* [PATCH 4.2 001/110] mac80211: Fix hwflags debugfs file format
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 002/110] ath9k: declare required extra tx headroom Greg Kroah-Hartman
` (101 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mohammed Shafi Shajakhan,
Jouni Malinen, Johannes Berg
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
commit 4633dfc32c0019bed2996de9bbdbe7f3b518a44e upstream.
Commit 30686bf7f5b3 ("mac80211: convert HW flags to unsigned long
bitmap") accidentally removed the newline delimiter from the hwflags
debugfs file. Fix this by adding back the newline between the HW flags.
Signed-off-by: Mohammed Shafi Shajakhan <mohammed@qti.qualcomm.com>
[fix commit log]
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mac80211/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -148,7 +148,7 @@ static ssize_t hwflags_read(struct file
for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) {
if (test_bit(i, local->hw.flags))
- pos += scnprintf(pos, end - pos, "%s",
+ pos += scnprintf(pos, end - pos, "%s\n",
hw_flag_names[i]);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 002/110] ath9k: declare required extra tx headroom
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 001/110] mac80211: Fix hwflags debugfs file format Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 003/110] mmc: core: Fix init_card in 52Mhz Greg Kroah-Hartman
` (100 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Felix Fietkau, Kalle Valo
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 029cd0370241641eb70235d205aa0b90c84dce44 upstream.
ath9k inserts padding between the 802.11 header and the data area (to
align it). Since it didn't declare this extra required headroom, this
led to some nasty issues like randomly dropped packets in some setups.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/init.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -874,6 +874,7 @@ static void ath9k_set_hw_capab(struct at
hw->max_rate_tries = 10;
hw->sta_data_size = sizeof(struct ath_node);
hw->vif_data_size = sizeof(struct ath_vif);
+ hw->extra_tx_headroom = 4;
hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 003/110] mmc: core: Fix init_card in 52Mhz
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 001/110] mac80211: Fix hwflags debugfs file format Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 002/110] ath9k: declare required extra tx headroom Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 004/110] iwlwifi: dvm: fix D3 firmware PN programming Greg Kroah-Hartman
` (99 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chaotian Jing, Adrian Hunter,
Ulf Hansson
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chaotian Jing <chaotian.jing@mediatek.com>
commit 08b137d90eec51b0e90c42e123ca8ceb118d233f upstream.
Suppose that we got a data crc error, and it triggers the mmc_reset.
mmc_reset will call mmc_send_status to see if HW reset was supported.
before issue CMD13, it will do retune, and if EMMC was in HS400 mode,
it will reduce frequency to 52Mhz firstly, then results in card init
was doing at 52Mhz.
The mmc_send_status was originally only done for mmc_test, should drop
it. And, rename the "eMMC hardware reset" to "Reset test", as we would
also be able to use the test for SD-cards.
Signed-off-by: Chaotian Jing <chaotian.jing@mediatek.com>
Suggested-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/card/mmc_test.c | 9 +++------
drivers/mmc/core/mmc.c | 7 -------
2 files changed, 3 insertions(+), 13 deletions(-)
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -2263,15 +2263,12 @@ static int mmc_test_profile_sglen_r_nonb
/*
* eMMC hardware reset.
*/
-static int mmc_test_hw_reset(struct mmc_test_card *test)
+static int mmc_test_reset(struct mmc_test_card *test)
{
struct mmc_card *card = test->card;
struct mmc_host *host = card->host;
int err;
- if (!mmc_card_mmc(card) || !mmc_can_reset(card))
- return RESULT_UNSUP_CARD;
-
err = mmc_hw_reset(host);
if (!err)
return RESULT_OK;
@@ -2605,8 +2602,8 @@ static const struct mmc_test_case mmc_te
},
{
- .name = "eMMC hardware reset",
- .run = mmc_test_hw_reset,
+ .name = "Reset test",
+ .run = mmc_test_reset,
},
};
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -1924,7 +1924,6 @@ EXPORT_SYMBOL(mmc_can_reset);
static int mmc_reset(struct mmc_host *host)
{
struct mmc_card *card = host->card;
- u32 status;
if (!(host->caps & MMC_CAP_HW_RESET) || !host->ops->hw_reset)
return -EOPNOTSUPP;
@@ -1937,12 +1936,6 @@ static int mmc_reset(struct mmc_host *ho
host->ops->hw_reset(host);
- /* If the reset has happened, then a status command will fail */
- if (!mmc_send_status(card, &status)) {
- mmc_host_clk_release(host);
- return -ENOSYS;
- }
-
/* Set initial state and call mmc_set_ios */
mmc_set_initial_state(host);
mmc_host_clk_release(host);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 004/110] iwlwifi: dvm: fix D3 firmware PN programming
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 003/110] mmc: core: Fix init_card in 52Mhz Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 005/110] iwlwifi: fix firmware filename for 3160 Greg Kroah-Hartman
` (98 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream.
The code to send the RX PN data (for each TID) to the firmware
has a devastating bug: it overwrites the data for TID 0 with
all the TID data, leaving the remaining TIDs zeroed. This will
allow replays to actually be accepted by the firmware, which
could allow waking up the system.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/dvm/lib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -1022,7 +1022,7 @@ static void iwlagn_wowlan_program_keys(s
u8 *pn = seq.ccmp.pn;
ieee80211_get_key_rx_seq(key, i, &seq);
- aes_sc->pn = cpu_to_le64(
+ aes_sc[i].pn = cpu_to_le64(
(u64)pn[5] |
((u64)pn[4] << 8) |
((u64)pn[3] << 16) |
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 005/110] iwlwifi: fix firmware filename for 3160
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 004/110] iwlwifi: dvm: fix D3 firmware PN programming Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 006/110] rtlwifi: rtl8821ae: Fix system lockups on boot Greg Kroah-Hartman
` (97 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hauke Mehrtens, Johannes Berg,
Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit b5a48134f8af08f5243328f8a0b05fc5ae7cf343 upstream.
The MODULE_FIRMWARE() for 3160 should be using the 7260 version as
it's done in the device configuration struct instead of referencing
IWL3160_UCODE_API_OK which doesn't even exist.
Reported-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = {
};
MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 006/110] rtlwifi: rtl8821ae: Fix system lockups on boot
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 005/110] iwlwifi: fix firmware filename for 3160 Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 007/110] iwlwifi: mvm: clear csa countdown when AP is stopped Greg Kroah-Hartman
` (96 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Larry Finger, Kalle Valo
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <Larry.Finger@lwfinger.net>
commit 54328e64047a54b8fc2362c2e1f0fa16c90f739f upstream.
In commit 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all
drivers"), the code that cleared all interrupt enable bits before setting them
was removed for all PCI drivers. This fixed an issue that caused TX to be
blocked for 3-5 seconds. On some RTL8821AE units, this change causes soft
lockups to occur on boot. For that reason, the portion of the earlier commit
that applied to rtl8821ae is reverted. Kernels 4.1 and newer are affected.
See http://marc.info/?l=linux-wireless&m=144373370103285&w=2 and
https://bugzilla.opensuse.org/show_bug.cgi?id=944978 for two cases where
this regression affected user systems. Note that this bug does not appear on
any of the developer's setups. For those users whose systems are affected
by the TX blockage, but do not lock up on boot, a module parameter is added
to disable the interrupt clear
Fixes: 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all drivers")
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/rtlwifi/pci.h | 2 ++
drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 +++++++++++++++++
drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 +++++
drivers/net/wireless/rtlwifi/wifi.h | 3 +++
4 files changed, 27 insertions(+)
--- a/drivers/net/wireless/rtlwifi/pci.h
+++ b/drivers/net/wireless/rtlwifi/pci.h
@@ -247,6 +247,8 @@ struct rtl_pci {
/* MSI support */
bool msi_support;
bool using_msi;
+ /* interrupt clear before set */
+ bool int_clear;
};
struct mp_adapter {
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
@@ -2253,11 +2253,28 @@ void rtl8821ae_set_qos(struct ieee80211_
}
}
+static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
+{
+ struct rtl_priv *rtlpriv = rtl_priv(hw);
+ u32 tmp = rtl_read_dword(rtlpriv, REG_HISR);
+
+ rtl_write_dword(rtlpriv, REG_HISR, tmp);
+
+ tmp = rtl_read_dword(rtlpriv, REG_HISRE);
+ rtl_write_dword(rtlpriv, REG_HISRE, tmp);
+
+ tmp = rtl_read_dword(rtlpriv, REG_HSISR);
+ rtl_write_dword(rtlpriv, REG_HSISR, tmp);
+}
+
void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+ if (!rtlpci->int_clear)
+ rtl8821ae_clear_interrupt(hw);/*clear it here first*/
+
rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
rtlpci->irq_enabled = true;
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c
@@ -96,6 +96,7 @@ int rtl8821ae_init_sw_vars(struct ieee80
rtl8821ae_bt_reg_init(hw);
rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+ rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear;
rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer();
rtlpriv->dm.dm_initialgain_enable = 1;
@@ -167,6 +168,7 @@ int rtl8821ae_init_sw_vars(struct ieee80
rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps;
rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps;
rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support;
+ rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear;
if (rtlpriv->cfg->mod_params->disable_watchdog)
pr_info("watchdog disabled\n");
rtlpriv->psc.reg_fwctrl_lps = 3;
@@ -308,6 +310,7 @@ static struct rtl_mod_params rtl8821ae_m
.swctrl_lps = false,
.fwctrl_lps = true,
.msi_support = true,
+ .int_clear = true,
.debug = DBG_EMERG,
.disable_watchdog = 0,
};
@@ -437,6 +440,7 @@ module_param_named(fwlps, rtl8821ae_mod_
module_param_named(msi, rtl8821ae_mod_params.msi_support, bool, 0444);
module_param_named(disable_watchdog, rtl8821ae_mod_params.disable_watchdog,
bool, 0444);
+module_param_named(int_clear, rtl8821ae_mod_params.int_clear, bool, 0444);
MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
@@ -444,6 +448,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use
MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n");
MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n");
static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2234,6 +2234,9 @@ struct rtl_mod_params {
/* default 0: 1 means disable */
bool disable_watchdog;
+
+ /* default 0: 1 means do not disable interrupts */
+ bool int_clear;
};
struct rtl_hal_usbint_cfg {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 007/110] iwlwifi: mvm: clear csa countdown when AP is stopped
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 006/110] rtlwifi: rtl8821ae: Fix system lockups on boot Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 008/110] iwlwifi: mvm: fix D3 CCMP TX PN assignment Greg Kroah-Hartman
` (95 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Avraham Stern, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <avraham.stern@intel.com>
commit e9cb0327b26dd7ba43a3b7a05b4b62219decf42d upstream.
The csa_countdown flag was not cleared when the AP is stopped.
As a result, if the AP was stopped after csa_countdown had started,
all the folowing channel switch commands would fail.
Fix that by clearing the csa_countdown flag when the AP is stopped.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/mvm/mac80211.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -2373,6 +2373,7 @@ static void iwl_mvm_stop_ap_ibss(struct
iwl_mvm_remove_time_event(mvm, mvmvif,
&mvmvif->time_event_data);
RCU_INIT_POINTER(mvm->csa_vif, NULL);
+ mvmvif->csa_countdown = false;
}
if (rcu_access_pointer(mvm->csa_tx_blocked_vif) == vif) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 008/110] iwlwifi: mvm: fix D3 CCMP TX PN assignment
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 007/110] iwlwifi: mvm: clear csa countdown when AP is stopped Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 009/110] iwlwifi: mvm: fix D3 firmware PN programming Greg Kroah-Hartman
` (94 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Luca Coelho, Johannes Berg
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 6645d5e441db9121793421d477255f4242b3dbf3 upstream.
When going into/coming out of D3, the TX PN must be programmed into
and restored from the firmware respectively. The restore was broken
due to my previous commit to move PN assignment into the driver.
Sending the PN to the firmware still worked since we now use the
counter that's shared with mac80211, but accessing it through the
mac80211 API makes no sense now.
Fix this by reading/writing the counter directly. This actually
simplifies the code since we don't need to round-trip through the
key_seq structure.
Fixes: ca8c0f4bede6 ("iwlwifi: mvm: move TX PN assignment for CCMP to the driver")
Reported-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/mvm/d3.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -274,18 +274,13 @@ static void iwl_mvm_wowlan_program_keys(
break;
case WLAN_CIPHER_SUITE_CCMP:
if (sta) {
- u8 *pn = seq.ccmp.pn;
+ u64 pn64;
aes_sc = data->rsc_tsc->all_tsc_rsc.aes.unicast_rsc;
aes_tx_sc = &data->rsc_tsc->all_tsc_rsc.aes.tsc;
- ieee80211_get_key_tx_seq(key, &seq);
- aes_tx_sc->pn = cpu_to_le64((u64)pn[5] |
- ((u64)pn[4] << 8) |
- ((u64)pn[3] << 16) |
- ((u64)pn[2] << 24) |
- ((u64)pn[1] << 32) |
- ((u64)pn[0] << 40));
+ pn64 = atomic64_read(&key->tx_pn);
+ aes_tx_sc->pn = cpu_to_le64(pn64);
} else {
aes_sc = data->rsc_tsc->all_tsc_rsc.aes.multicast_rsc;
}
@@ -1446,15 +1441,15 @@ static void iwl_mvm_d3_update_gtks(struc
switch (key->cipher) {
case WLAN_CIPHER_SUITE_CCMP:
- iwl_mvm_aes_sc_to_seq(&sc->aes.tsc, &seq);
iwl_mvm_set_aes_rx_seq(sc->aes.unicast_rsc, key);
+ atomic64_set(&key->tx_pn, le64_to_cpu(sc->aes.tsc.pn));
break;
case WLAN_CIPHER_SUITE_TKIP:
iwl_mvm_tkip_sc_to_seq(&sc->tkip.tsc, &seq);
iwl_mvm_set_tkip_rx_seq(sc->tkip.unicast_rsc, key);
+ ieee80211_set_key_tx_seq(key, &seq);
break;
}
- ieee80211_set_key_tx_seq(key, &seq);
/* that's it for this key */
return;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 009/110] iwlwifi: mvm: fix D3 firmware PN programming
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 008/110] iwlwifi: mvm: fix D3 CCMP TX PN assignment Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 010/110] iwlwifi: mvm: init card correctly on ctkill exit check Greg Kroah-Hartman
` (93 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Johannes Berg, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 2cf5eb3ab7bb7f2e3a70edcef236cd62c87db030 upstream.
The code to send the RX PN data (for each TID) to the firmware
has a devastating bug: it overwrites the data for TID 0 with
all the TID data, leaving the remaining TIDs zeroed. This will
allow replays to actually be accepted by the firmware, which
could allow waking up the system.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/mvm/d3.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -293,12 +293,12 @@ static void iwl_mvm_wowlan_program_keys(
u8 *pn = seq.ccmp.pn;
ieee80211_get_key_rx_seq(key, i, &seq);
- aes_sc->pn = cpu_to_le64((u64)pn[5] |
- ((u64)pn[4] << 8) |
- ((u64)pn[3] << 16) |
- ((u64)pn[2] << 24) |
- ((u64)pn[1] << 32) |
- ((u64)pn[0] << 40));
+ aes_sc[i].pn = cpu_to_le64((u64)pn[5] |
+ ((u64)pn[4] << 8) |
+ ((u64)pn[3] << 16) |
+ ((u64)pn[2] << 24) |
+ ((u64)pn[1] << 32) |
+ ((u64)pn[0] << 40));
}
data->use_rsc_tsc = true;
break;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 010/110] iwlwifi: mvm: init card correctly on ctkill exit check
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 009/110] iwlwifi: mvm: fix D3 firmware PN programming Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 011/110] iwlwifi: mvm: flush fw_dump_wk when mvm fails to start Greg Kroah-Hartman
` (92 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Arik Nemtsov, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arik Nemtsov <arik@wizery.com>
commit 1a3fe0b2b6778b7866e2b3f5c9a299d5e9bbd89c upstream.
During the CT-kill exit flow, the card is powered up and partially
initialized to check if the temperature is already low enough.
Unfortunately the init bails early because the CT-kill flag is set.
Make the code bail early only for HW RF-kill, as was intended by the
author. CT-kill is self-imposed and is not really RF-kill.
Fixes: 31b8b343e019 ("iwlwifi: fix RFkill while calibrating")
Signed-off-by: Arik Nemtsov <arikx.nemtsov@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/mvm/fw.c | 4 ++--
drivers/net/wireless/iwlwifi/mvm/mvm.h | 5 +++++
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -364,7 +364,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mv
* abort after reading the nvm in case RF Kill is on, we will complete
* the init seq later when RF kill will switch to off
*/
- if (iwl_mvm_is_radio_killed(mvm)) {
+ if (iwl_mvm_is_radio_hw_killed(mvm)) {
IWL_DEBUG_RF_KILL(mvm,
"jump over all phy activities due to RF kill\n");
iwl_remove_notification(&mvm->notif_wait, &calib_wait);
@@ -397,7 +397,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mv
ret = iwl_wait_notification(&mvm->notif_wait, &calib_wait,
MVM_UCODE_CALIB_TIMEOUT);
- if (ret && iwl_mvm_is_radio_killed(mvm)) {
+ if (ret && iwl_mvm_is_radio_hw_killed(mvm)) {
IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
ret = 1;
}
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -848,6 +848,11 @@ static inline bool iwl_mvm_is_radio_kill
test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status);
}
+static inline bool iwl_mvm_is_radio_hw_killed(struct iwl_mvm *mvm)
+{
+ return test_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
+}
+
/* Must be called with rcu_read_lock() held and it can only be
* released when mvmsta is not needed anymore.
*/
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 011/110] iwlwifi: mvm: flush fw_dump_wk when mvm fails to start
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 010/110] iwlwifi: mvm: init card correctly on ctkill exit check Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 012/110] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series Greg Kroah-Hartman
` (91 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrei Otcheretianski, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
commit dbf73d4a8bb8f4e1d1f3edd3be825692279e2ef3 upstream.
FW dump may be triggered when running init ucode, for example due to a
sysassert. In this case fw_dump_wk may run after mvm is freed, resulting
in a kernel panic.
Fix it by flushing the work.
Fixes: 01b988a708af ("iwlwifi: mvm: allow to collect debug data when restart is disabled")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/mvm/ops.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -582,6 +582,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *
ieee80211_unregister_hw(mvm->hw);
iwl_mvm_leds_exit(mvm);
out_free:
+ flush_delayed_work(&mvm->fw_dump_wk);
iwl_phy_db_free(mvm->phy_db);
kfree(mvm->scan_cmd);
if (!cfg->no_power_up_nic_in_init || !mvm->nvm_file_name)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 012/110] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 011/110] iwlwifi: mvm: flush fw_dump_wk when mvm fails to start Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 013/110] iommu/vt-d: fix range computation when making room for large pages Greg Kroah-Hartman
` (90 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeremy, Luca Coelho
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Coelho <luciano.coelho@intel.com>
commit f08f625876476b6c4a87834dc86e3b927f4697d2 upstream.
Add 3 new subdevice IDs for the 0x095A device ID and 2 for the 0x095B
device ID.
Reported-by: Jeremy <jeremy.bomkamp@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/iwlwifi/pcie/drv.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -414,6 +414,11 @@ static const struct pci_device_id iwl_hw
{IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5F10, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x5212, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x520A, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9000, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x9400, iwl7265_2ac_cfg)},
/* 8000 Series */
{IWL_PCI_DEVICE(0x24F3, 0x0010, iwl8260_2ac_cfg)},
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 013/110] iommu/vt-d: fix range computation when making room for large pages
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 012/110] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 014/110] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Greg Kroah-Hartman
` (89 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Zander, David Woodhouse
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Zander <christian@nervanasys.com>
commit ba2374fd2bf379f933773811fdb06cb6a5445f41 upstream.
In preparation for the installation of a large page, any small page
tables that may still exist in the target IOV address range are
removed. However, if a scatter/gather list entry is large enough to
fit more than one large page, the address space for any subsequent
large pages is not cleared of conflicting small page tables.
This can cause legitimate mapping requests to fail with errors of the
form below, potentially followed by a series of IOMMU faults:
ERROR: DMA PTE for vPFN 0xfde00 already set (to 7f83a4003 not 7e9e00083)
In this example, a 4MiB scatter/gather list entry resulted in the
successful installation of a large page @ vPFN 0xfdc00, followed by
a failed attempt to install another large page @ vPFN 0xfde00, due to
the presence of a pointer to a small page table @ 0x7f83a4000.
To address this problem, compute the number of large pages that fit
into a given scatter/gather list entry, and use it to derive the
last vPFN covered by the large page(s).
Signed-off-by: Christian Zander <christian@nervanasys.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2109,15 +2109,19 @@ static int __domain_mapping(struct dmar_
return -ENOMEM;
/* It is large page*/
if (largepage_lvl > 1) {
+ unsigned long nr_superpages, end_pfn;
+
pteval |= DMA_PTE_LARGE_PAGE;
lvl_pages = lvl_to_nr_pages(largepage_lvl);
+
+ nr_superpages = sg_res / lvl_pages;
+ end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
+
/*
* Ensure that old small page tables are
- * removed to make room for superpage,
- * if they exist.
+ * removed to make room for superpage(s).
*/
- dma_pte_free_pagetable(domain, iov_pfn,
- iov_pfn + lvl_pages - 1);
+ dma_pte_free_pagetable(domain, iov_pfn, end_pfn);
} else {
pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 014/110] iommu/amd: Fix BUG when faulting a PROT_NONE VMA
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 013/110] iommu/vt-d: fix range computation when making room for large pages Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 015/110] iommu/amd: Dont clear DTE flags when modifying it Greg Kroah-Hartman
` (88 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jay Cornwall, Joerg Roedel
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Cornwall <jay@jcornwall.me>
commit d14f6fced5f9360edca5a1325ddb7077aab1203b upstream.
handle_mm_fault indirectly triggers a BUG in do_numa_page
when given a VMA without read/write/execute access. Check
this condition in do_fault.
do_fault -> handle_mm_fault -> handle_pte_fault -> do_numa_page
mm/memory.c
3147 static int do_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
....
3159 /* A PROT_NONE fault should not end up here */
3160 BUG_ON(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)));
Signed-off-by: Jay Cornwall <jay@jcornwall.me>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu_v2.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/iommu/amd_iommu_v2.c
+++ b/drivers/iommu/amd_iommu_v2.c
@@ -516,6 +516,13 @@ static void do_fault(struct work_struct
goto out;
}
+ if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))) {
+ /* handle_mm_fault would BUG_ON() */
+ up_read(&mm->mmap_sem);
+ handle_fault_error(fault);
+ goto out;
+ }
+
ret = handle_mm_fault(mm, vma, address, write);
if (ret & VM_FAULT_ERROR) {
/* failed to service fault */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 015/110] iommu/amd: Dont clear DTE flags when modifying it
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 014/110] iommu/amd: Fix BUG when faulting a PROT_NONE VMA Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 016/110] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Greg Kroah-Hartman
` (87 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, G. Richard Bellamy, Joerg Roedel
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
commit cbf3ccd09d683abf1cacd36e3640872ee912d99b upstream.
During device assignment/deassignment the flags in the DTE
get lost, which might cause spurious faults, for example
when the device tries to access the system management range.
Fix this by not clearing the flags with the rest of the DTE.
Reported-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Tested-by: G. Richard Bellamy <rbellamy@pteradigm.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd_iommu.c | 4 ++--
drivers/iommu/amd_iommu_types.h | 1 +
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -1974,8 +1974,8 @@ static void set_dte_entry(u16 devid, str
static void clear_dte_entry(u16 devid)
{
/* remove entry from the device table seen by the hardware */
- amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
- amd_iommu_dev_table[devid].data[1] = 0;
+ amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
+ amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK;
amd_iommu_apply_erratum_63(devid);
}
--- a/drivers/iommu/amd_iommu_types.h
+++ b/drivers/iommu/amd_iommu_types.h
@@ -295,6 +295,7 @@
#define IOMMU_PTE_IR (1ULL << 61)
#define IOMMU_PTE_IW (1ULL << 62)
+#define DTE_FLAG_MASK (0x3ffULL << 32)
#define DTE_FLAG_IOTLB (0x01UL << 32)
#define DTE_FLAG_GV (0x01ULL << 55)
#define DTE_GLX_SHIFT (56)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 016/110] powerpc/rtas: Validate rtas.entry before calling enter_rtas()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 015/110] iommu/amd: Dont clear DTE flags when modifying it Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 017/110] drm: fix mutex leak in drm_dp_get_mst_branch_device Greg Kroah-Hartman
` (86 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, NAGESWARA R. SASTRY, Vasant Hegde,
Michael Ellerman
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
commit 8832317f662c06f5c06e638f57bfe89a71c9b266 upstream.
Currently we do not validate rtas.entry before calling enter_rtas(). This
leads to a kernel oops when user space calls rtas system call on a powernv
platform (see below). This patch adds code to validate rtas.entry before
making enter_rtas() call.
Oops: Exception in kernel mode, sig: 4 [#1]
SMP NR_CPUS=1024 NUMA PowerNV
task: c000000004294b80 ti: c0000007e1a78000 task.ti: c0000007e1a78000
NIP: 0000000000000000 LR: 0000000000009c14 CTR: c000000000423140
REGS: c0000007e1a7b920 TRAP: 0e40 Not tainted (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
MSR: 1000000000081000 <HV,ME> CR: 00000000 XER: 00000000
CFAR: c000000000009c0c SOFTE: 0
NIP [0000000000000000] (null)
LR [0000000000009c14] 0x9c14
Call Trace:
[c0000007e1a7bba0] [c00000000041a7f4] avc_has_perm_noaudit+0x54/0x110 (unreliable)
[c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
[c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98
Fixes: 55190f88789a ("powerpc: Add skeleton PowerNV platform")
Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Reword change log, trim oops, and add stable + fixes]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/rtas.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -1041,6 +1041,9 @@ asmlinkage int ppc_rtas(struct rtas_args
if (!capable(CAP_SYS_ADMIN))
return -EPERM;
+ if (!rtas.entry)
+ return -EINVAL;
+
if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
return -EFAULT;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 017/110] drm: fix mutex leak in drm_dp_get_mst_branch_device
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 016/110] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 018/110] drm: Correct arguments to list_tail_add in create blob ioctl Greg Kroah-Hartman
` (85 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Adam J. Richter, Daniel Vetter,
Dave Airlie
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Richter <adamrichter4@gmail.com>
commit 30730c7f5943b3beace1e29f7f1476e05de3da14 upstream.
In Linux 4.3-rc5, there is an error case in drm_dp_get_branch_device
that returns without releasing mgr->lock, resulting a spew of kernel
messages about a kernel work function possibly having leaked a mutex
and presumably more serious adverse consequences later. This patch
changes the error to "goto out" to unlock the mutex before returning.
[airlied: grabbed from drm-next as it fixes something we've seen]
Signed-off-by: Adam J. Richter <adam_richter2004@yahoo.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_dp_mst_topology.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -1193,17 +1193,18 @@ static struct drm_dp_mst_branch *drm_dp_
list_for_each_entry(port, &mstb->ports, next) {
if (port->port_num == port_num) {
- if (!port->mstb) {
+ mstb = port->mstb;
+ if (!mstb) {
DRM_ERROR("failed to lookup MSTB with lct %d, rad %02x\n", lct, rad[0]);
- return NULL;
+ goto out;
}
- mstb = port->mstb;
break;
}
}
}
kref_get(&mstb->kref);
+out:
mutex_unlock(&mgr->lock);
return mstb;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 018/110] drm: Correct arguments to list_tail_add in create blob ioctl
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 017/110] drm: fix mutex leak in drm_dp_get_mst_branch_device Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 019/110] drm: crtc: integer overflow in drm_property_create_blob() Greg Kroah-Hartman
` (84 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maneet Singh, Sean Paul, Daniel Stone,
Jani Nikula, Dave Airlie
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maneet Singh <mmaneetsingh@nvidia.com>
commit 8731b269f01e16193390c7276e70530366b8d626 upstream.
Arguments passed to list_add_tail were reversed resulting in deletion
of old blob property everytime the new one is added.
Fixes
commit e2f5d2ea479b9b2619965d43db70939589afe43a
Author: Daniel Stone <daniels@collabora.com>
Date: Fri May 22 13:34:51 2015 +0100
drm/mode: Add user blob-creation ioctl
Signed-off-by: Maneet Singh <mmaneetsingh@nvidia.com>
[seanpaul tweaked commit subject a little]
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Reviewed-by: Daniel Stone <daniels@collabora.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -4573,7 +4573,7 @@ int drm_mode_createblob_ioctl(struct drm
* not associated with any file_priv. */
mutex_lock(&dev->mode_config.blob_lock);
out_resp->blob_id = blob->base.id;
- list_add_tail(&file_priv->blobs, &blob->head_file);
+ list_add_tail(&blob->head_file, &file_priv->blobs);
mutex_unlock(&dev->mode_config.blob_lock);
return 0;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 019/110] drm: crtc: integer overflow in drm_property_create_blob()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 018/110] drm: Correct arguments to list_tail_add in create blob ioctl Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 020/110] [media] m88ds3103: use own reg update_bits() implementation Greg Kroah-Hartman
` (83 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Daniel Stone,
Dave Airlie
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 9ac0934bbe52290e4e4c2a58ec41cab9b6ca8c96 upstream.
The size here comes from the user via the ioctl, it is a number between
1-u32max so the addition here could overflow on 32 bit systems.
Fixes: f453ba046074 ('DRM: add mode setting support')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Daniel Stone <daniels@collabora.com>
Signed-off-by: Dave Airlie <airlied@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_crtc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -4221,7 +4221,7 @@ drm_property_create_blob(struct drm_devi
struct drm_property_blob *blob;
int ret;
- if (!length)
+ if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob))
return ERR_PTR(-EINVAL);
blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 020/110] [media] m88ds3103: use own reg update_bits() implementation
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 019/110] drm: crtc: integer overflow in drm_property_create_blob() Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 021/110] [media] si2157: Bounds check firmware Greg Kroah-Hartman
` (82 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Clarkstone, Antti Palosaari,
Mauro Carvalho Chehab
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit 56ea37da3b93dfe46cb5c3ee0ee4cc44229ece47 upstream.
Device stopped to tuning some channels after regmap conversion.
Reason is that regmap_update_bits() works a bit differently for
partially volatile registers than old homemade routine. Return
back to old routine in order to fix issue.
Fixes: 478932b16052f5ded74685d096ae920cd17d6424
Reported-by: Mark Clarkstone <hello@markclarkstone.co.uk>
Tested-by: Mark Clarkstone <hello@markclarkstone.co.uk>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/m88ds3103.c | 73 ++++++++++++++++++++------------
1 file changed, 47 insertions(+), 26 deletions(-)
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -18,6 +18,27 @@
static struct dvb_frontend_ops m88ds3103_ops;
+/* write single register with mask */
+static int m88ds3103_update_bits(struct m88ds3103_dev *dev,
+ u8 reg, u8 mask, u8 val)
+{
+ int ret;
+ u8 tmp;
+
+ /* no need for read if whole reg is written */
+ if (mask != 0xff) {
+ ret = regmap_bulk_read(dev->regmap, reg, &tmp, 1);
+ if (ret)
+ return ret;
+
+ val &= mask;
+ tmp &= ~mask;
+ val |= tmp;
+ }
+
+ return regmap_bulk_write(dev->regmap, reg, &val, 1);
+}
+
/* write reg val table using reg addr auto increment */
static int m88ds3103_wr_reg_val_tab(struct m88ds3103_dev *dev,
const struct m88ds3103_reg_val *tab, int tab_len)
@@ -394,10 +415,10 @@ static int m88ds3103_set_frontend(struct
u8tmp2 = 0x00; /* 0b00 */
break;
}
- ret = regmap_update_bits(dev->regmap, 0x22, 0xc0, u8tmp1 << 6);
+ ret = m88ds3103_update_bits(dev, 0x22, 0xc0, u8tmp1 << 6);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x24, 0xc0, u8tmp2 << 6);
+ ret = m88ds3103_update_bits(dev, 0x24, 0xc0, u8tmp2 << 6);
if (ret)
goto err;
}
@@ -455,13 +476,13 @@ static int m88ds3103_set_frontend(struct
if (ret)
goto err;
}
- ret = regmap_update_bits(dev->regmap, 0x9d, 0x08, 0x08);
+ ret = m88ds3103_update_bits(dev, 0x9d, 0x08, 0x08);
if (ret)
goto err;
ret = regmap_write(dev->regmap, 0xf1, 0x01);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x30, 0x80, 0x80);
+ ret = m88ds3103_update_bits(dev, 0x30, 0x80, 0x80);
if (ret)
goto err;
}
@@ -498,7 +519,7 @@ static int m88ds3103_set_frontend(struct
switch (dev->cfg->ts_mode) {
case M88DS3103_TS_SERIAL:
case M88DS3103_TS_SERIAL_D7:
- ret = regmap_update_bits(dev->regmap, 0x29, 0x20, u8tmp1);
+ ret = m88ds3103_update_bits(dev, 0x29, 0x20, u8tmp1);
if (ret)
goto err;
u8tmp1 = 0;
@@ -567,11 +588,11 @@ static int m88ds3103_set_frontend(struct
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x4d, 0x02, dev->cfg->spec_inv << 1);
+ ret = m88ds3103_update_bits(dev, 0x4d, 0x02, dev->cfg->spec_inv << 1);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x30, 0x10, dev->cfg->agc_inv << 4);
+ ret = m88ds3103_update_bits(dev, 0x30, 0x10, dev->cfg->agc_inv << 4);
if (ret)
goto err;
@@ -625,13 +646,13 @@ static int m88ds3103_init(struct dvb_fro
dev->warm = false;
/* wake up device from sleep */
- ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x01);
+ ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x01);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x00);
+ ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x00);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x00);
+ ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x00);
if (ret)
goto err;
@@ -749,18 +770,18 @@ static int m88ds3103_sleep(struct dvb_fr
utmp = 0x29;
else
utmp = 0x27;
- ret = regmap_update_bits(dev->regmap, utmp, 0x01, 0x00);
+ ret = m88ds3103_update_bits(dev, utmp, 0x01, 0x00);
if (ret)
goto err;
/* sleep */
- ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
+ ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
+ ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
if (ret)
goto err;
- ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
+ ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
if (ret)
goto err;
@@ -992,12 +1013,12 @@ static int m88ds3103_set_tone(struct dvb
}
utmp = tone << 7 | dev->cfg->envelope_mode << 5;
- ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
if (ret)
goto err;
utmp = 1 << 2;
- ret = regmap_update_bits(dev->regmap, 0xa1, reg_a1_mask, utmp);
+ ret = m88ds3103_update_bits(dev, 0xa1, reg_a1_mask, utmp);
if (ret)
goto err;
@@ -1047,7 +1068,7 @@ static int m88ds3103_set_voltage(struct
voltage_dis ^= dev->cfg->lnb_en_pol;
utmp = voltage_dis << 1 | voltage_sel << 0;
- ret = regmap_update_bits(dev->regmap, 0xa2, 0x03, utmp);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0x03, utmp);
if (ret)
goto err;
@@ -1080,7 +1101,7 @@ static int m88ds3103_diseqc_send_master_
}
utmp = dev->cfg->envelope_mode << 5;
- ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
if (ret)
goto err;
@@ -1115,12 +1136,12 @@ static int m88ds3103_diseqc_send_master_
} else {
dev_dbg(&client->dev, "diseqc tx timeout\n");
- ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
+ ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
if (ret)
goto err;
}
- ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
if (ret)
goto err;
@@ -1152,7 +1173,7 @@ static int m88ds3103_diseqc_send_burst(s
}
utmp = dev->cfg->envelope_mode << 5;
- ret = regmap_update_bits(dev->regmap, 0xa2, 0xe0, utmp);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0xe0, utmp);
if (ret)
goto err;
@@ -1194,12 +1215,12 @@ static int m88ds3103_diseqc_send_burst(s
} else {
dev_dbg(&client->dev, "diseqc tx timeout\n");
- ret = regmap_update_bits(dev->regmap, 0xa1, 0xc0, 0x40);
+ ret = m88ds3103_update_bits(dev, 0xa1, 0xc0, 0x40);
if (ret)
goto err;
}
- ret = regmap_update_bits(dev->regmap, 0xa2, 0xc0, 0x80);
+ ret = m88ds3103_update_bits(dev, 0xa2, 0xc0, 0x80);
if (ret)
goto err;
@@ -1435,13 +1456,13 @@ static int m88ds3103_probe(struct i2c_cl
goto err_kfree;
/* sleep */
- ret = regmap_update_bits(dev->regmap, 0x08, 0x01, 0x00);
+ ret = m88ds3103_update_bits(dev, 0x08, 0x01, 0x00);
if (ret)
goto err_kfree;
- ret = regmap_update_bits(dev->regmap, 0x04, 0x01, 0x01);
+ ret = m88ds3103_update_bits(dev, 0x04, 0x01, 0x01);
if (ret)
goto err_kfree;
- ret = regmap_update_bits(dev->regmap, 0x23, 0x10, 0x10);
+ ret = m88ds3103_update_bits(dev, 0x23, 0x10, 0x10);
if (ret)
goto err_kfree;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 021/110] [media] si2157: Bounds check firmware
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 020/110] [media] m88ds3103: use own reg update_bits() implementation Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 022/110] [media] si2168: " Greg Kroah-Hartman
` (81 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laura Abbott, Mauro Carvalho Chehab
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@fedoraproject.org>
commit a828d72df216c36e9c40b6c24dc4b17b6f7b5a76 upstream.
When reading the firmware and sending commands, the length
must be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the
expected format. Add the proper check.
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/tuners/si2157.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/tuners/si2157.c
+++ b/drivers/media/tuners/si2157.c
@@ -166,6 +166,10 @@ static int si2157_init(struct dvb_fronte
for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining];
+ if (len > SI2157_ARGLEN) {
+ dev_err(&client->dev, "Bad firmware length\n");
+ goto err_release_firmware;
+ }
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len;
cmd.rlen = 1;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 022/110] [media] si2168: Bounds check firmware
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 021/110] [media] si2157: Bounds check firmware Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 023/110] [media] rtl28xxu: fix control message flaws Greg Kroah-Hartman
` (80 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stuart Auchterlonie, Antti Palosaari,
Laura Abbott, Mauro Carvalho Chehab
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@fedoraproject.org>
commit 47810b4341ac9d2f558894bc5995e6fa2a1298f9 upstream.
When reading the firmware and sending commands, the length must
be bounds checked to avoid overrunning the size of the command
buffer and smashing the stack if the firmware is not in the expected
format:
si2168 11-0064: found a 'Silicon Labs Si2168-B40'
si2168 11-0064: downloading firmware from file 'dvb-demod-si2168-b40-01.fw'
si2168 11-0064: firmware download failed -95
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa085708f
Add the proper check.
Reported-by: Stuart Auchterlonie <sauchter@redhat.com>
Reviewed-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/si2168.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/media/dvb-frontends/si2168.c
+++ b/drivers/media/dvb-frontends/si2168.c
@@ -502,6 +502,10 @@ static int si2168_init(struct dvb_fronte
/* firmware is in the new format */
for (remaining = fw->size; remaining > 0; remaining -= 17) {
len = fw->data[fw->size - remaining];
+ if (len > SI2168_ARGLEN) {
+ ret = -EINVAL;
+ break;
+ }
memcpy(cmd.args, &fw->data[(fw->size - remaining) + 1], len);
cmd.wlen = len;
cmd.rlen = 1;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 023/110] [media] rtl28xxu: fix control message flaws
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 022/110] [media] si2168: " Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 024/110] KVM: arm: use GIC support unconditionally Greg Kroah-Hartman
` (79 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Antti Palosaari
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit d18ca5b7ceca0e9674cb4bb2ed476b0fcbb23ba2 upstream.
Add lock to prevent concurrent access for control message as control
message function uses shared buffer. Without the lock there may be
remote control polling which messes the buffer causing IO errors.
Increase buffer size and add check for maximum supported message
length.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=103391
Fixes: c56222a6b25c ("[media] rtl28xxu: move usb buffers to state")
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 15 +++++++++++++--
drivers/media/usb/dvb-usb-v2/rtl28xxu.h | 2 +-
2 files changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -34,6 +34,14 @@ static int rtl28xxu_ctrl_msg(struct dvb_
unsigned int pipe;
u8 requesttype;
+ mutex_lock(&d->usb_mutex);
+
+ if (req->size > sizeof(dev->buf)) {
+ dev_err(&d->intf->dev, "too large message %u\n", req->size);
+ ret = -EINVAL;
+ goto err_mutex_unlock;
+ }
+
if (req->index & CMD_WR_FLAG) {
/* write */
memcpy(dev->buf, req->data, req->size);
@@ -50,14 +58,17 @@ static int rtl28xxu_ctrl_msg(struct dvb_
dvb_usb_dbg_usb_control_msg(d->udev, 0, requesttype, req->value,
req->index, dev->buf, req->size);
if (ret < 0)
- goto err;
+ goto err_mutex_unlock;
/* read request, copy returned data to return buf */
if (requesttype == (USB_TYPE_VENDOR | USB_DIR_IN))
memcpy(req->data, dev->buf, req->size);
+ mutex_unlock(&d->usb_mutex);
+
return 0;
-err:
+err_mutex_unlock:
+ mutex_unlock(&d->usb_mutex);
dev_dbg(&d->intf->dev, "failed=%d\n", ret);
return ret;
}
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.h
@@ -71,7 +71,7 @@
struct rtl28xxu_dev {
- u8 buf[28];
+ u8 buf[128];
u8 chip_id;
u8 tuner;
char *tuner_name;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 024/110] KVM: arm: use GIC support unconditionally
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 023/110] [media] rtl28xxu: fix control message flaws Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 025/110] ALSA: hdac: Explicitly add io.h Greg Kroah-Hartman
` (78 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Marc Zyngier,
Christoffer Dall
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 4a5d69b73948d0e03cd38d77dc11edb2e707165f upstream.
The vgic code on ARM is built for all configurations that enable KVM,
but the parent_data field that it references is only present when
CONFIG_IRQ_DOMAIN_HIERARCHY is set:
virt/kvm/arm/vgic.c: In function 'kvm_vgic_map_phys_irq':
virt/kvm/arm/vgic.c:1781:13: error: 'struct irq_data' has no member named 'parent_data'
This flag is implied by the GIC driver, and indeed the VGIC code only
makes sense if a GIC is present. This changes the CONFIG_KVM symbol
to always select GIC, which avoids the issue.
Fixes: 662d9715840 ("arm/arm64: KVM: Kill CONFIG_KVM_ARM_{VGIC,TIMER}")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kvm/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/kvm/Kconfig
+++ b/arch/arm/kvm/Kconfig
@@ -21,6 +21,7 @@ config KVM
depends on MMU && OF
select PREEMPT_NOTIFIERS
select ANON_INODES
+ select ARM_GIC
select HAVE_KVM_CPU_RELAX_INTERCEPT
select HAVE_KVM_ARCH_TLB_FLUSH_ALL
select KVM_MMIO
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 025/110] ALSA: hdac: Explicitly add io.h
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 024/110] KVM: arm: use GIC support unconditionally Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 026/110] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 Greg Kroah-Hartman
` (77 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kbuild test robot, Mark Brown,
Vinod Koul, Takashi Iwai
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinod Koul <vinod.koul@intel.com>
commit 42f2bb1c494543084b764e1ca253c73db910daf2 upstream.
Compiling the hdac extended core on arm fails with below error:
sound/hda/ext/hdac_ext_bus.c: In function 'hdac_ext_writel':
>> sound/hda/ext/hdac_ext_bus.c:29:2: error: implicit declaration of
>> function
+'writel' [-Werror=implicit-function-declaration]
writel(value, addr);
^
sound/hda/ext/hdac_ext_bus.c: In function 'hdac_ext_readl':
>> sound/hda/ext/hdac_ext_bus.c:34:2: error: implicit declaration of
>> function
+'readl' [-Werror=implicit-function-declaration]
return readl(addr);
This is fixed by explicitly including io.h
Fixes: 99463b3a3994 - ('ALSA: hda: provide default bus io ops extended hdac')
Reported-by: kbuild test robot <lkp@intel.com>
Suggested-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/hda/ext/hdac_ext_bus.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/hda/ext/hdac_ext_bus.c
+++ b/sound/hda/ext/hdac_ext_bus.c
@@ -19,6 +19,7 @@
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/io.h>
#include <sound/hdaudio_ext.h>
MODULE_DESCRIPTION("HDA extended core");
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 026/110] ALSA: hda - Fix inverted internal mic on Lenovo G50-80
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 025/110] ALSA: hdac: Explicitly add io.h Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 027/110] ALSA: hda - Fix deadlock at error in building PCM Greg Kroah-Hartman
` (76 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Henningsson, Takashi Iwai
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Henningsson <david.henningsson@canonical.com>
commit e8d65a8d985271a102f07c7456da5b86c19ffe16 upstream.
Add the appropriate quirk to indicate the Lenovo G50-80 has a stereo
mic input where one channel has reverse polarity.
Alsa-info available at:
https://launchpadlibrarian.net/220846272/AlsaInfo.txt
BugLink: https://bugs.launchpad.net/bugs/1504778
Signed-off-by: David Henningsson <david.henningsson@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -819,6 +819,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x17aa, 0x21da, "Lenovo X220", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x21db, "Lenovo X220-tablet", CXT_PINCFG_LENOVO_TP410),
SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo IdeaPad Z560", CXT_FIXUP_MUTE_LED_EAPD),
+ SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 027/110] ALSA: hda - Fix deadlock at error in building PCM
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 026/110] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 028/110] ASoC: Add info callback for SX_TLV controls Greg Kroah-Hartman
` (75 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Takashi Iwai
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d289619a219dd01e255d7b5e30f9171b25efea48 upstream.
The HDA codec driver issues snd_hda_codec_reset() at the error path of
PCM build. This was needed in the earlier code base, but the recent
rewrite to use the standard bus binding made this a deadlock:
modprobe D 0000000000000005 0 720 716 0x00000080
Call Trace:
[<ffffffff816a5dbe>] schedule+0x3e/0x90
[<ffffffff816a61a5>] schedule_preempt_disabled+0x15/0x20
[<ffffffff816a7ae5>] __mutex_lock_slowpath+0xb5/0x120
[<ffffffff816a7b6b>] mutex_lock+0x1b/0x30
[<ffffffff8148656b>] device_release_driver+0x1b/0x30
[<ffffffff81485c15>] bus_remove_device+0x105/0x180
[<ffffffff814822b9>] device_del+0x139/0x260
[<ffffffffa05e0ec5>] snd_hdac_device_unregister+0x25/0x30 [snd_hda_core]
[<ffffffffa074fa6a>] snd_hda_codec_reset+0x2a/0x70 [snd_hda_codec]
[<ffffffffa075007b>] snd_hda_codec_build_pcms+0x18b/0x1b0 [snd_hda_codec]
[<ffffffffa074a44e>] hda_codec_driver_probe+0xbe/0x140 [snd_hda_codec]
[<ffffffff81486ac4>] driver_probe_device+0x1f4/0x460
[<ffffffff81486dc0>] __driver_attach+0x90/0xa0
[<ffffffff81484844>] bus_for_each_dev+0x64/0xa0
[<ffffffff814862de>] driver_attach+0x1e/0x20
[<ffffffff81485e7b>] bus_add_driver+0x1eb/0x280
[<ffffffff81487680>] driver_register+0x60/0xe0
[<ffffffffa074a0da>] __hda_codec_driver_register+0x5a/0x60 [snd_hda_codec]
[<ffffffffa070a01e>] realtek_driver_init+0x1e/0x1000 [snd_hda_codec_realtek]
[<ffffffff810002f3>] do_one_initcall+0xb3/0x200
[<ffffffff816a1fc5>] do_init_module+0x60/0x1f8
[<ffffffff810ee5c3>] load_module+0x1653/0x1bd0
[<ffffffff810eed48>] SYSC_finit_module+0x98/0xc0
[<ffffffff810eed8e>] SyS_finit_module+0xe/0x10
[<ffffffff816aa032>] entry_SYSCALL_64_fastpath+0x16/0x75
The simple fix is just to remove this call, since we don't need to
think about unbinding at there any longer.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=948758
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/hda_codec.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3438,10 +3438,8 @@ int snd_hda_codec_build_pcms(struct hda_
int dev, err;
err = snd_hda_codec_parse_pcms(codec);
- if (err < 0) {
- snd_hda_codec_reset(codec);
+ if (err < 0)
return err;
- }
/* attach a new PCM streams */
list_for_each_entry(cpcm, &codec->pcm_list_head, list) {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 028/110] ASoC: Add info callback for SX_TLV controls
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 027/110] ALSA: hda - Fix deadlock at error in building PCM Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 029/110] ASoC: wm8904: Correct number of EQ registers Greg Kroah-Hartman
` (74 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Charles Keepax, Brian Austin,
Mark Brown
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit 34198710f55b5f359f43e67d9a08fe5aadfbca1b upstream.
SX_TLV controls are intended for situations where the register behind
the control has some non-zero value indicating the minimum gain
and then gains increasing from there and eventually overflowing through
zero.
Currently every CODEC implementing these controls specifies the minimum
as the non-zero value for the minimum and the maximum as the number of
gain settings available.
This means when the info callback subtracts the minimum value from the
maximum value to calculate the number of gain levels available it is
actually under reporting the available levels. This patch fixes this
issue by adding a new snd_soc_info_volsw_sx callback that does not
subtract the minimum value.
Fixes: 1d99f2436d0d ("ASoC: core: Rework SOC_DOUBLE_R_SX_TLV add SOC_SINGLE_SX_TLV")
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Acked-by: Brian Austin <brian.austin@cirrus.com>
Tested-by: Brian Austin <brian.austin@cirrus.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/soc.h | 6 ++++--
sound/soc/soc-ops.c | 28 ++++++++++++++++++++++++++++
2 files changed, 32 insertions(+), 2 deletions(-)
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -86,7 +86,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array),\
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx,\
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -156,7 +156,7 @@
.access = SNDRV_CTL_ELEM_ACCESS_TLV_READ | \
SNDRV_CTL_ELEM_ACCESS_READWRITE, \
.tlv.p = (tlv_array), \
- .info = snd_soc_info_volsw, \
+ .info = snd_soc_info_volsw_sx, \
.get = snd_soc_get_volsw_sx, \
.put = snd_soc_put_volsw_sx, \
.private_value = (unsigned long)&(struct soc_mixer_control) \
@@ -573,6 +573,8 @@ int snd_soc_put_enum_double(struct snd_k
struct snd_ctl_elem_value *ucontrol);
int snd_soc_info_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo);
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo);
#define snd_soc_info_bool_ext snd_ctl_boolean_mono_info
int snd_soc_get_volsw(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_value *ucontrol);
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -207,6 +207,34 @@ int snd_soc_info_volsw(struct snd_kcontr
EXPORT_SYMBOL_GPL(snd_soc_info_volsw);
/**
+ * snd_soc_info_volsw_sx - Mixer info callback for SX TLV controls
+ * @kcontrol: mixer control
+ * @uinfo: control element information
+ *
+ * Callback to provide information about a single mixer control, or a double
+ * mixer control that spans 2 registers of the SX TLV type. SX TLV controls
+ * have a range that represents both positive and negative values either side
+ * of zero but without a sign bit.
+ *
+ * Returns 0 for success.
+ */
+int snd_soc_info_volsw_sx(struct snd_kcontrol *kcontrol,
+ struct snd_ctl_elem_info *uinfo)
+{
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+
+ snd_soc_info_volsw(kcontrol, uinfo);
+ /* Max represents the number of levels in an SX control not the
+ * maximum value, so add the minimum value back on
+ */
+ uinfo->value.integer.max += mc->min;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(snd_soc_info_volsw_sx);
+
+/**
* snd_soc_get_volsw - single mixer get callback
* @kcontrol: mixer control
* @ucontrol: control element information
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 029/110] ASoC: wm8904: Correct number of EQ registers
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 028/110] ASoC: Add info callback for SX_TLV controls Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range Greg Kroah-Hartman
` (73 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Charles Keepax, Mark Brown
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
commit 97aff2c03a1e4d343266adadb52313613efb027f upstream.
There are 24 EQ registers not 25, I suspect this bug came about because
the registers start at EQ1 not zero. The bug is relatively harmless as
the extra register written is an unused one.
Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/sound/wm8904.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/sound/wm8904.h
+++ b/include/sound/wm8904.h
@@ -119,7 +119,7 @@
#define WM8904_MIC_REGS 2
#define WM8904_GPIO_REGS 4
#define WM8904_DRC_REGS 4
-#define WM8904_EQ_REGS 25
+#define WM8904_EQ_REGS 24
/**
* DRC configurations are specified with a label and a set of register
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 029/110] ASoC: wm8904: Correct number of EQ registers Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:33 ` Borislav Petkov
2015-11-06 19:18 ` [PATCH 4.2 032/110] x86/ioapic: Prevent NULL pointer dereference in setup_ioapic_dest() Greg Kroah-Hartman
` (72 subsequent siblings)
102 siblings, 1 reply; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paolo Bonzini, Laszlo Ersek,
Borislav Petkov, H. Peter Anvin, Thomas Gleixner, Ingo Molnar,
Andy Lutomirski, Matt Fleming
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <pbonzini@redhat.com>
commit f5f3497cad8c8416a74b9aaceb127908755d020a upstream.
On 32-bit systems, the initial_page_table is reused by
efi_call_phys_prolog as an identity map to call
SetVirtualAddressMap. efi_call_phys_prolog takes care of
converting the current CPU's GDT to a physical address too.
For PAE kernels the identity mapping is achieved by aliasing the
first PDPE for the kernel memory mapping into the first PDPE
of initial_page_table. This makes the EFI stub's trick "just work".
However, for non-PAE kernels there is no guarantee that the identity
mapping in the initial_page_table extends as far as the GDT; in this
case, accesses to the GDT will cause a page fault (which quickly becomes
a triple fault). Fix this by copying the kernel mappings from
swapper_pg_dir to initial_page_table twice, both at PAGE_OFFSET and at
identity mapping.
For some reason, this is only reproducible with QEMU's dynamic translation
mode, and not for example with KVM. However, even under KVM one can clearly
see that the page table is bogus:
$ qemu-system-i386 -pflash OVMF.fd -M q35 vmlinuz0 -s -S -daemonize
$ gdb
(gdb) target remote localhost:1234
(gdb) hb *0x02858f6f
Hardware assisted breakpoint 1 at 0x2858f6f
(gdb) c
Continuing.
Breakpoint 1, 0x02858f6f in ?? ()
(gdb) monitor info registers
...
GDT= 0724e000 000000ff
IDT= fffbb000 000007ff
CR0=0005003b CR2=ff896000 CR3=032b7000 CR4=00000690
...
The page directory is sane:
(gdb) x/4wx 0x32b7000
0x32b7000: 0x03398063 0x03399063 0x0339a063 0x0339b063
(gdb) x/4wx 0x3398000
0x3398000: 0x00000163 0x00001163 0x00002163 0x00003163
(gdb) x/4wx 0x3399000
0x3399000: 0x00400003 0x00401003 0x00402003 0x00403003
but our particular page directory entry is empty:
(gdb) x/1wx 0x32b7000 + (0x724e000 >> 22) * 4
0x32b7070: 0x00000000
[ It appears that you can skate past this issue if you don't receive
any interrupts while the bogus GDT pointer is loaded, or if you avoid
reloading the segment registers in general.
Andy Lutomirski provides some additional insight:
"AFAICT it's entirely permissible for the GDTR and/or LDT
descriptor to point to unmapped memory. Any attempt to use them
(segment loads, interrupts, IRET, etc) will try to access that memory
as if the access came from CPL 0 and, if the access fails, will
generate a valid page fault with CR2 pointing into the GDT or
LDT."
Up until commit 23a0d4e8fa6d ("efi: Disable interrupts around EFI
calls, not in the epilog/prolog calls") interrupts were disabled
around the prolog and epilog calls, and the functional GDT was
re-installed before interrupts were re-enabled.
Which explains why no one has hit this issue until now. ]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Laszlo Ersek <lersek@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Matt Fleming <matt.fleming@intel.com>
[ Updated changelog. ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/setup.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1198,6 +1198,14 @@ void __init setup_arch(char **cmdline_p)
clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
swapper_pg_dir + KERNEL_PGD_BOUNDARY,
KERNEL_PGD_PTRS);
+
+ /*
+ * sync back low identity map too. It is used for example
+ * in the 32-bit EFI stub.
+ */
+ clone_pgd_range(initial_page_table,
+ swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+ KERNEL_PGD_PTRS);
#endif
tboot_probe();
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range
2015-11-06 19:18 ` [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range Greg Kroah-Hartman
@ 2015-11-06 19:33 ` Borislav Petkov
2015-11-06 19:48 ` Greg Kroah-Hartman
0 siblings, 1 reply; 113+ messages in thread
From: Borislav Petkov @ 2015-11-06 19:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Paolo Bonzini, Laszlo Ersek, H. Peter Anvin,
Thomas Gleixner, Ingo Molnar, Andy Lutomirski, Matt Fleming
Hi Greg,
this one is b0rked and a proper fix is still being discussed. You should
drop it from the queue.
On Fri, Nov 06, 2015 at 11:18:38AM -0800, Greg Kroah-Hartman wrote:
> 4.2-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Paolo Bonzini <pbonzini@redhat.com>
>
> commit f5f3497cad8c8416a74b9aaceb127908755d020a upstream.
>
> On 32-bit systems, the initial_page_table is reused by
> efi_call_phys_prolog as an identity map to call
> SetVirtualAddressMap. efi_call_phys_prolog takes care of
> converting the current CPU's GDT to a physical address too.
>
> For PAE kernels the identity mapping is achieved by aliasing the
> first PDPE for the kernel memory mapping into the first PDPE
> of initial_page_table. This makes the EFI stub's trick "just work".
>
> However, for non-PAE kernels there is no guarantee that the identity
> mapping in the initial_page_table extends as far as the GDT; in this
> case, accesses to the GDT will cause a page fault (which quickly becomes
> a triple fault). Fix this by copying the kernel mappings from
> swapper_pg_dir to initial_page_table twice, both at PAGE_OFFSET and at
> identity mapping.
>
> For some reason, this is only reproducible with QEMU's dynamic translation
> mode, and not for example with KVM. However, even under KVM one can clearly
> see that the page table is bogus:
>
> $ qemu-system-i386 -pflash OVMF.fd -M q35 vmlinuz0 -s -S -daemonize
> $ gdb
> (gdb) target remote localhost:1234
> (gdb) hb *0x02858f6f
> Hardware assisted breakpoint 1 at 0x2858f6f
> (gdb) c
> Continuing.
>
> Breakpoint 1, 0x02858f6f in ?? ()
> (gdb) monitor info registers
> ...
> GDT= 0724e000 000000ff
> IDT= fffbb000 000007ff
> CR0=0005003b CR2=ff896000 CR3=032b7000 CR4=00000690
> ...
>
> The page directory is sane:
>
> (gdb) x/4wx 0x32b7000
> 0x32b7000: 0x03398063 0x03399063 0x0339a063 0x0339b063
> (gdb) x/4wx 0x3398000
> 0x3398000: 0x00000163 0x00001163 0x00002163 0x00003163
> (gdb) x/4wx 0x3399000
> 0x3399000: 0x00400003 0x00401003 0x00402003 0x00403003
>
> but our particular page directory entry is empty:
>
> (gdb) x/1wx 0x32b7000 + (0x724e000 >> 22) * 4
> 0x32b7070: 0x00000000
>
> [ It appears that you can skate past this issue if you don't receive
> any interrupts while the bogus GDT pointer is loaded, or if you avoid
> reloading the segment registers in general.
>
> Andy Lutomirski provides some additional insight:
>
> "AFAICT it's entirely permissible for the GDTR and/or LDT
> descriptor to point to unmapped memory. Any attempt to use them
> (segment loads, interrupts, IRET, etc) will try to access that memory
> as if the access came from CPL 0 and, if the access fails, will
> generate a valid page fault with CR2 pointing into the GDT or
> LDT."
>
> Up until commit 23a0d4e8fa6d ("efi: Disable interrupts around EFI
> calls, not in the epilog/prolog calls") interrupts were disabled
> around the prolog and epilog calls, and the functional GDT was
> re-installed before interrupts were re-enabled.
>
> Which explains why no one has hit this issue until now. ]
>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Reported-by: Laszlo Ersek <lersek@redhat.com>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: "H. Peter Anvin" <hpa@zytor.com>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Ingo Molnar <mingo@kernel.org>
> Cc: Andy Lutomirski <luto@amacapital.net>
> Signed-off-by: Matt Fleming <matt.fleming@intel.com>
> [ Updated changelog. ]
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/x86/kernel/setup.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> --- a/arch/x86/kernel/setup.c
> +++ b/arch/x86/kernel/setup.c
> @@ -1198,6 +1198,14 @@ void __init setup_arch(char **cmdline_p)
> clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY,
> swapper_pg_dir + KERNEL_PGD_BOUNDARY,
> KERNEL_PGD_PTRS);
> +
> + /*
> + * sync back low identity map too. It is used for example
> + * in the 32-bit EFI stub.
> + */
> + clone_pgd_range(initial_page_table,
> + swapper_pg_dir + KERNEL_PGD_BOUNDARY,
> + KERNEL_PGD_PTRS);
> #endif
>
> tboot_probe();
>
>
>
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range
2015-11-06 19:33 ` Borislav Petkov
@ 2015-11-06 19:48 ` Greg Kroah-Hartman
2015-11-13 9:20 ` Borislav Petkov
0 siblings, 1 reply; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:48 UTC (permalink / raw)
To: Borislav Petkov
Cc: linux-kernel, stable, Paolo Bonzini, Laszlo Ersek, H. Peter Anvin,
Thomas Gleixner, Ingo Molnar, Andy Lutomirski, Matt Fleming
On Fri, Nov 06, 2015 at 08:33:15PM +0100, Borislav Petkov wrote:
> Hi Greg,
>
> this one is b0rked and a proper fix is still being discussed. You should
> drop it from the queue.
Thanks for letting me know, now dropped from all trees. If it ever gets
fixed up, please resend the git commit ids to stable@
thanks,
greg k-h
^ permalink raw reply [flat|nested] 113+ messages in thread
* Re: [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range
2015-11-06 19:48 ` Greg Kroah-Hartman
@ 2015-11-13 9:20 ` Borislav Petkov
2015-12-07 7:29 ` Greg Kroah-Hartman
0 siblings, 1 reply; 113+ messages in thread
From: Borislav Petkov @ 2015-11-13 9:20 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, stable, Paolo Bonzini, Laszlo Ersek, H. Peter Anvin,
Thomas Gleixner, Ingo Molnar, Andy Lutomirski, Matt Fleming
On Fri, Nov 06, 2015 at 11:48:30AM -0800, Greg Kroah-Hartman wrote:
> Thanks for letting me know, now dropped from all trees. If it ever gets
> fixed up, please resend the git commit ids to stable@
Ok, you can pick it back up at your earliest convenience. You need to
apply the fix too:
68accac392d8 ("x86/setup: Fix low identity map for >= 2GB kernel range")
Even 0day confirmed:
https://lkml.kernel.org/r/87fv0dm7k3.fsf@yhuang-dev.intel.com
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range
2015-11-13 9:20 ` Borislav Petkov
@ 2015-12-07 7:29 ` Greg Kroah-Hartman
0 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-12-07 7:29 UTC (permalink / raw)
To: Borislav Petkov
Cc: linux-kernel, stable, Paolo Bonzini, Laszlo Ersek, H. Peter Anvin,
Thomas Gleixner, Ingo Molnar, Andy Lutomirski, Matt Fleming
On Fri, Nov 13, 2015 at 10:20:18AM +0100, Borislav Petkov wrote:
> On Fri, Nov 06, 2015 at 11:48:30AM -0800, Greg Kroah-Hartman wrote:
> > Thanks for letting me know, now dropped from all trees. If it ever gets
> > fixed up, please resend the git commit ids to stable@
>
> Ok, you can pick it back up at your earliest convenience. You need to
> apply the fix too:
>
> 68accac392d8 ("x86/setup: Fix low identity map for >= 2GB kernel range")
>
> Even 0day confirmed:
>
> https://lkml.kernel.org/r/87fv0dm7k3.fsf@yhuang-dev.intel.com
Thanks, now queued up.
greg k-h
^ permalink raw reply [flat|nested] 113+ messages in thread
* [PATCH 4.2 032/110] x86/ioapic: Prevent NULL pointer dereference in setup_ioapic_dest()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 031/110] x86/setup: Extend low identity map to cover whole kernel range Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 033/110] mm: make sendfile(2) killable Greg Kroah-Hartman
` (71 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thomas Gleixner
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Werner Pawlitschko <werner.pawlitschko@arcor.de>
commit ababae44108b0e94b58eef6cb5bd830bd040a47f upstream.
Commit 4857c91f0d19 changed the way how irq affinity is setup in
setup_ioapic_dest() from using the core helper function to
unconditionally calling the irq_set_affinity() callback of the
underlying irq chip.
That results in a NULL pointer dereference for the rare case where the
underlying irq chip is lapic_chip which has no irq_set_affinity()
callback. lapic_chip is occasionally used for the timer interrupt (irq
0).
The fix is simple: Check the availability of the callback instead of
calling it unconditionally.
Fixes: 4857c91f0d19 "x86/ioapic: Force affinity setting in setup_ioapic_dest()"
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/io_apic.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -2547,7 +2547,9 @@ void __init setup_ioapic_dest(void)
mask = apic->target_cpus();
chip = irq_data_get_irq_chip(idata);
- chip->irq_set_affinity(idata, mask, false);
+ /* Might be lapic_chip for irq 0 */
+ if (chip->irq_set_affinity)
+ chip->irq_set_affinity(idata, mask, false);
}
}
#endif
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 033/110] mm: make sendfile(2) killable
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 032/110] x86/ioapic: Prevent NULL pointer dereference in setup_ioapic_dest() Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 034/110] fault-inject: fix inverted interval/probability values in printk Greg Kroah-Hartman
` (70 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Kara, Dmitry Vyukov, Al Viro,
Andrew Morton, Linus Torvalds
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.com>
commit 296291cdd1629c308114504b850dc343eabc2782 upstream.
Currently a simple program below issues a sendfile(2) system call which
takes about 62 days to complete in my test KVM instance.
int fd;
off_t off = 0;
fd = open("file", O_RDWR | O_TRUNC | O_SYNC | O_CREAT, 0644);
ftruncate(fd, 2);
lseek(fd, 0, SEEK_END);
sendfile(fd, fd, &off, 0xfffffff);
Now you should not ask kernel to do a stupid stuff like copying 256MB in
2-byte chunks and call fsync(2) after each chunk but if you do, sysadmin
should have a way to stop you.
We actually do have a check for fatal_signal_pending() in
generic_perform_write() which triggers in this path however because we
always succeed in writing something before the check is done, we return
value > 0 from generic_perform_write() and thus the information about
signal gets lost.
Fix the problem by doing the signal check before writing anything. That
way generic_perform_write() returns -EINTR, the error gets propagated up
and the sendfile loop terminates early.
Signed-off-by: Jan Kara <jack@suse.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/filemap.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -2488,6 +2488,11 @@ again:
break;
}
+ if (fatal_signal_pending(current)) {
+ status = -EINTR;
+ break;
+ }
+
status = a_ops->write_begin(file, mapping, pos, bytes, flags,
&page, &fsdata);
if (unlikely(status < 0))
@@ -2525,10 +2530,6 @@ again:
written += copied;
balance_dirty_pages_ratelimited(mapping);
- if (fatal_signal_pending(current)) {
- status = -EINTR;
- break;
- }
} while (iov_iter_count(i));
return written ? written : status;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 034/110] fault-inject: fix inverted interval/probability values in printk
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 033/110] mm: make sendfile(2) killable Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 035/110] tracing: Have stack tracer force RCU to be watching Greg Kroah-Hartman
` (69 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Akinobu Mita, Andrew Morton,
Linus Torvalds
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit bb387002693ed28b2bb0408c5dec65521b71e5f1 upstream.
interval displays the probability and vice versa.
Fixes: 6adc4a22f20bb ("fault-inject: add ratelimit option")
Acked-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/fault-inject.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/fault-inject.c
+++ b/lib/fault-inject.c
@@ -44,7 +44,7 @@ static void fail_dump(struct fault_attr
printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n"
"name %pd, interval %lu, probability %lu, "
"space %d, times %d\n", attr->dname,
- attr->probability, attr->interval,
+ attr->interval, attr->probability,
atomic_read(&attr->space),
atomic_read(&attr->times));
if (attr->verbose > 1)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 035/110] tracing: Have stack tracer force RCU to be watching
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 034/110] fault-inject: fix inverted interval/probability values in printk Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 036/110] bus: arm-ccn: Fix irq affinity setting on CPU migration Greg Kroah-Hartman
` (68 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra, Paul E. McKenney,
Steven Rostedt
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit a2d7629048322ae62bff57f34f5f995e25ed234c upstream.
The stack tracer was triggering the WARN_ON() in module.c:
static void module_assert_mutex_or_preempt(void)
{
#ifdef CONFIG_LOCKDEP
if (unlikely(!debug_locks))
return;
WARN_ON(!rcu_read_lock_sched_held() &&
!lockdep_is_held(&module_mutex));
#endif
}
The reason is that the stack tracer traces all function calls, and some of
those calls happen while exiting or entering user space and idle. Some of
these functions are called after RCU had already stopped watching, as RCU
does not watch userspace or idle CPUs.
If a max stack is hit, then the save_stack_trace() is called, which will
check module addresses and call module_assert_mutex_or_preempt(), and then
trigger the warning. Sad part is, the warning itself will also do a stack
trace and tigger the same warning. That probably should be fixed.
The warning was added by 0be964be0d45 "module: Sanitize RCU usage and
locking" but this bug has probably been around longer. But it's unlikely to
cause much harm, but the new warning causes the system to lock up.
Cc: Peter Zijlstra <peterz@infradead.org>
Cc:"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_stack.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/kernel/trace/trace_stack.c
+++ b/kernel/trace/trace_stack.c
@@ -94,6 +94,12 @@ check_stack(unsigned long ip, unsigned l
local_irq_save(flags);
arch_spin_lock(&max_stack_lock);
+ /*
+ * RCU may not be watching, make it see us.
+ * The stack trace code uses rcu_sched.
+ */
+ rcu_irq_enter();
+
/* In case another CPU set the tracer_frame on us */
if (unlikely(!frame_size))
this_size -= tracer_frame;
@@ -174,6 +180,7 @@ check_stack(unsigned long ip, unsigned l
}
out:
+ rcu_irq_exit();
arch_spin_unlock(&max_stack_lock);
local_irq_restore(flags);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 036/110] bus: arm-ccn: Fix irq affinity setting on CPU migration
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 035/110] tracing: Have stack tracer force RCU to be watching Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 037/110] drm/nouveau/gem: return only valid domain when theres only one Greg Kroah-Hartman
` (67 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Pawel Moll, Arnd Bergmann
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Moll <pawel.moll@arm.com>
commit a0bcbe969f564d1ec08658170dda72a1b7e9053a upstream.
When PMU context is migrating between CPUs, interrupt affinity is set as
well. Only this should not happen when the CCN interrupt is not being
used at all (the driver is using a hrtimer tick instead).
Fixed now.
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/arm-ccn.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/bus/arm-ccn.c
+++ b/drivers/bus/arm-ccn.c
@@ -1188,7 +1188,8 @@ static int arm_ccn_pmu_cpu_notifier(stru
break;
perf_pmu_migrate_context(&dt->pmu, cpu, target);
cpumask_set_cpu(target, &dt->cpu);
- WARN_ON(irq_set_affinity(ccn->irq, &dt->cpu) != 0);
+ if (ccn->irq)
+ WARN_ON(irq_set_affinity(ccn->irq, &dt->cpu) != 0);
default:
break;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 037/110] drm/nouveau/gem: return only valid domain when theres only one
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 036/110] bus: arm-ccn: Fix irq affinity setting on CPU migration Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 038/110] drm/radeon/dpm: dont add pwm attributes if DPM is disabled Greg Kroah-Hartman
` (66 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilia Mirkin, Ben Skeggs
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilia Mirkin <imirkin@alum.mit.edu>
commit 2a6c521bb41ce862e43db46f52e7681d33e8d771 upstream.
On nv50+, we restrict the valid domains to just the one where the buffer
was originally created. However after the buffer is evicted to system
memory, we might move it back to a different domain that was not
originally valid. When sharing the buffer and retrieving its GEM_INFO
data, we still want the domain that will be valid for this buffer in a
pushbuf, not the one where it currently happens to be.
This resolves fdo#92504 and several others. These are due to suspend
evicting all buffers, making it more likely that they temporarily end up
in the wrong place.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92504
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nouveau_gem.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -227,11 +227,12 @@ nouveau_gem_info(struct drm_file *file_p
struct nouveau_bo *nvbo = nouveau_gem_object(gem);
struct nvkm_vma *vma;
- if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+ if (is_power_of_2(nvbo->valid_domains))
+ rep->domain = nvbo->valid_domains;
+ else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
rep->domain = NOUVEAU_GEM_DOMAIN_GART;
else
rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
-
rep->offset = nvbo->bo.offset;
if (cli->vm) {
vma = nouveau_bo_vma_find(nvbo, cli->vm);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 038/110] drm/radeon/dpm: dont add pwm attributes if DPM is disabled
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 037/110] drm/nouveau/gem: return only valid domain when theres only one Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 039/110] drm/amdgpu: add missing dpm check for KV dpm late init Greg Kroah-Hartman
` (65 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 2a7d44f47f53fa1be677f44c73d78b1bcf9c05d9 upstream.
PWM fan control is only available with DPM. If DPM disabled,
don't expose the PWM fan controls to avoid a crash.
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=92524
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_pm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -720,10 +720,14 @@ static umode_t hwmon_attributes_visible(
struct radeon_device *rdev = dev_get_drvdata(dev);
umode_t effective_mode = attr->mode;
- /* Skip limit attributes if DPM is not enabled */
+ /* Skip attributes if DPM is not enabled */
if (rdev->pm.pm_method != PM_METHOD_DPM &&
(attr == &sensor_dev_attr_temp1_crit.dev_attr.attr ||
- attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr))
+ attr == &sensor_dev_attr_temp1_crit_hyst.dev_attr.attr ||
+ attr == &sensor_dev_attr_pwm1.dev_attr.attr ||
+ attr == &sensor_dev_attr_pwm1_enable.dev_attr.attr ||
+ attr == &sensor_dev_attr_pwm1_max.dev_attr.attr ||
+ attr == &sensor_dev_attr_pwm1_min.dev_attr.attr))
return 0;
/* Skip fan attributes if fan is not present */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 039/110] drm/amdgpu: add missing dpm check for KV dpm late init
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 038/110] drm/radeon/dpm: dont add pwm attributes if DPM is disabled Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 043/110] drm/radeon: dont try to recreate sysfs entries on resume Greg Kroah-Hartman
` (64 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 677c884ff6370add1360e2b9558285355ebe2b36 upstream.
Skip dpm late init if dpm is disabled.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2997,6 +2997,9 @@ static int kv_dpm_late_init(void *handle
struct amdgpu_device *adev = (struct amdgpu_device *)handle;
int ret;
+ if (!amdgpu_dpm)
+ return 0;
+
/* init the sysfs and debugfs files late */
ret = amdgpu_pm_sysfs_init(adev);
if (ret)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 043/110] drm/radeon: dont try to recreate sysfs entries on resume
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 039/110] drm/amdgpu: add missing dpm check for KV dpm late init Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 044/110] drm/amdgpu: " Greg Kroah-Hartman
` (63 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 49abb26651167c892393cd9f2ad23df429645ed9 upstream.
Fixes a harmless error message caused by:
51a4726b04e880fdd9b4e0e58b13f70b0a68a7f5
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon.h | 1 +
drivers/gpu/drm/radeon/radeon_pm.c | 35 +++++++++++++++++++++--------------
2 files changed, 22 insertions(+), 14 deletions(-)
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1658,6 +1658,7 @@ struct radeon_pm {
u8 fan_max_rpm;
/* dpm */
bool dpm_enabled;
+ bool sysfs_initialized;
struct radeon_dpm dpm;
};
--- a/drivers/gpu/drm/radeon/radeon_pm.c
+++ b/drivers/gpu/drm/radeon/radeon_pm.c
@@ -1533,19 +1533,23 @@ int radeon_pm_late_init(struct radeon_de
if (rdev->pm.pm_method == PM_METHOD_DPM) {
if (rdev->pm.dpm_enabled) {
- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state);
- if (ret)
- DRM_ERROR("failed to create device file for dpm state\n");
- ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level);
- if (ret)
- DRM_ERROR("failed to create device file for dpm state\n");
- /* XXX: these are noops for dpm but are here for backwards compat */
- ret = device_create_file(rdev->dev, &dev_attr_power_profile);
- if (ret)
- DRM_ERROR("failed to create device file for power profile\n");
- ret = device_create_file(rdev->dev, &dev_attr_power_method);
- if (ret)
- DRM_ERROR("failed to create device file for power method\n");
+ if (!rdev->pm.sysfs_initialized) {
+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_state);
+ if (ret)
+ DRM_ERROR("failed to create device file for dpm state\n");
+ ret = device_create_file(rdev->dev, &dev_attr_power_dpm_force_performance_level);
+ if (ret)
+ DRM_ERROR("failed to create device file for dpm state\n");
+ /* XXX: these are noops for dpm but are here for backwards compat */
+ ret = device_create_file(rdev->dev, &dev_attr_power_profile);
+ if (ret)
+ DRM_ERROR("failed to create device file for power profile\n");
+ ret = device_create_file(rdev->dev, &dev_attr_power_method);
+ if (ret)
+ DRM_ERROR("failed to create device file for power method\n");
+ if (!ret)
+ rdev->pm.sysfs_initialized = true;
+ }
mutex_lock(&rdev->pm.mutex);
ret = radeon_dpm_late_enable(rdev);
@@ -1561,7 +1565,8 @@ int radeon_pm_late_init(struct radeon_de
}
}
} else {
- if (rdev->pm.num_power_states > 1) {
+ if ((rdev->pm.num_power_states > 1) &&
+ (!rdev->pm.sysfs_initialized)) {
/* where's the best place to put these? */
ret = device_create_file(rdev->dev, &dev_attr_power_profile);
if (ret)
@@ -1569,6 +1574,8 @@ int radeon_pm_late_init(struct radeon_de
ret = device_create_file(rdev->dev, &dev_attr_power_method);
if (ret)
DRM_ERROR("failed to create device file for power method\n");
+ if (!ret)
+ rdev->pm.sysfs_initialized = true;
}
}
return ret;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 044/110] drm/amdgpu: dont try to recreate sysfs entries on resume
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 043/110] drm/radeon: dont try to recreate sysfs entries on resume Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 048/110] iio: st_accel: fix interrupt handling on LIS3LV02 Greg Kroah-Hartman
` (62 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alex Deucher
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit c86f5ebfbd147d1a228ab89ee1658e18939bd7ad upstream.
Fixes an error on resume caused by:
fa022a9b65d2886486a022fd66b20c823cd76ad9
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c | 5 +++++
2 files changed, 6 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -1583,6 +1583,7 @@ struct amdgpu_pm {
u8 fan_max_rpm;
/* dpm */
bool dpm_enabled;
+ bool sysfs_initialized;
struct amdgpu_dpm dpm;
const struct firmware *fw; /* SMC firmware */
uint32_t fw_version;
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_pm.c
@@ -693,6 +693,9 @@ int amdgpu_pm_sysfs_init(struct amdgpu_d
{
int ret;
+ if (adev->pm.sysfs_initialized)
+ return 0;
+
if (adev->pm.funcs->get_temperature == NULL)
return 0;
adev->pm.int_hwmon_dev = hwmon_device_register_with_groups(adev->dev,
@@ -721,6 +724,8 @@ int amdgpu_pm_sysfs_init(struct amdgpu_d
return ret;
}
+ adev->pm.sysfs_initialized = true;
+
return 0;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 048/110] iio: st_accel: fix interrupt handling on LIS3LV02
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 044/110] drm/amdgpu: " Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 049/110] iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb() Greg Kroah-Hartman
` (61 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Denis CIOCCA, Linus Walleij,
Jonathan Cameron
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 61fd56309165d4790f99462d893b099f0b07312a upstream.
This accelerometer accidentally either emits a DRDY signal or an
IRQ signal. Accidentally I activated the IRQ signal as I thought
it was analogous to the interrupt generator on other ST
accelerometers. This was wrong. After this patch generic_buffer
gives a nice stream of accelerometer readings.
Fixes: 3acddf74f807778f "iio: st-sensors: add support for lis3lv02d accelerometer"
Cc: Denis CIOCCA <denis.ciocca@st.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/st_accel_core.c | 6 ------
1 file changed, 6 deletions(-)
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -149,8 +149,6 @@
#define ST_ACCEL_4_BDU_MASK 0x40
#define ST_ACCEL_4_DRDY_IRQ_ADDR 0x21
#define ST_ACCEL_4_DRDY_IRQ_INT1_MASK 0x04
-#define ST_ACCEL_4_IG1_EN_ADDR 0x21
-#define ST_ACCEL_4_IG1_EN_MASK 0x08
#define ST_ACCEL_4_MULTIREAD_BIT true
/* CUSTOM VALUES FOR SENSOR 5 */
@@ -484,10 +482,6 @@ static const struct st_sensor_settings s
.drdy_irq = {
.addr = ST_ACCEL_4_DRDY_IRQ_ADDR,
.mask_int1 = ST_ACCEL_4_DRDY_IRQ_INT1_MASK,
- .ig1 = {
- .en_addr = ST_ACCEL_4_IG1_EN_ADDR,
- .en_mask = ST_ACCEL_4_IG1_EN_MASK,
- },
},
.multi_read_bit = ST_ACCEL_4_MULTIREAD_BIT,
.bootime = 2, /* guess */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 049/110] iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 048/110] iio: st_accel: fix interrupt handling on LIS3LV02 Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 050/110] rbd: require stable pages if message data CRCs are enabled Greg Kroah-Hartman
` (60 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jonathan Cameron
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit eda7d0f38aaf50dbb2a2de15e8db386c4f6f65fc upstream.
"num_read" is in byte units but we are write u16s so we end up write
twice as much as intended.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/iio/accel/sca3000_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/accel/sca3000_ring.c
+++ b/drivers/staging/iio/accel/sca3000_ring.c
@@ -116,7 +116,7 @@ static int sca3000_read_first_n_hw_rb(st
if (ret)
goto error_ret;
- for (i = 0; i < num_read; i++)
+ for (i = 0; i < num_read / sizeof(u16); i++)
*(((u16 *)rx) + i) = be16_to_cpup((__be16 *)rx + i);
if (copy_to_user(buf, rx, num_read))
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 050/110] rbd: require stable pages if message data CRCs are enabled
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 049/110] iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb() Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 051/110] rbd: dont leak parent_spec in rbd_dev_probe_parent() Greg Kroah-Hartman
` (59 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ronny Hegewald, Ilya Dryomov
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronny Hegewald <ronny.hegewald@online.de>
commit bae818ee1577c27356093901a0ea48f672eda514 upstream.
rbd requires stable pages, as it performs a crc of the page data before
they are send to the OSDs.
But since kernel 3.9 (patch 1d1d1a767206fbe5d4c69493b7e6d2a8d08cc0a0
"mm: only enforce stable page writes if the backing device requires
it") it is not assumed anymore that block devices require stable pages.
This patch sets the necessary flag to get stable pages back for rbd.
In a ceph installation that provides multiple ext4 formatted rbd
devices "bad crc" messages appeared regularly (ca 1 message every 1-2
minutes on every OSD that provided the data for the rbd) in the
OSD-logs before this patch. After this patch this messages are pretty
much gone (only ca 1-2 / month / OSD).
Signed-off-by: Ronny Hegewald <Ronny.Hegewald@online.de>
[idryomov@gmail.com: require stable pages only in crc case, changelog]
[idryomov@gmail.com: backport to 3.18-4.2: context]
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/rbd.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3819,6 +3819,9 @@ static int rbd_init_disk(struct rbd_devi
q->limits.discard_zeroes_data = 1;
blk_queue_merge_bvec(q, rbd_merge_bvec);
+ if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC))
+ q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES;
+
disk->queue = q;
q->queuedata = rbd_dev;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 051/110] rbd: dont leak parent_spec in rbd_dev_probe_parent()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 050/110] rbd: require stable pages if message data CRCs are enabled Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:18 ` [PATCH 4.2 052/110] rbd: prevent kernel stack blow up on rbd map Greg Kroah-Hartman
` (58 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Alex Elder
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 1f2c6651f69c14d0d3a9cfbda44ea101b02160ba upstream.
Currently we leak parent_spec and trigger a "parent reference
underflow" warning if rbd_dev_create() in rbd_dev_probe_parent() fails.
The problem is we take the !parent out_err branch and that only drops
refcounts; parent_spec that would've been freed had we called
rbd_dev_unparent() remains and triggers rbd_warn() in
rbd_dev_parent_put() - at that point we have parent_spec != NULL and
parent_ref == 0, so counter ends up being -1 after the decrement.
Redo rbd_dev_probe_parent() to fix this.
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/rbd.c | 36 ++++++++++++++++--------------------
1 file changed, 16 insertions(+), 20 deletions(-)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -5175,41 +5175,37 @@ out_err:
static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
{
struct rbd_device *parent = NULL;
- struct rbd_spec *parent_spec;
- struct rbd_client *rbdc;
int ret;
if (!rbd_dev->parent_spec)
return 0;
- /*
- * We need to pass a reference to the client and the parent
- * spec when creating the parent rbd_dev. Images related by
- * parent/child relationships always share both.
- */
- parent_spec = rbd_spec_get(rbd_dev->parent_spec);
- rbdc = __rbd_get_client(rbd_dev->rbd_client);
- ret = -ENOMEM;
- parent = rbd_dev_create(rbdc, parent_spec, NULL);
- if (!parent)
+ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec,
+ NULL);
+ if (!parent) {
+ ret = -ENOMEM;
goto out_err;
+ }
+
+ /*
+ * Images related by parent/child relationships always share
+ * rbd_client and spec/parent_spec, so bump their refcounts.
+ */
+ __rbd_get_client(rbd_dev->rbd_client);
+ rbd_spec_get(rbd_dev->parent_spec);
ret = rbd_dev_image_probe(parent, false);
if (ret < 0)
goto out_err;
+
rbd_dev->parent = parent;
atomic_set(&rbd_dev->parent_ref, 1);
-
return 0;
+
out_err:
- if (parent) {
- rbd_dev_unparent(rbd_dev);
+ rbd_dev_unparent(rbd_dev);
+ if (parent)
rbd_dev_destroy(parent);
- } else {
- rbd_put_client(rbdc);
- rbd_spec_put(parent_spec);
- }
-
return ret;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 052/110] rbd: prevent kernel stack blow up on rbd map
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 051/110] rbd: dont leak parent_spec in rbd_dev_probe_parent() Greg Kroah-Hartman
@ 2015-11-06 19:18 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 053/110] ARM: EXYNOS: Fix double of_node_put() when parsing child power domains Greg Kroah-Hartman
` (57 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:18 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Josh Durgin
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 6d69bb536bac0d403d83db1ca841444981b280cd upstream.
Mapping an image with a long parent chain (e.g. image foo, whose parent
is bar, whose parent is baz, etc) currently leads to a kernel stack
overflow, due to the following recursion in the reply path:
rbd_osd_req_callback()
rbd_obj_request_complete()
rbd_img_obj_callback()
rbd_img_parent_read_callback()
rbd_obj_request_complete()
...
Limit the parent chain to 16 images, which is ~5K worth of stack. When
the above recursion is eliminated, this limit can be lifted.
Fixes: http://tracker.ceph.com/issues/12538
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/rbd.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -96,6 +96,8 @@ static int atomic_dec_return_safe(atomic
#define RBD_MINORS_PER_MAJOR 256
#define RBD_SINGLE_MAJOR_PART_SHIFT 4
+#define RBD_MAX_PARENT_CHAIN_LEN 16
+
#define RBD_SNAP_DEV_NAME_PREFIX "snap_"
#define RBD_MAX_SNAP_NAME_LEN \
(NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1))
@@ -426,7 +428,7 @@ static ssize_t rbd_add_single_major(stru
size_t count);
static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf,
size_t count);
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping);
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth);
static void rbd_spec_put(struct rbd_spec *spec);
static int rbd_dev_id_to_minor(int dev_id)
@@ -5172,7 +5174,12 @@ out_err:
return ret;
}
-static int rbd_dev_probe_parent(struct rbd_device *rbd_dev)
+/*
+ * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() ->
+ * rbd_dev_image_probe() recursion depth, which means it's also the
+ * length of the already discovered part of the parent chain.
+ */
+static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth)
{
struct rbd_device *parent = NULL;
int ret;
@@ -5180,6 +5187,12 @@ static int rbd_dev_probe_parent(struct r
if (!rbd_dev->parent_spec)
return 0;
+ if (++depth > RBD_MAX_PARENT_CHAIN_LEN) {
+ pr_info("parent chain is too long (%d)\n", depth);
+ ret = -EINVAL;
+ goto out_err;
+ }
+
parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec,
NULL);
if (!parent) {
@@ -5194,7 +5207,7 @@ static int rbd_dev_probe_parent(struct r
__rbd_get_client(rbd_dev->rbd_client);
rbd_spec_get(rbd_dev->parent_spec);
- ret = rbd_dev_image_probe(parent, false);
+ ret = rbd_dev_image_probe(parent, depth);
if (ret < 0)
goto out_err;
@@ -5323,7 +5336,7 @@ static void rbd_dev_image_release(struct
* parent), initiate a watch on its header object before using that
* object to get detailed information about the rbd image.
*/
-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping)
+static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth)
{
int ret;
@@ -5341,7 +5354,7 @@ static int rbd_dev_image_probe(struct rb
if (ret)
goto err_out_format;
- if (mapping) {
+ if (!depth) {
ret = rbd_dev_header_watch_sync(rbd_dev);
if (ret) {
if (ret == -ENOENT)
@@ -5362,7 +5375,7 @@ static int rbd_dev_image_probe(struct rb
* Otherwise this is a parent image, identified by pool, image
* and snap ids - need to fill in names for those ids.
*/
- if (mapping)
+ if (!depth)
ret = rbd_spec_fill_snap_id(rbd_dev);
else
ret = rbd_spec_fill_names(rbd_dev);
@@ -5384,12 +5397,12 @@ static int rbd_dev_image_probe(struct rb
* Need to warn users if this image is the one being
* mapped and has a parent.
*/
- if (mapping && rbd_dev->parent_spec)
+ if (!depth && rbd_dev->parent_spec)
rbd_warn(rbd_dev,
"WARNING: kernel layering is EXPERIMENTAL!");
}
- ret = rbd_dev_probe_parent(rbd_dev);
+ ret = rbd_dev_probe_parent(rbd_dev, depth);
if (ret)
goto err_out_probe;
@@ -5400,7 +5413,7 @@ static int rbd_dev_image_probe(struct rb
err_out_probe:
rbd_dev_unprobe(rbd_dev);
err_out_watch:
- if (mapping)
+ if (!depth)
rbd_dev_header_unwatch_sync(rbd_dev);
out_header_name:
kfree(rbd_dev->header_name);
@@ -5463,7 +5476,7 @@ static ssize_t do_rbd_add(struct bus_typ
spec = NULL; /* rbd_dev now owns this */
rbd_opts = NULL; /* rbd_dev now owns this */
- rc = rbd_dev_image_probe(rbd_dev, true);
+ rc = rbd_dev_image_probe(rbd_dev, 0);
if (rc < 0)
goto err_out_rbd_dev;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 053/110] ARM: EXYNOS: Fix double of_node_put() when parsing child power domains
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2015-11-06 19:18 ` [PATCH 4.2 052/110] rbd: prevent kernel stack blow up on rbd map Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 054/110] ARM: orion: Fix DSA platform device after mvmdio conversion Greg Kroah-Hartman
` (56 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Kukjin Kim
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
commit 51a6256b00008a3c520f6f31bcd62cd15cb05960 upstream.
On each next iteration of for_each_compatible_node() the reference
counter for current device node is already decreased by the loop
iterator. The manual call to of_node_get() is required only on loop
break which is not happening here.
The double of_node_get() (with enabled CONFIG_OF_DYNAMIC) lead to
decreasing the counter below expected, initial value.
Fixes: fe4034a3fad7 ("ARM: EXYNOS: Add missing of_node_put() when parsing power domains")
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Kukjin Kim <kgene@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-exynos/pm_domains.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/arch/arm/mach-exynos/pm_domains.c
+++ b/arch/arm/mach-exynos/pm_domains.c
@@ -200,15 +200,15 @@ no_clk:
args.args_count = 0;
child_domain = of_genpd_get_from_provider(&args);
if (IS_ERR(child_domain))
- goto next_pd;
+ continue;
if (of_parse_phandle_with_args(np, "power-domains",
"#power-domain-cells", 0, &args) != 0)
- goto next_pd;
+ continue;
parent_domain = of_genpd_get_from_provider(&args);
if (IS_ERR(parent_domain))
- goto next_pd;
+ continue;
if (pm_genpd_add_subdomain(parent_domain, child_domain))
pr_warn("%s failed to add subdomain: %s\n",
@@ -216,8 +216,6 @@ no_clk:
else
pr_info("%s has as child subdomain: %s.\n",
parent_domain->name, child_domain->name);
-next_pd:
- of_node_put(np);
}
return 0;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 054/110] ARM: orion: Fix DSA platform device after mvmdio conversion
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 053/110] ARM: EXYNOS: Fix double of_node_put() when parsing child power domains Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:32 ` Florian Fainelli
2015-11-06 19:19 ` [PATCH 4.2 055/110] ARM: mvebu: correct a385-db-ap compatible string Greg Kroah-Hartman
` (55 subsequent siblings)
102 siblings, 1 reply; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frans van de Wiel, Florian Fainelli,
Gregory CLEMENT
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
commit d836ace65ee98d7079bc3c5afdbcc0e27dca20a3 upstream.
DSA expects the host_dev pointer to be the device structure associated
with the MDIO bus controller driver. First commit breaking that was
c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO
driver"), and then, it got completely under the radar for a while.
Reported-by: Frans van de Wiel <fvdw@fvdw.eu>
Fixes: c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/plat-orion/common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/plat-orion/common.c
+++ b/arch/arm/plat-orion/common.c
@@ -495,7 +495,7 @@ void __init orion_ge00_switch_init(struc
d->netdev = &orion_ge00.dev;
for (i = 0; i < d->nr_chips; i++)
- d->chip[i].host_dev = &orion_ge00_shared.dev;
+ d->chip[i].host_dev = &orion_ge_mvmdio.dev;
orion_switch_device.dev.platform_data = d;
platform_device_register(&orion_switch_device);
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 054/110] ARM: orion: Fix DSA platform device after mvmdio conversion
2015-11-06 19:19 ` [PATCH 4.2 054/110] ARM: orion: Fix DSA platform device after mvmdio conversion Greg Kroah-Hartman
@ 2015-11-06 19:32 ` Florian Fainelli
0 siblings, 0 replies; 113+ messages in thread
From: Florian Fainelli @ 2015-11-06 19:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Frans van de Wiel, Gregory CLEMENT
On 06/11/15 11:19, Greg Kroah-Hartman wrote:
> 4.2-stable review patch. If anyone has any objections, please let me know.
Thanks this patch is also applicable all the way down to 3.18. I have
sent a reply for the 3.10 through 3.17 kernels as the structure member
had a slightly different name.
>
> ------------------
>
> From: Florian Fainelli <f.fainelli@gmail.com>
>
> commit d836ace65ee98d7079bc3c5afdbcc0e27dca20a3 upstream.
>
> DSA expects the host_dev pointer to be the device structure associated
> with the MDIO bus controller driver. First commit breaking that was
> c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO
> driver"), and then, it got completely under the radar for a while.
>
> Reported-by: Frans van de Wiel <fvdw@fvdw.eu>
> Fixes: c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO driver")
> Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
> Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> arch/arm/plat-orion/common.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/arch/arm/plat-orion/common.c
> +++ b/arch/arm/plat-orion/common.c
> @@ -495,7 +495,7 @@ void __init orion_ge00_switch_init(struc
>
> d->netdev = &orion_ge00.dev;
> for (i = 0; i < d->nr_chips; i++)
> - d->chip[i].host_dev = &orion_ge00_shared.dev;
> + d->chip[i].host_dev = &orion_ge_mvmdio.dev;
> orion_switch_device.dev.platform_data = d;
>
> platform_device_register(&orion_switch_device);
>
>
--
Florian
^ permalink raw reply [flat|nested] 113+ messages in thread
* [PATCH 4.2 055/110] ARM: mvebu: correct a385-db-ap compatible string
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 054/110] ARM: orion: Fix DSA platform device after mvmdio conversion Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 056/110] ARM: dts: berlin: change BG2Qs USB PHY compatible Greg Kroah-Hartman
` (54 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marcin Wojtas, Gregory CLEMENT
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcin Wojtas <mw@semihalf.com>
commit db347f1a5304d68c68c52f19971924b1e5842f3c upstream.
This commit enables standby support on Armada 385 DB-AP board, because
the PM initalization routine requires "marvell,armada380" compatible
string for all Armada 38x-based platforms.
Beside the compatible "marvell,armada38x" was wrong and should be fixed
in the stable kernels too.
[gregory.clement@free-electrons.com: add information, about the fixes]
Fixes: e5ee12817e9ea ("ARM: mvebu: Add Armada 385 Access Point
Development Board support")
Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/armada-385-db-ap.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/armada-385-db-ap.dts
+++ b/arch/arm/boot/dts/armada-385-db-ap.dts
@@ -46,7 +46,7 @@
/ {
model = "Marvell Armada 385 Access Point Development Board";
- compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada38x";
+ compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada380";
chosen {
stdout-path = "serial1:115200n8";
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 056/110] ARM: dts: berlin: change BG2Qs USB PHY compatible
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 055/110] ARM: mvebu: correct a385-db-ap compatible string Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 057/110] ARM: dts: Fix audio card detection on Peach boards Greg Kroah-Hartman
` (53 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Hebb, Sebastian Hesselbarth
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hebb <tommyhebb@gmail.com>
commit 1f744fd317dc55cadd7132c57c499e3117aea01d upstream.
Currently, BG2Q shares a compatible with BG2. This is incorrect, since
BG2 and BG2Q use different USB PLL dividers. In reality, BG2Q shares a
divider with BG2CD. Change BG2Q's USB PHY compatible string to reflect
that.
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Signed-off-by: Sebastian Hesselbarth <sebastian.hesselbarth@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/berlin2q.dtsi | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/arm/boot/dts/berlin2q.dtsi
+++ b/arch/arm/boot/dts/berlin2q.dtsi
@@ -152,7 +152,7 @@
};
usb_phy2: phy@a2f400 {
- compatible = "marvell,berlin2-usb-phy";
+ compatible = "marvell,berlin2cd-usb-phy";
reg = <0xa2f400 0x128>;
#phy-cells = <0>;
resets = <&chip_rst 0x104 14>;
@@ -170,7 +170,7 @@
};
usb_phy0: phy@b74000 {
- compatible = "marvell,berlin2-usb-phy";
+ compatible = "marvell,berlin2cd-usb-phy";
reg = <0xb74000 0x128>;
#phy-cells = <0>;
resets = <&chip_rst 0x104 12>;
@@ -178,7 +178,7 @@
};
usb_phy1: phy@b78000 {
- compatible = "marvell,berlin2-usb-phy";
+ compatible = "marvell,berlin2cd-usb-phy";
reg = <0xb78000 0x128>;
#phy-cells = <0>;
resets = <&chip_rst 0x104 13>;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 057/110] ARM: dts: Fix audio card detection on Peach boards
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 056/110] ARM: dts: berlin: change BG2Qs USB PHY compatible Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 058/110] ARM: dts: imx7d: Fix UART2 base address Greg Kroah-Hartman
` (52 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alim Akhtar, Krzysztof Kozlowski,
Kukjin Kim
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alim Akhtar <alim.akhtar@samsung.com>
commit b8bb9baad27e455c467e8fac47eebadbe765c18f upstream.
Since commit 2fad972d45c4 ("ARM: dts: Add mclk entry for Peach boards"),
sound card detection is broken on peach boards and gives below errors:
[ 3.630457] max98090 7-0010: MAX98091 REVID=0x51
[ 3.634233] max98090 7-0010: use default 2.8v micbias
[ 3.640985] snow-audio sound: HiFi <-> 3830000.i2s mapping ok
[ 3.645307] max98090 7-0010: Invalid master clock frequency
[ 3.650824] snow-audio sound: ASoC: Peach-Pi-I2S-MAX98091 late_probe() failed: -22
[ 3.658914] snow-audio sound: snd_soc_register_card failed (-22)
[ 3.664366] snow-audio: probe of sound failed with error -22
This patch adds missing assigned-clocks and assigned-clock-parents for
pmu_system_controller node which is used as "mclk" for audio codec.
Fixes: 2fad972d45c4 ("ARM: dts: Add mclk entry for Peach boards")
Signed-off-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Kukjin Kim <kgene@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/exynos5420-peach-pit.dts | 5 +++++
arch/arm/boot/dts/exynos5800-peach-pi.dts | 5 +++++
2 files changed, 10 insertions(+)
--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts
+++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts
@@ -915,6 +915,11 @@
};
};
+&pmu_system_controller {
+ assigned-clocks = <&pmu_system_controller 0>;
+ assigned-clock-parents = <&clock CLK_FIN_PLL>;
+};
+
&rtc {
status = "okay";
clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>;
--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts
+++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts
@@ -878,6 +878,11 @@
};
};
+&pmu_system_controller {
+ assigned-clocks = <&pmu_system_controller 0>;
+ assigned-clock-parents = <&clock CLK_FIN_PLL>;
+};
+
&rtc {
status = "okay";
clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 058/110] ARM: dts: imx7d: Fix UART2 base address
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 057/110] ARM: dts: Fix audio card detection on Peach boards Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 059/110] ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on Greg Kroah-Hartman
` (51 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Fabio Estevam, Shawn Guo
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@freescale.com>
commit 178b2d09afc05a46f68b190c6594f3a429bc2385 upstream.
The UART2 memory space starts at address 0x30890000 (UART2_URXD).
Fix it so that UART2 can be used.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Fixes: 949673450291 ("ARM: dts: add imx7d soc dtsi file")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/imx7d.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/imx7d.dtsi
+++ b/arch/arm/boot/dts/imx7d.dtsi
@@ -340,10 +340,10 @@
status = "disabled";
};
- uart2: serial@30870000 {
+ uart2: serial@30890000 {
compatible = "fsl,imx7d-uart",
"fsl,imx6q-uart";
- reg = <0x30870000 0x10000>;
+ reg = <0x30890000 0x10000>;
interrupts = <GIC_SPI 27 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&clks IMX7D_UART2_ROOT_CLK>,
<&clks IMX7D_UART2_ROOT_CLK>;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 059/110] ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 058/110] ARM: dts: imx7d: Fix UART2 base address Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 060/110] ARM: ux500: modify initial levelshifter status Greg Kroah-Hartman
` (50 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kishon Vijay Abraham I,
Tomi Valkeinen, Louis McCarthy, Nishanth Menon, Tony Lindgren
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
commit 7e381ec6a36aa44f15fc1a76e6efb9e2cd942e61 upstream.
LDO1 regulator (VDD_SD) is connected to SoC's vddshv8. vddshv8 needs to
be kept always powered (see commit 5a0f93c6576a ("ARM: dts: Add
am57xx-beagle-x15"), but at the moment VDD_SD is enabled/disabled
depending on whether an SD card is inserted or not.
This patch sets LDO1 regulator to always-on.
This patch has a side effect of fixing another issue, HDMI DDC not
working when SD card is not inserted:
Why this happens is that the tpd12s015 (HDMI level shifter/ESD
protection chip) has LS_OE GPIO input, which needs to be enabled for the
HDMI DDC to work. LS_OE comes from gpio6_28. The pin that provides
gpio6_28 is powered by vddshv8, and vddshv8 comes from VDD_SD.
So when SD card is not inserted, VDD_SD is disabled, and LS_OE stays
off.
The proper fix for the HDMI DDC issue would be to maybe have the pinctrl
framework manage the pin specific power.
Apparently this fixes also a third issue (copy paste from Kishon's
patch):
ldo1_reg in addition to being connected to the io lines is also
connected to the card detect line. On card removal, omap_hsmmc
driver does a regulator_disable causing card detect line to be
pulled down. This raises a card insertion interrupt and once the
MMC core detects there is no card inserted, it does a
regulator disable which again raises a card insertion interrupt.
This happens in a loop causing infinite MMC interrupts.
Fixes: 5a0f93c6576a ("ARM: dts: Add am57xx-beagle-x15")
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Reported-by: Louis McCarthy <compeoree@gmail.com>
Acked-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/am57xx-beagle-x15.dts | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
+++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
@@ -415,11 +415,12 @@
/* SMPS9 unused */
ldo1_reg: ldo1 {
- /* VDD_SD */
+ /* VDD_SD / VDDSHV8 */
regulator-name = "ldo1";
regulator-min-microvolt = <1800000>;
regulator-max-microvolt = <3300000>;
regulator-boot-on;
+ regulator-always-on;
};
ldo2_reg: ldo2 {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 060/110] ARM: ux500: modify initial levelshifter status
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 059/110] ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 061/110] ARM: OMAP1: fix incorrect INT_DMA_LCD Greg Kroah-Hartman
` (49 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Linus Walleij, Arnd Bergmann
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 83bf6b13834d9c926905e45cdfda23fe218fc598 upstream.
commit 1d8aca9df612f5751892fb2642d72536f2f48fd0
"ARM: ux500: fix MMC/SD card regression"
fixed broken the level shifter: it should be default ON
but became default OFF.
Fixes: 1d8aca9df612 "ARM: ux500: fix MMC/SD card regression"
Reported-and-tested-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/ste-hrefv60plus.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/boot/dts/ste-hrefv60plus.dtsi
+++ b/arch/arm/boot/dts/ste-hrefv60plus.dtsi
@@ -56,7 +56,7 @@
/* VMMCI level-shifter enable */
default_hrefv60_cfg2 {
pins = "GPIO169_D22";
- ste,config = <&gpio_out_lo>;
+ ste,config = <&gpio_out_hi>;
};
/* VMMCI level-shifter voltage select */
default_hrefv60_cfg3 {
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 061/110] ARM: OMAP1: fix incorrect INT_DMA_LCD
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 060/110] ARM: ux500: modify initial levelshifter status Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 062/110] ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h Greg Kroah-Hartman
` (48 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aaro Koskinen, Tony Lindgren
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaro Koskinen <aaro.koskinen@iki.fi>
commit 1bd5dfe41b994a6e793363894befef76626965a9 upstream.
Commit 685e2d08c54b ("ARM: OMAP1: Change interrupt numbering for
sparse IRQ") turned on SPARSE_IRQ on OMAP1, but forgot to change
the number of INT_DMA_LCD. This broke the boot at least on Nokia 770,
where the device hangs during framebuffer initialization.
Fix by defining INT_DMA_LCD like the other interrupts.
Fixes: 685e2d08c54b ("ARM: OMAP1: Change interrupt numbering for sparse IRQ")
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/omap-dma.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/omap-dma.h
+++ b/include/linux/omap-dma.h
@@ -17,7 +17,7 @@
#include <linux/platform_device.h>
-#define INT_DMA_LCD 25
+#define INT_DMA_LCD (NR_IRQS_LEGACY + 25)
#define OMAP1_DMA_TOUT_IRQ (1 << 0)
#define OMAP_DMA_DROP_IRQ (1 << 1)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 062/110] ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 061/110] ARM: OMAP1: fix incorrect INT_DMA_LCD Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 063/110] ARM: 8449/1: fix bug in vdsomunge swab32 macro Greg Kroah-Hartman
` (47 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, H. Nikolaus Schaller, Nathan Lynch,
Russell King
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Nikolaus Schaller" <hns@goldelico.com>
commit 8a603f91cc4848ab1a0458bc065aa9f64322e123 upstream.
If the host toolchain is not glibc based then the arm kernel build
fails with
HOSTCC arch/arm/vdso/vdsomunge
arch/arm/vdso/vdsomunge.c:48:22: fatal error: byteswap.h: No such file or directory
Observed: with omap2plus_defconfig and compile on Mac OS X with arm ELF
cross-compiler.
Reason: byteswap.h is a glibc only header.
Solution: replace by private byte-swapping macros (taken from
arch/mips/boot/elf2ecoff.c and kindly improved by Russell King)
Tested to compile on Mac OS X 10.9.5 host.
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/vdso/vdsomunge.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/arch/arm/vdso/vdsomunge.c
+++ b/arch/arm/vdso/vdsomunge.c
@@ -45,7 +45,6 @@
* it does.
*/
-#include <byteswap.h>
#include <elf.h>
#include <errno.h>
#include <fcntl.h>
@@ -59,6 +58,16 @@
#include <sys/types.h>
#include <unistd.h>
+#define swab16(x) \
+ ((((x) & 0x00ff) << 8) | \
+ (((x) & 0xff00) >> 8))
+
+#define swab32(x) \
+ ((((x) & 0x000000ff) << 24) | \
+ (((x) & 0x0000ff00) << 8) | \
+ (((x) & 0x00ff0000) >> 8) | \
+ (((x) & 0xff000000) << 24))
+
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
#define HOST_ORDER ELFDATA2LSB
#elif __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
@@ -104,17 +113,17 @@ static void cleanup(void)
static Elf32_Word read_elf_word(Elf32_Word word, bool swap)
{
- return swap ? bswap_32(word) : word;
+ return swap ? swab32(word) : word;
}
static Elf32_Half read_elf_half(Elf32_Half half, bool swap)
{
- return swap ? bswap_16(half) : half;
+ return swap ? swab16(half) : half;
}
static void write_elf_word(Elf32_Word val, Elf32_Word *dst, bool swap)
{
- *dst = swap ? bswap_32(val) : val;
+ *dst = swap ? swab32(val) : val;
}
int main(int argc, char **argv)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 063/110] ARM: 8449/1: fix bug in vdsomunge swab32 macro
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 062/110] ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 064/110] Revert "ARM64: unwind: Fix PC calculation" Greg Kroah-Hartman
` (46 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Efraim Yawitz, H. Nikolaus Schaller,
Nathan Lynch, Russell King
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "H. Nikolaus Schaller" <hns@goldelico.com>
commit 38850d786a799c3ff2de0dc1980902c3263698dc upstream.
Commit 8a603f91cc48 ("ARM: 8445/1: fix vdsomunge not to depend on
glibc specific byteswap.h") unfortunately introduced a bug created but
not found during discussion and patch simplification.
Reported-by: Efraim Yawitz <efraim.yawitz@gmail.com>
Signed-off-by: H. Nikolaus Schaller <hns@goldelico.com>
Fixes: 8a603f91cc48 ("ARM: 8445/1: fix vdsomunge not to depend on glibc specific byteswap.h")
Signed-off-by: Nathan Lynch <nathan_lynch@mentor.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/vdso/vdsomunge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/vdso/vdsomunge.c
+++ b/arch/arm/vdso/vdsomunge.c
@@ -66,7 +66,7 @@
((((x) & 0x000000ff) << 24) | \
(((x) & 0x0000ff00) << 8) | \
(((x) & 0x00ff0000) >> 8) | \
- (((x) & 0xff000000) << 24))
+ (((x) & 0xff000000) >> 24))
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
#define HOST_ORDER ELFDATA2LSB
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 064/110] Revert "ARM64: unwind: Fix PC calculation"
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 063/110] ARM: 8449/1: fix bug in vdsomunge swab32 macro Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 065/110] arm64: kernel: fix tcr_el1.t0sz restore on systems with extended idmap Greg Kroah-Hartman
` (45 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Will Deacon
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 9702970c7bd3e2d6fecb642a190269131d4ac16c upstream.
This reverts commit e306dfd06fcb44d21c80acb8e5a88d55f3d1cf63.
With this patch applied, we were the only architecture making this sort
of adjustment to the PC calculation in the unwinder. This causes
problems for ftrace, where the PC values are matched against the
contents of the stack frames in the callchain and fail to match any
records after the address adjustment.
Whilst there has been some effort to change ftrace to workaround this,
those patches are not yet ready for mainline and, since we're the odd
architecture in this regard, let's just step in line with other
architectures (like arch/arm/) for now.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/stacktrace.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -48,11 +48,7 @@ int notrace unwind_frame(struct stackfra
frame->sp = fp + 0x10;
frame->fp = *(unsigned long *)(fp);
- /*
- * -4 here because we care about the PC at time of bl,
- * not where the return will go.
- */
- frame->pc = *(unsigned long *)(fp + 8) - 4;
+ frame->pc = *(unsigned long *)(fp + 8);
return 0;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 065/110] arm64: kernel: fix tcr_el1.t0sz restore on systems with extended idmap
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 064/110] Revert "ARM64: unwind: Fix PC calculation" Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 066/110] block: dont release bdi while request_queue has live references Greg Kroah-Hartman
` (44 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Catalin Marinas, Ard Biesheuvel,
Lorenzo Pieralisi, James Morse, Will Deacon
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
commit e13d918a19a7b6cba62b32884f5e336e764c2cc6 upstream.
Commit dd006da21646 ("arm64: mm: increase VA range of identity map")
introduced a mechanism to extend the virtual memory map range
to support arm64 systems with system RAM located at very high offset,
where the identity mapping used to enable/disable the MMU requires
additional translation levels to map the physical memory at an equal
virtual offset.
The kernel detects at boot time the tcr_el1.t0sz value required by the
identity mapping and sets-up the tcr_el1.t0sz register field accordingly,
any time the identity map is required in the kernel (ie when enabling the
MMU).
After enabling the MMU, in the cold boot path the kernel resets the
tcr_el1.t0sz to its default value (ie the actual configuration value for
the system virtual address space) so that after enabling the MMU the
memory space translated by ttbr0_el1 is restored as expected.
Commit dd006da21646 ("arm64: mm: increase VA range of identity map")
also added code to set-up the tcr_el1.t0sz value when the kernel resumes
from low-power states with the MMU off through cpu_resume() in order to
effectively use the identity mapping to enable the MMU but failed to add
the code required to restore the tcr_el1.t0sz to its default value, when
the core returns to the kernel with the MMU enabled, so that the kernel
might end up running with tcr_el1.t0sz value set-up for the identity
mapping which can be lower than the value required by the actual virtual
address space, resulting in an erroneous set-up.
This patchs adds code in the resume path that restores the tcr_el1.t0sz
default value upon core resume, mirroring this way the cold boot path
behaviour therefore fixing the issue.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Fixes: dd006da21646 ("arm64: mm: increase VA range of identity map")
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/suspend.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -80,17 +80,21 @@ int cpu_suspend(unsigned long arg, int (
if (ret == 0) {
/*
* We are resuming from reset with TTBR0_EL1 set to the
- * idmap to enable the MMU; restore the active_mm mappings in
- * TTBR0_EL1 unless the active_mm == &init_mm, in which case
- * the thread entered cpu_suspend with TTBR0_EL1 set to
- * reserved TTBR0 page tables and should be restored as such.
+ * idmap to enable the MMU; set the TTBR0 to the reserved
+ * page tables to prevent speculative TLB allocations, flush
+ * the local tlb and set the default tcr_el1.t0sz so that
+ * the TTBR0 address space set-up is properly restored.
+ * If the current active_mm != &init_mm we entered cpu_suspend
+ * with mappings in TTBR0 that must be restored, so we switch
+ * them back to complete the address space configuration
+ * restoration before returning.
*/
- if (mm == &init_mm)
- cpu_set_reserved_ttbr0();
- else
- cpu_switch_mm(mm->pgd, mm);
-
+ cpu_set_reserved_ttbr0();
flush_tlb_all();
+ cpu_set_default_tcr_t0sz();
+
+ if (mm != &init_mm)
+ cpu_switch_mm(mm->pgd, mm);
/*
* Restore per-cpu offset before any kernel
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 066/110] block: dont release bdi while request_queue has live references
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 065/110] arm64: kernel: fix tcr_el1.t0sz restore on systems with extended idmap Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 067/110] dm btree remove: fix a bug when rebalancing nodes after removal Greg Kroah-Hartman
` (43 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Jan Kara, Jeff Moyer,
Jens Axboe
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit b02176f30cd30acccd3b633ab7d9aed8b5da52ff upstream.
bdi's are initialized in two steps, bdi_init() and bdi_register(), but
destroyed in a single step by bdi_destroy() which, for a bdi embedded
in a request_queue, is called during blk_cleanup_queue() which makes
the queue invisible and starts the draining of remaining usages.
A request_queue's user can access the congestion state of the embedded
bdi as long as it holds a reference to the queue. As such, it may
access the congested state of a queue which finished
blk_cleanup_queue() but hasn't reached blk_release_queue() yet.
Because the congested state was embedded in backing_dev_info which in
turn is embedded in request_queue, accessing the congested state after
bdi_destroy() was called was fine. The bdi was destroyed but the
memory region for the congested state remained accessible till the
queue got released.
a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in
bdi_writeback") changed the situation. Now, the root congested state
which is expected to be pinned while request_queue remains accessible
is separately reference counted and the base ref is put during
bdi_destroy(). This means that the root congested state may go away
prematurely while the queue is between bdi_dstroy() and
blk_cleanup_queue(), which was detected by Andrey's KASAN tests.
The root cause of this problem is that bdi doesn't distinguish the two
steps of destruction, unregistration and release, and now the root
congested state actually requires a separate release step. To fix the
issue, this patch separates out bdi_unregister() and bdi_exit() from
bdi_destroy(). bdi_unregister() is called from blk_cleanup_queue()
and bdi_exit() from blk_release_queue(). bdi_destroy() is now just a
simple wrapper calling the two steps back-to-back.
While at it, the prototype of bdi_destroy() is moved right below
bdi_setup_and_register() so that the counterpart operations are
located together.
Signed-off-by: Tejun Heo <tj@kernel.org>
Fixes: a13f35e87140 ("writeback: don't embed root bdi_writeback_congested in bdi_writeback")
Reported-and-tested-by: Andrey Konovalov <andreyknvl@google.com>
Link: http://lkml.kernel.org/g/CAAeHK+zUJ74Zn17=rOyxacHU18SgCfC6bsYW=6kCY5GXJBwGfQ@mail.gmail.com
Reviewed-by: Jan Kara <jack@suse.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-core.c | 2 +-
block/blk-sysfs.c | 1 +
include/linux/backing-dev.h | 6 +++++-
mm/backing-dev.c | 12 +++++++++++-
4 files changed, 18 insertions(+), 3 deletions(-)
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -578,7 +578,7 @@ void blk_cleanup_queue(struct request_qu
q->queue_lock = &q->__queue_lock;
spin_unlock_irq(lock);
- bdi_destroy(&q->backing_dev_info);
+ bdi_unregister(&q->backing_dev_info);
/* @q is and will stay empty, shutdown and put */
blk_put_queue(q);
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -502,6 +502,7 @@ static void blk_release_queue(struct kob
struct request_queue *q =
container_of(kobj, struct request_queue, kobj);
+ bdi_exit(&q->backing_dev_info);
blkcg_exit_queue(q);
if (q->elevator) {
--- a/include/linux/backing-dev.h
+++ b/include/linux/backing-dev.h
@@ -18,13 +18,17 @@
#include <linux/slab.h>
int __must_check bdi_init(struct backing_dev_info *bdi);
-void bdi_destroy(struct backing_dev_info *bdi);
+void bdi_exit(struct backing_dev_info *bdi);
__printf(3, 4)
int bdi_register(struct backing_dev_info *bdi, struct device *parent,
const char *fmt, ...);
int bdi_register_dev(struct backing_dev_info *bdi, dev_t dev);
+void bdi_unregister(struct backing_dev_info *bdi);
+
int __must_check bdi_setup_and_register(struct backing_dev_info *, char *);
+void bdi_destroy(struct backing_dev_info *bdi);
+
void wb_start_writeback(struct bdi_writeback *wb, long nr_pages,
bool range_cyclic, enum wb_reason reason);
void wb_start_background_writeback(struct bdi_writeback *wb);
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -823,7 +823,7 @@ static void bdi_remove_from_list(struct
synchronize_rcu_expedited();
}
-void bdi_destroy(struct backing_dev_info *bdi)
+void bdi_unregister(struct backing_dev_info *bdi)
{
/* make sure nobody finds us on the bdi_list anymore */
bdi_remove_from_list(bdi);
@@ -835,9 +835,19 @@ void bdi_destroy(struct backing_dev_info
device_unregister(bdi->dev);
bdi->dev = NULL;
}
+}
+void bdi_exit(struct backing_dev_info *bdi)
+{
+ WARN_ON_ONCE(bdi->dev);
wb_exit(&bdi->wb);
}
+
+void bdi_destroy(struct backing_dev_info *bdi)
+{
+ bdi_unregister(bdi);
+ bdi_exit(bdi);
+}
EXPORT_SYMBOL(bdi_destroy);
/*
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 067/110] dm btree remove: fix a bug when rebalancing nodes after removal
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 066/110] block: dont release bdi while request_queue has live references Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 068/110] dm cache: the CLEAN_SHUTDOWN flag was not being set Greg Kroah-Hartman
` (42 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream.
Commit 4c7e309340ff ("dm btree remove: fix bug in redistribute3") wasn't
a complete fix for redistribute3().
The redistribute3 function takes 3 btree nodes and shares out the entries
evenly between them. If the three nodes in total contained
(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
the center.
Fix this issue by being more careful about calculating the target number
of entries for the left and right nodes.
Unit tested in userspace using this program:
https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-btree-remove.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btre
{
int s;
uint32_t max_entries = le32_to_cpu(left->header.max_entries);
- unsigned target = (nr_left + nr_center + nr_right) / 3;
- BUG_ON(target > max_entries);
+ unsigned total = nr_left + nr_center + nr_right;
+ unsigned target_right = total / 3;
+ unsigned remainder = (target_right * 3) != total;
+ unsigned target_left = target_right + remainder;
+
+ BUG_ON(target_left > max_entries);
+ BUG_ON(target_right > max_entries);
if (nr_left < nr_right) {
- s = nr_left - target;
+ s = nr_left - target_left;
if (s < 0 && nr_center < -s) {
/* not enough in central node */
@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btre
} else
shift(left, center, s);
- shift(center, right, target - nr_right);
+ shift(center, right, target_right - nr_right);
} else {
- s = target - nr_right;
+ s = target_right - nr_right;
if (s > 0 && nr_center < s) {
/* not enough in central node */
shift(center, right, nr_center);
@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btre
} else
shift(center, right, s);
- shift(left, center, nr_left - target);
+ shift(left, center, nr_left - target_left);
}
*key_ptr(parent, c->index) = center->keys[0];
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 068/110] dm cache: the CLEAN_SHUTDOWN flag was not being set
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 067/110] dm btree remove: fix a bug when rebalancing nodes after removal Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 069/110] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Greg Kroah-Hartman
` (41 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bogdan Vasiliev, Joe Thornber,
Mike Snitzer
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 3201ac452e84a8a368197d648c9b7011e061804a upstream.
If the CLEAN_SHUTDOWN flag is not set when a cache is loaded then all cache
blocks are marked as dirty and a full writeback occurs.
__commit_transaction() is responsible for setting/clearing
CLEAN_SHUTDOWN (based the flags_mutator that is passed in).
Fix this issue, of the cache's on-disk flags being wrong, by making sure
__commit_transaction() does not reset the flags after the mutator has
altered the flags in preparation for them being serialized to disk.
before:
sb_flags = mutator(le32_to_cpu(disk_super->flags));
disk_super->flags = cpu_to_le32(sb_flags);
disk_super->flags = cpu_to_le32(cmd->flags);
after:
disk_super->flags = cpu_to_le32(cmd->flags);
sb_flags = mutator(le32_to_cpu(disk_super->flags));
disk_super->flags = cpu_to_le32(sb_flags);
Reported-by: Bogdan Vasiliev <bogdan.vasiliev@gmail.com>
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-cache-metadata.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -634,10 +634,10 @@ static int __commit_transaction(struct d
disk_super = dm_block_data(sblock);
+ disk_super->flags = cpu_to_le32(cmd->flags);
if (mutator)
update_flags(disk_super, mutator);
- disk_super->flags = cpu_to_le32(cmd->flags);
disk_super->mapping_root = cpu_to_le64(cmd->root);
disk_super->hint_root = cpu_to_le64(cmd->hint_root);
disk_super->discard_root = cpu_to_le64(cmd->discard_root);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 069/110] dm btree: fix leak of bufio-backed block in btree_split_beneath error path
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 068/110] dm cache: the CLEAN_SHUTDOWN flag was not being set Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 070/110] nvme: fix 32-bit build warning Greg Kroah-Hartman
` (40 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer,
Joe Thornber
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be upstream.
btree_split_beneath()'s error path had an outstanding FIXME that speaks
directly to the potential for _not_ cleaning up a previously allocated
bufio-backed block.
Fix this by releasing the previously allocated bufio block using
unlock_block().
Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <thornber@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-btree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -523,7 +523,7 @@ static int btree_split_beneath(struct sh
r = new_block(s->info, &right);
if (r < 0) {
- /* FIXME: put left */
+ unlock_block(s->info, left);
return r;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 070/110] nvme: fix 32-bit build warning
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 069/110] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 071/110] Revert "serial: 8250_dma: dont bother DMA with small transfers" Greg Kroah-Hartman
` (39 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arnd Bergmann, Christoph Hellwig,
Jens Axboe
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 835da3f99d329b1160a1f7fc82c7ac81163d63d0 upstream.
Compiling the nvme driver on 32-bit warns about a cast from a __u64
variable to a pointer:
drivers/block/nvme-core.c: In function 'nvme_submit_io':
drivers/block/nvme-core.c:1847:4: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
(void __user *)io.addr, length, NULL, 0);
The cast here is intentional and safe, so we can shut up the
gcc warning by adding an intermediate cast to 'uintptr_t'.
I had previously submitted a patch to fix this problem in the
nvme driver, but it was accepted on the same day that two new
warnings got added.
For clarification, I also change the third instance of this cast
to use uintptr_t instead of unsigned long now.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: d29ec8241c10e ("nvme: submit internal commands through the block layer")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nvme-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -1764,7 +1764,7 @@ static int nvme_submit_io(struct nvme_ns
length = (io.nblocks + 1) << ns->lba_shift;
meta_len = (io.nblocks + 1) * ns->ms;
- metadata = (void __user *)(unsigned long)io.metadata;
+ metadata = (void __user *)(uintptr_t)io.metadata;
write = io.opcode & 1;
if (ns->ext) {
@@ -1804,7 +1804,7 @@ static int nvme_submit_io(struct nvme_ns
c.rw.metadata = cpu_to_le64(meta_dma);
status = __nvme_submit_sync_cmd(ns->queue, &c, NULL,
- (void __user *)io.addr, length, NULL, 0);
+ (void __user *)(uintptr_t)io.addr, length, NULL, 0);
unmap:
if (meta) {
if (status == NVME_SC_SUCCESS && !write) {
@@ -1846,7 +1846,7 @@ static int nvme_user_cmd(struct nvme_dev
timeout = msecs_to_jiffies(cmd.timeout_ms);
status = __nvme_submit_sync_cmd(ns ? ns->queue : dev->admin_q, &c,
- NULL, (void __user *)cmd.addr, cmd.data_len,
+ NULL, (void __user *)(uintptr_t)cmd.addr, cmd.data_len,
&cmd.result, timeout);
if (status >= 0) {
if (put_user(cmd.result, &ucmd->result))
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 071/110] Revert "serial: 8250_dma: dont bother DMA with small transfers"
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 070/110] nvme: fix 32-bit build warning Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 073/110] i2c: mv64xxx: really allow I2C offloading Greg Kroah-Hartman
` (38 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Frederic Danis, Heikki Krogerus,
Andy Shevchenko
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Danis <frederic.danis@linux.intel.com>
commit f967fc8f165fadb72166f2bd4785094b3ca21307 upstream.
This reverts commit 9119fba0cfeda6d415c9f068df66838a104b87cb.
This commit prevents from sending "big" file using Bluetooth.
When sending a lot of data quickly through the Bluetooth interface, and
after a variable amount of data sent, transfer fails with error:
kernel: [ 415.247453] Bluetooth: hci0 hardware error 0x00
Found on T100TA.
After reverting this commit, send works fine for any file size.
Signed-off-by: Frederic Danis <frederic.danis@linux.intel.com>
Fixes: 9119fba0cfed (serial: 8250_dma: don't bother DMA with small transfers)
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dma.c | 4 ----
1 file changed, 4 deletions(-)
--- a/drivers/tty/serial/8250/8250_dma.c
+++ b/drivers/tty/serial/8250/8250_dma.c
@@ -80,10 +80,6 @@ int serial8250_tx_dma(struct uart_8250_p
return 0;
dma->tx_size = CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE);
- if (dma->tx_size < p->port.fifosize) {
- ret = -EINVAL;
- goto err;
- }
desc = dmaengine_prep_slave_single(dma->txchan,
dma->tx_addr + xmit->tail,
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 073/110] i2c: mv64xxx: really allow I2C offloading
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 071/110] Revert "serial: 8250_dma: dont bother DMA with small transfers" Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-07 16:26 ` Ben Hutchings
2015-11-06 19:19 ` [PATCH 4.2 074/110] clkdev: fix clk_add_alias() with a NULL alias device name Greg Kroah-Hartman
` (37 subsequent siblings)
102 siblings, 1 reply; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hezi Shahmoon, Thomas Petazzoni,
Wolfram Sang
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hezi Shahmoon <hezi@marvell.com>
commit 0729a04977d497cf66234fd7f900ddcec3ef1c52 upstream.
Commit 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix
several problems") completely reworked the offload support, but left a
debugging-related "return false" at the beginning of the
mv64xxx_i2c_can_offload() function. This has the unfortunate consequence
that offloading is in fact never used, which wasn't really the
intention.
This commit fixes that problem by removing the bogus "return false".
Fixes: 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix several problems")
Signed-off-by: Hezi Shahmoon <hezi@marvell.com>
[Thomas: reworked commit log and title.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-mv64xxx.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -669,8 +669,6 @@ mv64xxx_i2c_can_offload(struct mv64xxx_i
struct i2c_msg *msgs = drv_data->msgs;
int num = drv_data->num_msgs;
- return false;
-
if (!drv_data->offload_enabled)
return false;
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 073/110] i2c: mv64xxx: really allow I2C offloading
2015-11-06 19:19 ` [PATCH 4.2 073/110] i2c: mv64xxx: really allow I2C offloading Greg Kroah-Hartman
@ 2015-11-07 16:26 ` Ben Hutchings
0 siblings, 0 replies; 113+ messages in thread
From: Ben Hutchings @ 2015-11-07 16:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Hezi Shahmoon, Thomas Petazzoni, Wolfram Sang
[-- Attachment #1: Type: text/plain, Size: 1958 bytes --]
On Fri, 2015-11-06 at 11:19 -0800, Greg Kroah-Hartman wrote:
> 4.2-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Hezi Shahmoon <hezi@marvell.com>
>
> commit 0729a04977d497cf66234fd7f900ddcec3ef1c52 upstream.
>
> Commit 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix
> several problems") completely reworked the offload support, but left a
> debugging-related "return false" at the beginning of the
> mv64xxx_i2c_can_offload() function. This has the unfortunate consequence
> that offloading is in fact never used, which wasn't really the
> intention.
>
> This commit fixes that problem by removing the bogus "return false".
This looks like enabling a feature rather than fixing a bug. As it's
not a critical feature, this doesn't seem suitable for stable.
Ben.
> Fixes: 00d8689b85a7 ("i2c: mv64xxx: rework offload support to fix several problems")
> Signed-off-by: Hezi Shahmoon <hezi@marvell.com>
> [Thomas: reworked commit log and title.]
> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
> Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/i2c/busses/i2c-mv64xxx.c | 2 --
> 1 file changed, 2 deletions(-)
>
> --- a/drivers/i2c/busses/i2c-mv64xxx.c
> +++ b/drivers/i2c/busses/i2c-mv64xxx.c
> @@ -669,8 +669,6 @@ mv64xxx_i2c_can_offload(struct mv64xxx_i
> > > struct i2c_msg *msgs = drv_data->msgs;
> > > int num = drv_data->num_msgs;
>
> -> > return false;
> -
> > > if (!drv_data->offload_enabled)
> > > > return false;
>
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe stable" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
Ben Hutchings
73.46% of all statistics are made up.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 113+ messages in thread
* [PATCH 4.2 074/110] clkdev: fix clk_add_alias() with a NULL alias device name
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 073/110] i2c: mv64xxx: really allow I2C offloading Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 075/110] fbcon: initialize blink interval before calling fb_set_par Greg Kroah-Hartman
` (36 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Aaro Koskinen, Russell King
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@arm.linux.org.uk>
commit 625faa6a720d26fc0db9e20b48dc0dfe4c8d8ddf upstream.
clk_add_alias() was not correctly handling the case where alias_dev_name
was NULL: rather than producing an entry with a NULL dev_id pointer,
it would produce a device name of (null). Fix this.
Fixes: 2568999835d7 ("clkdev: add clkdev_create() helper")
Reported-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/clkdev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/clk/clkdev.c
+++ b/drivers/clk/clkdev.c
@@ -333,7 +333,8 @@ int clk_add_alias(const char *alias, con
if (IS_ERR(r))
return PTR_ERR(r);
- l = clkdev_create(r, alias, "%s", alias_dev_name);
+ l = clkdev_create(r, alias, alias_dev_name ? "%s" : NULL,
+ alias_dev_name);
clk_put(r);
return l ? 0 : -ENODEV;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 075/110] fbcon: initialize blink interval before calling fb_set_par
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 074/110] clkdev: fix clk_add_alias() with a NULL alias device name Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 076/110] xhci: handle no ping response error properly Greg Kroah-Hartman
` (35 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scot Doyle
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scot Doyle <lkml14@scotdoyle.com>
commit f235f664a8afabccf863a5dee4777d2d7b676fda upstream.
Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459
fbcon: use the cursor blink interval provided by vt
a PPC64LE kernel fails to boot when fbcon_add_cursor_timer uses an
uninitialized ops->cur_blink_jiffies. Prevent by initializing
in fbcon_init before the call to info->fbops->fb_set_par.
Reported-and-tested-by: Alistair Popple <alistair@popple.id.au>
Signed-off-by: Scot Doyle <lkml14@scotdoyle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/console/fbcon.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -1093,6 +1093,7 @@ static void fbcon_init(struct vc_data *v
con_copy_unimap(vc, svc);
ops = info->fbcon_par;
+ ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
p->con_rotate = initial_rotation;
set_blitting_type(vc, info);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 076/110] xhci: handle no ping response error properly
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 075/110] fbcon: initialize blink interval before calling fb_set_par Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 077/110] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Greg Kroah-Hartman
` (34 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mathias Nyman
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 3b4739b8951d650becbcd855d7d6f18ac98a9a85 upstream.
If a host fails to wake up a isochronous SuperSpeed device from U1/U2
in time for a isoch transfer it will generate a "No ping response error"
Host will then move to the next transfer descriptor.
Handle this case in the same way as missed service errors, tag the
current TD as skipped and handle it on the next transfer event.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2239,6 +2239,7 @@ static int handle_tx_event(struct xhci_h
u32 trb_comp_code;
int ret = 0;
int td_num = 0;
+ bool handling_skipped_tds = false;
slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
xdev = xhci->devs[slot_id];
@@ -2372,6 +2373,10 @@ static int handle_tx_event(struct xhci_h
ep->skip = true;
xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
goto cleanup;
+ case COMP_PING_ERR:
+ ep->skip = true;
+ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
+ goto cleanup;
default:
if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
status = 0;
@@ -2508,13 +2513,18 @@ static int handle_tx_event(struct xhci_h
ep, &status);
cleanup:
+
+
+ handling_skipped_tds = ep->skip &&
+ trb_comp_code != COMP_MISSED_INT &&
+ trb_comp_code != COMP_PING_ERR;
+
/*
- * Do not update event ring dequeue pointer if ep->skip is set.
- * Will roll back to continue process missed tds.
+ * Do not update event ring dequeue pointer if we're in a loop
+ * processing missed tds.
*/
- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+ if (!handling_skipped_tds)
inc_deq(xhci, xhci->event_ring);
- }
if (ret) {
urb = td->urb;
@@ -2549,7 +2559,7 @@ cleanup:
* Process them as short transfer until reach the td pointed by
* the event.
*/
- } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+ } while (handling_skipped_tds);
return 0;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 077/110] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 076/110] xhci: handle no ping response error properly Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 078/110] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Greg Kroah-Hartman
` (33 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laura Abbott, Takashi Iwai,
Oliver Neukum, Mathias Nyman
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laura Abbott <labbott@fedoraproject.org>
commit fd7cd061adcf5f7503515ba52b6a724642a839c8 upstream.
We received several reports of systems rebooting and powering on
after an attempted shutdown. Testing showed that setting
XHCI_SPURIOUS_WAKEUP quirk in addition to the XHCI_SPURIOUS_REBOOT
quirk allowed the system to shutdown as expected for LynxPoint-LP
xHCI controllers. Set the quirk back.
Note that the quirk was originally introduced for LynxPoint and
LynxPoint-LP just for this same reason. See:
commit 638298dc66ea ("xhci: Fix spurious wakeups after S5 on Haswell")
It was later limited to only concern HP machines as it caused
regression on some machines, see both bug and commit:
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=66171
commit 6962d914f317 ("xhci: Limit the spurious wakeup fix only to HP machines")
Later it was discovered that the powering on after shutdown
was limited to LynxPoint-LP (Haswell-ULT) and that some non-LP HP
machine suffered from spontaneous resume from S3 (which should
not be related to the SPURIOUS_WAKEUP quirk at all). An attempt
to fix this then removed the SPURIOUS_WAKEUP flag usage completely.
commit b45abacde3d5 ("xhci: no switching back on non-ULT Haswell")
Current understanding is that LynxPoint-LP (Haswell ULT) machines
need the SPURIOUS_WAKEUP quirk, otherwise they will restart, and
plain Lynxpoint (Haswell) machines may _not_ have the quirk
set otherwise they again will restart.
Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Oliver Neukum <oneukum@suse.com>
[Added more history to commit message -Mathias]
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-pci.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -147,6 +147,7 @@ static void xhci_pci_quirks(struct devic
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
}
if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 078/110] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 077/110] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 079/110] module: Fix locking in symbol_put_addr() Greg Kroah-Hartman
` (32 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Cathy Avery, Konrad Rzeszutek Wilk
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cathy Avery <cathy.avery@oracle.com>
commit a54c8f0f2d7df525ff997e2afe71866a1a013064 upstream.
xen-blkfront will crash if the check to talk_to_blkback()
in blkback_changed()(XenbusStateInitWait) returns an error.
The driver data is freed and info is set to NULL. Later during
the close process via talk_to_blkback's call to xenbus_dev_fatal()
the null pointer is passed to and dereference in blkfront_closing.
Signed-off-by: Cathy Avery <cathy.avery@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkfront.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1984,7 +1984,8 @@ static void blkback_changed(struct xenbu
break;
/* Missed the backend's Closing state -- fallthrough */
case XenbusStateClosing:
- blkfront_closing(info);
+ if (info)
+ blkfront_closing(info);
break;
}
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 079/110] module: Fix locking in symbol_put_addr()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 078/110] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 080/110] PCI: Prevent out of bounds access in numa_node override Greg Kroah-Hartman
` (31 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, poma, Peter Zijlstra (Intel),
Rusty Russell
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 275d7d44d802ef271a42dc87ac091a495ba72fc5 upstream.
Poma (on the way to another bug) reported an assertion triggering:
[<ffffffff81150529>] module_assert_mutex_or_preempt+0x49/0x90
[<ffffffff81150822>] __module_address+0x32/0x150
[<ffffffff81150956>] __module_text_address+0x16/0x70
[<ffffffff81150f19>] symbol_put_addr+0x29/0x40
[<ffffffffa04b77ad>] dvb_frontend_detach+0x7d/0x90 [dvb_core]
Laura Abbott <labbott@redhat.com> produced a patch which lead us to
inspect symbol_put_addr(). This function has a comment claiming it
doesn't need to disable preemption around the module lookup
because it holds a reference to the module it wants to find, which
therefore cannot go away.
This is wrong (and a false optimization too, preempt_disable() is really
rather cheap, and I doubt any of this is on uber critical paths,
otherwise it would've retained a pointer to the actual module anyway and
avoided the second lookup).
While its true that the module cannot go away while we hold a reference
on it, the data structure we do the lookup in very much _CAN_ change
while we do the lookup. Therefore fix the comment and add the
required preempt_disable().
Reported-by: poma <pomidorabelisima@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Fixes: a6e6abd575fc ("module: remove module_text_address()")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1063,11 +1063,15 @@ void symbol_put_addr(void *addr)
if (core_kernel_text(a))
return;
- /* module_text_address is safe here: we're supposed to have reference
- * to module from symbol_get, so it can't go away. */
+ /*
+ * Even though we hold a reference on the module; we still need to
+ * disable preemption in order to safely traverse the data structure.
+ */
+ preempt_disable();
modaddr = __module_text_address(a);
BUG_ON(!modaddr);
module_put(modaddr);
+ preempt_enable();
}
EXPORT_SYMBOL_GPL(symbol_put_addr);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 080/110] PCI: Prevent out of bounds access in numa_node override
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 079/110] module: Fix locking in symbol_put_addr() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 081/110] ovl: free stack of paths in ovl_fill_super Greg Kroah-Hartman
` (30 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sasha Levin, Bjorn Helgaas
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <sasha.levin@oracle.com>
commit 1266963170f576d4d08e6310b6963e26d3ff9d1e upstream.
63692df103e9 ("PCI: Allow numa_node override via sysfs") didn't check that
the numa node provided by userspace is valid. Passing a node number too
high would attempt to access invalid memory and trigger a kernel panic.
Fixes: 63692df103e9 ("PCI: Allow numa_node override via sysfs")
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -216,7 +216,7 @@ static ssize_t numa_node_store(struct de
if (ret)
return ret;
- if (!node_online(node))
+ if (node >= MAX_NUMNODES || !node_online(node))
return -EINVAL;
add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 081/110] ovl: free stack of paths in ovl_fill_super
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 080/110] PCI: Prevent out of bounds access in numa_node override Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 082/110] ovl: free lower_mnt array in ovl_put_super Greg Kroah-Hartman
` (29 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov, Miklos Szeredi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit 0f95502ad84874b3c05fc7cdd9d4d9d5cddf7859 upstream.
This fixes small memory leak after mount.
Kmemleak report:
unreferenced object 0xffff88003683fe00 (size 16):
comm "mount", pid 2029, jiffies 4294909563 (age 33.380s)
hex dump (first 16 bytes):
20 27 1f bb 00 88 ff ff 40 4b 0f 36 02 88 ff ff '......@K.6....
backtrace:
[<ffffffff811f8cd4>] create_object+0x124/0x2c0
[<ffffffff817a059b>] kmemleak_alloc+0x7b/0xc0
[<ffffffff811dffe6>] __kmalloc+0x106/0x340
[<ffffffffa01b7a29>] ovl_fill_super+0x389/0x9a0 [overlay]
[<ffffffff81200ac4>] mount_nodev+0x54/0xa0
[<ffffffffa01b7118>] ovl_mount+0x18/0x20 [overlay]
[<ffffffff81201ab3>] mount_fs+0x43/0x170
[<ffffffff81220d34>] vfs_kern_mount+0x74/0x170
[<ffffffff812233ad>] do_mount+0x22d/0xdf0
[<ffffffff812242cb>] SyS_mount+0x7b/0xc0
[<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76
[<ffffffffffffffff>] 0xffffffffffffffff
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: a78d9f0d5d5c ("ovl: support multiple lower layers")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -1048,6 +1048,7 @@ static int ovl_fill_super(struct super_b
oe->lowerstack[i].dentry = stack[i].dentry;
oe->lowerstack[i].mnt = ufs->lower_mnt[i];
}
+ kfree(stack);
root_dentry->d_fsdata = oe;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 082/110] ovl: free lower_mnt array in ovl_put_super
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 081/110] ovl: free stack of paths in ovl_fill_super Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 083/110] ovl: use O_LARGEFILE in ovl_copy_up() Greg Kroah-Hartman
` (28 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Konstantin Khlebnikov, Miklos Szeredi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
commit 5ffdbe8bf1e485026e1c7e4714d2841553cf0b40 upstream.
This fixes memory leak after umount.
Kmemleak report:
unreferenced object 0xffff8800ba791010 (size 8):
comm "mount", pid 2394, jiffies 4294996294 (age 53.920s)
hex dump (first 8 bytes):
20 1c 13 02 00 88 ff ff .......
backtrace:
[<ffffffff811f8cd4>] create_object+0x124/0x2c0
[<ffffffff817a059b>] kmemleak_alloc+0x7b/0xc0
[<ffffffff811dffe6>] __kmalloc+0x106/0x340
[<ffffffffa0152bfc>] ovl_fill_super+0x55c/0x9b0 [overlay]
[<ffffffff81200ac4>] mount_nodev+0x54/0xa0
[<ffffffffa0152118>] ovl_mount+0x18/0x20 [overlay]
[<ffffffff81201ab3>] mount_fs+0x43/0x170
[<ffffffff81220d34>] vfs_kern_mount+0x74/0x170
[<ffffffff812233ad>] do_mount+0x22d/0xdf0
[<ffffffff812242cb>] SyS_mount+0x7b/0xc0
[<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76
[<ffffffffffffffff>] 0xffffffffffffffff
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: dd662667e6d3 ("ovl: add mutli-layer infrastructure")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -544,6 +544,7 @@ static void ovl_put_super(struct super_b
mntput(ufs->upper_mnt);
for (i = 0; i < ufs->numlower; i++)
mntput(ufs->lower_mnt[i]);
+ kfree(ufs->lower_mnt);
kfree(ufs->config.lowerdir);
kfree(ufs->config.upperdir);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 083/110] ovl: use O_LARGEFILE in ovl_copy_up()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 082/110] ovl: free lower_mnt array in ovl_put_super Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 084/110] ovl: fix dentry reference leak Greg Kroah-Hartman
` (27 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ulrich Obergfell, David Howells,
Miklos Szeredi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 0480334fa60488d12ae101a02d7d9e1a3d03d7dd upstream.
Open the lower file with O_LARGEFILE in ovl_copy_up().
Pass O_LARGEFILE unconditionally in ovl_copy_up_data() as it's purely for
catching 32-bit userspace dealing with a file large enough that it'll be
mishandled if the application isn't aware that there might be an integer
overflow. Inside the kernel, there shouldn't be any problems.
Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -81,11 +81,11 @@ static int ovl_copy_up_data(struct path
if (len == 0)
return 0;
- old_file = ovl_path_open(old, O_RDONLY);
+ old_file = ovl_path_open(old, O_LARGEFILE | O_RDONLY);
if (IS_ERR(old_file))
return PTR_ERR(old_file);
- new_file = ovl_path_open(new, O_WRONLY);
+ new_file = ovl_path_open(new, O_LARGEFILE | O_WRONLY);
if (IS_ERR(new_file)) {
error = PTR_ERR(new_file);
goto out_fput;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 084/110] ovl: fix dentry reference leak
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 083/110] ovl: use O_LARGEFILE in ovl_copy_up() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 085/110] ovl: fix open in stacked overlay Greg Kroah-Hartman
` (26 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ulrich Obergfell, David Howells,
Miklos Szeredi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit ab79efab0a0ba01a74df782eb7fa44b044dae8b5 upstream.
In ovl_copy_up_locked(), newdentry is leaked if the function exits through
out_cleanup as this just to out after calling ovl_cleanup() - which doesn't
actually release the ref on newdentry.
The out_cleanup segment should instead exit through out2 as certainly
newdentry leaks - and possibly upper does also, though this isn't caught
given the catch of newdentry.
Without this fix, something like the following is seen:
BUG: Dentry ffff880023e9eb20{i=f861,n=#ffff880023e82d90} still in use (1) [unmount of tmpfs tmpfs]
BUG: Dentry ffff880023ece640{i=0,n=bigfile} still in use (1) [unmount of tmpfs tmpfs]
when unmounting the upper layer after an error occurred in copyup.
An error can be induced by creating a big file in a lower layer with
something like:
dd if=/dev/zero of=/lower/a/bigfile bs=65536 count=1 seek=$((0xf000))
to create a large file (4.1G). Overlay an upper layer that is too small
(on tmpfs might do) and then induce a copy up by opening it writably.
Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -267,7 +267,7 @@ out:
out_cleanup:
ovl_cleanup(wdir, newdentry);
- goto out;
+ goto out2;
}
/*
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 085/110] ovl: fix open in stacked overlay
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 084/110] ovl: fix dentry reference leak Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 087/110] crypto: api - Only abort operations on fatal signal Greg Kroah-Hartman
` (25 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alban Crequy, Miklos Szeredi,
David Howells
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <miklos@szeredi.hu>
commit 1c8a47df36d72ace8cf78eb6c228aa0f8027d3c2 upstream.
If two overlayfs filesystems are stacked on top of each other, then we need
recursion in ovl_d_select_inode().
I guess d_backing_inode() is supposed to do that. But currently it doesn't
and that functionality is open coded in vfs_open(). This is now copied
into ovl_d_select_inode() to fix this regression.
Reported-by: Alban Crequy <alban.crequy@gmail.com>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay...")
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -363,6 +363,9 @@ struct inode *ovl_d_select_inode(struct
ovl_path_upper(dentry, &realpath);
}
+ if (realpath.dentry->d_flags & DCACHE_OP_SELECT_INODE)
+ return realpath.dentry->d_op->d_select_inode(realpath.dentry, file_flags);
+
return d_backing_inode(realpath.dentry);
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 087/110] crypto: api - Only abort operations on fatal signal
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 085/110] ovl: fix open in stacked overlay Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 088/110] md/raid1: submit_bio_wait() returns 0 on success Greg Kroah-Hartman
` (24 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Herbert Xu
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 3fc89adb9fa4beff31374a4bf50b3d099d88ae83 upstream.
Currently a number of Crypto API operations may fail when a signal
occurs. This causes nasty problems as the caller of those operations
are often not in a good position to restart the operation.
In fact there is currently no need for those operations to be
interrupted by user signals at all. All we need is for them to
be killable.
This patch replaces the relevant calls of signal_pending with
fatal_signal_pending, and wait_for_completion_interruptible with
wait_for_completion_killable, respectively.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/ablkcipher.c | 2 +-
crypto/algapi.c | 2 +-
crypto/api.c | 6 +++---
crypto/crypto_user.c | 2 +-
4 files changed, 6 insertions(+), 6 deletions(-)
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -706,7 +706,7 @@ struct crypto_ablkcipher *crypto_alloc_a
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -335,7 +335,7 @@ static void crypto_wait_for_test(struct
crypto_alg_tested(larval->alg.cra_driver_name, 0);
}
- err = wait_for_completion_interruptible(&larval->completion);
+ err = wait_for_completion_killable(&larval->completion);
WARN_ON(err);
out:
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -172,7 +172,7 @@ static struct crypto_alg *crypto_larval_
struct crypto_larval *larval = (void *)alg;
long timeout;
- timeout = wait_for_completion_interruptible_timeout(
+ timeout = wait_for_completion_killable_timeout(
&larval->completion, 60 * HZ);
alg = larval->adult;
@@ -445,7 +445,7 @@ struct crypto_tfm *crypto_alloc_base(con
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
@@ -562,7 +562,7 @@ void *crypto_alloc_tfm(const char *alg_n
err:
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -376,7 +376,7 @@ static struct crypto_alg *crypto_user_sk
err = PTR_ERR(alg);
if (err != -EAGAIN)
break;
- if (signal_pending(current)) {
+ if (fatal_signal_pending(current)) {
err = -EINTR;
break;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 088/110] md/raid1: submit_bio_wait() returns 0 on success
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 087/110] crypto: api - Only abort operations on fatal signal Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 089/110] md/raid10: " Greg Kroah-Hartman
` (23 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bill Kuzeja, Jes Sorensen, NeilBrown
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jes Sorensen <Jes.Sorensen@redhat.com>
commit 203d27b0226a05202438ddb39ef0ef1acb14a759 upstream.
This was introduced with 9e882242c6193ae6f416f2d8d8db0d9126bd996b
which changed the return value of submit_bio_wait() to return != 0 on
error, but didn't update the caller accordingly.
Fixes: 9e882242c6 ("block: Add submit_bio_wait(), remove from md")
Reported-by: Bill Kuzeja <William.Kuzeja@stratus.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -2249,7 +2249,7 @@ static int narrow_write_error(struct r1b
bio_trim(wbio, sector - r1_bio->sector, sectors);
wbio->bi_iter.bi_sector += rdev->data_offset;
wbio->bi_bdev = rdev->bdev;
- if (submit_bio_wait(WRITE, wbio) == 0)
+ if (submit_bio_wait(WRITE, wbio) < 0)
/* failure! */
ok = rdev_set_badblocks(rdev, sector,
sectors, 0)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 089/110] md/raid10: submit_bio_wait() returns 0 on success
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 088/110] md/raid1: submit_bio_wait() returns 0 on success Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 090/110] md/raid5: fix locking in handle_stripe_clean_event() Greg Kroah-Hartman
` (22 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bill Kuzeja, Jes Sorensen, NeilBrown
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jes Sorensen <Jes.Sorensen@redhat.com>
commit 681ab4696062f5aa939c9e04d058732306a97176 upstream.
This was introduced with 9e882242c6193ae6f416f2d8d8db0d9126bd996b
which changed the return value of submit_bio_wait() to return != 0 on
error, but didn't update the caller accordingly.
Fixes: 9e882242c6 ("block: Add submit_bio_wait(), remove from md")
Reported-by: Bill Kuzeja <William.Kuzeja@stratus.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid10.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2580,7 +2580,7 @@ static int narrow_write_error(struct r10
choose_data_offset(r10_bio, rdev) +
(sector - r10_bio->sector));
wbio->bi_bdev = rdev->bdev;
- if (submit_bio_wait(WRITE, wbio) == 0)
+ if (submit_bio_wait(WRITE, wbio) < 0)
/* Failure! */
ok = rdev_set_badblocks(rdev, sector,
sectors, 0)
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 090/110] md/raid5: fix locking in handle_stripe_clean_event()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 089/110] md/raid10: " Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 091/110] Revert "md: allow a partially recovered device to be hot-added to an array." Greg Kroah-Hartman
` (21 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roman Gushchin, NeilBrown, Shaohua Li
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <klamm@yandex-team.ru>
commit b8a9d66d043ffac116100775a469f05f5158c16f upstream.
After commit 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()")
__find_stripe() is called under conf->hash_locks + hash.
But handle_stripe_clean_event() calls remove_hash() under
conf->device_lock.
Under some cirscumstances the hash chain can be circuited,
and we get an infinite loop with disabled interrupts and locked hash
lock in __find_stripe(). This leads to hard lockup on multiple CPUs
and following system crash.
I was able to reproduce this behavior on raid6 over 6 ssd disks.
The devices_handle_discard_safely option should be set to enable trim
support. The following script was used:
for i in `seq 1 32`; do
dd if=/dev/zero of=large$i bs=10M count=100 &
done
neilb: original was against a 3.x kernel. I forward-ported
to 4.3-rc. This verison is suitable for any kernel since
Commit: 59fc630b8b5f ("RAID5: batch adjacent full stripe write")
(v4.1+). I'll post a version for earlier kernels to stable.
Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
Fixes: 566c09c53455 ("raid5: relieve lock contention in get_active_stripe()")
Signed-off-by: NeilBrown <neilb@suse.com>
Cc: Shaohua Li <shli@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3505,6 +3505,7 @@ returnbi:
}
if (!discard_pending &&
test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
+ int hash;
clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
if (sh->qd_idx >= 0) {
@@ -3518,16 +3519,17 @@ returnbi:
* no updated data, so remove it from hash list and the stripe
* will be reinitialized
*/
- spin_lock_irq(&conf->device_lock);
unhash:
+ hash = sh->hash_lock_index;
+ spin_lock_irq(conf->hash_locks + hash);
remove_hash(sh);
+ spin_unlock_irq(conf->hash_locks + hash);
if (head_sh->batch_head) {
sh = list_first_entry(&sh->batch_list,
struct stripe_head, batch_list);
if (sh != head_sh)
goto unhash;
}
- spin_unlock_irq(&conf->device_lock);
sh = head_sh;
if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 091/110] Revert "md: allow a partially recovered device to be hot-added to an array."
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 090/110] md/raid5: fix locking in handle_stripe_clean_event() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 092/110] EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs() Greg Kroah-Hartman
` (20 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, NeilBrown
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.com>
commit d01552a76d71f9879af448e9142389ee9be6e95b upstream.
This reverts commit 7eb418851f3278de67126ea0c427641ab4792c57.
This commit is poorly justified, I can find not discusison in email,
and it clearly causes a problem.
If a device which is being recovered fails and is subsequently
re-added to an array, there could easily have been changes to the
array *before* the point where the recovery was up to. So the
recovery must start again from the beginning.
If a spare is being recovered and fails, then when it is re-added we
really should do a bitmap-based recovery up to the recovery-offset,
and then a full recovery from there. Before this reversion, we only
did the "full recovery from there" which is not corect. After this
reversion with will do a full recovery from the start, which is safer
but not ideal.
It will be left to a future patch to arrange the two different styles
of recovery.
Reported-and-tested-by: Nate Dailey <nate.dailey@stratus.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes: 7eb418851f32 ("md: allow a partially recovered device to be hot-added to an array.")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -8030,8 +8030,7 @@ static int remove_and_add_spares(struct
!test_bit(Bitmap_sync, &rdev->flags)))
continue;
- if (rdev->saved_raid_disk < 0)
- rdev->recovery_offset = 0;
+ rdev->recovery_offset = 0;
if (mddev->pers->
hot_add_disk(mddev, rdev) == 0) {
if (sysfs_link_rdev(mddev, rdev))
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 092/110] EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 091/110] Revert "md: allow a partially recovered device to be hot-added to an array." Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 093/110] irqchip/tegra: Propagate IRQ type setting to parent Greg Kroah-Hartman
` (19 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Seth Jennings, Aristeu Rozanski,
Tony Luck, Borislav Petkov, Mauro Carvalho Chehab, linux-edac
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Jennings <sjenning@redhat.com>
commit 2900ea609616c2651dec65312beeb2a6e536bc50 upstream.
In commit
7d375bffa524 ("sb_edac: Fix support for systems with two home agents per socket")
NUM_CHANNELS was changed to 8 and the channel space was renumerated to
handle EN, EP, and EX configurations.
The *_mci_bind_devs() functions - except for sbridge_mci_bind_devs() -
got a new device presence check in the form of saw_chan_mask. However,
sbridge_mci_bind_devs() still uses the NUM_CHANNELS for loop.
With the increase in NUM_CHANNELS, this loop fails at index 4 since
SB only has 4 TADs. This results in the following error on SB machines:
EDAC sbridge: Some needed devices are missing
EDAC sbridge: Couldn't find mci handler
EDAC sbridge: Couldn't find mci handle
This patch adapts the saw_chan_mask logic for sbridge_mci_bind_devs() as
well.
After this patch:
EDAC MC0: Giving out device to module sbridge_edac.c controller Sandy Bridge Socket#0: DEV 0000:3f:0e.0 (POLLED)
EDAC MC1: Giving out device to module sbridge_edac.c controller Sandy Bridge Socket#1: DEV 0000:7f:0e.0 (POLLED)
Signed-off-by: Seth Jennings <sjenning@redhat.com>
Acked-by: Aristeu Rozanski <aris@redhat.com>
Acked-by: Tony Luck <tony.luck@intel.com>
Tested-by: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1438798561-10180-1-git-send-email-sjenning@redhat.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/sb_edac.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -1648,6 +1648,7 @@ static int sbridge_mci_bind_devs(struct
{
struct sbridge_pvt *pvt = mci->pvt_info;
struct pci_dev *pdev;
+ u8 saw_chan_mask = 0;
int i;
for (i = 0; i < sbridge_dev->n_devs; i++) {
@@ -1681,6 +1682,7 @@ static int sbridge_mci_bind_devs(struct
{
int id = pdev->device - PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_TAD0;
pvt->pci_tad[id] = pdev;
+ saw_chan_mask |= 1 << id;
}
break;
case PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_DDRIO:
@@ -1701,10 +1703,8 @@ static int sbridge_mci_bind_devs(struct
!pvt-> pci_tad || !pvt->pci_ras || !pvt->pci_ta)
goto enodev;
- for (i = 0; i < NUM_CHANNELS; i++) {
- if (!pvt->pci_tad[i])
- goto enodev;
- }
+ if (saw_chan_mask != 0x0f)
+ goto enodev;
return 0;
enodev:
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 093/110] irqchip/tegra: Propagate IRQ type setting to parent
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 092/110] EDAC, sb_edac: Fix TAD presence check for sbridge_mci_bind_devs() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 095/110] netfilter: ipset: Fix sleeping memory allocation in atomic context Greg Kroah-Hartman
` (18 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lucas Stach, Stephen Warren,
Thierry Reding, Alexandre Courbot, Jason Cooper, Marc Zyngier,
Thomas Gleixner
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <dev@lynxeye.de>
commit 209da39154837ec1b69fb34f438041939911e4b4 upstream.
The LIC doesn't deal with the different types of interrupts itself
but needs to forward calls to set the appropriate type to its parent
IRQ controller.
Without this fix all IRQs routed through the LIC will stay at the
initial EDGE type, while most of them should actually be level triggered.
Fixes: 1eec582158e2 "irqchip: tegra: Add Tegra210 support"
Signed-off-by: Lucas Stach <dev@lynxeye.de>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Alexandre Courbot <gnurou@gmail.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: http://lkml.kernel.org/r/1445787552-13062-1-git-send-email-dev@lynxeye.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-tegra.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/irqchip/irq-tegra.c
+++ b/drivers/irqchip/irq-tegra.c
@@ -215,6 +215,7 @@ static struct irq_chip tegra_ictlr_chip
.irq_unmask = tegra_unmask,
.irq_retrigger = tegra_retrigger,
.irq_set_wake = tegra_set_wake,
+ .irq_set_type = irq_chip_set_type_parent,
.flags = IRQCHIP_MASK_ON_SUSPEND,
#ifdef CONFIG_SMP
.irq_set_affinity = irq_chip_set_affinity_parent,
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 095/110] netfilter: ipset: Fix sleeping memory allocation in atomic context
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 093/110] irqchip/tegra: Propagate IRQ type setting to parent Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 096/110] btrfs: fix possible leak in btrfs_ioctl_balance() Greg Kroah-Hartman
` (17 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nikolay Borisov, Jozsef Kadlecsik,
Pablo Neira Ayuso
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Borisov <kernel@kyup.com>
commit 00db674bedd68ff8b5afae9030ff5e04d45d1b4a upstream.
Commit 00590fdd5be0 introduced RCU locking in list type and in
doing so introduced a memory allocation in list_set_add, which
is done in an atomic context, due to the fact that ipset rcu
list modifications are serialised with a spin lock. The reason
why we can't use a mutex is that in addition to modifying the
list with ipset commands, it's also being modified when a
particular ipset rule timeout expires aka garbage collection.
This gc is triggered from set_cleanup_entries, which in turn
is invoked from a timer thus requiring the lock to be bh-safe.
Concretely the following call chain can lead to "sleeping function
called in atomic context" splat:
call_ad -> list_set_uadt -> list_set_uadd -> kzalloc(, GFP_KERNEL).
And since GFP_KERNEL allows initiating direct reclaim thus
potentially sleeping in the allocation path.
To fix the issue change the allocation type to GFP_ATOMIC, to
correctly reflect that it is occuring in an atomic context.
Fixes: 00590fdd5be0 ("netfilter: ipset: Introduce RCU locking in list type")
Signed-off-by: Nikolay Borisov <kernel@kyup.com>
Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_list_set.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/ipset/ip_set_list_set.c
+++ b/net/netfilter/ipset/ip_set_list_set.c
@@ -297,7 +297,7 @@ list_set_uadd(struct ip_set *set, void *
ip_set_timeout_expired(ext_timeout(n, set))))
n = NULL;
- e = kzalloc(set->dsize, GFP_KERNEL);
+ e = kzalloc(set->dsize, GFP_ATOMIC);
if (!e)
return -ENOMEM;
e->id = d->id;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 096/110] btrfs: fix possible leak in btrfs_ioctl_balance()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 095/110] netfilter: ipset: Fix sleeping memory allocation in atomic context Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 097/110] kvm: irqchip: fix memory leak Greg Kroah-Hartman
` (16 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christian Engelmayer, David Sterba,
Chris Mason
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Engelmayer <cengelma@gmx.at>
commit 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e upstream.
Commit 8eb934591f8b ("btrfs: check unsupported filters in balance
arguments") adds a jump to exit label out_bargs in case the argument
check fails. At this point in addition to the bargs memory, the
memory for struct btrfs_balance_control has already been allocated.
Ownership of bctl is passed to btrfs_balance() in the good case,
thus the memory is not freed due to the introduced jump. Make sure
that the memory gets freed in any case as necessary. Detected by
Coverity CID 1328378.
Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ioctl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4649,7 +4649,7 @@ locked:
if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
ret = -EINVAL;
- goto out_bargs;
+ goto out_bctl;
}
do_balance:
@@ -4663,12 +4663,15 @@ do_balance:
need_unlock = false;
ret = btrfs_balance(bctl, bargs);
+ bctl = NULL;
if (arg) {
if (copy_to_user(arg, bargs, sizeof(*bargs)))
ret = -EFAULT;
}
+out_bctl:
+ kfree(bctl);
out_bargs:
kfree(bargs);
out_unlock:
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 097/110] kvm: irqchip: fix memory leak
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 096/110] btrfs: fix possible leak in btrfs_ioctl_balance() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 098/110] thermal: exynos: Fix register read in TMU Greg Kroah-Hartman
` (15 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudip Mukherjee, Paolo Bonzini,
William Dauchy
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
commit ba60c41ae392b473a1897faa0b8739fcb8759d69 upstream.
We were taking the exit path after checking ue->flags and return value
of setup_routing_entry(), but 'e' was not freed incase of a failure.
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: William Dauchy <william@gandi.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
virt/kvm/irqchip.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/virt/kvm/irqchip.c
+++ b/virt/kvm/irqchip.c
@@ -213,11 +213,15 @@ int kvm_set_irq_routing(struct kvm *kvm,
goto out;
r = -EINVAL;
- if (ue->flags)
+ if (ue->flags) {
+ kfree(e);
goto out;
+ }
r = setup_routing_entry(new, e, ue);
- if (r)
+ if (r) {
+ kfree(e);
goto out;
+ }
++ue;
}
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 098/110] thermal: exynos: Fix register read in TMU
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 097/110] kvm: irqchip: fix memory leak Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 099/110] um: Fix kernel mode fault condition Greg Kroah-Hartman
` (14 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sudip Mukherjee, Krzysztof Kozlowski,
Chanwoo Choi, Lukasz Majewski, Kukjin Kim
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
commit b28fec1324bf8f5010d2c3c5d57db4115bda66d4 upstream.
The value of emul_con was getting overwritten if the selected soc is
SOC_ARCH_EXYNOS5260. And so as a result we were reading from the wrong
register in the case of SOC_ARCH_EXYNOS5260.
Fixes: 488c7455d74c ("thermal: exynos: Add the support for Exynos5433 TMU")
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com>
Acked-by: Lukasz Majewski <l.majewski@samsung.com>
Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Kukjin Kim <kgene@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/samsung/exynos_tmu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -933,7 +933,7 @@ static void exynos4412_tmu_set_emulation
if (data->soc == SOC_ARCH_EXYNOS5260)
emul_con = EXYNOS5260_EMUL_CON;
- if (data->soc == SOC_ARCH_EXYNOS5433)
+ else if (data->soc == SOC_ARCH_EXYNOS5433)
emul_con = EXYNOS5433_TMU_EMUL_CON;
else if (data->soc == SOC_ARCH_EXYNOS7)
emul_con = EXYNOS7_TMU_REG_EMUL_CON;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 099/110] um: Fix kernel mode fault condition
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 098/110] thermal: exynos: Fix register read in TMU Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 100/110] blk-mq: fix use-after-free in blk_mq_free_tag_set() Greg Kroah-Hartman
` (13 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Richard Weinberger
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <richard@nod.at>
commit 56b88a3bf97a39d3f4f010509917b76a865a6dc8 upstream.
We have to exclude memory locations <= PAGE_SIZE from
the condition and let the kernel mode fault path catch it.
Otherwise a kernel NULL pointer exception will be reported
as a kernel user space access.
Fixes: d2313084e2c (um: Catch unprotected user memory access)
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/um/kernel/trap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/um/kernel/trap.c
+++ b/arch/um/kernel/trap.c
@@ -220,7 +220,7 @@ unsigned long segv(struct faultinfo fi,
show_regs(container_of(regs, struct pt_regs, regs));
panic("Segfault with no mm");
}
- else if (!is_user && address < TASK_SIZE) {
+ else if (!is_user && address > PAGE_SIZE && address < TASK_SIZE) {
show_regs(container_of(regs, struct pt_regs, regs));
panic("Kernel tried to access user memory at addr 0x%lx, ip 0x%lx",
address, ip);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 100/110] blk-mq: fix use-after-free in blk_mq_free_tag_set()
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 099/110] um: Fix kernel mode fault condition Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 101/110] IB/cm: Fix rb-tree duplicate free and use-after-free Greg Kroah-Hartman
` (12 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Junichi Nomura, Keith Busch,
Jeff Moyer, Jens Axboe
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junichi Nomura <j-nomura@ce.jp.nec.com>
commit f42d79ab67322e51b92dd7aa965e310c71352a64 upstream.
tags is freed in blk_mq_free_rq_map() and should not be used after that.
The problem doesn't manifest if CONFIG_CPUMASK_OFFSTACK is false because
free_cpumask_var() is nop.
tags->cpumask is allocated in blk_mq_init_tags() so it's natural to
free cpumask in its counter part, blk_mq_free_tags().
Fixes: f26cdc8536ad ("blk-mq: Shared tag enhancements")
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Cc: Keith Busch <keith.busch@intel.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-mq-tag.c | 1 +
block/blk-mq.c | 4 +---
2 files changed, 2 insertions(+), 3 deletions(-)
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -628,6 +628,7 @@ void blk_mq_free_tags(struct blk_mq_tags
{
bt_free(&tags->bitmap_tags);
bt_free(&tags->breserved_tags);
+ free_cpumask_var(tags->cpumask);
kfree(tags);
}
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2263,10 +2263,8 @@ void blk_mq_free_tag_set(struct blk_mq_t
int i;
for (i = 0; i < set->nr_hw_queues; i++) {
- if (set->tags[i]) {
+ if (set->tags[i])
blk_mq_free_rq_map(set, set->tags[i], i);
- free_cpumask_var(set->tags[i]->cpumask);
- }
}
kfree(set->tags);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 101/110] IB/cm: Fix rb-tree duplicate free and use-after-free
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 100/110] blk-mq: fix use-after-free in blk_mq_free_tag_set() Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 102/110] sched/deadline: Fix migration of SCHED_DEADLINE tasks Greg Kroah-Hartman
` (11 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Doron Tsur, Matan Barak, Doug Ledford
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Doron Tsur <doront@mellanox.com>
commit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.
ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.
Fixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur <doront@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/cm.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -873,6 +873,11 @@ retest:
case IB_CM_SIDR_REQ_RCVD:
spin_unlock_irq(&cm_id_priv->lock);
cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+ spin_lock_irq(&cm.lock);
+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
+ rb_erase(&cm_id_priv->sidr_id_node,
+ &cm.remote_sidr_table);
+ spin_unlock_irq(&cm.lock);
break;
case IB_CM_REQ_SENT:
case IB_CM_MRA_REQ_RCVD:
@@ -3112,7 +3117,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id
spin_unlock_irqrestore(&cm_id_priv->lock, flags);
spin_lock_irqsave(&cm.lock, flags);
- rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
+ rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+ RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
+ }
spin_unlock_irqrestore(&cm.lock, flags);
return 0;
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 102/110] sched/deadline: Fix migration of SCHED_DEADLINE tasks
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 101/110] IB/cm: Fix rb-tree duplicate free and use-after-free Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 103/110] cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL) Greg Kroah-Hartman
` (10 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Luca Abeni, Peter Zijlstra (Intel),
Juri Lelli, Linus Torvalds, Mike Galbraith, Thomas Gleixner,
Wanpeng Li, Ingo Molnar
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Abeni <luca.abeni@unitn.it>
commit 5aa5050787f449e7eaef2c5ec93c7b357aa7dcdc upstream.
Commit:
9d5142624256 ("sched/deadline: Reduce rq lock contention by eliminating locking of non-feasible target")
broke select_task_rq_dl() and find_lock_later_rq(), because it introduced
a comparison between the local task's deadline and dl.earliest_dl.curr of
the remote queue.
However, if the remote runqueue does not contain any SCHED_DEADLINE
task its earliest_dl.curr is 0 (always smaller than the deadline of
the local task) and the remote runqueue is not selected for pushing.
As a result, if an application creates multiple SCHED_DEADLINE
threads, they will never be pushed to runqueues that do not already
contain SCHED_DEADLINE tasks.
This patch fixes the issue by checking if dl.dl_nr_running == 0.
Signed-off-by: Luca Abeni <luca.abeni@unitn.it>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Juri Lelli <juri.lelli@arm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Wanpeng Li <wanpeng.li@linux.intel.com>
Fixes: 9d5142624256 ("sched/deadline: Reduce rq lock contention by eliminating locking of non-feasible target")
Link: http://lkml.kernel.org/r/1444982781-15608-1-git-send-email-luca.abeni@unitn.it
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/deadline.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -1066,8 +1066,9 @@ select_task_rq_dl(struct task_struct *p,
int target = find_later_rq(p);
if (target != -1 &&
- dl_time_before(p->dl.deadline,
- cpu_rq(target)->dl.earliest_dl.curr))
+ (dl_time_before(p->dl.deadline,
+ cpu_rq(target)->dl.earliest_dl.curr) ||
+ (cpu_rq(target)->dl.dl_nr_running == 0)))
cpu = target;
}
rcu_read_unlock();
@@ -1417,7 +1418,8 @@ static struct rq *find_lock_later_rq(str
later_rq = cpu_rq(cpu);
- if (!dl_time_before(task->dl.deadline,
+ if (later_rq->dl.dl_nr_running &&
+ !dl_time_before(task->dl.deadline,
later_rq->dl.earliest_dl.curr)) {
/*
* Target rq has tasks of equal or earlier deadline,
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 103/110] cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL)
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 102/110] sched/deadline: Fix migration of SCHED_DEADLINE tasks Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 104/110] arm64: compat: fix stxr failure case in SWP emulation Greg Kroah-Hartman
` (9 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Srinivas Pandruvada,
Kristen Carlson Accardi, Rafael J. Wysocki
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 8e601a9f97a00bab031980de34f9a81891c1f82f upstream.
This is a workaround for KNL platform, where in some cases MPERF counter
will not have updated value before next read of MSR_IA32_MPERF. In this
case divide by zero will occur. This change ignores current sample for
busy calculation in this case.
Fixes: b34ef932d79a (intel_pstate: Knights Landing support)
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Acked-by: Kristen Carlson Accardi <kristen@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/intel_pstate.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -766,6 +766,11 @@ static inline void intel_pstate_sample(s
local_irq_save(flags);
rdmsrl(MSR_IA32_APERF, aperf);
rdmsrl(MSR_IA32_MPERF, mperf);
+ if (cpu->prev_mperf == mperf) {
+ local_irq_restore(flags);
+ return;
+ }
+
tsc = native_read_tsc();
local_irq_restore(flags);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 104/110] arm64: compat: fix stxr failure case in SWP emulation
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 103/110] cpufreq: intel_pstate: Fix divide by zero on Knights Landing (KNL) Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 105/110] NVMe: Fix memory leak on retried commands Greg Kroah-Hartman
` (8 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Shengjiu Wang, Vladimir Murzin,
Will Deacon
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will.deacon@arm.com>
commit 589cb22bbedacf325951014c07a35a2b01ca57f6 upstream.
If the STXR instruction fails in the SWP emulation code, we leave *data
overwritten with the loaded value, therefore corrupting the data written
by a subsequent, successful attempt.
This patch re-jigs the code so that we only write back to *data once we
know that the update has happened.
Fixes: bd35a4adc413 ("arm64: Port SWP/SWPB emulation support from arm")
Reported-by: Shengjiu Wang <shengjiu.wang@freescale.com>
Reported-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/armv8_deprecated.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -279,22 +279,24 @@ static void register_insn_emulation_sysc
*/
#define __user_swpX_asm(data, addr, res, temp, B) \
__asm__ __volatile__( \
- " mov %w2, %w1\n" \
- "0: ldxr"B" %w1, [%3]\n" \
- "1: stxr"B" %w0, %w2, [%3]\n" \
+ "0: ldxr"B" %w2, [%3]\n" \
+ "1: stxr"B" %w0, %w1, [%3]\n" \
" cbz %w0, 2f\n" \
" mov %w0, %w4\n" \
+ " b 3f\n" \
"2:\n" \
+ " mov %w1, %w2\n" \
+ "3:\n" \
" .pushsection .fixup,\"ax\"\n" \
" .align 2\n" \
- "3: mov %w0, %w5\n" \
- " b 2b\n" \
+ "4: mov %w0, %w5\n" \
+ " b 3b\n" \
" .popsection" \
" .pushsection __ex_table,\"a\"\n" \
" .align 3\n" \
- " .quad 0b, 3b\n" \
- " .quad 1b, 3b\n" \
- " .popsection" \
+ " .quad 0b, 4b\n" \
+ " .quad 1b, 4b\n" \
+ " .popsection\n" \
: "=&r" (res), "+r" (data), "=&r" (temp) \
: "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \
: "memory")
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 105/110] NVMe: Fix memory leak on retried commands
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 104/110] arm64: compat: fix stxr failure case in SWP emulation Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 106/110] drm/vmwgfx: Fix up user_dmabuf refcounting Greg Kroah-Hartman
` (7 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Keith Busch, Christoph Hellwig,
Jens Axboe
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <keith.busch@intel.com>
commit 0dfc70c33409afc232ef0b9ec210535dfbf9bc61 upstream.
Resources are reallocated for requeued commands, so unmap and release
the iod for the failed command.
It's a pretty bad memory leak and causes a kernel hang if you remove a
drive because of a busy dma pool. You'll get messages spewing like this:
nvme 0000:xx:xx.x: dma_pool_destroy prp list 256, ffff880420dec000 busy
and lock up pci and the driver since removal never completes while
holding a lock.
Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nvme-core.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/block/nvme-core.c
+++ b/drivers/block/nvme-core.c
@@ -597,6 +597,7 @@ static void req_completion(struct nvme_q
struct nvme_iod *iod = ctx;
struct request *req = iod_get_private(iod);
struct nvme_cmd_info *cmd_rq = blk_mq_rq_to_pdu(req);
+ bool requeue = false;
u16 status = le16_to_cpup(&cqe->status) >> 1;
@@ -605,12 +606,13 @@ static void req_completion(struct nvme_q
&& (jiffies - req->start_time) < req->timeout) {
unsigned long flags;
+ requeue = true;
blk_mq_requeue_request(req);
spin_lock_irqsave(req->q->queue_lock, flags);
if (!blk_queue_stopped(req->q))
blk_mq_kick_requeue_list(req->q);
spin_unlock_irqrestore(req->q->queue_lock, flags);
- return;
+ goto release_iod;
}
if (req->cmd_type == REQ_TYPE_DRV_PRIV) {
if (cmd_rq->ctx == CMD_CTX_CANCELLED)
@@ -631,7 +633,7 @@ static void req_completion(struct nvme_q
dev_warn(nvmeq->dev->dev,
"completing aborted command with status:%04x\n",
status);
-
+ release_iod:
if (iod->nents) {
dma_unmap_sg(nvmeq->dev->dev, iod->sg, iod->nents,
rq_data_dir(req) ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
@@ -644,7 +646,8 @@ static void req_completion(struct nvme_q
}
nvme_free_iod(nvmeq->dev, iod);
- blk_mq_complete_request(req);
+ if (likely(!requeue))
+ blk_mq_complete_request(req);
}
/* length is in bytes. gfp flags indicates whether we may sleep. */
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 106/110] drm/vmwgfx: Fix up user_dmabuf refcounting
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 105/110] NVMe: Fix memory leak on retried commands Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 107/110] thp: use is_zero_pfn() only after pte_present() check Greg Kroah-Hartman
` (6 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Hellstrom, Brian Paul,
Sinclair Yeh
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellstrom <thellstrom@vmware.com>
commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream.
If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.
Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_drv.c | 3 +++
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 6 ++++--
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++--
drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 29 +++++++++++++++++++++--------
drivers/gpu/drm/vmwgfx/vmwgfx_shader.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 12 +++++++++---
7 files changed, 43 insertions(+), 17 deletions(-)
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -1458,6 +1458,9 @@ static void __exit vmwgfx_exit(void)
drm_pci_exit(&driver, &vmw_pci_driver);
}
+MODULE_INFO(vmw_patch, "ed7d78b2");
+MODULE_INFO(vmw_patch, "54c12bc3");
+
module_init(vmwgfx_init);
module_exit(vmwgfx_exit);
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -636,7 +636,8 @@ extern int vmw_user_dmabuf_alloc(struct
uint32_t size,
bool shareable,
uint32_t *handle,
- struct vmw_dma_buffer **p_dma_buf);
+ struct vmw_dma_buffer **p_dma_buf,
+ struct ttm_base_object **p_base);
extern int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
struct vmw_dma_buffer *dma_buf,
uint32_t *handle);
@@ -650,7 +651,8 @@ extern uint32_t vmw_dmabuf_validate_node
uint32_t cur_validate_node);
extern void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo);
extern int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
- uint32_t id, struct vmw_dma_buffer **out);
+ uint32_t id, struct vmw_dma_buffer **out,
+ struct ttm_base_object **base);
extern int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
struct drm_file *file_priv);
extern int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -887,7 +887,8 @@ static int vmw_translate_mob_ptr(struct
struct vmw_relocation *reloc;
int ret;
- ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+ ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+ NULL);
if (unlikely(ret != 0)) {
DRM_ERROR("Could not find or use MOB buffer.\n");
ret = -EINVAL;
@@ -949,7 +950,8 @@ static int vmw_translate_guest_ptr(struc
struct vmw_relocation *reloc;
int ret;
- ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+ ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+ NULL);
if (unlikely(ret != 0)) {
DRM_ERROR("Could not find or use GMR region.\n");
ret = -EINVAL;
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
@@ -484,7 +484,7 @@ int vmw_overlay_ioctl(struct drm_device
goto out_unlock;
}
- ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf);
+ ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf, NULL);
if (ret)
goto out_unlock;
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -356,7 +356,7 @@ int vmw_user_lookup_handle(struct vmw_pr
}
*out_surf = NULL;
- ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf);
+ ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf, NULL);
return ret;
}
@@ -483,7 +483,8 @@ int vmw_user_dmabuf_alloc(struct vmw_pri
uint32_t size,
bool shareable,
uint32_t *handle,
- struct vmw_dma_buffer **p_dma_buf)
+ struct vmw_dma_buffer **p_dma_buf,
+ struct ttm_base_object **p_base)
{
struct vmw_user_dma_buffer *user_bo;
struct ttm_buffer_object *tmp;
@@ -517,6 +518,10 @@ int vmw_user_dmabuf_alloc(struct vmw_pri
}
*p_dma_buf = &user_bo->dma;
+ if (p_base) {
+ *p_base = &user_bo->prime.base;
+ kref_get(&(*p_base)->refcount);
+ }
*handle = user_bo->prime.base.hash.key;
out_no_base_object:
@@ -633,6 +638,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct
struct vmw_dma_buffer *dma_buf;
struct vmw_user_dma_buffer *user_bo;
struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+ struct ttm_base_object *buffer_base;
int ret;
if ((arg->flags & (drm_vmw_synccpu_read | drm_vmw_synccpu_write)) == 0
@@ -645,7 +651,8 @@ int vmw_user_dmabuf_synccpu_ioctl(struct
switch (arg->op) {
case drm_vmw_synccpu_grab:
- ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf);
+ ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf,
+ &buffer_base);
if (unlikely(ret != 0))
return ret;
@@ -653,6 +660,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct
dma);
ret = vmw_user_dmabuf_synccpu_grab(user_bo, tfile, arg->flags);
vmw_dmabuf_unreference(&dma_buf);
+ ttm_base_object_unref(&buffer_base);
if (unlikely(ret != 0 && ret != -ERESTARTSYS &&
ret != -EBUSY)) {
DRM_ERROR("Failed synccpu grab on handle 0x%08x.\n",
@@ -694,7 +702,8 @@ int vmw_dmabuf_alloc_ioctl(struct drm_de
return ret;
ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
- req->size, false, &handle, &dma_buf);
+ req->size, false, &handle, &dma_buf,
+ NULL);
if (unlikely(ret != 0))
goto out_no_dmabuf;
@@ -723,7 +732,8 @@ int vmw_dmabuf_unref_ioctl(struct drm_de
}
int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
- uint32_t handle, struct vmw_dma_buffer **out)
+ uint32_t handle, struct vmw_dma_buffer **out,
+ struct ttm_base_object **p_base)
{
struct vmw_user_dma_buffer *vmw_user_bo;
struct ttm_base_object *base;
@@ -745,7 +755,10 @@ int vmw_user_dmabuf_lookup(struct ttm_ob
vmw_user_bo = container_of(base, struct vmw_user_dma_buffer,
prime.base);
(void)ttm_bo_reference(&vmw_user_bo->dma.base);
- ttm_base_object_unref(&base);
+ if (p_base)
+ *p_base = base;
+ else
+ ttm_base_object_unref(&base);
*out = &vmw_user_bo->dma;
return 0;
@@ -1006,7 +1019,7 @@ int vmw_dumb_create(struct drm_file *fil
ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
args->size, false, &args->handle,
- &dma_buf);
+ &dma_buf, NULL);
if (unlikely(ret != 0))
goto out_no_dmabuf;
@@ -1034,7 +1047,7 @@ int vmw_dumb_map_offset(struct drm_file
struct vmw_dma_buffer *out_buf;
int ret;
- ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+ ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf, NULL);
if (ret != 0)
return -EINVAL;
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -470,7 +470,7 @@ int vmw_shader_define_ioctl(struct drm_d
if (arg->buffer_handle != SVGA3D_INVALID_ID) {
ret = vmw_user_dmabuf_lookup(tfile, arg->buffer_handle,
- &buffer);
+ &buffer, NULL);
if (unlikely(ret != 0)) {
DRM_ERROR("Could not find buffer for shader "
"creation.\n");
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -43,6 +43,7 @@ struct vmw_user_surface {
struct vmw_surface srf;
uint32_t size;
struct drm_master *master;
+ struct ttm_base_object *backup_base;
};
/**
@@ -652,6 +653,8 @@ static void vmw_user_surface_base_releas
struct vmw_resource *res = &user_srf->srf.res;
*p_base = NULL;
+ if (user_srf->backup_base)
+ ttm_base_object_unref(&user_srf->backup_base);
vmw_resource_unreference(&res);
}
@@ -846,7 +849,8 @@ int vmw_surface_define_ioctl(struct drm_
res->backup_size,
true,
&backup_handle,
- &res->backup);
+ &res->backup,
+ &user_srf->backup_base);
if (unlikely(ret != 0)) {
vmw_resource_unreference(&res);
goto out_unlock;
@@ -1309,7 +1313,8 @@ int vmw_gb_surface_define_ioctl(struct d
if (req->buffer_handle != SVGA3D_INVALID_ID) {
ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
- &res->backup);
+ &res->backup,
+ &user_srf->backup_base);
} else if (req->drm_surface_flags &
drm_vmw_surface_flag_create_buffer)
ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1317,7 +1322,8 @@ int vmw_gb_surface_define_ioctl(struct d
req->drm_surface_flags &
drm_vmw_surface_flag_shareable,
&backup_handle,
- &res->backup);
+ &res->backup,
+ &user_srf->backup_base);
if (unlikely(ret != 0)) {
vmw_resource_unreference(&res);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 107/110] thp: use is_zero_pfn() only after pte_present() check
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 106/110] drm/vmwgfx: Fix up user_dmabuf refcounting Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 108/110] pinctrl: baytrail: Serialize all register access Greg Kroah-Hartman
` (5 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Minchan Kim, Andrea Arcangeli,
Kirill A. Shutemov, Mel Gorman, Vlastimil Babka, Hugh Dickins,
Rik van Riel, Andrew Morton, Linus Torvalds
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <minchan@kernel.org>
commit 47aee4d8e314384807e98b67ade07f6da476aa75 upstream.
Use is_zero_pfn() on pteval only after pte_present() check on pteval
(It might be better idea to introduce is_zero_pte() which checks
pte_present() first).
Otherwise when working on a swap or migration entry and if pte_pfn's
result is equal to zero_pfn by chance, we lose user's data in
__collapse_huge_page_copy(). So if you're unlucky, the application
segfaults and finally you could see below message on exit:
BUG: Bad rss-counter state mm:ffff88007f099300 idx:2 val:3
Fixes: ca0984caa823 ("mm: incorporate zero pages into transparent huge pages")
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Cc: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -2132,7 +2132,8 @@ static int __collapse_huge_page_isolate(
for (_pte = pte; _pte < pte+HPAGE_PMD_NR;
_pte++, address += PAGE_SIZE) {
pte_t pteval = *_pte;
- if (pte_none(pteval) || is_zero_pfn(pte_pfn(pteval))) {
+ if (pte_none(pteval) || (pte_present(pteval) &&
+ is_zero_pfn(pte_pfn(pteval)))) {
if (++none_or_zero <= khugepaged_max_ptes_none)
continue;
else
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 108/110] pinctrl: baytrail: Serialize all register access
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 107/110] thp: use is_zero_pfn() only after pte_present() check Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-08 9:38 ` Ben Hutchings
2015-11-06 19:19 ` [PATCH 4.2 109/110] pinctrl: baytrail: Use raw_spinlock for locking Greg Kroah-Hartman
` (4 subsequent siblings)
102 siblings, 1 reply; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mika Westerberg, Linus Walleij,
Lucas De Marchi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 39ce8150a079e3ae6ed9abf26d7918a558ef7c19 upstream.
There is a hardware issue in Intel Baytrail where concurrent GPIO register
access might result reads of 0xffffffff and writes might get dropped
completely.
Prevent this from happening by taking the serializing lock in all places
where it is possible that more than one thread might be accessing the
hardware concurrently.
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cc: Lucas De Marchi <lucas.de.marchi@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/intel/pinctrl-baytrail.c | 21 ++++++++++++++++-----
1 file changed, 16 insertions(+), 5 deletions(-)
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -201,6 +201,9 @@ static int byt_gpio_request(struct gpio_
struct byt_gpio *vg = to_byt_gpio(chip);
void __iomem *reg = byt_gpio_reg(chip, offset, BYT_CONF0_REG);
u32 value, gpio_mux;
+ unsigned long flags;
+
+ spin_lock_irqsave(&vg->lock, flags);
/*
* In most cases, func pin mux 000 means GPIO function.
@@ -214,18 +217,16 @@ static int byt_gpio_request(struct gpio_
value = readl(reg) & BYT_PIN_MUX;
gpio_mux = byt_get_gpio_mux(vg, offset);
if (WARN_ON(gpio_mux != value)) {
- unsigned long flags;
-
- spin_lock_irqsave(&vg->lock, flags);
value = readl(reg) & ~BYT_PIN_MUX;
value |= gpio_mux;
writel(value, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
dev_warn(&vg->pdev->dev,
"pin %u forcibly re-configured as GPIO\n", offset);
}
+ spin_unlock_irqrestore(&vg->lock, flags);
+
pm_runtime_get(&vg->pdev->dev);
return 0;
@@ -277,7 +278,15 @@ static int byt_irq_type(struct irq_data
static int byt_gpio_get(struct gpio_chip *chip, unsigned offset)
{
void __iomem *reg = byt_gpio_reg(chip, offset, BYT_VAL_REG);
- return readl(reg) & BYT_LEVEL;
+ struct byt_gpio *vg = to_byt_gpio(chip);
+ unsigned long flags;
+ u32 val;
+
+ spin_lock_irqsave(&vg->lock, flags);
+ val = readl(reg);
+ spin_unlock_irqrestore(&vg->lock, flags);
+
+ return val & BYT_LEVEL;
}
static void byt_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
@@ -450,8 +459,10 @@ static void byt_irq_ack(struct irq_data
unsigned offset = irqd_to_hwirq(d);
void __iomem *reg;
+ spin_lock(&vg->lock);
reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
writel(BIT(offset % 32), reg);
+ spin_unlock(&vg->lock);
}
static void byt_irq_unmask(struct irq_data *d)
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 108/110] pinctrl: baytrail: Serialize all register access
2015-11-06 19:19 ` [PATCH 4.2 108/110] pinctrl: baytrail: Serialize all register access Greg Kroah-Hartman
@ 2015-11-08 9:38 ` Ben Hutchings
0 siblings, 0 replies; 113+ messages in thread
From: Ben Hutchings @ 2015-11-08 9:38 UTC (permalink / raw)
To: Greg Kroah-Hartman, Mika Westerberg
Cc: stable, Linus Walleij, Lucas De Marchi, LKML
[-- Attachment #1: Type: text/plain, Size: 831 bytes --]
On Fri, 2015-11-06 at 11:19 -0800, Greg Kroah-Hartman wrote:
> 4.2-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Mika Westerberg <mika.westerberg@linux.intel.com>
>
> commit 39ce8150a079e3ae6ed9abf26d7918a558ef7c19 upstream.
>
> There is a hardware issue in Intel Baytrail where concurrent GPIO register
> access might result reads of 0xffffffff and writes might get dropped
> completely.
>
> Prevent this from happening by taking the serializing lock in all places
> where it is possible that more than one thread might be accessing the
> hardware concurrently.
[...]
While I have no objection to this, I think a complete fix requires
adding mmiowb() before each spin_unlock.
Ben.
--
Ben Hutchings
73.46% of all statistics are made up.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 811 bytes --]
^ permalink raw reply [flat|nested] 113+ messages in thread
* [PATCH 4.2 109/110] pinctrl: baytrail: Use raw_spinlock for locking
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 108/110] pinctrl: baytrail: Serialize all register access Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-06 19:19 ` [PATCH 4.2 110/110] xen: fix backport of previous kexec patch Greg Kroah-Hartman
` (3 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Walleij, Mika Westerberg,
Lucas De Marchi
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit 78e1c896932df5b8bcdff7bf5417d8e72a4d0d6b upstream.
The Intel Baytrail pinctrl driver implements irqchip callbacks which are
called with desc->lock raw_spinlock held. In mainline this is fine because
spinlock resolves to raw_spinlock. However, running the same code in -rt we
get:
BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:917
in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/0
Preemption disabled at:[<ffffffff81092e9f>] cpu_startup_entry+0x17f/0x480
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.1.5-rt5 #13
...
Call Trace:
<IRQ> [<ffffffff816283c6>] dump_stack+0x4a/0x61
[<ffffffff81077e17>] ___might_sleep+0xe7/0x170
[<ffffffff8162d6cf>] rt_spin_lock+0x1f/0x50
[<ffffffff812e3b88>] byt_gpio_clear_triggering+0x38/0x60
[<ffffffff812e3bc1>] byt_irq_mask+0x11/0x20
[<ffffffff810a7013>] handle_level_irq+0x83/0x150
[<ffffffff810a3457>] generic_handle_irq+0x27/0x40
[<ffffffff812e3a5f>] byt_gpio_irq_handler+0x7f/0xc0
[<ffffffff810050aa>] handle_irq+0xaa/0x190
...
This is because in -rt spinlocks are preemptible so taking the driver
private spinlock in irqchip callbacks causes might_sleep() to trigger.
In order to keep -rt happy but at the same time make sure that register
accesses get serialized, convert the driver to use raw_spinlock instead.
Also shorten the critical section a bit in few places.
Suggested-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Cc: Lucas De Marchi <lucas.de.marchi@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/intel/pinctrl-baytrail.c | 50 +++++++++++++++----------------
1 file changed, 25 insertions(+), 25 deletions(-)
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -146,7 +146,7 @@ struct byt_gpio_pin_context {
struct byt_gpio {
struct gpio_chip chip;
struct platform_device *pdev;
- spinlock_t lock;
+ raw_spinlock_t lock;
void __iomem *reg_base;
struct pinctrl_gpio_range *range;
struct byt_gpio_pin_context *saved_context;
@@ -174,11 +174,11 @@ static void byt_gpio_clear_triggering(st
unsigned long flags;
u32 value;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
value = readl(reg);
value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
writel(value, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
}
static u32 byt_get_gpio_mux(struct byt_gpio *vg, unsigned offset)
@@ -203,7 +203,7 @@ static int byt_gpio_request(struct gpio_
u32 value, gpio_mux;
unsigned long flags;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
/*
* In most cases, func pin mux 000 means GPIO function.
@@ -225,7 +225,7 @@ static int byt_gpio_request(struct gpio_
"pin %u forcibly re-configured as GPIO\n", offset);
}
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
pm_runtime_get(&vg->pdev->dev);
@@ -251,7 +251,7 @@ static int byt_irq_type(struct irq_data
if (offset >= vg->chip.ngpio)
return -EINVAL;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
value = readl(reg);
WARN(value & BYT_DIRECT_IRQ_EN,
@@ -270,7 +270,7 @@ static int byt_irq_type(struct irq_data
else if (type & IRQ_TYPE_LEVEL_MASK)
__irq_set_handler_locked(d->irq, handle_level_irq);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
return 0;
}
@@ -282,9 +282,9 @@ static int byt_gpio_get(struct gpio_chip
unsigned long flags;
u32 val;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
val = readl(reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
return val & BYT_LEVEL;
}
@@ -296,7 +296,7 @@ static void byt_gpio_set(struct gpio_chi
unsigned long flags;
u32 old_val;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
old_val = readl(reg);
@@ -305,7 +305,7 @@ static void byt_gpio_set(struct gpio_chi
else
writel(old_val & ~BYT_LEVEL, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
}
static int byt_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
@@ -315,13 +315,13 @@ static int byt_gpio_direction_input(stru
unsigned long flags;
u32 value;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
value = readl(reg) | BYT_DIR_MASK;
value &= ~BYT_INPUT_EN; /* active low */
writel(value, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
return 0;
}
@@ -335,7 +335,7 @@ static int byt_gpio_direction_output(str
unsigned long flags;
u32 reg_val;
- spin_lock_irqsave(&vg->lock, flags);
+ raw_spin_lock_irqsave(&vg->lock, flags);
/*
* Before making any direction modifications, do a check if gpio
@@ -354,7 +354,7 @@ static int byt_gpio_direction_output(str
else
writel(reg_val & ~BYT_LEVEL, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
return 0;
}
@@ -363,18 +363,19 @@ static void byt_gpio_dbg_show(struct seq
{
struct byt_gpio *vg = to_byt_gpio(chip);
int i;
- unsigned long flags;
u32 conf0, val, offs;
- spin_lock_irqsave(&vg->lock, flags);
-
for (i = 0; i < vg->chip.ngpio; i++) {
const char *pull_str = NULL;
const char *pull = NULL;
+ unsigned long flags;
const char *label;
offs = vg->range->pins[i] * 16;
+
+ raw_spin_lock_irqsave(&vg->lock, flags);
conf0 = readl(vg->reg_base + offs + BYT_CONF0_REG);
val = readl(vg->reg_base + offs + BYT_VAL_REG);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
label = gpiochip_is_requested(chip, i);
if (!label)
@@ -427,7 +428,6 @@ static void byt_gpio_dbg_show(struct seq
seq_puts(s, "\n");
}
- spin_unlock_irqrestore(&vg->lock, flags);
}
static void byt_gpio_irq_handler(unsigned irq, struct irq_desc *desc)
@@ -459,10 +459,10 @@ static void byt_irq_ack(struct irq_data
unsigned offset = irqd_to_hwirq(d);
void __iomem *reg;
- spin_lock(&vg->lock);
+ raw_spin_lock(&vg->lock);
reg = byt_gpio_reg(&vg->chip, offset, BYT_INT_STAT_REG);
writel(BIT(offset % 32), reg);
- spin_unlock(&vg->lock);
+ raw_spin_unlock(&vg->lock);
}
static void byt_irq_unmask(struct irq_data *d)
@@ -474,9 +474,9 @@ static void byt_irq_unmask(struct irq_da
void __iomem *reg;
u32 value;
- spin_lock_irqsave(&vg->lock, flags);
-
reg = byt_gpio_reg(&vg->chip, offset, BYT_CONF0_REG);
+
+ raw_spin_lock_irqsave(&vg->lock, flags);
value = readl(reg);
switch (irqd_get_trigger_type(d)) {
@@ -497,7 +497,7 @@ static void byt_irq_unmask(struct irq_da
writel(value, reg);
- spin_unlock_irqrestore(&vg->lock, flags);
+ raw_spin_unlock_irqrestore(&vg->lock, flags);
}
static void byt_irq_mask(struct irq_data *d)
@@ -589,7 +589,7 @@ static int byt_gpio_probe(struct platfor
if (IS_ERR(vg->reg_base))
return PTR_ERR(vg->reg_base);
- spin_lock_init(&vg->lock);
+ raw_spin_lock_init(&vg->lock);
gc = &vg->chip;
gc->label = dev_name(&pdev->dev);
^ permalink raw reply [flat|nested] 113+ messages in thread* [PATCH 4.2 110/110] xen: fix backport of previous kexec patch
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 109/110] pinctrl: baytrail: Use raw_spinlock for locking Greg Kroah-Hartman
@ 2015-11-06 19:19 ` Greg Kroah-Hartman
2015-11-07 1:45 ` [PATCH 4.2 000/110] 4.2.6-stable review Guenter Roeck
` (2 subsequent siblings)
102 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-06 19:19 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Vrabel, Luis Henriques
4.2-stable review patch. If anyone has any objections, please let me know.
------------------
Fixes the backport of 0b34a166f291d255755be46e43ed5497cdd194f2 upstream
Commit 0b34a166f291d255755be46e43ed5497cdd194f2 "x86/xen: Support
kexec/kdump in HVM guests by doing a soft reset" has been added to the
4.2-stable tree" needed to correct the CONFIG variable, as
CONFIG_KEXEC_CORE only showed up in 4.3.
Reported-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/xen/enlighten.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -33,7 +33,7 @@
#include <linux/memblock.h>
#include <linux/edd.h>
-#ifdef CONFIG_KEXEC_CORE
+#ifdef CONFIG_KEXEC
#include <linux/kexec.h>
#endif
@@ -1804,7 +1804,7 @@ static struct notifier_block xen_hvm_cpu
.notifier_call = xen_hvm_cpu_notify,
};
-#ifdef CONFIG_KEXEC_CORE
+#ifdef CONFIG_KEXEC
static void xen_hvm_shutdown(void)
{
native_machine_shutdown();
@@ -1838,7 +1838,7 @@ static void __init xen_hvm_guest_init(vo
x86_init.irqs.intr_init = xen_init_IRQ;
xen_hvm_init_time_ops();
xen_hvm_init_mmu_ops();
-#ifdef CONFIG_KEXEC_CORE
+#ifdef CONFIG_KEXEC
machine_ops.shutdown = xen_hvm_shutdown;
machine_ops.crash_shutdown = xen_hvm_crash_shutdown;
#endif
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 000/110] 4.2.6-stable review
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2015-11-06 19:19 ` [PATCH 4.2 110/110] xen: fix backport of previous kexec patch Greg Kroah-Hartman
@ 2015-11-07 1:45 ` Guenter Roeck
2015-11-07 2:44 ` Greg Kroah-Hartman
2015-11-07 2:53 ` Shuah Khan
2015-11-09 9:27 ` Sudip Mukherjee
102 siblings, 1 reply; 113+ messages in thread
From: Guenter Roeck @ 2015-11-07 1:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, shuah.kh, stable
On 11/06/2015 11:18 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.2.6 release.
> There are 110 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Nov 8 19:16:22 UTC 2015.
> Anything received after that time might be too late.
>
Build results:
total: 144 pass: 144 fail: 0
Qemu test results:
total: 94 pass: 94 fail: 0
Details are available at http://server.roeck-us.net:8010/builders.
Guenter
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 000/110] 4.2.6-stable review
2015-11-07 1:45 ` [PATCH 4.2 000/110] 4.2.6-stable review Guenter Roeck
@ 2015-11-07 2:44 ` Greg Kroah-Hartman
0 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-07 2:44 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, torvalds, akpm, shuah.kh, stable
On Fri, Nov 06, 2015 at 05:45:29PM -0800, Guenter Roeck wrote:
> On 11/06/2015 11:18 AM, Greg Kroah-Hartman wrote:
> >This is the start of the stable review cycle for the 4.2.6 release.
> >There are 110 patches in this series, all will be posted as a response
> >to this one. If anyone has any issues with these being applied, please
> >let me know.
> >
> >Responses should be made by Sun Nov 8 19:16:22 UTC 2015.
> >Anything received after that time might be too late.
> >
>
> Build results:
> total: 144 pass: 144 fail: 0
> Qemu test results:
> total: 94 pass: 94 fail: 0
>
> Details are available at http://server.roeck-us.net:8010/builders.
Thanks for testing all of these and letting me know.
I'm still working on generating a git tree with these patches, hopefully
that happens in a week or so.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 113+ messages in thread
* Re: [PATCH 4.2 000/110] 4.2.6-stable review
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2015-11-07 1:45 ` [PATCH 4.2 000/110] 4.2.6-stable review Guenter Roeck
@ 2015-11-07 2:53 ` Shuah Khan
2015-11-07 3:00 ` Greg Kroah-Hartman
2015-11-09 9:27 ` Sudip Mukherjee
102 siblings, 1 reply; 113+ messages in thread
From: Shuah Khan @ 2015-11-07 2:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel; +Cc: torvalds, akpm, linux, shuah.kh, stable
On 11/06/2015 12:18 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.2.6 release.
> There are 110 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Nov 8 19:16:22 UTC 2015.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.2.6-rc1.gz
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America (Silicon Valley)
shuahkh@osg.samsung.com | (970) 217-8978
^ permalink raw reply [flat|nested] 113+ messages in thread* Re: [PATCH 4.2 000/110] 4.2.6-stable review
2015-11-07 2:53 ` Shuah Khan
@ 2015-11-07 3:00 ` Greg Kroah-Hartman
0 siblings, 0 replies; 113+ messages in thread
From: Greg Kroah-Hartman @ 2015-11-07 3:00 UTC (permalink / raw)
To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable
On Fri, Nov 06, 2015 at 07:53:08PM -0700, Shuah Khan wrote:
> On 11/06/2015 12:18 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.2.6 release.
> > There are 110 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Nov 8 19:16:22 UTC 2015.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.2.6-rc1.gz
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 113+ messages in thread
* Re: [PATCH 4.2 000/110] 4.2.6-stable review
2015-11-06 19:18 [PATCH 4.2 000/110] 4.2.6-stable review Greg Kroah-Hartman
` (101 preceding siblings ...)
2015-11-07 2:53 ` Shuah Khan
@ 2015-11-09 9:27 ` Sudip Mukherjee
102 siblings, 0 replies; 113+ messages in thread
From: Sudip Mukherjee @ 2015-11-09 9:27 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: linux-kernel, torvalds, akpm, linux, shuah.kh, stable
On Fri, Nov 06, 2015 at 11:18:07AM -0800, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.2.6 release.
> There are 110 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Nov 8 19:16:22 UTC 2015.
> Anything received after that time might be too late.
I think its late for v4.2.6. Since I am travelling could not test on my
test system. But managed to test on my travis-ci.
tile and tilegx allmodconfig fails. Build log at:
https://travis-ci.org/sudipm-mukherjee/stable/builds/89798411
Known failure. Fix already in Linus tree.
Please consider upstream commit 3a48d13d76c0088a988a2e4f5b4d94872bdf58f3
for inclusion in v4.2.7
regards
sudip
^ permalink raw reply [flat|nested] 113+ messages in thread