* [PATCH 3.10 01/26] mm: avoid setting up anonymous pages into file mapping
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 02/26] freeing unlinked file indefinitely delayed Greg Kroah-Hartman
` (23 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov, Oleg Nesterov,
Andrew Morton, Willy Tarreau, Linus Torvalds
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d upstream.
Reading page fault handler code I've noticed that under right
circumstances kernel would map anonymous pages into file mappings: if
the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
on ->mmap(), kernel would handle page fault to not populated pte with
do_anonymous_page().
Let's change page fault handler to use do_anonymous_page() only on
anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
shared.
For file mappings without vm_ops->fault() or shred VMA without vm_ops,
page fault on pte_none() entry would lead to SIGBUS.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3230,6 +3230,10 @@ static int do_anonymous_page(struct mm_s
pte_unmap(page_table);
+ /* File mapping without ->vm_ops ? */
+ if (vma->vm_flags & VM_SHARED)
+ return VM_FAULT_SIGBUS;
+
/* Check if we need to add a guard page to the stack */
if (check_stack_guard_page(vma, address) < 0)
return VM_FAULT_SIGSEGV;
@@ -3495,6 +3499,9 @@ static int do_linear_fault(struct mm_str
- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
pte_unmap(page_table);
+ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
+ if (!vma->vm_ops->fault)
+ return VM_FAULT_SIGBUS;
return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
}
@@ -3706,11 +3713,9 @@ int handle_pte_fault(struct mm_struct *m
entry = *pte;
if (!pte_present(entry)) {
if (pte_none(entry)) {
- if (vma->vm_ops) {
- if (likely(vma->vm_ops->fault))
- return do_linear_fault(mm, vma, address,
+ if (vma->vm_ops)
+ return do_linear_fault(mm, vma, address,
pte, pmd, flags, entry);
- }
return do_anonymous_page(mm, vma, address,
pte, pmd, flags);
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 02/26] freeing unlinked file indefinitely delayed
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 01/26] mm: avoid setting up anonymous pages into file mapping Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 03/26] s390/sclp: clear upper register halves in _sclp_print_early Greg Kroah-Hartman
` (22 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, J. Bruce Fields, Al Viro
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@ZenIV.linux.org.uk>
commit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e upstream.
Normally opening a file, unlinking it and then closing will have
the inode freed upon close() (provided that it's not otherwise busy and
has no remaining links, of course). However, there's one case where that
does *not* happen. Namely, if you open it by fhandle with cold dcache,
then unlink() and close().
In normal case you get d_delete() in unlink(2) notice that dentry
is busy and unhash it; on the final dput() it will be forcibly evicted from
dcache, triggering iput() and inode removal. In this case, though, we end
up with *two* dentries - disconnected (created by open-by-fhandle) and
regular one (used by unlink()). The latter will have its reference to inode
dropped just fine, but the former will not - it's considered hashed (it
is on the ->s_anon list), so it will stay around until the memory pressure
will finally do it in. As the result, we have the final iput() delayed
indefinitely. It's trivial to reproduce -
void flush_dcache(void)
{
system("mount -o remount,rw /");
}
static char buf[20 * 1024 * 1024];
main()
{
int fd;
union {
struct file_handle f;
char buf[MAX_HANDLE_SZ];
} x;
int m;
x.f.handle_bytes = sizeof(x);
chdir("/root");
mkdir("foo", 0700);
fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
close(fd);
name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
flush_dcache();
fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
unlink("foo/bar");
write(fd, buf, sizeof(buf));
system("df ."); /* 20Mb eaten */
close(fd);
system("df ."); /* should've freed those 20Mb */
flush_dcache();
system("df ."); /* should be the same as #2 */
}
will spit out something like
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 303843 1131 100% /
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 303843 1131 100% /
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/root 322023 283282 21692 93% /
- inode gets freed only when dentry is finally evicted (here we trigger
than by remount; normally it would've happened in response to memory
pressure hell knows when).
Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -520,6 +520,9 @@ repeat:
return;
}
+ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+ goto kill_it;
+
if (dentry->d_flags & DCACHE_OP_DELETE) {
if (dentry->d_op->d_delete(dentry))
goto kill_it;
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 03/26] s390/sclp: clear upper register halves in _sclp_print_early
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 01/26] mm: avoid setting up anonymous pages into file mapping Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 02/26] freeing unlinked file indefinitely delayed Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 04/26] ARC: make sure instruction_pointer() returns unsigned value Greg Kroah-Hartman
` (21 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Schwidefsky
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit f9c87a6f46d508eae0d9ae640be98d50f237f827 upstream.
If the kernel is compiled with gcc 5.1 and the XZ compression option
the decompress_kernel function calls _sclp_print_early in 64-bit mode
while the content of the upper register half of %r6 is non-zero.
This causes a specification exception on the servc instruction in
_sclp_servc.
The _sclp_print_early function saves and restores the upper registers
halves but it fails to clear them for the 31-bit code of the mini sclp
driver.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/sclp.S | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/s390/kernel/sclp.S
+++ b/arch/s390/kernel/sclp.S
@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
jno .Lesa2
ahi %r15,-80
stmh %r6,%r15,96(%r15) # store upper register halves
+ basr %r13,0
+ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
.Lesa2:
#endif
lr %r10,%r2 # save string pointer
@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
#endif
lm %r6,%r15,120(%r15) # restore registers
br %r14
+.Lzeroes:
+ .fill 64,4,0
.LwritedataS4:
.long 0x00760005 # SCLP command for write data
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 04/26] ARC: make sure instruction_pointer() returns unsigned value
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 03/26] s390/sclp: clear upper register halves in _sclp_print_early Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 07/26] ALSA: usb-audio: add dB range mapping for some devices Greg Kroah-Hartman
` (20 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, arc-linux-dev,
Vineet Gupta
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <abrodkin@synopsys.com>
commit f51e2f1911122879eefefa4c592dea8bf794b39c upstream.
Currently instruction_pointer() returns pt_regs->ret and so return value
is of type "long", which implicitly stands for "signed long".
While that's perfectly fine when dealing with 32-bit values if return
value of instruction_pointer() gets assigned to 64-bit variable sign
extension may happen.
And at least in one real use-case it happens already.
In perf_prepare_sample() return value of perf_instruction_pointer()
(which is an alias to instruction_pointer() in case of ARC) is assigned
to (struct perf_sample_data)->ip (which type is "u64").
And what we see if instuction pointer points to user-space application
that in case of ARC lays below 0x8000_0000 "ip" gets set properly with
leading 32 zeros. But if instruction pointer points to kernel address
space that starts from 0x8000_0000 then "ip" is set with 32 leadig
"f"-s. I.e. id instruction_pointer() returns 0x8100_0000, "ip" will be
assigned with 0xffff_ffff__8100_0000. Which is obviously wrong.
In particular that issuse broke output of perf, because perf was unable
to associate addresses like 0xffff_ffff__8100_0000 with anything from
/proc/kallsyms.
That's what we used to see:
----------->8----------
6.27% ls [unknown] [k] 0xffffffff8046c5cc
2.96% ls libuClibc-0.9.34-git.so [.] memcpy
2.25% ls libuClibc-0.9.34-git.so [.] memset
1.66% ls [unknown] [k] 0xffffffff80666536
1.54% ls libuClibc-0.9.34-git.so [.] 0x000224d6
1.18% ls libuClibc-0.9.34-git.so [.] 0x00022472
----------->8----------
With that change perf output looks much better now:
----------->8----------
8.21% ls [kernel.kallsyms] [k] memset
3.52% ls libuClibc-0.9.34-git.so [.] memcpy
2.11% ls libuClibc-0.9.34-git.so [.] malloc
1.88% ls libuClibc-0.9.34-git.so [.] memset
1.64% ls [kernel.kallsyms] [k] _raw_spin_unlock_irqrestore
1.41% ls [kernel.kallsyms] [k] __d_lookup_rcu
----------->8----------
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: arc-linux-dev@synopsys.com
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/include/asm/ptrace.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arc/include/asm/ptrace.h
+++ b/arch/arc/include/asm/ptrace.h
@@ -83,7 +83,7 @@ struct callee_regs {
long r13;
};
-#define instruction_pointer(regs) ((regs)->ret)
+#define instruction_pointer(regs) (unsigned long)((regs)->ret)
#define profile_pc(regs) instruction_pointer(regs)
/* return 1 if user mode or 0 if kernel mode */
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 07/26] ALSA: usb-audio: add dB range mapping for some devices
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 04/26] ARC: make sure instruction_pointer() returns unsigned value Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 08/26] ALSA: hda - Fix MacBook Pro 5,2 quirk Greg Kroah-Hartman
` (19 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Yao-Wen Mao, Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yao-Wen Mao <yaowen@google.com>
commit 2d1cb7f658fb9c3ba8f9dab8aca297d4dfdec835 upstream.
Add the correct dB ranges of Bose Companion 5 and Drangonfly DAC 1.2.
Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer_maps.c | 24 ++++++++++++++++++++++++
1 file changed, 24 insertions(+)
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -330,6 +330,20 @@ static const struct usbmix_name_map scms
{ 0 }
};
+/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
+static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
+static struct usbmix_name_map bose_companion5_map[] = {
+ { 3, NULL, .dB = &bose_companion5_dB },
+ { 0 } /* terminator */
+};
+
+/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
+static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
+static struct usbmix_name_map dragonfly_1_2_map[] = {
+ { 7, NULL, .dB = &dragonfly_1_2_dB },
+ { 0 } /* terminator */
+};
+
/*
* Control map entries
*/
@@ -432,6 +446,16 @@ static struct usbmix_ctl_map usbmix_ctl_
.id = USB_ID(0x25c4, 0x0003),
.map = scms_usb3318_map,
},
+ {
+ /* Bose Companion 5 */
+ .id = USB_ID(0x05a7, 0x1020),
+ .map = bose_companion5_map,
+ },
+ {
+ /* Dragonfly DAC 1.2 */
+ .id = USB_ID(0x21b4, 0x0081),
+ .map = dragonfly_1_2_map,
+ },
{ 0 } /* terminator */
};
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 08/26] ALSA: hda - Fix MacBook Pro 5,2 quirk
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 07/26] ALSA: usb-audio: add dB range mapping for some devices Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 10/26] mac80211: clear subdir_stations when removing debugfs Greg Kroah-Hartman
` (18 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 649ccd08534ee26deb2e5b08509800d0e95167f5 upstream.
MacBook Pro 5,2 with ALC889 codec had already a fixup entry, but this
seems not working correctly, a fix for pin NID 0x15 is needed in
addition. It's equivalent with the fixup for MacBook Air 1,1, so use
this instead.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=102131
Reported-and-tested-by: Jeffery Miller <jefferym@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2204,7 +2204,7 @@ static const struct snd_pci_quirk alc882
SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 10/26] mac80211: clear subdir_stations when removing debugfs
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 08/26] ALSA: hda - Fix MacBook Pro 5,2 quirk Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 11/26] mmc: sdhci-esdhc: Make 8BIT bus work Greg Kroah-Hartman
` (17 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tom Hughes, Johannes Berg
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Hughes <tom@compton.nu>
commit 4479004e6409087d1b4986881dc98c6c15dffb28 upstream.
If we don't do this, and we then fail to recreate the debugfs
directory during a mode change, then we will fail later trying
to add stations to this now bogus directory:
BUG: unable to handle kernel NULL pointer dereference at 0000006c
IP: [<c0a92202>] mutex_lock+0x12/0x30
Call Trace:
[<c0678ab4>] start_creating+0x44/0xc0
[<c0679203>] debugfs_create_dir+0x13/0xf0
[<f8a938ae>] ieee80211_sta_debugfs_add+0x6e/0x490 [mac80211]
Signed-off-by: Tom Hughes <tom@compton.nu>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/debugfs_netdev.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -697,6 +697,7 @@ void ieee80211_debugfs_remove_netdev(str
debugfs_remove_recursive(sdata->vif.debugfs_dir);
sdata->vif.debugfs_dir = NULL;
+ sdata->debugfs.subdir_stations = NULL;
}
void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 11/26] mmc: sdhci-esdhc: Make 8BIT bus work
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 10/26] mac80211: clear subdir_stations when removing debugfs Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 12/26] mmc: sdhci-pxav3: fix platform_data is not initialized Greg Kroah-Hartman
` (16 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joakim Tjernlund, Ulf Hansson
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
commit 8e91125ff3f57f15c6568e2a6d32743b3f7815e4 upstream.
Support for 8BIT bus with was added some time ago to sdhci-esdhc but
then missed to remove the 8BIT from the reserved bit mask which made
8BIT non functional.
Fixes: 66b50a00992d ("mmc: esdhc: Add support for 8-bit bus width and..")
Signed-off-by: Joakim Tjernlund <joakim.tjernlund@transmode.se>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-esdhc.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mmc/host/sdhci-esdhc.h
+++ b/drivers/mmc/host/sdhci-esdhc.h
@@ -40,7 +40,7 @@
#define ESDHC_DMA_SYSCTL 0x40c
#define ESDHC_DMA_SNOOP 0x00000040
-#define ESDHC_HOST_CONTROL_RES 0x05
+#define ESDHC_HOST_CONTROL_RES 0x01
static inline void esdhc_set_clock(struct sdhci_host *host, unsigned int clock)
{
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 12/26] mmc: sdhci-pxav3: fix platform_data is not initialized
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 11/26] mmc: sdhci-esdhc: Make 8BIT bus work Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 13/26] md/raid1: fix test for was read error from last working device Greg Kroah-Hartman
` (15 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jingju Hou, Ulf Hansson
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jingju Hou <houjingj@marvell.com>
commit 9cd76049f0d90ae241f5ad80e311489824527000 upstream.
pdev->dev.platform_data is not initialized if match is true in function
sdhci_pxav3_probe. Just local variable pdata is assigned the return value
from function pxav3_get_mmc_pdata().
static int sdhci_pxav3_probe(struct platform_device *pdev) {
struct sdhci_pxa_platdata *pdata = pdev->dev.platform_data;
...
if (match) {
ret = mmc_of_parse(host->mmc);
if (ret)
goto err_of_parse;
sdhci_get_of_property(pdev);
pdata = pxav3_get_mmc_pdata(dev);
}
...
}
Signed-off-by: Jingju Hou <houjingj@marvell.com>
Fixes: b650352dd3df("mmc: sdhci-pxa: Add device tree support")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/sdhci-pxav3.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/mmc/host/sdhci-pxav3.c
+++ b/drivers/mmc/host/sdhci-pxav3.c
@@ -255,6 +255,7 @@ static int sdhci_pxav3_probe(struct plat
mmc_of_parse(host->mmc);
sdhci_get_of_property(pdev);
pdata = pxav3_get_mmc_pdata(dev);
+ pdev->dev.platform_data = pdata;
} else if (pdata) {
/* on-chip device */
if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 13/26] md/raid1: fix test for was read error from last working device.
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 12/26] mmc: sdhci-pxav3: fix platform_data is not initialized Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 14/26] tile: use free_bootmem_late() for initrd Greg Kroah-Hartman
` (14 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit 34cab6f42003cb06f48f86a86652984dec338ae9 upstream.
When we get a read error from the last working device, we don't
try to repair it, and don't fail the device. We simple report a
read error to the caller.
However the current test for 'is this the last working device' is
wrong.
When there is only one fully working device, it assumes that a
non-faulty device is that device. However a spare which is rebuilding
would be non-faulty but so not the only working device.
So change the test from "!Faulty" to "In_sync". If ->degraded says
there is only one fully working device and this device is in_sync,
this must be the one.
This bug has existed since we allowed read_balance to read from
a recovering spare in v3.0
Reported-and-tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
Fixes: 76073054c95b ("md/raid1: clean up read_balance.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -327,7 +327,7 @@ static void raid1_end_read_request(struc
spin_lock_irqsave(&conf->device_lock, flags);
if (r1_bio->mddev->degraded == conf->raid_disks ||
(r1_bio->mddev->degraded == conf->raid_disks-1 &&
- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
+ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
uptodate = 1;
spin_unlock_irqrestore(&conf->device_lock, flags);
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 14/26] tile: use free_bootmem_late() for initrd
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 13/26] md/raid1: fix test for was read error from last working device Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 15/26] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Greg Kroah-Hartman
` (13 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Chris Metcalf
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <cmetcalf@ezchip.com>
commit 3f81d2447b37ac697b3c600039f2c6b628c06e21 upstream.
We were previously using free_bootmem() and just getting lucky
that nothing too bad happened.
Signed-off-by: Chris Metcalf <cmetcalf@ezchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/tile/kernel/setup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/tile/kernel/setup.c
+++ b/arch/tile/kernel/setup.c
@@ -1064,7 +1064,7 @@ static void __init load_hv_initrd(void)
void __init free_initrd_mem(unsigned long begin, unsigned long end)
{
- free_bootmem(__pa(begin), end - begin);
+ free_bootmem_late(__pa(begin), end - begin);
}
#else
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 15/26] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 14/26] tile: use free_bootmem_late() for initrd Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 16/26] blkcg: fix gendisk reference leak in blkg_conf_prep() Greg Kroah-Hartman
` (12 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jakob Mustafa, Bernhard Bender,
Dmitry Torokhov
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bernhard Bender <bernhard.bender@bytecmed.com>
commit 968491709e5b1aaf429428814fff3d932fa90b60 upstream.
This patch fixes a problem in the usbtouchscreen driver for DMC TSC-30
touch screen. Due to a missing delay between the RESET and SET_RATE
commands, the touch screen may become unresponsive during system startup or
driver loading.
According to the DMC documentation, a delay is needed after the RESET
command to allow the chip to complete its internal initialization. As this
delay is not guaranteed, we had a system where the touch screen
occasionally did not send any touch data. There was no other indication of
the problem.
The patch fixes the problem by adding a 150ms delay between the RESET and
SET_RATE commands.
Suggested-by: Jakob Mustafa <jakob.mustafa@bytecmed.com>
Signed-off-by: Bernhard Bender <bernhard.bender@bytecmed.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/usbtouchscreen.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -626,6 +626,9 @@ static int dmc_tsc10_init(struct usbtouc
goto err_out;
}
+ /* TSC-25 data sheet specifies a delay after the RESET command */
+ msleep(150);
+
/* set coordinate output rate */
buf[0] = buf[1] = 0xFF;
ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 16/26] blkcg: fix gendisk reference leak in blkg_conf_prep()
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 15/26] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 17/26] ata: pmp: add quirk for Marvell 4140 SATA PMP Greg Kroah-Hartman
` (11 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejun Heo, Jens Axboe
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 5f6c2d2b7dbb541c1e922538c49fa04c494ae3d7 upstream.
When a blkcg configuration is targeted to a partition rather than a
whole device, blkg_conf_prep fails with -EINVAL; unfortunately, it
forgets to put the gendisk ref in that case. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-cgroup.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
@@ -720,8 +720,12 @@ int blkg_conf_prep(struct blkcg *blkcg,
return -EINVAL;
disk = get_gendisk(MKDEV(major, minor), &part);
- if (!disk || part)
+ if (!disk)
return -EINVAL;
+ if (part) {
+ put_disk(disk);
+ return -EINVAL;
+ }
rcu_read_lock();
spin_lock_irq(disk->queue->queue_lock);
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 17/26] ata: pmp: add quirk for Marvell 4140 SATA PMP
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 16/26] blkcg: fix gendisk reference leak in blkg_conf_prep() Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 18/26] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Greg Kroah-Hartman
` (10 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lior Amsalem, Nadav Haklai,
Thomas Petazzoni, Tejun Heo
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lior Amsalem <alior@marvell.com>
commit 945b47441d83d2392ac9f984e0267ad521f24268 upstream.
This commit adds the necessary quirk to make the Marvell 4140 SATA PMP
work properly. This PMP doesn't like SRST on port number 4 (the host
port) so this commit marks this port as not supporting SRST.
Signed-off-by: Lior Amsalem <alior@marvell.com>
Reviewed-by: Nadav Haklai <nadavh@marvell.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-pmp.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_p
ATA_LFLAG_NO_SRST |
ATA_LFLAG_ASSUME_ATA;
}
+ } else if (vendor == 0x11ab && devid == 0x4140) {
+ /* Marvell 4140 quirks */
+ ata_for_each_link(link, ap, EDGE) {
+ /* port 4 is for SEMB device and it doesn't like SRST */
+ if (link->pmp == 4)
+ link->flags |= ATA_LFLAG_DISABLED;
+ }
}
}
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 18/26] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 17/26] ata: pmp: add quirk for Marvell 4140 SATA PMP Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 19/26] xhci: Calculate old endpoints correctly on device reset Greg Kroah-Hartman
` (9 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Oliver Neukum, Lars Melin
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 5fb2c782f451a4fb9c19c076e2c442839faf0f76 upstream.
This device automatically switches itself to another mode (0x1405)
unless the specific access pattern of Windows is followed in its
initial mode. That makes a dirty unmount of the internal storage
devices inevitable if they are mounted. So the card reader of
such a device should be ignored, lest an unclean removal become
inevitable.
This replaces an earlier patch that ignored all LUNs of this device.
That patch was overly broad.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reviewed-by: Lars Melin <larsm17@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_NO_READ_DISC_INFO ),
+/* Reported by Oliver Neukum <oneukum@suse.com>
+ * This device morphes spontaneously into another device if the access
+ * pattern of Windows isn't followed. Thus writable media would be dirty
+ * if the initial instance is used. So the device is limited to its
+ * virtual CD.
+ * And yes, the concept that BCD goes up to 9 is not heeded */
+UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
+ "ZTE,Incorporated",
+ "ZTE WCDMA Technologies MSM",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_SINGLE_LUN ),
+
/* Reported by Sven Geggus <sven-usbst@geggus.net>
* This encrypted pen drive returns bogus data for the initial READ(10).
*/
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 19/26] xhci: Calculate old endpoints correctly on device reset
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 18/26] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 20/26] xhci: report U3 when link is in resume state Greg Kroah-Hartman
` (8 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Brian Campbell, Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Campbell <bacam@z273.org.uk>
commit 326124a027abc9a7f43f72dc94f6f0f7a55b02b3 upstream.
When resetting a device the number of active TTs may need to be
corrected by xhci_update_tt_active_eps, but the number of old active
endpoints supplied to it was always zero, so the number of TTs and the
bandwidth reserved for them was not updated, and could rise
unnecessarily.
This affected systems using Intel's Patherpoint chipset, which rely on
software bandwidth checking. For example, a Lenovo X230 would lose the
ability to use ports on the docking station after enough suspend/resume
cycles because the bandwidth calculated would rise with every cycle when
a suitable device is attached.
The correct number of active endpoints is calculated in the same way as
in xhci_reserve_bandwidth.
Signed-off-by: Brian Campbell <bacam@z273.org.uk>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -3356,6 +3356,9 @@ int xhci_discover_or_reset_device(struct
return -EINVAL;
}
+ if (virt_dev->tt_info)
+ old_active_eps = virt_dev->tt_info->active_eps;
+
if (virt_dev->udev != udev) {
/* If the virt_dev and the udev does not match, this virt_dev
* may belong to another udev.
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 20/26] xhci: report U3 when link is in resume state
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 19/26] xhci: Calculate old endpoints correctly on device reset Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 21/26] xhci: prevent bus_suspend if SS port resuming in phase 1 Greg Kroah-Hartman
` (7 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhuang Jin Can, Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhuang Jin Can <jin.can.zhuang@intel.com>
commit 243292a2ad3dc365849b820a64868927168894ac upstream.
xhci_hub_report_usb3_link_state() returns pls as U0 when the link
is in resume state, and this causes usb core to think the link is in
U0 while actually it's in resume state. When usb core transfers
control request on the link, it fails with TRB error as the link
is not ready for transfer.
To fix the issue, report U3 when the link is in resume state, thus
usb core knows the link it's not ready for transfer.
Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -468,10 +468,13 @@ static void xhci_hub_report_link_state(s
u32 pls = status_reg & PORT_PLS_MASK;
/* resume state is a xHCI internal state.
- * Do not report it to usb core.
+ * Do not report it to usb core, instead, pretend to be U3,
+ * thus usb core knows it's not ready for transfer
*/
- if (pls == XDEV_RESUME)
+ if (pls == XDEV_RESUME) {
+ *status |= USB_SS_PORT_LS_U3;
return;
+ }
/* When the CAS bit is set then warm reset
* should be performed on port
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 21/26] xhci: prevent bus_suspend if SS port resuming in phase 1
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 20/26] xhci: report U3 when link is in resume state Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 22/26] rds: rds_ib_device.refcount overflow Greg Kroah-Hartman
` (6 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Zhuang Jin Can, Mathias Nyman
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhuang Jin Can <jin.can.zhuang@intel.com>
commit fac4271d1126c45ceaceb7f4a336317b771eb121 upstream.
When the link is just waken, it's in Resume state, and driver sets PLS to
U0. This refers to Phase 1. Phase 2 refers to when the link has completed
the transition from Resume state to U0.
With the fix of xhci: report U3 when link is in resume state, it also
exposes an issue that usb3 roothub and controller can suspend right
after phase 1, and this causes a hard hang in controller.
To fix the issue, we need to prevent usb3 bus suspend if any port is
resuming in phase 1.
[merge separate USB2 and USB3 port resume checking to one -Mathias]
Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 6 +++---
drivers/usb/host/xhci-ring.c | 3 +++
drivers/usb/host/xhci.h | 1 +
3 files changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1048,10 +1048,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd
spin_lock_irqsave(&xhci->lock, flags);
if (hcd->self.root_hub->do_remote_wakeup) {
- if (bus_state->resuming_ports) {
+ if (bus_state->resuming_ports || /* USB2 */
+ bus_state->port_remote_wakeup) { /* USB3 */
spin_unlock_irqrestore(&xhci->lock, flags);
- xhci_dbg(xhci, "suspend failed because "
- "a port is resuming\n");
+ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
return -EBUSY;
}
}
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1669,6 +1669,9 @@ static void handle_port_status(struct xh
usb_hcd_resume_root_hub(hcd);
}
+ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
+ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
+
if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
xhci_dbg(xhci, "port resume event for port %d\n", port_id);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -280,6 +280,7 @@ struct xhci_op_regs {
#define XDEV_U0 (0x0 << 5)
#define XDEV_U2 (0x2 << 5)
#define XDEV_U3 (0x3 << 5)
+#define XDEV_INACTIVE (0x6 << 5)
#define XDEV_RESUME (0xf << 5)
/* true: port has power (see HCC_PPC) */
#define PORT_POWER (1 << 9)
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 22/26] rds: rds_ib_device.refcount overflow
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 21/26] xhci: prevent bus_suspend if SS port resuming in phase 1 Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 24/26] iscsi-target: Fix use-after-free during TPG session shutdown Greg Kroah-Hartman
` (5 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wengang Wang, Haggai Eran,
Doug Ledford
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wengang Wang <wen.gang.wang@oracle.com>
commit 4fabb59449aa44a585b3603ffdadd4c5f4d0c033 upstream.
Fixes: 3e0249f9c05c ("RDS/IB: add refcount tracking to struct rds_ib_device")
There lacks a dropping on rds_ib_device.refcount in case rds_ib_alloc_fmr
failed(mr pool running out). this lead to the refcount overflow.
A complain in line 117(see following) is seen. From vmcore:
s_ib_rdma_mr_pool_depleted is 2147485544 and rds_ibdev->refcount is -2147475448.
That is the evidence the mr pool is used up. so rds_ib_alloc_fmr is very likely
to return ERR_PTR(-EAGAIN).
115 void rds_ib_dev_put(struct rds_ib_device *rds_ibdev)
116 {
117 BUG_ON(atomic_read(&rds_ibdev->refcount) <= 0);
118 if (atomic_dec_and_test(&rds_ibdev->refcount))
119 queue_work(rds_wq, &rds_ibdev->free_work);
120 }
fix is to drop refcount when rds_ib_alloc_fmr failed.
Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Reviewed-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/ib_rdma.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *
}
ibmr = rds_ib_alloc_fmr(rds_ibdev);
- if (IS_ERR(ibmr))
+ if (IS_ERR(ibmr)) {
+ rds_ib_dev_put(rds_ibdev);
return ibmr;
+ }
ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
if (ret == 0)
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 24/26] iscsi-target: Fix use-after-free during TPG session shutdown
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 22/26] rds: rds_ib_device.refcount overflow Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 25/26] iscsi-target: Fix iser explicit logout TX kthread leak Greg Kroah-Hartman
` (4 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sunilkumar Nadumuttlu,
Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 417c20a9bdd1e876384127cf096d8ae8b559066c upstream.
This patch fixes a use-after-free bug in iscsit_release_sessions_for_tpg()
where se_portal_group->session_lock was incorrectly released/re-acquired
while walking the active se_portal_group->tpg_sess_list.
The can result in a NULL pointer dereference when iscsit_close_session()
shutdown happens in the normal path asynchronously to this code, causing
a bogus dereference of an already freed list entry to occur.
To address this bug, walk the session list checking for the same state
as before, but move entries to a local list to avoid dropping the lock
while walking the active list.
As before, signal using iscsi_session->session_restatement=1 for those
list entries to be released locally by iscsit_free_session() code.
Reported-by: Sunilkumar Nadumuttlu <sjn@datera.io>
Cc: Sunilkumar Nadumuttlu <sjn@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4649,6 +4649,7 @@ int iscsit_release_sessions_for_tpg(stru
struct iscsi_session *sess;
struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
struct se_session *se_sess, *se_sess_tmp;
+ LIST_HEAD(free_list);
int session_count = 0;
spin_lock_bh(&se_tpg->session_lock);
@@ -4670,14 +4671,17 @@ int iscsit_release_sessions_for_tpg(stru
}
atomic_set(&sess->session_reinstatement, 1);
spin_unlock(&sess->conn_lock);
- spin_unlock_bh(&se_tpg->session_lock);
- iscsit_free_session(sess);
- spin_lock_bh(&se_tpg->session_lock);
+ list_move_tail(&se_sess->sess_list, &free_list);
+ }
+ spin_unlock_bh(&se_tpg->session_lock);
+ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
+ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
+ iscsit_free_session(sess);
session_count++;
}
- spin_unlock_bh(&se_tpg->session_lock);
pr_debug("Released %d iSCSI Session(s) from Target Portal"
" Group: %hu\n", session_count, tpg->tpgt);
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 25/26] iscsi-target: Fix iser explicit logout TX kthread leak
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 24/26] iscsi-target: Fix use-after-free during TPG session shutdown Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-08 22:07 ` [PATCH 3.10 26/26] efi: fix 32bit kernel boot failed problem using efi Greg Kroah-Hartman
` (3 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Nicholas Bellinger
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <nab@linux-iscsi.org>
commit 007d038bdf95ccfe2491d0078be54040d110fd06 upstream.
This patch fixes a regression introduced with the following commit
in v4.0-rc1 code, where an explicit iser-target logout would result
in ->tx_thread_active being incorrectly cleared by the logout post
handler, and subsequent TX kthread leak:
commit 88dcd2dab5c23b1c9cfc396246d8f476c872f0ca
Author: Nicholas Bellinger <nab@linux-iscsi.org>
Date: Thu Feb 26 22:19:15 2015 -0800
iscsi-target: Convert iscsi_thread_set usage to kthread.h
To address this bug, change iscsit_logout_post_handler_closesession()
and iscsit_logout_post_handler_samecid() to only cmpxchg() on
->tx_thread_active for traditional iscsi/tcp connections.
This is required because iscsi/tcp connections are invoking logout
post handler logic directly from TX kthread context, while iser
connections are invoking logout post handler logic from a seperate
workqueue context.
Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/iscsi/iscsi_target.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4416,7 +4416,18 @@ static void iscsit_logout_post_handler_c
struct iscsi_conn *conn)
{
struct iscsi_session *sess = conn->sess;
- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ int sleep = 1;
+ /*
+ * Traditional iscsi/tcp will invoke this logic from TX thread
+ * context during session logout, so clear tx_thread_active and
+ * sleep if iscsit_close_connection() has not already occured.
+ *
+ * Since iser-target invokes this logic from it's own workqueue,
+ * always sleep waiting for RX/TX thread shutdown to complete
+ * within iscsit_close_connection().
+ */
+ if (conn->conn_transport->transport_type == ISCSI_TCP)
+ sleep = cmpxchg(&conn->tx_thread_active, true, false);
atomic_set(&conn->conn_logout_remove, 0);
complete(&conn->conn_logout_comp);
@@ -4430,7 +4441,10 @@ static void iscsit_logout_post_handler_c
static void iscsit_logout_post_handler_samecid(
struct iscsi_conn *conn)
{
- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ int sleep = 1;
+
+ if (conn->conn_transport->transport_type == ISCSI_TCP)
+ sleep = cmpxchg(&conn->tx_thread_active, true, false);
atomic_set(&conn->conn_logout_remove, 0);
complete(&conn->conn_logout_comp);
^ permalink raw reply [flat|nested] 27+ messages in thread* [PATCH 3.10 26/26] efi: fix 32bit kernel boot failed problem using efi
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 25/26] iscsi-target: Fix iser explicit logout TX kthread leak Greg Kroah-Hartman
@ 2015-08-08 22:07 ` Greg Kroah-Hartman
2015-08-09 3:14 ` [PATCH 3.10 00/26] 3.10.86-stable review Guenter Roeck
` (2 subsequent siblings)
24 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-08 22:07 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fupan Li, Matt Fleming
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fupan Li <fupan.li@windriver.com>
Commit 35d5134b7d5a
("x86/efi: Correct EFI boot stub use of code32_start")
imported a bug, which will cause 32bit kernel boot failed
using efi method. It should use the label's address instead
of the value stored in the label to caculate the address of
code32_start.
Signed-off-by: Fupan Li <fupan.li@windriver.com>
Reviewed-by: Matt Fleming <matt.fleming@intel.com>
---
arch/x86/boot/compressed/head_32.S | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry)
call reloc
reloc:
popl %ecx
- subl reloc, %ecx
+ subl $reloc, %ecx
movl %ecx, BP_code32_start(%eax)
sub $0x4, %esp
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [PATCH 3.10 00/26] 3.10.86-stable review
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2015-08-08 22:07 ` [PATCH 3.10 26/26] efi: fix 32bit kernel boot failed problem using efi Greg Kroah-Hartman
@ 2015-08-09 3:14 ` Guenter Roeck
2015-08-10 19:10 ` Greg Kroah-Hartman
2015-08-10 4:38 ` Sudip Mukherjee
2015-08-10 18:12 ` Shuah Khan
24 siblings, 1 reply; 27+ messages in thread
From: Guenter Roeck @ 2015-08-09 3:14 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, shuah.kh, stable
On 08/08/2015 03:07 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.10.86 release.
> There are 26 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Aug 10 22:07:03 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
total: 129 pass: 129 fail: 0
Qemu test results:
total: 53 pass: 51 fail: 2
Failed tests:
arm:realview-eb-mpcore:arm_realview_eb_defconfig
arm:realview-eb:arm_realview_eb_defconfig
The failed qemu tests are not new problems, but found due to newly
introduced tests. Request to include the fix in -stable is here [1].
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
---
[1] http://permalink.gmane.org/gmane.linux.kernel.stable/145285
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [PATCH 3.10 00/26] 3.10.86-stable review
2015-08-09 3:14 ` [PATCH 3.10 00/26] 3.10.86-stable review Guenter Roeck
@ 2015-08-10 19:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 27+ messages in thread
From: Greg Kroah-Hartman @ 2015-08-10 19:10 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable
On Sat, Aug 08, 2015 at 08:14:56PM -0700, Guenter Roeck wrote:
> On 08/08/2015 03:07 PM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 3.10.86 release.
> >There are 26 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Mon Aug 10 22:07:03 UTC 2015.
> >Anything received after that time might be too late.
> >
>
> Build results:
> total: 129 pass: 129 fail: 0
> Qemu test results:
> total: 53 pass: 51 fail: 2
> Failed tests:
> arm:realview-eb-mpcore:arm_realview_eb_defconfig
> arm:realview-eb:arm_realview_eb_defconfig
>
> The failed qemu tests are not new problems, but found due to newly
> introduced tests. Request to include the fix in -stable is here [1].
>
> Details are available at http://server.roeck-us.net:8010/builders.
>
> Guenter
>
> ---
> [1] http://permalink.gmane.org/gmane.linux.kernel.stable/145285
Yes, I missed those for this round, sorry, will pick them up for the
next round.
greg k-h
^ permalink raw reply [flat|nested] 27+ messages in thread
* Re: [PATCH 3.10 00/26] 3.10.86-stable review
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2015-08-09 3:14 ` [PATCH 3.10 00/26] 3.10.86-stable review Guenter Roeck
@ 2015-08-10 4:38 ` Sudip Mukherjee
2015-08-10 18:12 ` Shuah Khan
24 siblings, 0 replies; 27+ messages in thread
From: Sudip Mukherjee @ 2015-08-10 4:38 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable
On Sat, Aug 08, 2015 at 03:07:16PM -0700, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.10.86 release.
> There are 26 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Aug 10 22:07:03 UTC 2015.
> Anything received after that time might be too late.
Compiled and booted on x86_32. No errors in dmesg.
regards
sudip
^ permalink raw reply [flat|nested] 27+ messages in thread* Re: [PATCH 3.10 00/26] 3.10.86-stable review
2015-08-08 22:07 [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2015-08-10 4:38 ` Sudip Mukherjee
@ 2015-08-10 18:12 ` Shuah Khan
24 siblings, 0 replies; 27+ messages in thread
From: Shuah Khan @ 2015-08-10 18:12 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, linux, shuah.kh, stable
On 08/08/2015 04:07 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.10.86 release.
> There are 26 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon Aug 10 22:07:03 UTC 2015.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.10.86-rc1.gz
> and the diffstat can be found below.
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 27+ messages in thread