBus compliant battery.
Signed-off-by: Marek Roszko <mark.roszko@gmail.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-at91.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -102,6 +102,7 @@ struct at91_twi_dev {
unsigned twi_cwgr_reg;
struct at91_twi_pdata *pdata;
bool use_dma;
+ bool recv_len_abort;
struct at91_twi_dma dma;
};
@@ -268,12 +269,24 @@ static void at91_twi_read_next_byte(stru
*dev->buf = at91_twi_read(dev, AT91_TWI_RHR) & 0xff;
--dev->buf_len;
+ /* return if aborting, we only needed to read RHR to clear RXRDY*/
+ if (dev->recv_len_abort)
+ return;
+
/* handle I2C_SMBUS_BLOCK_DATA */
if (unlikely(dev->msg->flags & I2C_M_RECV_LEN)) {
- dev->msg->flags &= ~I2C_M_RECV_LEN;
- dev->buf_len += *dev->buf;
- dev->msg->len = dev->buf_len + 1;
- dev_dbg(dev->dev, "received block length %d\n", dev->buf_len);
+ /* ensure length byte is a valid value */
+ if (*dev->buf <= I2C_SMBUS_BLOCK_MAX && *dev->buf > 0) {
+ dev->msg->flags &= ~I2C_M_RECV_LEN;
+ dev->buf_len += *dev->buf;
+ dev->msg->len = dev->buf_len + 1;
+ dev_dbg(dev->dev, "received block length %d\n",
+ dev->buf_len);
+ } else {
+ /* abort and send the stop by reading one more byte */
+ dev->recv_len_abort = true;
+ dev->buf_len = 1;
+ }
}
/* send stop if second but last byte has been read */
@@ -445,6 +458,12 @@ static int at91_do_twi_transfer(struct a
ret = -EIO;
goto error;
}
+ if (dev->recv_len_abort) {
+ dev_err(dev->dev, "invalid smbus block length recvd\n");
+ ret = -EPROTO;
+ goto error;
+ }
+
dev_dbg(dev->dev, "transfer complete\n");
return 0;
@@ -501,6 +520,7 @@ static int at91_twi_xfer(struct i2c_adap
dev->buf_len = m_start->len;
dev->buf = m_start->buf;
dev->msg = m_start;
+ dev->recv_len_abort = false;
ret = at91_do_twi_transfer(dev);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 018/143] i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer.
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 017/143] i2c: at91: add bound checking on SMBus block length bytes Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 019/143] trace: Fix epoll hang when we race with new entries Greg Kroah-Hartman
` (122 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Lindgren, Ludovic Desroches,
Wolfram Sang
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Lindgren <simon@aqwary.com>
commit 6721f28a26efd6368497abbdef5dcfc59608d899 upstream.
There is a race condition in at91_do_twi_xfer when signals arrive.
If a signal is recieved while waiting for a transfer to complete
wait_for_completion_interruptible_timeout() will return -ERESTARTSYS.
This is not handled correctly resulting in interrupts still being
enabled and a transfer being in flight when we return.
Symptoms include a range of oopses and bus lockups. Oopses can happen
when the transfer completes because the interrupt handler will corrupt
the stack. If a new transfer is started before the interrupt fires
the controller will start a new transfer in the middle of the old one,
resulting in confused slaves and a locked bus.
To avoid this, use wait_for_completion_io_timeout instead so that we
don't have to deal with gracefully shutting down the transfer and
disabling the interrupts.
Signed-off-by: Simon Lindgren <simon@aqwary.com>
Acked-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-at91.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -435,8 +435,8 @@ static int at91_do_twi_transfer(struct a
}
}
- ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
- dev->adapter.timeout);
+ ret = wait_for_completion_io_timeout(&dev->cmd_complete,
+ dev->adapter.timeout);
if (ret == 0) {
dev_err(dev->dev, "controller timed out\n");
at91_init_twi_bus(dev);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 019/143] trace: Fix epoll hang when we race with new entries
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 018/143] i2c: at91: Fix a race condition during signal handling in at91_do_twi_xfer Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 020/143] arm64: ptrace: fix compat hardware watchpoint reporting Greg Kroah-Hartman
` (121 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martin Lau, Josef Bacik,
Steven Rostedt
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <jbacik@fb.com>
commit 4ce97dbf50245227add17c83d87dc838e7ca79d0 upstream.
Epoll on trace_pipe can sometimes hang in a weird case. If the ring buffer is
empty when we set waiters_pending but an event shows up exactly at that moment
we can miss being woken up by the ring buffers irq work. Since
ring_buffer_empty() is inherently racey we will sometimes think that the buffer
is not empty. So we don't get woken up and we don't think there are any events
even though there were some ready when we added the watch, which makes us hang.
This patch fixes this by making sure that we are actually on the wait list
before we set waiters_pending, and add a memory barrier to make sure
ring_buffer_empty() is going to be correct.
Link: http://lkml.kernel.org/p/1408989581-23727-1-git-send-email-jbacik@fb.com
Cc: Martin Lau <kafai@fb.com>
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ring_buffer.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -626,8 +626,22 @@ int ring_buffer_poll_wait(struct ring_bu
work = &cpu_buffer->irq_work;
}
- work->waiters_pending = true;
poll_wait(filp, &work->waiters, poll_table);
+ work->waiters_pending = true;
+ /*
+ * There's a tight race between setting the waiters_pending and
+ * checking if the ring buffer is empty. Once the waiters_pending bit
+ * is set, the next event will wake the task up, but we can get stuck
+ * if there's only a single event in.
+ *
+ * FIXME: Ideally, we need a memory barrier on the writer side as well,
+ * but adding a memory barrier to all events will cause too much of a
+ * performance hit in the fast path. We only need a memory barrier when
+ * the buffer goes from empty to having content. But as this race is
+ * extremely small, and it's not a problem if another event comes in, we
+ * will fix it later.
+ */
+ smp_mb();
if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) ||
(cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu)))
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 020/143] arm64: ptrace: fix compat hardware watchpoint reporting
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 019/143] trace: Fix epoll hang when we race with new entries Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 021/143] ALSA: core: fix buffer overflow in snd_info_get_line() Greg Kroah-Hartman
` (120 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Will Deacon
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 27d7ff273c2aad37b28f6ff0cab2cfa35b51e648 upstream.
I'm not sure what I was on when I wrote this, but when iterating over
the hardware watchpoint array (hbp_watch_array), our index is off by
ARM_MAX_BRP, so we walk off the end of our thread_struct...
... except, a dodgy condition in the loop means that it never executes
at all (bp cannot be NULL).
This patch fixes the code so that we remove the bp check and use the
correct index for accessing the watchpoint structures.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/hw_breakpoint.h | 1 -
arch/arm64/kernel/ptrace.c | 3 ++-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm64/include/asm/hw_breakpoint.h
+++ b/arch/arm64/include/asm/hw_breakpoint.h
@@ -79,7 +79,6 @@ static inline void decode_ctrl_reg(u32 r
*/
#define ARM_MAX_BRP 16
#define ARM_MAX_WRP 16
-#define ARM_MAX_HBP_SLOTS (ARM_MAX_BRP + ARM_MAX_WRP)
/* Virtual debug register bases. */
#define AARCH64_DBG_REG_BVR 0
--- a/arch/arm64/kernel/ptrace.c
+++ b/arch/arm64/kernel/ptrace.c
@@ -103,7 +103,8 @@ static void ptrace_hbptriggered(struct p
break;
}
}
- for (i = ARM_MAX_BRP; i < ARM_MAX_HBP_SLOTS && !bp; ++i) {
+
+ for (i = 0; i < ARM_MAX_WRP; ++i) {
if (current->thread.debug.hbp_watch[i] == bp) {
info.si_errno = -((i << 1) + 1);
break;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 021/143] ALSA: core: fix buffer overflow in snd_info_get_line()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 020/143] arm64: ptrace: fix compat hardware watchpoint reporting Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 022/143] ALSA: hda - Fix COEF setups for ALC1150 codec Greg Kroah-Hartman
` (119 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tommi Rantala, Clemens Ladisch,
Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <clemens@ladisch.de>
commit ddc64b278a4dda052390b3de1b551e59acdff105 upstream.
snd_info_get_line() documents that its last parameter must be one
less than the buffer size, but this API design guarantees that
(literally) every caller gets it wrong.
Just change this parameter to have its obvious meaning.
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/info.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/core/info.c
+++ b/sound/core/info.c
@@ -679,7 +679,7 @@ int snd_info_card_free(struct snd_card *
* snd_info_get_line - read one line from the procfs buffer
* @buffer: the procfs buffer
* @line: the buffer to store
- * @len: the max. buffer size - 1
+ * @len: the max. buffer size
*
* Reads one line from the buffer and stores the string.
*
@@ -699,7 +699,7 @@ int snd_info_get_line(struct snd_info_bu
buffer->stop = 1;
if (c == '\n')
break;
- if (len) {
+ if (len > 1) {
len--;
*line++ = c;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 022/143] ALSA: hda - Fix COEF setups for ALC1150 codec
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 021/143] ALSA: core: fix buffer overflow in snd_info_get_line() Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 023/143] ALSA: hda - Fix invalid pin powermap without jack detection Greg Kroah-Hartman
` (118 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit acf08081adb5e8fe0519eb97bb49797ef52614d6 upstream.
ALC1150 codec seems to need the COEF- and PLL-setups just like its
compatible ALC882 codec. Some machines (e.g. SunMicro X10SAT) show
the problem like too low output volumes unless the COEF setup is
applied.
Reported-and-tested-by: Dana Goyette <danagoyette@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -318,6 +318,7 @@ static void alc_auto_init_amp(struct hda
case 0x10ec0885:
case 0x10ec0887:
/*case 0x10ec0889:*/ /* this causes an SPDIF problem */
+ case 0x10ec0900:
alc889_coef_init(codec);
break;
case 0x10ec0888:
@@ -2252,6 +2253,7 @@ static int patch_alc882(struct hda_codec
switch (codec->vendor_id) {
case 0x10ec0882:
case 0x10ec0885:
+ case 0x10ec0900:
break;
default:
/* ALC883 and variants */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 023/143] ALSA: hda - Fix invalid pin powermap without jack detection
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 022/143] ALSA: hda - Fix COEF setups for ALC1150 codec Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 024/143] ALSA: pcm: fix fifo_size frame calculation Greg Kroah-Hartman
` (117 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Adam Richter, Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 7a9744cb455e6faa287e148394b4b422a6f3c5c4 upstream.
When a driver is set up without the jack detection explicitly (either
by passing a model option or via a specific fixup), the pin powermap
of IDT/STAC codecs is set up wrongly, resulting in the silence
output. It's because of a logic failure in stac_init_power_map().
It tries to avoid creating a callback for the pins that have other
auto-hp and auto-mic callbacks, but the check is done in a wrong way
at a wrong time. The stac_init_power_map() should be called after
creating other jack detection ctls, and the jack callback should be
created only for jack-detectable widgets.
This patch fixes the check in stac_init_power_map() and its callee
at the right place, after snd_hda_gen_build_controls().
Reported-by: Adam Richter <adam_richter2004@yahoo.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_sigmatel.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -539,8 +539,8 @@ static void stac_init_power_map(struct h
if (snd_hda_jack_tbl_get(codec, nid))
continue;
if (def_conf == AC_JACK_PORT_COMPLEX &&
- !(spec->vref_mute_led_nid == nid ||
- is_jack_detectable(codec, nid))) {
+ spec->vref_mute_led_nid != nid &&
+ is_jack_detectable(codec, nid)) {
snd_hda_jack_detect_enable_callback(codec, nid,
STAC_PWR_EVENT,
jack_update_power);
@@ -3647,11 +3647,18 @@ static int stac_parse_auto_config(struct
return err;
}
- stac_init_power_map(codec);
-
return 0;
}
+static int stac_build_controls(struct hda_codec *codec)
+{
+ int err = snd_hda_gen_build_controls(codec);
+
+ if (err < 0)
+ return err;
+ stac_init_power_map(codec);
+ return 0;
+}
static int stac_init(struct hda_codec *codec)
{
@@ -3794,7 +3801,7 @@ static void stac_set_power_state(struct
#endif /* CONFIG_PM */
static const struct hda_codec_ops stac_patch_ops = {
- .build_controls = snd_hda_gen_build_controls,
+ .build_controls = stac_build_controls,
.build_pcms = snd_hda_gen_build_pcms,
.init = stac_init,
.free = stac_free,
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 024/143] ALSA: pcm: fix fifo_size frame calculation
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 023/143] ALSA: hda - Fix invalid pin powermap without jack detection Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 025/143] cfq-iosched: Fix wrong children_weight calculation Greg Kroah-Hartman
` (116 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Clemens Ladisch, Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Ladisch <clemens@ladisch.de>
commit a9960e6a293e6fc3ed414643bb4e4106272e4d0a upstream.
The calculated frame size was wrong because snd_pcm_format_physical_width()
actually returns the number of bits, not bytes.
Use snd_pcm_format_size() instead, which not only returns bytes, but also
simplifies the calculation.
Fixes: 8bea869c5e56 ("ALSA: PCM midlevel: improve fifo_size handling")
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_lib.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1782,14 +1782,16 @@ static int snd_pcm_lib_ioctl_fifo_size(s
{
struct snd_pcm_hw_params *params = arg;
snd_pcm_format_t format;
- int channels, width;
+ int channels;
+ ssize_t frame_size;
params->fifo_size = substream->runtime->hw.fifo_size;
if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) {
format = params_format(params);
channels = params_channels(params);
- width = snd_pcm_format_physical_width(format);
- params->fifo_size /= width * channels;
+ frame_size = snd_pcm_format_size(format, channels);
+ if (frame_size > 0)
+ params->fifo_size /= (unsigned)frame_size;
}
return 0;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 025/143] cfq-iosched: Fix wrong children_weight calculation
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 024/143] ALSA: pcm: fix fifo_size frame calculation Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 026/143] HID: picolcd: sanity check report size in raw_event() callback Greg Kroah-Hartman
` (115 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ruki Sekiya, Toshiaki Makita,
Tejun Heo, Jens Axboe
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
commit e15693ef18e13e3e6bffe891fe140f18b8ff6d07 upstream.
cfq_group_service_tree_add() is applying new_weight at the beginning of
the function via cfq_update_group_weight().
This actually allows weight to change between adding it to and subtracting
it from children_weight, and triggers WARN_ON_ONCE() in
cfq_group_service_tree_del(), or even causes oops by divide error during
vfr calculation in cfq_group_service_tree_add().
The detailed scenario is as follows:
1. Create blkio cgroups X and Y as a child of X.
Set X's weight to 500 and perform some I/O to apply new_weight.
This X's I/O completes before starting Y's I/O.
2. Y starts I/O and cfq_group_service_tree_add() is called with Y.
3. cfq_group_service_tree_add() walks up the tree during children_weight
calculation and adds parent X's weight (500) to children_weight of root.
children_weight becomes 500.
4. Set X's weight to 1000.
5. X starts I/O and cfq_group_service_tree_add() is called with X.
6. cfq_group_service_tree_add() applies its new_weight (1000).
7. I/O of Y completes and cfq_group_service_tree_del() is called with Y.
8. I/O of X completes and cfq_group_service_tree_del() is called with X.
9. cfq_group_service_tree_del() subtracts X's weight (1000) from
children_weight of root. children_weight becomes -500.
This triggers WARN_ON_ONCE().
10. Set X's weight to 500.
11. X starts I/O and cfq_group_service_tree_add() is called with X.
12. cfq_group_service_tree_add() applies its new_weight (500) and adds it
to children_weight of root. children_weight becomes 0. Calcularion of
vfr triggers oops by divide error.
weight should be updated right before adding it to children_weight.
Reported-by: Ruki Sekiya <sekiya.ruki@lab.ntt.co.jp>
Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/cfq-iosched.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -1275,12 +1275,16 @@ __cfq_group_service_tree_add(struct cfq_
static void
cfq_update_group_weight(struct cfq_group *cfqg)
{
- BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
-
if (cfqg->new_weight) {
cfqg->weight = cfqg->new_weight;
cfqg->new_weight = 0;
}
+}
+
+static void
+cfq_update_group_leaf_weight(struct cfq_group *cfqg)
+{
+ BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
if (cfqg->new_leaf_weight) {
cfqg->leaf_weight = cfqg->new_leaf_weight;
@@ -1299,7 +1303,7 @@ cfq_group_service_tree_add(struct cfq_rb
/* add to the service tree */
BUG_ON(!RB_EMPTY_NODE(&cfqg->rb_node));
- cfq_update_group_weight(cfqg);
+ cfq_update_group_leaf_weight(cfqg);
__cfq_group_service_tree_add(st, cfqg);
/*
@@ -1323,6 +1327,7 @@ cfq_group_service_tree_add(struct cfq_rb
*/
while ((parent = cfqg_parent(pos))) {
if (propagate) {
+ cfq_update_group_weight(pos);
propagate = !parent->nr_active++;
parent->children_weight += pos->weight;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 026/143] HID: picolcd: sanity check report size in raw_event() callback
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 025/143] cfq-iosched: Fix wrong children_weight calculation Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 027/143] HID: magicmouse: " Greg Kroah-Hartman
` (114 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Vittitoe, Jiri Kosina
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit 844817e47eef14141cf59b8d5ac08dd11c0a9189 upstream.
The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that raw_data
that we hold in picolcd_pending structure are always kept within proper
bounds.
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-picolcd_core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -350,6 +350,12 @@ static int picolcd_raw_event(struct hid_
if (!data)
return 1;
+ if (size > 64) {
+ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
+ size);
+ return 0;
+ }
+
if (report->id == REPORT_KEY_STATE) {
if (data->input_keys)
ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 027/143] HID: magicmouse: sanity check report size in raw_event() callback
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 026/143] HID: picolcd: sanity check report size in raw_event() callback Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 028/143] HID: logitech-dj: prevent false errors to be shown Greg Kroah-Hartman
` (113 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steven Vittitoe, Jiri Kosina
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <jkosina@suse.cz>
commit c54def7bd64d7c0b6993336abcffb8444795bf38 upstream.
The report passed to us from transport driver could potentially be
arbitrarily large, therefore we better sanity-check it so that
magicmouse_emit_touch() gets only valid values of raw_id.
Reported-by: Steven Vittitoe <scvitti@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-magicmouse.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/hid/hid-magicmouse.c
+++ b/drivers/hid/hid-magicmouse.c
@@ -290,6 +290,11 @@ static int magicmouse_raw_event(struct h
if (size < 4 || ((size - 4) % 9) != 0)
return 0;
npoints = (size - 4) / 9;
+ if (npoints > 15) {
+ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
+ size);
+ return 0;
+ }
msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
@@ -307,6 +312,11 @@ static int magicmouse_raw_event(struct h
if (size < 6 || ((size - 6) % 8) != 0)
return 0;
npoints = (size - 6) / 8;
+ if (npoints > 15) {
+ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
+ size);
+ return 0;
+ }
msc->ntouches = 0;
for (ii = 0; ii < npoints; ii++)
magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 028/143] HID: logitech-dj: prevent false errors to be shown
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 027/143] HID: magicmouse: " Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 029/143] drm/i915: Remove bogus __init annotation from DMI callbacks Greg Kroah-Hartman
` (112 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Benjamin Tissoires, Jiri Kosina
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
commit 5abfe85c1d4694d5d4bbd13ecc166262b937adf0 upstream.
Commit "HID: logitech: perform bounds checking on device_id early
enough" unfortunately leaks some errors to dmesg which are not real
ones:
- if the report is not a DJ one, then there is not point in checking
the device_id
- the receiver (index 0) can also receive some notifications which
can be safely ignored given the current implementation
Move out the test regarding the report_id and also discards
printing errors when the receiver got notified.
Fixes: ad3e14d7c5268c2e24477c6ef54bbdf88add5d36
Reported-and-tested-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-dj.c | 43 ++++++++++++++++++++++++------------------
drivers/hid/hid-logitech-dj.h | 1
2 files changed, 26 insertions(+), 18 deletions(-)
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -679,7 +679,6 @@ static int logi_dj_raw_event(struct hid_
struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
struct dj_report *dj_report = (struct dj_report *) data;
unsigned long flags;
- bool report_processed = false;
dbg_hid("%s, size:%d\n", __func__, size);
@@ -706,34 +705,42 @@ static int logi_dj_raw_event(struct hid_
* device (via hid_input_report() ) and return 1 so hid-core does not do
* anything else with it.
*/
+
+ /* case 1) */
+ if (data[0] != REPORT_ID_DJ_SHORT)
+ return false;
+
if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
(dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
- dev_err(&hdev->dev, "%s: invalid device index:%d\n",
+ /*
+ * Device index is wrong, bail out.
+ * This driver can ignore safely the receiver notifications,
+ * so ignore those reports too.
+ */
+ if (dj_report->device_index != DJ_RECEIVER_INDEX)
+ dev_err(&hdev->dev, "%s: invalid device index:%d\n",
__func__, dj_report->device_index);
return false;
}
spin_lock_irqsave(&djrcv_dev->lock, flags);
- if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
- switch (dj_report->report_type) {
- case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
- case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
- logi_dj_recv_queue_notification(djrcv_dev, dj_report);
- break;
- case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
- if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
- STATUS_LINKLOSS) {
- logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
- }
- break;
- default:
- logi_dj_recv_forward_report(djrcv_dev, dj_report);
+ switch (dj_report->report_type) {
+ case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
+ case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
+ logi_dj_recv_queue_notification(djrcv_dev, dj_report);
+ break;
+ case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
+ if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
+ STATUS_LINKLOSS) {
+ logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
}
- report_processed = true;
+ break;
+ default:
+ logi_dj_recv_forward_report(djrcv_dev, dj_report);
}
spin_unlock_irqrestore(&djrcv_dev->lock, flags);
- return report_processed;
+ return true;
}
static int logi_dj_probe(struct hid_device *hdev,
--- a/drivers/hid/hid-logitech-dj.h
+++ b/drivers/hid/hid-logitech-dj.h
@@ -27,6 +27,7 @@
#define DJ_MAX_PAIRED_DEVICES 6
#define DJ_MAX_NUMBER_NOTIFICATIONS 8
+#define DJ_RECEIVER_INDEX 0
#define DJ_DEVICE_INDEX_MIN 1
#define DJ_DEVICE_INDEX_MAX 6
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 029/143] drm/i915: Remove bogus __init annotation from DMI callbacks
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 028/143] HID: logitech-dj: prevent false errors to be shown Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 031/143] drm/ast: AST2000 cannot be detected correctly Greg Kroah-Hartman
` (111 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mathias Krause, Daniel Vetter,
Duncan Laurie, Jarod Wilson, Jani Nikula, Rusty Russell
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
commit bbe1c2740d3a25aa1dbe5d842d2ff09cddcdde0a upstream.
The __init annotations for the DMI callback functions are wrong as this
code can be called even after the module has been initialized, e.g. like
this:
# echo 1 > /sys/bus/pci/devices/0000:00:02.0/remove
# modprobe i915
# echo 1 > /sys/bus/pci/rescan
The first command will remove the PCI device from the kernel's device
list so the second command won't see it right away. But as it registers
a PCI driver it'll see it on the third command. If the system happens to
match one of the DMI table entries we'll try to call a function in long
released memory and generate an Oops, at best.
Fix this by removing the bogus annotation.
Modpost should have caught that one but it ignores section reference
mismatches from the .rodata section. :/
Fixes: 25e341cfc33d ("drm/i915: quirk away broken OpRegion VBT")
Fixes: 8ca4013d702d ("CHROMIUM: i915: Add DMI override to skip CRT...")
Fixes: 425d244c8670 ("drm/i915: ignore LVDS on intel graphics systems...")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Duncan Laurie <dlaurie@chromium.org>
Cc: Jarod Wilson <jarod@redhat.com>
Cc: Rusty Russell <rusty@rustcorp.com.au> # Can modpost be fixed?
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/intel_bios.c | 2 +-
drivers/gpu/drm/i915/intel_crt.c | 2 +-
drivers/gpu/drm/i915/intel_lvds.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -657,7 +657,7 @@ init_vbt_defaults(struct drm_i915_privat
DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq);
}
-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
{
DRM_DEBUG_KMS("Falling back to manually reading VBT from "
"VBIOS ROM for %s\n",
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -702,7 +702,7 @@ static const struct drm_encoder_funcs in
.destroy = intel_encoder_destroy,
};
-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_crt_dmi_callback(const struct dmi_system_id *id)
{
DRM_INFO("Skipping CRT initialization for %s\n", id->ident);
return 1;
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -694,7 +694,7 @@ static const struct drm_encoder_funcs in
.destroy = intel_encoder_destroy,
};
-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
{
DRM_INFO("Skipping LVDS initialization for %s\n", id->ident);
return 1;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 031/143] drm/ast: AST2000 cannot be detected correctly
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 029/143] drm/i915: Remove bogus __init annotation from DMI callbacks Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 032/143] drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle Greg Kroah-Hartman
` (110 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Y.C. Chen, Egbert Eich, Dave Airlie
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Y.C. Chen" <yc_chen@aspeedtech.com>
commit 83502a5d34386f7c6973bc70e1c423f55f5a2e3a upstream.
Type error and cause AST2000 cannot be detected correctly
Signed-off-by: Y.C. Chen <yc_chen@aspeedtech.com>
Reviewed-by: Egbert Eich <eich@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -100,7 +100,7 @@ static int ast_detect_chip(struct drm_de
}
ast->vga2_clone = false;
} else {
- ast->chip = 2000;
+ ast->chip = AST2000;
DRM_INFO("AST 2000 detected\n");
}
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 032/143] drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 031/143] drm/ast: AST2000 cannot be detected correctly Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 033/143] drm/radeon: add connector quirk for fujitsu board Greg Kroah-Hartman
` (109 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Mark Sheldon,
Jakob Bornecrantz
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit f01ea0c3d9db536c64d47922716d8b3b8f21d850 upstream.
The code waiting for fifo idle was incorrect and could possibly spin
forever under certain circumstances.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reported-by: Mark Sheldon <markshel@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Reivewed-by: Mark Sheldon <markshel@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_private
mutex_lock(&dev_priv->hw_mutex);
+ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
- vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+ ;
dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 033/143] drm/radeon: add connector quirk for fujitsu board
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 032/143] drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 034/143] xtensa: replace IOCTL code definitions with constants Greg Kroah-Hartman
` (108 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 1952f24d0fa6292d65f886887af87ba8ac79b3ba upstream.
Vbios connector table lists non-existent VGA port.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=83184
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -463,6 +463,13 @@ static bool radeon_atom_apply_quirks(str
}
}
+ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
+ if ((dev->pdev->device == 0x9805) &&
+ (dev->pdev->subsystem_vendor == 0x1734) &&
+ (dev->pdev->subsystem_device == 0x11bd)) {
+ if (*connector_type == DRM_MODE_CONNECTOR_VGA)
+ return false;
+ }
return true;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 034/143] xtensa: replace IOCTL code definitions with constants
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 033/143] drm/radeon: add connector quirk for fujitsu board Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 035/143] xtensa: fix address checks in dma_{alloc,free}_coherent Greg Kroah-Hartman
` (107 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit f61bf8e7d19e0a3456a7a9ed97c399e4353698dc upstream.
This fixes userspace code that builds on other architectures but fails
on xtensa due to references to structures that other architectures don't
refer to. E.g. this fixes the following issue with python-2.7.8:
python-2.7.8/Modules/termios.c:861:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct'
{"TIOCSERGETMULTI", TIOCSERGETMULTI},
python-2.7.8/Modules/termios.c:870:25: error: invalid application
of 'sizeof' to incomplete type 'struct serial_multiport_struct'
{"TIOCSERSETMULTI", TIOCSERSETMULTI},
python-2.7.8/Modules/termios.c:900:24: error: invalid application
of 'sizeof' to incomplete type 'struct tty_struct'
{"TIOCTTYGSTRUCT", TIOCTTYGSTRUCT},
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/include/uapi/asm/ioctls.h | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/arch/xtensa/include/uapi/asm/ioctls.h
+++ b/arch/xtensa/include/uapi/asm/ioctls.h
@@ -28,17 +28,17 @@
#define TCSETSW 0x5403
#define TCSETSF 0x5404
-#define TCGETA _IOR('t', 23, struct termio)
-#define TCSETA _IOW('t', 24, struct termio)
-#define TCSETAW _IOW('t', 25, struct termio)
-#define TCSETAF _IOW('t', 28, struct termio)
+#define TCGETA 0x80127417 /* _IOR('t', 23, struct termio) */
+#define TCSETA 0x40127418 /* _IOW('t', 24, struct termio) */
+#define TCSETAW 0x40127419 /* _IOW('t', 25, struct termio) */
+#define TCSETAF 0x4012741C /* _IOW('t', 28, struct termio) */
#define TCSBRK _IO('t', 29)
#define TCXONC _IO('t', 30)
#define TCFLSH _IO('t', 31)
-#define TIOCSWINSZ _IOW('t', 103, struct winsize)
-#define TIOCGWINSZ _IOR('t', 104, struct winsize)
+#define TIOCSWINSZ 0x40087467 /* _IOW('t', 103, struct winsize) */
+#define TIOCGWINSZ 0x80087468 /* _IOR('t', 104, struct winsize) */
#define TIOCSTART _IO('t', 110) /* start output, like ^Q */
#define TIOCSTOP _IO('t', 111) /* stop output, like ^S */
#define TIOCOUTQ _IOR('t', 115, int) /* output queue size */
@@ -88,7 +88,6 @@
#define TIOCSETD _IOW('T', 35, int)
#define TIOCGETD _IOR('T', 36, int)
#define TCSBRKP _IOW('T', 37, int) /* Needed for POSIX tcsendbreak()*/
-#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct) /* For debugging only*/
#define TIOCSBRK _IO('T', 39) /* BSD compatibility */
#define TIOCCBRK _IO('T', 40) /* BSD compatibility */
#define TIOCGSID _IOR('T', 41, pid_t) /* Return the session ID of FD*/
@@ -114,8 +113,10 @@
#define TIOCSERGETLSR _IOR('T', 89, unsigned int) /* Get line status reg. */
/* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
# define TIOCSER_TEMT 0x01 /* Transmitter physically empty */
-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config */
-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
+#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config */
+ /* _IOR('T', 90, struct serial_multiport_struct) */
+#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */
+ /* _IOW('T', 91, struct serial_multiport_struct) */
#define TIOCMIWAIT _IO('T', 92) /* wait for a change on serial input line(s) */
#define TIOCGICOUNT 0x545D /* read serial port inline interrupt counts */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 035/143] xtensa: fix address checks in dma_{alloc,free}_coherent
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 034/143] xtensa: replace IOCTL code definitions with constants Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 036/143] xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS Greg Kroah-Hartman
` (106 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Douglas, Max Filippov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Douglas <adouglas@cadence.com>
commit 1ca49463c44c970b1ab1d71b0f268bfdf8427a7e upstream.
Virtual address is translated to the XCHAL_KSEG_CACHED region in the
dma_free_coherent, but is checked to be in the 0...XCHAL_KSEG_SIZE
range.
Change check for end of the range from 'addr >= X' to 'addr > X - 1' to
handle the case of X == 0.
Replace 'if (C) BUG();' construct with 'BUG_ON(C);'.
Signed-off-by: Alan Douglas <adouglas@cadence.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/kernel/pci-dma.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/arch/xtensa/kernel/pci-dma.c
+++ b/arch/xtensa/kernel/pci-dma.c
@@ -49,9 +49,8 @@ dma_alloc_coherent(struct device *dev,si
/* We currently don't support coherent memory outside KSEG */
- if (ret < XCHAL_KSEG_CACHED_VADDR
- || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE)
- BUG();
+ BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
+ ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
if (ret != 0) {
@@ -68,10 +67,11 @@ EXPORT_SYMBOL(dma_alloc_coherent);
void dma_free_coherent(struct device *hwdev, size_t size,
void *vaddr, dma_addr_t dma_handle)
{
- long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR;
+ unsigned long addr = (unsigned long)vaddr +
+ XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
- if (addr < 0 || addr >= XCHAL_KSEG_SIZE)
- BUG();
+ BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
+ addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
free_pages(addr, get_order(size));
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 036/143] xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 035/143] xtensa: fix address checks in dma_{alloc,free}_coherent Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 037/143] xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss Greg Kroah-Hartman
` (105 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 52247123749cc3cbc30168b33ad8c69515c96d23 upstream.
With SMP and a lot of debug options enabled task_struct::thread gets out
of reach of s32i/l32i instructions with base pointing at task_struct,
breaking build with the following messages:
arch/xtensa/kernel/entry.S: Assembler messages:
arch/xtensa/kernel/entry.S:1002: Error: operand 3 of 'l32i.n' has invalid value '1048'
arch/xtensa/kernel/entry.S:1831: Error: operand 3 of 's32i.n' has invalid value '1040'
arch/xtensa/kernel/entry.S:1832: Error: operand 3 of 's32i.n' has invalid value '1044'
Change base to point to task_struct::thread in such cases.
Don't use a10 in _switch_to to save/restore prev pointer as a2 is not
clobbered.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/include/asm/uaccess.h | 5 +++++
arch/xtensa/kernel/entry.S | 12 ++++++++----
2 files changed, 13 insertions(+), 4 deletions(-)
--- a/arch/xtensa/include/asm/uaccess.h
+++ b/arch/xtensa/include/asm/uaccess.h
@@ -52,7 +52,12 @@
*/
.macro get_fs ad, sp
GET_CURRENT(\ad,\sp)
+#if THREAD_CURRENT_DS > 1020
+ addi \ad, \ad, TASK_THREAD
+ l32i \ad, \ad, THREAD_CURRENT_DS - TASK_THREAD
+#else
l32i \ad, \ad, THREAD_CURRENT_DS
+#endif
.endm
/*
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1961,7 +1961,6 @@ ENTRY(_switch_to)
entry a1, 16
- mov a10, a2 # preserve 'prev' (a2)
mov a11, a3 # and 'next' (a3)
l32i a4, a2, TASK_THREAD_INFO
@@ -1969,8 +1968,14 @@ ENTRY(_switch_to)
save_xtregs_user a4 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
- s32i a0, a10, THREAD_RA # save return address
- s32i a1, a10, THREAD_SP # save stack pointer
+#if THREAD_RA > 1020 || THREAD_SP > 1020
+ addi a10, a2, TASK_THREAD
+ s32i a0, a10, THREAD_RA - TASK_THREAD # save return address
+ s32i a1, a10, THREAD_SP - TASK_THREAD # save stack pointer
+#else
+ s32i a0, a2, THREAD_RA # save return address
+ s32i a1, a2, THREAD_SP # save stack pointer
+#endif
/* Disable ints while we manipulate the stack pointer. */
@@ -2011,7 +2016,6 @@ ENTRY(_switch_to)
load_xtregs_user a5 a6 a8 a9 a12 a13 THREAD_XTREGS_USER
wsr a14, ps
- mov a2, a10 # return 'prev'
rsync
retw
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 037/143] xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 036/143] xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 038/143] xtensa: fix a6 and a7 handling in fast_syscall_xtensa Greg Kroah-Hartman
` (104 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 7128039fe2dd3d59da9e4ffa036f3aaa3ba87b9f upstream.
Current definition of TLBTEMP_BASE_2 is always 32K above the
TLBTEMP_BASE_1, whereas fast_second_level_miss handler for the TLBTEMP
region analyzes virtual address bit (PAGE_SHIFT + DCACHE_ALIAS_ORDER)
to determine TLBTEMP region where the fault happened. The size of the
TLBTEMP region is also checked incorrectly: not 64K, but twice data
cache way size (whicht may as well be less than the instruction cache
way size).
Fix TLBTEMP_BASE_2 to be TLBTEMP_BASE_1 + data cache way size.
Provide TLBTEMP_SIZE that is a greater of doubled data cache way size or
the instruction cache way size, and use it to determine if the second
level TLB miss occured in the TLBTEMP region.
Practical occurence of page faults in the TLBTEMP area is extremely
rare, this code can be tested by deletion of all w[di]tlb instructions
in the tlbtemp_mapping region.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/include/asm/pgtable.h | 7 ++++++-
arch/xtensa/kernel/entry.S | 2 +-
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/arch/xtensa/include/asm/pgtable.h
+++ b/arch/xtensa/include/asm/pgtable.h
@@ -68,7 +68,12 @@
#define VMALLOC_START 0xC0000000
#define VMALLOC_END 0xC7FEFFFF
#define TLBTEMP_BASE_1 0xC7FF0000
-#define TLBTEMP_BASE_2 0xC7FF8000
+#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
+#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
+#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE)
+#else
+#define TLBTEMP_SIZE ICACHE_WAY_SIZE
+#endif
/*
* Xtensa Linux config PTE layout (when present):
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1703,7 +1703,7 @@ ENTRY(fast_second_level_miss)
rsr a0, excvaddr
bltu a0, a3, 2f
- addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT))
+ addi a1, a0, -TLBTEMP_SIZE
bgeu a1, a3, 2f
/* Check if we have to restore an ITLB mapping. */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 038/143] xtensa: fix a6 and a7 handling in fast_syscall_xtensa
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 037/143] xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 039/143] USB: serial: pl2303: add device id for ztek device Greg Kroah-Hartman
` (103 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Max Filippov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit d1b6ba82a50cecf94be540a3a153aa89d97511a0 upstream.
Remove restoring a6 on some return paths and instead modify and restore
it in a single place, using symbolic name.
Correctly restore a7 from PT_AREG7 in case of illegal a6 value.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/kernel/entry.S | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
--- a/arch/xtensa/kernel/entry.S
+++ b/arch/xtensa/kernel/entry.S
@@ -1121,9 +1121,8 @@ ENTRY(fast_syscall_xtensa)
movi a7, 4 # sizeof(unsigned int)
access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp
- addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1
- _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill
- _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp
+ _bgeui a6, SYS_XTENSA_COUNT, .Lill
+ _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp
/* Fall through for ATOMIC_CMP_SWP. */
@@ -1135,27 +1134,26 @@ TRY s32i a5, a3, 0 # different, modify
l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, 1 # and return 1
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe
1: l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, 0 # return 0 (note that we cannot set
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe
.Lnswp: /* Atomic set, add, and exg_add. */
TRY l32i a7, a3, 0 # orig
+ addi a6, a6, -SYS_XTENSA_ATOMIC_SET
add a0, a4, a7 # + arg
moveqz a0, a4, a6 # set
+ addi a6, a6, SYS_XTENSA_ATOMIC_SET
TRY s32i a0, a3, 0 # write new value
mov a0, a2
mov a2, a7
l32i a7, a0, PT_AREG7 # restore a7
l32i a0, a0, PT_AREG0 # restore a0
- addi a6, a6, 1 # restore a6 (really necessary?)
rfe
CATCH
@@ -1164,7 +1162,7 @@ CATCH
movi a2, -EFAULT
rfe
-.Lill: l32i a7, a2, PT_AREG0 # restore a7
+.Lill: l32i a7, a2, PT_AREG7 # restore a7
l32i a0, a2, PT_AREG0 # restore a0
movi a2, -EINVAL
rfe
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 039/143] USB: serial: pl2303: add device id for ztek device
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 038/143] xtensa: fix a6 and a7 handling in fast_syscall_xtensa Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 040/143] USB: serial: fix potential stack buffer overflow Greg Kroah-Hartman
` (102 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mike Chu, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg KH <gregkh@linuxfoundation.org>
commit 91fcb1ce420e0a5f8d92d556d7008a78bc6ce1eb upstream.
This adds a new device id to the pl2303 driver for the ZTEK device.
Reported-by: Mike Chu <Mike-Chu@prolific.com.tw>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
drivers/usb/serial/pl2303.c | 1 +
drivers/usb/serial/pl2303.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -47,6 +47,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -22,6 +22,7 @@
#define PL2303_PRODUCT_ID_GPRS 0x0609
#define PL2303_PRODUCT_ID_HCR331 0x331a
#define PL2303_PRODUCT_ID_MOTOROLA 0x0307
+#define PL2303_PRODUCT_ID_ZTEK 0xe1f1
#define ATEN_VENDOR_ID 0x0557
#define ATEN_VENDOR_ID2 0x0547
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 040/143] USB: serial: fix potential stack buffer overflow
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 039/143] USB: serial: pl2303: add device id for ztek device Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 041/143] USB: sisusb: add device id for Magic Control USB video Greg Kroah-Hartman
` (101 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d979e9f9ecab04c1ecca741370e30a8a498893f5 upstream.
Make sure to verify the maximum number of endpoints per type to avoid
writing beyond the end of a stack-allocated array.
The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of endpoints of a certain
type reported by a device did not exceed this limit.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/usb-serial.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -778,29 +778,39 @@ static int usb_serial_probe(struct usb_i
if (usb_endpoint_is_bulk_in(endpoint)) {
/* we found a bulk in endpoint */
dev_dbg(ddev, "found bulk in on endpoint %d\n", i);
- bulk_in_endpoint[num_bulk_in] = endpoint;
- ++num_bulk_in;
+ if (num_bulk_in < MAX_NUM_PORTS) {
+ bulk_in_endpoint[num_bulk_in] = endpoint;
+ ++num_bulk_in;
+ }
}
if (usb_endpoint_is_bulk_out(endpoint)) {
/* we found a bulk out endpoint */
dev_dbg(ddev, "found bulk out on endpoint %d\n", i);
- bulk_out_endpoint[num_bulk_out] = endpoint;
- ++num_bulk_out;
+ if (num_bulk_out < MAX_NUM_PORTS) {
+ bulk_out_endpoint[num_bulk_out] = endpoint;
+ ++num_bulk_out;
+ }
}
if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in on endpoint %d\n", i);
- interrupt_in_endpoint[num_interrupt_in] = endpoint;
- ++num_interrupt_in;
+ if (num_interrupt_in < MAX_NUM_PORTS) {
+ interrupt_in_endpoint[num_interrupt_in] =
+ endpoint;
+ ++num_interrupt_in;
+ }
}
if (usb_endpoint_is_int_out(endpoint)) {
/* we found an interrupt out endpoint */
dev_dbg(ddev, "found interrupt out on endpoint %d\n", i);
- interrupt_out_endpoint[num_interrupt_out] = endpoint;
- ++num_interrupt_out;
+ if (num_interrupt_out < MAX_NUM_PORTS) {
+ interrupt_out_endpoint[num_interrupt_out] =
+ endpoint;
+ ++num_interrupt_out;
+ }
}
}
@@ -823,8 +833,10 @@ static int usb_serial_probe(struct usb_i
if (usb_endpoint_is_int_in(endpoint)) {
/* we found a interrupt in endpoint */
dev_dbg(ddev, "found interrupt in for Prolific device on separate interface\n");
- interrupt_in_endpoint[num_interrupt_in] = endpoint;
- ++num_interrupt_in;
+ if (num_interrupt_in < MAX_NUM_PORTS) {
+ interrupt_in_endpoint[num_interrupt_in] = endpoint;
+ ++num_interrupt_in;
+ }
}
}
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 041/143] USB: sisusb: add device id for Magic Control USB video
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 040/143] USB: serial: fix potential stack buffer overflow Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 042/143] USB: serial: fix potential heap buffer overflow Greg Kroah-Hartman
` (100 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Stephen Hemminger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <stephen@networkplumber.org>
commit 5b6b80aeb21091ed3030b9b6aae597d81326f1aa upstream.
I have a j5 create (JUA210) USB 2 video device and adding it device id
to SIS USB video gets it to work.
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/sisusbvga/sisusb.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb
{ USB_DEVICE(0x0711, 0x0918) },
{ USB_DEVICE(0x0711, 0x0920) },
{ USB_DEVICE(0x0711, 0x0950) },
+ { USB_DEVICE(0x0711, 0x5200) },
{ USB_DEVICE(0x182d, 0x021c) },
{ USB_DEVICE(0x182d, 0x0269) },
{ }
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 042/143] USB: serial: fix potential heap buffer overflow
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 041/143] USB: sisusb: add device id for Magic Control USB video Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 043/143] USB: option: reduce interrupt-urb logging verbosity Greg Kroah-Hartman
` (99 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 5654699fb38512bdbfc0f892ce54fce75bdc2bab upstream.
Make sure to verify the number of ports requested by subdriver to avoid
writing beyond the end of fixed-size array in interface data.
The current usb-serial implementation is limited to eight ports per
interface but failed to verify that the number of ports requested by a
subdriver (which could have been determined from device descriptors) did
not exceed this limit.
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/usb-serial.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -876,6 +876,11 @@ static int usb_serial_probe(struct usb_i
num_ports = type->num_ports;
}
+ if (num_ports > MAX_NUM_PORTS) {
+ dev_warn(ddev, "too many ports requested: %d\n", num_ports);
+ num_ports = MAX_NUM_PORTS;
+ }
+
serial->num_ports = num_ports;
serial->num_bulk_in = num_bulk_in;
serial->num_bulk_out = num_bulk_out;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 043/143] USB: option: reduce interrupt-urb logging verbosity
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 042/143] USB: serial: fix potential heap buffer overflow Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:33 ` [PATCH 3.10 044/143] USB: option: add VIA Telecom CDS7 chipset device id Greg Kroah-Hartman
` (98 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ed Butler, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit f0e4cba2534cd88476dff920727c81350130f3c5 upstream.
Do not log normal interrupt-urb shutdowns as errors.
The option driver has always been logging any nonzero interrupt-urb
status as an error, including when the urb is killed during normal
operation.
Commit 9096f1fbba91 ("USB: usb_wwan: fix potential NULL-deref at
resume") moved the interrupt urb submission from port probe and release
to open and close, thus potentially increasing the number of these
false-positive error messages dramatically.
Reported-by: Ed Butler <ressy66@ausics.net>
Tested-by: Ed Butler <ressy66@ausics.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1917,6 +1917,8 @@ static void option_instat_callback(struc
dev_dbg(dev, "%s: type %x req %x\n", __func__,
req_pkt->bRequestType, req_pkt->bRequest);
}
+ } else if (status == -ENOENT || status == -ESHUTDOWN) {
+ dev_dbg(dev, "%s: urb stopped: %d\n", __func__, status);
} else
dev_err(dev, "%s: error %d\n", __func__, status);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 044/143] USB: option: add VIA Telecom CDS7 chipset device id
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 043/143] USB: option: reduce interrupt-urb logging verbosity Greg Kroah-Hartman
@ 2014-10-03 21:33 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 045/143] Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev" Greg Kroah-Hartman
` (97 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brennan Ashton, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brennan Ashton <bashton@brennanashton.com>
commit d77302739d900bbca5e901a3b7ac48c907ee6c93 upstream.
This VIA Telecom baseband processor is used is used by by u-blox in both the
FW2770 and FW2760 products and may be used in others as well.
This patch has been tested on both of these modem versions.
Signed-off-by: Brennan Ashton <bashton@brennanashton.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -494,6 +494,10 @@ static void option_instat_callback(struc
#define INOVIA_VENDOR_ID 0x20a6
#define INOVIA_SEW858 0x1105
+/* VIA Telecom */
+#define VIATELECOM_VENDOR_ID 0x15eb
+#define VIATELECOM_PRODUCT_CDS7 0x0001
+
/* some devices interfaces need special handling due to a number of reasons */
enum option_blacklist_reason {
OPTION_BLACKLIST_NONE = 0,
@@ -1724,6 +1728,7 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
{ } /* Terminating entry */
};
MODULE_DEVICE_TABLE(usb, option_ids);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 045/143] Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2014-10-03 21:33 ` [PATCH 3.10 044/143] USB: option: add VIA Telecom CDS7 chipset device id Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 046/143] USB: zte_ev: remove duplicate Gobi PID Greg Kroah-Hartman
` (96 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lei Liu, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 63a901c06e3c2c45bd601916fe04e870e9ccae1e upstream.
This reverts commit 73228a0538a7 ("USB: option,zte_ev: move most ZTE
CDMA devices to zte_ev").
Move the IDs of the devices that were previously driven by the option
driver back to that driver.
As several users have reported, the zte_ev driver is causing random
disconnects as well as reconnect failures.
A closer analysis of the zte_ev setup code reveals that it consists of
standard CDC requests (SET/GET_LINE_CODING and SET_CONTROL_LINE_STATE)
but unfortunately fails to get some of those right. In particular, as
reported by Liu Lei, it fails to lower DTR/RTS on close. It also appears
that the control requests lack the interface argument.
Note that the zte_ev driver is based on code (once) distributed by ZTE
that still appears to originally have been reverse-engineered and bolted
onto the generic driver.
Since line control is already handled properly by the option driver, and
the SET/GET_LINE_CODING requests appears to be redundant (amounts to a
SET 9600 8N1), this is a first step in ultimately removing the redundant
zte_ev driver.
Note that AC2726 had already been moved back to option, and that some
IDs were in the device table of both drivers prior to the commit being
reverted.
Reported-by: Lei Liu <liu.lei78@zte.com.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 24 +++++++++++++++++++++---
drivers/usb/serial/zte_ev.c | 18 ------------------
2 files changed, 21 insertions(+), 21 deletions(-)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -275,8 +275,12 @@ static void option_instat_callback(struc
#define ZTE_PRODUCT_MF622 0x0001
#define ZTE_PRODUCT_MF628 0x0015
#define ZTE_PRODUCT_MF626 0x0031
-#define ZTE_PRODUCT_MC2718 0xffe8
#define ZTE_PRODUCT_AC2726 0xfff1
+#define ZTE_PRODUCT_CDMA_TECH 0xfffe
+#define ZTE_PRODUCT_AC8710T 0xffff
+#define ZTE_PRODUCT_MC2718 0xffe8
+#define ZTE_PRODUCT_AD3812 0xffeb
+#define ZTE_PRODUCT_MC2716 0xffed
#define BENQ_VENDOR_ID 0x04a5
#define BENQ_PRODUCT_H10 0x4068
@@ -531,10 +535,18 @@ static const struct option_blacklist_inf
.reserved = BIT(4),
};
+static const struct option_blacklist_info zte_ad3812_z_blacklist = {
+ .sendsetup = BIT(0) | BIT(1) | BIT(2),
+};
+
static const struct option_blacklist_info zte_mc2718_z_blacklist = {
.sendsetup = BIT(1) | BIT(2) | BIT(3) | BIT(4),
};
+static const struct option_blacklist_info zte_mc2716_z_blacklist = {
+ .sendsetup = BIT(1) | BIT(2) | BIT(3),
+};
+
static const struct option_blacklist_info huawei_cdc12_blacklist = {
.reserved = BIT(1) | BIT(2),
};
@@ -1074,6 +1086,7 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(BANDRICH_VENDOR_ID, BANDRICH_PRODUCT_1012, 0xff) },
{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
{ USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
@@ -1548,13 +1561,18 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
- /* NOTE: most ZTE CDMA devices should be driven by zte_ev, not option */
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2718, 0xff, 0xff, 0xff),
.driver_info = (kernel_ulong_t)&zte_mc2718_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AD3812, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_ad3812_z_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MC2716, 0xff, 0xff, 0xff),
+ .driver_info = (kernel_ulong_t)&zte_mc2716_z_blacklist },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x01) },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x02, 0x05) },
{ USB_VENDOR_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff, 0x86, 0x10) },
- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
{ USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
{ USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -273,27 +273,9 @@ static void zte_ev_usb_serial_close(stru
}
static const struct usb_device_id id_table[] = {
- /* AC8710, AC8710T */
- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffff, 0xff, 0xff, 0xff) },
- /* AC8700 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xfffe, 0xff, 0xff, 0xff) },
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
- { USB_DEVICE(0x19d2, 0xfffc) },
- { USB_DEVICE(0x19d2, 0xfffb) },
- /* AC8710_V3 */
- { USB_DEVICE(0x19d2, 0xfff6) },
- { USB_DEVICE(0x19d2, 0xfff7) },
- { USB_DEVICE(0x19d2, 0xfff8) },
- { USB_DEVICE(0x19d2, 0xfff9) },
- { USB_DEVICE(0x19d2, 0xffee) },
- /* AC2716, MC2716 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffed, 0xff, 0xff, 0xff) },
- /* AD3812 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x19d2, 0xffeb, 0xff, 0xff, 0xff) },
- { USB_DEVICE(0x19d2, 0xffec) },
{ USB_DEVICE(0x05C6, 0x3197) },
- { USB_DEVICE(0x05C6, 0x6000) },
{ USB_DEVICE(0x05C6, 0x9008) },
{ },
};
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 046/143] USB: zte_ev: remove duplicate Gobi PID
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 045/143] Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev" Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 047/143] USB: zte_ev: remove duplicate Qualcom PID Greg Kroah-Hartman
` (95 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 95be5739588c56a9327e477aa0ba3c81c5cf8631 upstream.
Remove dublicate Gobi PID 0x9008 which is already handled by the
qcserial driver since commit f05932c0caf4 ("USB: qcserial: Add extra
device IDs").
Fixes: 799ee9243d89 ("USB: serial: add zte_ev.c driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/zte_ev.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -276,7 +276,6 @@ static const struct usb_device_id id_tab
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
{ USB_DEVICE(0x05C6, 0x3197) },
- { USB_DEVICE(0x05C6, 0x9008) },
{ },
};
MODULE_DEVICE_TABLE(usb, id_table);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 047/143] USB: zte_ev: remove duplicate Qualcom PID
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 046/143] USB: zte_ev: remove duplicate Gobi PID Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 050/143] USB: ftdi_sio: add support for NOVITUS Bono E thermal printer Greg Kroah-Hartman
` (94 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 754eb21c0bbbbc4b8830a9a864b286323b84225f upstream.
Remove dublicate Qualcom PID 0x3197 which is already handled by the
moto-modem driver since commit 6986a978eec7 ("USB: add new moto_modem
driver for some Morotola phones").
Fixes: 799ee9243d89 ("USB: serial: add zte_ev.c driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/zte_ev.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -275,7 +275,6 @@ static void zte_ev_usb_serial_close(stru
static const struct usb_device_id id_table[] = {
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
- { USB_DEVICE(0x05C6, 0x3197) },
{ },
};
MODULE_DEVICE_TABLE(usb, id_table);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 050/143] USB: ftdi_sio: add support for NOVITUS Bono E thermal printer
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 047/143] USB: zte_ev: remove duplicate Qualcom PID Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 051/143] USB: zte_ev: fix removed PIDs Greg Kroah-Hartman
` (93 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Emanuel Koczwara, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ee444609dbae8afee420c3243ce4c5f442efb622 upstream.
Add device id for NOVITUS Bono E thermal printer.
Reported-by: Emanuel Koczwara <poczta@emanuelkoczwara.pl>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++
2 files changed, 7 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -744,6 +744,7 @@ static struct usb_device_id id_table_com
{ USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
.driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
{ USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -837,6 +837,12 @@
#define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */
/*
+ * NOVITUS printers
+ */
+#define NOVITUS_VID 0x1a28
+#define NOVITUS_BONO_E_PID 0x6010
+
+/*
* RT Systems programming cables for various ham radios
*/
#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 051/143] USB: zte_ev: fix removed PIDs
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 050/143] USB: ftdi_sio: add support for NOVITUS Bono E thermal printer Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 052/143] xhci: Fix null pointer dereference if xhci initialization fails Greg Kroah-Hartman
` (92 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lei Liu, Johan Hovold
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 3096691011d01cef56b243a5e65431405c07d574 upstream.
Add back some PIDs that were mistakingly remove when reverting commit
73228a0538a7 ("USB: option,zte_ev: move most ZTE CDMA devices to
zte_ev"), which apparently did more than its commit message claimed in
that it not only moved some PIDs from option to zte_ev but also added
some new ones.
Fixes: 63a901c06e3c ("Revert "USB: option,zte_ev: move most ZTE CDMA
devices to zte_ev"")
Reported-by: Lei Liu <lei35151@163.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/zte_ev.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/usb/serial/zte_ev.c
+++ b/drivers/usb/serial/zte_ev.c
@@ -273,6 +273,14 @@ static void zte_ev_usb_serial_close(stru
}
static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x19d2, 0xffec) },
+ { USB_DEVICE(0x19d2, 0xffee) },
+ { USB_DEVICE(0x19d2, 0xfff6) },
+ { USB_DEVICE(0x19d2, 0xfff7) },
+ { USB_DEVICE(0x19d2, 0xfff8) },
+ { USB_DEVICE(0x19d2, 0xfff9) },
+ { USB_DEVICE(0x19d2, 0xfffb) },
+ { USB_DEVICE(0x19d2, 0xfffc) },
/* MG880 */
{ USB_DEVICE(0x19d2, 0xfffd) },
{ },
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 052/143] xhci: Fix null pointer dereference if xhci initialization fails
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 051/143] USB: zte_ev: fix removed PIDs Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 053/143] xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices Greg Kroah-Hartman
` (91 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Manuel Reimer, Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit c207e7c50f31113c24a9f536fcab1e8a256985d7 upstream.
If xhci initialization fails before the roothub bandwidth
domains (xhci->rh_bw[i]) are allocated it will oops when
trying to access rh_bw members in xhci_mem_cleanup().
Reported-by: Manuel Reimer <manuel.reimer@gmx.de>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-mem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1795,7 +1795,7 @@ void xhci_mem_cleanup(struct xhci_hcd *x
}
num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
- for (i = 0; i < num_ports; i++) {
+ for (i = 0; i < num_ports && xhci->rh_bw; i++) {
struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
struct list_head *ep = &bwt->interval_bw[j].endpoints;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 053/143] xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 052/143] xhci: Fix null pointer dereference if xhci initialization fails Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 054/143] usb: hub: take hub->hdev reference when processing from eventlist Greg Kroah-Hartman
` (90 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Imre Deak, Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 96044694b8511bc2b04df0776b4ba295cfe005c0 upstream.
Resuming from hibernate (S4) will restart and re-initialize xHC.
The device contexts are freed and will be re-allocated later during device reset.
Usb core will disable link pm in device resume before device reset, which will
try to change the max exit latency, accessing the device contexts before they are re-allocated.
There is no need to zero (disable) the max exit latency when disabling hw lpm
for a freshly re-initialized xHC. So check that device context exists before
doing anything. The max exit latency will be set again after device reset when usb core
enables the link pm.
Reported-by: Imre Deak <imre.deak@intel.com>
Tested-by: Imre Deak <imre.deak@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4407,13 +4407,21 @@ static int xhci_change_max_exit_latency(
int ret;
spin_lock_irqsave(&xhci->lock, flags);
- if (max_exit_latency == xhci->devs[udev->slot_id]->current_mel) {
+
+ virt_dev = xhci->devs[udev->slot_id];
+
+ /*
+ * virt_dev might not exists yet if xHC resumed from hibernate (S4) and
+ * xHC was re-initialized. Exit latency will be set later after
+ * hub_port_finish_reset() is done and xhci->devs[] are re-allocated
+ */
+
+ if (!virt_dev || max_exit_latency == virt_dev->current_mel) {
spin_unlock_irqrestore(&xhci->lock, flags);
return 0;
}
/* Attempt to issue an Evaluate Context command to change the MEL. */
- virt_dev = xhci->devs[udev->slot_id];
command = xhci->lpm_command;
xhci_slot_copy(xhci, command->in_ctx, virt_dev->out_ctx);
spin_unlock_irqrestore(&xhci->lock, flags);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 054/143] usb: hub: take hub->hdev reference when processing from eventlist
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 053/143] xhci: fix oops when xhci resumes from hibernate with hw lpm capable devices Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 055/143] storage: Add single-LUN quirk for Jaz USB Adapter Greg Kroah-Hartman
` (89 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Lawrence, Alan Stern
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Lawrence <joe.lawrence@stratus.com>
commit c605f3cdff53a743f6d875b76956b239deca1272 upstream.
During surprise device hotplug removal tests, it was observed that
hub_events may try to call usb_lock_device on a device that has already
been freed. Protect the usb_device by taking out a reference (under the
hub_event_lock) when hub_events pulls it off the list, returning the
reference after hub_events is finished using it.
Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com>
Suggested-by: David Bulkow <david.bulkow@stratus.com> for using kref
Suggested-by: Alan Stern <stern@rowland.harvard.edu> for placement
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4702,9 +4702,10 @@ static void hub_events(void)
hub = list_entry(tmp, struct usb_hub, event_list);
kref_get(&hub->kref);
+ hdev = hub->hdev;
+ usb_get_dev(hdev);
spin_unlock_irq(&hub_event_lock);
- hdev = hub->hdev;
hub_dev = hub->intfdev;
intf = to_usb_interface(hub_dev);
dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
@@ -4919,6 +4920,7 @@ static void hub_events(void)
usb_autopm_put_interface(intf);
loop_disconnected:
usb_unlock_device(hdev);
+ usb_put_dev(hdev);
kref_put(&hub->kref, hub_release);
} /* end while (1) */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 055/143] storage: Add single-LUN quirk for Jaz USB Adapter
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 054/143] usb: hub: take hub->hdev reference when processing from eventlist Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 056/143] USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter Greg Kroah-Hartman
` (88 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Knibbs
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <markk@clara.co.uk>
commit c66f1c62e85927357e7b3f4c701614dcb5c498a2 upstream.
The Iomega Jaz USB Adapter is a SCSI-USB converter cable. The hardware
seems to be identical to e.g. the Microtech XpressSCSI, using a Shuttle/
SCM chip set. However its firmware restricts it to only work with Jaz
drives.
On connecting the cable a message like this appears four times in the log:
reset full speed USB device number 4 using uhci_hcd
That's non-fatal but the US_FL_SINGLE_LUN quirk fixes it.
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -741,6 +741,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_SINGLE_LUN ),
+UNUSUAL_DEV( 0x059b, 0x0040, 0x0100, 0x0100,
+ "Iomega",
+ "Jaz USB Adapter",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_SINGLE_LUN ),
+
/* Reported by <Hendryk.Pfeiffer@gmx.de> */
UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
"LaCie",
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 056/143] USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 055/143] storage: Add single-LUN quirk for Jaz USB Adapter Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 057/143] USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter Greg Kroah-Hartman
` (87 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Knibbs
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <markk@clara.co.uk>
commit 67d365a57a51fb9dece6a5ceb504aa381cae1e5b upstream.
The Adaptec USBConnect 2000 is another SCSI-USB converter which uses
Shuttle Technology/SCM Microsystems chips. The US_FL_SCM_MULT_TARG quirk is
required to use SCSI devices with ID other than 0.
I don't have a USBConnect 2000, but based on the other entries for Shuttle/
SCM-based converters this patch is very likely correct. I used 0x0000 and
0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which
bcdDevice value the product uses.
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -101,6 +101,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x
"PhotoSmart R707",
USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
+UNUSUAL_DEV( 0x03f3, 0x0001, 0x0000, 0x9999,
+ "Adaptec",
+ "USBConnect 2000",
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
/* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
* and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
* for USB floppies that need the SINGLE_LUN enforcement.
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 057/143] USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 056/143] USB: storage: Add quirk for Adaptec USBConnect 2000 USB-to-SCSI Adapter Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 058/143] USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters Greg Kroah-Hartman
` (86 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Knibbs
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <markk@clara.co.uk>
commit b6a3ed677991558ce09046397a7c4d70530d15b3 upstream.
Hi,
The Ariston Technologies iConnect 025 and iConnect 050 (also known as e.g.
iSCSI-50) are SCSI-USB converters which use Shuttle Technology/SCM
Microsystems chips. Only the connectors differ; both have the same USB ID.
The US_FL_SCM_MULT_TARG quirk is required to use SCSI devices with ID other
than 0.
I don't have one of these, but based on the other entries for Shuttle/
SCM-based converters this patch is very likely correct. I used 0x0000 and
0x9999 for bcdDeviceMin and bcdDeviceMax because I'm not sure which
bcdDevice value the products use.
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1979,6 +1979,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+UNUSUAL_DEV( 0x1822, 0x0001, 0x0000, 0x9999,
+ "Ariston Technologies",
+ "iConnect USB to SCSI adapter",
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
/* Reported by Hans de Goede <hdegoede@redhat.com>
* These Appotech controllers are found in Picture Frames, they provide a
* (buggy) emulation of a cdrom drive which contains the windows software
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 058/143] USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 057/143] USB: storage: Add quirk for Ariston Technologies iConnect USB to SCSI adapter Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 059/143] USB: EHCI: unlink QHs even after the controller has stopped Greg Kroah-Hartman
` (85 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Knibbs
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark <markk@clara.co.uk>
commit c80b4495c61636edc58fe1ce300f09f24db28e10 upstream.
This patch adds quirks for Entrega Technologies (later Xircom PortGear) USB-
SCSI converters. They use Shuttle Technology EUSB-01/EUSB-S1 chips. The
US_FL_SCM_MULT_TARG quirk is needed to allow multiple devices on the SCSI
chain to be accessed. Without it only the (single) device with SCSI ID 0
can be used.
The standalone converter sold by Entrega had model number U1-SC25. Xircom
acquired Entrega and re-branded the product line PortGear. The PortGear USB
to SCSI Converter (model PGSCSI) is internally identical to the Entrega
product, but later models may use a different USB ID. The Entrega-branded
units have USB ID 1645:0007, as does my Xircom PGSCSI, but the Windows and
Macintosh drivers also support 085A:0028.
Entrega also sold the "Mac USB Dock", which provides two USB ports, a Mac
(8-pin mini-DIN) serial port and a SCSI port. It appears to the computer as
a four-port hub, USB-serial, and USB-SCSI converters. The USB-SCSI part may
have initially used the same ID as the standalone U1-SC25 (1645:0007), but
later production used 085A:0026.
My Xircom PortGear PGSCSI has bcdDevice=0x0100. Units with bcdDevice=0x0133
probably also exist.
This patch adds quirks for 1645:0007, 085A:0026 and 085A:0028. The Windows
driver INF file also mentions 085A:0032 "PortStation SCSI Module", but I
couldn't find any mention of that actually existing in the wild; perhaps it
was cancelled before release?
Signed-off-by: Mark Knibbs <markk@clara.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1125,6 +1125,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_NOT_LOCKABLE),
+UNUSUAL_DEV( 0x085a, 0x0026, 0x0100, 0x0133,
+ "Xircom",
+ "PortGear USB-SCSI (Mac USB Dock)",
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
+UNUSUAL_DEV( 0x085a, 0x0028, 0x0100, 0x0133,
+ "Xircom",
+ "PortGear USB to SCSI Converter",
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
/* Submitted by Jan De Luyck <lkml@kcore.org> */
UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000,
"CITIZEN",
@@ -1957,6 +1969,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
+ * and Mac USB Dock USB-SCSI */
+UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
+ "Entrega Technologies",
+ "USB to SCSI Converter",
+ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
+ US_FL_SCM_MULT_TARG ),
+
/* Reported by Robert Schedel <r.schedel@yahoo.de>
* Note: this is a 'super top' device like the above 14cd/6600 device */
UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 059/143] USB: EHCI: unlink QHs even after the controller has stopped
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 058/143] USB: storage: Add quirks for Entrega/Xircom USB to SCSI converters Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 060/143] usb: dwc3: omap: fix ordering for runtime pm calls Greg Kroah-Hartman
` (84 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Joe Lawrence
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 7312b5ddd47fee2356baa78c5516ef8e04eed452 upstream.
Old code in ehci-hcd tries to expedite disabling endpoints after the
controller has stopped, by destroying the endpoint's associated QH
without first unlinking the QH. This was necessary back when the
driver wasn't so careful about keeping track of the controller's
state.
But now we are careful about it, and the driver knows that when the
controller isn't running, no unlinking delay is needed. Furthermore,
skipping the unlink step will trigger a BUG() in qh_destroy() when the
preceding QH is released, because the link pointer will be non-NULL.
Removing the lines that skip the unlinking step and go directly to
QH_STATE_IDLE fixes the problem.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ehci-hcd.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -972,8 +972,6 @@ rescan:
}
qh->exception = 1;
- if (ehci->rh_state < EHCI_RH_RUNNING)
- qh->qh_state = QH_STATE_IDLE;
switch (qh->qh_state) {
case QH_STATE_LINKED:
case QH_STATE_COMPLETING:
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 060/143] usb: dwc3: omap: fix ordering for runtime pm calls
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 059/143] USB: EHCI: unlink QHs even after the controller has stopped Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 061/143] usb:hub set hub->change_bits when over-current happens Greg Kroah-Hartman
` (83 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Balbi
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit 81a60b7f5c143ab3cdcd9943c9b4b7c63c32fc31 upstream.
we don't to gate clocks until our children are
done with their remove path.
Fixes: af310e9 (usb: dwc3: omap: use runtime API's to enable clocks)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-omap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -395,9 +395,9 @@ static int dwc3_omap_remove(struct platf
struct dwc3_omap *omap = platform_get_drvdata(pdev);
dwc3_omap_disable_irqs(omap);
+ device_for_each_child(&pdev->dev, NULL, dwc3_omap_remove_core);
pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
- device_for_each_child(&pdev->dev, NULL, dwc3_omap_remove_core);
return 0;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 061/143] usb:hub set hub->change_bits when over-current happens
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 060/143] usb: dwc3: omap: fix ordering for runtime pm calls Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 062/143] NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists() Greg Kroah-Hartman
` (82 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shen Guang, Alan Stern, Sarah Sharp,
Frans Klaver
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shen Guang <shenguang10@gmail.com>
commit 08d1dec6f4054e3613f32051d9b149d4203ce0d2 upstream.
When we are doing compliance test with xHCI, we found that if we
enable CONFIG_USB_SUSPEND and plug in a bad device which causes
over-current condition to the root port, software will not be noticed.
The reason is that current code don't set hub->change_bits in
hub_activate() when over-current happens, and then hub_events() will
not check the port status because it thinks nothing changed.
If CONFIG_USB_SUSPEND is disabled, the interrupt pipe of the hub will
report the change and set hub->event_bits, and then hub_events() will
check what events happened.In this case over-current can be detected.
Signed-off-by: Shen Guang <shenguang10@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Frans Klaver <fransklaver@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1165,7 +1165,8 @@ static void hub_activate(struct usb_hub
/* Tell khubd to disconnect the device or
* check for a new connection
*/
- if (udev || (portstatus & USB_PORT_STAT_CONNECTION))
+ if (udev || (portstatus & USB_PORT_STAT_CONNECTION) ||
+ (portstatus & USB_PORT_STAT_OVERCURRENT))
set_bit(port1, hub->change_bits);
} else if (portstatus & USB_PORT_STAT_ENABLE) {
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 062/143] NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 061/143] usb:hub set hub->change_bits when over-current happens Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 063/143] NFSv4: Fix another bug in the close/open_downgrade code Greg Kroah-Hartman
` (81 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steve Dickson, Trond Myklebust
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steve Dickson <steved@redhat.com>
commit 080af20cc945d110f9912d01cf6b66f94a375b8d upstream.
There is a race between nfs4_state_manager() and
nfs_server_remove_lists() that happens during a nfsv3 mount.
The v3 mount notices there is already a supper block so
nfs_server_remove_lists() called which uses the nfs_client_lock
spin lock to synchronize access to the client list.
At the same time nfs4_state_manager() is running through
the client list looking for work to do, using the same
lock. When nfs4_state_manager() wins the race to the
list, a v3 client pointer is found and not ignored
properly which causes the panic.
Moving some protocol checks before the state checking
avoids the panic.
Signed-off-by: Steve Dickson <steved@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4client.c | 38 ++++++++++++++++++++------------------
1 file changed, 20 insertions(+), 18 deletions(-)
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -311,6 +311,16 @@ int nfs40_walk_client_list(struct nfs_cl
spin_lock(&nn->nfs_client_lock);
list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+
+ if (pos->rpc_ops != new->rpc_ops)
+ continue;
+
+ if (pos->cl_proto != new->cl_proto)
+ continue;
+
+ if (pos->cl_minorversion != new->cl_minorversion)
+ continue;
+
/* If "pos" isn't marked ready, we can't trust the
* remaining fields in "pos" */
if (pos->cl_cons_state > NFS_CS_READY) {
@@ -330,15 +340,6 @@ int nfs40_walk_client_list(struct nfs_cl
if (pos->cl_cons_state != NFS_CS_READY)
continue;
- if (pos->rpc_ops != new->rpc_ops)
- continue;
-
- if (pos->cl_proto != new->cl_proto)
- continue;
-
- if (pos->cl_minorversion != new->cl_minorversion)
- continue;
-
if (pos->cl_clientid != new->cl_clientid)
continue;
@@ -444,6 +445,16 @@ int nfs41_walk_client_list(struct nfs_cl
spin_lock(&nn->nfs_client_lock);
list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+
+ if (pos->rpc_ops != new->rpc_ops)
+ continue;
+
+ if (pos->cl_proto != new->cl_proto)
+ continue;
+
+ if (pos->cl_minorversion != new->cl_minorversion)
+ continue;
+
/* If "pos" isn't marked ready, we can't trust the
* remaining fields in "pos", especially the client
* ID and serverowner fields. Wait for CREATE_SESSION
@@ -469,15 +480,6 @@ int nfs41_walk_client_list(struct nfs_cl
if (pos->cl_cons_state != NFS_CS_READY)
continue;
- if (pos->rpc_ops != new->rpc_ops)
- continue;
-
- if (pos->cl_proto != new->cl_proto)
- continue;
-
- if (pos->cl_minorversion != new->cl_minorversion)
- continue;
-
if (!nfs4_match_clientids(pos, new))
continue;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 063/143] NFSv4: Fix another bug in the close/open_downgrade code
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 062/143] NFSv4: nfs4_state_manager() vs. nfs_server_remove_lists() Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 064/143] ARM: 8128/1: abort: dont clear the exclusive monitors Greg Kroah-Hartman
` (80 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Drews, Trond Myklebust
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
commit cd9288ffaea4359d5cfe2b8d264911506aed26a4 upstream.
James Drew reports another bug whereby the NFS client is now sending
an OPEN_DOWNGRADE in a situation where it should really have sent a
CLOSE: the client is opening the file for O_RDWR, but then trying to
do a downgrade to O_RDONLY, which is not allowed by the NFSv4 spec.
Reported-by: James Drews <drews@engr.wisc.edu>
Link: http://lkml.kernel.org/r/541AD7E5.8020409@engr.wisc.edu
Fixes: aee7af356e15 (NFSv4: Fix problems with close in the presence...)
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 30 +++++++++++++++---------------
1 file changed, 15 insertions(+), 15 deletions(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2299,23 +2299,23 @@ static void nfs4_close_prepare(struct rp
is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
- /* Calculate the current open share mode */
- calldata->arg.fmode = 0;
- if (is_rdonly || is_rdwr)
- calldata->arg.fmode |= FMODE_READ;
- if (is_wronly || is_rdwr)
- calldata->arg.fmode |= FMODE_WRITE;
/* Calculate the change in open mode */
+ calldata->arg.fmode = 0;
if (state->n_rdwr == 0) {
- if (state->n_rdonly == 0) {
- call_close |= is_rdonly || is_rdwr;
- calldata->arg.fmode &= ~FMODE_READ;
- }
- if (state->n_wronly == 0) {
- call_close |= is_wronly || is_rdwr;
- calldata->arg.fmode &= ~FMODE_WRITE;
- }
- }
+ if (state->n_rdonly == 0)
+ call_close |= is_rdonly;
+ else if (is_rdonly)
+ calldata->arg.fmode |= FMODE_READ;
+ if (state->n_wronly == 0)
+ call_close |= is_wronly;
+ else if (is_wronly)
+ calldata->arg.fmode |= FMODE_WRITE;
+ } else if (is_rdwr)
+ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
+
+ if (calldata->arg.fmode == 0)
+ call_close |= is_rdwr;
+
if (!nfs4_valid_open_stateid(state))
call_close = 0;
spin_unlock(&state->owner->so_lock);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 064/143] ARM: 8128/1: abort: dont clear the exclusive monitors
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 063/143] NFSv4: Fix another bug in the close/open_downgrade code Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 065/143] ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs Greg Kroah-Hartman
` (79 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Rutland, Will Deacon,
Russell King
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 85868313177700d20644263a782351262d2aff84 upstream.
The ARMv6 and ARMv7 early abort handlers clear the exclusive monitors
upon entry to the kernel, but this is redundant:
- We clear the monitors on every exception return since commit
200b812d0084 ("Clear the exclusive monitor when returning from an
exception"), so this is not necessary to ensure the monitors are
cleared before returning from a fault handler.
- Any dummy STREX will target a temporary scratch area in memory, and
may succeed or fail without corrupting useful data. Its status value
will not be used.
- Any other STREX in the kernel must be preceded by an LDREX, which
will initialise the monitors consistently and will not depend on the
earlier state of the monitors.
Therefore we have no reason to care about the initial state of the
exclusive monitors when a data abort is taken, and clearing the monitors
prior to exception return (as we already do) is sufficient.
This patch removes the redundant clearing of the exclusive monitors from
the early abort handlers.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/abort-ev6.S | 6 ------
arch/arm/mm/abort-ev7.S | 6 ------
2 files changed, 12 deletions(-)
--- a/arch/arm/mm/abort-ev6.S
+++ b/arch/arm/mm/abort-ev6.S
@@ -17,12 +17,6 @@
*/
.align 5
ENTRY(v6_early_abort)
-#ifdef CONFIG_CPU_V6
- sub r1, sp, #4 @ Get unused stack location
- strex r0, r1, [r1] @ Clear the exclusive monitor
-#elif defined(CONFIG_CPU_32v6K)
- clrex
-#endif
mrc p15, 0, r1, c5, c0, 0 @ get FSR
mrc p15, 0, r0, c6, c0, 0 @ get FAR
/*
--- a/arch/arm/mm/abort-ev7.S
+++ b/arch/arm/mm/abort-ev7.S
@@ -13,12 +13,6 @@
*/
.align 5
ENTRY(v7_early_abort)
- /*
- * The effect of data aborts on on the exclusive access monitor are
- * UNPREDICTABLE. Do a CLREX to clear the state
- */
- clrex
-
mrc p15, 0, r1, c5, c0, 0 @ get FSR
mrc p15, 0, r0, c6, c0, 0 @ get FAR
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 065/143] ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 064/143] ARM: 8128/1: abort: dont clear the exclusive monitors Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 066/143] ARM: 7897/1: kexec: Use the right ISA for relocate_new_kernel Greg Kroah-Hartman
` (78 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudeep Holla, Thomas Gleixner,
Mark Rutland, Russell King
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
commit a040803a9d6b8c1876d3487a5cb69602ebcbb82c upstream.
Since commit 1dbfa187dad ("ARM: irq migration: force migration off CPU
going down") the ARM interrupt migration code on cpu offline calls
irqchip.irq_set_affinity() with the argument force=true. At the point
of this change the argument had no effect because it was not used by
any interrupt chip driver and there was no semantics defined.
This changed with commit 01f8fa4f01d8 ("genirq: Allow forcing cpu
affinity of interrupts") which made the force argument useful to route
interrupts to not yet online cpus without checking the target cpu
against the cpu online mask. The following commit ffde1de64012
("irqchip: gic: Support forced affinity setting") implemented this for
the GIC interrupt controller.
As a consequence the ARM cpu offline irq migration fails if CPU0 is
offlined, because CPU0 is still set in the affinity mask and the
validataion against cpu online mask is skipped to the force argument
being true. The following first_cpu(mask) selection always selects
CPU0 as the target.
Solve the issue by calling irq_set_affinity() with force=false from
the CPU offline irq migration code so the GIC driver validates the
affinity mask against CPU online mask and therefore removes CPU0 from
the possible target candidates.
Tested on TC2 hotpluging CPU0 in and out. Without this patch the system
locks up as the IRQs are not migrated away from CPU0.
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/irq.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -163,7 +163,7 @@ static bool migrate_one_irq(struct irq_d
c = irq_data_get_irq_chip(d);
if (!c->irq_set_affinity)
pr_debug("IRQ%u: unable to set affinity\n", d->irq);
- else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
+ else if (c->irq_set_affinity(d, affinity, false) == IRQ_SET_MASK_OK && ret)
cpumask_copy(d->affinity, affinity);
return ret;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 066/143] ARM: 7897/1: kexec: Use the right ISA for relocate_new_kernel
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 065/143] ARM: 8133/1: use irq_set_affinity with force=false when migrating irqs Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 067/143] ARM: 8165/1: alignment: dont break misaligned NEON load/store Greg Kroah-Hartman
` (77 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Martin, Will Deacon,
Taras Kondratiuk, Russell King, Liu Hua
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <dave.martin@linaro.org>
commit e2ccba49085ab5d71b092de2a5176eb9b19cc876 upstream.
Copying a function with memcpy() and then trying to execute the
result isn't trivially portable to Thumb.
This patch modifies the kexec soft restart code to copy its
assembler trampoline relocate_new_kernel() using fncpy() instead,
so that relocate_new_kernel can be in the same ISA as the rest of
the kernel without problems.
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Reported-by: Taras Kondratiuk <taras.kondratiuk@linaro.org>
Tested-by: Taras Kondratiuk <taras.kondratiuk@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Integrated-by: Liu Hua <sdu.liu@huawei.com>
Signed-off-by: Liu Hua <sdu.liu@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/machine_kexec.c | 17 ++++++++++-------
arch/arm/kernel/relocate_kernel.S | 8 ++++++--
2 files changed, 16 insertions(+), 9 deletions(-)
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -14,10 +14,11 @@
#include <asm/pgalloc.h>
#include <asm/mmu_context.h>
#include <asm/cacheflush.h>
+#include <asm/fncpy.h>
#include <asm/mach-types.h>
#include <asm/system_misc.h>
-extern const unsigned char relocate_new_kernel[];
+extern void relocate_new_kernel(void);
extern const unsigned int relocate_new_kernel_size;
extern unsigned long kexec_start_address;
@@ -133,6 +134,8 @@ void machine_kexec(struct kimage *image)
{
unsigned long page_list;
unsigned long reboot_code_buffer_phys;
+ unsigned long reboot_entry = (unsigned long)relocate_new_kernel;
+ unsigned long reboot_entry_phys;
void *reboot_code_buffer;
if (num_online_cpus() > 1) {
@@ -156,18 +159,18 @@ void machine_kexec(struct kimage *image)
/* copy our kernel relocation code to the control code page */
- memcpy(reboot_code_buffer,
- relocate_new_kernel, relocate_new_kernel_size);
+ reboot_entry = fncpy(reboot_code_buffer,
+ reboot_entry,
+ relocate_new_kernel_size);
+ reboot_entry_phys = (unsigned long)reboot_entry +
+ (reboot_code_buffer_phys - (unsigned long)reboot_code_buffer);
-
- flush_icache_range((unsigned long) reboot_code_buffer,
- (unsigned long) reboot_code_buffer + KEXEC_CONTROL_PAGE_SIZE);
printk(KERN_INFO "Bye!\n");
if (kexec_reinit)
kexec_reinit();
- soft_restart(reboot_code_buffer_phys);
+ soft_restart(reboot_entry_phys);
}
void arch_crash_save_vmcoreinfo(void)
--- a/arch/arm/kernel/relocate_kernel.S
+++ b/arch/arm/kernel/relocate_kernel.S
@@ -2,10 +2,12 @@
* relocate_kernel.S - put the kernel image in place to boot
*/
+#include <linux/linkage.h>
#include <asm/kexec.h>
- .globl relocate_new_kernel
-relocate_new_kernel:
+ .align 3 /* not needed for this code, but keeps fncpy() happy */
+
+ENTRY(relocate_new_kernel)
ldr r0,kexec_indirection_page
ldr r1,kexec_start_address
@@ -79,6 +81,8 @@ kexec_mach_type:
kexec_boot_atags:
.long 0x0
+ENDPROC(relocate_new_kernel)
+
relocate_new_kernel_end:
.globl relocate_new_kernel_size
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 067/143] ARM: 8165/1: alignment: dont break misaligned NEON load/store
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 066/143] ARM: 7897/1: kexec: Use the right ISA for relocate_new_kernel Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 068/143] MIPS: ZBOOT: add missing <linux/string.h> include Greg Kroah-Hartman
` (76 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Hosie, Robin Murphy,
Russell King
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 5ca918e5e3f9df4634077c06585c42bc6a8d699a upstream.
The alignment fixup incorrectly decodes faulting ARM VLDn/VSTn
instructions (where the optional alignment hint is given but incorrect)
as LDR/STR, leading to register corruption. Detect these and correctly
treat them as unhandled, so that userspace gets the fault it expects.
Reported-by: Simon Hosie <simon.hosie@arm.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/alignment.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -39,6 +39,7 @@
* This code is not portable to processors with late data abort handling.
*/
#define CODING_BITS(i) (i & 0x0e000000)
+#define COND_BITS(i) (i & 0xf0000000)
#define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */
#define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */
@@ -812,6 +813,8 @@ do_alignment(unsigned long addr, unsigne
break;
case 0x04000000: /* ldr or str immediate */
+ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
+ goto bad;
offset.un = OFFSET_BITS(instr);
handler = do_alignment_ldrstr;
break;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 068/143] MIPS: ZBOOT: add missing <linux/string.h> include
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 067/143] ARM: 8165/1: alignment: dont break misaligned NEON load/store Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 069/143] MIPS: mcount: Adjust stack pointer for static trace in MIPS32 Greg Kroah-Hartman
` (75 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aurelien Jarno, linux-mips,
Ralf Baechle
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aurelien Jarno <aurelien@aurel32.net>
commit 29593fd5a8149462ed6fad0d522234facdaee6c8 upstream.
Commit dc4d7b37 (MIPS: ZBOOT: gather string functions into string.c)
moved the string related functions into a separate file, which might
cause the following build error, depending on the configuration:
| CC arch/mips/boot/compressed/decompress.o
| In file included from linux/arch/mips/boot/compressed/../../../../lib/decompress_unxz.c:234:0,
| from linux/arch/mips/boot/compressed/decompress.c:67:
| linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c: In function 'fill_temp':
| linux/arch/mips/boot/compressed/../../../../lib/xz/xz_dec_stream.c:162:2: error: implicit declaration of function 'memcpy' [-Werror=implicit-function-declaration]
| cc1: some warnings being treated as errors
| linux/scripts/Makefile.build:308: recipe for target 'arch/mips/boot/compressed/decompress.o' failed
| make[6]: *** [arch/mips/boot/compressed/decompress.o] Error 1
| linux/arch/mips/Makefile:308: recipe for target 'vmlinuz' failed
It does not fail with the standard configuration, as when
CONFIG_DYNAMIC_DEBUG is not enabled <linux/string.h> gets included in
include/linux/dynamic_debug.h. There might be other ways for it to
get indirectly included.
We can't add the include directly in xz_dec_stream.c as some
architectures might want to use a different version for the boot/
directory (see for example arch/x86/boot/string.h).
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7420/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/boot/compressed/decompress.c | 1 +
1 file changed, 1 insertion(+)
--- a/arch/mips/boot/compressed/decompress.c
+++ b/arch/mips/boot/compressed/decompress.c
@@ -13,6 +13,7 @@
#include <linux/types.h>
#include <linux/kernel.h>
+#include <linux/string.h>
#include <asm/addrspace.h>
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 069/143] MIPS: mcount: Adjust stack pointer for static trace in MIPS32
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 068/143] MIPS: ZBOOT: add missing <linux/string.h> include Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 070/143] ACPICA: Update to GPIO region handler interface Greg Kroah-Hartman
` (74 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Markos Chandras, linux-mips,
Ralf Baechle
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Markos Chandras <markos.chandras@imgtec.com>
commit 8a574cfa2652545eb95595d38ac2a0bb501af0ae upstream.
Every mcount() call in the MIPS 32-bit kernel is done as follows:
[...]
move at, ra
jal _mcount
addiu sp, sp, -8
[...]
but upon returning from the mcount() function, the stack pointer
is not adjusted properly. This is explained in details in 58b69401c797
(MIPS: Function tracer: Fix broken function tracing).
Commit ad8c396936e3 ("MIPS: Unbreak function tracer for 64-bit kernel.)
fixed the stack manipulation for 64-bit but it didn't fix it completely
for MIPS32.
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/7792/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/kernel/mcount.S | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/arch/mips/kernel/mcount.S
+++ b/arch/mips/kernel/mcount.S
@@ -123,7 +123,11 @@ NESTED(_mcount, PT_SIZE, ra)
nop
#endif
b ftrace_stub
+#ifdef CONFIG_32BIT
+ addiu sp, sp, 8
+#else
nop
+#endif
static_trace:
MCOUNT_SAVE_REGS
@@ -133,6 +137,9 @@ static_trace:
move a1, AT /* arg2: parent's return address */
MCOUNT_RESTORE_REGS
+#ifdef CONFIG_32BIT
+ addiu sp, sp, 8
+#endif
.globl ftrace_stub
ftrace_stub:
RETURN_BACK
@@ -181,6 +188,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
jal prepare_ftrace_return
nop
MCOUNT_RESTORE_REGS
+#ifndef CONFIG_DYNAMIC_FTRACE
+#ifdef CONFIG_32BIT
+ addiu sp, sp, 8
+#endif
+#endif
RETURN_BACK
END(ftrace_graph_caller)
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 070/143] ACPICA: Update to GPIO region handler interface.
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 069/143] MIPS: mcount: Adjust stack pointer for static trace in MIPS32 Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 071/143] regmap: Fix handling of volatile registers for format_write() chips Greg Kroah-Hartman
` (73 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bob Moore, Lv Zheng,
Rafael J. Wysocki
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Moore <Robert.Moore@intel.com>
commit 75ec6e55f1384548311a13ce4fcb39c516053314 upstream.
Changes to correct several GPIO issues:
1) The update_rule in a GPIO field definition is now ignored;
a read-modify-write operation is never performed for GPIO fields.
(Internally, this means that the field assembly/disassembly
code is completely bypassed for GPIO.)
2) The Address parameter passed to a GPIO region handler is
now the bit offset of the field from a previous Connection()
operator. Thus, it becomes a "Pin Number Index" into the
Connection() resource descriptor.
3) The bit_width parameter passed to a GPIO region handler is
now the exact bit width of the GPIO field. Thus, it can be
interpreted as "number of pins".
Overall, we can now say that the region handler interface
to GPIO handlers is a raw "bit/pin" addressed interface, not
a byte-addressed interface like the system_memory handler interface.
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Lv Zheng <lv.zheng@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpica/aclocal.h | 1
drivers/acpi/acpica/acobject.h | 1
drivers/acpi/acpica/dsfield.c | 2 +
drivers/acpi/acpica/evregion.c | 47 ++++++++++++++++++----------
drivers/acpi/acpica/exfield.c | 67 +++++++++++++++++++++++++++++++++++++++++
drivers/acpi/acpica/exprep.c | 2 +
6 files changed, 104 insertions(+), 16 deletions(-)
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -254,6 +254,7 @@ struct acpi_create_field_info {
u32 field_bit_position;
u32 field_bit_length;
u16 resource_length;
+ u16 pin_number_index;
u8 field_flags;
u8 attribute;
u8 field_type;
--- a/drivers/acpi/acpica/acobject.h
+++ b/drivers/acpi/acpica/acobject.h
@@ -263,6 +263,7 @@ struct acpi_object_region_field {
ACPI_OBJECT_COMMON_HEADER ACPI_COMMON_FIELD_INFO u16 resource_length;
union acpi_operand_object *region_obj; /* Containing op_region object */
u8 *resource_buffer; /* resource_template for serial regions/fields */
+ u16 pin_number_index; /* Index relative to previous Connection/Template */
};
struct acpi_object_bank_field {
--- a/drivers/acpi/acpica/dsfield.c
+++ b/drivers/acpi/acpica/dsfield.c
@@ -360,6 +360,7 @@ acpi_ds_get_field_names(struct acpi_crea
*/
info->resource_buffer = NULL;
info->connection_node = NULL;
+ info->pin_number_index = 0;
/*
* A Connection() is either an actual resource descriptor (buffer)
@@ -437,6 +438,7 @@ acpi_ds_get_field_names(struct acpi_crea
}
info->field_bit_position += info->field_bit_length;
+ info->pin_number_index++; /* Index relative to previous Connection() */
break;
default:
--- a/drivers/acpi/acpica/evregion.c
+++ b/drivers/acpi/acpica/evregion.c
@@ -141,6 +141,7 @@ acpi_ev_address_space_dispatch(union acp
union acpi_operand_object *region_obj2;
void *region_context = NULL;
struct acpi_connection_info *context;
+ acpi_physical_address address;
ACPI_FUNCTION_TRACE(ev_address_space_dispatch);
@@ -235,25 +236,32 @@ acpi_ev_address_space_dispatch(union acp
/* We have everything we need, we can invoke the address space handler */
handler = handler_desc->address_space.handler;
-
- ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
- "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
- ®ion_obj->region.handler->address_space, handler,
- ACPI_FORMAT_NATIVE_UINT(region_obj->region.address +
- region_offset),
- acpi_ut_get_region_name(region_obj->region.
- space_id)));
+ address = (region_obj->region.address + region_offset);
/*
* Special handling for generic_serial_bus and general_purpose_io:
* There are three extra parameters that must be passed to the
* handler via the context:
- * 1) Connection buffer, a resource template from Connection() op.
- * 2) Length of the above buffer.
- * 3) Actual access length from the access_as() op.
+ * 1) Connection buffer, a resource template from Connection() op
+ * 2) Length of the above buffer
+ * 3) Actual access length from the access_as() op
+ *
+ * In addition, for general_purpose_io, the Address and bit_width fields
+ * are defined as follows:
+ * 1) Address is the pin number index of the field (bit offset from
+ * the previous Connection)
+ * 2) bit_width is the actual bit length of the field (number of pins)
*/
- if (((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) ||
- (region_obj->region.space_id == ACPI_ADR_SPACE_GPIO)) &&
+ if ((region_obj->region.space_id == ACPI_ADR_SPACE_GSBUS) &&
+ context && field_obj) {
+
+ /* Get the Connection (resource_template) buffer */
+
+ context->connection = field_obj->field.resource_buffer;
+ context->length = field_obj->field.resource_length;
+ context->access_length = field_obj->field.access_length;
+ }
+ if ((region_obj->region.space_id == ACPI_ADR_SPACE_GPIO) &&
context && field_obj) {
/* Get the Connection (resource_template) buffer */
@@ -261,8 +269,17 @@ acpi_ev_address_space_dispatch(union acp
context->connection = field_obj->field.resource_buffer;
context->length = field_obj->field.resource_length;
context->access_length = field_obj->field.access_length;
+ address = field_obj->field.pin_number_index;
+ bit_width = field_obj->field.bit_length;
}
+ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ ®ion_obj->region.handler->address_space, handler,
+ ACPI_FORMAT_NATIVE_UINT(address),
+ acpi_ut_get_region_name(region_obj->region.
+ space_id)));
+
if (!(handler_desc->address_space.handler_flags &
ACPI_ADDR_HANDLER_DEFAULT_INSTALLED)) {
/*
@@ -275,9 +292,7 @@ acpi_ev_address_space_dispatch(union acp
/* Call the handler */
- status = handler(function,
- (region_obj->region.address + region_offset),
- bit_width, value, context,
+ status = handler(function, address, bit_width, value, context,
region_obj2->extra.region_context);
if (ACPI_FAILURE(status)) {
--- a/drivers/acpi/acpica/exfield.c
+++ b/drivers/acpi/acpica/exfield.c
@@ -178,6 +178,37 @@ acpi_ex_read_data_from_field(struct acpi
buffer = &buffer_desc->integer.value;
}
+ if ((obj_desc->common.type == ACPI_TYPE_LOCAL_REGION_FIELD) &&
+ (obj_desc->field.region_obj->region.space_id ==
+ ACPI_ADR_SPACE_GPIO)) {
+ /*
+ * For GPIO (general_purpose_io), the Address will be the bit offset
+ * from the previous Connection() operator, making it effectively a
+ * pin number index. The bit_length is the length of the field, which
+ * is thus the number of pins.
+ */
+ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
+ "GPIO FieldRead [FROM]: Pin %u Bits %u\n",
+ obj_desc->field.pin_number_index,
+ obj_desc->field.bit_length));
+
+ /* Lock entire transaction if requested */
+
+ acpi_ex_acquire_global_lock(obj_desc->common_field.field_flags);
+
+ /* Perform the write */
+
+ status = acpi_ex_access_region(obj_desc, 0,
+ (u64 *)buffer, ACPI_READ);
+ acpi_ex_release_global_lock(obj_desc->common_field.field_flags);
+ if (ACPI_FAILURE(status)) {
+ acpi_ut_remove_reference(buffer_desc);
+ } else {
+ *ret_buffer_desc = buffer_desc;
+ }
+ return_ACPI_STATUS(status);
+ }
+
ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
"FieldRead [TO]: Obj %p, Type %X, Buf %p, ByteLen %X\n",
obj_desc, obj_desc->common.type, buffer,
@@ -325,6 +356,42 @@ acpi_ex_write_data_to_field(union acpi_o
*result_desc = buffer_desc;
return_ACPI_STATUS(status);
+ } else if ((obj_desc->common.type == ACPI_TYPE_LOCAL_REGION_FIELD) &&
+ (obj_desc->field.region_obj->region.space_id ==
+ ACPI_ADR_SPACE_GPIO)) {
+ /*
+ * For GPIO (general_purpose_io), we will bypass the entire field
+ * mechanism and handoff the bit address and bit width directly to
+ * the handler. The Address will be the bit offset
+ * from the previous Connection() operator, making it effectively a
+ * pin number index. The bit_length is the length of the field, which
+ * is thus the number of pins.
+ */
+ if (source_desc->common.type != ACPI_TYPE_INTEGER) {
+ return_ACPI_STATUS(AE_AML_OPERAND_TYPE);
+ }
+
+ ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
+ "GPIO FieldWrite [FROM]: (%s:%X), Val %.8X [TO]: Pin %u Bits %u\n",
+ acpi_ut_get_type_name(source_desc->common.
+ type),
+ source_desc->common.type,
+ (u32)source_desc->integer.value,
+ obj_desc->field.pin_number_index,
+ obj_desc->field.bit_length));
+
+ buffer = &source_desc->integer.value;
+
+ /* Lock entire transaction if requested */
+
+ acpi_ex_acquire_global_lock(obj_desc->common_field.field_flags);
+
+ /* Perform the write */
+
+ status = acpi_ex_access_region(obj_desc, 0,
+ (u64 *)buffer, ACPI_WRITE);
+ acpi_ex_release_global_lock(obj_desc->common_field.field_flags);
+ return_ACPI_STATUS(status);
}
/* Get a pointer to the data to be written */
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -479,6 +479,8 @@ acpi_status acpi_ex_prep_field_value(str
obj_desc->field.resource_length = info->resource_length;
}
+ obj_desc->field.pin_number_index = info->pin_number_index;
+
/* Allow full data read from EC address space */
if ((obj_desc->field.region_obj->region.space_id ==
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 071/143] regmap: Fix handling of volatile registers for format_write() chips
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 070/143] ACPICA: Update to GPIO region handler interface Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 072/143] KVM: x86: handle idiv overflow at kvm_write_tsc Greg Kroah-Hartman
` (72 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mark Brown, Lars-Peter Clausen
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <broonie@linaro.org>
commit 5844a8b9d98ec11ce1d77610daacf3f0a0e14715 upstream.
A previous over-zealous factorisation of code means that we only treat
registers as volatile if they are readable. For most devices this is fine
since normally most registers can be read and volatility implies
readability but for format_write() devices where there is no readback from
the hardware and we use volatility to mean simply uncacheability this means
that we end up treating all registers as cacheble.
A bigger refactoring of the code to clarify this is in order but as a fix
make a minimal change and only check readability when checking volatility
if there is no format_write() operation defined for the device.
Signed-off-by: Mark Brown <broonie@linaro.org>
Tested-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -114,7 +114,7 @@ bool regmap_readable(struct regmap *map,
bool regmap_volatile(struct regmap *map, unsigned int reg)
{
- if (!regmap_readable(map, reg))
+ if (!map->format.format_write && !regmap_readable(map, reg))
return false;
if (map->volatile_reg)
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 072/143] KVM: x86: handle idiv overflow at kvm_write_tsc
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 071/143] regmap: Fix handling of volatile registers for format_write() chips Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 073/143] x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8 Greg Kroah-Hartman
` (71 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marcelo Tosatti, Gleb Natapov,
Philipp Hahn
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcelo Tosatti <mtosatti@redhat.com>
commit 8915aa27d5efbb9185357175b0acf884325565f9 upstream.
Its possible that idivl overflows (due to large delta stored in usdiff,
valid scenario).
Create an exception handler to catch the overflow exception (division by zero
is protected by vcpu->arch.virtual_tsc_khz check), and interpret it accordingly
(delta is larger than USEC_PER_SEC).
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=969644
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Philipp Hahn <hahn@univention.de>
Tested-by: Philipp Hahn <hahn@univention.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -1196,20 +1196,37 @@ void kvm_write_tsc(struct kvm_vcpu *vcpu
elapsed = ns - kvm->arch.last_tsc_nsec;
if (vcpu->arch.virtual_tsc_khz) {
+ int faulted = 0;
+
/* n.b - signed multiplication and division required */
usdiff = data - kvm->arch.last_tsc_write;
#ifdef CONFIG_X86_64
usdiff = (usdiff * 1000) / vcpu->arch.virtual_tsc_khz;
#else
/* do_div() only does unsigned */
- asm("idivl %2; xor %%edx, %%edx"
- : "=A"(usdiff)
- : "A"(usdiff * 1000), "rm"(vcpu->arch.virtual_tsc_khz));
+ asm("1: idivl %[divisor]\n"
+ "2: xor %%edx, %%edx\n"
+ " movl $0, %[faulted]\n"
+ "3:\n"
+ ".section .fixup,\"ax\"\n"
+ "4: movl $1, %[faulted]\n"
+ " jmp 3b\n"
+ ".previous\n"
+
+ _ASM_EXTABLE(1b, 4b)
+
+ : "=A"(usdiff), [faulted] "=r" (faulted)
+ : "A"(usdiff * 1000), [divisor] "rm"(vcpu->arch.virtual_tsc_khz));
+
#endif
do_div(elapsed, 1000);
usdiff -= elapsed;
if (usdiff < 0)
usdiff = -usdiff;
+
+ /* idivl overflow => difference is larger than USEC_PER_SEC */
+ if (faulted)
+ usdiff = USEC_PER_SEC;
} else
usdiff = USEC_PER_SEC; /* disable TSC match window below */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 073/143] x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 072/143] KVM: x86: handle idiv overflow at kvm_write_tsc Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 074/143] shmem: fix nlink for rename overwrite directory Greg Kroah-Hartman
` (70 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dave Young, Matt Fleming
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Young <dyoung@redhat.com>
commit 3eddc69ffeba092d288c386646bfa5ec0fce25fd upstream.
3.16 kernel boot fail with earlyprintk=efi, it keeps scrolling at the
bottom line of screen.
Bisected, the first bad commit is below:
commit 86dfc6f339886559d80ee0d4bd20fe5ee90450f0
Author: Lv Zheng <lv.zheng@intel.com>
Date: Fri Apr 4 12:38:57 2014 +0800
ACPICA: Tables: Fix table checksums verification before installation.
I did some debugging by enabling both serial and efi earlyprintk, below is
some debug dmesg, seems early_ioremap fails in scroll up function due to
no free slot, see below dmesg output:
WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:116 __early_ioremap+0x90/0x1c4()
__early_ioremap(ed00c800, 00000c80) not found slot
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 3.17.0-rc1+ #204
Hardware name: Hewlett-Packard HP Z420 Workstation/1589, BIOS J61 v03.15 05/09/2013
Call Trace:
dump_stack+0x4e/0x7a
warn_slowpath_common+0x75/0x8e
? __early_ioremap+0x90/0x1c4
warn_slowpath_fmt+0x47/0x49
__early_ioremap+0x90/0x1c4
? sprintf+0x46/0x48
early_ioremap+0x13/0x15
early_efi_map+0x24/0x26
early_efi_scroll_up+0x6d/0xc0
early_efi_write+0x1b0/0x214
call_console_drivers.constprop.21+0x73/0x7e
console_unlock+0x151/0x3b2
? vprintk_emit+0x49f/0x532
vprintk_emit+0x521/0x532
? console_unlock+0x383/0x3b2
printk+0x4f/0x51
acpi_os_vprintf+0x2b/0x2d
acpi_os_printf+0x43/0x45
acpi_info+0x5c/0x63
? __acpi_map_table+0x13/0x18
? acpi_os_map_iomem+0x21/0x147
acpi_tb_print_table_header+0x177/0x186
acpi_tb_install_table_with_override+0x4b/0x62
acpi_tb_install_standard_table+0xd9/0x215
? early_ioremap+0x13/0x15
? __acpi_map_table+0x13/0x18
acpi_tb_parse_root_table+0x16e/0x1b4
acpi_initialize_tables+0x57/0x59
acpi_table_init+0x50/0xce
acpi_boot_table_init+0x1e/0x85
setup_arch+0x9b7/0xcc4
start_kernel+0x94/0x42d
? early_idt_handlers+0x120/0x120
x86_64_start_reservations+0x2a/0x2c
x86_64_start_kernel+0xf3/0x100
Quote reply from Lv.zheng about the early ioremap slot usage in this case:
"""
In early_efi_scroll_up(), 2 mapping entries will be used for the src/dst screen buffer.
In drivers/acpi/acpica/tbutils.c, we've improved the early table loading code in acpi_tb_parse_root_table().
We now need 2 mapping entries:
1. One mapping entry is used for RSDT table mapping. Each RSDT entry contains an address for another ACPI table.
2. For each entry in RSDP, we need another mapping entry to map the table to perform necessary check/override before installing it.
When acpi_tb_parse_root_table() prints something through EFI earlyprintk console, we'll have 4 mapping entries used.
The current 4 slots setting of early_ioremap() seems to be too small for such a use case.
"""
Thus increase the slot to 8 in this patch to fix this issue.
boot-time mappings become 512 page with this patch.
Signed-off-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/fixmap.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/include/asm/fixmap.h
+++ b/arch/x86/include/asm/fixmap.h
@@ -123,14 +123,14 @@ enum fixed_addresses {
__end_of_permanent_fixed_addresses,
/*
- * 256 temporary boot-time mappings, used by early_ioremap(),
+ * 512 temporary boot-time mappings, used by early_ioremap(),
* before ioremap() is functional.
*
- * If necessary we round it up to the next 256 pages boundary so
+ * If necessary we round it up to the next 512 pages boundary so
* that we can have a single pgd entry and a single pte table:
*/
#define NR_FIX_BTMAPS 64
-#define FIX_BTMAPS_SLOTS 4
+#define FIX_BTMAPS_SLOTS 8
#define TOTAL_FIX_BTMAPS (NR_FIX_BTMAPS * FIX_BTMAPS_SLOTS)
FIX_BTMAP_END =
(__end_of_permanent_fixed_addresses ^
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 074/143] shmem: fix nlink for rename overwrite directory
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 073/143] x86 early_ioremap: Increase FIX_BTMAPS_SLOTS to 8 Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 075/143] ASoC: davinci-mcasp: Correct rx format unit configuration Greg Kroah-Hartman
` (69 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi, Al Viro
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit b928095b0a7cff7fb9fcf4c706348ceb8ab2c295 upstream.
If overwriting an empty directory with rename, then need to drop the extra
nlink.
Test prog:
#include <stdio.h>
#include <fcntl.h>
#include <err.h>
#include <sys/stat.h>
int main(void)
{
const char *test_dir1 = "test-dir1";
const char *test_dir2 = "test-dir2";
int res;
int fd;
struct stat statbuf;
res = mkdir(test_dir1, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir1);
res = mkdir(test_dir2, 0777);
if (res == -1)
err(1, "mkdir(\"%s\")", test_dir2);
fd = open(test_dir2, O_RDONLY);
if (fd == -1)
err(1, "open(\"%s\")", test_dir2);
res = rename(test_dir1, test_dir2);
if (res == -1)
err(1, "rename(\"%s\", \"%s\")", test_dir1, test_dir2);
res = fstat(fd, &statbuf);
if (res == -1)
err(1, "fstat(%i)", fd);
if (statbuf.st_nlink != 0) {
fprintf(stderr, "nlink is %lu, should be 0\n", statbuf.st_nlink);
return 1;
}
return 0;
}
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/shmem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2128,8 +2128,10 @@ static int shmem_rename(struct inode *ol
if (new_dentry->d_inode) {
(void) shmem_unlink(new_dir, new_dentry);
- if (they_are_dirs)
+ if (they_are_dirs) {
+ drop_nlink(new_dentry->d_inode);
drop_nlink(old_dir);
+ }
} else if (they_are_dirs) {
drop_nlink(old_dir);
inc_nlink(new_dir);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 075/143] ASoC: davinci-mcasp: Correct rx format unit configuration
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 074/143] shmem: fix nlink for rename overwrite directory Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 076/143] CIFS: Fix directory rename error Greg Kroah-Hartman
` (68 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Ujfalusi, Mark Brown
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <peter.ujfalusi@ti.com>
commit fe0a29e163a5d045c73faab682a8dac71c2f8012 upstream.
In case of capture we should not use rotation. The reverse and mask is
enough to get the data align correctly from the bus to MCU:
Format data from bus after reverse (XRBUF)
S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB|
S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB|
S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB|
S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB|
With this patch all supported formats will work for playback and capture.
Reported-by: Jyri Sarha <jsarha@ti.com> (broken S24_3LE capture)
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/davinci/davinci-mcasp.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/sound/soc/davinci/davinci-mcasp.c
+++ b/sound/soc/davinci/davinci-mcasp.c
@@ -632,8 +632,17 @@ static int davinci_config_channel_size(s
{
u32 fmt;
u32 tx_rotate = (word_length / 4) & 0x7;
- u32 rx_rotate = (32 - word_length) / 4;
u32 mask = (1ULL << word_length) - 1;
+ /*
+ * For captured data we should not rotate, inversion and masking is
+ * enoguh to get the data to the right position:
+ * Format data from bus after reverse (XRBUF)
+ * S16_LE: |LSB|MSB|xxx|xxx| |xxx|xxx|MSB|LSB|
+ * S24_3LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB|
+ * S24_LE: |LSB|DAT|MSB|xxx| |xxx|MSB|DAT|LSB|
+ * S32_LE: |LSB|DAT|DAT|MSB| |MSB|DAT|DAT|LSB|
+ */
+ u32 rx_rotate = 0;
/*
* if s BCLK-to-LRCLK ratio has been configured via the set_clkdiv()
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 076/143] CIFS: Fix directory rename error
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 075/143] ASoC: davinci-mcasp: Correct rx format unit configuration Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 077/143] CIFS: Fix SMB2 readdir error handling Greg Kroah-Hartman
` (67 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit a07d322059db66b84c9eb4f98959df468e88b34b upstream.
CIFS servers process nlink counts differently for files and directories.
In cifs_rename() if we the request fails on the existing target, we
try to remove it through cifs_unlink() but this is not what we want
to do for directories. As the result the following sequence of commands
mkdir {1,2}; mv -T 1 2; rmdir {1,2}; mkdir {1,2}; echo foo > 2/bar
and XFS test generic/023 fail with -ENOENT error. That's why the second
mkdir reuses the existing inode (target inode of the mv -T command) with
S_DEAD flag.
Fix this by checking whether the target is directory or not and
calling cifs_rmdir() rather than cifs_unlink() for directories.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/inode.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -1640,7 +1640,10 @@ cifs_rename(struct inode *source_dir, st
unlink_target:
/* Try unlinking the target dentry if it's not negative */
if (target_dentry->d_inode && (rc == -EACCES || rc == -EEXIST)) {
- tmprc = cifs_unlink(target_dir, target_dentry);
+ if (S_ISDIR(target_dentry->d_inode->i_mode))
+ tmprc = cifs_rmdir(target_dir, target_dentry);
+ else
+ tmprc = cifs_unlink(target_dir, target_dentry);
if (tmprc)
goto cifs_rename_exit;
rc = cifs_do_rename(xid, source_dentry, from_name,
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 077/143] CIFS: Fix SMB2 readdir error handling
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 076/143] CIFS: Fix directory rename error Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 078/143] iio:trigger: modify return value for iio_trigger_get Greg Kroah-Hartman
` (66 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pavel Shilovsky, Steve French
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <pshilovsky@samba.org>
commit 52755808d4525f4d5b86d112d36ffc7a46f3fb48 upstream.
SMB2 servers indicates the end of a directory search with
STATUS_NO_MORE_FILE error code that is not processed now.
This causes generic/257 xfstest to fail. Fix this by triggering
the end of search by this error code in SMB2_query_directory.
Also when negotiating CIFS protocol we tell the server to close
the search automatically at the end and there is no need to do
it itself. In the case of SMB2 protocol, we need to close it
explicitly - separate close directory checks for different
protocols.
Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsglob.h | 2 ++
fs/cifs/file.c | 2 +-
fs/cifs/readdir.c | 2 +-
fs/cifs/smb1ops.c | 7 +++++++
fs/cifs/smb2maperror.c | 2 +-
fs/cifs/smb2ops.c | 8 ++++++++
fs/cifs/smb2pdu.c | 9 ++++-----
7 files changed, 24 insertions(+), 8 deletions(-)
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -375,6 +375,8 @@ struct smb_version_operations {
const char *, u32 *);
int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,
int);
+ /* check if we need to issue closedir */
+ bool (*dir_needs_close)(struct cifsFileInfo *);
};
struct smb_version_values {
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -735,7 +735,7 @@ int cifs_closedir(struct inode *inode, s
cifs_dbg(FYI, "Freeing private data in close dir\n");
spin_lock(&cifs_file_list_lock);
- if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
+ if (server->ops->dir_needs_close(cfile)) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
if (server->ops->close_dir)
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -582,7 +582,7 @@ find_cifs_entry(const unsigned int xid,
/* close and restart search */
cifs_dbg(FYI, "search backing up - close and restart search\n");
spin_lock(&cifs_file_list_lock);
- if (!cfile->srch_inf.endOfSearch && !cfile->invalidHandle) {
+ if (server->ops->dir_needs_close(cfile)) {
cfile->invalidHandle = true;
spin_unlock(&cifs_file_list_lock);
if (server->ops->close_dir)
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -885,6 +885,12 @@ cifs_mand_lock(const unsigned int xid, s
(__u8)type, wait, 0);
}
+static bool
+cifs_dir_needs_close(struct cifsFileInfo *cfile)
+{
+ return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle;
+}
+
struct smb_version_operations smb1_operations = {
.send_cancel = send_nt_cancel,
.compare_fids = cifs_compare_fids,
@@ -948,6 +954,7 @@ struct smb_version_operations smb1_opera
.mand_lock = cifs_mand_lock,
.mand_unlock_range = cifs_unlock_range,
.push_mand_locks = cifs_push_mandatory_locks,
+ .dir_needs_close = cifs_dir_needs_close,
#ifdef CONFIG_CIFS_XATTR
.query_all_EAs = CIFSSMBQAllEAs,
.set_EA = CIFSSMBSetEA,
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -214,7 +214,7 @@ static const struct status_to_posix_erro
{STATUS_BREAKPOINT, -EIO, "STATUS_BREAKPOINT"},
{STATUS_SINGLE_STEP, -EIO, "STATUS_SINGLE_STEP"},
{STATUS_BUFFER_OVERFLOW, -EIO, "STATUS_BUFFER_OVERFLOW"},
- {STATUS_NO_MORE_FILES, -EIO, "STATUS_NO_MORE_FILES"},
+ {STATUS_NO_MORE_FILES, -ENODATA, "STATUS_NO_MORE_FILES"},
{STATUS_WAKE_SYSTEM_DEBUGGER, -EIO, "STATUS_WAKE_SYSTEM_DEBUGGER"},
{STATUS_HANDLES_CLOSED, -EIO, "STATUS_HANDLES_CLOSED"},
{STATUS_NO_INHERITANCE, -EIO, "STATUS_NO_INHERITANCE"},
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -554,6 +554,12 @@ smb2_new_lease_key(struct cifs_fid *fid)
get_random_bytes(fid->lease_key, SMB2_LEASE_KEY_SIZE);
}
+static bool
+smb2_dir_needs_close(struct cifsFileInfo *cfile)
+{
+ return !cfile->invalidHandle;
+}
+
struct smb_version_operations smb21_operations = {
.compare_fids = smb2_compare_fids,
.setup_request = smb2_setup_request,
@@ -618,6 +624,7 @@ struct smb_version_operations smb21_oper
.set_lease_key = smb2_set_lease_key,
.new_lease_key = smb2_new_lease_key,
.calc_signature = smb2_calc_signature,
+ .dir_needs_close = smb2_dir_needs_close,
};
@@ -685,6 +692,7 @@ struct smb_version_operations smb30_oper
.set_lease_key = smb2_set_lease_key,
.new_lease_key = smb2_new_lease_key,
.calc_signature = smb3_calc_signature,
+ .dir_needs_close = smb2_dir_needs_close,
};
struct smb_version_values smb20_values = {
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1800,6 +1800,10 @@ SMB2_query_directory(const unsigned int
rsp = (struct smb2_query_directory_rsp *)iov[0].iov_base;
if (rc) {
+ if (rc == -ENODATA && rsp->hdr.Status == STATUS_NO_MORE_FILES) {
+ srch_inf->endOfSearch = true;
+ rc = 0;
+ }
cifs_stats_fail_inc(tcon, SMB2_QUERY_DIRECTORY_HE);
goto qdir_exit;
}
@@ -1837,11 +1841,6 @@ SMB2_query_directory(const unsigned int
else
cifs_dbg(VFS, "illegal search buffer type\n");
- if (rsp->hdr.Status == STATUS_NO_MORE_FILES)
- srch_inf->endOfSearch = 1;
- else
- srch_inf->endOfSearch = 0;
-
return rc;
qdir_exit:
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 078/143] iio:trigger: modify return value for iio_trigger_get
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 077/143] CIFS: Fix SMB2 readdir error handling Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 079/143] iio: gyro: itg3200: Fix indio_dev->trig assignment Greg Kroah-Hartman
` (65 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit f153566570fb9e32c2f59182883f4f66048788fb upstream.
Instead of a void function, return the trigger pointer.
Whilst not in of itself a fix, this makes the following set of
7 fixes cleaner than they would otherwise be.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/iio/trigger.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/include/linux/iio/trigger.h
+++ b/include/linux/iio/trigger.h
@@ -83,10 +83,12 @@ static inline void iio_trigger_put(struc
put_device(&trig->dev);
}
-static inline void iio_trigger_get(struct iio_trigger *trig)
+static inline struct iio_trigger *iio_trigger_get(struct iio_trigger *trig)
{
get_device(&trig->dev);
__module_get(trig->ops->owner);
+
+ return trig;
}
/**
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 079/143] iio: gyro: itg3200: Fix indio_dev->trig assignment
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 078/143] iio:trigger: modify return value for iio_trigger_get Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 080/143] iio: inv_mpu6050: " Greg Kroah-Hartman
` (64 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 0b4dce2ee694a991ef38203ec5ff91a738518cb3 upstream.
This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/gyro/itg3200_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/gyro/itg3200_buffer.c
+++ b/drivers/iio/gyro/itg3200_buffer.c
@@ -135,7 +135,7 @@ int itg3200_probe_trigger(struct iio_dev
goto error_free_irq;
/* select default trigger */
- indio_dev->trig = st->trig;
+ indio_dev->trig = iio_trigger_get(st->trig);
return 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 080/143] iio: inv_mpu6050: Fix indio_dev->trig assignment
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 079/143] iio: gyro: itg3200: Fix indio_dev->trig assignment Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 081/143] iio: meter: ade7758: " Greg Kroah-Hartman
` (63 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit b07e3b3850b2e1f09c19f54d3ed7210d9f529e2c upstream.
This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
@@ -135,7 +135,7 @@ int inv_mpu6050_probe_trigger(struct iio
ret = iio_trigger_register(st->trig);
if (ret)
goto error_free_irq;
- indio_dev->trig = st->trig;
+ indio_dev->trig = iio_trigger_get(st->trig);
return 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 081/143] iio: meter: ade7758: Fix indio_dev->trig assignment
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 080/143] iio: inv_mpu6050: " Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 082/143] iio: st_sensors: " Greg Kroah-Hartman
` (62 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada,
Lars-Peter Clausen, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 0495081179212b758775df752e657ea71dcae020 upstream.
This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/meter/ade7758_trigger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/meter/ade7758_trigger.c
+++ b/drivers/staging/iio/meter/ade7758_trigger.c
@@ -85,7 +85,7 @@ int ade7758_probe_trigger(struct iio_dev
ret = iio_trigger_register(st->trig);
/* select default trigger */
- indio_dev->trig = st->trig;
+ indio_dev->trig = iio_trigger_get(st->trig);
if (ret)
goto error_free_irq;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 082/143] iio: st_sensors: Fix indio_dev->trig assignment
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 081/143] iio: meter: ade7758: " Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 083/143] iio: adc: ad_sigma_delta: " Greg Kroah-Hartman
` (61 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit f0e84acd7056e6d7ade551c6439531606ae30a46 upstream.
This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/st_sensors/st_sensors_trigger.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/common/st_sensors/st_sensors_trigger.c
+++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c
@@ -49,7 +49,7 @@ int st_sensors_allocate_trigger(struct i
dev_err(&indio_dev->dev, "failed to register iio trigger.\n");
goto iio_trigger_register_error;
}
- indio_dev->trig = sdata->trig;
+ indio_dev->trig = iio_trigger_get(sdata->trig);
return 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 083/143] iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 082/143] iio: st_sensors: " Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 084/143] iio:magnetometer: bugfix magnetometers gain values Greg Kroah-Hartman
` (60 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada,
Lars-Peter Clausen, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 9e5846be33277802c0c76e5c12825d0e4d27f639 upstream.
This can result in wrong reference count for trigger device, call
iio_trigger_get to increment reference.
Refer to http://www.spinics.net/lists/linux-iio/msg13669.html for discussion
with Jonathan.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad_sigma_delta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -477,7 +477,7 @@ static int ad_sd_probe_trigger(struct ii
goto error_free_irq;
/* select default trigger */
- indio_dev->trig = sigma_delta->trig;
+ indio_dev->trig = iio_trigger_get(sigma_delta->trig);
return 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 084/143] iio:magnetometer: bugfix magnetometers gain values
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 083/143] iio: adc: ad_sigma_delta: " Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 085/143] iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name Greg Kroah-Hartman
` (59 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Denis Ciocca, Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis CIOCCA <denis.ciocca@st.com>
commit a31d0928999fbf33b3a6042e8bcb7b7f7e07d094 upstream.
This patch fix gains values. The first driver was designed using
engineering samples, in mass production the values are changed.
Signed-off-by: Denis Ciocca <denis.ciocca@st.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/st_magn_core.c | 52 ++++++++++++++++++--------------
1 file changed, 30 insertions(+), 22 deletions(-)
--- a/drivers/iio/magnetometer/st_magn_core.c
+++ b/drivers/iio/magnetometer/st_magn_core.c
@@ -40,7 +40,8 @@
#define ST_MAGN_FS_AVL_5600MG 5600
#define ST_MAGN_FS_AVL_8000MG 8000
#define ST_MAGN_FS_AVL_8100MG 8100
-#define ST_MAGN_FS_AVL_10000MG 10000
+#define ST_MAGN_FS_AVL_12000MG 12000
+#define ST_MAGN_FS_AVL_16000MG 16000
/* CUSTOM VALUES FOR SENSOR 1 */
#define ST_MAGN_1_WAI_EXP 0x3c
@@ -67,20 +68,20 @@
#define ST_MAGN_1_FS_AVL_4700_VAL 0x05
#define ST_MAGN_1_FS_AVL_5600_VAL 0x06
#define ST_MAGN_1_FS_AVL_8100_VAL 0x07
-#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 1100
-#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 855
-#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 670
-#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 450
-#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 400
-#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 330
-#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 230
-#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 980
-#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 760
-#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 600
-#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 400
-#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 355
-#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 295
-#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 205
+#define ST_MAGN_1_FS_AVL_1300_GAIN_XY 909
+#define ST_MAGN_1_FS_AVL_1900_GAIN_XY 1169
+#define ST_MAGN_1_FS_AVL_2500_GAIN_XY 1492
+#define ST_MAGN_1_FS_AVL_4000_GAIN_XY 2222
+#define ST_MAGN_1_FS_AVL_4700_GAIN_XY 2500
+#define ST_MAGN_1_FS_AVL_5600_GAIN_XY 3030
+#define ST_MAGN_1_FS_AVL_8100_GAIN_XY 4347
+#define ST_MAGN_1_FS_AVL_1300_GAIN_Z 1020
+#define ST_MAGN_1_FS_AVL_1900_GAIN_Z 1315
+#define ST_MAGN_1_FS_AVL_2500_GAIN_Z 1666
+#define ST_MAGN_1_FS_AVL_4000_GAIN_Z 2500
+#define ST_MAGN_1_FS_AVL_4700_GAIN_Z 2816
+#define ST_MAGN_1_FS_AVL_5600_GAIN_Z 3389
+#define ST_MAGN_1_FS_AVL_8100_GAIN_Z 4878
#define ST_MAGN_1_MULTIREAD_BIT false
/* CUSTOM VALUES FOR SENSOR 2 */
@@ -103,10 +104,12 @@
#define ST_MAGN_2_FS_MASK 0x60
#define ST_MAGN_2_FS_AVL_4000_VAL 0x00
#define ST_MAGN_2_FS_AVL_8000_VAL 0x01
-#define ST_MAGN_2_FS_AVL_10000_VAL 0x02
-#define ST_MAGN_2_FS_AVL_4000_GAIN 430
-#define ST_MAGN_2_FS_AVL_8000_GAIN 230
-#define ST_MAGN_2_FS_AVL_10000_GAIN 230
+#define ST_MAGN_2_FS_AVL_12000_VAL 0x02
+#define ST_MAGN_2_FS_AVL_16000_VAL 0x03
+#define ST_MAGN_2_FS_AVL_4000_GAIN 146
+#define ST_MAGN_2_FS_AVL_8000_GAIN 292
+#define ST_MAGN_2_FS_AVL_12000_GAIN 438
+#define ST_MAGN_2_FS_AVL_16000_GAIN 584
#define ST_MAGN_2_MULTIREAD_BIT false
#define ST_MAGN_2_OUT_X_L_ADDR 0x28
#define ST_MAGN_2_OUT_Y_L_ADDR 0x2a
@@ -252,9 +255,14 @@ static const struct st_sensors st_magn_s
.gain = ST_MAGN_2_FS_AVL_8000_GAIN,
},
[2] = {
- .num = ST_MAGN_FS_AVL_10000MG,
- .value = ST_MAGN_2_FS_AVL_10000_VAL,
- .gain = ST_MAGN_2_FS_AVL_10000_GAIN,
+ .num = ST_MAGN_FS_AVL_12000MG,
+ .value = ST_MAGN_2_FS_AVL_12000_VAL,
+ .gain = ST_MAGN_2_FS_AVL_12000_GAIN,
+ },
+ [3] = {
+ .num = ST_MAGN_FS_AVL_16000MG,
+ .value = ST_MAGN_2_FS_AVL_16000_VAL,
+ .gain = ST_MAGN_2_FS_AVL_16000_GAIN,
},
},
},
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 085/143] iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 084/143] iio:magnetometer: bugfix magnetometers gain values Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 086/143] Target/iser: Get isert_conn reference once got to connected_handler Greg Kroah-Hartman
` (58 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Pointner, Guenter Roeck,
Jonathan Cameron
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Pointner <johannes.pointner@gmail.com>
commit 872687f626e033b4ddfaec1e410057cfc6636d77 upstream.
Fixes: a2c12493ed7e ('iio: of_iio_channel_get_by_name() returns non-null pointers for error legs')
which improperly assumes that of_iio_channel_get_by_name must always
return NULL and thus now hides -EPROBE_DEFER.
Signed-off-by: Johannes Pointner <johannes.pointner@br-automation.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/inkern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -178,7 +178,7 @@ static struct iio_channel *of_iio_channe
index = of_property_match_string(np, "io-channel-names",
name);
chan = of_iio_channel_get(np, index);
- if (!IS_ERR(chan))
+ if (!IS_ERR(chan) || PTR_ERR(chan) == -EPROBE_DEFER)
break;
else if (name && index >= 0) {
pr_err("ERROR: could not get IIO channel %s:%s(%i)\n",
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 086/143] Target/iser: Get isert_conn reference once got to connected_handler
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 085/143] iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 087/143] Target/iser: Dont put isert_conn inside disconnected handler Greg Kroah-Hartman
` (57 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagig@mellanox.com>
commit c2f88b17a1d97ca4ecd96cc22333a7a4f1407d39 upstream.
In case the connection didn't reach connected state, disconnected
handler will never be invoked thus the second kref_put on
isert_conn will be missing.
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -404,7 +404,6 @@ isert_connect_request(struct rdma_cm_id
init_completion(&isert_conn->conn_wait);
init_completion(&isert_conn->conn_wait_comp_err);
kref_init(&isert_conn->conn_kref);
- kref_get(&isert_conn->conn_kref);
mutex_init(&isert_conn->conn_mutex);
cma_id->context = isert_conn;
@@ -530,7 +529,9 @@ isert_connect_release(struct isert_conn
static void
isert_connected_handler(struct rdma_cm_id *cma_id)
{
- return;
+ struct isert_conn *isert_conn = cma_id->context;
+
+ kref_get(&isert_conn->conn_kref);
}
static void
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 087/143] Target/iser: Dont put isert_conn inside disconnected handler
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 086/143] Target/iser: Get isert_conn reference once got to connected_handler Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 088/143] iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure Greg Kroah-Hartman
` (56 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagig@mellanox.com>
commit 0fc4ea701fcf5bc51ace4e288af5be741465f776 upstream.
disconnected_handler is invoked on several CM events (such
as DISCONNECTED, DEVICE_REMOVAL, TIMEWAIT_EXIT...). Since
multiple events can occur while before isert_free_conn is
invoked, we might put all isert_conn references and free
the connection too early.
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -583,7 +583,6 @@ isert_disconnect_work(struct work_struct
wake_up:
complete(&isert_conn->conn_wait);
- isert_put_conn(isert_conn);
}
static void
@@ -2266,6 +2265,7 @@ static void isert_wait_conn(struct iscsi
wait_for_completion(&isert_conn->conn_wait_comp_err);
wait_for_completion(&isert_conn->conn_wait);
+ isert_put_conn(isert_conn);
}
static void isert_free_conn(struct iscsi_conn *conn)
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 088/143] iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 087/143] Target/iser: Dont put isert_conn inside disconnected handler Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 089/143] iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid Greg Kroah-Hartman
` (55 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joern Engel, Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joern Engel <joern@logfs.org>
commit 8ae757d09c45102b347a1bc2867f54ffc1ab8fda upstream.
In iscsi_copy_param_list() a failed iscsi_param_list memory allocation
currently invokes iscsi_release_param_list() to cleanup, and will promptly
trigger a NULL pointer dereference.
Instead, go ahead and return for the first iscsi_copy_param_list()
failure case.
Found by coverity.
Signed-off-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target_parameters.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -603,7 +603,7 @@ int iscsi_copy_param_list(
param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
if (!param_list) {
pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
- goto err_out;
+ return -1;
}
INIT_LIST_HEAD(¶m_list->param_list);
INIT_LIST_HEAD(¶m_list->extra_response_list);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 089/143] iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 088/143] iscsi-target: avoid NULL pointer in iscsi_copy_param_list failure Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 090/143] NFC: microread: Potential overflows in microread_target_discovered() Greg Kroah-Hartman
` (54 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joern Engel, Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit b53b0d99d6fbf7d44330395349a895521cfdbc96 upstream.
This patch fixes a bug in iscsit_logout_post_handler_diffcid() where
a pointer used as storage for list_for_each_entry() was incorrectly
being used to determine if no matching entry had been found.
This patch changes iscsit_logout_post_handler_diffcid() to key off
bool conn_found to determine if the function needs to exit early.
Reported-by: Joern Engel <joern@logfs.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4453,6 +4453,7 @@ static void iscsit_logout_post_handler_d
{
struct iscsi_conn *l_conn;
struct iscsi_session *sess = conn->sess;
+ bool conn_found = false;
if (!sess)
return;
@@ -4461,12 +4462,13 @@ static void iscsit_logout_post_handler_d
list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {
if (l_conn->cid == cid) {
iscsit_inc_conn_usage_count(l_conn);
+ conn_found = true;
break;
}
}
spin_unlock_bh(&sess->conn_lock);
- if (!l_conn)
+ if (!conn_found)
return;
if (l_conn->sock)
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 090/143] NFC: microread: Potential overflows in microread_target_discovered()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 089/143] iscsi-target: Fix memory corruption in iscsit_logout_post_handler_diffcid Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 091/143] SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu Greg Kroah-Hartman
` (53 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Samuel Ortiz
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit d07f1e8600ccb885c8f4143402b8912f7d827bcb upstream.
Smatch says that skb->data is untrusted so we need to check to make sure
that the memcpy() doesn't overflow.
Fixes: cfad1ba87150 ('NFC: Initial support for Inside Secure microread')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nfc/microread/microread.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/nfc/microread/microread.c
+++ b/drivers/nfc/microread/microread.c
@@ -501,9 +501,13 @@ static void microread_target_discovered(
targets->sens_res =
be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A_ATQA]);
targets->sel_res = skb->data[MICROREAD_EMCF_A_SAK];
- memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID],
- skb->data[MICROREAD_EMCF_A_LEN]);
targets->nfcid1_len = skb->data[MICROREAD_EMCF_A_LEN];
+ if (targets->nfcid1_len > sizeof(targets->nfcid1)) {
+ r = -EINVAL;
+ goto exit_free;
+ }
+ memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A_UID],
+ targets->nfcid1_len);
break;
case MICROREAD_GATE_ID_MREAD_ISO_A_3:
targets->supported_protocols =
@@ -511,9 +515,13 @@ static void microread_target_discovered(
targets->sens_res =
be16_to_cpu(*(u16 *)&skb->data[MICROREAD_EMCF_A3_ATQA]);
targets->sel_res = skb->data[MICROREAD_EMCF_A3_SAK];
- memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID],
- skb->data[MICROREAD_EMCF_A3_LEN]);
targets->nfcid1_len = skb->data[MICROREAD_EMCF_A3_LEN];
+ if (targets->nfcid1_len > sizeof(targets->nfcid1)) {
+ r = -EINVAL;
+ goto exit_free;
+ }
+ memcpy(targets->nfcid1, &skb->data[MICROREAD_EMCF_A3_UID],
+ targets->nfcid1_len);
break;
case MICROREAD_GATE_ID_MREAD_ISO_B:
targets->supported_protocols = NFC_PROTO_ISO14443_B_MASK;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 091/143] SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 090/143] NFC: microread: Potential overflows in microread_target_discovered() Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 092/143] Revert "iwlwifi: dvm: dont enable CTS to self" Greg Kroah-Hartman
` (52 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Mike Christie,
Sagi Grimberg, Christoph Hellwig, James Bottomley
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Christie <michaelc@cs.wisc.edu>
commit db9bfd64b14a3a8f1868d2164518fdeab1b26ad1 upstream.
This patches fixes a potential buffer overrun in __iscsi_conn_send_pdu.
This function is used by iscsi drivers and userspace to send iscsi PDUs/
commands. For login commands, we have a set buffer size. For all other
commands we do not support data buffers.
This was reported by Dan Carpenter here:
http://www.spinics.net/lists/linux-scsi/msg66838.html
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/libiscsi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -717,11 +717,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn
return NULL;
}
+ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
+ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
+ return NULL;
+ }
+
task = conn->login_task;
} else {
if (session->state != ISCSI_STATE_LOGGED_IN)
return NULL;
+ if (data_size != 0) {
+ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
+ return NULL;
+ }
+
BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 092/143] Revert "iwlwifi: dvm: dont enable CTS to self"
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 091/143] SCSI: libiscsi: fix potential buffer overrun in __iscsi_conn_send_pdu Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 093/143] workqueue: apply __WQ_ORDERED to create_singlethread_workqueue() Greg Kroah-Hartman
` (51 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Emmanuel Grumbach
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
commit f47f46d7b09cf1d09e4b44b6cc4dd7d68a08028c upstream.
This reverts commit 43d826ca5979927131685cc2092c7ce862cb91cd.
This commit caused packet loss.
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/dvm/rxon.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1072,6 +1072,13 @@ int iwlagn_commit_rxon(struct iwl_priv *
/* recalculate basic rates */
iwl_calc_basic_rates(priv, ctx);
+ /*
+ * force CTS-to-self frames protection if RTS-CTS is not preferred
+ * one aggregation protection method
+ */
+ if (!priv->hw_params.use_rts_for_aggregation)
+ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+
if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
!(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
@@ -1477,6 +1484,11 @@ void iwlagn_bss_info_changed(struct ieee
else
ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+ if (bss_conf->use_cts_prot)
+ ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
+ else
+ ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
+
memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
if (vif->type == NL80211_IFTYPE_AP ||
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 093/143] workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 092/143] Revert "iwlwifi: dvm: dont enable CTS to self" Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 094/143] block: Fix dev_t minor allocation lifetime Greg Kroah-Hartman
` (50 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Mike Anderson,
Oleg Nesterov, Gustavo Luiz Duarte, Tomas Henzl
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit e09c2c295468476a239d13324ce9042ec4de05eb upstream.
create_singlethread_workqueue() is a compat interface for single
threaded workqueue which maps to ordered workqueue w/ rescuer in the
current implementation. create_singlethread_workqueue() currently
implemented by invoking alloc_workqueue() w/ appropriate parameters.
8719dceae2f9 ("workqueue: reject adjusting max_active or applying
attrs to ordered workqueues") introduced __WQ_ORDERED to protect
ordered workqueues against dynamic attribute changes which can break
ordering guarantees but forgot to apply it to
create_singlethread_workqueue(). This in itself is okay as nobody
currently uses dynamic attribute change on workqueues created with
create_singlethread_workqueue().
However, 4c16bd327c ("workqueue: implement NUMA affinity for unbound
workqueues") broke singlethreaded guarantee for ordered workqueues
through allocating a separate pool_workqueue on each NUMA node by
default. A later change 8a2b75384444 ("workqueue: fix ordered
workqueues in NUMA setups") fixed it by allocating only one global
pool_workqueue if __WQ_ORDERED is set.
Combined, the __WQ_ORDERED omission in create_singlethread_workqueue()
became critical breaking its single threadedness and ordering
guarantee.
Let's make create_singlethread_workqueue() wrap
alloc_ordered_workqueue() instead so that it inherits __WQ_ORDERED and
can implicitly track future ordered_workqueue changes.
v2: I missed that __WQ_ORDERED now protects against pwq splitting
across NUMA nodes and incorrectly described the patch as a
nice-to-have fix to protect against future dynamic attribute
usages. Oleg pointed out that this is actually a critical
breakage due to 8a2b75384444 ("workqueue: fix ordered workqueues
in NUMA setups").
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mike Anderson <mike.anderson@us.ibm.com>
Cc: Oleg Nesterov <onestero@redhat.com>
Cc: Gustavo Luiz Duarte <gduarte@redhat.com>
Cc: Tomas Henzl <thenzl@redhat.com>
Fixes: 4c16bd327c ("workqueue: implement NUMA affinity for unbound workqueues")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/workqueue.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/workqueue.h
+++ b/include/linux/workqueue.h
@@ -414,7 +414,7 @@ __alloc_workqueue_key(const char *fmt, u
#define create_freezable_workqueue(name) \
alloc_workqueue((name), WQ_FREEZABLE | WQ_UNBOUND | WQ_MEM_RECLAIM, 1)
#define create_singlethread_workqueue(name) \
- alloc_workqueue((name), WQ_UNBOUND | WQ_MEM_RECLAIM, 1)
+ alloc_ordered_workqueue("%s", WQ_MEM_RECLAIM, name)
extern void destroy_workqueue(struct workqueue_struct *wq);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 094/143] block: Fix dev_t minor allocation lifetime
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 093/143] workqueue: apply __WQ_ORDERED to create_singlethread_workqueue() Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 095/143] dm crypt: fix access beyond the end of allocated space Greg Kroah-Hartman
` (49 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Keith Busch, Jens Axboe
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <keith.busch@intel.com>
commit 2da78092dda13f1efd26edbbf99a567776913750 upstream.
Releases the dev_t minor when all references are closed to prevent
another device from acquiring the same major/minor.
Since the partition's release may be invoked from call_rcu's soft-irq
context, the ext_dev_idr's mutex had to be replaced with a spinlock so
as not so sleep.
Signed-off-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/genhd.c | 24 ++++++++++++++----------
block/partition-generic.c | 2 +-
2 files changed, 15 insertions(+), 11 deletions(-)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -28,10 +28,10 @@ struct kobject *block_depr;
/* for extended dynamic devt allocation, currently only one major is used */
#define NR_EXT_DEVT (1 << MINORBITS)
-/* For extended devt allocation. ext_devt_mutex prevents look up
+/* For extended devt allocation. ext_devt_lock prevents look up
* results from going away underneath its user.
*/
-static DEFINE_MUTEX(ext_devt_mutex);
+static DEFINE_SPINLOCK(ext_devt_lock);
static DEFINE_IDR(ext_devt_idr);
static struct device_type disk_type;
@@ -420,9 +420,13 @@ int blk_alloc_devt(struct hd_struct *par
}
/* allocate ext devt */
- mutex_lock(&ext_devt_mutex);
- idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_KERNEL);
- mutex_unlock(&ext_devt_mutex);
+ idr_preload(GFP_KERNEL);
+
+ spin_lock(&ext_devt_lock);
+ idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT);
+ spin_unlock(&ext_devt_lock);
+
+ idr_preload_end();
if (idx < 0)
return idx == -ENOSPC ? -EBUSY : idx;
@@ -447,9 +451,9 @@ void blk_free_devt(dev_t devt)
return;
if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
- mutex_lock(&ext_devt_mutex);
+ spin_lock(&ext_devt_lock);
idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
- mutex_unlock(&ext_devt_mutex);
+ spin_unlock(&ext_devt_lock);
}
}
@@ -665,7 +669,6 @@ void del_gendisk(struct gendisk *disk)
sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
pm_runtime_set_memalloc_noio(disk_to_dev(disk), false);
device_del(disk_to_dev(disk));
- blk_free_devt(disk_to_dev(disk)->devt);
}
EXPORT_SYMBOL(del_gendisk);
@@ -690,13 +693,13 @@ struct gendisk *get_gendisk(dev_t devt,
} else {
struct hd_struct *part;
- mutex_lock(&ext_devt_mutex);
+ spin_lock(&ext_devt_lock);
part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
if (part && get_disk(part_to_disk(part))) {
*partno = part->partno;
disk = part_to_disk(part);
}
- mutex_unlock(&ext_devt_mutex);
+ spin_unlock(&ext_devt_lock);
}
return disk;
@@ -1098,6 +1101,7 @@ static void disk_release(struct device *
{
struct gendisk *disk = dev_to_disk(dev);
+ blk_free_devt(dev->devt);
disk_release_events(disk);
kfree(disk->random);
disk_replace_part_tbl(disk, NULL);
--- a/block/partition-generic.c
+++ b/block/partition-generic.c
@@ -211,6 +211,7 @@ static const struct attribute_group *par
static void part_release(struct device *dev)
{
struct hd_struct *p = dev_to_part(dev);
+ blk_free_devt(dev->devt);
free_part_stats(p);
free_part_info(p);
kfree(p);
@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *di
rcu_assign_pointer(ptbl->last_lookup, NULL);
kobject_put(part->holder_dir);
device_del(part_to_dev(part));
- blk_free_devt(part_devt(part));
hd_struct_put(part);
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 095/143] dm crypt: fix access beyond the end of allocated space
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 094/143] block: Fix dev_t minor allocation lifetime Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 096/143] Input: serport - add compat handling for SPIOCSTYPE ioctl Greg Kroah-Hartman
` (48 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kolasa, Milan Broz,
Mikulas Patocka, Mike Snitzer
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.
The DM crypt target accesses memory beyond allocated space resulting in
a crash on 32 bit x86 systems.
This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm
crypt: use async crypto"). However, this bug was masked by the fact
that kmalloc rounds the size up to the next power of two. This bug
wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio
data"). By switching to using per-bio data there was no longer any
padding beyond the end of a dm-crypt allocated memory block.
To minimize allocation overhead dm-crypt puts several structures into one
block allocated with kmalloc. The block holds struct ablkcipher_request,
cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),
struct dm_crypt_request and an initialization vector.
The variable dmreq_start is set to offset of struct dm_crypt_request
within this memory block. dm-crypt allocates the block with this size:
cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.
When accessing the initialization vector, dm-crypt uses the function
iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).
dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request
structure. However, when dm-crypt accesses the initialization vector, it
takes a pointer to the end of dm_crypt_request, aligns it, and then uses
it as the initialization vector. If the end of dm_crypt_request is not
aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the
alignment causes the initialization vector to point beyond the allocated
space.
Fix this bug by calculating the variable iv_size_padding and adding it
to the allocated size.
Also correct the alignment of dm_crypt_request. struct dm_crypt_request
is specific to dm-crypt (it isn't used by the crypto subsystem at all),
so it is aligned on __alignof__(struct dm_crypt_request).
Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is
aligned as if the block was allocated with kmalloc.
Reported-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Tested-by: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-crypt.c | 20 ++++++++++++++++----
1 file changed, 16 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1506,6 +1506,7 @@ static int crypt_ctr(struct dm_target *t
unsigned int key_size, opt_params;
unsigned long long tmpll;
int ret;
+ size_t iv_size_padding;
struct dm_arg_set as;
const char *opt_string;
char dummy;
@@ -1542,12 +1543,23 @@ static int crypt_ctr(struct dm_target *t
cc->dmreq_start = sizeof(struct ablkcipher_request);
cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
- ~(crypto_tfm_ctx_alignment() - 1);
+ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
+
+ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
+ /* Allocate the padding exactly */
+ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
+ & crypto_ablkcipher_alignmask(any_tfm(cc));
+ } else {
+ /*
+ * If the cipher requires greater alignment than kmalloc
+ * alignment, we don't know the exact position of the
+ * initialization vector. We must assume worst case.
+ */
+ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
+ }
cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
- sizeof(struct dm_crypt_request) + cc->iv_size);
+ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
if (!cc->req_pool) {
ti->error = "Cannot allocate crypt request mempool";
goto bad;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 096/143] Input: serport - add compat handling for SPIOCSTYPE ioctl
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 095/143] dm crypt: fix access beyond the end of allocated space Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 097/143] Input: synaptics - add support for ForcePads Greg Kroah-Hartman
` (47 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, John Sung, Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Sung <penmount.touch@gmail.com>
commit a80d8b02751060a178bb1f7a6b7a93645a7a308b upstream.
When running a 32-bit inputattach utility in a 64-bit system, there will be
error code "inputattach: can't set device type". This is caused by the
serport device driver not supporting compat_ioctl, so that SPIOCSTYPE ioctl
fails.
Signed-off-by: John Sung <penmount.touch@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/serport.c | 45 +++++++++++++++++++++++++++++++++++-------
1 file changed, 38 insertions(+), 7 deletions(-)
--- a/drivers/input/serio/serport.c
+++ b/drivers/input/serio/serport.c
@@ -21,6 +21,7 @@
#include <linux/init.h>
#include <linux/serio.h>
#include <linux/tty.h>
+#include <linux/compat.h>
MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
MODULE_DESCRIPTION("Input device TTY line discipline");
@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct
return 0;
}
+static void serport_set_type(struct tty_struct *tty, unsigned long type)
+{
+ struct serport *serport = tty->disc_data;
+
+ serport->id.proto = type & 0x000000ff;
+ serport->id.id = (type & 0x0000ff00) >> 8;
+ serport->id.extra = (type & 0x00ff0000) >> 16;
+}
+
/*
* serport_ldisc_ioctl() allows to set the port protocol, and device ID
*/
-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
+static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file,
+ unsigned int cmd, unsigned long arg)
{
- struct serport *serport = (struct serport*) tty->disc_data;
- unsigned long type;
-
if (cmd == SPIOCSTYPE) {
+ unsigned long type;
+
if (get_user(type, (unsigned long __user *) arg))
return -EFAULT;
- serport->id.proto = type & 0x000000ff;
- serport->id.id = (type & 0x0000ff00) >> 8;
- serport->id.extra = (type & 0x00ff0000) >> 16;
+ serport_set_type(tty, type);
+ return 0;
+ }
+
+ return -EINVAL;
+}
+
+#ifdef CONFIG_COMPAT
+#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t)
+static long serport_ldisc_compat_ioctl(struct tty_struct *tty,
+ struct file *file,
+ unsigned int cmd, unsigned long arg)
+{
+ if (cmd == COMPAT_SPIOCSTYPE) {
+ void __user *uarg = compat_ptr(arg);
+ compat_ulong_t compat_type;
+
+ if (get_user(compat_type, (compat_ulong_t __user *)uarg))
+ return -EFAULT;
+ serport_set_type(tty, compat_type);
return 0;
}
return -EINVAL;
}
+#endif
static void serport_ldisc_write_wakeup(struct tty_struct * tty)
{
@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldis
.close = serport_ldisc_close,
.read = serport_ldisc_read,
.ioctl = serport_ldisc_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = serport_ldisc_compat_ioctl,
+#endif
.receive_buf = serport_ldisc_receive,
.write_wakeup = serport_ldisc_write_wakeup
};
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 097/143] Input: synaptics - add support for ForcePads
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 096/143] Input: serport - add compat handling for SPIOCSTYPE ioctl Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 099/143] Input: atkbd - do not try deactivate keyboard on any LG laptops Greg Kroah-Hartman
` (46 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hans de Goede, Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 5715fc764f7753d464dbe094b5ef9cffa6e479a4 upstream.
ForcePads are found on HP EliteBook 1040 laptops. They lack any kind of
physical buttons, instead they generate primary button click when user
presses somewhat hard on the surface of the touchpad. Unfortunately they
also report primary button click whenever there are 2 or more contacts
on the pad, messing up all multi-finger gestures (2-finger scrolling,
multi-finger tapping, etc). To cope with this behavior we introduce a
delay (currently 50 msecs) in reporting primary press in case more
contacts appear.
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/synaptics.c | 68 ++++++++++++++++++++++++++++++----------
drivers/input/mouse/synaptics.h | 11 ++++++
2 files changed, 63 insertions(+), 16 deletions(-)
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -549,10 +549,61 @@ static int synaptics_parse_hw_state(cons
((buf[0] & 0x04) >> 1) |
((buf[3] & 0x04) >> 2));
+ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
+ hw->w == 2) {
+ synaptics_parse_agm(buf, priv, hw);
+ return 1;
+ }
+
+ hw->x = (((buf[3] & 0x10) << 8) |
+ ((buf[1] & 0x0f) << 8) |
+ buf[4]);
+ hw->y = (((buf[3] & 0x20) << 7) |
+ ((buf[1] & 0xf0) << 4) |
+ buf[5]);
+ hw->z = buf[2];
+
hw->left = (buf[0] & 0x01) ? 1 : 0;
hw->right = (buf[0] & 0x02) ? 1 : 0;
- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
+ /*
+ * ForcePads, like Clickpads, use middle button
+ * bits to report primary button clicks.
+ * Unfortunately they report primary button not
+ * only when user presses on the pad above certain
+ * threshold, but also when there are more than one
+ * finger on the touchpad, which interferes with
+ * out multi-finger gestures.
+ */
+ if (hw->z == 0) {
+ /* No contacts */
+ priv->press = priv->report_press = false;
+ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) {
+ /*
+ * Single-finger touch with pressure above
+ * the threshold. If pressure stays long
+ * enough, we'll start reporting primary
+ * button. We rely on the device continuing
+ * sending data even if finger does not
+ * move.
+ */
+ if (!priv->press) {
+ priv->press_start = jiffies;
+ priv->press = true;
+ } else if (time_after(jiffies,
+ priv->press_start +
+ msecs_to_jiffies(50))) {
+ priv->report_press = true;
+ }
+ } else {
+ priv->press = false;
+ }
+
+ hw->left = priv->report_press;
+
+ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
/*
* Clickpad's button is transmitted as middle button,
* however, since it is primary button, we will report
@@ -571,21 +622,6 @@ static int synaptics_parse_hw_state(cons
hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
}
- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
- hw->w == 2) {
- synaptics_parse_agm(buf, priv, hw);
- return 1;
- }
-
- hw->x = (((buf[3] & 0x10) << 8) |
- ((buf[1] & 0x0f) << 8) |
- buf[4]);
- hw->y = (((buf[3] & 0x20) << 7) |
- ((buf[1] & 0xf0) << 4) |
- buf[5]);
- hw->z = buf[2];
-
if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
((buf[0] ^ buf[3]) & 0x02)) {
switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -78,6 +78,11 @@
* 2 0x08 image sensor image sensor tracks 5 fingers, but only
* reports 2.
* 2 0x20 report min query 0x0f gives min coord reported
+ * 2 0x80 forcepad forcepad is a variant of clickpad that
+ * does not have physical buttons but rather
+ * uses pressure above certain threshold to
+ * report primary clicks. Forcepads also have
+ * clickpad bit set.
*/
#define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
#define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
@@ -86,6 +91,7 @@
#define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000)
#define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
#define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800)
+#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000)
/* synaptics modes query bits */
#define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
@@ -177,6 +183,11 @@ struct synaptics_data {
*/
struct synaptics_hw_state agm;
bool agm_pending; /* new AGM packet received */
+
+ /* ForcePad handling */
+ unsigned long press_start;
+ bool press;
+ bool report_press;
};
void synaptics_module_init(void);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 099/143] Input: atkbd - do not try deactivate keyboard on any LG laptops
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 097/143] Input: synaptics - add support for ForcePads Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 100/143] Input: i8042 - add Fujitsu U574 to no_timeout dmi table Greg Kroah-Hartman
` (45 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jaime Velasco Juan, Georgios Tsalikis,
Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit c01206796139e2b1feb7539bc72174fef1c6dc6e upstream.
We are getting more and more reports about LG laptops not having
functioning keyboard if we try to deactivate keyboard during probe.
Given that having keyboard deactivated is merely "nice to have"
instead of a hard requirement for probing, let's disable it on all
LG boxes instead of trying to hunt down particular models.
This change is prompted by patches trying to add "LG Electronics"/"ROCKY"
and "LG Electronics"/"LW60-F27B" to the DMI list.
https://bugzilla.kernel.org/show_bug.cgi?id=77051
Reported-by: Jaime Velasco Juan <jsagarribay@gmail.com>
Reported-by: Georgios Tsalikis <georgios@tsalikis.net>
Tested-by: Jaime Velasco Juan <jsagarribay@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/atkbd.c | 8 --------
1 file changed, 8 deletions(-)
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -1791,14 +1791,6 @@ static const struct dmi_system_id atkbd_
{
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
- DMI_MATCH(DMI_PRODUCT_NAME, "LW25-B7HV"),
- },
- .callback = atkbd_deactivate_fixup,
- },
- {
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
- DMI_MATCH(DMI_PRODUCT_NAME, "P1-J273B"),
},
.callback = atkbd_deactivate_fixup,
},
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 100/143] Input: i8042 - add Fujitsu U574 to no_timeout dmi table
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 099/143] Input: atkbd - do not try deactivate keyboard on any LG laptops Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 101/143] Input: i8042 - add nomux quirk for Avatar AVIU-145A6 Greg Kroah-Hartman
` (44 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Robinson, Hans de Goede,
Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit cc18a69c92d0972bc2fc5a047ee3be1e8398171b upstream.
https://bugzilla.kernel.org/show_bug.cgi?id=69731
Reported-by: Jason Robinson <mail@jasonrobinson.me>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -601,6 +601,14 @@ static const struct dmi_system_id __init
DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
},
},
+ {
+ /* Fujitsu U574 laptop */
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
+ },
+ },
{ }
};
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 101/143] Input: i8042 - add nomux quirk for Avatar AVIU-145A6
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 100/143] Input: i8042 - add Fujitsu U574 to no_timeout dmi table Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 102/143] ata_piix: Add Device IDs for Intel 9 Series PCH Greg Kroah-Hartman
` (43 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hugo P, Hans de Goede,
Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit d2682118f4bb3ceb835f91c1a694407a31bb7378 upstream.
The sys_vendor / product_name are somewhat generic unfortunately, so this
may lead to some false positives. But nomux usually does no harm, where as
not having it clearly is causing problems on the Avatar AVIU-145A6.
https://bugzilla.kernel.org/show_bug.cgi?id=77391
Reported-by: Hugo P <saurosii@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -458,6 +458,13 @@ static const struct dmi_system_id __init
DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
},
},
+ {
+ /* Avatar AVIU-145A6 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
+ },
+ },
{ }
};
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 102/143] ata_piix: Add Device IDs for Intel 9 Series PCH
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 101/143] Input: i8042 - add nomux quirk for Avatar AVIU-145A6 Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 103/143] percpu: free percpu allocation info for uniprocessor system Greg Kroah-Hartman
` (42 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, James Ralston, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Ralston <james.d.ralston@intel.com>
commit 6cad1376954e591c3c41500c4e586e183e7ffe6d upstream.
This patch adds the IDE mode SATA Device IDs for the Intel 9 Series PCH.
Signed-off-by: James Ralston <james.d.ralston@intel.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/ata_piix.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -340,6 +340,14 @@ static const struct pci_device_id piix_p
{ 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
/* SATA Controller IDE (Coleto Creek) */
{ 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ /* SATA Controller IDE (9 Series) */
+ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ /* SATA Controller IDE (9 Series) */
+ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ /* SATA Controller IDE (9 Series) */
+ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (9 Series) */
+ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
{ } /* terminate list */
};
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 103/143] percpu: free percpu allocation info for uniprocessor system
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 102/143] ata_piix: Add Device IDs for Intel 9 Series PCH Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:34 ` [PATCH 3.10 104/143] percpu: fix pcpu_alloc_pages() failure path Greg Kroah-Hartman
` (41 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Honggang Li, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Honggang Li <enjoymindful@gmail.com>
commit 3189eddbcafcc4d827f7f19facbeddec4424eba8 upstream.
Currently, only SMP system free the percpu allocation info.
Uniprocessor system should free it too. For example, one x86 UML
virtual machine with 256MB memory, UML kernel wastes one page memory.
Signed-off-by: Honggang Li <enjoymindful@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/mm/percpu.c
+++ b/mm/percpu.c
@@ -1910,6 +1910,8 @@ void __init setup_per_cpu_areas(void)
if (pcpu_setup_first_chunk(ai, fc) < 0)
panic("Failed to initialize percpu areas.");
+
+ pcpu_free_alloc_info(ai);
}
#endif /* CONFIG_SMP */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 104/143] percpu: fix pcpu_alloc_pages() failure path
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 103/143] percpu: free percpu allocation info for uniprocessor system Greg Kroah-Hartman
@ 2014-10-03 21:34 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 105/143] percpu: perform tlb flush after pcpu_map_pages() failure Greg Kroah-Hartman
` (40 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:34 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit f0d279654dea22b7a6ad34b9334aee80cda62cde upstream.
When pcpu_alloc_pages() fails midway, pcpu_free_pages() is invoked to
free what has already been allocated. The invocation is across the
whole requested range and pcpu_free_pages() will try to free all
non-NULL pages; unfortunately, this is incorrect as
pcpu_get_pages_and_bitmap(), unlike what its comment suggests, doesn't
clear the pages array and thus the array may have entries from the
previous invocations making the partial failure path free incorrect
pages.
Fix it by open-coding the partial freeing of the already allocated
pages.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu-vm.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_
int page_start, int page_end)
{
const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
- unsigned int cpu;
+ unsigned int cpu, tcpu;
int i;
for_each_possible_cpu(cpu) {
@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_
struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
*pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
- if (!*pagep) {
- pcpu_free_pages(chunk, pages, populated,
- page_start, page_end);
- return -ENOMEM;
- }
+ if (!*pagep)
+ goto err;
}
}
return 0;
+
+err:
+ while (--i >= page_start)
+ __free_page(pages[pcpu_page_idx(cpu, i)]);
+
+ for_each_possible_cpu(tcpu) {
+ if (tcpu == cpu)
+ break;
+ for (i = page_start; i < page_end; i++)
+ __free_page(pages[pcpu_page_idx(tcpu, i)]);
+ }
+ return -ENOMEM;
}
/**
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 105/143] percpu: perform tlb flush after pcpu_map_pages() failure
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2014-10-03 21:34 ` [PATCH 3.10 104/143] percpu: fix pcpu_alloc_pages() failure path Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 106/143] rtlwifi: rtl8192cu: Add new ID Greg Kroah-Hartman
` (39 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 849f5169097e1ba35b90ac9df76b5bb6f9c0aabd upstream.
If pcpu_map_pages() fails midway, it unmaps the already mapped pages.
Currently, it doesn't flush tlb after the partial unmapping. This may
be okay in most cases as the established mapping hasn't been used at
that point but it can go wrong and when it goes wrong it'd be
extremely difficult to track down.
Flush tlb after the partial unmapping.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/percpu-vm.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/percpu-vm.c
+++ b/mm/percpu-vm.c
@@ -272,6 +272,7 @@ err:
__pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
page_end - page_start);
}
+ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
return err;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 106/143] rtlwifi: rtl8192cu: Add new ID
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 105/143] percpu: perform tlb flush after pcpu_map_pages() failure Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 107/143] lockd: fix rpcbind crash on lockd startup failure Greg Kroah-Hartman
` (38 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nico Baggus, Larry Finger,
John W. Linville
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit c66517165610b911e4c6d268f28d8c640832dbd1 upstream.
The Sitecom WLA-2102 adapter uses this driver.
Reported-by: Nico Baggus <nico-linux@noci.xs4all.nl>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Nico Baggus <nico-linux@noci.xs4all.nl>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb
{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 107/143] lockd: fix rpcbind crash on lockd startup failure
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 106/143] rtlwifi: rtl8192cu: Add new ID Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 108/143] genhd: fix leftover might_sleep() in blk_free_devt() Greg Kroah-Hartman
` (37 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikita Yushchenko, Jeff Layton,
J. Bruce Fields
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "J. Bruce Fields" <bfields@redhat.com>
commit 7c17705e77b12b20fb8afb7c1b15dcdb126c0c12 upstream.
Nikita Yuschenko reported that booting a kernel with init=/bin/sh and
then nfs mounting without portmap or rpcbind running using a busybox
mount resulted in:
# mount -t nfs 10.30.130.21:/opt /mnt
svc: failed to register lockdv1 RPC service (errno 111).
lockd_up: makesock failed, error=-111
Unable to handle kernel paging request for data at address 0x00000030
Faulting instruction address: 0xc055e65c
Oops: Kernel access of bad area, sig: 11 [#1]
MPC85xx CDS
Modules linked in:
CPU: 0 PID: 1338 Comm: mount Not tainted 3.10.44.cge #117
task: cf29cea0 ti: cf35c000 task.ti: cf35c000
NIP: c055e65c LR: c0566490 CTR: c055e648
REGS: cf35dad0 TRAP: 0300 Not tainted (3.10.44.cge)
MSR: 00029000 <CE,EE,ME> CR: 22442488 XER: 20000000
DEAR: 00000030, ESR: 00000000
GPR00: c05606f4 cf35db80 cf29cea0 cf0ded80 cf0dedb8 00000001 1dec3086
00000000
GPR08: 00000000 c07b1640 00000007 1dec3086 22442482 100b9758 00000000
10090ae8
GPR16: 00000000 000186a5 00000000 00000000 100c3018 bfa46edc 100b0000
bfa46ef0
GPR24: cf386ae0 c07834f0 00000000 c0565f88 00000001 cf0dedb8 00000000
cf0ded80
NIP [c055e65c] call_start+0x14/0x34
LR [c0566490] __rpc_execute+0x70/0x250
Call Trace:
[cf35db80] [00000080] 0x80 (unreliable)
[cf35dbb0] [c05606f4] rpc_run_task+0x9c/0xc4
[cf35dbc0] [c0560840] rpc_call_sync+0x50/0xb8
[cf35dbf0] [c056ee90] rpcb_register_call+0x54/0x84
[cf35dc10] [c056f24c] rpcb_register+0xf8/0x10c
[cf35dc70] [c0569e18] svc_unregister.isra.23+0x100/0x108
[cf35dc90] [c0569e38] svc_rpcb_cleanup+0x18/0x30
[cf35dca0] [c0198c5c] lockd_up+0x1dc/0x2e0
[cf35dcd0] [c0195348] nlmclnt_init+0x2c/0xc8
[cf35dcf0] [c015bb5c] nfs_start_lockd+0x98/0xec
[cf35dd20] [c015ce6c] nfs_create_server+0x1e8/0x3f4
[cf35dd90] [c0171590] nfs3_create_server+0x10/0x44
[cf35dda0] [c016528c] nfs_try_mount+0x158/0x1e4
[cf35de20] [c01670d0] nfs_fs_mount+0x434/0x8c8
[cf35de70] [c00cd3bc] mount_fs+0x20/0xbc
[cf35de90] [c00e4f88] vfs_kern_mount+0x50/0x104
[cf35dec0] [c00e6e0c] do_mount+0x1d0/0x8e0
[cf35df10] [c00e75ac] SyS_mount+0x90/0xd0
[cf35df40] [c000ccf4] ret_from_syscall+0x0/0x3c
The addition of svc_shutdown_net() resulted in two calls to
svc_rpcb_cleanup(); the second is no longer necessary and crashes when
it calls rpcb_register_call with clnt=NULL.
Reported-by: Nikita Yushchenko <nyushchenko@dev.rtsoft.ru>
Fixes: 679b033df484 "lockd: ensure we tear down any live sockets when socket creation fails during lockd_up"
Acked-by: Jeff Layton <jlayton@primarydata.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -253,13 +253,11 @@ static int lockd_up_net(struct svc_serv
error = make_socks(serv, net);
if (error < 0)
- goto err_socks;
+ goto err_bind;
set_grace_period(net);
dprintk("lockd_up_net: per-net data created; net=%p\n", net);
return 0;
-err_socks:
- svc_rpcb_cleanup(serv, net);
err_bind:
ln->nlmsvc_users--;
return error;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 108/143] genhd: fix leftover might_sleep() in blk_free_devt()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 107/143] lockd: fix rpcbind crash on lockd startup failure Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 109/143] usb: host: xhci: fix compliance mode workaround Greg Kroah-Hartman
` (36 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pontus Fuchs, Jens Axboe
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@fb.com>
commit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62 upstream.
Commit 2da78092 changed the locking from a mutex to a spinlock,
so we now longer sleep in this context. But there was a leftover
might_sleep() in there, which now triggers since we do the final
free from an RCU callback. Get rid of it.
Reported-by: Pontus Fuchs <pontus.fuchs@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/genhd.c | 2 --
1 file changed, 2 deletions(-)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -445,8 +445,6 @@ int blk_alloc_devt(struct hd_struct *par
*/
void blk_free_devt(dev_t devt)
{
- might_sleep();
-
if (devt == MKDEV(0, 0))
return;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 109/143] usb: host: xhci: fix compliance mode workaround
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 108/143] genhd: fix leftover might_sleep() in blk_free_devt() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 110/143] usb: dwc3: core: fix order of PM runtime calls Greg Kroah-Hartman
` (35 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexis R. Cortes, Felipe Balbi,
Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit 96908589a8b2584b1185f834d365f5cc360e8226 upstream.
Commit 71c731a (usb: host: xhci: Fix Compliance Mode
on SN65LVP3502CP Hardware) implemented a workaround
for a known issue with Texas Instruments' USB 3.0
redriver IC but it left a condition where any xHCI
host would be taken out of reset if port was placed
in compliance mode and there was no device connected
to the port.
That condition would trigger a fake connection to a
non-existent device so that usbcore would trigger a
warm reset of the port, thus taking the link out of
reset.
This has the side-effect of preventing any xHCI host
connected to a Linux machine from starting and running
the USB 3.0 Electrical Compliance Suite because the
port will mysteriously taken out of compliance mode
and, thus, xHCI won't step through the necessary
compliance patterns for link validation.
This patch fixes the issue by just adding a missing
check for XHCI_COMP_MODE_QUIRK inside
xhci_hub_report_usb3_link_state() when PORT_CAS isn't
set.
This patch should be backported to all kernels containing
commit 71c731a.
Fixes: 71c731a (usb: host: xhci: Fix Compliance Mode on SN65LVP3502CP Hardware)
Cc: Alexis R. Cortes <alexis.cortes@ti.com>
Cc: <stable@vger.kernel.org> # v3.2+
Signed-off-by: Felipe Balbi <balbi@ti.com>
Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -462,7 +462,8 @@ void xhci_test_and_clear_bit(struct xhci
}
/* Updates Link Status for super Speed port */
-static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+static void xhci_hub_report_link_state(struct xhci_hcd *xhci,
+ u32 *status, u32 status_reg)
{
u32 pls = status_reg & PORT_PLS_MASK;
@@ -501,7 +502,8 @@ static void xhci_hub_report_link_state(u
* in which sometimes the port enters compliance mode
* caused by a delay on the host-device negotiation.
*/
- if (pls == USB_SS_PORT_LS_COMP_MOD)
+ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
+ (pls == USB_SS_PORT_LS_COMP_MOD))
pls |= USB_PORT_STAT_CONNECTION;
}
@@ -686,7 +688,7 @@ int xhci_hub_control(struct usb_hcd *hcd
}
/* Update Port Link State for super speed ports*/
if (hcd->speed == HCD_USB3) {
- xhci_hub_report_link_state(&status, temp);
+ xhci_hub_report_link_state(xhci, &status, temp);
/*
* Verify if all USB3 Ports Have entered U0 already.
* Delete Compliance Mode Timer if so.
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 110/143] usb: dwc3: core: fix order of PM runtime calls
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 109/143] usb: host: xhci: fix compliance mode workaround Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 111/143] usb: dwc3: core: fix ordering for PHY suspend Greg Kroah-Hartman
` (34 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felipe Balbi
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit fed33afce0eda44a46ae24d93aec1b5198c0bac4 upstream.
Currently, we disable pm_runtime before all register
accesses are done, this is dangerous and might lead
to abort exceptions due to the driver trying to access
a register which is clocked by a clock which was long
gated.
Fix that by moving pm_runtime_put_sync() and pm_runtime_disable()
as the last thing we do before returning from our ->remove()
method.
Fixes: 72246da (usb: Introduce DesignWare USB3 DRD Driver)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -606,9 +606,6 @@ static int dwc3_remove(struct platform_d
usb_phy_set_suspend(dwc->usb2_phy, 1);
usb_phy_set_suspend(dwc->usb3_phy, 1);
- pm_runtime_put(&pdev->dev);
- pm_runtime_disable(&pdev->dev);
-
dwc3_debugfs_exit(dwc);
switch (dwc->mode) {
@@ -631,6 +628,9 @@ static int dwc3_remove(struct platform_d
dwc3_free_event_buffers(dwc);
dwc3_core_exit(dwc);
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+
return 0;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 111/143] usb: dwc3: core: fix ordering for PHY suspend
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 110/143] usb: dwc3: core: fix order of PM runtime calls Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 112/143] Revert "mac80211: disable uAPSD if all ACs are under ACM" Greg Kroah-Hartman
` (33 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Felipe Balbi
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <balbi@ti.com>
commit dc99f16f076559235c92d3eb66d03d1310faea08 upstream.
We can't suspend the PHYs before dwc3_core_exit_mode()
has been called, that's because the host and/or device
sides might still need to communicate with the far end
link partner.
Fixes: 8ba007a (usb: dwc3: core: enable the USB2 and USB3 phy in probe)
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -603,9 +603,6 @@ static int dwc3_remove(struct platform_d
{
struct dwc3 *dwc = platform_get_drvdata(pdev);
- usb_phy_set_suspend(dwc->usb2_phy, 1);
- usb_phy_set_suspend(dwc->usb3_phy, 1);
-
dwc3_debugfs_exit(dwc);
switch (dwc->mode) {
@@ -626,6 +623,10 @@ static int dwc3_remove(struct platform_d
dwc3_event_buffers_cleanup(dwc);
dwc3_free_event_buffers(dwc);
+
+ usb_phy_set_suspend(dwc->usb2_phy, 1);
+ usb_phy_set_suspend(dwc->usb3_phy, 1);
+
dwc3_core_exit(dwc);
pm_runtime_put_sync(&pdev->dev);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 112/143] Revert "mac80211: disable uAPSD if all ACs are under ACM"
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 111/143] usb: dwc3: core: fix ordering for PHY suspend Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 113/143] kcmp: fix standard comparison bug Greg Kroah-Hartman
` (32 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luciano Coelho, Johannes Berg
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit bb512ad0732232f1d2693bb68f31a76bed8f22ae upstream.
This reverts commit 24aa11ab8ae03292d38ec0dbd9bc2ac49fe8a6dd.
That commit was wrong since it uses data that hasn't even been set
up yet, but might be a hold-over from a previous connection.
Additionally, it seems like a driver-specific workaround that
shouldn't have been in mac80211 to start with.
Fixes: 24aa11ab8ae0 ("mac80211: disable uAPSD if all ACs are under ACM")
Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/mlme.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -4395,8 +4395,7 @@ int ieee80211_mgd_assoc(struct ieee80211
rcu_read_unlock();
if (bss->wmm_used && bss->uapsd_supported &&
- (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD) &&
- sdata->wmm_acm != 0xff) {
+ (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_UAPSD)) {
assoc_data->uapsd = true;
ifmgd->flags |= IEEE80211_STA_UAPSD_ENABLED;
} else {
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 113/143] kcmp: fix standard comparison bug
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 112/143] Revert "mac80211: disable uAPSD if all ACs are under ACM" Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 114/143] fsnotify/fdinfo: use named constants instead of hardcoded values Greg Kroah-Hartman
` (31 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rasmus Villemoes, Cyrill Gorcunov,
Andrew Morton, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
commit acbbe6fbb240a927ee1f5994f04d31267d422215 upstream.
The C operator <= defines a perfectly fine total ordering on the set of
values representable in a long. However, unlike its namesake in the
integers, it is not translation invariant, meaning that we do not have
"b <= c" iff "a+b <= a+c" for all a,b,c.
This means that it is always wrong to try to boil down the relationship
between two longs to a question about the sign of their difference,
because the resulting relation [a LEQ b iff a-b <= 0] is neither
anti-symmetric or transitive. The former is due to -LONG_MIN==LONG_MIN
(take any two a,b with a-b = LONG_MIN; then a LEQ b and b LEQ a, but a !=
b). The latter can either be seen observing that x LEQ x+1 for all x,
implying x LEQ x+1 LEQ x+2 ... LEQ x-1 LEQ x; or more directly with the
simple example a=LONG_MIN, b=0, c=1, for which a-b < 0, b-c < 0, but a-c >
0.
Note that it makes absolutely no difference that a transmogrying bijection
has been applied before the comparison is done. In fact, had the
obfuscation not been done, one could probably not observe the bug
(assuming all values being compared always lie in one half of the address
space, the mathematical value of a-b is always representable in a long).
As it stands, one can easily obtain three file descriptors exhibiting the
non-transitivity of kcmp().
Side note 1: I can't see that ensuring the MSB of the multiplier is
set serves any purpose other than obfuscating the obfuscating code.
Side note 2:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <assert.h>
#include <sys/syscall.h>
enum kcmp_type {
KCMP_FILE,
KCMP_VM,
KCMP_FILES,
KCMP_FS,
KCMP_SIGHAND,
KCMP_IO,
KCMP_SYSVSEM,
KCMP_TYPES,
};
pid_t pid;
int kcmp(pid_t pid1, pid_t pid2, int type,
unsigned long idx1, unsigned long idx2)
{
return syscall(SYS_kcmp, pid1, pid2, type, idx1, idx2);
}
int cmp_fd(int fd1, int fd2)
{
int c = kcmp(pid, pid, KCMP_FILE, fd1, fd2);
if (c < 0) {
perror("kcmp");
exit(1);
}
assert(0 <= c && c < 3);
return c;
}
int cmp_fdp(const void *a, const void *b)
{
static const int normalize[] = {0, -1, 1};
return normalize[cmp_fd(*(int*)a, *(int*)b)];
}
#define MAX 100 /* This is plenty; I've seen it trigger for MAX==3 */
int main(int argc, char *argv[])
{
int r, s, count = 0;
int REL[3] = {0,0,0};
int fd[MAX];
pid = getpid();
while (count < MAX) {
r = open("/dev/null", O_RDONLY);
if (r < 0)
break;
fd[count++] = r;
}
printf("opened %d file descriptors\n", count);
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
qsort(fd, count, sizeof(fd[0]), cmp_fdp);
memset(REL, 0, sizeof(REL));
for (r = 0; r < count; ++r) {
for (s = r+1; s < count; ++s) {
REL[cmp_fd(fd[r], fd[s])]++;
}
}
printf("== %d\t< %d\t> %d\n", REL[0], REL[1], REL[2]);
return (REL[0] + REL[2] != 0);
}
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/kcmp.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int t
*/
static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type)
{
- long ret;
+ long t1, t2;
- ret = kptr_obfuscate((long)v1, type) - kptr_obfuscate((long)v2, type);
+ t1 = kptr_obfuscate((long)v1, type);
+ t2 = kptr_obfuscate((long)v2, type);
- return (ret < 0) | ((ret > 0) << 1);
+ return (t1 < t2) | ((t1 > t2) << 1);
}
/* The caller must have pinned the task */
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 114/143] fsnotify/fdinfo: use named constants instead of hardcoded values
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (102 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 113/143] kcmp: fix standard comparison bug Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 115/143] fs/notify: dont show f_handle if exportfs_encode_inode_fh failed Greg Kroah-Hartman
` (30 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Vagin, Cyrill Gorcunov,
Alexander Viro, Andrew Morton, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <avagin@openvz.org>
commit 1fc98d11cac6dd66342e5580cb2687e5b1e9a613 upstream.
MAX_HANDLE_SZ is equal to 128, but currently the size of pad is only 64
bytes, so exportfs_encode_inode_fh can return an error.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fdinfo.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -42,7 +42,7 @@ static int show_mark_fhandle(struct seq_
{
struct {
struct file_handle handle;
- u8 pad[64];
+ u8 pad[MAX_HANDLE_SZ];
} f;
int size, ret, i;
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_
size = f.handle.handle_bytes >> 2;
ret = exportfs_encode_inode_fh(inode, (struct fid *)f.handle.f_handle, &size, 0);
- if ((ret == 255) || (ret == -ENOSPC)) {
+ if ((ret == FILEID_INVALID) || (ret == -ENOSPC)) {
WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
return 0;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 115/143] fs/notify: dont show f_handle if exportfs_encode_inode_fh failed
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (103 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 114/143] fsnotify/fdinfo: use named constants instead of hardcoded values Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 116/143] nilfs2: fix data loss with mmap() Greg Kroah-Hartman
` (29 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Vagin, Cyrill Gorcunov,
Alexander Viro, Andrew Morton, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vagin <avagin@openvz.org>
commit 7e8824816bda16bb11ff5ff1e1212d642e57b0b3 upstream.
Currently we handle only ENOSPC. In case of other errors the file_handle
variable isn't filled properly and we will show a part of stack.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fdinfo.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/notify/fdinfo.c
+++ b/fs/notify/fdinfo.c
@@ -50,7 +50,7 @@ static int show_mark_fhandle(struct seq_
size = f.handle.handle_bytes >> 2;
ret = exportfs_encode_inode_fh(inode, (struct fid *)f.handle.f_handle, &size, 0);
- if ((ret == FILEID_INVALID) || (ret == -ENOSPC)) {
+ if ((ret == FILEID_INVALID) || (ret < 0)) {
WARN_ONCE(1, "Can't encode file handler for inotify: %d\n", ret);
return 0;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 116/143] nilfs2: fix data loss with mmap()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (104 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 115/143] fs/notify: dont show f_handle if exportfs_encode_inode_fh failed Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 117/143] ocfs2/dlm: do not get resource spinlock if lockres is new Greg Kroah-Hartman
` (28 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andreas Rohner, Ryusuke Konishi,
Andrew Morton, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Rohner <andreas.rohner@gmx.net>
commit 56d7acc792c0d98f38f22058671ee715ff197023 upstream.
This bug leads to reproducible silent data loss, despite the use of
msync(), sync() and a clean unmount of the file system. It is easily
reproducible with the following script:
----------------[BEGIN SCRIPT]--------------------
mkfs.nilfs2 -f /dev/sdb
mount /dev/sdb /mnt
dd if=/dev/zero bs=1M count=30 of=/mnt/testfile
umount /mnt
mount /dev/sdb /mnt
CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"
/root/mmaptest/mmaptest /mnt/testfile 30 10 5
sync
CHECKSUM_AFTER="$(md5sum /mnt/testfile)"
umount /mnt
mount /dev/sdb /mnt
CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)"
umount /mnt
echo "BEFORE MMAP:\t$CHECKSUM_BEFORE"
echo "AFTER MMAP:\t$CHECKSUM_AFTER"
echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT"
----------------[END SCRIPT]--------------------
The mmaptest tool looks something like this (very simplified, with
error checking removed):
----------------[BEGIN mmaptest]--------------------
data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
MAP_SHARED, fd, file_offset);
for (i = 0; i < write_count; ++i) {
memcpy(data + i * 4096, buf, sizeof(buf));
msync(data, file_size - file_offset, MS_SYNC))
}
----------------[END mmaptest]--------------------
The output of the script looks something like this:
BEFORE MMAP: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
AFTER MMAP: 6604a1c31f10780331a6850371b3a313 /mnt/testfile
AFTER REMOUNT: 281ed1d5ae50e8419f9b978aab16de83 /mnt/testfile
So it is clear, that the changes done using mmap() do not survive a
remount. This can be reproduced a 100% of the time. The problem was
introduced in commit 136e8770cd5d ("nilfs2: fix issue of
nilfs_set_page_dirty() for page at EOF boundary").
If the page was read with mpage_readpage() or mpage_readpages() for
example, then it has no buffers attached to it. In that case
page_has_buffers(page) in nilfs_set_page_dirty() will be false.
Therefore nilfs_set_file_dirty() is never called and the pages are never
collected and never written to disk.
This patch fixes the problem by also calling nilfs_set_file_dirty() if the
page has no buffers attached to it.
[akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -24,6 +24,7 @@
#include <linux/buffer_head.h>
#include <linux/gfp.h>
#include <linux/mpage.h>
+#include <linux/pagemap.h>
#include <linux/writeback.h>
#include <linux/aio.h>
#include "nilfs.h"
@@ -219,10 +220,10 @@ static int nilfs_writepage(struct page *
static int nilfs_set_page_dirty(struct page *page)
{
+ struct inode *inode = page->mapping->host;
int ret = __set_page_dirty_nobuffers(page);
if (page_has_buffers(page)) {
- struct inode *inode = page->mapping->host;
unsigned nr_dirty = 0;
struct buffer_head *bh, *head;
@@ -245,6 +246,10 @@ static int nilfs_set_page_dirty(struct p
if (nr_dirty)
nilfs_set_file_dirty(inode, nr_dirty);
+ } else if (ret) {
+ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
+
+ nilfs_set_file_dirty(inode, nr_dirty);
}
return ret;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 117/143] ocfs2/dlm: do not get resource spinlock if lockres is new
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (105 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 116/143] nilfs2: fix data loss with mmap() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 118/143] sched: Fix unreleased llc_shared_mask bit during CPU hotplug Greg Kroah-Hartman
` (27 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Joseph Qi, joyce.xue, Guozhonghua,
Joel Becker, Mark Fasheh, Andrew Morton, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joseph Qi <joseph.qi@huawei.com>
commit 5760a97c7143c208fa3a8f8cad0ed7dd672ebd28 upstream.
There is a deadlock case which reported by Guozhonghua:
https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html
This case is caused by &res->spinlock and &dlm->master_lock
misordering in different threads.
It was introduced by commit 8d400b81cc83 ("ocfs2/dlm: Clean up refmap
helpers"). Since lockres is new, it doesn't not require the
&res->spinlock. So remove it.
Fixes: 8d400b81cc83 ("ocfs2/dlm: Clean up refmap helpers")
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Reported-by: Guozhonghua <guozhonghua@h3c.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ocfs2/dlm/dlmmaster.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/fs/ocfs2/dlm/dlmmaster.c
+++ b/fs/ocfs2/dlm/dlmmaster.c
@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(struct
clear_bit(bit, res->refmap);
}
-
-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
struct dlm_lock_resource *res)
{
- assert_spin_locked(&res->spinlock);
-
res->inflight_locks++;
mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struc
__builtin_return_address(0));
}
+void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ struct dlm_lock_resource *res)
+{
+ assert_spin_locked(&res->spinlock);
+ __dlm_lockres_grab_inflight_ref(dlm, res);
+}
+
void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
struct dlm_lock_resource *res)
{
@@ -855,10 +859,8 @@ lookup:
/* finally add the lockres to its hash bucket */
__dlm_insert_lockres(dlm, res);
- /* Grab inflight ref to pin the resource */
- spin_lock(&res->spinlock);
- dlm_lockres_grab_inflight_ref(dlm, res);
- spin_unlock(&res->spinlock);
+ /* since this lockres is new it doesn't not require the spinlock */
+ __dlm_lockres_grab_inflight_ref(dlm, res);
/* get an extra ref on the mle in case this is a BLOCK
* if so, the creator of the BLOCK may try to put the last
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 118/143] sched: Fix unreleased llc_shared_mask bit during CPU hotplug
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (106 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 117/143] ocfs2/dlm: do not get resource spinlock if lockres is new Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 119/143] powerpc/perf: Fix ABIv2 kernel backtraces Greg Kroah-Hartman
` (26 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wanpeng Li, Linn Crosetto,
Borislav Petkov, Toshi Kani, Yasuaki Ishimatsu, David Rientjes,
Prarit Bhargava, Steven Rostedt, Peter Zijlstra, Ingo Molnar
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@linux.intel.com>
commit 03bd4e1f7265548832a76e7919a81f3137c44fd1 upstream.
The following bug can be triggered by hot adding and removing a large number of
xen domain0's vcpus repeatedly:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [..] find_busiest_group
PGD 5a9d5067 PUD 13067 PMD 0
Oops: 0000 [#3] SMP
[...]
Call Trace:
load_balance
? _raw_spin_unlock_irqrestore
idle_balance
__schedule
schedule
schedule_timeout
? lock_timer_base
schedule_timeout_uninterruptible
msleep
lock_device_hotplug_sysfs
online_store
dev_attr_store
sysfs_write_file
vfs_write
SyS_write
system_call_fastpath
Last level cache shared mask is built during CPU up and the
build_sched_domain() routine takes advantage of it to setup
the sched domain CPU topology.
However, llc_shared_mask is not released during CPU disable,
which leads to an invalid sched domainCPU topology.
This patch fix it by releasing the llc_shared_mask correctly
during CPU disable.
Yasuaki also reported that this can happen on real hardware:
https://lkml.org/lkml/2014/7/22/1018
His case is here:
==
Here is an example on my system.
My system has 4 sockets and each socket has 15 cores and HT is
enabled. In this case, each core of sockes is numbered as
follows:
| CPU#
Socket#0 | 0-14 , 60-74
Socket#1 | 15-29, 75-89
Socket#2 | 30-44, 90-104
Socket#3 | 45-59, 105-119
Then llc_shared_mask of CPU#30 has 0x3fff80000001fffc0000000.
It means that last level cache of Socket#2 is shared with
CPU#30-44 and 90-104.
When hot-removing socket#2 and #3, each core of sockets is
numbered as follows:
| CPU#
Socket#0 | 0-14 , 60-74
Socket#1 | 15-29, 75-89
But llc_shared_mask is not cleared. So llc_shared_mask of CPU#30
remains having 0x3fff80000001fffc0000000.
After that, when hot-adding socket#2 and #3, each core of
sockets is numbered as follows:
| CPU#
Socket#0 | 0-14 , 60-74
Socket#1 | 15-29, 75-89
Socket#2 | 30-59
Socket#3 | 90-119
Then llc_shared_mask of CPU#30 becomes
0x3fff8000fffffffc0000000. It means that last level cache of
Socket#2 is shared with CPU#30-59 and 90-104. So the mask has
the wrong value.
Signed-off-by: Wanpeng Li <wanpeng.li@linux.intel.com>
Tested-by: Linn Crosetto <linn@hp.com>
Reviewed-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Toshi Kani <toshi.kani@hp.com>
Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Steven Rostedt <srostedt@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/1411547885-48165-1-git-send-email-wanpeng.li@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/smpboot.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1284,6 +1284,9 @@ static void remove_siblinginfo(int cpu)
for_each_cpu(sibling, cpu_sibling_mask(cpu))
cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling));
+ for_each_cpu(sibling, cpu_llc_shared_mask(cpu))
+ cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling));
+ cpumask_clear(cpu_llc_shared_mask(cpu));
cpumask_clear(cpu_sibling_mask(cpu));
cpumask_clear(cpu_core_mask(cpu));
c->phys_proc_id = 0;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 119/143] powerpc/perf: Fix ABIv2 kernel backtraces
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (107 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 118/143] sched: Fix unreleased llc_shared_mask bit during CPU hotplug Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 120/143] parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds Greg Kroah-Hartman
` (25 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aneesh Kumar K.V, Anton Blanchard
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit 85101af13bb854a6572fa540df7c7201958624b9 upstream.
ABIv2 kernels are failing to backtrace through the kernel. An example:
39.30% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
__GI___libc_read
The problem is in valid_next_sp() where we check that the new stack
pointer is at least STACK_FRAME_OVERHEAD below the previous one.
ABIv1 has a minimum stack frame size of 112 bytes consisting of 48 bytes
and 64 bytes of parameter save area. ABIv2 changes that to 32 bytes
with no paramter save area.
STACK_FRAME_OVERHEAD is in theory the minimum stack frame size,
but we over 240 uses of it, some of which assume that it includes
space for the parameter area.
We need to work through all our stack defines and rationalise them
but let's fix perf now by creating STACK_FRAME_MIN_SIZE and using
in valid_next_sp(). This fixes the issue:
30.64% readseek2_proce [kernel.kallsyms] [k] find_get_entry
|
--- find_get_entry
pagecache_get_page
generic_file_read_iter
new_sync_read
vfs_read
sys_read
syscall_exit
__GI___libc_read
Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/ptrace.h | 7 +++++++
arch/powerpc/perf/callchain.c | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/ptrace.h
+++ b/arch/powerpc/include/asm/ptrace.h
@@ -35,6 +35,12 @@
STACK_FRAME_OVERHEAD + 288)
#define STACK_FRAME_MARKER 12
+#if defined(_CALL_ELF) && _CALL_ELF == 2
+#define STACK_FRAME_MIN_SIZE 32
+#else
+#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD
+#endif
+
/* Size of dummy stack frame allocated when calling signal handler. */
#define __SIGNAL_FRAMESIZE 128
#define __SIGNAL_FRAMESIZE32 64
@@ -46,6 +52,7 @@
#define STACK_FRAME_REGS_MARKER ASM_CONST(0x72656773)
#define STACK_INT_FRAME_SIZE (sizeof(struct pt_regs) + STACK_FRAME_OVERHEAD)
#define STACK_FRAME_MARKER 2
+#define STACK_FRAME_MIN_SIZE STACK_FRAME_OVERHEAD
/* Size of stack frame allocated when calling signal handler. */
#define __SIGNAL_FRAMESIZE 64
--- a/arch/powerpc/perf/callchain.c
+++ b/arch/powerpc/perf/callchain.c
@@ -35,7 +35,7 @@ static int valid_next_sp(unsigned long s
return 0; /* must be 16-byte aligned */
if (!validate_sp(sp, current, STACK_FRAME_OVERHEAD))
return 0;
- if (sp >= prev_sp + STACK_FRAME_OVERHEAD)
+ if (sp >= prev_sp + STACK_FRAME_MIN_SIZE)
return 1;
/*
* sp could decrease when we jump off an interrupt stack
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 120/143] parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (108 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 119/143] powerpc/perf: Fix ABIv2 kernel backtraces Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 121/143] alarmtimer: Do not signal SIGEV_NONE timers Greg Kroah-Hartman
` (24 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, John David Anglin, Helge Deller
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John David Anglin <dave.anglin@bell.net>
commit d26a7730b5874a5fa6779c62f4ad7c5065a94723 upstream.
In spite of what the GCC manual says, the -mfast-indirect-calls has
never been supported in the 64-bit parisc compiler. Indirect calls have
always been done using function descriptors irrespective of the
-mfast-indirect-calls option.
Recently, it was noticed that a function descriptor was always requested
when the -mfast-indirect-calls option was specified. This caused
problems when the option was used in application code and doesn't make
any sense because the whole point of the option is to avoid using a
function descriptor for indirect calls.
Fixing this broke 64-bit kernel builds.
I will fix GCC but for now we need the attached change. This results in
the same kernel code as before.
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/Makefile | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@@ -46,7 +46,12 @@ cflags-y := -pipe
# These flags should be implied by an hppa-linux configuration, but they
# are not in gcc 3.2.
-cflags-y += -mno-space-regs -mfast-indirect-calls
+cflags-y += -mno-space-regs
+
+# -mfast-indirect-calls is only relevant for 32-bit kernels.
+ifndef CONFIG_64BIT
+cflags-y += -mfast-indirect-calls
+endif
# Currently we save and restore fpregs on all kernel entry/interruption paths.
# If that gets optimized, we might need to disable the use of fpregs in the
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 121/143] alarmtimer: Do not signal SIGEV_NONE timers
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (109 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 120/143] parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 122/143] alarmtimer: Lock k_itimer during timer callback Greg Kroah-Hartman
` (23 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Ingo Molnar,
Richard Cochran, Prarit Bhargava, Sharvil Nanavati,
Richard Larocque, John Stultz
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <rlarocque@google.com>
commit 265b81d23a46c39df0a735a3af4238954b41a4c2 upstream.
Avoids sending a signal to alarm timers created with sigev_notify set to
SIGEV_NONE by checking for that special case in the timeout callback.
The regular posix timers avoid sending signals to SIGEV_NONE timers by
not scheduling any callbacks for them in the first place. Although it
would be possible to do something similar for alarm timers, it's simpler
to handle this as a special case in the timeout.
Prior to this patch, the alarm timer would ignore the sigev_notify value
and try to deliver signals to the process anyway. Even worse, the
sanity check for the value of sigev_signo is skipped when SIGEV_NONE was
specified, so the signal number could be bogus. If sigev_signo was an
unitialized value (as it often would be if SIGEV_NONE is used), then
it's hard to predict which signal will be sent.
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Sharvil Nanavati <sharvil@google.com>
Signed-off-by: Richard Larocque <rlarocque@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/alarmtimer.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -421,8 +421,10 @@ static enum alarmtimer_restart alarm_han
{
struct k_itimer *ptr = container_of(alarm, struct k_itimer,
it.alarm.alarmtimer);
- if (posix_timer_event(ptr, 0) != 0)
- ptr->it_overrun++;
+ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
+ if (posix_timer_event(ptr, 0) != 0)
+ ptr->it_overrun++;
+ }
/* Re-add periodic timers */
if (ptr->it.alarm.interval.tv64) {
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 122/143] alarmtimer: Lock k_itimer during timer callback
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (110 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 121/143] alarmtimer: Do not signal SIGEV_NONE timers Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 123/143] perf: Fix a race condition in perf_remove_from_context() Greg Kroah-Hartman
` (22 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Ingo Molnar,
Richard Cochran, Prarit Bhargava, Sharvil Nanavati,
Richard Larocque, John Stultz
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Larocque <rlarocque@google.com>
commit 474e941bed9262f5fa2394f9a4a67e24499e5926 upstream.
Locks the k_itimer's it_lock member when handling the alarm timer's
expiry callback.
The regular posix timers defined in posix-timers.c have this lock held
during timout processing because their callbacks are routed through
posix_timer_fn(). The alarm timers follow a different path, so they
ought to grab the lock somewhere else.
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: Sharvil Nanavati <sharvil@google.com>
Signed-off-by: Richard Larocque <rlarocque@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/alarmtimer.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/kernel/time/alarmtimer.c
+++ b/kernel/time/alarmtimer.c
@@ -419,8 +419,12 @@ static enum alarmtimer_type clock2alarm(
static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
ktime_t now)
{
+ unsigned long flags;
struct k_itimer *ptr = container_of(alarm, struct k_itimer,
it.alarm.alarmtimer);
+ enum alarmtimer_restart result = ALARMTIMER_NORESTART;
+
+ spin_lock_irqsave(&ptr->it_lock, flags);
if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
if (posix_timer_event(ptr, 0) != 0)
ptr->it_overrun++;
@@ -430,9 +434,11 @@ static enum alarmtimer_restart alarm_han
if (ptr->it.alarm.interval.tv64) {
ptr->it_overrun += alarm_forward(alarm, now,
ptr->it.alarm.interval);
- return ALARMTIMER_RESTART;
+ result = ALARMTIMER_RESTART;
}
- return ALARMTIMER_NORESTART;
+ spin_unlock_irqrestore(&ptr->it_lock, flags);
+
+ return result;
}
/**
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 123/143] perf: Fix a race condition in perf_remove_from_context()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (111 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 122/143] alarmtimer: Lock k_itimer during timer callback Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 124/143] perf kmem: Make it work again on non NUMA machines Greg Kroah-Hartman
` (21 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cong Wang, Cong Wang, Peter Zijlstra,
Paul Mackerras, Arnaldo Carvalho de Melo, Linus Torvalds,
Ingo Molnar
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <cwang@twopensource.com>
commit 3577af70a2ce4853d58e57d832e687d739281479 upstream.
We saw a kernel soft lockup in perf_remove_from_context(),
it looks like the `perf` process, when exiting, could not go
out of the retry loop. Meanwhile, the target process was forking
a child. So either the target process should execute the smp
function call to deactive the event (if it was running) or it should
do a context switch which deactives the event.
It seems we optimize out a context switch in perf_event_context_sched_out(),
and what's more important, we still test an obsolete task pointer when
retrying, so no one actually would deactive that event in this situation.
Fix it directly by reloading the task pointer in perf_remove_from_context().
This should cure the above soft lockup.
Signed-off-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/1409696840-843-1-git-send-email-xiyou.wangcong@gmail.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/events/core.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1398,6 +1398,11 @@ retry:
*/
if (ctx->is_active) {
raw_spin_unlock_irq(&ctx->lock);
+ /*
+ * Reload the task pointer, it might have been changed by
+ * a concurrent perf_event_context_sched_out().
+ */
+ task = ctx->task;
goto retry;
}
@@ -1829,6 +1834,11 @@ retry:
*/
if (ctx->is_active) {
raw_spin_unlock_irq(&ctx->lock);
+ /*
+ * Reload the task pointer, it might have been changed by
+ * a concurrent perf_event_context_sched_out().
+ */
+ task = ctx->task;
goto retry;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 124/143] perf kmem: Make it work again on non NUMA machines
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (112 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 123/143] perf: Fix a race condition in perf_remove_from_context() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 125/143] Fix nasty 32-bit overflow bug in buffer i/o code Greg Kroah-Hartman
` (20 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Olsa, Corey Ashford,
Frederic Weisbecker, Namhyung Kim, Paul Mackerras, Peter Zijlstra,
Arnaldo Carvalho de Melo, zhangzhiqiang
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@redhat.com>
commit 4921e320244e099bdf237fd10428594ce5f5b87d upstream.
The commit '2814eb0 perf kmem: Remove die() calls' disabled 'perf kmem'
command for machines without numa support. It made the command fail if
'/sys/devices/system/node' dir wasn't found.
Skipping the numa based initialization in case the directory is not
found and continue execution.
Signed-off-by: Jiri Olsa <jolsa@redhat.com>
Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1379003976-5839-5-git-send-email-jolsa@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: zhangzhiqiang <zhangzhiqiang.zhang@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/builtin-kmem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/builtin-kmem.c
+++ b/tools/perf/builtin-kmem.c
@@ -101,7 +101,7 @@ static int setup_cpunode_map(void)
dir1 = opendir(PATH_SYS_NODE);
if (!dir1)
- return -1;
+ return 0;
while ((dent1 = readdir(dir1)) != NULL) {
if (dent1->d_type != DT_DIR ||
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 125/143] Fix nasty 32-bit overflow bug in buffer i/o code.
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (113 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 124/143] perf kmem: Make it work again on non NUMA machines Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 126/143] media: cx18: fix kernel oops with tda8290 tuner Greg Kroah-Hartman
` (19 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Anton Altaparmakov, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Altaparmakov <aia21@cam.ac.uk>
commit f2d5a94436cc7cc0221b9a81bba2276a25187dd3 upstream.
On 32-bit architectures, the legacy buffer_head functions are not always
handling the sector number with the proper 64-bit types, and will thus
fail on 4TB+ disks.
Any code that uses __getblk() (and thus bread(), breadahead(),
sb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit
block on a 32-bit arch (where "long" is 32-bit) causes an inifinite loop
in __getblk_slow() with an infinite stream of errors logged to dmesg
like this:
__find_get_block_slow() failed. block=6740375944, b_blocknr=2445408648
b_state=0x00000020, b_size=512
device sda1 blocksize: 512
Note how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the
top 32-bits are missing (in this case the 0x1 at the top).
This is because grow_dev_page() is broken and has a 32-bit overflow due
to shifting the page index value (a pgoff_t - which is just 32 bits on
32-bit architectures) left-shifted as the block number. But the top
bits to get lost as the pgoff_t is not type cast to sector_t / 64-bit
before the shift.
This patch fixes this issue by type casting "index" to sector_t before
doing the left shift.
Note this is not a theoretical bug but has been seen in the field on a
4TiB hard drive with logical sector size 512 bytes.
This patch has been verified to fix the infinite loop problem on 3.17-rc5
kernel using a 4TB disk image mounted using "-o loop". Without this patch
doing a "find /nt" where /nt is an NTFS volume causes the inifinite loop
100% reproducibly whilst with the patch it works fine as expected.
Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/buffer.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -985,7 +985,8 @@ grow_dev_page(struct block_device *bdev,
bh = page_buffers(page);
if (bh->b_size == size) {
end_block = init_page_buffers(page, bdev,
- index << sizebits, size);
+ (sector_t)index << sizebits,
+ size);
goto done;
}
if (!try_to_free_buffers(page))
@@ -1006,7 +1007,8 @@ grow_dev_page(struct block_device *bdev,
*/
spin_lock(&inode->i_mapping->private_lock);
link_dev_buffers(page, bh);
- end_block = init_page_buffers(page, bdev, index << sizebits, size);
+ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
+ size);
spin_unlock(&inode->i_mapping->private_lock);
done:
ret = (block < end_block) ? 1 : -ENXIO;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 126/143] media: cx18: fix kernel oops with tda8290 tuner
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (114 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 125/143] Fix nasty 32-bit overflow bug in buffer i/o code Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 127/143] md/raid1: fix_read_error should act on all non-faulty devices Greg Kroah-Hartman
` (18 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hans Verkuil, Scott Robinson,
Mauro Carvalho Chehab
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <hans.verkuil@cisco.com>
commit 6a03dc92cc2edfa2257502557b9f714893987383 upstream.
This was caused by an uninitialized setup.config field.
Based on a suggestion from Devin Heitmueller.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Thanks-to: Devin Heitmueller <dheitmueller@kernellabs.com>
Reported-by: Scott Robinson <scott.robinson55@gmail.com>
Tested-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/cx18/cx18-driver.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/pci/cx18/cx18-driver.c
+++ b/drivers/media/pci/cx18/cx18-driver.c
@@ -1092,6 +1092,7 @@ static int cx18_probe(struct pci_dev *pc
setup.addr = ADDR_UNSET;
setup.type = cx->options.tuner;
setup.mode_mask = T_ANALOG_TV; /* matches TV tuners */
+ setup.config = NULL;
if (cx->options.radio > 0)
setup.mode_mask |= T_RADIO;
setup.tuner_callback = (setup.type == TUNER_XC2028) ?
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 127/143] md/raid1: fix_read_error should act on all non-faulty devices.
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (115 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 126/143] media: cx18: fix kernel oops with tda8290 tuner Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 128/143] ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack Greg Kroah-Hartman
` (17 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Lyakas, NeilBrown
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit b8cb6b4c121e1bf1963c16ed69e7adcb1bc301cd upstream.
If a devices is being recovered it is not InSync and is not Faulty.
If a read error is experienced on that device, fix_read_error()
will be called, but it ignores non-InSync devices. So it will
neither fix the error nor fail the device.
It is incorrect that fix_read_error() ignores non-InSync devices.
It should only ignore Faulty devices. So fix it.
This became a bug when we allowed reading from a device that was being
recovered. It is suitable for any subsequent -stable kernel.
Fixes: da8840a747c0dbf49506ec906757a6b87b9741e9
Reported-by: Alexander Lyakas <alex.bolshoy@gmail.com>
Tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2051,7 +2051,7 @@ static void fix_read_error(struct r1conf
d--;
rdev = conf->mirrors[d].rdev;
if (rdev &&
- test_bit(In_sync, &rdev->flags))
+ !test_bit(Faulty, &rdev->flags))
r1_sync_page_io(rdev, sect, s,
conf->tmppage, WRITE);
}
@@ -2063,7 +2063,7 @@ static void fix_read_error(struct r1conf
d--;
rdev = conf->mirrors[d].rdev;
if (rdev &&
- test_bit(In_sync, &rdev->flags)) {
+ !test_bit(Faulty, &rdev->flags)) {
if (r1_sync_page_io(rdev, sect, s,
conf->tmppage, READ)) {
atomic_add(s, &rdev->corrected_errors);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 128/143] ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (116 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 127/143] md/raid1: fix_read_error should act on all non-faulty devices Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 129/143] ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding Greg Kroah-Hartman
` (16 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Julian Anastasov, Hans Schillstrom,
Simon Horman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit 2627b7e15c5064ddd5e578e4efd948d48d531a3f upstream.
commit 8f4e0a18682d91 ("IPVS netns exit causes crash in conntrack")
added second ip_vs_conn_drop_conntrack call instead of just adding
the needed check. As result, the first call still can cause
crash on netns exit. Remove it.
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Hans Schillstrom <hans@schillstrom.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_conn.c | 1 -
1 file changed, 1 deletion(-)
--- a/net/netfilter/ipvs/ip_vs_conn.c
+++ b/net/netfilter/ipvs/ip_vs_conn.c
@@ -797,7 +797,6 @@ static void ip_vs_conn_expire(unsigned l
ip_vs_control_del(cp);
if (cp->flags & IP_VS_CONN_F_NFCT) {
- ip_vs_conn_drop_conntrack(cp);
/* Do not access conntracks during subsys cleanup
* because nf_conntrack_find_get can not be used after
* conntrack cleanup for the net.
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 129/143] ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (117 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 128/143] ipvs: avoid netns exit crash on ip_vs_conn_drop_conntrack Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 130/143] ipvs: fix ipv6 hook registration for local replies Greg Kroah-Hartman
` (15 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alex Gartrell, Julian Anastasov,
Simon Horman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Gartrell <agartrell@fb.com>
commit 76f084bc10004b3050b2cff9cfac29148f1f6088 upstream.
Previously, only the four high bits of the tclass were maintained in the
ipv6 case. This matches the behavior of ipv4, though whether or not we
should reflect ECN bits may be up for debate.
Signed-off-by: Alex Gartrell <agartrell@fb.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -967,8 +967,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb
iph->nexthdr = IPPROTO_IPV6;
iph->payload_len = old_iph->payload_len;
be16_add_cpu(&iph->payload_len, sizeof(*old_iph));
- iph->priority = old_iph->priority;
memset(&iph->flow_lbl, 0, sizeof(iph->flow_lbl));
+ ipv6_change_dsfield(iph, 0, ipv6_get_dsfield(old_iph));
iph->daddr = cp->daddr.in6;
iph->saddr = saddr;
iph->hop_limit = old_iph->hop_limit;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 130/143] ipvs: fix ipv6 hook registration for local replies
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (118 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 129/143] ipvs: Maintain all DSCP and ECN bits for ipv6 tun forwarding Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 131/143] PM / sleep: Add state field to pm_states[] entries Greg Kroah-Hartman
` (14 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris J Arges, Julian Anastasov,
Simon Horman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Anastasov <ja@ssi.bg>
commit eb90b0c734ad793d5f5bf230a9e9a4dcc48df8aa upstream.
commit fc604767613b6d2036cdc35b660bc39451040a47
("ipvs: changes for local real server") from 2.6.37
introduced DNAT support to local real server but the
IPv6 LOCAL_OUT handler ip_vs_local_reply6() is
registered incorrectly as IPv4 hook causing any outgoing
IPv4 traffic to be dropped depending on the IP header values.
Chris tracked down the problem to CONFIG_IP_VS_IPV6=y
Bug report: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1349768
Reported-by: Chris J Arges <chris.j.arges@canonical.com>
Tested-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1898,7 +1898,7 @@ static struct nf_hook_ops ip_vs_ops[] __
{
.hook = ip_vs_local_reply6,
.owner = THIS_MODULE,
- .pf = NFPROTO_IPV4,
+ .pf = NFPROTO_IPV6,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP6_PRI_NAT_DST + 1,
},
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 131/143] PM / sleep: Add state field to pm_states[] entries
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (119 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 130/143] ipvs: fix ipv6 hook registration for local replies Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 132/143] PM / sleep: Use valid_state() for platform-dependent sleep states only Greg Kroah-Hartman
` (13 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Brian Norris
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 27ddcc6596e50cb8f03d2e83248897667811d8f6 upstream.
To allow sleep states corresponding to the "mem", "standby" and
"freeze" lables to be different from the pm_states[] indexes of
those strings, introduce struct pm_sleep_state, consisting of
a string label and a state number, and turn pm_states[] into an
array of objects of that type.
This modification should not lead to any functional changes.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/power/main.c | 16 ++++++++--------
kernel/power/power.h | 7 ++++++-
kernel/power/suspend.c | 12 ++++++------
kernel/power/suspend_test.c | 22 ++++++++++------------
4 files changed, 30 insertions(+), 27 deletions(-)
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -293,12 +293,12 @@ static ssize_t state_show(struct kobject
{
char *s = buf;
#ifdef CONFIG_SUSPEND
- int i;
+ suspend_state_t i;
+
+ for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
+ if (valid_state(i))
+ s += sprintf(s,"%s ", pm_states[i].label);
- for (i = 0; i < PM_SUSPEND_MAX; i++) {
- if (pm_states[i] && valid_state(i))
- s += sprintf(s,"%s ", pm_states[i]);
- }
#endif
#ifdef CONFIG_HIBERNATION
s += sprintf(s, "%s\n", "disk");
@@ -314,7 +314,7 @@ static suspend_state_t decode_state(cons
{
#ifdef CONFIG_SUSPEND
suspend_state_t state = PM_SUSPEND_MIN;
- const char * const *s;
+ struct pm_sleep_state *s;
#endif
char *p;
int len;
@@ -328,7 +328,7 @@ static suspend_state_t decode_state(cons
#ifdef CONFIG_SUSPEND
for (s = &pm_states[state]; state < PM_SUSPEND_MAX; s++, state++)
- if (*s && len == strlen(*s) && !strncmp(buf, *s, len))
+ if (len == strlen(s->label) && !strncmp(buf, s->label, len))
return state;
#endif
@@ -446,7 +446,7 @@ static ssize_t autosleep_show(struct kob
#ifdef CONFIG_SUSPEND
if (state < PM_SUSPEND_MAX)
return sprintf(buf, "%s\n", valid_state(state) ?
- pm_states[state] : "error");
+ pm_states[state].label : "error");
#endif
#ifdef CONFIG_HIBERNATION
return sprintf(buf, "disk\n");
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -175,8 +175,13 @@ extern void swsusp_show_speed(struct tim
unsigned int, char *);
#ifdef CONFIG_SUSPEND
+struct pm_sleep_state {
+ const char *label;
+ suspend_state_t state;
+};
+
/* kernel/power/suspend.c */
-extern const char *const pm_states[];
+extern struct pm_sleep_state pm_states[];
extern bool valid_state(suspend_state_t state);
extern int suspend_devices_and_enter(suspend_state_t state);
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -29,10 +29,10 @@
#include "power.h"
-const char *const pm_states[PM_SUSPEND_MAX] = {
- [PM_SUSPEND_FREEZE] = "freeze",
- [PM_SUSPEND_STANDBY] = "standby",
- [PM_SUSPEND_MEM] = "mem",
+struct pm_sleep_state pm_states[PM_SUSPEND_MAX] = {
+ [PM_SUSPEND_FREEZE] = { "freeze", PM_SUSPEND_FREEZE },
+ [PM_SUSPEND_STANDBY] = { "standby", PM_SUSPEND_STANDBY },
+ [PM_SUSPEND_MEM] = { "mem", PM_SUSPEND_MEM },
};
static const struct platform_suspend_ops *suspend_ops;
@@ -337,7 +337,7 @@ static int enter_state(suspend_state_t s
sys_sync();
printk("done.\n");
- pr_debug("PM: Preparing system for %s sleep\n", pm_states[state]);
+ pr_debug("PM: Preparing system for %s sleep\n", pm_states[state].label);
error = suspend_prepare(state);
if (error)
goto Unlock;
@@ -345,7 +345,7 @@ static int enter_state(suspend_state_t s
if (suspend_test(TEST_FREEZER))
goto Finish;
- pr_debug("PM: Entering %s sleep\n", pm_states[state]);
+ pr_debug("PM: Entering %s sleep\n", pm_states[state].label);
pm_restrict_gfp_mask();
error = suspend_devices_and_enter(state);
pm_restore_gfp_mask();
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -92,13 +92,13 @@ static void __init test_wakealarm(struct
}
if (state == PM_SUSPEND_MEM) {
- printk(info_test, pm_states[state]);
+ printk(info_test, pm_states[state].label);
status = pm_suspend(state);
if (status == -ENODEV)
state = PM_SUSPEND_STANDBY;
}
if (state == PM_SUSPEND_STANDBY) {
- printk(info_test, pm_states[state]);
+ printk(info_test, pm_states[state].label);
status = pm_suspend(state);
}
if (status < 0)
@@ -136,18 +136,16 @@ static char warn_bad_state[] __initdata
static int __init setup_test_suspend(char *value)
{
- unsigned i;
+ suspend_state_t i;
/* "=mem" ==> "mem" */
value++;
- for (i = 0; i < PM_SUSPEND_MAX; i++) {
- if (!pm_states[i])
- continue;
- if (strcmp(pm_states[i], value) != 0)
- continue;
- test_state = (__force suspend_state_t) i;
- return 0;
- }
+ for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
+ if (!strcmp(pm_states[i].label, value)) {
+ test_state = pm_states[i].state;
+ return 0;
+ }
+
printk(warn_bad_state, value);
return 0;
}
@@ -165,7 +163,7 @@ static int __init test_suspend(void)
if (test_state == PM_SUSPEND_ON)
goto done;
if (!valid_state(test_state)) {
- printk(warn_bad_state, pm_states[test_state]);
+ printk(warn_bad_state, pm_states[test_state].label);
goto done;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 132/143] PM / sleep: Use valid_state() for platform-dependent sleep states only
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (120 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 131/143] PM / sleep: Add state field to pm_states[] entries Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 133/143] netfilter: nf_conntrack: avoid large timeout for mid-stream pickup Greg Kroah-Hartman
` (12 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Brian Norris
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 43e8317b0bba1d6eb85f38a4a233d82d7c20d732 upstream.
Use the observation that, for platform-dependent sleep states
(PM_SUSPEND_STANDBY, PM_SUSPEND_MEM), a given state is either
always supported or always unsupported and store that information
in pm_states[] instead of calling valid_state() every time we
need to check it.
Also do not use valid_state() for PM_SUSPEND_FREEZE, which is always
valid, and move the pm_test_level validity check for PM_SUSPEND_FREEZE
directly into enter_state().
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/power/main.c | 9 +++---
kernel/power/power.h | 2 -
kernel/power/suspend.c | 60 ++++++++++++++++++++++----------------------
kernel/power/suspend_test.c | 2 -
4 files changed, 36 insertions(+), 37 deletions(-)
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -296,7 +296,7 @@ static ssize_t state_show(struct kobject
suspend_state_t i;
for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++)
- if (valid_state(i))
+ if (pm_states[i].state)
s += sprintf(s,"%s ", pm_states[i].label);
#endif
@@ -328,8 +328,9 @@ static suspend_state_t decode_state(cons
#ifdef CONFIG_SUSPEND
for (s = &pm_states[state]; state < PM_SUSPEND_MAX; s++, state++)
- if (len == strlen(s->label) && !strncmp(buf, s->label, len))
- return state;
+ if (s->state && len == strlen(s->label)
+ && !strncmp(buf, s->label, len))
+ return s->state;
#endif
return PM_SUSPEND_ON;
@@ -445,7 +446,7 @@ static ssize_t autosleep_show(struct kob
#ifdef CONFIG_SUSPEND
if (state < PM_SUSPEND_MAX)
- return sprintf(buf, "%s\n", valid_state(state) ?
+ return sprintf(buf, "%s\n", pm_states[state].state ?
pm_states[state].label : "error");
#endif
#ifdef CONFIG_HIBERNATION
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -183,14 +183,12 @@ struct pm_sleep_state {
/* kernel/power/suspend.c */
extern struct pm_sleep_state pm_states[];
-extern bool valid_state(suspend_state_t state);
extern int suspend_devices_and_enter(suspend_state_t state);
#else /* !CONFIG_SUSPEND */
static inline int suspend_devices_and_enter(suspend_state_t state)
{
return -ENOSYS;
}
-static inline bool valid_state(suspend_state_t state) { return false; }
#endif /* !CONFIG_SUSPEND */
#ifdef CONFIG_PM_TEST_SUSPEND
--- a/kernel/power/suspend.c
+++ b/kernel/power/suspend.c
@@ -30,9 +30,9 @@
#include "power.h"
struct pm_sleep_state pm_states[PM_SUSPEND_MAX] = {
- [PM_SUSPEND_FREEZE] = { "freeze", PM_SUSPEND_FREEZE },
- [PM_SUSPEND_STANDBY] = { "standby", PM_SUSPEND_STANDBY },
- [PM_SUSPEND_MEM] = { "mem", PM_SUSPEND_MEM },
+ [PM_SUSPEND_FREEZE] = { .label = "freeze", .state = PM_SUSPEND_FREEZE },
+ [PM_SUSPEND_STANDBY] = { .label = "standby", },
+ [PM_SUSPEND_MEM] = { .label = "mem", },
};
static const struct platform_suspend_ops *suspend_ops;
@@ -62,42 +62,34 @@ void freeze_wake(void)
}
EXPORT_SYMBOL_GPL(freeze_wake);
+static bool valid_state(suspend_state_t state)
+{
+ /*
+ * PM_SUSPEND_STANDBY and PM_SUSPEND_MEM states need low level
+ * support and need to be valid to the low level
+ * implementation, no valid callback implies that none are valid.
+ */
+ return suspend_ops && suspend_ops->valid && suspend_ops->valid(state);
+}
+
/**
* suspend_set_ops - Set the global suspend method table.
* @ops: Suspend operations to use.
*/
void suspend_set_ops(const struct platform_suspend_ops *ops)
{
+ suspend_state_t i;
+
lock_system_sleep();
+
suspend_ops = ops;
+ for (i = PM_SUSPEND_STANDBY; i <= PM_SUSPEND_MEM; i++)
+ pm_states[i].state = valid_state(i) ? i : 0;
+
unlock_system_sleep();
}
EXPORT_SYMBOL_GPL(suspend_set_ops);
-bool valid_state(suspend_state_t state)
-{
- if (state == PM_SUSPEND_FREEZE) {
-#ifdef CONFIG_PM_DEBUG
- if (pm_test_level != TEST_NONE &&
- pm_test_level != TEST_FREEZER &&
- pm_test_level != TEST_DEVICES &&
- pm_test_level != TEST_PLATFORM) {
- printk(KERN_WARNING "Unsupported pm_test mode for "
- "freeze state, please choose "
- "none/freezer/devices/platform.\n");
- return false;
- }
-#endif
- return true;
- }
- /*
- * PM_SUSPEND_STANDBY and PM_SUSPEND_MEMORY states need lowlevel
- * support and need to be valid to the lowlevel
- * implementation, no valid callback implies that none are valid.
- */
- return suspend_ops && suspend_ops->valid && suspend_ops->valid(state);
-}
-
/**
* suspend_valid_only_mem - Generic memory-only valid callback.
*
@@ -324,9 +316,17 @@ static int enter_state(suspend_state_t s
{
int error;
- if (!valid_state(state))
- return -ENODEV;
-
+ if (state == PM_SUSPEND_FREEZE) {
+#ifdef CONFIG_PM_DEBUG
+ if (pm_test_level != TEST_NONE && pm_test_level <= TEST_CPUS) {
+ pr_warning("PM: Unsupported test mode for freeze state,"
+ "please choose none/freezer/devices/platform.\n");
+ return -EAGAIN;
+ }
+#endif
+ } else if (!valid_state(state)) {
+ return -EINVAL;
+ }
if (!mutex_trylock(&pm_mutex))
return -EBUSY;
--- a/kernel/power/suspend_test.c
+++ b/kernel/power/suspend_test.c
@@ -162,7 +162,7 @@ static int __init test_suspend(void)
/* PM is initialized by now; is that state testable? */
if (test_state == PM_SUSPEND_ON)
goto done;
- if (!valid_state(test_state)) {
+ if (!pm_states[test_state].state) {
printk(warn_bad_state, pm_states[test_state].label);
goto done;
}
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 133/143] netfilter: nf_conntrack: avoid large timeout for mid-stream pickup
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (121 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 132/143] PM / sleep: Use valid_state() for platform-dependent sleep states only Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 134/143] ARM: 7748/1: oabi: handle faults when loading swi instruction from userspace Greg Kroah-Hartman
` (11 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Florian Westphal, Jozsef Kadlecsik,
Pablo Neira Ayuso, Florian Koch
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 6547a221871f139cc56328a38105d47c14874cbe upstream.
When loose tracking is enabled (default), non-syn packets cause
creation of new conntracks in established state with default timeout for
established state (5 days). This causes the table to fill up with UNREPLIED
when the 'new ack' packet happened to be the last-ack of a previous,
already timed-out connection.
Consider:
A 192.168.x.52792 > 10.184.y.80: F, 426:426(0) ack 9237 win 255
B 10.184.y.80 > 192.168.x.52792: ., ack 427 win 123
<61 second pause>
C 10.184.y.80 > 192.168.x.52792: F, 9237:9237(0) ack 427 win 123
D 192.168.x.52792 > 10.184.y.80: ., ack 9238 win 255
B moves conntrack to CLOSE_WAIT and will kill it after 60 second timeout,
C is ignored (FIN set), but last packet (D) causes new ct with 5-days timeout.
Use UNACK timeout (5 minutes) instead to get rid of these entries sooner
when in ESTABLISHED state without having seen traffic in both directions.
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Florian Koch <florian.koch1981@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_conntrack_proto_tcp.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -1043,6 +1043,12 @@ static int tcp_packet(struct nf_conn *ct
nf_ct_kill_acct(ct, ctinfo, skb);
return NF_ACCEPT;
}
+ /* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
+ * pickup with loose=1. Avoid large ESTABLISHED timeout.
+ */
+ if (new_state == TCP_CONNTRACK_ESTABLISHED &&
+ timeout > timeouts[TCP_CONNTRACK_UNACK])
+ timeout = timeouts[TCP_CONNTRACK_UNACK];
} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
&& (old_state == TCP_CONNTRACK_SYN_RECV
|| old_state == TCP_CONNTRACK_ESTABLISHED)
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 134/143] ARM: 7748/1: oabi: handle faults when loading swi instruction from userspace
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (122 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 133/143] netfilter: nf_conntrack: avoid large timeout for mid-stream pickup Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 135/143] serial: 8250_dma: check the result of TX buffer mapping Greg Kroah-Hartman
` (10 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wang, Yalin, Nicolas Pitre,
Will Deacon, Russell King, Sheng Yong
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 1aa2b3b7a6c4f3dbd3671171113a20e6a6190e3b upstream.
Running an OABI_COMPAT kernel on an SMP platform can lead to fun and
games with page aging.
If one CPU issues a swi instruction immediately before another CPU
decides to mkold the page containing the swi instruction, then we will
fault attempting to load the instruction during the vector_swi handler
in order to retrieve its immediate field. Since this fault is not
currently dealt with by our exception tables, this results in a panic:
Unable to handle kernel paging request at virtual address 4020841c
pgd = c490c000
[4020841c] *pgd=84451831, *pte=bf05859d, *ppte=00000000
Internal error: Oops: 17 [#1] PREEMPT SMP ARM
Modules linked in: hid_sony(O)
CPU: 1 Tainted: G W O (3.4.0-perf-gf496dca-01162-gcbcc62b #1)
PC is at vector_swi+0x28/0x88
LR is at 0x40208420
This patch wraps all of the swi instruction loads with the USER macro
and provides a shared exception table entry which simply rewinds the
saved user PC and returns from the system call (without setting tbl, so
there's no worries with tracing or syscall restarting). Returning to
userspace will re-enter the page fault handler, from where we will
probably send SIGSEGV to the current task.
Reported-by: Wang, Yalin <yalin.wang@sonymobile.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Sheng Yong <shengyong1@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/entry-common.S | 42 ++++++++++++++++++++++++++++-------------
1 file changed, 29 insertions(+), 13 deletions(-)
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -362,6 +362,16 @@ ENTRY(vector_swi)
str r0, [sp, #S_OLD_R0] @ Save OLD_R0
zero_fp
+#ifdef CONFIG_ALIGNMENT_TRAP
+ ldr ip, __cr_alignment
+ ldr ip, [ip]
+ mcr p15, 0, ip, c1, c0 @ update control register
+#endif
+
+ enable_irq
+ ct_user_exit
+ get_thread_info tsk
+
/*
* Get the system call number.
*/
@@ -375,9 +385,9 @@ ENTRY(vector_swi)
#ifdef CONFIG_ARM_THUMB
tst r8, #PSR_T_BIT
movne r10, #0 @ no thumb OABI emulation
- ldreq r10, [lr, #-4] @ get SWI instruction
+ USER( ldreq r10, [lr, #-4] ) @ get SWI instruction
#else
- ldr r10, [lr, #-4] @ get SWI instruction
+ USER( ldr r10, [lr, #-4] ) @ get SWI instruction
#endif
#ifdef CONFIG_CPU_ENDIAN_BE8
rev r10, r10 @ little endian instruction
@@ -392,22 +402,13 @@ ENTRY(vector_swi)
/* Legacy ABI only, possibly thumb mode. */
tst r8, #PSR_T_BIT @ this is SPSR from save_user_regs
addne scno, r7, #__NR_SYSCALL_BASE @ put OS number in
- ldreq scno, [lr, #-4]
+ USER( ldreq scno, [lr, #-4] )
#else
/* Legacy ABI only. */
- ldr scno, [lr, #-4] @ get SWI instruction
+ USER( ldr scno, [lr, #-4] ) @ get SWI instruction
#endif
-#ifdef CONFIG_ALIGNMENT_TRAP
- ldr ip, __cr_alignment
- ldr ip, [ip]
- mcr p15, 0, ip, c1, c0 @ update control register
-#endif
- enable_irq
- ct_user_exit
-
- get_thread_info tsk
adr tbl, sys_call_table @ load syscall table pointer
#if defined(CONFIG_OABI_COMPAT)
@@ -442,6 +443,21 @@ local_restart:
eor r0, scno, #__NR_SYSCALL_BASE @ put OS number back
bcs arm_syscall
b sys_ni_syscall @ not private func
+
+#if defined(CONFIG_OABI_COMPAT) || !defined(CONFIG_AEABI)
+ /*
+ * We failed to handle a fault trying to access the page
+ * containing the swi instruction, but we're not really in a
+ * position to return -EFAULT. Instead, return back to the
+ * instruction and re-enter the user fault handling path trying
+ * to page it in. This will likely result in sending SEGV to the
+ * current task.
+ */
+9001:
+ sub lr, lr, #4
+ str lr, [sp, #S_PC]
+ b ret_fast_syscall
+#endif
ENDPROC(vector_swi)
/*
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 135/143] serial: 8250_dma: check the result of TX buffer mapping
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (123 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 134/143] ARM: 7748/1: oabi: handle faults when loading swi instruction from userspace Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 136/143] ext2: Fix fs corruption in ext2_get_xip_mem() Greg Kroah-Hartman
` (9 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heikki Krogerus, Petallo, MauriceX R
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
commit d4089a332883ad969700aac5dd4dd5f1c4fee825 upstream.
Using dma_mapping_error() to make sure the mapping did not
fail.
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: "Petallo, MauriceX R" <mauricex.r.petallo@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dma.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -192,21 +192,28 @@ int serial8250_request_dma(struct uart_8
dma->rx_buf = dma_alloc_coherent(dma->rxchan->device->dev, dma->rx_size,
&dma->rx_addr, GFP_KERNEL);
- if (!dma->rx_buf) {
- dma_release_channel(dma->rxchan);
- dma_release_channel(dma->txchan);
- return -ENOMEM;
- }
+ if (!dma->rx_buf)
+ goto err;
/* TX buffer */
dma->tx_addr = dma_map_single(dma->txchan->device->dev,
p->port.state->xmit.buf,
UART_XMIT_SIZE,
DMA_TO_DEVICE);
+ if (dma_mapping_error(dma->txchan->device->dev, dma->tx_addr)) {
+ dma_free_coherent(dma->rxchan->device->dev, dma->rx_size,
+ dma->rx_buf, dma->rx_addr);
+ goto err;
+ }
dev_dbg_ratelimited(p->port.dev, "got both dma channels\n");
return 0;
+err:
+ dma_release_channel(dma->rxchan);
+ dma_release_channel(dma->txchan);
+
+ return -ENOMEM;
}
EXPORT_SYMBOL_GPL(serial8250_request_dma);
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 136/143] ext2: Fix fs corruption in ext2_get_xip_mem()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (124 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 135/143] serial: 8250_dma: check the result of TX buffer mapping Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 137/143] arm: multi_v7_defconfig: Enable Zynq UART driver Greg Kroah-Hartman
` (8 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Kara, Wang Nan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 7ba3ec5749ddb61f79f7be17b5fd7720eebc52de upstream.
Commit 8e3dffc651cb "Ext2: mark inode dirty after the function
dquot_free_block_nodirty is called" unveiled a bug in __ext2_get_block()
called from ext2_get_xip_mem(). That function called ext2_get_block()
mistakenly asking it to map 0 blocks while 1 was intended. Before the
above mentioned commit things worked out fine by luck but after that commit
we started returning that we allocated 0 blocks while we in fact
allocated 1 block and thus allocation was looping until all blocks in
the filesystem were exhausted.
Fix the problem by properly asking for one block and also add assertion
in ext2_get_blocks() to catch similar problems.
Reported-and-tested-by: Andiry Xu <andiry.xu@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Wang Nan <wangnan0@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext2/inode.c | 2 ++
fs/ext2/xip.c | 1 +
2 files changed, 3 insertions(+)
--- a/fs/ext2/inode.c
+++ b/fs/ext2/inode.c
@@ -632,6 +632,8 @@ static int ext2_get_blocks(struct inode
int count = 0;
ext2_fsblk_t first_block = 0;
+ BUG_ON(maxblocks == 0);
+
depth = ext2_block_to_path(inode,iblock,offsets,&blocks_to_boundary);
if (depth == 0)
--- a/fs/ext2/xip.c
+++ b/fs/ext2/xip.c
@@ -35,6 +35,7 @@ __ext2_get_block(struct inode *inode, pg
int rc;
memset(&tmp, 0, sizeof(struct buffer_head));
+ tmp.b_size = 1 << inode->i_blkbits;
rc = ext2_get_block(inode, pgoff, &tmp, create);
*result = tmp.b_blocknr;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 137/143] arm: multi_v7_defconfig: Enable Zynq UART driver
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (125 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 136/143] ext2: Fix fs corruption in ext2_get_xip_mem() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 138/143] kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code Greg Kroah-Hartman
` (7 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Soren Brinkmann, Michal Simek
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Soren Brinkmann <soren.brinkmann@xilinx.com>
commit 90de827b9c238f8d8209bc7adc70190575514315 upstream.
Signed-off-by: Soren Brinkmann <soren.brinkmann@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/configs/multi_v7_defconfig | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/arm/configs/multi_v7_defconfig
+++ b/arch/arm/configs/multi_v7_defconfig
@@ -48,6 +48,8 @@ CONFIG_SERIAL_SIRFSOC=y
CONFIG_SERIAL_SIRFSOC_CONSOLE=y
CONFIG_SERIAL_VT8500=y
CONFIG_SERIAL_VT8500_CONSOLE=y
+CONFIG_SERIAL_XILINX_PS_UART=y
+CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y
CONFIG_IPMI_HANDLER=y
CONFIG_IPMI_SI=y
CONFIG_I2C=y
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 138/143] kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (126 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 137/143] arm: multi_v7_defconfig: Enable Zynq UART driver Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 139/143] introduce for_each_thread() to replace the buggy while_each_thread() Greg Kroah-Hartman
` (6 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Eric W. Biederman,
Michal Hocko, Pavel Emelyanov, Sergey Dyasly, Andrew Morton,
Linus Torvalds, Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 80628ca06c5d42929de6bc22c0a41589a834d151 upstream.
Cleanup and preparation for the next changes.
Move the "if (clone_flags & CLONE_THREAD)" code down under "if
(likely(p->pid))" and turn it into into the "else" branch. This makes the
process/thread initialization more symmetrical and removes one check.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Sergey Dyasly <dserrg@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/fork.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1448,14 +1448,6 @@ static struct task_struct *copy_process(
goto bad_fork_free_pid;
}
- if (clone_flags & CLONE_THREAD) {
- current->signal->nr_threads++;
- atomic_inc(¤t->signal->live);
- atomic_inc(¤t->signal->sigcnt);
- p->group_leader = current->group_leader;
- list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
- }
-
if (likely(p->pid)) {
ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
@@ -1472,6 +1464,13 @@ static struct task_struct *copy_process(
list_add_tail(&p->sibling, &p->real_parent->children);
list_add_tail_rcu(&p->tasks, &init_task.tasks);
__this_cpu_inc(process_counts);
+ } else {
+ current->signal->nr_threads++;
+ atomic_inc(¤t->signal->live);
+ atomic_inc(¤t->signal->sigcnt);
+ p->group_leader = current->group_leader;
+ list_add_tail_rcu(&p->thread_group,
+ &p->group_leader->thread_group);
}
attach_pid(p, PIDTYPE_PID, pid);
nr_threads++;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 139/143] introduce for_each_thread() to replace the buggy while_each_thread()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (127 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 138/143] kernel/fork.c:copy_process(): unify CLONE_THREAD-or-thread_group_leader code Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 140/143] oom_kill: change oom_kill.c to use for_each_thread() Greg Kroah-Hartman
` (5 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Sergey Dyasly,
Sameer Nanda, David Rientjes, Eric W. Biederman,
Frederic Weisbecker, Mandeep Singh Baines, Ma, Xindong,
Michal Hocko, Tu, Xiaobing, Andrew Morton, Linus Torvalds,
Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 0c740d0afc3bff0a097ad03a1c8df92757516f5c upstream.
while_each_thread() and next_thread() should die, almost every lockless
usage is wrong.
1. Unless g == current, the lockless while_each_thread() is not safe.
while_each_thread(g, t) can loop forever if g exits, next_thread()
can't reach the unhashed thread in this case. Note that this can
happen even if g is the group leader, it can exec.
2. Even if while_each_thread() itself was correct, people often use
it wrongly.
It was never safe to just take rcu_read_lock() and loop unless
you verify that pid_alive(g) == T, even the first next_thread()
can point to the already freed/reused memory.
This patch adds signal_struct->thread_head and task->thread_node to
create the normal rcu-safe list with the stable head. The new
for_each_thread(g, t) helper is always safe under rcu_read_lock() as
long as this task_struct can't go away.
Note: of course it is ugly to have both task_struct->thread_node and the
old task_struct->thread_group, we will kill it later, after we change
the users of while_each_thread() to use for_each_thread().
Perhaps we can kill it even before we convert all users, we can
reimplement next_thread(t) using the new thread_head/thread_node. But
we can't do this right now because this will lead to subtle behavioural
changes. For example, do/while_each_thread() always sees at least one
task, while for_each_thread() can do nothing if the whole thread group
has died. Or thread_group_empty(), currently its semantics is not clear
unless thread_group_leader(p) and we need to audit the callers before we
can change it.
So this patch adds the new interface which has to coexist with the old
one for some time, hopefully the next changes will be more or less
straightforward and the old one will go away soon.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Sergey Dyasly <dserrg@gmail.com>
Tested-by: Sergey Dyasly <dserrg@gmail.com>
Reviewed-by: Sameer Nanda <snanda@chromium.org>
Acked-by: David Rientjes <rientjes@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: "Ma, Xindong" <xindong.ma@intel.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: "Tu, Xiaobing" <xiaobing.tu@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/init_task.h | 2 ++
include/linux/sched.h | 12 ++++++++++++
kernel/exit.c | 1 +
kernel/fork.c | 7 +++++++
4 files changed, 22 insertions(+)
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -40,6 +40,7 @@ extern struct fs_struct init_fs;
#define INIT_SIGNALS(sig) { \
.nr_threads = 1, \
+ .thread_head = LIST_HEAD_INIT(init_task.thread_node), \
.wait_chldexit = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\
.shared_pending = { \
.list = LIST_HEAD_INIT(sig.shared_pending.list), \
@@ -213,6 +214,7 @@ extern struct task_group root_task_group
[PIDTYPE_SID] = INIT_PID_LINK(PIDTYPE_SID), \
}, \
.thread_group = LIST_HEAD_INIT(tsk.thread_group), \
+ .thread_node = LIST_HEAD_INIT(init_signals.thread_head), \
INIT_IDS \
INIT_PERF_EVENTS(tsk) \
INIT_TRACE_IRQFLAGS \
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -480,6 +480,7 @@ struct signal_struct {
atomic_t sigcnt;
atomic_t live;
int nr_threads;
+ struct list_head thread_head;
wait_queue_head_t wait_chldexit; /* for wait4() */
@@ -1160,6 +1161,7 @@ struct task_struct {
/* PID/PID hash table linkage. */
struct pid_link pids[PIDTYPE_MAX];
struct list_head thread_group;
+ struct list_head thread_node;
struct completion *vfork_done; /* for vfork() */
int __user *set_child_tid; /* CLONE_CHILD_SETTID */
@@ -2167,6 +2169,16 @@ extern bool current_is_single_threaded(v
#define while_each_thread(g, t) \
while ((t = next_thread(t)) != g)
+#define __for_each_thread(signal, t) \
+ list_for_each_entry_rcu(t, &(signal)->thread_head, thread_node)
+
+#define for_each_thread(p, t) \
+ __for_each_thread((p)->signal, t)
+
+/* Careful: this is a double loop, 'break' won't work as expected. */
+#define for_each_process_thread(p, t) \
+ for_each_process(p) for_each_thread(p, t)
+
static inline int get_nr_threads(struct task_struct *tsk)
{
return tsk->signal->nr_threads;
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -74,6 +74,7 @@ static void __unhash_process(struct task
__this_cpu_dec(process_counts);
}
list_del_rcu(&p->thread_group);
+ list_del_rcu(&p->thread_node);
}
/*
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1045,6 +1045,11 @@ static int copy_signal(unsigned long clo
sig->nr_threads = 1;
atomic_set(&sig->live, 1);
atomic_set(&sig->sigcnt, 1);
+
+ /* list_add(thread_node, thread_head) without INIT_LIST_HEAD() */
+ sig->thread_head = (struct list_head)LIST_HEAD_INIT(tsk->thread_node);
+ tsk->thread_node = (struct list_head)LIST_HEAD_INIT(sig->thread_head);
+
init_waitqueue_head(&sig->wait_chldexit);
sig->curr_target = tsk;
init_sigpending(&sig->shared_pending);
@@ -1471,6 +1476,8 @@ static struct task_struct *copy_process(
p->group_leader = current->group_leader;
list_add_tail_rcu(&p->thread_group,
&p->group_leader->thread_group);
+ list_add_tail_rcu(&p->thread_node,
+ &p->signal->thread_head);
}
attach_pid(p, PIDTYPE_PID, pid);
nr_threads++;
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 140/143] oom_kill: change oom_kill.c to use for_each_thread()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (128 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 139/143] introduce for_each_thread() to replace the buggy while_each_thread() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 141/143] oom_kill: has_intersects_mems_allowed() needs rcu_read_lock() Greg Kroah-Hartman
` (4 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Sergey Dyasly,
Sameer Nanda, Eric W. Biederman, Frederic Weisbecker,
Mandeep Singh Baines, Ma, Xindong, Michal Hocko, Tu, Xiaobing,
David Rientjes, Andrew Morton, Linus Torvalds, Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 1da4db0cd5c8a31d4468ec906b413e75e604b465 upstream.
Change oom_kill.c to use for_each_thread() rather than the racy
while_each_thread() which can loop forever if we race with exit.
Note also that most users were buggy even if while_each_thread() was
fine, the task can exit even _before_ rcu_read_lock().
Fortunately the new for_each_thread() only requires the stable
task_struct, so this change fixes both problems.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Sergey Dyasly <dserrg@gmail.com>
Tested-by: Sergey Dyasly <dserrg@gmail.com>
Reviewed-by: Sameer Nanda <snanda@chromium.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: "Ma, Xindong" <xindong.ma@intel.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: "Tu, Xiaobing" <xiaobing.tu@intel.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/oom_kill.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -59,7 +59,7 @@ static bool has_intersects_mems_allowed(
{
struct task_struct *start = tsk;
- do {
+ for_each_thread(start, tsk) {
if (mask) {
/*
* If this is a mempolicy constrained oom, tsk's
@@ -77,7 +77,7 @@ static bool has_intersects_mems_allowed(
if (cpuset_mems_allowed_intersects(current, tsk))
return true;
}
- } while_each_thread(start, tsk);
+ }
return false;
}
@@ -97,14 +97,14 @@ static bool has_intersects_mems_allowed(
*/
struct task_struct *find_lock_task_mm(struct task_struct *p)
{
- struct task_struct *t = p;
+ struct task_struct *t;
- do {
+ for_each_thread(p, t) {
task_lock(t);
if (likely(t->mm))
return t;
task_unlock(t);
- } while_each_thread(p, t);
+ }
return NULL;
}
@@ -301,7 +301,7 @@ static struct task_struct *select_bad_pr
unsigned long chosen_points = 0;
rcu_read_lock();
- do_each_thread(g, p) {
+ for_each_process_thread(g, p) {
unsigned int points;
switch (oom_scan_process_thread(p, totalpages, nodemask,
@@ -323,7 +323,7 @@ static struct task_struct *select_bad_pr
chosen = p;
chosen_points = points;
}
- } while_each_thread(g, p);
+ }
if (chosen)
get_task_struct(chosen);
rcu_read_unlock();
@@ -406,7 +406,7 @@ void oom_kill_process(struct task_struct
{
struct task_struct *victim = p;
struct task_struct *child;
- struct task_struct *t = p;
+ struct task_struct *t;
struct mm_struct *mm;
unsigned int victim_points = 0;
static DEFINE_RATELIMIT_STATE(oom_rs, DEFAULT_RATELIMIT_INTERVAL,
@@ -437,7 +437,7 @@ void oom_kill_process(struct task_struct
* still freeing memory.
*/
read_lock(&tasklist_lock);
- do {
+ for_each_thread(p, t) {
list_for_each_entry(child, &t->children, sibling) {
unsigned int child_points;
@@ -455,7 +455,7 @@ void oom_kill_process(struct task_struct
get_task_struct(victim);
}
}
- } while_each_thread(p, t);
+ }
read_unlock(&tasklist_lock);
rcu_read_lock();
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 141/143] oom_kill: has_intersects_mems_allowed() needs rcu_read_lock()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (129 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 140/143] oom_kill: change oom_kill.c to use for_each_thread() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 142/143] oom_kill: add rcu_read_lock() into find_lock_task_mm() Greg Kroah-Hartman
` (3 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Sergey Dyasly,
Sameer Nanda, Eric W. Biederman, Frederic Weisbecker,
Mandeep Singh Baines, Ma, Xindong, Michal Hocko, Tu, Xiaobing,
David Rientjes, Andrew Morton, Linus Torvalds, Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit ad96244179fbd55b40c00f10f399bc04739b8e1f upstream.
At least out_of_memory() calls has_intersects_mems_allowed() without
even rcu_read_lock(), this is obviously buggy.
Add the necessary rcu_read_lock(). This means that we can not simply
return from the loop, we need "bool ret" and "break".
While at it, swap the names of task_struct's (the argument and the
local). This cleans up the code a little bit and avoids the unnecessary
initialization.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Sergey Dyasly <dserrg@gmail.com>
Tested-by: Sergey Dyasly <dserrg@gmail.com>
Reviewed-by: Sameer Nanda <snanda@chromium.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: "Ma, Xindong" <xindong.ma@intel.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: "Tu, Xiaobing" <xiaobing.tu@intel.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/oom_kill.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -47,18 +47,20 @@ static DEFINE_SPINLOCK(zone_scan_lock);
#ifdef CONFIG_NUMA
/**
* has_intersects_mems_allowed() - check task eligiblity for kill
- * @tsk: task struct of which task to consider
+ * @start: task struct of which task to consider
* @mask: nodemask passed to page allocator for mempolicy ooms
*
* Task eligibility is determined by whether or not a candidate task, @tsk,
* shares the same mempolicy nodes as current if it is bound by such a policy
* and whether or not it has the same set of allowed cpuset nodes.
*/
-static bool has_intersects_mems_allowed(struct task_struct *tsk,
+static bool has_intersects_mems_allowed(struct task_struct *start,
const nodemask_t *mask)
{
- struct task_struct *start = tsk;
+ struct task_struct *tsk;
+ bool ret = false;
+ rcu_read_lock();
for_each_thread(start, tsk) {
if (mask) {
/*
@@ -67,19 +69,20 @@ static bool has_intersects_mems_allowed(
* mempolicy intersects current, otherwise it may be
* needlessly killed.
*/
- if (mempolicy_nodemask_intersects(tsk, mask))
- return true;
+ ret = mempolicy_nodemask_intersects(tsk, mask);
} else {
/*
* This is not a mempolicy constrained oom, so only
* check the mems of tsk's cpuset.
*/
- if (cpuset_mems_allowed_intersects(current, tsk))
- return true;
+ ret = cpuset_mems_allowed_intersects(current, tsk);
}
+ if (ret)
+ break;
}
+ rcu_read_unlock();
- return false;
+ return ret;
}
#else
static bool has_intersects_mems_allowed(struct task_struct *tsk,
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 142/143] oom_kill: add rcu_read_lock() into find_lock_task_mm()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (130 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 141/143] oom_kill: has_intersects_mems_allowed() needs rcu_read_lock() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-03 21:35 ` [PATCH 3.10 143/143] vm_is_stack: use for_each_thread() rather then buggy while_each_thread() Greg Kroah-Hartman
` (2 subsequent siblings)
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Sergey Dyasly,
Sameer Nanda, Eric W. Biederman, Frederic Weisbecker,
Mandeep Singh Baines, Ma, Xindong, Michal Hocko, Tu, Xiaobing,
David Rientjes, Andrew Morton, Linus Torvalds, Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 4d4048be8a93769350efa31d2482a038b7de73d0 upstream.
find_lock_task_mm() expects it is called under rcu or tasklist lock, but
it seems that at least oom_unkillable_task()->task_in_mem_cgroup() and
mem_cgroup_out_of_memory()->oom_badness() can call it lockless.
Perhaps we could fix the callers, but this patch simply adds rcu lock
into find_lock_task_mm(). This also allows to simplify a bit one of its
callers, oom_kill_process().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Cc: Sergey Dyasly <dserrg@gmail.com>
Cc: Sameer Nanda <snanda@chromium.org>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Mandeep Singh Baines <msb@chromium.org>
Cc: "Ma, Xindong" <xindong.ma@intel.com>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: "Tu, Xiaobing" <xiaobing.tu@intel.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/oom_kill.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/mm/oom_kill.c
+++ b/mm/oom_kill.c
@@ -102,14 +102,19 @@ struct task_struct *find_lock_task_mm(st
{
struct task_struct *t;
+ rcu_read_lock();
+
for_each_thread(p, t) {
task_lock(t);
if (likely(t->mm))
- return t;
+ goto found;
task_unlock(t);
}
+ t = NULL;
+found:
+ rcu_read_unlock();
- return NULL;
+ return t;
}
/* return true if the task is not adequate as candidate victim task. */
@@ -461,10 +466,8 @@ void oom_kill_process(struct task_struct
}
read_unlock(&tasklist_lock);
- rcu_read_lock();
p = find_lock_task_mm(victim);
if (!p) {
- rcu_read_unlock();
put_task_struct(victim);
return;
} else if (victim != p) {
@@ -490,6 +493,7 @@ void oom_kill_process(struct task_struct
* That thread will now get access to memory reserves since it has a
* pending fatal signal.
*/
+ rcu_read_lock();
for_each_process(p)
if (p->mm == mm && !same_thread_group(p, victim) &&
!(p->flags & PF_KTHREAD)) {
^ permalink raw reply [flat|nested] 136+ messages in thread* [PATCH 3.10 143/143] vm_is_stack: use for_each_thread() rather then buggy while_each_thread()
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (131 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 142/143] oom_kill: add rcu_read_lock() into find_lock_task_mm() Greg Kroah-Hartman
@ 2014-10-03 21:35 ` Greg Kroah-Hartman
2014-10-04 0:25 ` [PATCH 3.10 000/143] 3.10.56-stable review Shuah Khan
2014-10-04 3:05 ` Guenter Roeck
134 siblings, 0 replies; 136+ messages in thread
From: Greg Kroah-Hartman @ 2014-10-03 21:35 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Oleg Nesterov, Aleksei Besogonov,
David Rientjes, Andrew Morton, Linus Torvalds, Li Zefan
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 4449a51a7c281602d3a385044ab928322a122a02 upstream.
Aleksei hit the soft lockup during reading /proc/PID/smaps. David
investigated the problem and suggested the right fix.
while_each_thread() is racy and should die, this patch updates
vm_is_stack().
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reported-by: Aleksei Besogonov <alex.besogonov@gmail.com>
Tested-by: Aleksei Besogonov <alex.besogonov@gmail.com>
Suggested-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/util.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
--- a/mm/util.c
+++ b/mm/util.c
@@ -272,17 +272,14 @@ pid_t vm_is_stack(struct task_struct *ta
if (in_group) {
struct task_struct *t;
- rcu_read_lock();
- if (!pid_alive(task))
- goto done;
- t = task;
- do {
+ rcu_read_lock();
+ for_each_thread(task, t) {
if (vm_is_stack_for_task(t, vma)) {
ret = t->pid;
goto done;
}
- } while_each_thread(task, t);
+ }
done:
rcu_read_unlock();
}
^ permalink raw reply [flat|nested] 136+ messages in thread* Re: [PATCH 3.10 000/143] 3.10.56-stable review
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (132 preceding siblings ...)
2014-10-03 21:35 ` [PATCH 3.10 143/143] vm_is_stack: use for_each_thread() rather then buggy while_each_thread() Greg Kroah-Hartman
@ 2014-10-04 0:25 ` Shuah Khan
2014-10-04 3:05 ` Guenter Roeck
134 siblings, 0 replies; 136+ messages in thread
From: Shuah Khan @ 2014-10-04 0:25 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, satoru.takeuchi, shuah.kh, stable
On 10/03/2014 03:33 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.10.56 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Oct 5 21:32:57 UTC 2014.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.0/stable-review/patch-3.10.56-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Compiled and booted on my test system. No dmesg regressions.
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 136+ messages in thread* Re: [PATCH 3.10 000/143] 3.10.56-stable review
2014-10-03 21:33 [PATCH 3.10 000/143] 3.10.56-stable review Greg Kroah-Hartman
` (133 preceding siblings ...)
2014-10-04 0:25 ` [PATCH 3.10 000/143] 3.10.56-stable review Shuah Khan
@ 2014-10-04 3:05 ` Guenter Roeck
134 siblings, 0 replies; 136+ messages in thread
From: Guenter Roeck @ 2014-10-04 3:05 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, satoru.takeuchi, shuah.kh, stable
On 10/03/2014 02:33 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.10.56 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Oct 5 21:32:57 UTC 2014.
> Anything received after that time might be too late.
>
Build results:
total: 137 pass: 137 fail: 0
Qemu test results:
total: 25 pass: 25 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 136+ messages in thread