* [PATCH 4.11 034/197] dm space map disk: fix some book keeping in the disk space map
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream.
When decrementing the reference count for a block, the free count wasn't
being updated if the reference count went to zero.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-space-map-disk.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-space-map-disk.c
+++ b/drivers/md/persistent-data/dm-space-map-disk.c
@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_s
static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b)
{
+ int r;
+ uint32_t old_count;
enum allocation_event ev;
struct sm_disk *smd = container_of(sm, struct sm_disk, sm);
- return sm_ll_dec(&smd->ll, b, &ev);
+ r = sm_ll_dec(&smd->ll, b, &ev);
+ if (!r && (ev == SM_FREE)) {
+ /*
+ * It's only free if it's also free in the last
+ * transaction.
+ */
+ r = sm_ll_lookup(&smd->old_ll, b, &old_count);
+ if (!r && !old_count)
+ smd->nr_allocated_this_transaction--;
+ }
+
+ return r;
}
static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b)
^ permalink raw reply
* [PATCH 4.11 033/197] dm thin metadata: call precommit before saving the roots
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Joe Thornber, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <ejt@redhat.com>
commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 upstream.
These calls were the wrong way round in __write_initial_superblock.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin-metadata.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -485,11 +485,11 @@ static int __write_initial_superblock(st
if (r < 0)
return r;
- r = save_sm_roots(pmd);
+ r = dm_tm_pre_commit(pmd->tm);
if (r < 0)
return r;
- r = dm_tm_pre_commit(pmd->tm);
+ r = save_sm_roots(pmd);
if (r < 0)
return r;
^ permalink raw reply
* [PATCH 4.11 031/197] dm cache metadata: fail operations if fail_io mode has been established
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 10add84e276432d9dd8044679a1028dd4084117e upstream.
Otherwise it is possible to trigger crashes due to the metadata being
inaccessible yet these methods don't safely account for that possibility
without these checks.
Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-cache-metadata.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -1627,17 +1627,19 @@ void dm_cache_metadata_set_stats(struct
int dm_cache_commit(struct dm_cache_metadata *cmd, bool clean_shutdown)
{
- int r;
+ int r = -EINVAL;
flags_mutator mutator = (clean_shutdown ? set_clean_shutdown :
clear_clean_shutdown);
WRITE_LOCK(cmd);
+ if (cmd->fail_io)
+ goto out;
+
r = __commit_transaction(cmd, mutator);
if (r)
goto out;
r = __begin_transaction(cmd);
-
out:
WRITE_UNLOCK(cmd);
return r;
@@ -1649,7 +1651,8 @@ int dm_cache_get_free_metadata_block_cou
int r = -EINVAL;
READ_LOCK(cmd);
- r = dm_sm_get_nr_free(cmd->metadata_sm, result);
+ if (!cmd->fail_io)
+ r = dm_sm_get_nr_free(cmd->metadata_sm, result);
READ_UNLOCK(cmd);
return r;
@@ -1661,7 +1664,8 @@ int dm_cache_get_metadata_dev_size(struc
int r = -EINVAL;
READ_LOCK(cmd);
- r = dm_sm_get_nr_blocks(cmd->metadata_sm, result);
+ if (!cmd->fail_io)
+ r = dm_sm_get_nr_blocks(cmd->metadata_sm, result);
READ_UNLOCK(cmd);
return r;
^ permalink raw reply
* [PATCH 4.11 028/197] dm mpath: split and rename activate_path() to prepare for its expanded use
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Hannes Reinecke,
Christoph Hellwig, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 89bfce763e43fa4897e0d3af6b29ed909df64cfd upstream.
activate_path() is renamed to activate_path_work() which now calls
activate_or_offline_path(). activate_or_offline_path() will be used
by the next commit.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-mpath.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -111,7 +111,8 @@ typedef int (*action_fn) (struct pgpath
static struct workqueue_struct *kmultipathd, *kmpath_handlerd;
static void trigger_event(struct work_struct *work);
-static void activate_path(struct work_struct *work);
+static void activate_or_offline_path(struct pgpath *pgpath);
+static void activate_path_work(struct work_struct *work);
static void process_queued_bios(struct work_struct *work);
/*-----------------------------------------------
@@ -136,7 +137,7 @@ static struct pgpath *alloc_pgpath(void)
if (pgpath) {
pgpath->is_active = true;
- INIT_DELAYED_WORK(&pgpath->activate_path, activate_path);
+ INIT_DELAYED_WORK(&pgpath->activate_path, activate_path_work);
}
return pgpath;
@@ -1436,10 +1437,8 @@ out:
spin_unlock_irqrestore(&m->lock, flags);
}
-static void activate_path(struct work_struct *work)
+static void activate_or_offline_path(struct pgpath *pgpath)
{
- struct pgpath *pgpath =
- container_of(work, struct pgpath, activate_path.work);
struct request_queue *q = bdev_get_queue(pgpath->path.dev->bdev);
if (pgpath->is_active && !blk_queue_dying(q))
@@ -1448,6 +1447,14 @@ static void activate_path(struct work_st
pg_init_done(pgpath, SCSI_DH_DEV_OFFLINED);
}
+static void activate_path_work(struct work_struct *work)
+{
+ struct pgpath *pgpath =
+ container_of(work, struct pgpath, activate_path.work);
+
+ activate_or_offline_path(pgpath);
+}
+
static int noretry_error(int error)
{
switch (error) {
^ permalink raw reply
* [PATCH 4.11 027/197] dm mpath: requeue after a small delay if blk_get_request() fails
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bart Van Assche, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 06eb061f48594aa369f6e852b352410298b317a8 upstream.
If blk_get_request() returns ENODEV then multipath_clone_and_map()
causes a request to be requeued immediately. This can cause a kworker
thread to spend 100% of the CPU time of a single core in
__blk_mq_run_hw_queue() and also can cause device removal to never
finish.
Avoid this by only requeuing after a delay if blk_get_request() fails.
Additionally, reduce the requeue delay.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-mpath.c | 5 ++---
drivers/md/dm-rq.c | 2 +-
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-mpath.c
+++ b/drivers/md/dm-mpath.c
@@ -484,7 +484,6 @@ static int multipath_clone_and_map(struc
struct request **__clone)
{
struct multipath *m = ti->private;
- int r = DM_MAPIO_REQUEUE;
size_t nr_bytes = blk_rq_bytes(rq);
struct pgpath *pgpath;
struct block_device *bdev;
@@ -503,7 +502,7 @@ static int multipath_clone_and_map(struc
} else if (test_bit(MPATHF_QUEUE_IO, &m->flags) ||
test_bit(MPATHF_PG_INIT_REQUIRED, &m->flags)) {
pg_init_all_paths(m);
- return r;
+ return DM_MAPIO_REQUEUE;
}
memset(mpio, 0, sizeof(*mpio));
@@ -517,7 +516,7 @@ static int multipath_clone_and_map(struc
GFP_ATOMIC);
if (IS_ERR(clone)) {
/* EBUSY, ENODEV or EWOULDBLOCK: requeue */
- return r;
+ return DM_MAPIO_DELAY_REQUEUE;
}
clone->bio = clone->biotail = NULL;
clone->rq_disk = bdev->bd_disk;
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -280,7 +280,7 @@ static void dm_requeue_original_request(
if (!rq->q->mq_ops)
dm_old_requeue_request(rq);
else
- dm_mq_delay_requeue_request(rq, delay_requeue ? 5000 : 0);
+ dm_mq_delay_requeue_request(rq, delay_requeue ? 100/*ms*/ : 0);
rq_completed(md, rw, false);
}
^ permalink raw reply
* [PATCH 4.11 025/197] dm bufio: avoid a possible ABBA deadlock
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 upstream.
__get_memory_limit() tests if dm_bufio_cache_size changed and calls
__cache_size_refresh() if it did. It takes dm_bufio_clients_lock while
it already holds the client lock. However, lock ordering is violated
because in cleanup_old_buffers() dm_bufio_clients_lock is taken before
the client lock.
This results in a possible deadlock and lockdep engine warning.
Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the
lock can't be taken, it will be re-checked next time when a new buffer
is allocated.
Also add "unlikely" to the if condition, so that the optimizer assumes
that the condition is false.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -933,10 +933,11 @@ static void __get_memory_limit(struct dm
{
unsigned long buffers;
- if (ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch) {
- mutex_lock(&dm_bufio_clients_lock);
- __cache_size_refresh();
- mutex_unlock(&dm_bufio_clients_lock);
+ if (unlikely(ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch)) {
+ if (mutex_trylock(&dm_bufio_clients_lock)) {
+ __cache_size_refresh();
+ mutex_unlock(&dm_bufio_clients_lock);
+ }
}
buffers = dm_bufio_cache_size_per_client >>
^ permalink raw reply
* [PATCH 4.11 024/197] dm raid: select the Kconfig option CONFIG_MD_RAID0
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Mikulas Patocka, Mike Snitzer
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 7b81ef8b14f80033e4a4168d199a0f5fd79b9426 upstream.
Since the commit 0cf4503174c1 ("dm raid: add support for the MD RAID0
personality"), the dm-raid subsystem can activate a RAID-0 array.
Therefore, add MD_RAID0 to the dependencies of DM_RAID, so that MD_RAID0
will be selected when DM_RAID is selected.
Fixes: 0cf4503174c1 ("dm raid: add support for the MD RAID0 personality")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -365,6 +365,7 @@ config DM_LOG_USERSPACE
config DM_RAID
tristate "RAID 1/4/5/6/10 target"
depends on BLK_DEV_DM
+ select MD_RAID0
select MD_RAID1
select MD_RAID10
select MD_RAID456
^ permalink raw reply
* [PATCH 4.11 021/197] mlx5: Fix mlx5_ib_map_mr_sg mr length
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sagi Grimberg, Israel Rukshin,
Doug Ledford
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
commit 0a49f2c31c3efbeb0de3e4b5598764887f629be2 upstream.
In case we got an initial sg_offset, we need to
account for it in the mr length.
Fixes: ff2ba9936591 ("IB/core: Add passing an offset into the SG to ib_map_mr_sg")
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Tested-by: Israel Rukshin <israelr@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/mr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1782,7 +1782,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr
klms[i].va = cpu_to_be64(sg_dma_address(sg) + sg_offset);
klms[i].bcount = cpu_to_be32(sg_dma_len(sg) - sg_offset);
klms[i].key = cpu_to_be32(lkey);
- mr->ibmr.length += sg_dma_len(sg);
+ mr->ibmr.length += sg_dma_len(sg) - sg_offset;
sg_offset = 0;
}
^ permalink raw reply
* Re: [PATCH v2] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
From: Greg KH @ 2017-05-23 20:06 UTC (permalink / raw)
To: Marciniszyn, Mike
Cc: stable@vger.kernel.org, linux-rdma@vger.kernel.org,
stable-commits@vger.kernel.org
In-Reply-To: <32E1700B9017364D9B60AED9960492BC342FD4B2@fmsmsx120.amr.corp.intel.com>
On Tue, May 23, 2017 at 07:59:21PM +0000, Marciniszyn, Mike wrote:
> > > Cc: stable <stable@vger.kernel.org> # v4.10
> >
> > Why resend this???
>
> There are two patches, one for 4.10 and one for 4.11.
>
> Each of the v2's should have had a different version on the stable cc line in the signoff block.
But I already emailed you saying, 4.10 is end-of-life, no one is doing
anything with it, so why resend it?
greg k-h
^ permalink raw reply
* [PATCH 4.11 020/197] ASoC: cs4271: configure reset GPIO as output
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Sverdlin, Mark Brown
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Sverdlin <alexander.sverdlin@gmail.com>
commit 49b2e27ab9f66b0a22c21980ad8118a4038324ae upstream.
During reset "refactoring" the output configuration was lost.
This commit repairs sound on EDB93XX boards.
Fixes: 9a397f4 ("ASoC: cs4271: add regulator consumer support")
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@gmail.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/cs4271.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -498,7 +498,7 @@ static int cs4271_reset(struct snd_soc_c
struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
if (gpio_is_valid(cs4271->gpio_nreset)) {
- gpio_set_value(cs4271->gpio_nreset, 0);
+ gpio_direction_output(cs4271->gpio_nreset, 0);
mdelay(1);
gpio_set_value(cs4271->gpio_nreset, 1);
mdelay(1);
^ permalink raw reply
* [PATCH 4.11 018/197] vTPM: Fix missing NULL check
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hon Ching(Vicky) Lo, Jarkko Sakkine
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hon Ching \(Vicky\) Lo <honclo@linux.vnet.ibm.com>
commit 31574d321c70f6d3b40fe98f9b2eafd9a903fef9 upstream.
The current code passes the address of tpm_chip as the argument to
dev_get_drvdata() without prior NULL check in
tpm_ibmvtpm_get_desired_dma. This resulted an oops during kernel
boot when vTPM is enabled in Power partition configured in active
memory sharing mode.
The vio_driver's get_desired_dma() is called before the probe(), which
for vtpm is tpm_ibmvtpm_probe, and it's this latter function that
initializes the driver and set data. Attempting to get data before
the probe() caused the problem.
This patch adds a NULL check to the tpm_ibmvtpm_get_desired_dma.
fixes: 9e0d39d8a6a0 ("tpm: Remove useless priv field in struct tpm_vendor_specific")
Signed-off-by: Hon Ching(Vicky) Lo <honclo@linux.vnet.ibm.com>
Reviewed-by: Jarkko Sakkine <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -299,6 +299,8 @@ static int tpm_ibmvtpm_remove(struct vio
}
kfree(ibmvtpm);
+ /* For tpm_ibmvtpm_get_desired_dma */
+ dev_set_drvdata(&vdev->dev, NULL);
return 0;
}
@@ -313,14 +315,16 @@ static int tpm_ibmvtpm_remove(struct vio
static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev)
{
struct tpm_chip *chip = dev_get_drvdata(&vdev->dev);
- struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev);
+ struct ibmvtpm_dev *ibmvtpm;
/*
* ibmvtpm initializes at probe time, so the data we are
* asking for may not be set yet. Estimate that 4K required
* for TCE-mapped buffer in addition to CRQ.
*/
- if (!ibmvtpm)
+ if (chip)
+ ibmvtpm = dev_get_drvdata(&chip->dev);
+ else
return CRQ_RES_BUF_SIZE + PAGE_SIZE;
return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size;
^ permalink raw reply
* [PATCH 4.11 017/197] tpm_crb: check for bad response size
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jerry Snitselaar, Jarkko Sakkinen
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Snitselaar <jsnitsel@redhat.com>
commit 8569defde8057258835c51ce01a33de82e14b148 upstream.
Make sure size of response buffer is at least 6 bytes, or
we will underflow and pass large size_t to memcpy_fromio().
This was encountered while testing earlier version of
locality patchset.
Fixes: 30fc8d138e912 ("tpm: TPM 2.0 CRB Interface")
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_crb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -176,8 +176,7 @@ static int crb_recv(struct tpm_chip *chi
memcpy_fromio(buf, priv->rsp, 6);
expected = be32_to_cpup((__be32 *) &buf[2]);
-
- if (expected > count)
+ if (expected > count || expected < 6)
return -EIO;
memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
^ permalink raw reply
* [PATCH 4.11 015/197] tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Nayna Jain, Jarkko Sakkinen
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <nayna@linux.vnet.ibm.com>
commit a233a0289cf9a96ef9b42c730a7621ccbf9a6f98 upstream.
Commit 500462a9de65 "timers: Switch to a non-cascading wheel" replaced
the 'classic' timer wheel, which aimed for near 'exact' expiry of the
timers. Their analysis was that the vast majority of timeout timers
are used as safeguards, not as real timers, and are cancelled or
rearmed before expiration. The only exception noted to this were
networking timers with a small expiry time.
Not included in the analysis was the TPM polling timer, which resulted
in a longer normal delay and, every so often, a very long delay. The
non-cascading wheel delay is based on CONFIG_HZ. For a description of
the different rings and their delays, refer to the comments in
kernel/time/timer.c.
Below are the delays given for rings 0 - 2, which explains the longer
"normal" delays and the very, long delays as seen on systems with
CONFIG_HZ 250.
* HZ 1000 steps
* Level Offset Granularity Range
* 0 0 1 ms 0 ms - 63 ms
* 1 64 8 ms 64 ms - 511 ms
* 2 128 64 ms 512 ms - 4095 ms (512ms - ~4s)
* HZ 250
* Level Offset Granularity Range
* 0 0 4 ms 0 ms - 255 ms
* 1 64 32 ms 256 ms - 2047 ms (256ms - ~2s)
* 2 128 256 ms 2048 ms - 16383 ms (~2s - ~16s)
Below is a comparison of extending the TPM with 1000 measurements,
using msleep() vs. usleep_delay() when configured for 1000 hz vs. 250
hz, before and after commit 500462a9de65.
linux-4.7 | msleep() usleep_range()
1000 hz: 0m44.628s | 1m34.497s 29.243s
250 hz: 1m28.510s | 4m49.269s 32.386s
linux-4.7 | min-max (msleep) min-max (usleep_range)
1000 hz: 0:017 - 2:760s | 0:015 - 3:967s 0:014 - 0:418s
250 hz: 0:028 - 1:954s | 0:040 - 4:096s 0:016 - 0:816s
This patch replaces the msleep() with usleep_range() calls in the
i2c nuvoton driver with a consistent max range value.
Signed-of-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Nayna Jain <nayna@linux.vnet.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_i2c_nuvoton.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
--- a/drivers/char/tpm/tpm_i2c_nuvoton.c
+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c
@@ -49,9 +49,10 @@
*/
#define TPM_I2C_MAX_BUF_SIZE 32
#define TPM_I2C_RETRY_COUNT 32
-#define TPM_I2C_BUS_DELAY 1 /* msec */
-#define TPM_I2C_RETRY_DELAY_SHORT 2 /* msec */
-#define TPM_I2C_RETRY_DELAY_LONG 10 /* msec */
+#define TPM_I2C_BUS_DELAY 1000 /* usec */
+#define TPM_I2C_RETRY_DELAY_SHORT (2 * 1000) /* usec */
+#define TPM_I2C_RETRY_DELAY_LONG (10 * 1000) /* usec */
+#define TPM_I2C_DELAY_RANGE 300 /* usec */
#define OF_IS_TPM2 ((void *)1)
#define I2C_IS_TPM2 1
@@ -123,7 +124,8 @@ static s32 i2c_nuvoton_write_status(stru
/* this causes the current command to be aborted */
for (i = 0, status = -1; i < TPM_I2C_RETRY_COUNT && status < 0; i++) {
status = i2c_nuvoton_write_buf(client, TPM_STS, 1, &data);
- msleep(TPM_I2C_BUS_DELAY);
+ usleep_range(TPM_I2C_BUS_DELAY, TPM_I2C_BUS_DELAY
+ + TPM_I2C_DELAY_RANGE);
}
return status;
}
@@ -160,7 +162,8 @@ static int i2c_nuvoton_get_burstcount(st
burst_count = min_t(u8, TPM_I2C_MAX_BUF_SIZE, data);
break;
}
- msleep(TPM_I2C_BUS_DELAY);
+ usleep_range(TPM_I2C_BUS_DELAY, TPM_I2C_BUS_DELAY
+ + TPM_I2C_DELAY_RANGE);
} while (time_before(jiffies, stop));
return burst_count;
@@ -203,13 +206,17 @@ static int i2c_nuvoton_wait_for_stat(str
return 0;
/* use polling to wait for the event */
- ten_msec = jiffies + msecs_to_jiffies(TPM_I2C_RETRY_DELAY_LONG);
+ ten_msec = jiffies + usecs_to_jiffies(TPM_I2C_RETRY_DELAY_LONG);
stop = jiffies + timeout;
do {
if (time_before(jiffies, ten_msec))
- msleep(TPM_I2C_RETRY_DELAY_SHORT);
+ usleep_range(TPM_I2C_RETRY_DELAY_SHORT,
+ TPM_I2C_RETRY_DELAY_SHORT
+ + TPM_I2C_DELAY_RANGE);
else
- msleep(TPM_I2C_RETRY_DELAY_LONG);
+ usleep_range(TPM_I2C_RETRY_DELAY_LONG,
+ TPM_I2C_RETRY_DELAY_LONG
+ + TPM_I2C_DELAY_RANGE);
status_valid = i2c_nuvoton_check_status(chip, mask,
value);
if (status_valid)
^ permalink raw reply
* [PATCH 4.11 014/197] tpm_tis_spi: Add small delay after last transfer
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Steffen, Peter Huewe,
Jarkko Sakkinen, Benoit Houyere
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <peter.huewe@infineon.com>
commit 5cc0101d1f88500f8901d01b035af743215d4c3a upstream.
Testing the implementation with a Raspberry Pi 2 showed that under some
circumstances its SPI master erroneously releases the CS line before the
transfer is complete, i.e. before the end of the last clock. In this case
the TPM ignores the transfer and misses for example the GO command. The
driver is unable to detect this communication problem and will wait for a
command response that is never going to arrive, timing out eventually.
As a workaround, the small delay ensures that the CS line is held long
enough, even with a faulty SPI master. Other SPI masters are not affected,
except for a negligible performance penalty.
Fixes: 0edbfea537d1 ("tpm/tpm_tis_spi: Add support for spi phy")
Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
Signed-off-by: Peter Huewe <peter.huewe@infineon.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Benoit Houyere <benoit.houyere@st.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_spi.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/char/tpm/tpm_tis_spi.c
+++ b/drivers/char/tpm/tpm_tis_spi.c
@@ -111,6 +111,7 @@ static int tpm_tis_spi_transfer(struct t
spi_xfer.cs_change = 0;
spi_xfer.len = transfer_len;
+ spi_xfer.delay_usecs = 5;
if (direction) {
spi_xfer.tx_buf = NULL;
^ permalink raw reply
* [PATCH 4.11 009/197] fanotify: dont expose EOPENSTALE to userspace
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Marko Rauhamaa, linux-api,
Amir Goldstein, Jan Kara
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <amir73il@gmail.com>
commit 4ff33aafd32e084f5ee7faa54ba06e95f8b1b8af upstream.
When delivering an event to userspace for a file on an NFS share,
if the file is deleted on server side before user reads the event,
user will not get the event.
If the event queue contained several events, the stale event is
quietly dropped and read() returns to user with events read so far
in the buffer.
If the event queue contains a single stale event or if the stale
event is a permission event, read() returns to user with the kernel
internal error code 518 (EOPENSTALE), which is not a POSIX error code.
Check the internal return value -EOPENSTALE in fanotify_read(), just
the same as it is checked in path_openat() and drop the event in the
cases that it is not already dropped.
This is a reproducer from Marko Rauhamaa:
Just take the example program listed under "man fanotify" ("fantest")
and follow these steps:
==============================================================
NFS Server NFS Client(1) NFS Client(2)
==============================================================
# echo foo >/nfsshare/bar.txt
# cat /nfsshare/bar.txt
foo
# ./fantest /nfsshare
Press enter key to terminate.
Listening for events.
# rm -f /nfsshare/bar.txt
# cat /nfsshare/bar.txt
read: Unknown error 518
cat: /nfsshare/bar.txt: Operation not permitted
==============================================================
where NFS Client (1) and (2) are two terminal sessions on a single NFS
Client machine.
Reported-by: Marko Rauhamaa <marko.rauhamaa@f-secure.com>
Tested-by: Marko Rauhamaa <marko.rauhamaa@f-secure.com>
Cc: <linux-api@vger.kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/notify/fanotify/fanotify_user.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -295,27 +295,37 @@ static ssize_t fanotify_read(struct file
}
ret = copy_event_to_user(group, kevent, buf);
+ if (unlikely(ret == -EOPENSTALE)) {
+ /*
+ * We cannot report events with stale fd so drop it.
+ * Setting ret to 0 will continue the event loop and
+ * do the right thing if there are no more events to
+ * read (i.e. return bytes read, -EAGAIN or wait).
+ */
+ ret = 0;
+ }
+
/*
* Permission events get queued to wait for response. Other
* events can be destroyed now.
*/
if (!(kevent->mask & FAN_ALL_PERM_EVENTS)) {
fsnotify_destroy_event(group, kevent);
- if (ret < 0)
- break;
} else {
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
- if (ret < 0) {
+ if (ret <= 0) {
FANOTIFY_PE(kevent)->response = FAN_DENY;
wake_up(&group->fanotify_data.access_waitq);
- break;
+ } else {
+ spin_lock(&group->notification_lock);
+ list_add_tail(&kevent->list,
+ &group->fanotify_data.access_list);
+ spin_unlock(&group->notification_lock);
}
- spin_lock(&group->notification_lock);
- list_add_tail(&kevent->list,
- &group->fanotify_data.access_list);
- spin_unlock(&group->notification_lock);
#endif
}
+ if (ret < 0)
+ break;
buf += ret;
count -= ret;
}
^ permalink raw reply
* [PATCH 4.11 007/197] tpm_tis_core: Choose appropriate timeout for reading burstcount
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Steffen, Peter Huewe,
Jarkko Sakkinen
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Steffen <Alexander.Steffen@infineon.com>
commit 302a6ad7fc77146191126a1f3e2c5d724fd72416 upstream.
TIS v1.3 for TPM 1.2 and PTP for TPM 2.0 disagree about which timeout
value applies to reading a valid burstcount. It is TIMEOUT_D according to
TIS, but TIMEOUT_A according to PTP, so choose the appropriate value
depending on whether we deal with a TPM 1.2 or a TPM 2.0.
This is important since according to the PTP TIMEOUT_D is much smaller
than TIMEOUT_A. So the previous implementation could run into timeouts
with a TPM 2.0, even though the TPM was behaving perfectly fine.
During tpm2_probe TIMEOUT_D will be used even with a TPM 2.0, because
TPM_CHIP_FLAG_TPM2 is not yet set. This is fine, since the timeout values
will only be changed afterwards by tpm_get_timeouts. Until then
TIS_TIMEOUT_D_MAX applies, which is large enough.
Fixes: aec04cbdf723 ("tpm: TPM 2.0 FIFO Interface")
Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
Signed-off-by: Peter Huewe <peter.huewe@infineon.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -160,8 +160,10 @@ static int get_burstcount(struct tpm_chi
u32 value;
/* wait for burstcount */
- /* which timeout value, spec has 2 answers (c & d) */
- stop = jiffies + chip->timeout_d;
+ if (chip->flags & TPM_CHIP_FLAG_TPM2)
+ stop = jiffies + chip->timeout_a;
+ else
+ stop = jiffies + chip->timeout_d;
do {
rc = tpm_tis_read32(priv, TPM_STS(priv->locality), &value);
if (rc < 0)
^ permalink raw reply
* [PATCH 4.11 006/197] USB: core: replace %p with %pK
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vamsi Krishna Samavedam
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
commit 2f964780c03b73de269b08d12aff96a9618d13f3 upstream.
Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.
echo 0 > /proc/sys/kernel/kptr_restrict
[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/devio.c | 14 +++++++-------
drivers/usb/core/hcd.c | 4 ++--
drivers/usb/core/urb.c | 2 +-
3 files changed, 10 insertions(+), 10 deletions(-)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device
if (userurb) { /* Async */
if (when == SUBMIT)
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"length %u\n",
userurb, ep, t, d, length);
else
- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "
+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
"actual_length %u status %d\n",
userurb, ep, t, d, length,
timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_s
if (as) {
int retval;
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl(as, (void __user * __user *)arg);
free_async(as);
return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct u
as = async_getcompleted(ps);
if (as) {
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl(as, (void __user * __user *)arg);
free_async(as);
} else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct us
if (as) {
int retval;
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl_compat(as, (void __user * __user *)arg);
free_async(as);
return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(s
as = async_getcompleted(ps);
if (as) {
- snoop(&ps->dev->dev, "reap %p\n", as->userurb);
+ snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
retval = processcompl_compat(as, (void __user * __user *)arg);
free_async(as);
} else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file
#endif
case USBDEVFS_DISCARDURB:
- snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);
+ snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
ret = proc_unlinkurb(ps, p);
break;
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1722,7 +1722,7 @@ int usb_hcd_unlink_urb (struct urb *urb,
if (retval == 0)
retval = -EINPROGRESS;
else if (retval != -EIDRM && retval != -EBUSY)
- dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
+ dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",
urb, retval);
usb_put_dev(udev);
}
@@ -1889,7 +1889,7 @@ rescan:
/* kick hcd */
unlink1(hcd, urb, -ESHUTDOWN);
dev_dbg (hcd->self.controller,
- "shutdown urb %p ep%d%s%s\n",
+ "shutdown urb %pK ep%d%s%s\n",
urb, usb_endpoint_num(&ep->desc),
is_in ? "in" : "out",
({ char *s;
--- a/drivers/usb/core/urb.c
+++ b/drivers/usb/core/urb.c
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_
if (!urb || !urb->complete)
return -EINVAL;
if (urb->hcpriv) {
- WARN_ONCE(1, "URB %p submitted while active\n", urb);
+ WARN_ONCE(1, "URB %pK submitted while active\n", urb);
return -EBUSY;
}
^ permalink raw reply
* [PATCH 4.11 004/197] watchdog: pcwd_usb: fix NULL-deref at probe
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johan Hovold, Guenter Roeck,
Wim Van Sebroeck
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 46c319b848268dab3f0e7c4a5b6e9146d3bca8a4 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/watchdog/pcwd_usb.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/watchdog/pcwd_usb.c
+++ b/drivers/watchdog/pcwd_usb.c
@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_int
return -ENODEV;
}
+ if (iface_desc->desc.bNumEndpoints < 1)
+ return -ENODEV;
+
/* check out the endpoint: it has to be Interrupt & IN */
endpoint = &iface_desc->endpoint[0].desc;
^ permalink raw reply
* [PATCH 4.11 003/197] USB: ene_usb6250: fix DMA to the stack
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern
In-Reply-To: <20170523200821.666872592@linuxfoundation.org>
4.11-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 628c2893d44876ddd11602400c70606ade62e129 upstream.
The ene_usb6250 sub-driver in usb-storage does USB I/O to buffers on
the stack, which doesn't work with vmapped stacks. This patch fixes
the problem by allocating a separate 512-byte buffer at probe time and
using it for all of the offending I/O operations.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/ene_ub6250.c | 90 +++++++++++++++++++++++----------------
1 file changed, 55 insertions(+), 35 deletions(-)
--- a/drivers/usb/storage/ene_ub6250.c
+++ b/drivers/usb/storage/ene_ub6250.c
@@ -446,6 +446,10 @@ struct ms_lib_ctrl {
#define SD_BLOCK_LEN 9
struct ene_ub6250_info {
+
+ /* I/O bounce buffer */
+ u8 *bbuf;
+
/* for 6250 code */
struct SD_STATUS SD_Status;
struct MS_STATUS MS_Status;
@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_da
static void ene_ub6250_info_destructor(void *extra)
{
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra;
+
if (!extra)
return;
+ kfree(info->bbuf);
}
static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg)
@@ -860,8 +867,9 @@ static int ms_read_readpage(struct us_da
u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat)
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
int result;
- u8 ExtBuf[4];
u32 bn = PhyBlockAddr * 0x20 + PageNum;
result = ene_load_bincode(us, MS_RW_PATTERN);
@@ -901,7 +909,7 @@ static int ms_read_readpage(struct us_da
bcb->CDB[2] = (unsigned char)(PhyBlockAddr>>16);
bcb->CDB[6] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
@@ -910,9 +918,9 @@ static int ms_read_readpage(struct us_da
ExtraDat->status0 = 0x10; /* Not yet,fireware support */
ExtraDat->status1 = 0x00; /* Not yet,fireware support */
- ExtraDat->ovrflg = ExtBuf[0];
- ExtraDat->mngflg = ExtBuf[1];
- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+ ExtraDat->ovrflg = bbuf[0];
+ ExtraDat->mngflg = bbuf[1];
+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]);
return USB_STOR_TRANSPORT_GOOD;
}
@@ -1332,8 +1340,9 @@ static int ms_lib_read_extra(struct us_d
u8 PageNum, struct ms_lib_type_extdat *ExtraDat)
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
int result;
- u8 ExtBuf[4];
memset(bcb, 0, sizeof(struct bulk_cb_wrap));
bcb->Signature = cpu_to_le32(US_BULK_CB_SIGN);
@@ -1347,7 +1356,7 @@ static int ms_lib_read_extra(struct us_d
bcb->CDB[2] = (unsigned char)(PhyBlock>>16);
bcb->CDB[6] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
@@ -1355,9 +1364,9 @@ static int ms_lib_read_extra(struct us_d
ExtraDat->intr = 0x80; /* Not yet, waiting for fireware support */
ExtraDat->status0 = 0x10; /* Not yet, waiting for fireware support */
ExtraDat->status1 = 0x00; /* Not yet, waiting for fireware support */
- ExtraDat->ovrflg = ExtBuf[0];
- ExtraDat->mngflg = ExtBuf[1];
- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]);
+ ExtraDat->ovrflg = bbuf[0];
+ ExtraDat->mngflg = bbuf[1];
+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]);
return USB_STOR_TRANSPORT_GOOD;
}
@@ -1556,9 +1565,9 @@ static int ms_lib_scan_logicalblocknumbe
u16 PhyBlock, newblk, i;
u16 LogStart, LogEnde;
struct ms_lib_type_extdat extdat;
- u8 buf[0x200];
u32 count = 0, index = 0;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) {
ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde);
@@ -1572,14 +1581,16 @@ static int ms_lib_scan_logicalblocknumbe
}
if (count == PhyBlock) {
- ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf);
+ ms_lib_read_extrablock(us, PhyBlock, 0, 0x80,
+ bbuf);
count += 0x80;
}
index = (PhyBlock % 0x80) * 4;
- extdat.ovrflg = buf[index];
- extdat.mngflg = buf[index+1];
- extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]);
+ extdat.ovrflg = bbuf[index];
+ extdat.mngflg = bbuf[index+1];
+ extdat.logadr = memstick_logaddr(bbuf[index+2],
+ bbuf[index+3]);
if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) {
ms_lib_setacquired_errorblock(us, PhyBlock);
@@ -2062,9 +2073,9 @@ static int ene_ms_init(struct us_data *u
{
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
int result;
- u8 buf[0x200];
u16 MSP_BlockSize, MSP_UserAreaBlocks;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
printk(KERN_INFO "transport --- ENE_MSInit\n");
@@ -2083,13 +2094,13 @@ static int ene_ms_init(struct us_data *u
bcb->CDB[0] = 0xF1;
bcb->CDB[1] = 0x01;
- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD) {
printk(KERN_ERR "Execution MS Init Code Fail !!\n");
return USB_STOR_TRANSPORT_ERROR;
}
/* the same part to test ENE */
- info->MS_Status = *(struct MS_STATUS *)&buf[0];
+ info->MS_Status = *(struct MS_STATUS *) bbuf;
if (info->MS_Status.Insert && info->MS_Status.Ready) {
printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert);
@@ -2098,15 +2109,15 @@ static int ene_ms_init(struct us_data *u
printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG);
printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP);
if (info->MS_Status.IsMSPro) {
- MSP_BlockSize = (buf[6] << 8) | buf[7];
- MSP_UserAreaBlocks = (buf[10] << 8) | buf[11];
+ MSP_BlockSize = (bbuf[6] << 8) | bbuf[7];
+ MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11];
info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks;
} else {
ms_card_init(us); /* Card is MS (to ms.c)*/
}
usb_stor_dbg(us, "MS Init Code OK !!\n");
} else {
- usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]);
+ usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]);
return USB_STOR_TRANSPORT_ERROR;
}
@@ -2116,9 +2127,9 @@ static int ene_ms_init(struct us_data *u
static int ene_sd_init(struct us_data *us)
{
int result;
- u8 buf[0x200];
struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf;
struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra;
+ u8 *bbuf = info->bbuf;
usb_stor_dbg(us, "transport --- ENE_SDInit\n");
/* SD Init Part-1 */
@@ -2152,17 +2163,17 @@ static int ene_sd_init(struct us_data *u
bcb->Flags = US_BULK_FLAG_IN;
bcb->CDB[0] = 0xF1;
- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0);
+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0);
if (result != USB_STOR_XFER_GOOD) {
usb_stor_dbg(us, "Execution SD Init Code Fail !!\n");
return USB_STOR_TRANSPORT_ERROR;
}
- info->SD_Status = *(struct SD_STATUS *)&buf[0];
+ info->SD_Status = *(struct SD_STATUS *) bbuf;
if (info->SD_Status.Insert && info->SD_Status.Ready) {
struct SD_STATUS *s = &info->SD_Status;
- ene_get_card_status(us, (unsigned char *)&buf);
+ ene_get_card_status(us, bbuf);
usb_stor_dbg(us, "Insert = %x\n", s->Insert);
usb_stor_dbg(us, "Ready = %x\n", s->Ready);
usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC);
@@ -2170,7 +2181,7 @@ static int ene_sd_init(struct us_data *u
usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed);
usb_stor_dbg(us, "WtP = %x\n", s->WtP);
} else {
- usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]);
+ usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]);
return USB_STOR_TRANSPORT_ERROR;
}
return USB_STOR_TRANSPORT_GOOD;
@@ -2180,13 +2191,15 @@ static int ene_sd_init(struct us_data *u
static int ene_init(struct us_data *us)
{
int result;
- u8 misc_reg03 = 0;
+ u8 misc_reg03;
struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra);
+ u8 *bbuf = info->bbuf;
- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+ result = ene_get_card_type(us, REG_CARD_STATUS, bbuf);
if (result != USB_STOR_XFER_GOOD)
return USB_STOR_TRANSPORT_ERROR;
+ misc_reg03 = bbuf[0];
if (misc_reg03 & 0x01) {
if (!info->SD_Status.Ready) {
result = ene_sd_init(us);
@@ -2303,8 +2316,9 @@ static int ene_ub6250_probe(struct usb_i
const struct usb_device_id *id)
{
int result;
- u8 misc_reg03 = 0;
+ u8 misc_reg03;
struct us_data *us;
+ struct ene_ub6250_info *info;
result = usb_stor_probe1(&us, intf, id,
(id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list,
@@ -2313,11 +2327,16 @@ static int ene_ub6250_probe(struct usb_i
return result;
/* FIXME: where should the code alloc extra buf ? */
- if (!us->extra) {
- us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
- if (!us->extra)
- return -ENOMEM;
- us->extra_destructor = ene_ub6250_info_destructor;
+ us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL);
+ if (!us->extra)
+ return -ENOMEM;
+ us->extra_destructor = ene_ub6250_info_destructor;
+
+ info = (struct ene_ub6250_info *)(us->extra);
+ info->bbuf = kmalloc(512, GFP_KERNEL);
+ if (!info->bbuf) {
+ kfree(us->extra);
+ return -ENOMEM;
}
us->transport_name = "ene_ub6250";
@@ -2329,12 +2348,13 @@ static int ene_ub6250_probe(struct usb_i
return result;
/* probe card type */
- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03);
+ result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf);
if (result != USB_STOR_XFER_GOOD) {
usb_stor_disconnect(intf);
return USB_STOR_TRANSPORT_ERROR;
}
+ misc_reg03 = info->bbuf[0];
if (!(misc_reg03 & 0x01)) {
pr_info("ums_eneub6250: This driver only supports SD/MS cards. "
"It does not support SM cards.\n");
^ permalink raw reply
* [PATCH 4.11 000/197] 4.11.3-stable review
From: Greg Kroah-Hartman @ 2017-05-23 20:06 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, stable
This is the start of the stable review cycle for the 4.11.3 release.
There are 197 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu May 25 20:07:44 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.11.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.11.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.11.3-rc1
Tadeusz Struk <tadeusz.struk@intel.com>
IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
Chris Wilson <chris@chris-wilson.co.uk>
drm/i915/gvt: Disable access to stolen memory as a guest
Julius Werner <jwerner@chromium.org>
drivers: char: mem: Check for address space wraparound with mmap()
Trond Myklebust <trond.myklebust@primarydata.com>
nfsd: Fix up the "supattr_exclcreat" attributes
J. Bruce Fields <bfields@redhat.com>
nfsd: encoders mustn't use unitialized values in error cases
Ari Kauppi <ari@synopsys.com>
nfsd: fix undefined behavior in nfsd4_layout_verify
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4: Fix an rcu lock leak
Trond Myklebust <trond.myklebust@primarydata.com>
pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect
Benjamin Coddington <bcodding@redhat.com>
NFS: Use GFP_NOIO for two allocations in writeback
Fred Isaman <fred.isaman@gmail.com>
NFS: Fix use after free in write error path
Trond Myklebust <trond.myklebust@primarydata.com>
NFSv4: Fix a hang in OPEN related to server reboot
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
Alexander Couzens <lynxis@fe80.eu>
mtd: nand: add ooblayout for old hamming layout
Roger Quadros <rogerq@ti.com>
mtd: nand: omap2: Fix partition creation via cmdline mtdparts
Simon Baatz <gmbnomis@gmail.com>
mtd: nand: orion: fix clk handling
Lukas Wunner <lukas@wunner.de>
PCI: Freeze PME scan before suspending devices
David Woodhouse <dwmw@amazon.co.uk>
PCI: Only allow WC mmap on prefetchable resources
David Woodhouse <dwmw@amazon.co.uk>
PCI: Fix another sanity check bug in /proc/pci mmap
David Woodhouse <dwmw@amazon.co.uk>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
K. Y. Srinivasan <kys@microsoft.com>
PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs
K. Y. Srinivasan <kys@microsoft.com>
PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC
Tomasz Nowicki <tn@semihalf.com>
PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk
Bjorn Helgaas <bhelgaas@google.com>
PCI/ACPI: Tidy up MCFG quirk whitespace
Dawei Chien <dawei.chien@mediatek.com>
thermal: mt8173: minor mtk_thermal.c cleanups
Thomas Gleixner <tglx@linutronix.de>
tracing/kprobes: Enforce kprobes teardown after testing
Arnd Bergmann <arnd@arndb.de>
firmware: ti_sci: fix strncat length check
Masami Hiramatsu <mhiramat@kernel.org>
um: Fix to call read_initrd after init_bootmem
Lars Ellenberg <lars.ellenberg@linbit.com>
drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub()
Al Viro <viro@zeniv.linux.org.uk>
osf_wait4(): fix infoleak
Suzuki K Poulose <suzuki.poulose@arm.com>
kvm: arm/arm64: Force reading uncached stage2 PGD
Suzuki K Poulose <suzuki.poulose@arm.com>
kvm: arm/arm64: Fix use after free of stage2 page table
Suzuki K Poulose <suzuki.poulose@arm.com>
kvm: arm/arm64: Fix race in resetting stage2 PGD
Huacai Chen <chenhc@lemote.com>
MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6
Jon Derrick <jonathan.derrick@intel.com>
nvme: unmap CMB and remove sysfs file in reset path
Thomas Gleixner <tglx@linutronix.de>
genirq: Fix chained interrupt data ordering
Johan Hovold <johan@kernel.org>
uwb: fix device quirk on big-endian hosts
Daniel Micay <danielmicay@gmail.com>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Check access_ok in strncpy_from_user
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Fix access_ok()
Li, Fei <fei.li@intel.com>
cpuidle: check dev before usage in cpuidle_use_deepest_state()
KarimAllah Ahmed <karahmed@amazon.de>
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: GetTs Fix invalid TID 7 warning.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.
Phil Elwell <phil@raspberrypi.org>
staging: vc04_services: Fix bulk cache maintenance
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: documentation: document tagged pointer stack constraints
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: entry: improve data abort handling of tagged pointers
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: hw_breakpoint: fix watchpoint matching for tagged pointers
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: traps: fix userspace cache maintenance emulation on a tagged pointer
Mark Rutland <mark.rutland@arm.com>
arm64: uaccess: ensure extension of access_ok() addr
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated: ensure extension of addr
Mark Rutland <mark.rutland@arm.com>
arm64: ensure extension of smp_store_release value
Mark Rutland <mark.rutland@arm.com>
arm64: xchg: hazard against entire exchange variable
Daniel Lezcano <daniel.lezcano@linaro.org>
arm64: dts: hi6220: Reset the mmc hosts
Leonard Crestez <leonard.crestez@nxp.com>
ARM: dts: imx6sx-sdb: Remove OPP override
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: fix ADC vref
Vladimir Murzin <vladimir.murzin@arm.com>
ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call
Jon Medhurst <tixy@linaro.org>
ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap
Ard Biesheuvel <ard.biesheuvel@linaro.org>
ARM: 8662/1: module: split core and init PLT sections
Zhichao Huang <zhichao.huang@linaro.org>
KVM: arm: plug potential guest hardware debug leakage
Marc Zyngier <marc.zyngier@arm.com>
KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <marc.zyngier@arm.com>
KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt
Marc Zyngier <marc.zyngier@arm.com>
arm: KVM: Do not use stack-protector to compile HYP code
Marc Zyngier <marc.zyngier@arm.com>
arm64: KVM: Do not use stack-protector to compile EL2 code
Michael Neuling <mikey@neuling.org>
powerpc/tm: Fix FP and VMX register corruption
Michael Ellerman <mpe@ellerman.id.au>
powerpc/mm: Fix crash in page table dump with huge pages
LiuHailong <liu.hailong6@zte.com.cn>
powerpc/64e: Fix hang when debugging programs with relocated kernel
Alistair Popple <alistair@popple.id.au>
powerpc/powernv: Fix TCE kill on NVLink2
Alexey Kardashevskiy <aik@ozlabs.ru>
powerpc/iommu: Do not call PageTransHuge() on tail pages
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
powerpc/book3s/mce: Move add_taint() later in virtual mode
Russell Currey <ruscur@russell.cc>
powerpc/eeh: Avoid use after free in eeh_handle_special_event()
David Gibson <david@gibson.dropbear.id.au>
powerpc/mm: Ensure IRQs are off in switch_mm()
Johan Hovold <johan@kernel.org>
cx231xx-cards: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix init error path
Alyssa Milburn <amilburn@zall.org>
dw2102: limit messages to buffer size
Alyssa Milburn <amilburn@zall.org>
digitv: limit messages to buffer size
Daniel Scheller <d.scheller@gmx.net>
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
Alyssa Milburn <amilburn@zall.org>
zr364xx: enforce minimum size when reading header
Johan Hovold <johan@kernel.org>
dib0700: fix NULL-deref at probe
Marek Szyprowski <m.szyprowski@samsung.com>
s5p-mfc: Fix unbalanced call to clock management
Johan Hovold <johan@kernel.org>
gspca: konica: add missing endpoint sanity check
Marek Szyprowski <m.szyprowski@samsung.com>
s5p-mfc: Fix race between interrupt routine and device functions
Lee Jones <lee.jones@linaro.org>
cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC)
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
iio: hid-sensor: Store restore poll and hysteresis on S3
Matt Ranostay <matt.ranostay@konsulko.com>
iio: proximity: as3935: fix as3935_write
Dan Carpenter <dan.carpenter@oracle.com>
ipx: call ipxitf_put() in ioctl error path
Johan Hovold <johan@kernel.org>
USB: hub: fix non-SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: hub: fix SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: serial: io_ti: fix div-by-zero in set_termios
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix big-endian baud-rate handling
Bjørn Mork <bjorn@mork.no>
USB: serial: qcserial: add more Lenovo EM74xx device IDs
Daniele Palmas <dnlplm@gmail.com>
usb: serial: option: add Telit ME910 support
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix info ioctl on big-endian hosts
Tony Lindgren <tony@atomide.com>
usb: musb: Fix trying to suspend while active for OTG configurations
Peter Ujfalusi <peter.ujfalusi@ti.com>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: gadget: Prevent losing events in event cache
Ben Hutchings <ben@decadent.org.uk>
dvb-usb-dibusb-mc-common: Add MODULE_LICENSE
Alyssa Milburn <amilburn@zall.org>
ttusb2: limit messages to buffer size
Johan Hovold <johan@kernel.org>
mceusb: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
usbvision: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
net: irda: irda-usb: fix firmware name on big-endian hosts
Peter Chen <peter.chen@nxp.com>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
Alan Stern <stern@rowland.harvard.edu>
USB: xhci: fix lock-inversion problem
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
usb: host: xhci-plat: propagate return value of platform_get_irq()
Matthias Lange <matthias.lange@kernkonzept.com>
xhci: remove GFP_DMA flag from allocation
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Fix command ring stop regression in 4.11
Yazen Ghannam <yazen.ghannam@amd.com>
EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h
Jan Kara <jack@suse.cz>
dax: fix data corruption when fault races with write
Toshi Kani <toshi.kani@hpe.com>
libnvdimm: fix clear length of nvdimm_forget_poison()
David Howells <dhowells@redhat.com>
Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx()
Johan Hovold <johan@kernel.org>
USB: chaoskey: fix Alea quirk on big-endian hosts
Andrey Korolyov <andrey@xdel.ru>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
Anthony Mallet <anthony.mallet@laas.fr>
USB: serial: ftdi_sio: fix setting latency for unprivileged users
Kirill Tkhai <ktkhai@virtuozzo.com>
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
Eric W. Biederman <ebiederm@xmission.com>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
Michael J. Ruhl <michael.j.ruhl@intel.com>
IB/hfi1: Fix a subcontext memory leak
Michael J. Ruhl <michael.j.ruhl@intel.com>
IB/hfi1: Return an error on memory allocation failure
Fabrice Gasnier <fabrice.gasnier@st.com>
iio: stm32 trigger: fix sampling_frequency read
Andreas Klinger <ak@it-klinger.de>
IIO: bmp280-core.c: fix error in humidity calculation
Pavel Roskin <plroskin@gmail.com>
iio: dac: ad7303: fix channel description
James Smart <jsmart2021@gmail.com>
scsi: lpfc: Fix panic on BFS configuration
Bryant G. Ly <bryantly@linux.vnet.ibm.com>
ibmvscsis: Do not send aborted task response
Johan Hovold <johan@kernel.org>
of: fdt: add missing allocation-failure check
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes()
Rob Herring <robh@kernel.org>
of: fix sparse warning in of_pci_range_parser_one
Takashi Iwai <tiwai@suse.de>
proc: Fix unbalanced hard link numbers
Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
cxl: Route eeh events to all drivers in cxl_pci_error_detected()
Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
cxl: Force context lock during EEH flow
Gerd Hoffmann <kraxel@redhat.com>
ohci-pci: add qemu quirk
Tobias Herzog <t-herzog@gmx.de>
cdc-acm: fix possible invalid access when processing notification
David Rivshin <DRivshin@allworx.com>
gpio: omap: return error if requested debounce time is not possible
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: handle races with hw when updating the next alarm time
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: ack interrupt before processing alarms
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/kms/nv50: skip core channel cursor update on position-only changes
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/kms/nv50: fix source-rect-only plane updates
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path.
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Make display watermark calculations more accurate
Johan Hovold <johan@kernel.org>
ath9k_htc: fix NULL-deref at probe
Dmitry Tunin <hanipouspilot@gmail.com>
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
Martin Schwidefsky <schwidefsky@de.ibm.com>
s390/cputime: fix incorrect system time
Michael Holzheu <holzheu@linux.vnet.ibm.com>
s390/kdump: Add final note
Richard Cochran <rcochran@linutronix.de>
regulator: tps65023: Fix inverted core enable logic.
Wadim Egorov <w.egorov@phytec.de>
regulator: rk808: Fix RK818 LDO2
Linus Torvalds <torvalds@linux-foundation.org>
x86: fix 32-bit case of __get_user_asm_u64()
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: x86: Fix potential preemption when get the current kvmclock timestamp
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: x86: Fix load damaged SSEx MXCSR register
Daniel Glöckner <dg@emlix.com>
ima: accept previously set IMA_NEW_FILE
Brian Norris <briannorris@chromium.org>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Brian Norris <briannorris@chromium.org>
mwifiex: MAC randomization should not be persistent
Larry Finger <Larry.Finger@lwfinger.net>
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
NeilBrown <neilb@suse.com>
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
Dennis Yang <dennisyang@qnap.com>
md: update slab_cache before releasing new stripes when stripes resizing
Joe Thornber <ejt@redhat.com>
dm space map disk: fix some book keeping in the disk space map
Joe Thornber <ejt@redhat.com>
dm thin metadata: call precommit before saving the roots
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: make the parameter "retain_bytes" unsigned long
Mike Snitzer <snitzer@redhat.com>
dm cache metadata: fail operations if fail_io mode has been established
Bart Van Assche <bart.vanassche@sandisk.com>
dm mpath: delay requeuing while path initialization is in progress
Bart Van Assche <bart.vanassche@sandisk.com>
dm mpath: avoid that path removal can trigger an infinite loop
Bart Van Assche <bart.vanassche@sandisk.com>
dm mpath: split and rename activate_path() to prepare for its expanded use
Bart Van Assche <bart.vanassche@sandisk.com>
dm mpath: requeue after a small delay if blk_get_request() fails
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: check new buffer allocation watermark every 30 seconds
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: avoid a possible ABBA deadlock
Mikulas Patocka <mpatocka@redhat.com>
dm raid: select the Kconfig option CONFIG_MD_RAID0
Vinothkumar Raja <vinraja@cs.stonybrook.edu>
dm btree: fix for dm_btree_find_lowest_key()
Paolo Abeni <pabeni@redhat.com>
infiniband: call ipv6 route lookup via the stub interface
Sagi Grimberg <sagi@grimberg.me>
mlx5: Fix mlx5_ib_map_mr_sg mr length
Alexander Sverdlin <alexander.sverdlin@gmail.com>
ASoC: cs4271: configure reset GPIO as output
Petr Vandrovec <petr@vmware.com>
tpm: fix handling of the TPM 2.0 event logs
Hon Ching \(Vicky) Lo <honclo@linux.vnet.ibm.com>
vTPM: Fix missing NULL check
Jerry Snitselaar <jsnitsel@redhat.com>
tpm_crb: check for bad response size
Nayna Jain <nayna@linux.vnet.ibm.com>
tpm: add sleep only for retry in i2c_nuvoton_write_status()
Nayna Jain <nayna@linux.vnet.ibm.com>
tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Add small delay after last transfer
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Check correct byte for wait state indicator
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Abort transfer when too many wait states are signaled
Peter Huewe <peter.huewe@infineon.com>
tpm_tis_spi: Use single function to transfer data
Amir Goldstein <amir73il@gmail.com>
fanotify: don't expose EOPENSTALE to userspace
Jeeja KP <jeeja.kp@intel.com>
ALSA: hda: Fix cpu lockup when stopping the cmd dmas
Alexander Steffen <Alexander.Steffen@infineon.com>
tpm_tis_core: Choose appropriate timeout for reading burstcount
Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
USB: core: replace %p with %pK
Willy Tarreau <w@1wt.eu>
char: lp: fix possible integer overflow in lp_setup()
Johan Hovold <johan@kernel.org>
watchdog: pcwd_usb: fix NULL-deref at probe
Alan Stern <stern@rowland.harvard.edu>
USB: ene_usb6250: fix DMA to the stack
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix memory leak
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix buffers on stack
-------------
Diffstat:
Documentation/arm64/tagged-pointers.txt | 62 ++++++--
Makefile | 4 +-
arch/alpha/kernel/osf_sys.c | 6 +-
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +-
arch/arm/boot/dts/imx6sx-sdb.dts | 17 ---
arch/arm/include/asm/fixmap.h | 2 +-
arch/arm/include/asm/kvm_coproc.h | 3 +-
arch/arm/include/asm/module.h | 9 +-
arch/arm/kernel/module-plts.c | 87 +++++++----
arch/arm/kernel/module.lds | 1 +
arch/arm/kernel/setup.c | 4 +-
arch/arm/kvm/coproc.c | 77 +++++++---
arch/arm/kvm/handle_exit.c | 4 +-
arch/arm/kvm/hyp/Makefile | 2 +
arch/arm/kvm/hyp/switch.c | 4 +-
arch/arm/kvm/mmu.c | 33 +++--
arch/arm/mm/mmu.c | 16 ++-
arch/arm/mm/proc-v7m.S | 4 +-
arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 3 +
arch/arm64/include/asm/asm-uaccess.h | 9 ++
arch/arm64/include/asm/barrier.h | 20 ++-
arch/arm64/include/asm/cmpxchg.h | 2 +-
arch/arm64/include/asm/uaccess.h | 9 +-
arch/arm64/kernel/armv8_deprecated.c | 3 +-
arch/arm64/kernel/entry.S | 5 +-
arch/arm64/kernel/hw_breakpoint.c | 3 +
arch/arm64/kernel/traps.c | 4 +-
arch/arm64/kvm/hyp/Makefile | 2 +
arch/metag/include/asm/uaccess.h | 49 ++++---
arch/mips/Kconfig | 1 +
arch/powerpc/include/asm/mmu_context.h | 17 ++-
arch/powerpc/kernel/eeh_driver.c | 19 ++-
arch/powerpc/kernel/exceptions-64e.S | 12 ++
arch/powerpc/kernel/mce.c | 2 +
arch/powerpc/kernel/process.c | 19 +++
arch/powerpc/kernel/sysfs.c | 6 +
arch/powerpc/kernel/traps.c | 4 +-
arch/powerpc/mm/dump_linuxpagetables.c | 7 +-
arch/powerpc/mm/mmu_context_iommu.c | 4 +-
arch/powerpc/platforms/powernv/npu-dma.c | 8 +-
arch/powerpc/platforms/powernv/pci-ioda.c | 10 +-
arch/powerpc/platforms/powernv/pci.h | 2 +-
arch/powerpc/platforms/pseries/dlpar.c | 1 -
arch/s390/kernel/crash_dump.c | 15 ++
arch/s390/kernel/entry.S | 21 ++-
arch/um/kernel/initrd.c | 4 +-
arch/um/kernel/um_arch.c | 6 +
arch/x86/include/asm/uaccess.h | 6 +-
arch/x86/kernel/fpu/init.c | 1 +
arch/x86/kvm/x86.c | 43 ++++--
drivers/acpi/pci_mcfg.c | 14 +-
drivers/block/drbd/drbd_req.c | 27 ++--
drivers/char/lp.c | 6 +-
drivers/char/mem.c | 5 +
drivers/char/tpm/tpm2_eventlog.c | 14 +-
drivers/char/tpm/tpm_crb.c | 3 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 24 ++--
drivers/char/tpm/tpm_ibmvtpm.c | 8 +-
drivers/char/tpm/tpm_tis_core.c | 6 +-
drivers/char/tpm/tpm_tis_spi.c | 160 +++++++++------------
drivers/cpuidle/cpuidle.c | 3 +-
drivers/edac/amd64_edac.c | 40 +++---
drivers/firmware/ti_sci.c | 3 +-
drivers/gpio/gpio-omap.c | 23 ++-
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++--
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++--
drivers/gpu/drm/amd/amdgpu/dce_v6_0.c | 36 ++---
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++--
drivers/gpu/drm/drm_edid.c | 8 ++
drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +
drivers/gpu/drm/nouveau/nv50_display.c | 18 +--
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 +++++---
drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +-
.../iio/common/hid-sensors/hid-sensor-attributes.c | 26 +++-
.../iio/common/hid-sensors/hid-sensor-trigger.c | 20 ++-
drivers/iio/dac/ad7303.c | 6 +-
drivers/iio/pressure/bmp280-core.c | 11 +-
drivers/iio/proximity/as3935.c | 3 +-
drivers/iio/trigger/stm32-timer-trigger.c | 6 +-
drivers/infiniband/core/addr.c | 4 +-
drivers/infiniband/hw/hfi1/file_ops.c | 5 +-
drivers/infiniband/hw/hfi1/init.c | 1 +
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 32 +++--
drivers/infiniband/hw/hfi1/user_exp_rcv.h | 1 +
drivers/infiniband/hw/hfi1/verbs.c | 12 +-
drivers/infiniband/hw/mlx5/mr.c | 2 +-
drivers/iommu/intel-iommu.c | 5 +-
drivers/md/Kconfig | 1 +
drivers/md/dm-bufio.c | 35 +++--
drivers/md/dm-cache-metadata.c | 12 +-
drivers/md/dm-mpath.c | 47 ++++--
drivers/md/dm-rq.c | 2 +-
drivers/md/dm-thin-metadata.c | 4 +-
drivers/md/md.c | 5 +
drivers/md/persistent-data/dm-btree.c | 8 +-
drivers/md/persistent-data/dm-space-map-disk.c | 15 +-
drivers/md/raid5.c | 6 +-
drivers/media/cec/cec-core.c | 2 +-
drivers/media/dvb-frontends/cxd2841er.c | 4 +-
drivers/media/platform/s5p-mfc/s5p_mfc.c | 13 +-
drivers/media/rc/mceusb.c | 4 +-
drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++--
drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++-
drivers/media/usb/dvb-usb/dib0700_core.c | 3 +
drivers/media/usb/dvb-usb/dibusb-mc-common.c | 2 +
drivers/media/usb/dvb-usb/digitv.c | 3 +
drivers/media/usb/dvb-usb/dw2102.c | 54 +++++++
drivers/media/usb/dvb-usb/ttusb2.c | 19 +++
drivers/media/usb/gspca/konica.c | 3 +
drivers/media/usb/usbvision/usbvision-video.c | 9 +-
drivers/media/usb/zr364xx/zr364xx.c | 8 ++
drivers/misc/cxl/pci.c | 34 +++--
drivers/mtd/nand/nand_base.c | 70 ++++++++-
drivers/mtd/nand/omap2.c | 9 ++
drivers/mtd/nand/orion_nand.c | 42 +++---
drivers/net/irda/irda-usb.c | 2 +-
drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 4 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 7 +
.../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 +++++++++++++---
.../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 +
drivers/nvdimm/bus.c | 5 +-
drivers/nvme/host/pci.c | 7 +-
drivers/of/address.c | 2 +-
drivers/of/fdt.c | 3 +
drivers/of/of_numa.c | 2 +
drivers/pci/host/pci-hyperv.c | 13 +-
drivers/pci/pci-sysfs.c | 10 +-
drivers/pci/pci.c | 9 +-
drivers/pci/proc.c | 21 ++-
drivers/regulator/rk808-regulator.c | 2 +-
drivers/regulator/tps65023-regulator.c | 3 +-
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 114 +++++++++++----
drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.h | 2 +
drivers/scsi/lpfc/lpfc_crtn.h | 1 +
drivers/scsi/lpfc/lpfc_init.c | 7 +
drivers/scsi/lpfc/lpfc_sli.c | 19 ++-
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 24 ++--
drivers/staging/rtl8192e/rtl819x_TSProc.c | 15 +-
.../interface/vchiq_arm/vchiq_2835_arm.c | 31 ++--
drivers/thermal/mtk_thermal.c | 2 +-
drivers/usb/class/cdc-acm.c | 13 +-
drivers/usb/core/devio.c | 14 +-
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/hub.c | 19 ++-
drivers/usb/core/urb.c | 2 +-
drivers/usb/dwc3/gadget.c | 9 ++
drivers/usb/host/ohci-hcd.c | 3 +-
drivers/usb/host/ohci-pci.c | 16 +++
drivers/usb/host/ohci.h | 1 +
drivers/usb/host/xhci-hub.c | 2 +-
drivers/usb/host/xhci-mem.c | 4 +-
drivers/usb/host/xhci-pci.c | 7 +-
drivers/usb/host/xhci-plat.c | 2 +-
drivers/usb/host/xhci-ring.c | 13 +-
drivers/usb/host/xhci.c | 8 +-
drivers/usb/misc/chaoskey.c | 2 +-
drivers/usb/misc/iowarrior.c | 2 +-
drivers/usb/misc/legousbtower.c | 38 +++--
drivers/usb/musb/musb_host.c | 9 +-
drivers/usb/musb/tusb6010_omap.c | 13 +-
drivers/usb/serial/ftdi_sio.c | 10 +-
drivers/usb/serial/ftdi_sio_ids.h | 2 +
drivers/usb/serial/io_ti.c | 5 +-
drivers/usb/serial/mct_u232.c | 2 +-
drivers/usb/serial/option.c | 8 ++
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/storage/ene_ub6250.c | 90 +++++++-----
drivers/uwb/i1480/dfu/usb.c | 5 +-
drivers/watchdog/pcwd_usb.c | 3 +
fs/dax.c | 32 ++---
fs/nfs/callback_proc.c | 6 +-
fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +-
fs/nfs/nfs4proc.c | 4 +-
fs/nfs/pagelist.c | 15 +-
fs/nfs/write.c | 2 +-
fs/nfsd/nfs4proc.c | 3 +-
fs/nfsd/nfs4xdr.c | 19 ++-
fs/notify/fanotify/fanotify_user.c | 26 ++--
fs/proc/generic.c | 1 +
include/linux/fs.h | 8 +-
include/linux/hid-sensor-hub.h | 2 +
include/linux/kprobes.h | 3 +
kernel/fork.c | 10 +-
kernel/irq/chip.c | 2 +-
kernel/kprobes.c | 2 +-
kernel/pid_namespace.c | 2 +-
kernel/trace/trace_kprobe.c | 5 +
net/ipx/af_ipx.c | 5 +-
security/integrity/ima/ima_appraise.c | 5 +-
sound/hda/hdac_controller.c | 4 +
sound/soc/codecs/cs4271.c | 2 +-
virt/kvm/arm/vgic/vgic-v2.c | 7 +
virt/kvm/arm/vgic/vgic-v3.c | 7 +
198 files changed, 1908 insertions(+), 857 deletions(-)
^ permalink raw reply
* Patch "IB/hfi1: Protect the global dev_cntr_names and port_cntr_names" has been added to the 4.11-stable tree
From: gregkh @ 2017-05-23 20:04 UTC (permalink / raw)
To: tadeusz.struk, dennis.dalessandro, dledford, easwar.hariharan,
gregkh, mike.marciniszyn
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
to the 4.11-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
ib-hfi1-protect-the-global-dev_cntr_names-and-port_cntr_names.patch
and it can be found in the queue-4.11 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 62eed66e98b4c2286fef2ce5911d8d75b7515f7b Mon Sep 17 00:00:00 2001
From: Tadeusz Struk <tadeusz.struk@intel.com>
Date: Mon, 20 Mar 2017 17:25:35 -0700
Subject: IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
From: Tadeusz Struk <tadeusz.struk@intel.com>
commit 62eed66e98b4c2286fef2ce5911d8d75b7515f7b upstream.
Protect the global dev_cntr_names and port_cntr_names with the global
mutex as they are allocated and freed in a function called per device.
Otherwise there is a danger of double free and memory leaks.
Fixes: Commit b7481944b06e ("IB/hfi1: Show statistics counters under IB stats interface")
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Reviewed-by: Easwar Hariharan <easwar.hariharan@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/hfi1/verbs.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1524,6 +1524,7 @@ static const char * const driver_cntr_na
"DRIVER_EgrHdrFull"
};
+static DEFINE_MUTEX(cntr_names_lock); /* protects the *_cntr_names bufers */
static const char **dev_cntr_names;
static const char **port_cntr_names;
static int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
@@ -1578,6 +1579,7 @@ static struct rdma_hw_stats *alloc_hw_st
{
int i, err;
+ mutex_lock(&cntr_names_lock);
if (!cntr_names_initialized) {
struct hfi1_devdata *dd = dd_from_ibdev(ibdev);
@@ -1586,8 +1588,10 @@ static struct rdma_hw_stats *alloc_hw_st
num_driver_cntrs,
&num_dev_cntrs,
&dev_cntr_names);
- if (err)
+ if (err) {
+ mutex_unlock(&cntr_names_lock);
return NULL;
+ }
for (i = 0; i < num_driver_cntrs; i++)
dev_cntr_names[num_dev_cntrs + i] =
@@ -1601,10 +1605,12 @@ static struct rdma_hw_stats *alloc_hw_st
if (err) {
kfree(dev_cntr_names);
dev_cntr_names = NULL;
+ mutex_unlock(&cntr_names_lock);
return NULL;
}
cntr_names_initialized = 1;
}
+ mutex_unlock(&cntr_names_lock);
if (!port_num)
return rdma_alloc_hw_stats_struct(
@@ -1823,9 +1829,13 @@ void hfi1_unregister_ib_device(struct hf
del_timer_sync(&dev->mem_timer);
verbs_txreq_exit(dev);
+ mutex_lock(&cntr_names_lock);
kfree(dev_cntr_names);
kfree(port_cntr_names);
+ dev_cntr_names = NULL;
+ port_cntr_names = NULL;
cntr_names_initialized = 0;
+ mutex_unlock(&cntr_names_lock);
}
void hfi1_cnp_rcv(struct hfi1_packet *packet)
Patches currently in stable-queue which might be from tadeusz.struk@intel.com are
queue-4.11/ib-hfi1-protect-the-global-dev_cntr_names-and-port_cntr_names.patch
^ permalink raw reply
* RE: [PATCH v2] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
From: Marciniszyn, Mike @ 2017-05-23 19:59 UTC (permalink / raw)
To: Greg KH
Cc: stable@vger.kernel.org, linux-rdma@vger.kernel.org,
stable-commits@vger.kernel.org
In-Reply-To: <20170523195533.GA17694@kroah.com>
> > Cc: stable <stable@vger.kernel.org> # v4.10
>
> Why resend this???
There are two patches, one for 4.10 and one for 4.11.
Each of the v2's should have had a different version on the stable cc line in the signoff block.
Mike
^ permalink raw reply
* Re: [PATCH v2] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
From: Greg KH @ 2017-05-23 19:55 UTC (permalink / raw)
To: Mike Marciniszyn; +Cc: stable, linux-rdma, stable-commits
In-Reply-To: <20170523194407.28059.59929.stgit@phlsvslse11.ph.intel.com>
On Tue, May 23, 2017 at 03:44:29PM -0400, Mike Marciniszyn wrote:
> From: Tadeusz Struk <tadeusz.struk@intel.com>
>
> commit 62eed66e98b4c2286fef2ce5911d8d75b7515f7b upstream.
>
> Protect the global dev_cntr_names and port_cntr_names with the global
> mutex as they are allocated and freed in a function called per device.
> Otherwise there is a danger of double free and memory leaks.
>
> Cc: stable <stable@vger.kernel.org> # v4.10
Why resend this???
^ permalink raw reply
* Re: Patch "drm/i915/gvt: Disable access to stolen memory as a guest" has been added to the 4.4-stable tree
From: Greg KH @ 2017-05-23 19:46 UTC (permalink / raw)
To: chris, joonas.lahtinen, zhenyuw; +Cc: stable, stable-commits
In-Reply-To: <149556465011245@kroah.com>
Ugh, this broke the build on 4.4, so I'm dropping it from there...
I try to include just a few i915 patches into the stable tree this time,
and all of them break or don't even apply...
Ugh.
greg k-h
On Tue, May 23, 2017 at 08:37:30PM +0200, gregkh@linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> drm/i915/gvt: Disable access to stolen memory as a guest
>
> to the 4.4-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> drm-i915-gvt-disable-access-to-stolen-memory-as-a-guest.patch
> and it can be found in the queue-4.4 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>
>
> >From 04a68a35ce6d7b54749989f943993020f48fed62 Mon Sep 17 00:00:00 2001
> From: Chris Wilson <chris@chris-wilson.co.uk>
> Date: Wed, 9 Nov 2016 10:39:05 +0000
> Subject: drm/i915/gvt: Disable access to stolen memory as a guest
>
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> commit 04a68a35ce6d7b54749989f943993020f48fed62 upstream.
>
> Explicitly disable stolen memory when running as a guest in a virtual
> machine, since the memory is not mediated between clients and reserved
> entirely for the host. The actual size should be reported as zero, but
> like every other quirk we want to tell the user what is happening.
>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99028
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Link: http://patchwork.freedesktop.org/patch/msgid/20161109103905.17860-1-chris@chris-wilson.co.uk
> Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/gpu/drm/i915/i915_gem_stolen.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> --- a/drivers/gpu/drm/i915/i915_gem_stolen.c
> +++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
> @@ -405,6 +405,11 @@ int i915_gem_init_stolen(struct drm_devi
>
> mutex_init(&dev_priv->mm.stolen_lock);
>
> + if (intel_vgpu_active(dev_priv)) {
> + DRM_INFO("iGVT-g active, disabling use of stolen memory\n");
> + return 0;
> + }
> +
> #ifdef CONFIG_INTEL_IOMMU
> if (intel_iommu_gfx_mapped && INTEL_INFO(dev)->gen < 8) {
> DRM_INFO("DMAR active, disabling use of stolen memory\n");
>
>
> Patches currently in stable-queue which might be from chris@chris-wilson.co.uk are
>
> queue-4.4/drm-i915-gvt-disable-access-to-stolen-memory-as-a-guest.patch
^ permalink raw reply
* [PATCH v2] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names
From: Mike Marciniszyn @ 2017-05-23 19:44 UTC (permalink / raw)
To: stable; +Cc: linux-rdma, stable-commits
From: Tadeusz Struk <tadeusz.struk@intel.com>
commit 62eed66e98b4c2286fef2ce5911d8d75b7515f7b upstream.
Protect the global dev_cntr_names and port_cntr_names with the global
mutex as they are allocated and freed in a function called per device.
Otherwise there is a danger of double free and memory leaks.
Cc: stable <stable@vger.kernel.org> # v4.10
Fixes: Commit b7481944b06e ("IB/hfi1: Show statistics counters under IB stats interface")
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Reviewed-by: Easwar Hariharan <easwar.hariharan@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
---
v2 - fix upstream commit id.
drivers/infiniband/hw/hfi1/verbs.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 6002aa9..5105b95 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1605,6 +1605,7 @@ static void hfi1_get_dev_fw_str(struct ib_device *ibdev, char *str,
"DRIVER_EgrHdrFull"
};
+static DEFINE_MUTEX(cntr_names_lock); /* protects the *_cntr_names bufers */
static const char **dev_cntr_names;
static const char **port_cntr_names;
static int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
@@ -1659,6 +1660,7 @@ static struct rdma_hw_stats *alloc_hw_stats(struct ib_device *ibdev,
{
int i, err;
+ mutex_lock(&cntr_names_lock);
if (!cntr_names_initialized) {
struct hfi1_devdata *dd = dd_from_ibdev(ibdev);
@@ -1667,8 +1669,10 @@ static struct rdma_hw_stats *alloc_hw_stats(struct ib_device *ibdev,
num_driver_cntrs,
&num_dev_cntrs,
&dev_cntr_names);
- if (err)
+ if (err) {
+ mutex_unlock(&cntr_names_lock);
return NULL;
+ }
for (i = 0; i < num_driver_cntrs; i++)
dev_cntr_names[num_dev_cntrs + i] =
@@ -1682,10 +1686,12 @@ static struct rdma_hw_stats *alloc_hw_stats(struct ib_device *ibdev,
if (err) {
kfree(dev_cntr_names);
dev_cntr_names = NULL;
+ mutex_unlock(&cntr_names_lock);
return NULL;
}
cntr_names_initialized = 1;
}
+ mutex_unlock(&cntr_names_lock);
if (!port_num)
return rdma_alloc_hw_stats_struct(
@@ -1903,9 +1909,13 @@ void hfi1_unregister_ib_device(struct hfi1_devdata *dd)
del_timer_sync(&dev->mem_timer);
verbs_txreq_exit(dev);
+ mutex_lock(&cntr_names_lock);
kfree(dev_cntr_names);
kfree(port_cntr_names);
+ dev_cntr_names = NULL;
+ port_cntr_names = NULL;
cntr_names_initialized = 0;
+ mutex_unlock(&cntr_names_lock);
}
void hfi1_cnp_rcv(struct hfi1_packet *packet)
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox