--- /dev/null
+From fa5d506592a759b7848a59d1d5a025af8c9a7a6c Mon Sep 17 00:00:00 2001
+From: Vineet Gupta <vgupta@synopsys.com>
+Date: Thu, 5 Nov 2015 09:13:31 +0530
+Subject: ARC: use ASL assembler mnemonic
+
+From: Vineet Gupta <vgupta@synopsys.com>
+
+commit a6416f57ce57fb390b6ee30b12c01c29032a26af upstream.
+
+ARCompact and ARCv2 only have ASL, while binutils used to support LSL as
+a alias mnemonic.
+
+Newer binutils (upstream) don't want to do that so replace it.
+
+Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arc/mm/tlbex.S | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arc/mm/tlbex.S
++++ b/arch/arc/mm/tlbex.S
+@@ -89,7 +89,7 @@ ex_saved_reg1:
+ #ifdef CONFIG_SMP
+ sr r0, [ARC_REG_SCRATCH_DATA0] ; freeup r0 to code with
+ GET_CPU_ID r0 ; get to per cpu scratch mem,
+- lsl r0, r0, L1_CACHE_SHIFT ; cache line wide per cpu
++ asl r0, r0, L1_CACHE_SHIFT ; cache line wide per cpu
+ add r0, @ex_saved_reg1, r0
+ #else
+ st r0, [@ex_saved_reg1]
+@@ -108,7 +108,7 @@ ex_saved_reg1:
+ .macro TLBMISS_RESTORE_REGS
+ #ifdef CONFIG_SMP
+ GET_CPU_ID r0 ; get to per cpu scratch mem
+- lsl r0, r0, L1_CACHE_SHIFT ; each is cache line wide
++ asl r0, r0, L1_CACHE_SHIFT ; each is cache line wide
+ add r0, @ex_saved_reg1, r0
+ ld_s r3, [r0,12]
+ ld_s r2, [r0, 8]
+@@ -220,7 +220,7 @@ ex_saved_reg1:
+
+ .macro CONV_PTE_TO_TLB
+ and r3, r0, PTE_BITS_RWX ; r w x
+- lsl r2, r3, 3 ; r w x 0 0 0
++ asl r2, r3, 3 ; Kr Kw Kx 0 0 0 (GLOBAL, kernel only)
+ and.f 0, r0, _PAGE_GLOBAL
+ or.z r2, r2, r3 ; r w x r w x
+
--- /dev/null
+From 7bc9491645118c9461bd21099c31755ff6783593 Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Fri, 15 Jul 2016 00:22:07 -0400
+Subject: ext4: verify extent header depth
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit 7bc9491645118c9461bd21099c31755ff6783593 upstream.
+
+Although the extent tree depth of 5 should enough be for the worst
+case of 2*32 extents of length 1, the extent tree code does not
+currently to merge nodes which are less than half-full with a sibling
+node, or to shrink the tree depth if possible. So it's possible, at
+least in theory, for the tree depth to be greater than 5. However,
+even in the worst case, a tree depth of 32 is highly unlikely, and if
+the file system is maliciously corrupted, an insanely large eh_depth
+can cause memory allocation failures that will trigger kernel warnings
+(here, eh_depth = 65280):
+
+ JBD2: ext4.exe wants too many credits credits:195849 rsv_credits:0 max:256
+ ------------[ cut here ]------------
+ WARNING: CPU: 0 PID: 50 at fs/jbd2/transaction.c:293 start_this_handle+0x569/0x580
+ CPU: 0 PID: 50 Comm: ext4.exe Not tainted 4.7.0-rc5+ #508
+ Stack:
+ 604a8947 625badd8 0002fd09 00000000
+ 60078643 00000000 62623910 601bf9bc
+ 62623970 6002fc84 626239b0 900000125
+ Call Trace:
+ [<6001c2dc>] show_stack+0xdc/0x1a0
+ [<601bf9bc>] dump_stack+0x2a/0x2e
+ [<6002fc84>] __warn+0x114/0x140
+ [<6002fdff>] warn_slowpath_null+0x1f/0x30
+ [<60165829>] start_this_handle+0x569/0x580
+ [<60165d4e>] jbd2__journal_start+0x11e/0x220
+ [<60146690>] __ext4_journal_start_sb+0x60/0xa0
+ [<60120a81>] ext4_truncate+0x131/0x3a0
+ [<60123677>] ext4_setattr+0x757/0x840
+ [<600d5d0f>] notify_change+0x16f/0x2a0
+ [<600b2b16>] do_truncate+0x76/0xc0
+ [<600c3e56>] path_openat+0x806/0x1300
+ [<600c55c9>] do_filp_open+0x89/0xf0
+ [<600b4074>] do_sys_open+0x134/0x1e0
+ [<600b4140>] SyS_open+0x20/0x30
+ [<6001ea68>] handle_syscall+0x88/0x90
+ [<600295fd>] userspace+0x3fd/0x500
+ [<6001ac55>] fork_handler+0x85/0x90
+
+ ---[ end trace 08b0b88b6387a244 ]---
+
+[ Commit message modified and the extent tree depath check changed
+from 5 to 32 -- tytso ]
+
+Cc: Darrick J. Wong <darrick.wong@oracle.com>
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/extents.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -452,6 +452,10 @@ static int __ext4_ext_check(const char *
+ error_msg = "invalid extent entries";
+ goto corrupted;
+ }
++ if (unlikely(depth > 32)) {
++ error_msg = "too large eh_depth";
++ goto corrupted;
++ }
+ /* Verify checksum on non-root extent tree nodes */
+ if (ext_depth(inode) != depth &&
+ !ext4_extent_block_csum_verify(inode, eh)) {
--- /dev/null
+From f68381a70bb2b26c31b13fdaf67c778f92fd32b4 Mon Sep 17 00:00:00 2001
+From: Taras Kondratiuk <takondra@cisco.com>
+Date: Wed, 13 Jul 2016 22:05:38 +0000
+Subject: mmc: block: fix packed command header endianness
+
+From: Taras Kondratiuk <takondra@cisco.com>
+
+commit f68381a70bb2b26c31b13fdaf67c778f92fd32b4 upstream.
+
+The code that fills packed command header assumes that CPU runs in
+little-endian mode. Hence the header is malformed in big-endian mode
+and causes MMC data transfer errors:
+
+[ 563.200828] mmcblk0: error -110 transferring data, sector 2048, nr 8, cmd response 0x900, card status 0xc40
+[ 563.219647] mmcblk0: packed cmd failed, nr 2, sectors 16, failure index: -1
+
+Convert header data to LE.
+
+Signed-off-by: Taras Kondratiuk <takondra@cisco.com>
+Fixes: ce39f9d17c14 ("mmc: support packed write command for eMMC4.5 devices")
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mmc/card/block.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1610,8 +1610,8 @@ static void mmc_blk_packed_hdr_wrq_prep(
+
+ packed_cmd_hdr = packed->cmd_hdr;
+ memset(packed_cmd_hdr, 0, sizeof(packed->cmd_hdr));
+- packed_cmd_hdr[0] = (packed->nr_entries << 16) |
+- (PACKED_CMD_WR << 8) | PACKED_CMD_VER;
++ packed_cmd_hdr[0] = cpu_to_le32((packed->nr_entries << 16) |
++ (PACKED_CMD_WR << 8) | PACKED_CMD_VER);
+ hdr_blocks = mmc_large_sector(card) ? 8 : 1;
+
+ /*
+@@ -1625,14 +1625,14 @@ static void mmc_blk_packed_hdr_wrq_prep(
+ ((brq->data.blocks * brq->data.blksz) >=
+ card->ext_csd.data_tag_unit_size);
+ /* Argument of CMD23 */
+- packed_cmd_hdr[(i * 2)] =
++ packed_cmd_hdr[(i * 2)] = cpu_to_le32(
+ (do_rel_wr ? MMC_CMD23_ARG_REL_WR : 0) |
+ (do_data_tag ? MMC_CMD23_ARG_TAG_REQ : 0) |
+- blk_rq_sectors(prq);
++ blk_rq_sectors(prq));
+ /* Argument of CMD18 or CMD25 */
+- packed_cmd_hdr[((i * 2)) + 1] =
++ packed_cmd_hdr[((i * 2)) + 1] = cpu_to_le32(
+ mmc_card_blockaddr(card) ?
+- blk_rq_pos(prq) : blk_rq_pos(prq) << 9;
++ blk_rq_pos(prq) : blk_rq_pos(prq) << 9);
+ packed->blocks += blk_rq_sectors(prq);
+ i++;
+ }
--- /dev/null
+From 7831b4ff0d926e0deeaabef9db8800ed069a2757 Mon Sep 17 00:00:00 2001
+From: Ursula Braun <ubraun@linux.vnet.ibm.com>
+Date: Mon, 4 Jul 2016 14:07:16 +0200
+Subject: qeth: delete napi struct when removing a qeth device
+
+From: Ursula Braun <ubraun@linux.vnet.ibm.com>
+
+commit 7831b4ff0d926e0deeaabef9db8800ed069a2757 upstream.
+
+A qeth_card contains a napi_struct linked to the net_device during
+device probing. This struct must be deleted when removing the qeth
+device, otherwise Panic on oops can occur when qeth devices are
+repeatedly removed and added.
+
+Fixes: a1c3ed4c9ca ("qeth: NAPI support for l2 and l3 discipline")
+Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
+Tested-by: Alexander Klein <ALKL@de.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/net/qeth_l2_main.c | 1 +
+ drivers/s390/net/qeth_l3_main.c | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -906,6 +906,7 @@ static void qeth_l2_remove_device(struct
+ qeth_l2_set_offline(cgdev);
+
+ if (card->dev) {
++ netif_napi_del(&card->napi);
+ unregister_netdev(card->dev);
+ card->dev = NULL;
+ }
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -3333,6 +3333,7 @@ static void qeth_l3_remove_device(struct
+ qeth_l3_set_offline(cgdev);
+
+ if (card->dev) {
++ netif_napi_del(&card->napi);
+ unregister_netdev(card->dev);
+ card->dev = NULL;
+ }
pinctrl-single-fix-missing-flush-of-posted-write-for-a-wakeirq.patch
revert-ecryptfs-forbid-opening-files-without-mmap-handler.patch
ecryptfs-don-t-allow-mmap-when-the-lower-fs-doesn-t-support-it.patch
+arc-use-asl-assembler-mnemonic.patch
+ext4-verify-extent-header-depth.patch
+qeth-delete-napi-struct-when-removing-a-qeth-device.patch
+mmc-block-fix-packed-command-header-endianness.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
