From: Greg Kroah-Hartman Date: Mon, 8 Aug 2016 13:42:20 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v3.14.75~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2520b507949b43694eb68326603de0a899a3e80c;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch can-fix-handling-of-unmodifiable-configuration-options-fix.patch can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch perf-x86-fix-pebs-issues-on-intel-atom-core2.patch rds-fix-rds_tcp_init-error-path.patch scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch --- diff --git a/queue-4.4/can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch b/queue-4.4/can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch new file mode 100644 index 00000000000..99f9a054f5e --- /dev/null +++ b/queue-4.4/can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch @@ -0,0 +1,38 @@ +From 43200a4480cbbe660309621817f54cbb93907108 Mon Sep 17 00:00:00 2001 +From: Wolfgang Grandegger +Date: Mon, 13 Jun 2016 15:44:19 +0200 +Subject: can: at91_can: RX queue could get stuck at high bus load + +From: Wolfgang Grandegger + +commit 43200a4480cbbe660309621817f54cbb93907108 upstream. + +At high bus load it could happen that "at91_poll()" enters with all RX +message boxes filled up. If then at the end the "quota" is exceeded as +well, "rx_next" will not be reset to the first RX mailbox and hence the +interrupts remain disabled. + +Signed-off-by: Wolfgang Grandegger +Tested-by: Amr Bekhit +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/at91_can.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/can/at91_can.c ++++ b/drivers/net/can/at91_can.c +@@ -712,9 +712,10 @@ static int at91_poll_rx(struct net_devic + + /* upper group completed, look again in lower */ + if (priv->rx_next > get_mb_rx_low_last(priv) && +- quota > 0 && mb > get_mb_rx_last(priv)) { ++ mb > get_mb_rx_last(priv)) { + priv->rx_next = get_mb_rx_first(priv); +- goto again; ++ if (quota > 0) ++ goto again; + } + + return received; diff --git a/queue-4.4/can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch b/queue-4.4/can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch new file mode 100644 index 00000000000..c0a02b66ad6 --- /dev/null +++ b/queue-4.4/can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch @@ -0,0 +1,82 @@ +From 427460c83cdf55069eee49799a0caef7dde8df69 Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Thu, 16 Jun 2016 11:10:19 -0500 +Subject: can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access + +From: Thor Thayer + +commit 427460c83cdf55069eee49799a0caef7dde8df69 upstream. + +When testing CAN write floods on Altera's CycloneV, the first 2 bytes +are sometimes 0x00, 0x00 or corrupted instead of the values sent. Also +observed bytes 4 & 5 were corrupted in some cases. + +The D_CAN Data registers are 32 bits and changing from 16 bit writes to +32 bit writes fixes the problem. + +Testing performed on Altera CycloneV (D_CAN). Requesting tests on other +C_CAN & D_CAN platforms. + +Reported-by: Richard Andrysek +Signed-off-by: Thor Thayer +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/c_can/c_can.c | 38 +++++++++++++++++++++++++++++++------- + 1 file changed, 31 insertions(+), 7 deletions(-) + +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -332,9 +332,23 @@ static void c_can_setup_tx_object(struct + + priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl); + +- for (i = 0; i < frame->can_dlc; i += 2) { +- priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2, +- frame->data[i] | (frame->data[i + 1] << 8)); ++ if (priv->type == BOSCH_D_CAN) { ++ u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface); ++ ++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) { ++ data = (u32)frame->data[i]; ++ data |= (u32)frame->data[i + 1] << 8; ++ data |= (u32)frame->data[i + 2] << 16; ++ data |= (u32)frame->data[i + 3] << 24; ++ priv->write_reg32(priv, dreg, data); ++ } ++ } else { ++ for (i = 0; i < frame->can_dlc; i += 2) { ++ priv->write_reg(priv, ++ C_CAN_IFACE(DATA1_REG, iface) + i / 2, ++ frame->data[i] | ++ (frame->data[i + 1] << 8)); ++ } + } + } + +@@ -402,10 +416,20 @@ static int c_can_read_msg_object(struct + } else { + int i, dreg = C_CAN_IFACE(DATA1_REG, iface); + +- for (i = 0; i < frame->can_dlc; i += 2, dreg ++) { +- data = priv->read_reg(priv, dreg); +- frame->data[i] = data; +- frame->data[i + 1] = data >> 8; ++ if (priv->type == BOSCH_D_CAN) { ++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) { ++ data = priv->read_reg32(priv, dreg); ++ frame->data[i] = data; ++ frame->data[i + 1] = data >> 8; ++ frame->data[i + 2] = data >> 16; ++ frame->data[i + 3] = data >> 24; ++ } ++ } else { ++ for (i = 0; i < frame->can_dlc; i += 2, dreg++) { ++ data = priv->read_reg(priv, dreg); ++ frame->data[i] = data; ++ frame->data[i + 1] = data >> 8; ++ } + } + } + diff --git a/queue-4.4/can-fix-handling-of-unmodifiable-configuration-options-fix.patch b/queue-4.4/can-fix-handling-of-unmodifiable-configuration-options-fix.patch new file mode 100644 index 00000000000..f22e0f0c784 --- /dev/null +++ b/queue-4.4/can-fix-handling-of-unmodifiable-configuration-options-fix.patch @@ -0,0 +1,37 @@ +From bce271f255dae8335dc4d2ee2c4531e09cc67f5a Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Tue, 21 Jun 2016 12:14:07 +0200 +Subject: can: fix handling of unmodifiable configuration options fix + +From: Oliver Hartkopp + +commit bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream. + +With upstream commit bb208f144cf3f59 (can: fix handling of unmodifiable +configuration options) a new can_validate() function was introduced. + +When invoking 'ip link set can0 type can' without any configuration data +can_validate() tries to validate the content without taking into account that +there's totally no content. This patch adds a check for missing content. + +Reported-by: ajneu +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/dev.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -798,6 +798,9 @@ static int can_validate(struct nlattr *t + * - control mode with CAN_CTRLMODE_FD set + */ + ++ if (!data) ++ return 0; ++ + if (data[IFLA_CAN_CTRLMODE]) { + struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]); + diff --git a/queue-4.4/can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch b/queue-4.4/can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch new file mode 100644 index 00000000000..cbbc57ece81 --- /dev/null +++ b/queue-4.4/can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch @@ -0,0 +1,50 @@ +From 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 Mon Sep 17 00:00:00 2001 +From: Oliver Hartkopp +Date: Tue, 21 Jun 2016 15:45:47 +0200 +Subject: can: fix oops caused by wrong rtnl dellink usage + +From: Oliver Hartkopp + +commit 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 upstream. + +For 'real' hardware CAN devices the netlink interface is used to set CAN +specific communication parameters. Real CAN hardware can not be created nor +removed with the ip tool ... + +This patch adds a private dellink function for the CAN device driver interface +that does just nothing. + +It's a follow up to commit 993e6f2fd ("can: fix oops caused by wrong rtnl +newlink usage") but for dellink. + +Reported-by: ajneu +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/dev.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -1011,6 +1011,11 @@ static int can_newlink(struct net *src_n + return -EOPNOTSUPP; + } + ++static void can_dellink(struct net_device *dev, struct list_head *head) ++{ ++ return; ++} ++ + static struct rtnl_link_ops can_link_ops __read_mostly = { + .kind = "can", + .maxtype = IFLA_CAN_MAX, +@@ -1019,6 +1024,7 @@ static struct rtnl_link_ops can_link_ops + .validate = can_validate, + .newlink = can_newlink, + .changelink = can_changelink, ++ .dellink = can_dellink, + .get_size = can_get_size, + .fill_info = can_fill_info, + .get_xstats_size = can_get_xstats_size, diff --git a/queue-4.4/ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch b/queue-4.4/ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch new file mode 100644 index 00000000000..2c3371e884f --- /dev/null +++ b/queue-4.4/ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch @@ -0,0 +1,31 @@ +From 54e430bbd490e18ab116afa4cd90dcc45787b3df Mon Sep 17 00:00:00 2001 +From: Brian King +Date: Mon, 27 Jun 2016 09:09:40 -0500 +Subject: ipr: Clear interrupt on croc/crocodile when running with LSI + +From: Brian King + +commit 54e430bbd490e18ab116afa4cd90dcc45787b3df upstream. + +If we fall back to using LSI on the Croc or Crocodile chip we need to +clear the interrupt so we don't hang the system. + +Tested-by: Benjamin Herrenschmidt +Signed-off-by: Brian King +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/ipr.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/ipr.c ++++ b/drivers/scsi/ipr.c +@@ -10095,6 +10095,7 @@ static int ipr_probe_ioa(struct pci_dev + ioa_cfg->intr_flag = IPR_USE_MSI; + else { + ioa_cfg->intr_flag = IPR_USE_LSI; ++ ioa_cfg->clear_isr = 1; + ioa_cfg->nvectors = 1; + dev_info(&pdev->dev, "Cannot enable MSI.\n"); + } diff --git a/queue-4.4/perf-x86-fix-pebs-issues-on-intel-atom-core2.patch b/queue-4.4/perf-x86-fix-pebs-issues-on-intel-atom-core2.patch new file mode 100644 index 00000000000..257b94b3475 --- /dev/null +++ b/queue-4.4/perf-x86-fix-pebs-issues-on-intel-atom-core2.patch @@ -0,0 +1,58 @@ +From 1424a09a9e1839285e948d4ea9fdfca26c9a2086 Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Thu, 3 Dec 2015 23:33:18 +0100 +Subject: perf/x86: fix PEBS issues on Intel Atom/Core2 + +From: Stephane Eranian + +commit 1424a09a9e1839285e948d4ea9fdfca26c9a2086 upstream. + +This patch fixes broken PEBS support on Intel Atom and Core2 +due to wrong pointer arithmetic in intel_pmu_drain_pebs_core(). + +The get_next_pebs_record_by_bit() was called on PEBS format fmt0 +which does not use the pebs_record_nhm layout. + +Signed-off-by: Stephane Eranian +Signed-off-by: Peter Zijlstra (Intel) +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: kan.liang@intel.com +Fixes: 21509084f999 ("perf/x86/intel: Handle multiple records in the PEBS buffer") +Link: http://lkml.kernel.org/r/1449182000-31524-3-git-send-email-eranian@google.com +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kernel/cpu/perf_event_intel_ds.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -1110,6 +1110,13 @@ get_next_pebs_record_by_bit(void *base, + void *at; + u64 pebs_status; + ++ /* ++ * fmt0 does not have a status bitfield (does not use ++ * perf_record_nhm format) ++ */ ++ if (x86_pmu.intel_cap.pebs_format < 1) ++ return base; ++ + if (base == NULL) + return NULL; + +@@ -1195,7 +1202,7 @@ static void intel_pmu_drain_pebs_core(st + if (!event->attr.precise_ip) + return; + +- n = (top - at) / x86_pmu.pebs_record_size; ++ n = top - at; + if (n <= 0) + return; + diff --git a/queue-4.4/rds-fix-rds_tcp_init-error-path.patch b/queue-4.4/rds-fix-rds_tcp_init-error-path.patch new file mode 100644 index 00000000000..e2cd2e8f327 --- /dev/null +++ b/queue-4.4/rds-fix-rds_tcp_init-error-path.patch @@ -0,0 +1,47 @@ +From 3dad5424adfb346c871847d467f97dcdca64ea97 Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Sun, 3 Jul 2016 10:54:54 +0200 +Subject: RDS: fix rds_tcp_init() error path + +From: Vegard Nossum + +commit 3dad5424adfb346c871847d467f97dcdca64ea97 upstream. + +If register_pernet_subsys() fails, we shouldn't try to call +unregister_pernet_subsys(). + +Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.") +Cc: Sowmini Varadhan +Cc: David S. Miller +Signed-off-by: Vegard Nossum +Acked-by: Sowmini Varadhan +Acked-by: Santosh Shilimkar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/rds/tcp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -421,7 +421,7 @@ static int rds_tcp_init(void) + + ret = rds_tcp_recv_init(); + if (ret) +- goto out_slab; ++ goto out_pernet; + + ret = rds_trans_register(&rds_tcp_transport); + if (ret) +@@ -433,8 +433,9 @@ static int rds_tcp_init(void) + + out_recv: + rds_tcp_recv_exit(); +-out_slab: ++out_pernet: + unregister_pernet_subsys(&rds_tcp_net_ops); ++out_slab: + kmem_cache_destroy(rds_tcp_conn_slab); + out: + return ret; diff --git a/queue-4.4/scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch b/queue-4.4/scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch new file mode 100644 index 00000000000..ad39149c28c --- /dev/null +++ b/queue-4.4/scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch @@ -0,0 +1,70 @@ +From 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 23 Jun 2016 15:05:26 -0400 +Subject: SCSI: fix new bug in scsi_dev_info_list string matching + +From: Alan Stern + +commit 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 upstream. + +Commit b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching") +changed the way vendor- and model-string matching was carried out in the +routine that looks up entries in a SCSI devinfo list. The new matching +code failed to take into account the case of a maximum-length string; in +such cases it could end up testing for a terminating '\0' byte beyond +the end of the memory allocated to the string. This out-of-bounds bug +was detected by UBSAN. + +I don't know if anybody has actually encountered this bug. The symptom +would be that a device entry in the blacklist might not be matched +properly if it contained an 8-character vendor name or a 16-character +model name. Such entries certainly exist in scsi_static_device_list. + +This patch fixes the problem by adding a check for a maximum-length +string before the '\0' test. + +Signed-off-by: Alan Stern +Fixes: b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching") +Tested-by: Wilfried Klaebe +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/scsi_devinfo.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -426,7 +426,7 @@ static struct scsi_dev_info_list *scsi_d + * here, and we don't know what device it is + * trying to work with, leave it as-is. + */ +- vmax = 8; /* max length of vendor */ ++ vmax = sizeof(devinfo->vendor); + vskip = vendor; + while (vmax > 0 && *vskip == ' ') { + vmax--; +@@ -436,7 +436,7 @@ static struct scsi_dev_info_list *scsi_d + while (vmax > 0 && vskip[vmax - 1] == ' ') + --vmax; + +- mmax = 16; /* max length of model */ ++ mmax = sizeof(devinfo->model); + mskip = model; + while (mmax > 0 && *mskip == ' ') { + mmax--; +@@ -452,10 +452,12 @@ static struct scsi_dev_info_list *scsi_d + * Behave like the older version of get_device_flags. + */ + if (memcmp(devinfo->vendor, vskip, vmax) || +- devinfo->vendor[vmax]) ++ (vmax < sizeof(devinfo->vendor) && ++ devinfo->vendor[vmax])) + continue; + if (memcmp(devinfo->model, mskip, mmax) || +- devinfo->model[mmax]) ++ (mmax < sizeof(devinfo->model) && ++ devinfo->model[mmax])) + continue; + return devinfo; + } else { diff --git a/queue-4.4/series b/queue-4.4/series index 0dc6975bcde..bbc23f640a0 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -48,3 +48,11 @@ block-fix-use-after-free-in-sys_ioprio_get.patch mmc-block-fix-packed-command-header-endianness.patch sched-fair-fix-effective_load-to-consistently-use-smoothed-load.patch ovl-handle-attr_kill.patch +perf-x86-fix-pebs-issues-on-intel-atom-core2.patch +can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch +can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch +can-fix-handling-of-unmodifiable-configuration-options-fix.patch +can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch +rds-fix-rds_tcp_init-error-path.patch +scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch +ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch