From: Greg Kroah-Hartman Date: Thu, 17 Nov 2016 08:36:47 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.33~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6cd48811b97f9186e8d3803afbb032dc3e5c3d7e;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch i40e-fix-call-of-ndo_dflt_bridge_getlink.patch lib-genalloc.c-start-search-from-start-of-chunk.patch mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch --- diff --git a/queue-4.4/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch b/queue-4.4/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch new file mode 100644 index 00000000000..7c06bc1d12a --- /dev/null +++ b/queue-4.4/acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch @@ -0,0 +1,36 @@ +From 806487a8fc8f385af75ed261e9ab658fc845e633 Mon Sep 17 00:00:00 2001 +From: Punit Agrawal +Date: Tue, 18 Oct 2016 17:07:19 +0100 +Subject: ACPI / APEI: Fix incorrect return value of ghes_proc() + +From: Punit Agrawal + +commit 806487a8fc8f385af75ed261e9ab658fc845e633 upstream. + +Although ghes_proc() tests for errors while reading the error status, +it always return success (0). Fix this by propagating the return +value. + +Fixes: d334a49113a4a33 (ACPI, APEI, Generic Hardware Error Source memory error support) +Signed-of-by: Punit Agrawal +Tested-by: Tyler Baicar +Reviewed-by: Borislav Petkov +[ rjw: Subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/apei/ghes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -657,7 +657,7 @@ static int ghes_proc(struct ghes *ghes) + ghes_do_proc(ghes, ghes->estatus); + out: + ghes_clear_estatus(ghes); +- return 0; ++ return rc; + } + + static void ghes_add_timer(struct ghes *ghes) diff --git a/queue-4.4/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch b/queue-4.4/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch new file mode 100644 index 00000000000..996b36a5e29 --- /dev/null +++ b/queue-4.4/asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch @@ -0,0 +1,54 @@ +From 85915b63ad8b796848f431b66c9ba5e356e722e5 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 31 Oct 2016 14:42:09 +0800 +Subject: ASoC: sun4i-codec: return error code instead of NULL when create_card fails + +From: Chen-Yu Tsai + +commit 85915b63ad8b796848f431b66c9ba5e356e722e5 upstream. + +When sun4i_codec_create_card fails, we do not assign a proper error +code to the return value. The return value would be 0 from the previous +function call, or we would have bailed out sooner. This would confuse +the driver core into thinking the device probe succeeded, when in fact +it didn't, leaving various devres based resources lingering. + +Make the create_card function pass back a meaningful error code, and +assign it to the return value. + +Fixes: 45fb6b6f2aa3 ("ASoC: sunxi: add support for the on-chip codec on + early Allwinner SoCs") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/sunxi/sun4i-codec.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/sound/soc/sunxi/sun4i-codec.c ++++ b/sound/soc/sunxi/sun4i-codec.c +@@ -575,11 +575,11 @@ static struct snd_soc_card *sun4i_codec_ + + card = devm_kzalloc(dev, sizeof(*card), GFP_KERNEL); + if (!card) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + card->dai_link = sun4i_codec_create_link(dev, &card->num_links); + if (!card->dai_link) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + card->dev = dev; + card->name = "sun4i-codec"; +@@ -661,7 +661,8 @@ static int sun4i_codec_probe(struct plat + } + + card = sun4i_codec_create_card(&pdev->dev); +- if (!card) { ++ if (IS_ERR(card)) { ++ ret = PTR_ERR(card); + dev_err(&pdev->dev, "Failed to create our card\n"); + goto err_unregister_codec; + } diff --git a/queue-4.4/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch b/queue-4.4/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch new file mode 100644 index 00000000000..a57c9fd7fcc --- /dev/null +++ b/queue-4.4/hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch @@ -0,0 +1,44 @@ +From 6d4952d9d9d4dc2bb9c0255d95a09405a1e958f7 Mon Sep 17 00:00:00 2001 +From: Andrew Lutomirski +Date: Mon, 17 Oct 2016 10:06:27 -0700 +Subject: hwrng: core - Don't use a stack buffer in add_early_randomness() + +From: Andrew Lutomirski + +commit 6d4952d9d9d4dc2bb9c0255d95a09405a1e958f7 upstream. + +hw_random carefully avoids using a stack buffer except in +add_early_randomness(). This causes a crash in virtio_rng if +CONFIG_VMAP_STACK=y. + +Reported-by: Matt Mullins +Tested-by: Matt Mullins +Fixes: d3cc7996473a ("hwrng: fetch randomness only after device init") +Signed-off-by: Andy Lutomirski +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/hw_random/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/char/hw_random/core.c ++++ b/drivers/char/hw_random/core.c +@@ -84,14 +84,14 @@ static size_t rng_buffer_size(void) + + static void add_early_randomness(struct hwrng *rng) + { +- unsigned char bytes[16]; + int bytes_read; ++ size_t size = min_t(size_t, 16, rng_buffer_size()); + + mutex_lock(&reading_mutex); +- bytes_read = rng_get_data(rng, bytes, sizeof(bytes), 1); ++ bytes_read = rng_get_data(rng, rng_buffer, size, 1); + mutex_unlock(&reading_mutex); + if (bytes_read > 0) +- add_device_randomness(bytes, bytes_read); ++ add_device_randomness(rng_buffer, bytes_read); + } + + static inline void cleanup_rng(struct kref *kref) diff --git a/queue-4.4/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch b/queue-4.4/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch new file mode 100644 index 00000000000..00fcc199f65 --- /dev/null +++ b/queue-4.4/i40e-fix-call-of-ndo_dflt_bridge_getlink.patch @@ -0,0 +1,39 @@ +From 599b076d15ee3ead7af20fc907079df00b2d59a0 Mon Sep 17 00:00:00 2001 +From: Huaibin Wang +Date: Mon, 26 Sep 2016 09:51:18 +0200 +Subject: i40e: fix call of ndo_dflt_bridge_getlink() + +From: Huaibin Wang + +commit 599b076d15ee3ead7af20fc907079df00b2d59a0 upstream. + +Order of arguments is wrong. +The wrong code has been introduced by commit 7d4f8d871ab1, but is compiled +only since commit 9df70b66418e. + +Note that this may break netlink dumps. + +Fixes: 9df70b66418e ("i40e: Remove incorrect #ifdef's") +Fixes: 7d4f8d871ab1 ("switchdev; add VLAN support for port's bridge_getlink") +CC: Carolyn Wyborny +Signed-off-by: Huaibin Wang +Signed-off-by: Nicolas Dichtel +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -8595,7 +8595,7 @@ static int i40e_ndo_bridge_getlink(struc + return 0; + + return ndo_dflt_bridge_getlink(skb, pid, seq, dev, veb->bridge_mode, +- nlflags, 0, 0, filter_mask, NULL); ++ 0, 0, nlflags, filter_mask, NULL); + } + + #define I40E_MAX_TUNNEL_HDR_LEN 80 diff --git a/queue-4.4/lib-genalloc.c-start-search-from-start-of-chunk.patch b/queue-4.4/lib-genalloc.c-start-search-from-start-of-chunk.patch new file mode 100644 index 00000000000..e043ce40281 --- /dev/null +++ b/queue-4.4/lib-genalloc.c-start-search-from-start-of-chunk.patch @@ -0,0 +1,69 @@ +From 62e931fac45b17c2a42549389879411572f75804 Mon Sep 17 00:00:00 2001 +From: Daniel Mentz +Date: Thu, 27 Oct 2016 17:46:59 -0700 +Subject: lib/genalloc.c: start search from start of chunk + +From: Daniel Mentz + +commit 62e931fac45b17c2a42549389879411572f75804 upstream. + +gen_pool_alloc_algo() iterates over the chunks of a pool trying to find +a contiguous block of memory that satisfies the allocation request. + +The shortcut + + if (size > atomic_read(&chunk->avail)) + continue; + +makes the loop skip over chunks that do not have enough bytes left to +fulfill the request. There are two situations, though, where an +allocation might still fail: + +(1) The available memory is not contiguous, i.e. the request cannot + be fulfilled due to external fragmentation. + +(2) A race condition. Another thread runs the same code concurrently + and is quicker to grab the available memory. + +In those situations, the loop calls pool->algo() to search the entire +chunk, and pool->algo() returns some value that is >= end_bit to +indicate that the search failed. This return value is then assigned to +start_bit. The variables start_bit and end_bit describe the range that +should be searched, and this range should be reset for every chunk that +is searched. Today, the code fails to reset start_bit to 0. As a +result, prefixes of subsequent chunks are ignored. Memory allocations +might fail even though there is plenty of room left in these prefixes of +those other chunks. + +Fixes: 7f184275aa30 ("lib, Make gen_pool memory allocator lockless") +Link: http://lkml.kernel.org/r/1477420604-28918-1-git-send-email-danielmentz@google.com +Signed-off-by: Daniel Mentz +Reviewed-by: Mathieu Desnoyers +Acked-by: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + lib/genalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -273,7 +273,7 @@ unsigned long gen_pool_alloc(struct gen_ + struct gen_pool_chunk *chunk; + unsigned long addr = 0; + int order = pool->min_alloc_order; +- int nbits, start_bit = 0, end_bit, remain; ++ int nbits, start_bit, end_bit, remain; + + #ifndef CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG + BUG_ON(in_nmi()); +@@ -288,6 +288,7 @@ unsigned long gen_pool_alloc(struct gen_ + if (size > atomic_read(&chunk->avail)) + continue; + ++ start_bit = 0; + end_bit = chunk_size(chunk) >> order; + retry: + start_bit = pool->algo(chunk->bits, end_bit, start_bit, nbits, diff --git a/queue-4.4/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch b/queue-4.4/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch new file mode 100644 index 00000000000..3484e0cb21d --- /dev/null +++ b/queue-4.4/mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch @@ -0,0 +1,44 @@ +From f91346e8b5f46aaf12f1df26e87140584ffd1b3f Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Sat, 5 Nov 2016 17:45:07 -0200 +Subject: mmc: mxs: Initialize the spinlock prior to using it + +From: Fabio Estevam + +commit f91346e8b5f46aaf12f1df26e87140584ffd1b3f upstream. + +An interrupt may occur right after devm_request_irq() is called and +prior to the spinlock initialization, leading to a kernel oops, +as the interrupt handler uses the spinlock. + +In order to prevent this problem, move the spinlock initialization +prior to requesting the interrupts. + +Fixes: e4243f13d10e (mmc: mxs-mmc: add mmc host driver for i.MX23/28) +Signed-off-by: Fabio Estevam +Reviewed-by: Marek Vasut +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/mxs-mmc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/mmc/host/mxs-mmc.c ++++ b/drivers/mmc/host/mxs-mmc.c +@@ -661,13 +661,13 @@ static int mxs_mmc_probe(struct platform + + platform_set_drvdata(pdev, mmc); + ++ spin_lock_init(&host->lock); ++ + ret = devm_request_irq(&pdev->dev, irq_err, mxs_mmc_irq_handler, 0, + dev_name(&pdev->dev), host); + if (ret) + goto out_free_dma; + +- spin_lock_init(&host->lock); +- + ret = mmc_add_host(mmc); + if (ret) + goto out_free_dma; diff --git a/queue-4.4/series b/queue-4.4/series index 82727d4cda0..24239aac666 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -28,3 +28,9 @@ tty-serial-at91-fix-hardware-handshake-on-atmel-platforms.patch iommu-amd-free-domain-id-when-free-a-domain-of-struct-dma_ops_domain.patch iommu-vt-d-fix-dead-locks-in-disable_dmar_iommu-path.patch mei-bus-fix-received-data-size-check-in-nfc-fixup.patch +lib-genalloc.c-start-search-from-start-of-chunk.patch +hwrng-core-don-t-use-a-stack-buffer-in-add_early_randomness.patch +i40e-fix-call-of-ndo_dflt_bridge_getlink.patch +acpi-apei-fix-incorrect-return-value-of-ghes_proc.patch +asoc-sun4i-codec-return-error-code-instead-of-null-when-create_card-fails.patch +mmc-mxs-initialize-the-spinlock-prior-to-using-it.patch