From: Greg Kroah-Hartman Date: Tue, 10 Jul 2018 14:50:34 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v3.18.115~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=64be9236800fc3bf3bbbd8fb64e9816ff8add830;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: mtd-cfi_cmdset_0002-change-definition-naming-to-retry-write-operation.patch mtd-cfi_cmdset_0002-change-erase-functions-to-check-chip-good-only.patch mtd-cfi_cmdset_0002-change-erase-functions-to-retry-for-error.patch netfilter-nf_log-don-t-hold-nf_log_mutex-during-user-access.patch --- diff --git a/queue-3.18/mtd-cfi_cmdset_0002-change-definition-naming-to-retry-write-operation.patch b/queue-3.18/mtd-cfi_cmdset_0002-change-definition-naming-to-retry-write-operation.patch new file mode 100644 index 00000000000..c00a2a96a12 --- /dev/null +++ b/queue-3.18/mtd-cfi_cmdset_0002-change-definition-naming-to-retry-write-operation.patch @@ -0,0 +1,59 @@ +From 85a82e28b023de9b259a86824afbd6ba07bd6475 Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Wed, 30 May 2018 18:32:27 +0900 +Subject: mtd: cfi_cmdset_0002: Change definition naming to retry write operation + +From: Tokunori Ikegami + +commit 85a82e28b023de9b259a86824afbd6ba07bd6475 upstream. + +The definition can be used for other program and erase operations also. +So change the naming to MAX_RETRIES from MAX_WORD_RETRIES. + +Signed-off-by: Tokunori Ikegami +Reviewed-by: Joakim Tjernlund +Cc: Chris Packham +Cc: Brian Norris +Cc: David Woodhouse +Cc: Boris Brezillon +Cc: Marek Vasut +Cc: Richard Weinberger +Cc: Cyrille Pitchen +Cc: linux-mtd@lists.infradead.org +Cc: stable@vger.kernel.org +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -42,7 +42,7 @@ + #define AMD_BOOTLOC_BUG + #define FORCE_WORD_WRITE 0 + +-#define MAX_WORD_RETRIES 3 ++#define MAX_RETRIES 3 + + #define SST49LF004B 0x0060 + #define SST49LF040B 0x0050 +@@ -1645,7 +1645,7 @@ static int __xipram do_write_oneword(str + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_WORD_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) + goto retry; + + ret = -EIO; +@@ -2104,7 +2104,7 @@ retry: + map_write(map, CMD(0xF0), chip->start); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_WORD_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) + goto retry; + + ret = -EIO; diff --git a/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-check-chip-good-only.patch b/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-check-chip-good-only.patch new file mode 100644 index 00000000000..e086f9b6ee6 --- /dev/null +++ b/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-check-chip-good-only.patch @@ -0,0 +1,107 @@ +From 79ca484b613041ca223f74b34608bb6f5221724b Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Wed, 30 May 2018 18:32:29 +0900 +Subject: mtd: cfi_cmdset_0002: Change erase functions to check chip good only + +From: Tokunori Ikegami + +commit 79ca484b613041ca223f74b34608bb6f5221724b upstream. + +Currently the functions use to check both chip ready and good. +But the chip ready is not enough to check the operation status. +So change this to check the chip good instead of this. +About the retry functions to make sure the error handling remain it. + +Signed-off-by: Tokunori Ikegami +Reviewed-by: Joakim Tjernlund +Cc: Chris Packham +Cc: Brian Norris +Cc: David Woodhouse +Cc: Boris Brezillon +Cc: Marek Vasut +Cc: Richard Weinberger +Cc: Cyrille Pitchen +Cc: linux-mtd@lists.infradead.org +Cc: stable@vger.kernel.org +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -2294,12 +2294,13 @@ static int __xipram do_erase_chip(struct + chip->erase_suspended = 0; + } + +- if (chip_ready(map, adr)) ++ if (chip_good(map, adr, map_word_ff(map))) + break; + + if (time_after(jiffies, timeo)) { + printk(KERN_WARNING "MTD %s(): software timeout\n", + __func__ ); ++ ret = -EIO; + break; + } + +@@ -2307,15 +2308,15 @@ static int __xipram do_erase_chip(struct + UDELAY(map, chip, adr, 1000000/HZ); + } + /* Did we succeed? */ +- if (!chip_good(map, adr, map_word_ff(map))) { ++ if (ret) { + /* reset on all failures. */ + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) { ++ ret = 0; + goto retry; +- +- ret = -EIO; ++ } + } + + chip->state = FL_READY; +@@ -2389,7 +2390,7 @@ static int __xipram do_erase_oneblock(st + chip->erase_suspended = 0; + } + +- if (chip_ready(map, adr)) { ++ if (chip_good(map, adr, map_word_ff(map))) { + xip_enable(map, chip, adr); + break; + } +@@ -2398,6 +2399,7 @@ static int __xipram do_erase_oneblock(st + xip_enable(map, chip, adr); + printk(KERN_WARNING "MTD %s(): software timeout\n", + __func__ ); ++ ret = -EIO; + break; + } + +@@ -2405,15 +2407,15 @@ static int __xipram do_erase_oneblock(st + UDELAY(map, chip, adr, 1000000/HZ); + } + /* Did we succeed? */ +- if (!chip_good(map, adr, map_word_ff(map))) { ++ if (ret) { + /* reset on all failures. */ + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) { ++ ret = 0; + goto retry; +- +- ret = -EIO; ++ } + } + + chip->state = FL_READY; diff --git a/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-retry-for-error.patch b/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-retry-for-error.patch new file mode 100644 index 00000000000..7dac97746fb --- /dev/null +++ b/queue-3.18/mtd-cfi_cmdset_0002-change-erase-functions-to-retry-for-error.patch @@ -0,0 +1,91 @@ +From 45f75b8a919a4255f52df454f1ffdee0e42443b2 Mon Sep 17 00:00:00 2001 +From: Tokunori Ikegami +Date: Wed, 30 May 2018 18:32:28 +0900 +Subject: mtd: cfi_cmdset_0002: Change erase functions to retry for error + +From: Tokunori Ikegami + +commit 45f75b8a919a4255f52df454f1ffdee0e42443b2 upstream. + +For the word write functions it is retried for error. +But it is not implemented to retry for the erase functions. +To make sure for the erase functions change to retry as same. + +This is needed to prevent the flash erase error caused only once. +It was caused by the error case of chip_good() in the do_erase_oneblock(). +Also it was confirmed on the MACRONIX flash device MX29GL512FHT2I-11G. +But the error issue behavior is not able to reproduce at this moment. +The flash controller is parallel Flash interface integrated on BCM53003. + +Signed-off-by: Tokunori Ikegami +Reviewed-by: Joakim Tjernlund +Cc: Chris Packham +Cc: Brian Norris +Cc: David Woodhouse +Cc: Boris Brezillon +Cc: Marek Vasut +Cc: Richard Weinberger +Cc: Cyrille Pitchen +Cc: linux-mtd@lists.infradead.org +Cc: stable@vger.kernel.org +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/chips/cfi_cmdset_0002.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -2239,6 +2239,7 @@ static int __xipram do_erase_chip(struct + unsigned long int adr; + DECLARE_WAITQUEUE(wait, current); + int ret = 0; ++ int retry_cnt = 0; + + adr = cfi->addr_unlock1; + +@@ -2256,6 +2257,7 @@ static int __xipram do_erase_chip(struct + ENABLE_VPP(map); + xip_disable(map, chip, adr); + ++ retry: + cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); +@@ -2310,6 +2312,9 @@ static int __xipram do_erase_chip(struct + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + ++ if (++retry_cnt <= MAX_RETRIES) ++ goto retry; ++ + ret = -EIO; + } + +@@ -2329,6 +2334,7 @@ static int __xipram do_erase_oneblock(st + unsigned long timeo = jiffies + HZ; + DECLARE_WAITQUEUE(wait, current); + int ret = 0; ++ int retry_cnt = 0; + + adr += chip->start; + +@@ -2346,6 +2352,7 @@ static int __xipram do_erase_oneblock(st + ENABLE_VPP(map); + xip_disable(map, chip, adr); + ++ retry: + cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); +@@ -2403,6 +2410,9 @@ static int __xipram do_erase_oneblock(st + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + ++ if (++retry_cnt <= MAX_RETRIES) ++ goto retry; ++ + ret = -EIO; + } + diff --git a/queue-3.18/netfilter-nf_log-don-t-hold-nf_log_mutex-during-user-access.patch b/queue-3.18/netfilter-nf_log-don-t-hold-nf_log_mutex-during-user-access.patch new file mode 100644 index 00000000000..f23c116975d --- /dev/null +++ b/queue-3.18/netfilter-nf_log-don-t-hold-nf_log_mutex-during-user-access.patch @@ -0,0 +1,49 @@ +From ce00bf07cc95a57cd20b208e02b3c2604e532ae8 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Mon, 25 Jun 2018 17:22:00 +0200 +Subject: netfilter: nf_log: don't hold nf_log_mutex during user access + +From: Jann Horn + +commit ce00bf07cc95a57cd20b208e02b3c2604e532ae8 upstream. + +The old code would indefinitely block other users of nf_log_mutex if +a userspace access in proc_dostring() blocked e.g. due to a userfaultfd +region. Fix it by moving proc_dostring() out of the locked region. + +This is a followup to commit 266d07cb1c9a ("netfilter: nf_log: fix +sleeping function called from invalid context"), which changed this code +from using rcu_read_lock() to taking nf_log_mutex. + +Fixes: 266d07cb1c9a ("netfilter: nf_log: fix sleeping function calle[...]") +Signed-off-by: Jann Horn +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nf_log.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -387,14 +387,17 @@ static int nf_log_proc_dostring(struct c + rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); + mutex_unlock(&nf_log_mutex); + } else { ++ struct ctl_table tmp = *table; ++ ++ tmp.data = buf; + mutex_lock(&nf_log_mutex); + logger = nft_log_dereference(net->nf.nf_loggers[tindex]); + if (!logger) +- table->data = "NONE"; ++ strlcpy(buf, "NONE", sizeof(buf)); + else +- table->data = logger->name; +- r = proc_dostring(table, write, buffer, lenp, ppos); ++ strlcpy(buf, logger->name, sizeof(buf)); + mutex_unlock(&nf_log_mutex); ++ r = proc_dostring(&tmp, write, buffer, lenp, ppos); + } + + return r; diff --git a/queue-3.18/series b/queue-3.18/series index 09112da7be1..8d4ac2f0973 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -17,3 +17,7 @@ media-cx25840-use-subdev-host-data-for-pll-override.patch dm-bufio-avoid-sleeping-while-holding-the-dm_bufio-lock.patch dm-bufio-drop-the-lock-when-doing-gfp_noio-allocation.patch mtd-rawnand-mxc-set-spare-area-size-register-explicitly.patch +mtd-cfi_cmdset_0002-change-definition-naming-to-retry-write-operation.patch +mtd-cfi_cmdset_0002-change-erase-functions-to-retry-for-error.patch +mtd-cfi_cmdset_0002-change-erase-functions-to-check-chip-good-only.patch +netfilter-nf_log-don-t-hold-nf_log_mutex-during-user-access.patch