From: Greg Kroah-Hartman Date: Wed, 3 Jun 2015 01:12:51 +0000 (+0900) Subject: 3.14-stable patches X-Git-Tag: v3.10.80~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1c24aa23fa1889ec5fea0c1e29945f1fbf4829a4;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch lguest-fix-out-by-one-error-in-address-checking.patch libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch xfs-xfs_iozero-can-return-positive-errno.patch --- diff --git a/queue-3.14/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch b/queue-3.14/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch new file mode 100644 index 00000000000..a6927db602f --- /dev/null +++ b/queue-3.14/fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch @@ -0,0 +1,45 @@ +From dcbff39da3d815f08750552fdd04f96b51751129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2015 15:44:29 -0700 +Subject: fs, omfs: add NULL terminator in the end up the token list + +From: Sasha Levin + +commit dcbff39da3d815f08750552fdd04f96b51751129 upstream. + +match_token() expects a NULL terminator at the end of the token list so +that it would know where to stop. Not having one causes it to overrun +to invalid memory. + +In practice, passing a mount option that omfs didn't recognize would +sometimes panic the system. + +Signed-off-by: Sasha Levin +Signed-off-by: Bob Copeland +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/omfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/omfs/inode.c ++++ b/fs/omfs/inode.c +@@ -361,7 +361,7 @@ nomem: + } + + enum { +- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask ++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err + }; + + static const match_table_t tokens = { +@@ -370,6 +370,7 @@ static const match_table_t tokens = { + {Opt_umask, "umask=%o"}, + {Opt_dmask, "dmask=%o"}, + {Opt_fmask, "fmask=%o"}, ++ {Opt_err, NULL}, + }; + + static int parse_options(char *options, struct omfs_sb_info *sbi) diff --git a/queue-3.14/hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch b/queue-3.14/hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch new file mode 100644 index 00000000000..0a0f9939ca3 --- /dev/null +++ b/queue-3.14/hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch @@ -0,0 +1,48 @@ +From 1b63bf617206ff35b93c57c67bbe067ac735a85a Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 28 May 2015 09:08:09 -0700 +Subject: hwmon: (nct6775) Add missing sysfs attribute initialization + +From: Guenter Roeck + +commit 1b63bf617206ff35b93c57c67bbe067ac735a85a upstream. + +The following error message is seen when loading the nct6775 driver +with DEBUG_LOCK_ALLOC enabled. + +BUG: key ffff88040b2f0030 not in .data! +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 186 at kernel/locking/lockdep.c:2988 + lockdep_init_map+0x469/0x630() +DEBUG_LOCKS_WARN_ON(1) + +Caused by a missing call to sysfs_attr_init() when initializing +sysfs attributes. + +Reported-by: Alexey Orishko +Reviewed-by: Jean Delvare +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/nct6775.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -986,6 +986,7 @@ nct6775_create_attr_group(struct device + (*t)->dev_attr.attr.name, tg->base + i); + if ((*t)->s2) { + a2 = &su->u.a2; ++ sysfs_attr_init(&a2->dev_attr.attr); + a2->dev_attr.attr.name = su->name; + a2->nr = (*t)->u.s.nr + i; + a2->index = (*t)->u.s.index; +@@ -996,6 +997,7 @@ nct6775_create_attr_group(struct device + *attrs = &a2->dev_attr.attr; + } else { + a = &su->u.a1; ++ sysfs_attr_init(&a->dev_attr.attr); + a->dev_attr.attr.name = su->name; + a->index = (*t)->u.index + i; + a->dev_attr.attr.mode = diff --git a/queue-3.14/hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch b/queue-3.14/hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch new file mode 100644 index 00000000000..bb78405f63a --- /dev/null +++ b/queue-3.14/hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch @@ -0,0 +1,48 @@ +From adba657533bdd255f7b78bc8a324091f46b294cd Mon Sep 17 00:00:00 2001 +From: Chris Lesiak +Date: Tue, 26 May 2015 15:40:44 -0500 +Subject: hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE + +From: Chris Lesiak + +commit adba657533bdd255f7b78bc8a324091f46b294cd upstream. + +When configured via device tree, the associated iio device needs to be +measuring voltage for the conversion to resistance to be correct. +Return -EINVAL if that is not the case. + +Signed-off-by: Chris Lesiak +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/ntc_thermistor.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/hwmon/ntc_thermistor.c ++++ b/drivers/hwmon/ntc_thermistor.c +@@ -181,8 +181,10 @@ static struct ntc_thermistor_platform_da + ntc_thermistor_parse_dt(struct platform_device *pdev) + { + struct iio_channel *chan; ++ enum iio_chan_type type; + struct device_node *np = pdev->dev.of_node; + struct ntc_thermistor_platform_data *pdata; ++ int ret; + + if (!np) + return NULL; +@@ -195,6 +197,13 @@ ntc_thermistor_parse_dt(struct platform_ + if (IS_ERR(chan)) + return ERR_CAST(chan); + ++ ret = iio_get_channel_type(chan, &type); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ ++ if (type != IIO_VOLTAGE) ++ return ERR_PTR(-EINVAL); ++ + if (of_property_read_u32(np, "pullup-uv", &pdata->pullup_uv)) + return ERR_PTR(-ENODEV); + if (of_property_read_u32(np, "pullup-ohm", &pdata->pullup_ohm)) diff --git a/queue-3.14/lguest-fix-out-by-one-error-in-address-checking.patch b/queue-3.14/lguest-fix-out-by-one-error-in-address-checking.patch new file mode 100644 index 00000000000..0c53d115b60 --- /dev/null +++ b/queue-3.14/lguest-fix-out-by-one-error-in-address-checking.patch @@ -0,0 +1,33 @@ +From 83a35114d0e4583e6b0ca39502e68b6a92e2910c Mon Sep 17 00:00:00 2001 +From: Rusty Russell +Date: Wed, 27 May 2015 10:59:26 +0930 +Subject: lguest: fix out-by-one error in address checking. + +From: Rusty Russell + +commit 83a35114d0e4583e6b0ca39502e68b6a92e2910c upstream. + +This bug has been there since day 1; addresses in the top guest physical +page weren't considered valid. You could map that page (the check in +check_gpte() is correct), but if a guest tried to put a pagetable there +we'd check that address manually when walking it, and kill the guest. + +Signed-off-by: Rusty Russell +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/lguest/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/lguest/core.c ++++ b/drivers/lguest/core.c +@@ -176,7 +176,7 @@ static void unmap_switcher(void) + bool lguest_address_ok(const struct lguest *lg, + unsigned long addr, unsigned long len) + { +- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); ++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); + } + + /* diff --git a/queue-3.14/libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch b/queue-3.14/libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch new file mode 100644 index 00000000000..6f98707005a --- /dev/null +++ b/queue-3.14/libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch @@ -0,0 +1,94 @@ +From b0494532214bdfbf241e94fabab5dd46f7b82631 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Mon, 11 May 2015 17:53:10 +0300 +Subject: libceph: request a new osdmap if lingering request maps to no osd + +From: Ilya Dryomov + +commit b0494532214bdfbf241e94fabab5dd46f7b82631 upstream. + +This commit does two things. First, if there are any homeless +lingering requests, we now request a new osdmap even if the osdmap that +is being processed brought no changes, i.e. if a given lingering +request turned homeless in one of the previous epochs and remained +homeless in the current epoch. Not doing so leaves us with a stale +osdmap and as a result we may miss our window for reestablishing the +watch and lose notifies. + +MON=1 OSD=1: + + # cat linger-needmap.sh + #!/bin/bash + rbd create --size 1 test + DEV=$(rbd map test) + ceph osd out 0 + rbd map dne/dne # obtain a new osdmap as a side effect (!) + sleep 1 + ceph osd in 0 + rbd resize --size 2 test + # rbd info test | grep size -> 2M + # blockdev --getsize $DEV -> 1M + +N.B.: Not obtaining a new osdmap in between "osd out" and "osd in" +above is enough to make it miss that resize notify, but that is a +bug^Wlimitation of ceph watch/notify v1. + +Second, homeless lingering requests are now kicked just like those +lingering requests whose mapping has changed. This is mainly to +recognize that a homeless lingering request makes no sense and to +preserve the invariant that a registered lingering request is not +sitting on any of r_req_lru_item lists. This spares us a WARN_ON, +which commit ba9d114ec557 ("libceph: clear r_req_lru_item in +__unregister_linger_request()") tried to fix the _wrong_ way. + +Signed-off-by: Ilya Dryomov +Reviewed-by: Sage Weil +Signed-off-by: Greg Kroah-Hartman + +--- + net/ceph/osd_client.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +--- a/net/ceph/osd_client.c ++++ b/net/ceph/osd_client.c +@@ -1932,20 +1932,29 @@ static void kick_requests(struct ceph_os + err = __map_request(osdc, req, + force_resend || force_resend_writes); + dout("__map_request returned %d\n", err); +- if (err == 0) +- continue; /* no change and no osd was specified */ + if (err < 0) + continue; /* hrm! */ +- if (req->r_osd == NULL) { +- dout("tid %llu maps to no valid osd\n", req->r_tid); +- needmap++; /* request a newer map */ +- continue; +- } ++ if (req->r_osd == NULL || err > 0) { ++ if (req->r_osd == NULL) { ++ dout("lingering %p tid %llu maps to no osd\n", ++ req, req->r_tid); ++ /* ++ * A homeless lingering request makes ++ * no sense, as it's job is to keep ++ * a particular OSD connection open. ++ * Request a newer map and kick the ++ * request, knowing that it won't be ++ * resent until we actually get a map ++ * that can tell us where to send it. ++ */ ++ needmap++; ++ } + +- dout("kicking lingering %p tid %llu osd%d\n", req, req->r_tid, +- req->r_osd ? req->r_osd->o_osd : -1); +- __register_request(osdc, req); +- __unregister_linger_request(osdc, req); ++ dout("kicking lingering %p tid %llu osd%d\n", req, ++ req->r_tid, req->r_osd ? req->r_osd->o_osd : -1); ++ __register_request(osdc, req); ++ __unregister_linger_request(osdc, req); ++ } + } + reset_changed_osds(osdc); + mutex_unlock(&osdc->request_mutex); diff --git a/queue-3.14/series b/queue-3.14/series index ba3d3f997a2..a90c493d5de 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -7,3 +7,10 @@ qla2xxx-remove-redundant-declaration-in-qla_gbl.h.patch x86-fpu-disable-xsaves-support-for-now.patch kvm-mmu-fix-cr4.smep-1-cr0.wp-0-with-shadow-pages.patch net-socket-fix-the-wrong-returns-for-recvmsg-and-sendmsg.patch +fs-omfs-add-null-terminator-in-the-end-up-the-token-list.patch +xfs-xfs_iozero-can-return-positive-errno.patch +lguest-fix-out-by-one-error-in-address-checking.patch +libceph-request-a-new-osdmap-if-lingering-request-maps-to-no-osd.patch +xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch +hwmon-ntc_thermistor-ensure-iio-channel-is-of-type-iio_voltage.patch +hwmon-nct6775-add-missing-sysfs-attribute-initialization.patch diff --git a/queue-3.14/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch b/queue-3.14/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch new file mode 100644 index 00000000000..f628b5243de --- /dev/null +++ b/queue-3.14/xen-events-don-t-bind-non-percpu-virqs-with-percpu-chip.patch @@ -0,0 +1,92 @@ +From 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a Mon Sep 17 00:00:00 2001 +From: David Vrabel +Date: Tue, 19 May 2015 18:40:49 +0100 +Subject: xen/events: don't bind non-percpu VIRQs with percpu chip + +From: David Vrabel + +commit 77bb3dfdc0d554befad58fdefbc41be5bc3ed38a upstream. + +A non-percpu VIRQ (e.g., VIRQ_CONSOLE) may be freed on a different +VCPU than it is bound to. This can result in a race between +handle_percpu_irq() and removing the action in __free_irq() because +handle_percpu_irq() does not take desc->lock. The interrupt handler +sees a NULL action and oopses. + +Only use the percpu chip/handler for per-CPU VIRQs (like VIRQ_TIMER). + + # cat /proc/interrupts | grep virq + 40: 87246 0 xen-percpu-virq timer0 + 44: 0 0 xen-percpu-virq debug0 + 47: 0 20995 xen-percpu-virq timer1 + 51: 0 0 xen-percpu-virq debug1 + 69: 0 0 xen-dyn-virq xen-pcpu + 74: 0 0 xen-dyn-virq mce + 75: 29 0 xen-dyn-virq hvc_console + +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/hvc/hvc_xen.c | 2 +- + drivers/xen/events/events_base.c | 12 ++++++++---- + include/xen/events.h | 2 +- + 3 files changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/tty/hvc/hvc_xen.c ++++ b/drivers/tty/hvc/hvc_xen.c +@@ -289,7 +289,7 @@ static int xen_initial_domain_console_in + return -ENOMEM; + } + +- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0); ++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false); + info->vtermno = HVC_COOKIE; + + spin_lock(&xencons_lock); +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -973,7 +973,7 @@ unsigned xen_evtchn_nr_channels(void) + } + EXPORT_SYMBOL_GPL(xen_evtchn_nr_channels); + +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu) ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu) + { + struct evtchn_bind_virq bind_virq; + int evtchn, irq, ret; +@@ -987,8 +987,12 @@ int bind_virq_to_irq(unsigned int virq, + if (irq < 0) + goto out; + +- irq_set_chip_and_handler_name(irq, &xen_percpu_chip, +- handle_percpu_irq, "virq"); ++ if (percpu) ++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip, ++ handle_percpu_irq, "virq"); ++ else ++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip, ++ handle_edge_irq, "virq"); + + bind_virq.virq = virq; + bind_virq.vcpu = cpu; +@@ -1078,7 +1082,7 @@ int bind_virq_to_irqhandler(unsigned int + { + int irq, retval; + +- irq = bind_virq_to_irq(virq, cpu); ++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU); + if (irq < 0) + return irq; + retval = request_irq(irq, handler, irqflags, devname, dev_id); +--- a/include/xen/events.h ++++ b/include/xen/events.h +@@ -14,7 +14,7 @@ int bind_evtchn_to_irqhandler(unsigned i + irq_handler_t handler, + unsigned long irqflags, const char *devname, + void *dev_id); +-int bind_virq_to_irq(unsigned int virq, unsigned int cpu); ++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu); + int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu, + irq_handler_t handler, + unsigned long irqflags, const char *devname, diff --git a/queue-3.14/xfs-xfs_iozero-can-return-positive-errno.patch b/queue-3.14/xfs-xfs_iozero-can-return-positive-errno.patch new file mode 100644 index 00000000000..a034e9dbb17 --- /dev/null +++ b/queue-3.14/xfs-xfs_iozero-can-return-positive-errno.patch @@ -0,0 +1,35 @@ +From cddc116228cb9d51d3224d23ba3e61fbbc3ec3d2 Mon Sep 17 00:00:00 2001 +From: Dave Chinner +Date: Fri, 29 May 2015 07:40:32 +1000 +Subject: xfs: xfs_iozero can return positive errno + +From: Dave Chinner + +commit cddc116228cb9d51d3224d23ba3e61fbbc3ec3d2 upstream. + +It was missed when we converted everything in XFs to use negative error +numbers, so fix it now. Bug introduced in 3.17 by commit 2451337 ("xfs: global +error sign conversion"), and should go back to stable kernels. + +Thanks to Brian Foster for noticing it. + +Signed-off-by: Dave Chinner +Reviewed-by: Brian Foster +Signed-off-by: Dave Chinner +Signed-off-by: Greg Kroah-Hartman + +--- + fs/xfs/xfs_file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -126,7 +126,7 @@ xfs_iozero( + status = 0; + } while (count); + +- return (-status); ++ return status; + } + + /*