From: Greg Kroah-Hartman Date: Sun, 27 Jan 2019 15:33:36 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.9.154~61 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6a59d1b124cbae5952c229079424a8077feadbda;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: arc-perf-map-generic-branches-to-correct-hardware-condition.patch asoc-atom-fix-a-missing-check-of-snd_pcm_lib_malloc_pages.patch char-mwave-fix-potential-spectre-v1-vulnerability.patch s390-early-improve-machine-detection.patch s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan.patch staging-rtl8188eu-add-device-code-for-d-link-dwa-121-rev-b1.patch usb-serial-pl2303-add-new-pid-to-support-pl2303tb.patch usb-serial-simple-add-motorola-tetra-tpg2200-device-id.patch --- diff --git a/queue-4.4/arc-perf-map-generic-branches-to-correct-hardware-condition.patch b/queue-4.4/arc-perf-map-generic-branches-to-correct-hardware-condition.patch new file mode 100644 index 00000000000..c14321f6dbb --- /dev/null +++ b/queue-4.4/arc-perf-map-generic-branches-to-correct-hardware-condition.patch @@ -0,0 +1,41 @@ +From 3affbf0e154ee351add6fcc254c59c3f3947fa8f Mon Sep 17 00:00:00 2001 +From: Eugeniy Paltsev +Date: Mon, 17 Dec 2018 12:54:23 +0300 +Subject: ARC: perf: map generic branches to correct hardware condition + +From: Eugeniy Paltsev + +commit 3affbf0e154ee351add6fcc254c59c3f3947fa8f upstream. + +So far we've mapped branches to "ijmp" which also counts conditional +branches NOT taken. This makes us different from other architectures +such as ARM which seem to be counting only taken branches. + +So use "ijmptak" hardware condition which only counts (all jump +instructions that are taken) + +'ijmptak' event is available on both ARCompact and ARCv2 ISA based +cores. + +Signed-off-by: Eugeniy Paltsev +Cc: stable@vger.kernel.org +Signed-off-by: Vineet Gupta +[vgupta: reworked changelog] +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/include/asm/perf_event.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arc/include/asm/perf_event.h ++++ b/arch/arc/include/asm/perf_event.h +@@ -103,7 +103,8 @@ static const char * const arc_pmu_ev_hw_ + + /* counts condition */ + [PERF_COUNT_HW_INSTRUCTIONS] = "iall", +- [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmp", /* Excludes ZOL jumps */ ++ /* All jump instructions that are taken */ ++ [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = "ijmptak", + [PERF_COUNT_ARC_BPOK] = "bpok", /* NP-NT, PT-T, PNT-NT */ + #ifdef CONFIG_ISA_ARCV2 + [PERF_COUNT_HW_BRANCH_MISSES] = "bpmp", diff --git a/queue-4.4/asoc-atom-fix-a-missing-check-of-snd_pcm_lib_malloc_pages.patch b/queue-4.4/asoc-atom-fix-a-missing-check-of-snd_pcm_lib_malloc_pages.patch new file mode 100644 index 00000000000..bd80ec676fc --- /dev/null +++ b/queue-4.4/asoc-atom-fix-a-missing-check-of-snd_pcm_lib_malloc_pages.patch @@ -0,0 +1,39 @@ +From 44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Tue, 25 Dec 2018 20:29:48 -0600 +Subject: ASoC: atom: fix a missing check of snd_pcm_lib_malloc_pages + +From: Kangjie Lu + +commit 44fabd8cdaaa3acb80ad2bb3b5c61ae2136af661 upstream. + +snd_pcm_lib_malloc_pages() may fail, so let's check its status and +return its error code upstream. + +Signed-off-by: Kangjie Lu +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst-mfld-platform-pcm.c ++++ b/sound/soc/intel/atom/sst-mfld-platform-pcm.c +@@ -398,7 +398,13 @@ static int sst_media_hw_params(struct sn + struct snd_pcm_hw_params *params, + struct snd_soc_dai *dai) + { +- snd_pcm_lib_malloc_pages(substream, params_buffer_bytes(params)); ++ int ret; ++ ++ ret = ++ snd_pcm_lib_malloc_pages(substream, ++ params_buffer_bytes(params)); ++ if (ret) ++ return ret; + memset(substream->runtime->dma_area, 0, params_buffer_bytes(params)); + return 0; + } diff --git a/queue-4.4/char-mwave-fix-potential-spectre-v1-vulnerability.patch b/queue-4.4/char-mwave-fix-potential-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..5b87b836f7d --- /dev/null +++ b/queue-4.4/char-mwave-fix-potential-spectre-v1-vulnerability.patch @@ -0,0 +1,69 @@ +From 701956d4018e5d5438570e39e8bda47edd32c489 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Wed, 9 Jan 2019 13:02:36 -0600 +Subject: char/mwave: fix potential Spectre v1 vulnerability + +From: Gustavo A. R. Silva + +commit 701956d4018e5d5438570e39e8bda47edd32c489 upstream. + +ipcnum is indirectly controlled by user-space, hence leading to +a potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +drivers/char/mwave/mwavedd.c:299 mwave_ioctl() warn: potential spectre issue 'pDrvData->IPCs' [w] (local cap) + +Fix this by sanitizing ipcnum before using it to index pDrvData->IPCs. + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Cc: stable@vger.kernel.org +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/mwave/mwavedd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/char/mwave/mwavedd.c ++++ b/drivers/char/mwave/mwavedd.c +@@ -59,6 +59,7 @@ + #include + #include + #include ++#include + #include "smapi.h" + #include "mwavedd.h" + #include "3780i.h" +@@ -289,6 +290,8 @@ static long mwave_ioctl(struct file *fil + ipcnum); + return -EINVAL; + } ++ ipcnum = array_index_nospec(ipcnum, ++ ARRAY_SIZE(pDrvData->IPCs)); + PRINTK_3(TRACE_MWAVE, + "mwavedd::mwave_ioctl IOCTL_MW_REGISTER_IPC" + " ipcnum %x entry usIntCount %x\n", +@@ -317,6 +320,8 @@ static long mwave_ioctl(struct file *fil + " Invalid ipcnum %x\n", ipcnum); + return -EINVAL; + } ++ ipcnum = array_index_nospec(ipcnum, ++ ARRAY_SIZE(pDrvData->IPCs)); + PRINTK_3(TRACE_MWAVE, + "mwavedd::mwave_ioctl IOCTL_MW_GET_IPC" + " ipcnum %x, usIntCount %x\n", +@@ -383,6 +388,8 @@ static long mwave_ioctl(struct file *fil + ipcnum); + return -EINVAL; + } ++ ipcnum = array_index_nospec(ipcnum, ++ ARRAY_SIZE(pDrvData->IPCs)); + mutex_lock(&mwave_mutex); + if (pDrvData->IPCs[ipcnum].bIsEnabled == TRUE) { + pDrvData->IPCs[ipcnum].bIsEnabled = FALSE; diff --git a/queue-4.4/s390-early-improve-machine-detection.patch b/queue-4.4/s390-early-improve-machine-detection.patch new file mode 100644 index 00000000000..8ccd5b55f99 --- /dev/null +++ b/queue-4.4/s390-early-improve-machine-detection.patch @@ -0,0 +1,53 @@ +From 03aa047ef2db4985e444af6ee1c1dd084ad9fb4c Mon Sep 17 00:00:00 2001 +From: Christian Borntraeger +Date: Fri, 9 Nov 2018 09:21:47 +0100 +Subject: s390/early: improve machine detection + +From: Christian Borntraeger + +commit 03aa047ef2db4985e444af6ee1c1dd084ad9fb4c upstream. + +Right now the early machine detection code check stsi 3.2.2 for "KVM" +and set MACHINE_IS_VM if this is different. As the console detection +uses diagnose 8 if MACHINE_IS_VM returns true this will crash Linux +early for any non z/VM system that sets a different value than KVM. +So instead of assuming z/VM, do not set any of MACHINE_IS_LPAR, +MACHINE_IS_VM, or MACHINE_IS_KVM. + +CC: stable@vger.kernel.org +Reviewed-by: Heiko Carstens +Signed-off-by: Christian Borntraeger +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/early.c | 4 ++-- + arch/s390/kernel/setup.c | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -224,10 +224,10 @@ static noinline __init void detect_machi + if (stsi(vmms, 3, 2, 2) || !vmms->count) + return; + +- /* Running under KVM? If not we assume z/VM */ ++ /* Detect known hypervisors */ + if (!memcmp(vmms->vm[0].cpi, "\xd2\xe5\xd4", 3)) + S390_lowcore.machine_flags |= MACHINE_FLAG_KVM; +- else ++ else if (!memcmp(vmms->vm[0].cpi, "\xa9\x61\xe5\xd4", 4)) + S390_lowcore.machine_flags |= MACHINE_FLAG_VM; + } + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -833,6 +833,8 @@ void __init setup_arch(char **cmdline_p) + pr_info("Linux is running under KVM in 64-bit mode\n"); + else if (MACHINE_IS_LPAR) + pr_info("Linux is running natively in 64-bit mode\n"); ++ else ++ pr_info("Linux is running as a guest in 64-bit mode\n"); + + /* Have one command line that is parsed and saved in /proc/cmdline */ + /* boot_command_line has been already set up in early.c */ diff --git a/queue-4.4/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan.patch b/queue-4.4/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan.patch new file mode 100644 index 00000000000..99a783db118 --- /dev/null +++ b/queue-4.4/s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan.patch @@ -0,0 +1,84 @@ +From b7cb707c373094ce4008d4a6ac9b6b366ec52da5 Mon Sep 17 00:00:00 2001 +From: Gerald Schaefer +Date: Wed, 9 Jan 2019 13:00:03 +0100 +Subject: s390/smp: fix CPU hotplug deadlock with CPU rescan + +From: Gerald Schaefer + +commit b7cb707c373094ce4008d4a6ac9b6b366ec52da5 upstream. + +smp_rescan_cpus() is called without the device_hotplug_lock, which can lead +to a dedlock when a new CPU is found and immediately set online by a udev +rule. + +This was observed on an older kernel version, where the cpu_hotplug_begin() +loop was still present, and it resulted in hanging chcpu and systemd-udev +processes. This specific deadlock will not show on current kernels. However, +there may be other possible deadlocks, and since smp_rescan_cpus() can still +trigger a CPU hotplug operation, the device_hotplug_lock should be held. + +For reference, this was the deadlock with the old cpu_hotplug_begin() loop: + + chcpu (rescan) systemd-udevd + + echo 1 > /sys/../rescan + -> smp_rescan_cpus() + -> (*) get_online_cpus() + (increases refcount) + -> smp_add_present_cpu() + (new CPU found) + -> register_cpu() + -> device_add() + -> udev "add" event triggered -----------> udev rule sets CPU online + -> echo 1 > /sys/.../online + -> lock_device_hotplug_sysfs() + (this is missing in rescan path) + -> device_online() + -> (**) device_lock(new CPU dev) + -> cpu_up() + -> cpu_hotplug_begin() + (loops until refcount == 0) + -> deadlock with (*) + -> bus_probe_device() + -> device_attach() + -> device_lock(new CPU dev) + -> deadlock with (**) + +Fix this by taking the device_hotplug_lock in the CPU rescan path. + +Cc: +Signed-off-by: Gerald Schaefer +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/smp.c | 4 ++++ + drivers/s390/char/sclp_config.c | 2 ++ + 2 files changed, 6 insertions(+) + +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -1152,7 +1152,11 @@ static ssize_t __ref rescan_store(struct + { + int rc; + ++ rc = lock_device_hotplug_sysfs(); ++ if (rc) ++ return rc; + rc = smp_rescan_cpus(); ++ unlock_device_hotplug(); + return rc ? rc : count; + } + static DEVICE_ATTR(rescan, 0200, NULL, rescan_store); +--- a/drivers/s390/char/sclp_config.c ++++ b/drivers/s390/char/sclp_config.c +@@ -43,7 +43,9 @@ static void sclp_cpu_capability_notify(s + + static void __ref sclp_cpu_change_notify(struct work_struct *work) + { ++ lock_device_hotplug(); + smp_rescan_cpus(); ++ unlock_device_hotplug(); + } + + static void sclp_conf_receiver_fn(struct evbuf_header *evbuf) diff --git a/queue-4.4/series b/queue-4.4/series index 6b7020c397b..66f9d70910d 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -4,3 +4,11 @@ net-ipv4-fix-memory-leak-in-network-namespace-dismantle.patch net_sched-refetch-skb-protocol-for-each-filter.patch net-bridge-fix-ethernet-header-pointer-before-check-skb-forwardable.patch mmc-kconfig-enable-config_mmc_sdhci_io_accessors.patch +usb-serial-simple-add-motorola-tetra-tpg2200-device-id.patch +usb-serial-pl2303-add-new-pid-to-support-pl2303tb.patch +asoc-atom-fix-a-missing-check-of-snd_pcm_lib_malloc_pages.patch +arc-perf-map-generic-branches-to-correct-hardware-condition.patch +s390-early-improve-machine-detection.patch +s390-smp-fix-cpu-hotplug-deadlock-with-cpu-rescan.patch +char-mwave-fix-potential-spectre-v1-vulnerability.patch +staging-rtl8188eu-add-device-code-for-d-link-dwa-121-rev-b1.patch diff --git a/queue-4.4/staging-rtl8188eu-add-device-code-for-d-link-dwa-121-rev-b1.patch b/queue-4.4/staging-rtl8188eu-add-device-code-for-d-link-dwa-121-rev-b1.patch new file mode 100644 index 00000000000..2564a08e5d2 --- /dev/null +++ b/queue-4.4/staging-rtl8188eu-add-device-code-for-d-link-dwa-121-rev-b1.patch @@ -0,0 +1,32 @@ +From 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a Mon Sep 17 00:00:00 2001 +From: Michael Straube +Date: Mon, 7 Jan 2019 18:28:58 +0100 +Subject: staging: rtl8188eu: Add device code for D-Link DWA-121 rev B1 + +From: Michael Straube + +commit 5f74a8cbb38d10615ed46bc3e37d9a4c9af8045a upstream. + +This device was added to the stand-alone driver on github. +Add it to the staging driver as well. + +Link: https://github.com/lwfinger/rtl8188eu/commit/a0619a07cd1e +Signed-off-by: Michael Straube +Acked-by: Larry Finger +Cc: stable +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_t + {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ + {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ ++ {USB_DEVICE(0x2001, 0x331B)}, /* D-Link DWA-121 rev B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ diff --git a/queue-4.4/usb-serial-pl2303-add-new-pid-to-support-pl2303tb.patch b/queue-4.4/usb-serial-pl2303-add-new-pid-to-support-pl2303tb.patch new file mode 100644 index 00000000000..190a4f088bf --- /dev/null +++ b/queue-4.4/usb-serial-pl2303-add-new-pid-to-support-pl2303tb.patch @@ -0,0 +1,49 @@ +From 4dcf9ddc9ad5ab649abafa98c5a4d54b1a33dabb Mon Sep 17 00:00:00 2001 +From: Charles Yeh +Date: Tue, 15 Jan 2019 23:13:56 +0800 +Subject: USB: serial: pl2303: add new PID to support PL2303TB + +From: Charles Yeh + +commit 4dcf9ddc9ad5ab649abafa98c5a4d54b1a33dabb upstream. + +Add new PID to support PL2303TB (TYPE_HX) + +Signed-off-by: Charles Yeh +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/pl2303.c | 1 + + drivers/usb/serial/pl2303.h | 2 ++ + 2 files changed, 3 insertions(+) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -47,6 +47,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) }, + { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) }, ++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_TB) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -13,6 +13,7 @@ + + #define PL2303_VENDOR_ID 0x067b + #define PL2303_PRODUCT_ID 0x2303 ++#define PL2303_PRODUCT_ID_TB 0x2304 + #define PL2303_PRODUCT_ID_RSAQ2 0x04bb + #define PL2303_PRODUCT_ID_DCU11 0x1234 + #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 +@@ -25,6 +26,7 @@ + #define PL2303_PRODUCT_ID_MOTOROLA 0x0307 + #define PL2303_PRODUCT_ID_ZTEK 0xe1f1 + ++ + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 diff --git a/queue-4.4/usb-serial-simple-add-motorola-tetra-tpg2200-device-id.patch b/queue-4.4/usb-serial-simple-add-motorola-tetra-tpg2200-device-id.patch new file mode 100644 index 00000000000..09d62565f36 --- /dev/null +++ b/queue-4.4/usb-serial-simple-add-motorola-tetra-tpg2200-device-id.patch @@ -0,0 +1,41 @@ +From b81c2c33eab79dfd3650293b2227ee5c6036585c Mon Sep 17 00:00:00 2001 +From: Max Schulze +Date: Mon, 7 Jan 2019 08:31:49 +0100 +Subject: USB: serial: simple: add Motorola Tetra TPG2200 device id + +From: Max Schulze + +commit b81c2c33eab79dfd3650293b2227ee5c6036585c upstream. + +Add new Motorola Tetra device id for Motorola Solutions TETRA PEI device + +T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=0cad ProdID=9016 Rev=24.16 +S: Manufacturer=Motorola Solutions, Inc. +S: Product=TETRA PEI interface +C: #Ifs= 2 Cfg#= 1 Atr=80 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=usb_serial_simple +I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=usb_serial_simple + +Signed-off-by: Max Schulze +Cc: stable +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/usb-serial-simple.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -88,7 +88,8 @@ DEVICE(moto_modem, MOTO_IDS); + /* Motorola Tetra driver */ + #define MOTOROLA_TETRA_IDS() \ + { USB_DEVICE(0x0cad, 0x9011) }, /* Motorola Solutions TETRA PEI */ \ +- { USB_DEVICE(0x0cad, 0x9012) } /* MTP6550 */ ++ { USB_DEVICE(0x0cad, 0x9012) }, /* MTP6550 */ \ ++ { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + + /* Novatel Wireless GPS driver */