From: Greg Kroah-Hartman Date: Fri, 6 Nov 2015 05:54:01 +0000 (-0800) Subject: 4.1-stable patches X-Git-Tag: v3.10.93~28 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=26ee4e916f78ed9130cd955c08ac8e6b24910d68;p=thirdparty%2Fkernel%2Fstable-queue.git 4.1-stable patches added patches: arm-dts-am57xx-beagle-x15-set-vdd_sd-to-always-on.patch arm-dts-fix-audio-card-detection-on-peach-boards.patch arm-dts-sunxi-raise-minimum-cpu-voltage-for-sun7i-a20-to-meet-soc-specifications.patch arm-mvebu-correct-a385-db-ap-compatible-string.patch arm-orion-fix-dsa-platform-device-after-mvmdio-conversion.patch iio-accel-sca3000-memory-corruption-in-sca3000_read_first_n_hw_rb.patch iio-mxs-lradc-fix-temperature-offset.patch iio-st_accel-fix-interrupt-handling-on-lis3lv02.patch rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch --- diff --git a/queue-4.1/arm-dts-am57xx-beagle-x15-set-vdd_sd-to-always-on.patch b/queue-4.1/arm-dts-am57xx-beagle-x15-set-vdd_sd-to-always-on.patch new file mode 100644 index 00000000000..a4085f08c93 --- /dev/null +++ b/queue-4.1/arm-dts-am57xx-beagle-x15-set-vdd_sd-to-always-on.patch @@ -0,0 +1,69 @@ +From 7e381ec6a36aa44f15fc1a76e6efb9e2cd942e61 Mon Sep 17 00:00:00 2001 +From: Tomi Valkeinen +Date: Fri, 25 Sep 2015 16:02:03 +0300 +Subject: ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on + +From: Tomi Valkeinen + +commit 7e381ec6a36aa44f15fc1a76e6efb9e2cd942e61 upstream. + +LDO1 regulator (VDD_SD) is connected to SoC's vddshv8. vddshv8 needs to +be kept always powered (see commit 5a0f93c6576a ("ARM: dts: Add +am57xx-beagle-x15"), but at the moment VDD_SD is enabled/disabled +depending on whether an SD card is inserted or not. + +This patch sets LDO1 regulator to always-on. + +This patch has a side effect of fixing another issue, HDMI DDC not +working when SD card is not inserted: + +Why this happens is that the tpd12s015 (HDMI level shifter/ESD +protection chip) has LS_OE GPIO input, which needs to be enabled for the +HDMI DDC to work. LS_OE comes from gpio6_28. The pin that provides +gpio6_28 is powered by vddshv8, and vddshv8 comes from VDD_SD. + +So when SD card is not inserted, VDD_SD is disabled, and LS_OE stays +off. + +The proper fix for the HDMI DDC issue would be to maybe have the pinctrl +framework manage the pin specific power. + +Apparently this fixes also a third issue (copy paste from Kishon's +patch): + +ldo1_reg in addition to being connected to the io lines is also +connected to the card detect line. On card removal, omap_hsmmc +driver does a regulator_disable causing card detect line to be +pulled down. This raises a card insertion interrupt and once the +MMC core detects there is no card inserted, it does a +regulator disable which again raises a card insertion interrupt. +This happens in a loop causing infinite MMC interrupts. + +Fixes: 5a0f93c6576a ("ARM: dts: Add am57xx-beagle-x15") +Cc: Kishon Vijay Abraham I +Signed-off-by: Tomi Valkeinen +Reported-by: Louis McCarthy +Acked-by: Nishanth Menon +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/am57xx-beagle-x15.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts ++++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts +@@ -354,11 +354,12 @@ + /* SMPS9 unused */ + + ldo1_reg: ldo1 { +- /* VDD_SD */ ++ /* VDD_SD / VDDSHV8 */ + regulator-name = "ldo1"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; ++ regulator-always-on; + }; + + ldo2_reg: ldo2 { diff --git a/queue-4.1/arm-dts-fix-audio-card-detection-on-peach-boards.patch b/queue-4.1/arm-dts-fix-audio-card-detection-on-peach-boards.patch new file mode 100644 index 00000000000..c7aaafb0a28 --- /dev/null +++ b/queue-4.1/arm-dts-fix-audio-card-detection-on-peach-boards.patch @@ -0,0 +1,62 @@ +From b8bb9baad27e455c467e8fac47eebadbe765c18f Mon Sep 17 00:00:00 2001 +From: Alim Akhtar +Date: Tue, 13 Oct 2015 04:32:53 +0900 +Subject: ARM: dts: Fix audio card detection on Peach boards + +From: Alim Akhtar + +commit b8bb9baad27e455c467e8fac47eebadbe765c18f upstream. + +Since commit 2fad972d45c4 ("ARM: dts: Add mclk entry for Peach boards"), +sound card detection is broken on peach boards and gives below errors: + +[ 3.630457] max98090 7-0010: MAX98091 REVID=0x51 +[ 3.634233] max98090 7-0010: use default 2.8v micbias +[ 3.640985] snow-audio sound: HiFi <-> 3830000.i2s mapping ok +[ 3.645307] max98090 7-0010: Invalid master clock frequency +[ 3.650824] snow-audio sound: ASoC: Peach-Pi-I2S-MAX98091 late_probe() failed: -22 +[ 3.658914] snow-audio sound: snd_soc_register_card failed (-22) +[ 3.664366] snow-audio: probe of sound failed with error -22 + +This patch adds missing assigned-clocks and assigned-clock-parents for +pmu_system_controller node which is used as "mclk" for audio codec. + +Fixes: 2fad972d45c4 ("ARM: dts: Add mclk entry for Peach boards") +Signed-off-by: Alim Akhtar +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Kukjin Kim +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos5420-peach-pit.dts | 5 +++++ + arch/arm/boot/dts/exynos5800-peach-pi.dts | 5 +++++ + 2 files changed, 10 insertions(+) + +--- a/arch/arm/boot/dts/exynos5420-peach-pit.dts ++++ b/arch/arm/boot/dts/exynos5420-peach-pit.dts +@@ -915,6 +915,11 @@ + }; + }; + ++&pmu_system_controller { ++ assigned-clocks = <&pmu_system_controller 0>; ++ assigned-clock-parents = <&clock CLK_FIN_PLL>; ++}; ++ + &rtc { + status = "okay"; + clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>; +--- a/arch/arm/boot/dts/exynos5800-peach-pi.dts ++++ b/arch/arm/boot/dts/exynos5800-peach-pi.dts +@@ -878,6 +878,11 @@ + }; + }; + ++&pmu_system_controller { ++ assigned-clocks = <&pmu_system_controller 0>; ++ assigned-clock-parents = <&clock CLK_FIN_PLL>; ++}; ++ + &rtc { + status = "okay"; + clocks = <&clock CLK_RTC>, <&max77802 MAX77802_CLK_32K_AP>; diff --git a/queue-4.1/arm-dts-sunxi-raise-minimum-cpu-voltage-for-sun7i-a20-to-meet-soc-specifications.patch b/queue-4.1/arm-dts-sunxi-raise-minimum-cpu-voltage-for-sun7i-a20-to-meet-soc-specifications.patch new file mode 100644 index 00000000000..36d58220aca --- /dev/null +++ b/queue-4.1/arm-dts-sunxi-raise-minimum-cpu-voltage-for-sun7i-a20-to-meet-soc-specifications.patch @@ -0,0 +1,37 @@ +From eaeef1ad9b6ea6df1d1220c254d9563da60cb9d1 Mon Sep 17 00:00:00 2001 +From: Timo Sigurdsson +Date: Tue, 4 Aug 2015 23:08:01 +0200 +Subject: ARM: dts: sunxi: Raise minimum CPU voltage for sun7i-a20 to meet SoC specifications + +From: Timo Sigurdsson + +commit eaeef1ad9b6ea6df1d1220c254d9563da60cb9d1 upstream. + +sun7i-a20.dtsi contains a cpufreq operating point at 0.9 volts. The minimum +CPU voltage for the Allwinner A20 SoC, however, is 1.0 volts. Thus, raise +the voltage for the lowest operating point to 1.0 volts in order to stay +within the SoC specifications. It is an undervolted setting that isn't +stable across all SoCs and boards out there. + +Fixes: d96b7161916f ("ARM: dts: sun7i: Add cpu clock reference and + operating points to dtsi") +Signed-off-by: Timo Sigurdsson +Acked-by: Iain Paton +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun7i-a20.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -111,7 +111,7 @@ + 720000 1200000 + 528000 1100000 + 312000 1000000 +- 144000 900000 ++ 144000 1000000 + >; + #cooling-cells = <2>; + cooling-min-level = <0>; diff --git a/queue-4.1/arm-mvebu-correct-a385-db-ap-compatible-string.patch b/queue-4.1/arm-mvebu-correct-a385-db-ap-compatible-string.patch new file mode 100644 index 00000000000..0fa64865f41 --- /dev/null +++ b/queue-4.1/arm-mvebu-correct-a385-db-ap-compatible-string.patch @@ -0,0 +1,38 @@ +From db347f1a5304d68c68c52f19971924b1e5842f3c Mon Sep 17 00:00:00 2001 +From: Marcin Wojtas +Date: Thu, 15 Oct 2015 03:17:08 +0200 +Subject: ARM: mvebu: correct a385-db-ap compatible string + +From: Marcin Wojtas + +commit db347f1a5304d68c68c52f19971924b1e5842f3c upstream. + +This commit enables standby support on Armada 385 DB-AP board, because +the PM initalization routine requires "marvell,armada380" compatible +string for all Armada 38x-based platforms. + +Beside the compatible "marvell,armada38x" was wrong and should be fixed +in the stable kernels too. + +[gregory.clement@free-electrons.com: add information, about the fixes] +Fixes: e5ee12817e9ea ("ARM: mvebu: Add Armada 385 Access Point +Development Board support") +Signed-off-by: Marcin Wojtas +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/armada-385-db-ap.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/armada-385-db-ap.dts ++++ b/arch/arm/boot/dts/armada-385-db-ap.dts +@@ -46,7 +46,7 @@ + + / { + model = "Marvell Armada 385 Access Point Development Board"; +- compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada38x"; ++ compatible = "marvell,a385-db-ap", "marvell,armada385", "marvell,armada380"; + + chosen { + stdout-path = "serial1:115200n8"; diff --git a/queue-4.1/arm-orion-fix-dsa-platform-device-after-mvmdio-conversion.patch b/queue-4.1/arm-orion-fix-dsa-platform-device-after-mvmdio-conversion.patch new file mode 100644 index 00000000000..bfbe64e6055 --- /dev/null +++ b/queue-4.1/arm-orion-fix-dsa-platform-device-after-mvmdio-conversion.patch @@ -0,0 +1,35 @@ +From d836ace65ee98d7079bc3c5afdbcc0e27dca20a3 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Sat, 3 Oct 2015 13:03:47 -0700 +Subject: ARM: orion: Fix DSA platform device after mvmdio conversion + +From: Florian Fainelli + +commit d836ace65ee98d7079bc3c5afdbcc0e27dca20a3 upstream. + +DSA expects the host_dev pointer to be the device structure associated +with the MDIO bus controller driver. First commit breaking that was +c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO +driver"), and then, it got completely under the radar for a while. + +Reported-by: Frans van de Wiel +Fixes: c3a07134e6aa ("mv643xx_eth: convert to use the Marvell Orion MDIO driver") +Signed-off-by: Florian Fainelli +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/plat-orion/common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/plat-orion/common.c ++++ b/arch/arm/plat-orion/common.c +@@ -499,7 +499,7 @@ void __init orion_ge00_switch_init(struc + + d->netdev = &orion_ge00.dev; + for (i = 0; i < d->nr_chips; i++) +- d->chip[i].host_dev = &orion_ge00_shared.dev; ++ d->chip[i].host_dev = &orion_ge_mvmdio.dev; + orion_switch_device.dev.platform_data = d; + + platform_device_register(&orion_switch_device); diff --git a/queue-4.1/iio-accel-sca3000-memory-corruption-in-sca3000_read_first_n_hw_rb.patch b/queue-4.1/iio-accel-sca3000-memory-corruption-in-sca3000_read_first_n_hw_rb.patch new file mode 100644 index 00000000000..f278c2e68b7 --- /dev/null +++ b/queue-4.1/iio-accel-sca3000-memory-corruption-in-sca3000_read_first_n_hw_rb.patch @@ -0,0 +1,31 @@ +From eda7d0f38aaf50dbb2a2de15e8db386c4f6f65fc Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 8 Aug 2015 22:16:42 +0300 +Subject: iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb() + +From: Dan Carpenter + +commit eda7d0f38aaf50dbb2a2de15e8db386c4f6f65fc upstream. + +"num_read" is in byte units but we are write u16s so we end up write +twice as much as intended. + +Signed-off-by: Dan Carpenter +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/accel/sca3000_ring.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/iio/accel/sca3000_ring.c ++++ b/drivers/staging/iio/accel/sca3000_ring.c +@@ -116,7 +116,7 @@ static int sca3000_read_first_n_hw_rb(st + if (ret) + goto error_ret; + +- for (i = 0; i < num_read; i++) ++ for (i = 0; i < num_read / sizeof(u16); i++) + *(((u16 *)rx) + i) = be16_to_cpup((__be16 *)rx + i); + + if (copy_to_user(buf, rx, num_read)) diff --git a/queue-4.1/iio-mxs-lradc-fix-temperature-offset.patch b/queue-4.1/iio-mxs-lradc-fix-temperature-offset.patch new file mode 100644 index 00000000000..5b6803d9506 --- /dev/null +++ b/queue-4.1/iio-mxs-lradc-fix-temperature-offset.patch @@ -0,0 +1,46 @@ +From b94e22805a2224061bb263a82b72e09544a5fbb3 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Wed, 7 Oct 2015 13:10:54 +0200 +Subject: iio: mxs-lradc: Fix temperature offset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +commit b94e22805a2224061bb263a82b72e09544a5fbb3 upstream. + +0° Kelvin is actually −273.15°C, not -272.15°C. Fix the temperature offset. +Also improve the comment explaining the calculation. + +Reported-by: Janusz Użycki +Signed-off-by: Alexandre Belloni +Acked-by: Stefan Wahren +Acked-by: Marek Vasut +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/iio/adc/mxs-lradc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/staging/iio/adc/mxs-lradc.c ++++ b/drivers/staging/iio/adc/mxs-lradc.c +@@ -919,11 +919,12 @@ static int mxs_lradc_read_raw(struct iio + case IIO_CHAN_INFO_OFFSET: + if (chan->type == IIO_TEMP) { + /* The calculated value from the ADC is in Kelvin, we +- * want Celsius for hwmon so the offset is +- * -272.15 * scale ++ * want Celsius for hwmon so the offset is -273.15 ++ * The offset is applied before scaling so it is ++ * actually -213.15 * 4 / 1.012 = -1079.644268 + */ +- *val = -1075; +- *val2 = 691699; ++ *val = -1079; ++ *val2 = 644268; + + return IIO_VAL_INT_PLUS_MICRO; + } diff --git a/queue-4.1/iio-st_accel-fix-interrupt-handling-on-lis3lv02.patch b/queue-4.1/iio-st_accel-fix-interrupt-handling-on-lis3lv02.patch new file mode 100644 index 00000000000..82d08882410 --- /dev/null +++ b/queue-4.1/iio-st_accel-fix-interrupt-handling-on-lis3lv02.patch @@ -0,0 +1,47 @@ +From 61fd56309165d4790f99462d893b099f0b07312a Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Wed, 2 Sep 2015 21:02:58 +0200 +Subject: iio: st_accel: fix interrupt handling on LIS3LV02 + +From: Linus Walleij + +commit 61fd56309165d4790f99462d893b099f0b07312a upstream. + +This accelerometer accidentally either emits a DRDY signal or an +IRQ signal. Accidentally I activated the IRQ signal as I thought +it was analogous to the interrupt generator on other ST +accelerometers. This was wrong. After this patch generic_buffer +gives a nice stream of accelerometer readings. + +Fixes: 3acddf74f807778f "iio: st-sensors: add support for lis3lv02d accelerometer" +Cc: Denis CIOCCA +Signed-off-by: Linus Walleij +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/accel/st_accel_core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -149,8 +149,6 @@ + #define ST_ACCEL_4_BDU_MASK 0x40 + #define ST_ACCEL_4_DRDY_IRQ_ADDR 0x21 + #define ST_ACCEL_4_DRDY_IRQ_INT1_MASK 0x04 +-#define ST_ACCEL_4_IG1_EN_ADDR 0x21 +-#define ST_ACCEL_4_IG1_EN_MASK 0x08 + #define ST_ACCEL_4_MULTIREAD_BIT true + + static const struct iio_chan_spec st_accel_12bit_channels[] = { +@@ -446,10 +444,6 @@ static const struct st_sensor_settings s + .drdy_irq = { + .addr = ST_ACCEL_4_DRDY_IRQ_ADDR, + .mask_int1 = ST_ACCEL_4_DRDY_IRQ_INT1_MASK, +- .ig1 = { +- .en_addr = ST_ACCEL_4_IG1_EN_ADDR, +- .en_mask = ST_ACCEL_4_IG1_EN_MASK, +- }, + }, + .multi_read_bit = ST_ACCEL_4_MULTIREAD_BIT, + .bootime = 2, /* guess */ diff --git a/queue-4.1/rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch b/queue-4.1/rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch new file mode 100644 index 00000000000..50d6e0db713 --- /dev/null +++ b/queue-4.1/rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch @@ -0,0 +1,87 @@ +From 1f2c6651f69c14d0d3a9cfbda44ea101b02160ba Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Sun, 11 Oct 2015 19:38:00 +0200 +Subject: rbd: don't leak parent_spec in rbd_dev_probe_parent() + +From: Ilya Dryomov + +commit 1f2c6651f69c14d0d3a9cfbda44ea101b02160ba upstream. + +Currently we leak parent_spec and trigger a "parent reference +underflow" warning if rbd_dev_create() in rbd_dev_probe_parent() fails. +The problem is we take the !parent out_err branch and that only drops +refcounts; parent_spec that would've been freed had we called +rbd_dev_unparent() remains and triggers rbd_warn() in +rbd_dev_parent_put() - at that point we have parent_spec != NULL and +parent_ref == 0, so counter ends up being -1 after the decrement. + +Redo rbd_dev_probe_parent() to fix this. + +Signed-off-by: Ilya Dryomov +[idryomov@gmail.com: backport to < 4.2: rbd_dev->opts] +Reviewed-by: Alex Elder +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 35 +++++++++++++++-------------------- + 1 file changed, 15 insertions(+), 20 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5148,41 +5148,36 @@ out_err: + static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) + { + struct rbd_device *parent = NULL; +- struct rbd_spec *parent_spec; +- struct rbd_client *rbdc; + int ret; + + if (!rbd_dev->parent_spec) + return 0; +- /* +- * We need to pass a reference to the client and the parent +- * spec when creating the parent rbd_dev. Images related by +- * parent/child relationships always share both. +- */ +- parent_spec = rbd_spec_get(rbd_dev->parent_spec); +- rbdc = __rbd_get_client(rbd_dev->rbd_client); + +- ret = -ENOMEM; +- parent = rbd_dev_create(rbdc, parent_spec); +- if (!parent) ++ parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec); ++ if (!parent) { ++ ret = -ENOMEM; + goto out_err; ++ } ++ ++ /* ++ * Images related by parent/child relationships always share ++ * rbd_client and spec/parent_spec, so bump their refcounts. ++ */ ++ __rbd_get_client(rbd_dev->rbd_client); ++ rbd_spec_get(rbd_dev->parent_spec); + + ret = rbd_dev_image_probe(parent, false); + if (ret < 0) + goto out_err; ++ + rbd_dev->parent = parent; + atomic_set(&rbd_dev->parent_ref, 1); +- + return 0; ++ + out_err: +- if (parent) { +- rbd_dev_unparent(rbd_dev); ++ rbd_dev_unparent(rbd_dev); ++ if (parent) + rbd_dev_destroy(parent); +- } else { +- rbd_put_client(rbdc); +- rbd_spec_put(parent_spec); +- } +- + return ret; + } + diff --git a/queue-4.1/rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch b/queue-4.1/rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch new file mode 100644 index 00000000000..f8635776170 --- /dev/null +++ b/queue-4.1/rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch @@ -0,0 +1,150 @@ +From 6d69bb536bac0d403d83db1ca841444981b280cd Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Sun, 11 Oct 2015 19:38:00 +0200 +Subject: rbd: prevent kernel stack blow up on rbd map + +From: Ilya Dryomov + +commit 6d69bb536bac0d403d83db1ca841444981b280cd upstream. + +Mapping an image with a long parent chain (e.g. image foo, whose parent +is bar, whose parent is baz, etc) currently leads to a kernel stack +overflow, due to the following recursion in the reply path: + + rbd_osd_req_callback() + rbd_obj_request_complete() + rbd_img_obj_callback() + rbd_img_parent_read_callback() + rbd_obj_request_complete() + ... + +Limit the parent chain to 16 images, which is ~5K worth of stack. When +the above recursion is eliminated, this limit can be lifted. + +Fixes: http://tracker.ceph.com/issues/12538 + +Signed-off-by: Ilya Dryomov +Reviewed-by: Josh Durgin +[idryomov@gmail.com: backport to 4.1: rbd_dev->opts] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -96,6 +96,8 @@ static int atomic_dec_return_safe(atomic + #define RBD_MINORS_PER_MAJOR 256 + #define RBD_SINGLE_MAJOR_PART_SHIFT 4 + ++#define RBD_MAX_PARENT_CHAIN_LEN 16 ++ + #define RBD_SNAP_DEV_NAME_PREFIX "snap_" + #define RBD_MAX_SNAP_NAME_LEN \ + (NAME_MAX - (sizeof (RBD_SNAP_DEV_NAME_PREFIX) - 1)) +@@ -425,7 +427,7 @@ static ssize_t rbd_add_single_major(stru + size_t count); + static ssize_t rbd_remove_single_major(struct bus_type *bus, const char *buf, + size_t count); +-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping); ++static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth); + static void rbd_spec_put(struct rbd_spec *spec); + + static int rbd_dev_id_to_minor(int dev_id) +@@ -5145,7 +5147,12 @@ out_err: + return ret; + } + +-static int rbd_dev_probe_parent(struct rbd_device *rbd_dev) ++/* ++ * @depth is rbd_dev_image_probe() -> rbd_dev_probe_parent() -> ++ * rbd_dev_image_probe() recursion depth, which means it's also the ++ * length of the already discovered part of the parent chain. ++ */ ++static int rbd_dev_probe_parent(struct rbd_device *rbd_dev, int depth) + { + struct rbd_device *parent = NULL; + int ret; +@@ -5153,6 +5160,12 @@ static int rbd_dev_probe_parent(struct r + if (!rbd_dev->parent_spec) + return 0; + ++ if (++depth > RBD_MAX_PARENT_CHAIN_LEN) { ++ pr_info("parent chain is too long (%d)\n", depth); ++ ret = -EINVAL; ++ goto out_err; ++ } ++ + parent = rbd_dev_create(rbd_dev->rbd_client, rbd_dev->parent_spec); + if (!parent) { + ret = -ENOMEM; +@@ -5166,7 +5179,7 @@ static int rbd_dev_probe_parent(struct r + __rbd_get_client(rbd_dev->rbd_client); + rbd_spec_get(rbd_dev->parent_spec); + +- ret = rbd_dev_image_probe(parent, false); ++ ret = rbd_dev_image_probe(parent, depth); + if (ret < 0) + goto out_err; + +@@ -5295,7 +5308,7 @@ static void rbd_dev_image_release(struct + * parent), initiate a watch on its header object before using that + * object to get detailed information about the rbd image. + */ +-static int rbd_dev_image_probe(struct rbd_device *rbd_dev, bool mapping) ++static int rbd_dev_image_probe(struct rbd_device *rbd_dev, int depth) + { + int ret; + +@@ -5313,7 +5326,7 @@ static int rbd_dev_image_probe(struct rb + if (ret) + goto err_out_format; + +- if (mapping) { ++ if (!depth) { + ret = rbd_dev_header_watch_sync(rbd_dev); + if (ret) { + if (ret == -ENOENT) +@@ -5334,7 +5347,7 @@ static int rbd_dev_image_probe(struct rb + * Otherwise this is a parent image, identified by pool, image + * and snap ids - need to fill in names for those ids. + */ +- if (mapping) ++ if (!depth) + ret = rbd_spec_fill_snap_id(rbd_dev); + else + ret = rbd_spec_fill_names(rbd_dev); +@@ -5356,12 +5369,12 @@ static int rbd_dev_image_probe(struct rb + * Need to warn users if this image is the one being + * mapped and has a parent. + */ +- if (mapping && rbd_dev->parent_spec) ++ if (!depth && rbd_dev->parent_spec) + rbd_warn(rbd_dev, + "WARNING: kernel layering is EXPERIMENTAL!"); + } + +- ret = rbd_dev_probe_parent(rbd_dev); ++ ret = rbd_dev_probe_parent(rbd_dev, depth); + if (ret) + goto err_out_probe; + +@@ -5372,7 +5385,7 @@ static int rbd_dev_image_probe(struct rb + err_out_probe: + rbd_dev_unprobe(rbd_dev); + err_out_watch: +- if (mapping) ++ if (!depth) + rbd_dev_header_unwatch_sync(rbd_dev); + out_header_name: + kfree(rbd_dev->header_name); +@@ -5437,7 +5450,7 @@ static ssize_t do_rbd_add(struct bus_typ + rbdc = NULL; /* rbd_dev now owns this */ + spec = NULL; /* rbd_dev now owns this */ + +- rc = rbd_dev_image_probe(rbd_dev, true); ++ rc = rbd_dev_image_probe(rbd_dev, 0); + if (rc < 0) + goto err_out_rbd_dev; + diff --git a/queue-4.1/rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch b/queue-4.1/rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch new file mode 100644 index 00000000000..9eb890178ba --- /dev/null +++ b/queue-4.1/rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch @@ -0,0 +1,46 @@ +From bae818ee1577c27356093901a0ea48f672eda514 Mon Sep 17 00:00:00 2001 +From: Ronny Hegewald +Date: Thu, 15 Oct 2015 18:50:46 +0000 +Subject: rbd: require stable pages if message data CRCs are enabled + +From: Ronny Hegewald + +commit bae818ee1577c27356093901a0ea48f672eda514 upstream. + +rbd requires stable pages, as it performs a crc of the page data before +they are send to the OSDs. + +But since kernel 3.9 (patch 1d1d1a767206fbe5d4c69493b7e6d2a8d08cc0a0 +"mm: only enforce stable page writes if the backing device requires +it") it is not assumed anymore that block devices require stable pages. + +This patch sets the necessary flag to get stable pages back for rbd. + +In a ceph installation that provides multiple ext4 formatted rbd +devices "bad crc" messages appeared regularly (ca 1 message every 1-2 +minutes on every OSD that provided the data for the rbd) in the +OSD-logs before this patch. After this patch this messages are pretty +much gone (only ca 1-2 / month / OSD). + +Signed-off-by: Ronny Hegewald +[idryomov@gmail.com: require stable pages only in crc case, changelog] +[idryomov@gmail.com: backport to 3.18-4.2: context] +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -3797,6 +3797,9 @@ static int rbd_init_disk(struct rbd_devi + q->limits.discard_zeroes_data = 1; + + blk_queue_merge_bvec(q, rbd_merge_bvec); ++ if (!ceph_test_opt(rbd_dev->rbd_client->client, NOCRC)) ++ q->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES; ++ + disk->queue = q; + + q->queuedata = rbd_dev; diff --git a/queue-4.1/series b/queue-4.1/series index c352dca5d0e..d0e63ac0b69 100644 --- a/queue-4.1/series +++ b/queue-4.1/series @@ -32,3 +32,14 @@ drm-i915-deny-wrapping-an-userptr-into-a-framebuffer.patch drm-radeon-don-t-try-to-recreate-sysfs-entries-on-resume.patch drm-radeon-fix-dpms-when-driver-backlight-control-is-disabled.patch drm-radeon-move-bl-encoder-assignment-into-bl-init.patch +iio-mxs-lradc-fix-temperature-offset.patch +iio-st_accel-fix-interrupt-handling-on-lis3lv02.patch +iio-accel-sca3000-memory-corruption-in-sca3000_read_first_n_hw_rb.patch +rbd-require-stable-pages-if-message-data-crcs-are-enabled.patch +rbd-don-t-leak-parent_spec-in-rbd_dev_probe_parent.patch +rbd-prevent-kernel-stack-blow-up-on-rbd-map.patch +arm-orion-fix-dsa-platform-device-after-mvmdio-conversion.patch +arm-mvebu-correct-a385-db-ap-compatible-string.patch +arm-dts-fix-audio-card-detection-on-peach-boards.patch +arm-dts-am57xx-beagle-x15-set-vdd_sd-to-always-on.patch +arm-dts-sunxi-raise-minimum-cpu-voltage-for-sun7i-a20-to-meet-soc-specifications.patch