From: Greg Kroah-Hartman Date: Fri, 27 Apr 2018 12:20:10 +0000 (+0200) Subject: 4.16-stable patches X-Git-Tag: v3.18.107~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=923224dce842c666c464bb3bd0822136a2d0e1b8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.16-stable patches added patches: acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch block-swim-check-drive-type.patch block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch block-swim-fix-array-bounds-check.patch block-swim-fix-io-error-at-end-of-medium.patch block-swim-remove-extra-put_disk-call-from-error-path.patch block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch block-swim-select-appropriate-drive-on-device-open.patch cdrom-information-leak-in-cdrom_ioctl_media_changed.patch commoncap-handle-memory-allocation-failure.patch fsnotify-fix-fsnotify_mark_connector-race.patch hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch kprobes-fix-random-address-output-of-blacklist-file.patch m68k-mac-don-t-remap-swim-mmio-region.patch revert-mm-hmm-fix-header-file-if-else-endif-maze.patch s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch s390-dasd-fix-io-error-for-newly-defined-devices.patch s390-uprobes-implement-arch_uretprobe_is_alive.patch scsi-mptsas-disable-write-same.patch tracing-fix-missing-tab-for-hwlat_detector-print-format.patch --- diff --git a/queue-4.16/acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch b/queue-4.16/acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch new file mode 100644 index 00000000000..58d6afeacb4 --- /dev/null +++ b/queue-4.16/acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch @@ -0,0 +1,85 @@ +From 53fa1f6e8a5958da698a31edf366ffe90596b490 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 17 Apr 2018 18:23:50 +0200 +Subject: ACPI / video: Only default only_lcd to true on Win8-ready _desktops_ + +From: Hans de Goede + +commit 53fa1f6e8a5958da698a31edf366ffe90596b490 upstream. + +Commit 5928c281524f (ACPI / video: Default lcd_only to true on Win8-ready +and newer machines) made only_lcd default to true on all machines where +acpi_osi_is_win8() returns true, including laptops. + +The purpose of this is to avoid the bogus / non-working acpi backlight +interface which many newer BIOS-es define on desktop machines. + +But this is causing a regression on some laptops, specifically on the +Dell XPS 13 2013 model, which does not have the LCD flag set for its +fully functional ACPI backlight interface. + +Rather then DMI quirking our way out of this, this commits changes the +logic for setting only_lcd to true, to only do this on machines with +a desktop (or server) dmi chassis-type. + +Note that we cannot simply only check the chassis-type and not register +the backlight interface based on that as there are some laptops and +tablets which have their chassis-type set to "3" aka desktop. Hopefully +the combination of checking the LCD flag, but only on devices with +a desktop(ish) chassis-type will avoid the needs for DMI quirks for this, +or at least limit the amount of DMI quirks which we need to a minimum. + +Fixes: 5928c281524f (ACPI / video: Default lcd_only to true on Win8-ready and newer machines) +Reported-and-tested-by: James Hogan +Signed-off-by: Hans de Goede +Cc: 4.15+ # 4.15+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/acpi/acpi_video.c | 27 +++++++++++++++++++++++++-- + 1 file changed, 25 insertions(+), 2 deletions(-) + +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present + return opregion; + } + ++static bool dmi_is_desktop(void) ++{ ++ const char *chassis_type; ++ ++ chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); ++ if (!chassis_type) ++ return false; ++ ++ if (!strcmp(chassis_type, "3") || /* 3: Desktop */ ++ !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */ ++ !strcmp(chassis_type, "5") || /* 5: Pizza Box */ ++ !strcmp(chassis_type, "6") || /* 6: Mini Tower */ ++ !strcmp(chassis_type, "7") || /* 7: Tower */ ++ !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */ ++ return true; ++ ++ return false; ++} ++ + int acpi_video_register(void) + { + int ret = 0; +@@ -2143,8 +2162,12 @@ int acpi_video_register(void) + * win8 ready (where we also prefer the native backlight driver, so + * normally the acpi_video code should not register there anyways). + */ +- if (only_lcd == -1) +- only_lcd = acpi_osi_is_win8(); ++ if (only_lcd == -1) { ++ if (dmi_is_desktop() && acpi_osi_is_win8()) ++ only_lcd = true; ++ else ++ only_lcd = false; ++ } + + dmi_check_system(video_dmi_table); + diff --git a/queue-4.16/block-swim-check-drive-type.patch b/queue-4.16/block-swim-check-drive-type.patch new file mode 100644 index 00000000000..3d0b699133f --- /dev/null +++ b/queue-4.16/block-swim-check-drive-type.patch @@ -0,0 +1,43 @@ +From 8a500df63d07d8aee44b7ee2c54e462e47ce93ec Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Check drive type + +From: Finn Thain + +commit 8a500df63d07d8aee44b7ee2c54e462e47ce93ec upstream. + +The SWIM chip is compatible with GCR-mode Sony 400K/800K drives but +this driver only supports MFM mode. Therefore only Sony FDHD drives +are supported. Skip incompatible drives. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -834,10 +834,12 @@ static int swim_floppy_init(struct swim_ + /* scan floppy drives */ + + swim_drive(base, INTERNAL_DRIVE); +- if (swim_readbit(base, DRIVE_PRESENT)) ++ if (swim_readbit(base, DRIVE_PRESENT) && ++ !swim_readbit(base, ONEMEG_DRIVE)) + swim_add_floppy(swd, INTERNAL_DRIVE); + swim_drive(base, EXTERNAL_DRIVE); +- if (swim_readbit(base, DRIVE_PRESENT)) ++ if (swim_readbit(base, DRIVE_PRESENT) && ++ !swim_readbit(base, ONEMEG_DRIVE)) + swim_add_floppy(swd, EXTERNAL_DRIVE); + + /* register floppy drives */ diff --git a/queue-4.16/block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch b/queue-4.16/block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch new file mode 100644 index 00000000000..be6958c8922 --- /dev/null +++ b/queue-4.16/block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch @@ -0,0 +1,53 @@ +From 8e2ab5a4efaac77fb93e5b5b109d0b3976fdd3a0 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Don't log an error message for an invalid ioctl + +From: Finn Thain + +commit 8e2ab5a4efaac77fb93e5b5b109d0b3976fdd3a0 upstream. + +The 'eject' shell command may send various different ioctl commands. +This leads to error messages on the console even though the FDEJECT +ioctl succeeds. + +~# eject floppy +SWIM floppy_ioctl: unknown cmd 21257 +SWIM floppy_ioctl: unknown cmd 1 + +Don't log an error message for an invalid ioctl, just do as the +swim3 driver does and return -ENOTTY. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -727,14 +727,9 @@ static int floppy_ioctl(struct block_dev + if (copy_to_user((void __user *) param, (void *) &floppy_type, + sizeof(struct floppy_struct))) + return -EFAULT; +- break; +- +- default: +- printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n", +- cmd); +- return -ENOSYS; ++ return 0; + } +- return 0; ++ return -ENOTTY; + } + + static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo) diff --git a/queue-4.16/block-swim-fix-array-bounds-check.patch b/queue-4.16/block-swim-fix-array-bounds-check.patch new file mode 100644 index 00000000000..5cc6cb39292 --- /dev/null +++ b/queue-4.16/block-swim-fix-array-bounds-check.patch @@ -0,0 +1,101 @@ +From 7ae6a2b6cc058005ee3d0d2b9ce27688e51afa4b Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Fix array bounds check + +From: Finn Thain + +commit 7ae6a2b6cc058005ee3d0d2b9ce27688e51afa4b upstream. + +In the floppy_find() function in swim.c is a call to +get_disk(swd->unit[drive].disk). The actual parameter to this call +can be a NULL pointer when drive == swd->floppy_count. This causes +an oops in get_disk(). + +Data read fault at 0x00000198 in Super Data (pc=0x1be5b6) +BAD KERNEL BUSERR +Oops: 00000000 +Modules linked in: swim_mod ipv6 mac8390 +PC: [<001be5b6>] get_disk+0xc/0x76 +SR: 2004 SP: 9a078bc1 a2: 0213ed90 +d0: 00000000 d1: 00000000 d2: 00000000 d3: 000000ff +d4: 00000002 d5: 02983590 a0: 02332e00 a1: 022dfd64 +Process dd (pid: 285, task=020ab25b) +Frame format=B ssw=074d isc=4a88 isb=6732 daddr=00000198 dobuf=00000000 +baddr=001be5bc dibuf=bfffffff ver=f +Stack from 022dfca4: + 00000000 0203fc00 0213ed90 022dfcc0 02982936 00000000 00200000 022dfd08 + 0020f85a 00200000 022dfd64 02332e00 004040fc 00000014 001be77e 022dfd64 + 00334e4a 001be3f8 0800001d 022dfd64 01c04b60 01c04b70 022aba80 029828f8 + 02332e00 022dfd2c 001be7ac 0203fc00 00200000 022dfd64 02103a00 01c04b60 + 01c04b60 0200e400 022dfd68 000e191a 00200000 022dfd64 02103a00 0800001d + 00000000 00000003 000b89de 00500000 02103a00 01c04b60 02103a08 01c04c2e +Call Trace: [<02982936>] floppy_find+0x3e/0x4a [swim_mod] + [<00200000>] uart_remove_one_port+0x1a2/0x260 + [<0020f85a>] kobj_lookup+0xde/0x132 + [<00200000>] uart_remove_one_port+0x1a2/0x260 + [<001be77e>] get_gendisk+0x0/0x130 + [<00334e4a>] mutex_lock+0x0/0x2e + [<001be3f8>] disk_block_events+0x0/0x6c + [<029828f8>] floppy_find+0x0/0x4a [swim_mod] + [<001be7ac>] get_gendisk+0x2e/0x130 + [<00200000>] uart_remove_one_port+0x1a2/0x260 + [<000e191a>] __blkdev_get+0x32/0x45a + [<00200000>] uart_remove_one_port+0x1a2/0x260 + [<000b89de>] complete_walk+0x0/0x8a + [<000e1e22>] blkdev_get+0xe0/0x29a + [<000e1fdc>] blkdev_open+0x0/0xb0 + [<000b89de>] complete_walk+0x0/0x8a + [<000e1fdc>] blkdev_open+0x0/0xb0 + [<000e01cc>] bd_acquire+0x74/0x8a + [<000e205c>] blkdev_open+0x80/0xb0 + [<000e1fdc>] blkdev_open+0x0/0xb0 + [<000abf24>] do_dentry_open+0x1a4/0x322 + [<00020000>] __do_proc_douintvec+0x22/0x27e + [<000b89de>] complete_walk+0x0/0x8a + [<000baa62>] link_path_walk+0x0/0x48e + [<000ba3f8>] inode_permission+0x20/0x54 + [<000ac0e4>] vfs_open+0x42/0x78 + [<000bc372>] path_openat+0x2b2/0xeaa + [<000bc0c0>] path_openat+0x0/0xeaa + [<0004463e>] __irq_wake_thread+0x0/0x4e + [<0003a45a>] task_tick_fair+0x18/0xc8 + [<000bd00a>] do_filp_open+0xa0/0xea + [<000abae0>] do_sys_open+0x11a/0x1ee + [<00020000>] __do_proc_douintvec+0x22/0x27e + [<000abbf4>] SyS_open+0x1e/0x22 + [<00020000>] __do_proc_douintvec+0x22/0x27e + [<00002b40>] syscall+0x8/0xc + [<00020000>] __do_proc_douintvec+0x22/0x27e + [<0000c00b>] dyadic+0x1/0x28 +Code: 4e5e 4e75 4e56 fffc 2f0b 2f02 266e 0008 <206b> 0198 4a88 6732 2428 002c 661e 486b 0058 4eb9 0032 0b96 588f 4a88 672c 2008 +Disabling lock debugging due to kernel taint + +Fix the array index bounds check to avoid this. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Fixes: 8852ecd97488 ("[PATCH] m68k: mac - Add SWIM floppy support") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -790,7 +790,7 @@ static struct kobject *floppy_find(dev_t + struct swim_priv *swd = data; + int drive = (*part & 3); + +- if (drive > swd->floppy_count) ++ if (drive >= swd->floppy_count) + return NULL; + + *part = 0; diff --git a/queue-4.16/block-swim-fix-io-error-at-end-of-medium.patch b/queue-4.16/block-swim-fix-io-error-at-end-of-medium.patch new file mode 100644 index 00000000000..5b05d804336 --- /dev/null +++ b/queue-4.16/block-swim-fix-io-error-at-end-of-medium.patch @@ -0,0 +1,75 @@ +From 5a13388d7aa1177b98d7168330ecbeeac52f844d Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Fix IO error at end of medium + +From: Finn Thain + +commit 5a13388d7aa1177b98d7168330ecbeeac52f844d upstream. + +Reading to the end of a 720K disk results in an IO error instead of EOF +because the block layer thinks the disk has 2880 sectors. (Partly this +is a result of inverted logic of the ONEMEG_MEDIA bit that's now fixed.) + +Initialize the density and head count in swim_add_floppy() to agree +with the device size passed to set_capacity() during drive probe. + +Call set_capacity() again upon device open, after refreshing the density +and head count values. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_s + struct floppy_struct *g; + fs->disk_in = 1; + fs->write_protected = swim_readbit(base, WRITE_PROT); +- fs->type = swim_readbit(base, TWOMEG_MEDIA); + + if (swim_track00(base)) + printk(KERN_ERR +@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_s + + swim_track00(base); + ++ fs->type = swim_readbit(base, TWOMEG_MEDIA) ? ++ HD_MEDIA : DD_MEDIA; ++ fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2; + get_floppy_geometry(fs, 0, &g); + fs->total_secs = g->size; + fs->secpercyl = g->head * g->sect; +@@ -656,6 +658,8 @@ static int floppy_open(struct block_devi + goto out; + } + ++ set_capacity(fs->disk, fs->total_secs); ++ + if (mode & FMODE_NDELAY) + return 0; + +@@ -808,10 +812,9 @@ static int swim_add_floppy(struct swim_p + + swim_motor(base, OFF); + +- if (swim_readbit(base, SINGLE_SIDED)) +- fs->head_number = 1; +- else +- fs->head_number = 2; ++ fs->type = HD_MEDIA; ++ fs->head_number = 2; ++ + fs->ref_count = 0; + fs->ejected = 1; + diff --git a/queue-4.16/block-swim-remove-extra-put_disk-call-from-error-path.patch b/queue-4.16/block-swim-remove-extra-put_disk-call-from-error-path.patch new file mode 100644 index 00000000000..c859948c640 --- /dev/null +++ b/queue-4.16/block-swim-remove-extra-put_disk-call-from-error-path.patch @@ -0,0 +1,34 @@ +From c1d6207cc0eef2a7f8551f9c7420d8776268f6e1 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Remove extra put_disk() call from error path + +From: Finn Thain + +commit c1d6207cc0eef2a7f8551f9c7420d8776268f6e1 upstream. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Fixes: 103db8b2dfa5 ("[PATCH] swim: stop sharing request queue across multiple gendisks") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -858,7 +858,6 @@ static int swim_floppy_init(struct swim_ + &swd->lock); + if (!swd->unit[drive].disk->queue) { + err = -ENOMEM; +- put_disk(swd->unit[drive].disk); + goto exit_put_disks; + } + blk_queue_bounce_limit(swd->unit[drive].disk->queue, diff --git a/queue-4.16/block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch b/queue-4.16/block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch new file mode 100644 index 00000000000..2d22eebfdc6 --- /dev/null +++ b/queue-4.16/block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch @@ -0,0 +1,95 @@ +From 56a1c5ee54f69dd767fb61d301883dc919ddc259 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Rename macros to avoid inconsistent inverted logic + +From: Finn Thain + +commit 56a1c5ee54f69dd767fb61d301883dc919ddc259 upstream. + +The Sony drive status bits use active-low logic. The swim_readbit() +function converts that to 'C' logic for readability. Hence, the +sense of the names of the status bit macros should not be inverted. + +Mostly they are correct. However, the TWOMEG_DRIVE, MFM_MODE and +TWOMEG_MEDIA macros have inverted sense (like MkLinux). Fix this +inconsistency and make the following patches less confusing. + +The same problem affects swim3.c so fix that too. + +No functional change. + +The FDHD drive status bits are documented in sonydriv.cpp from MAME +and in swimiii.h from MkLinux. + +Cc: Laurent Vivier +Cc: Benjamin Herrenschmidt +Cc: linuxppc-dev@lists.ozlabs.org +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 8 ++++---- + drivers/block/swim3.c | 6 +++--- + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -110,7 +110,7 @@ struct iwm { + /* Select values for swim_select and swim_readbit */ + + #define READ_DATA_0 0x074 +-#define TWOMEG_DRIVE 0x075 ++#define ONEMEG_DRIVE 0x075 + #define SINGLE_SIDED 0x076 + #define DRIVE_PRESENT 0x077 + #define DISK_IN 0x170 +@@ -118,9 +118,9 @@ struct iwm { + #define TRACK_ZERO 0x172 + #define TACHO 0x173 + #define READ_DATA_1 0x174 +-#define MFM_MODE 0x175 ++#define GCR_MODE 0x175 + #define SEEK_COMPLETE 0x176 +-#define ONEMEG_MEDIA 0x177 ++#define TWOMEG_MEDIA 0x177 + + /* Bits in handshake register */ + +@@ -612,7 +612,7 @@ static void setup_medium(struct floppy_s + struct floppy_struct *g; + fs->disk_in = 1; + fs->write_protected = swim_readbit(base, WRITE_PROT); +- fs->type = swim_readbit(base, ONEMEG_MEDIA); ++ fs->type = swim_readbit(base, TWOMEG_MEDIA); + + if (swim_track00(base)) + printk(KERN_ERR +--- a/drivers/block/swim3.c ++++ b/drivers/block/swim3.c +@@ -148,7 +148,7 @@ struct swim3 { + #define MOTOR_ON 2 + #define RELAX 3 /* also eject in progress */ + #define READ_DATA_0 4 +-#define TWOMEG_DRIVE 5 ++#define ONEMEG_DRIVE 5 + #define SINGLE_SIDED 6 /* drive or diskette is 4MB type? */ + #define DRIVE_PRESENT 7 + #define DISK_IN 8 +@@ -156,9 +156,9 @@ struct swim3 { + #define TRACK_ZERO 10 + #define TACHO 11 + #define READ_DATA_1 12 +-#define MFM_MODE 13 ++#define GCR_MODE 13 + #define SEEK_COMPLETE 14 +-#define ONEMEG_MEDIA 15 ++#define TWOMEG_MEDIA 15 + + /* Definitions of values used in writing and formatting */ + #define DATA_ESCAPE 0x99 diff --git a/queue-4.16/block-swim-select-appropriate-drive-on-device-open.patch b/queue-4.16/block-swim-select-appropriate-drive-on-device-open.patch new file mode 100644 index 00000000000..f36d87b4c52 --- /dev/null +++ b/queue-4.16/block-swim-select-appropriate-drive-on-device-open.patch @@ -0,0 +1,36 @@ +From b3906535ccc6cd04c42f9b1c7e31d1947b3ebc74 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: block/swim: Select appropriate drive on device open + +From: Finn Thain + +commit b3906535ccc6cd04c42f9b1c7e31d1947b3ebc74 upstream. + +The driver supports internal and external FDD units so the floppy_open +function must not hard-code the drive location. + +Cc: Laurent Vivier +Cc: Jens Axboe +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -646,7 +646,7 @@ static int floppy_open(struct block_devi + + swim_write(base, setup, S_IBM_DRIVE | S_FCLK_DIV2); + udelay(10); +- swim_drive(base, INTERNAL_DRIVE); ++ swim_drive(base, fs->location); + swim_motor(base, ON); + swim_action(base, SETMFM); + if (fs->ejected) diff --git a/queue-4.16/cdrom-information-leak-in-cdrom_ioctl_media_changed.patch b/queue-4.16/cdrom-information-leak-in-cdrom_ioctl_media_changed.patch new file mode 100644 index 00000000000..345aac70830 --- /dev/null +++ b/queue-4.16/cdrom-information-leak-in-cdrom_ioctl_media_changed.patch @@ -0,0 +1,36 @@ +From 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 18 Apr 2018 12:51:31 +0300 +Subject: cdrom: information leak in cdrom_ioctl_media_changed() + +From: Dan Carpenter + +commit 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707 upstream. + +This cast is wrong. "cdi->capacity" is an int and "arg" is an unsigned +long. The way the check is written now, if one of the high 32 bits is +set then we could read outside the info->slots[] array. + +This bug is pretty old and it predates git. + +Reviewed-by: Christoph Hellwig +Cc: stable@vger.kernel.org +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/cdrom/cdrom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(str + if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT) + return media_changed(cdi, 1); + +- if ((unsigned int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + + info = kmalloc(sizeof(*info), GFP_KERNEL); diff --git a/queue-4.16/commoncap-handle-memory-allocation-failure.patch b/queue-4.16/commoncap-handle-memory-allocation-failure.patch new file mode 100644 index 00000000000..281fadcf309 --- /dev/null +++ b/queue-4.16/commoncap-handle-memory-allocation-failure.patch @@ -0,0 +1,39 @@ +From 1f5781725dcbb026438e77091c91a94f678c3522 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Tue, 10 Apr 2018 15:15:16 +0900 +Subject: commoncap: Handle memory allocation failure. + +From: Tetsuo Handa + +commit 1f5781725dcbb026438e77091c91a94f678c3522 upstream. + +syzbot is reporting NULL pointer dereference at xattr_getsecurity() [1], +for cap_inode_getsecurity() is returning sizeof(struct vfs_cap_data) when +memory allocation failed. Return -ENOMEM if memory allocation failed. + +[1] https://syzkaller.appspot.com/bug?id=a55ba438506fe68649a5f50d2d82d56b365e0107 + +Signed-off-by: Tetsuo Handa +Fixes: 8db6c34f1dbc8e06 ("Introduce v3 namespaced file capabilities") +Reported-by: syzbot +Cc: stable # 4.14+ +Acked-by: Serge E. Hallyn +Acked-by: James Morris +Signed-off-by: Eric W. Biederman +Signed-off-by: Greg Kroah-Hartman + +--- + security/commoncap.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode * + magic |= VFS_CAP_FLAGS_EFFECTIVE; + memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32); + cap->magic_etc = cpu_to_le32(magic); ++ } else { ++ size = -ENOMEM; + } + } + kfree(tmpbuf); diff --git a/queue-4.16/fsnotify-fix-fsnotify_mark_connector-race.patch b/queue-4.16/fsnotify-fix-fsnotify_mark_connector-race.patch new file mode 100644 index 00000000000..b2e64aa14bf --- /dev/null +++ b/queue-4.16/fsnotify-fix-fsnotify_mark_connector-race.patch @@ -0,0 +1,67 @@ +From d90a10e2444ba5a351fa695917258ff4c5709fa5 Mon Sep 17 00:00:00 2001 +From: Robert Kolchmeyer +Date: Thu, 19 Apr 2018 10:44:33 -0700 +Subject: fsnotify: Fix fsnotify_mark_connector race + +From: Robert Kolchmeyer + +commit d90a10e2444ba5a351fa695917258ff4c5709fa5 upstream. + +fsnotify() acquires a reference to a fsnotify_mark_connector through +the SRCU-protected pointer to_tell->i_fsnotify_marks. However, it +appears that no precautions are taken in fsnotify_put_mark() to +ensure that fsnotify() drops its reference to this +fsnotify_mark_connector before assigning a value to its 'destroy_next' +field. This can result in fsnotify_put_mark() assigning a value +to a connector's 'destroy_next' field right before fsnotify() tries to +traverse the linked list referenced by the connector's 'list' field. +Since these two fields are members of the same union, this behavior +results in a kernel panic. + +This issue is resolved by moving the connector's 'destroy_next' field +into the object pointer union. This should work since the object pointer +access is protected by both a spinlock and the value of the 'flags' +field, and the 'flags' field is cleared while holding the spinlock in +fsnotify_put_mark() before 'destroy_next' is updated. It shouldn't be +possible for another thread to accidentally read from the object pointer +after the 'destroy_next' field is updated. + +The offending behavior here is extremely unlikely; since +fsnotify_put_mark() removes references to a connector (specifically, +it ensures that the connector is unreachable from the inode it was +formerly attached to) before updating its 'destroy_next' field, a +sizeable chunk of code in fsnotify_put_mark() has to execute in the +short window between when fsnotify() acquires the connector reference +and saves the value of its 'list' field. On the HEAD kernel, I've only +been able to reproduce this by inserting a udelay(1) in fsnotify(). +However, I've been able to reproduce this issue without inserting a +udelay(1) anywhere on older unmodified release kernels, so I believe +it's worth fixing at HEAD. + +References: https://bugzilla.kernel.org/show_bug.cgi?id=199437 +Fixes: 08991e83b7286635167bab40927665a90fb00d81 +CC: stable@vger.kernel.org +Signed-off-by: Robert Kolchmeyer +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/fsnotify_backend.h | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/include/linux/fsnotify_backend.h ++++ b/include/linux/fsnotify_backend.h +@@ -217,12 +217,10 @@ struct fsnotify_mark_connector { + union { /* Object pointer [lock] */ + struct inode *inode; + struct vfsmount *mnt; +- }; +- union { +- struct hlist_head list; + /* Used listing heads to free after srcu period expires */ + struct fsnotify_mark_connector *destroy_next; + }; ++ struct hlist_head list; + }; + + /* diff --git a/queue-4.16/hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch b/queue-4.16/hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch new file mode 100644 index 00000000000..b3feee12944 --- /dev/null +++ b/queue-4.16/hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch @@ -0,0 +1,47 @@ +From 877d8948d0aa402fbbede138fc73432bb335b65f Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 24 Apr 2018 08:59:45 -0700 +Subject: hwmon: (k10temp) Add support for AMD Ryzen w/ Vega graphics +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +commit 877d8948d0aa402fbbede138fc73432bb335b65f upstream. + +Enable k10temp for AMD Ryzen APUs w/ Vega Mobile Gfx. + +Based on patch from René Rebe . Dropped temperature +offsets since those are not supposed to apply for the affected CPUs. + +Cc: stable@vger.kernel.org # v4.16+ +Cc: René Rebe +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k10temp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex); + #define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463 + #endif + ++#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB ++#define PCI_DEVICE_ID_AMD_17H_RR_NB 0x15d0 ++#endif ++ + /* CPUID function 0x80000001, ebx */ + #define CPUID_PKGTYPE_MASK 0xf0000000 + #define CPUID_PKGTYPE_F 0x00000000 +@@ -298,6 +302,7 @@ static const struct pci_device_id k10tem + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) }, + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) }, ++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) }, + {} + }; + MODULE_DEVICE_TABLE(pci, k10temp_id_table); diff --git a/queue-4.16/hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch b/queue-4.16/hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch new file mode 100644 index 00000000000..baba7559722 --- /dev/null +++ b/queue-4.16/hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch @@ -0,0 +1,66 @@ +From 1b59788979acd230b9627276c76f6e6ba2c4709c Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 24 Apr 2018 06:55:55 -0700 +Subject: hwmon: (k10temp) Add temperature offset for Ryzen 2700X + +From: Guenter Roeck + +commit 1b59788979acd230b9627276c76f6e6ba2c4709c upstream. + +Ryzen 2700X has a temperature offset of 10 degrees C. If bit 19 of the +Temperature Control register is set, there is an additional offset of +49 degrees C. Take this into account as well. + +Cc: stable@vger.kernel.org # v4.16+ +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwmon/k10temp.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/hwmon/k10temp.c ++++ b/drivers/hwmon/k10temp.c +@@ -72,6 +72,7 @@ struct k10temp_data { + struct pci_dev *pdev; + void (*read_tempreg)(struct pci_dev *pdev, u32 *regval); + int temp_offset; ++ u32 temp_adjust_mask; + }; + + struct tctl_offset { +@@ -84,6 +85,7 @@ static const struct tctl_offset tctl_off + { 0x17, "AMD Ryzen 5 1600X", 20000 }, + { 0x17, "AMD Ryzen 7 1700X", 20000 }, + { 0x17, "AMD Ryzen 7 1800X", 20000 }, ++ { 0x17, "AMD Ryzen 7 2700X", 10000 }, + { 0x17, "AMD Ryzen Threadripper 1950X", 27000 }, + { 0x17, "AMD Ryzen Threadripper 1920X", 27000 }, + { 0x17, "AMD Ryzen Threadripper 1900X", 27000 }, +@@ -129,6 +131,8 @@ static ssize_t temp1_input_show(struct d + + data->read_tempreg(data->pdev, ®val); + temp = (regval >> 21) * 125; ++ if (regval & data->temp_adjust_mask) ++ temp -= 49000; + if (temp > data->temp_offset) + temp -= data->temp_offset; + else +@@ -259,12 +263,14 @@ static int k10temp_probe(struct pci_dev + data->pdev = pdev; + + if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 || +- boot_cpu_data.x86_model == 0x70)) ++ boot_cpu_data.x86_model == 0x70)) { + data->read_tempreg = read_tempreg_nb_f15; +- else if (boot_cpu_data.x86 == 0x17) ++ } else if (boot_cpu_data.x86 == 0x17) { ++ data->temp_adjust_mask = 0x80000; + data->read_tempreg = read_tempreg_nb_f17; +- else ++ } else { + data->read_tempreg = read_tempreg_pci; ++ } + + for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) { + const struct tctl_offset *entry = &tctl_offset_table[i]; diff --git a/queue-4.16/kprobes-fix-random-address-output-of-blacklist-file.patch b/queue-4.16/kprobes-fix-random-address-output-of-blacklist-file.patch new file mode 100644 index 00000000000..8bd710b78c5 --- /dev/null +++ b/queue-4.16/kprobes-fix-random-address-output-of-blacklist-file.patch @@ -0,0 +1,68 @@ +From bcbd385b61bbdef3491d662203ac2e8186e5be59 Mon Sep 17 00:00:00 2001 +From: Thomas Richter +Date: Thu, 19 Apr 2018 12:55:56 +0200 +Subject: kprobes: Fix random address output of blacklist file + +From: Thomas Richter + +commit bcbd385b61bbdef3491d662203ac2e8186e5be59 upstream. + +File /sys/kernel/debug/kprobes/blacklist displays random addresses: + +[root@s8360046 linux]# cat /sys/kernel/debug/kprobes/blacklist +0x0000000047149a90-0x00000000bfcb099a print_type_x8 +.... + +This breaks 'perf probe' which uses the blacklist file to prohibit +probes on certain functions by checking the address range. + +Fix this by printing the correct (unhashed) address. + +The file mode is read all but this is not an issue as the file +hierarchy points out: + # ls -ld /sys/ /sys/kernel/ /sys/kernel/debug/ /sys/kernel/debug/kprobes/ + /sys/kernel/debug/kprobes/blacklist +dr-xr-xr-x 12 root root 0 Apr 19 07:56 /sys/ +drwxr-xr-x 8 root root 0 Apr 19 07:56 /sys/kernel/ +drwx------ 16 root root 0 Apr 19 06:56 /sys/kernel/debug/ +drwxr-xr-x 2 root root 0 Apr 19 06:56 /sys/kernel/debug/kprobes/ +-r--r--r-- 1 root root 0 Apr 19 06:56 /sys/kernel/debug/kprobes/blacklist + +Everything in and below /sys/kernel/debug is rwx to root only, +no group or others have access. + +Background: +Directory /sys/kernel/debug/kprobes is created by debugfs_create_dir() +which sets the mode bits to rwxr-xr-x. Maybe change that to use the +parent's directory mode bits instead? + +Link: http://lkml.kernel.org/r/20180419105556.86664-1-tmricht@linux.ibm.com + +Fixes: ad67b74d2469 ("printk: hash addresses printed with %p") +Cc: stable@vger.kernel.org +Cc: # v4.15+ +Cc: Ananth N Mavinakayanahalli +Cc: Anil S Keshavamurthy +Cc: David S Miller +Cc: Masami Hiramatsu +Cc: acme@kernel.org + +Signed-off-by: Thomas Richter +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/kprobes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(str + struct kprobe_blacklist_entry *ent = + list_entry(v, struct kprobe_blacklist_entry, list); + +- seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr, ++ seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr, + (void *)ent->end_addr, (void *)ent->start_addr); + return 0; + } diff --git a/queue-4.16/m68k-mac-don-t-remap-swim-mmio-region.patch b/queue-4.16/m68k-mac-don-t-remap-swim-mmio-region.patch new file mode 100644 index 00000000000..d5055150755 --- /dev/null +++ b/queue-4.16/m68k-mac-don-t-remap-swim-mmio-region.patch @@ -0,0 +1,157 @@ +From b64576cbf36afa5fabf3b31f62a1994c429ef855 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Wed, 11 Apr 2018 20:50:14 -0400 +Subject: m68k/mac: Don't remap SWIM MMIO region + +From: Finn Thain + +commit b64576cbf36afa5fabf3b31f62a1994c429ef855 upstream. + +For reasons I don't understand, calling ioremap() then iounmap() on +the SWIM MMIO region causes a hang on 68030 (but not on 68040). + +~# modprobe swim_mod +SWIM floppy driver Version 0.2 (2008-10-30) +SWIM device not found ! +watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [modprobe:285] +Modules linked in: swim_mod(+) +Format 00 Vector: 0064 PC: 000075aa Status: 2000 Not tainted +ORIG_D0: ffffffff D0: d00c0000 A2: 007c2370 A1: 003f810c +A0: 00040000 D5: d0096800 D4: d0097e00 +D3: 00000001 D2: 00000003 D1: 00000000 +Non-Maskable Interrupt +Modules linked in: swim_mod(+) +PC: [<000075ba>] __iounmap+0x24/0x10e +SR: 2000 SP: 007abc48 a2: 007c2370 +d0: d00c0000 d1: 000001a0 d2: 00000019 d3: 00000001 +d4: d0097e00 d5: d0096800 a0: 00040000 a1: 003f810c +Process modprobe (pid: 285, task=007c2370) +Frame format=0 +Stack from 007abc7c: + ffffffed 00000000 006a4060 004712e0 007abca0 000076ea d0080000 00080000 + 010bb4b8 007abcd8 010ba542 d0096000 00000000 00000000 00000001 010bb59c + 00000000 007abf30 010bb4b8 0047760a 0047763c 00477612 00616540 007abcec + 0020a91a 00477600 0047760a 010bb4cc 007abd18 002092f2 0047760a 00333b06 + 007abd5c 00000000 0047760a 010bb4cc 00404f90 004776b8 00000001 007abd38 + 00209446 010bb4cc 0047760a 010bb4cc 0020938e 0031f8be 00616540 007abd64 +Call Trace: [<000076ea>] iounmap+0x46/0x5a + [<00080000>] shrink_page_list+0x7f6/0xe06 + [<010ba542>] swim_probe+0xe4/0x496 [swim_mod] + [<0020a91a>] platform_drv_probe+0x20/0x5e + [<002092f2>] driver_probe_device+0x21c/0x2b8 + [<00333b06>] mutex_lock+0x0/0x2e + [<00209446>] __driver_attach+0xb8/0xce + [<0020938e>] __driver_attach+0x0/0xce + [<0031f8be>] klist_next+0x0/0xa0 + [<00207562>] bus_for_each_dev+0x74/0xba + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<00333b06>] mutex_lock+0x0/0x2e + [<00208e44>] driver_attach+0x1a/0x1e + [<0020938e>] __driver_attach+0x0/0xce + [<00207e26>] bus_add_driver+0x188/0x234 + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<00209894>] driver_register+0x58/0x104 + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<010bd000>] swim_init+0x0/0x2c [swim_mod] + [<0020a7be>] __platform_driver_register+0x38/0x3c + [<010bd028>] swim_init+0x28/0x2c [swim_mod] + [<000020dc>] do_one_initcall+0x38/0x196 + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<003331cc>] mutex_unlock+0x0/0x3e + [<00333b06>] mutex_lock+0x0/0x2e + [<003331cc>] mutex_unlock+0x0/0x3e + [<00333b06>] mutex_lock+0x0/0x2e + [<003331cc>] mutex_unlock+0x0/0x3e + [<00333b06>] mutex_lock+0x0/0x2e + [<003331cc>] mutex_unlock+0x0/0x3e + [<00333b06>] mutex_lock+0x0/0x2e + [<00075008>] __free_pages+0x0/0x38 + [<000045c0>] mangle_kernel_stack+0x30/0xda + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<003331cc>] mutex_unlock+0x0/0x3e + [<00333b06>] mutex_lock+0x0/0x2e + [<0005ced4>] do_init_module+0x42/0x266 + [<010bd000>] swim_init+0x0/0x2c [swim_mod] + [<000344c0>] blocking_notifier_call_chain+0x0/0x20 + [<0005eda0>] load_module+0x1a30/0x1e70 + [<0000465d>] mangle_kernel_stack+0xcd/0xda + [<00331c64>] __generic_copy_from_user+0x0/0x46 + [<0033256e>] _cond_resched+0x0/0x32 + [<00331b9c>] memset+0x0/0x98 + [<0033256e>] _cond_resched+0x0/0x32 + [<0005f25c>] SyS_init_module+0x7c/0x112 + [<00002000>] _start+0x0/0x8 + [<00002000>] _start+0x0/0x8 + [<00331c82>] __generic_copy_from_user+0x1e/0x46 + [<0005f2b2>] SyS_init_module+0xd2/0x112 + [<0000465d>] mangle_kernel_stack+0xcd/0xda + [<00002b40>] syscall+0x8/0xc + [<0000465d>] mangle_kernel_stack+0xcd/0xda + [<0008c00c>] pcpu_balance_workfn+0xb2/0x40e +Code: 2200 7419 e4a9 e589 2841 d9fc 0000 1000 <2414> 7203 c282 7602 b681 6600 0096 0242 fe00 0482 0000 0000 e9c0 11c3 ed89 2642 + +There's no need to call ioremap() for the SWIM address range, as it lies +within the usual IO device region at 0x5000 0000, which has already been +mapped by head.S. + +Remove the redundant ioremap() and iounmap() calls to fix the hang. + +Cc: Laurent Vivier +Cc: stable@vger.kernel.org # v4.14+ +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Acked-by: Laurent Vivier +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/swim.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -911,7 +911,7 @@ static int swim_probe(struct platform_de + goto out; + } + +- swim_base = ioremap(res->start, resource_size(res)); ++ swim_base = (struct swim __iomem *)res->start; + if (!swim_base) { + ret = -ENOMEM; + goto out_release_io; +@@ -923,7 +923,7 @@ static int swim_probe(struct platform_de + if (!get_swim_mode(swim_base)) { + printk(KERN_INFO "SWIM device not found !\n"); + ret = -ENODEV; +- goto out_iounmap; ++ goto out_release_io; + } + + /* set platform driver data */ +@@ -931,7 +931,7 @@ static int swim_probe(struct platform_de + swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL); + if (!swd) { + ret = -ENOMEM; +- goto out_iounmap; ++ goto out_release_io; + } + platform_set_drvdata(dev, swd); + +@@ -945,8 +945,6 @@ static int swim_probe(struct platform_de + + out_kfree: + kfree(swd); +-out_iounmap: +- iounmap(swim_base); + out_release_io: + release_mem_region(res->start, resource_size(res)); + out: +@@ -974,8 +972,6 @@ static int swim_remove(struct platform_d + for (drive = 0; drive < swd->floppy_count; drive++) + floppy_eject(&swd->unit[drive]); + +- iounmap(swd->base); +- + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (res) + release_mem_region(res->start, resource_size(res)); diff --git a/queue-4.16/revert-mm-hmm-fix-header-file-if-else-endif-maze.patch b/queue-4.16/revert-mm-hmm-fix-header-file-if-else-endif-maze.patch new file mode 100644 index 00000000000..3b075b7bc10 --- /dev/null +++ b/queue-4.16/revert-mm-hmm-fix-header-file-if-else-endif-maze.patch @@ -0,0 +1,60 @@ +From 6c0675331b010daf06d60c889b5765e81ef7b40e Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Fri, 27 Apr 2018 13:49:00 +0200 +Subject: Revert "mm/hmm: fix header file if/else/endif maze" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Kroah-Hartman + +This reverts commit 25df8b83e867dcfb660123e9589ebf6f094fcdd3 which is +commit b28b08de436a638c82d0cf3dcdbdbad055baf1fc upstream. + +There are still build errors with this patch applied, and the upstream +patches do not seem to apply anymore, so reverting this patch seems like +the best thing to do at this point in time. + +Reported-by: Randy Dunlap +Cc: Arnd Bergmann +Cc: Михаил Носов +Cc: Jérôme Glisse +Cc: Balbir Singh +Cc: Andrew Morton +Cc: Ralph Campbell +Cc: John Hubbard +Cc: Evgeny Baskakov +Cc: Andrew Morton +Cc: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/hmm.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/include/linux/hmm.h ++++ b/include/linux/hmm.h +@@ -498,16 +498,23 @@ struct hmm_device { + struct hmm_device *hmm_device_new(void *drvdata); + void hmm_device_put(struct hmm_device *hmm_device); + #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */ ++#endif /* IS_ENABLED(CONFIG_HMM) */ + + /* Below are for HMM internal use only! Not to be used by device driver! */ ++#if IS_ENABLED(CONFIG_HMM_MIRROR) + void hmm_mm_destroy(struct mm_struct *mm); + + static inline void hmm_mm_init(struct mm_struct *mm) + { + mm->hmm = NULL; + } ++#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */ ++static inline void hmm_mm_destroy(struct mm_struct *mm) {} ++static inline void hmm_mm_init(struct mm_struct *mm) {} ++#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */ ++ ++ + #else /* IS_ENABLED(CONFIG_HMM) */ + static inline void hmm_mm_destroy(struct mm_struct *mm) {} + static inline void hmm_mm_init(struct mm_struct *mm) {} +-#endif /* IS_ENABLED(CONFIG_HMM) */ + #endif /* LINUX_HMM_H */ diff --git a/queue-4.16/s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch b/queue-4.16/s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch new file mode 100644 index 00000000000..f507728f3b5 --- /dev/null +++ b/queue-4.16/s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch @@ -0,0 +1,56 @@ +From af2e460ade0b0180d0f3812ca4f4f59cc9597f3e Mon Sep 17 00:00:00 2001 +From: Sebastian Ott +Date: Wed, 11 Apr 2018 11:21:17 +0200 +Subject: s390/cio: update chpid descriptor after resource accessibility event + +From: Sebastian Ott + +commit af2e460ade0b0180d0f3812ca4f4f59cc9597f3e upstream. + +Channel path descriptors have been seen as something stable (as +long as the chpid is configured). Recent tests have shown that the +descriptor can also be altered when the link state of a channel path +changes. Thus it is necessary to update the descriptor during +handling of resource accessibility events. + +Cc: +Signed-off-by: Sebastian Ott +Reviewed-by: Peter Oberparleiter +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/cio/chsc.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/s390/cio/chsc.c ++++ b/drivers/s390/cio/chsc.c +@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incide + + static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area) + { ++ struct channel_path *chp; + struct chp_link link; + struct chp_id chpid; + int status; +@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(str + chpid.id = sei_area->rsid; + /* allocate a new channel path structure, if needed */ + status = chp_get_status(chpid); +- if (status < 0) +- chp_new(chpid); +- else if (!status) ++ if (!status) + return; ++ ++ if (status < 0) { ++ chp_new(chpid); ++ } else { ++ chp = chpid_to_chp(chpid); ++ mutex_lock(&chp->lock); ++ chp_update_desc(chp); ++ mutex_unlock(&chp->lock); ++ } + memset(&link, 0, sizeof(struct chp_link)); + link.chpid = chpid; + if ((sei_area->vf & 0xc0) != 0) { diff --git a/queue-4.16/s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch b/queue-4.16/s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch new file mode 100644 index 00000000000..d5138aaef22 --- /dev/null +++ b/queue-4.16/s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch @@ -0,0 +1,64 @@ +From 5f3ba878e7a2ffef82fb0882c0dd2c3507d734bc Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andr=C3=A9=20Wild?= +Date: Wed, 18 Apr 2018 17:59:58 +0200 +Subject: s390/cpum_cf: rename IBM z13/z14 counter names +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: André Wild + +commit 5f3ba878e7a2ffef82fb0882c0dd2c3507d734bc upstream. + +Change the IBM z13/z14 counter names to be in sync with all other models. + +Cc: stable@vger.kernel.org # v4.12+ +Fixes: 3593eb944c ("s390/cpum_cf: add hardware counter support for IBM z14") +Fixes: 3fc7acebae ("s390/cpum_cf: add IBM z13 counter event names") +Signed-off-by: André Wild +Signed-off-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/perf_cpum_cf_events.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/s390/kernel/perf_cpum_cf_events.c ++++ b/arch/s390/kernel/perf_cpum_cf_events.c +@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L + CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1); + CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2); + CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3); +-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080); ++CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080); + CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081); + CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082); + CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083); +@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_ + CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc); + CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0); + CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1); +-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080); ++CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080); + CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081); + CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082); + CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083); +@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pm + }; + + static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = { +- CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL), ++ CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES), + CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES), + CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES), + CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES), +@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_ + }; + + static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = { +- CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL), ++ CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES), + CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES), + CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES), + CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES), diff --git a/queue-4.16/s390-dasd-fix-io-error-for-newly-defined-devices.patch b/queue-4.16/s390-dasd-fix-io-error-for-newly-defined-devices.patch new file mode 100644 index 00000000000..ce0b7cda680 --- /dev/null +++ b/queue-4.16/s390-dasd-fix-io-error-for-newly-defined-devices.patch @@ -0,0 +1,81 @@ +From 5d27a2bf6e14f5c7d1033ad1e993fcd0eba43e83 Mon Sep 17 00:00:00 2001 +From: Stefan Haberland +Date: Thu, 12 Apr 2018 13:38:22 +0200 +Subject: s390/dasd: fix IO error for newly defined devices + +From: Stefan Haberland + +commit 5d27a2bf6e14f5c7d1033ad1e993fcd0eba43e83 upstream. + +When a new CKD storage volume is defined at the storage server, Linux +may be relying on outdated information about that volume, which leads to +the following errors: + +1. Command Reject Errors for minidisk on z/VM: + +dasd-eckd.b3193d: 0.0.XXXX: An error occurred in the DASD device driver, + reason=09 +dasd(eckd): I/O status report for device 0.0.XXXX: +dasd(eckd): in req: 00000000XXXXXXXX CC:00 FC:04 AC:00 SC:17 DS:02 CS:00 + RC:0 +dasd(eckd): device 0.0.2046: Failing CCW: 00000000XXXXXXXX +dasd(eckd): Sense(hex) 0- 7: 80 00 00 00 00 00 00 00 +dasd(eckd): Sense(hex) 8-15: 00 00 00 00 00 00 00 00 +dasd(eckd): Sense(hex) 16-23: 00 00 00 00 e1 00 0f 00 +dasd(eckd): Sense(hex) 24-31: 00 00 40 e2 00 00 00 00 +dasd(eckd): 24 Byte: 0 MSG 0, no MSGb to SYSOP + +2. Equipment Check errors on LPAR or for dedicated devices on z/VM: + +dasd(eckd): I/O status report for device 0.0.XXXX: +dasd(eckd): in req: 00000000XXXXXXXX CC:00 FC:04 AC:00 SC:17 DS:0E CS:40 + fcxs:01 schxs:00 RC:0 +dasd(eckd): device 0.0.9713: Failing TCW: 00000000XXXXXXXX +dasd(eckd): Sense(hex) 0- 7: 10 00 00 00 13 58 4d 0f +dasd(eckd): Sense(hex) 8-15: 67 00 00 00 00 00 00 04 +dasd(eckd): Sense(hex) 16-23: e5 18 05 33 97 01 0f 0f +dasd(eckd): Sense(hex) 24-31: 00 00 40 e2 00 04 58 0d +dasd(eckd): 24 Byte: 0 MSG f, no MSGb to SYSOP + +Fix this problem by using the up-to-date information provided during +online processing via the device specific SNEQ to detect the case of +outdated LCU data. If there is a difference, perform a re-read of that +data. + +Cc: stable@vger.kernel.org +Reviewed-by: Jan Hoeppner +Signed-off-by: Stefan Haberland +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/block/dasd_alias.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct a + int dasd_alias_add_device(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; +- struct alias_lcu *lcu; ++ __u8 uaddr = private->uid.real_unit_addr; ++ struct alias_lcu *lcu = private->lcu; + unsigned long flags; + int rc; + +- lcu = private->lcu; + rc = 0; + spin_lock_irqsave(&lcu->lock, flags); ++ /* ++ * Check if device and lcu type differ. If so, the uac data may be ++ * outdated and needs to be updated. ++ */ ++ if (private->uid.type != lcu->uac->unit[uaddr].ua_type) { ++ lcu->flags |= UPDATE_PENDING; ++ DBF_DEV_EVENT(DBF_WARNING, device, "%s", ++ "uid type mismatch - trigger rescan"); ++ } + if (!(lcu->flags & UPDATE_PENDING)) { + rc = _add_device_to_lcu(lcu, device, device); + if (rc) diff --git a/queue-4.16/s390-uprobes-implement-arch_uretprobe_is_alive.patch b/queue-4.16/s390-uprobes-implement-arch_uretprobe_is_alive.patch new file mode 100644 index 00000000000..2b06c072869 --- /dev/null +++ b/queue-4.16/s390-uprobes-implement-arch_uretprobe_is_alive.patch @@ -0,0 +1,46 @@ +From 783c3b53b9506db3e05daacfe34e0287eebb09d8 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Mon, 16 Apr 2018 12:22:24 +0200 +Subject: s390/uprobes: implement arch_uretprobe_is_alive() + +From: Heiko Carstens + +commit 783c3b53b9506db3e05daacfe34e0287eebb09d8 upstream. + +Implement s390 specific arch_uretprobe_is_alive() to avoid SIGSEGVs +observed with uretprobes in combination with setjmp/longjmp. + +See commit 2dea1d9c38e4 ("powerpc/uprobes: Implement +arch_uretprobe_is_alive()") for more details. + +With this implemented all test cases referenced in the above commit +pass. + +Reported-by: Ziqian SUN +Cc: # v4.3+ +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/kernel/uprobes.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/s390/kernel/uprobes.c ++++ b/arch/s390/kernel/uprobes.c +@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_retu + return orig; + } + ++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx, ++ struct pt_regs *regs) ++{ ++ if (ctx == RP_CHECK_CHAIN_CALL) ++ return user_stack_pointer(regs) <= ret->stack; ++ else ++ return user_stack_pointer(regs) < ret->stack; ++} ++ + /* Instruction Emulation */ + + static void adjust_psw_addr(psw_t *psw, unsigned long len) diff --git a/queue-4.16/scsi-mptsas-disable-write-same.patch b/queue-4.16/scsi-mptsas-disable-write-same.patch new file mode 100644 index 00000000000..dc6a51393bc --- /dev/null +++ b/queue-4.16/scsi-mptsas-disable-write-same.patch @@ -0,0 +1,31 @@ +From 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 Mon Sep 17 00:00:00 2001 +From: "Martin K. Petersen" +Date: Wed, 18 Apr 2018 22:54:59 -0400 +Subject: scsi: mptsas: Disable WRITE SAME + +From: Martin K. Petersen + +commit 94e5395d2403c8bc2504a7cbe4c4caaacb7b8b84 upstream. + +First generation MPT Fusion controllers can not translate WRITE SAME +when the attached device is a SATA drive. Disable WRITE SAME support. + +Reported-by: Nikola Ciprich +Cc: +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/message/fusion/mptsas.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/message/fusion/mptsas.c ++++ b/drivers/message/fusion/mptsas.c +@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_ + .cmd_per_lun = 7, + .use_clustering = ENABLE_CLUSTERING, + .shost_attrs = mptscsih_host_attrs, ++ .no_write_same = 1, + }; + + static int mptsas_get_linkerrors(struct sas_phy *phy) diff --git a/queue-4.16/series b/queue-4.16/series index b7ff630b241..6cf6e12ba64 100644 --- a/queue-4.16/series +++ b/queue-4.16/series @@ -57,3 +57,25 @@ tun-fix-vlan-packet-truncation.patch net-aquantia-oops-when-shutdown-on-already-stopped-device.patch virtio_net-split-out-ctrl-buffer.patch virtio_net-fix-adding-vids-on-big-endian.patch +revert-mm-hmm-fix-header-file-if-else-endif-maze.patch +commoncap-handle-memory-allocation-failure.patch +scsi-mptsas-disable-write-same.patch +cdrom-information-leak-in-cdrom_ioctl_media_changed.patch +fsnotify-fix-fsnotify_mark_connector-race.patch +m68k-mac-don-t-remap-swim-mmio-region.patch +block-swim-check-drive-type.patch +block-swim-don-t-log-an-error-message-for-an-invalid-ioctl.patch +block-swim-remove-extra-put_disk-call-from-error-path.patch +block-swim-rename-macros-to-avoid-inconsistent-inverted-logic.patch +block-swim-select-appropriate-drive-on-device-open.patch +block-swim-fix-array-bounds-check.patch +block-swim-fix-io-error-at-end-of-medium.patch +tracing-fix-missing-tab-for-hwlat_detector-print-format.patch +hwmon-k10temp-add-temperature-offset-for-ryzen-2700x.patch +hwmon-k10temp-add-support-for-amd-ryzen-w-vega-graphics.patch +s390-cio-update-chpid-descriptor-after-resource-accessibility-event.patch +s390-dasd-fix-io-error-for-newly-defined-devices.patch +s390-uprobes-implement-arch_uretprobe_is_alive.patch +s390-cpum_cf-rename-ibm-z13-z14-counter-names.patch +kprobes-fix-random-address-output-of-blacklist-file.patch +acpi-video-only-default-only_lcd-to-true-on-win8-ready-_desktops_.patch diff --git a/queue-4.16/tracing-fix-missing-tab-for-hwlat_detector-print-format.patch b/queue-4.16/tracing-fix-missing-tab-for-hwlat_detector-print-format.patch new file mode 100644 index 00000000000..88f9e189229 --- /dev/null +++ b/queue-4.16/tracing-fix-missing-tab-for-hwlat_detector-print-format.patch @@ -0,0 +1,35 @@ +From 9a0fd675304d410f3a9586e1b333e16f4658d56c Mon Sep 17 00:00:00 2001 +From: Peter Xu +Date: Thu, 15 Mar 2018 14:06:39 +0800 +Subject: tracing: Fix missing tab for hwlat_detector print format + +From: Peter Xu + +commit 9a0fd675304d410f3a9586e1b333e16f4658d56c upstream. + +It's been missing for a while but no one is touching that up. Fix it. + +Link: http://lkml.kernel.org/r/20180315060639.9578-1-peterx@redhat.com + +CC: Ingo Molnar +Cc:stable@vger.kernel.org +Fixes: 7b2c86250122d ("tracing: Add NMI tracing in hwlat detector") +Signed-off-by: Peter Xu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/trace/trace_entries.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/trace/trace_entries.h ++++ b/kernel/trace/trace_entries.h +@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry, + __field( unsigned int, seqnum ) + ), + +- F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n", ++ F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n", + __entry->seqnum, + __entry->tv_sec, + __entry->tv_nsec,