From: Greg Kroah-Hartman Date: Fri, 6 Dec 2013 18:46:16 +0000 (-0800) Subject: 3.10-stable patches X-Git-Tag: v3.4.73~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=95cc0ab9634de84693a1e13600caad67d85c2bd3;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: elevator-acquire-q-sysfs_lock-in-elevator_change.patch elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch ntp-make-periodic-rtc-update-more-reliable.patch video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch --- diff --git a/queue-3.10/elevator-acquire-q-sysfs_lock-in-elevator_change.patch b/queue-3.10/elevator-acquire-q-sysfs_lock-in-elevator_change.patch new file mode 100644 index 00000000000..875a0e374b1 --- /dev/null +++ b/queue-3.10/elevator-acquire-q-sysfs_lock-in-elevator_change.patch @@ -0,0 +1,63 @@ +From 7c8a3679e3d8e9d92d58f282161760a0e247df97 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Tue, 15 Oct 2013 16:42:19 -0600 +Subject: elevator: acquire q->sysfs_lock in elevator_change() + +From: Tomoki Sekiyama + +commit 7c8a3679e3d8e9d92d58f282161760a0e247df97 upstream. + +Add locking of q->sysfs_lock into elevator_change() (an exported function) +to ensure it is held to protect q->elevator from elevator_init(), even if +elevator_change() is called from non-sysfs paths. +sysfs path (elv_iosched_store) uses __elevator_change(), non-locking +version, as the lock is already taken by elv_iosched_store(). + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Jens Axboe +Cc: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + block/elevator.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -965,7 +965,7 @@ fail_init: + /* + * Switch this queue to the given IO scheduler. + */ +-int elevator_change(struct request_queue *q, const char *name) ++static int __elevator_change(struct request_queue *q, const char *name) + { + char elevator_name[ELV_NAME_MAX]; + struct elevator_type *e; +@@ -987,6 +987,18 @@ int elevator_change(struct request_queue + + return elevator_switch(q, e); + } ++ ++int elevator_change(struct request_queue *q, const char *name) ++{ ++ int ret; ++ ++ /* Protect q->elevator from elevator_init() */ ++ mutex_lock(&q->sysfs_lock); ++ ret = __elevator_change(q, name); ++ mutex_unlock(&q->sysfs_lock); ++ ++ return ret; ++} + EXPORT_SYMBOL(elevator_change); + + ssize_t elv_iosched_store(struct request_queue *q, const char *name, +@@ -997,7 +1009,7 @@ ssize_t elv_iosched_store(struct request + if (!q->elevator) + return count; + +- ret = elevator_change(q, name); ++ ret = __elevator_change(q, name); + if (!ret) + return count; + diff --git a/queue-3.10/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch b/queue-3.10/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch new file mode 100644 index 00000000000..ebca35d75c8 --- /dev/null +++ b/queue-3.10/elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch @@ -0,0 +1,102 @@ +From eb1c160b22655fd4ec44be732d6594fd1b1e44f4 Mon Sep 17 00:00:00 2001 +From: Tomoki Sekiyama +Date: Tue, 15 Oct 2013 16:42:16 -0600 +Subject: elevator: Fix a race in elevator switching and md device initialization + +From: Tomoki Sekiyama + +commit eb1c160b22655fd4ec44be732d6594fd1b1e44f4 upstream. + +The soft lockup below happens at the boot time of the system using dm +multipath and the udev rules to switch scheduler. + +[ 356.127001] BUG: soft lockup - CPU#3 stuck for 22s! [sh:483] +[ 356.127001] RIP: 0010:[] [] lock_timer_base.isra.35+0x1d/0x50 +... +[ 356.127001] Call Trace: +[ 356.127001] [] try_to_del_timer_sync+0x20/0x70 +[ 356.127001] [] ? kmem_cache_alloc_node_trace+0x20a/0x230 +[ 356.127001] [] del_timer_sync+0x52/0x60 +[ 356.127001] [] cfq_exit_queue+0x32/0xf0 +[ 356.127001] [] elevator_exit+0x2f/0x50 +[ 356.127001] [] elevator_change+0xf1/0x1c0 +[ 356.127001] [] elv_iosched_store+0x20/0x50 +[ 356.127001] [] queue_attr_store+0x59/0xb0 +[ 356.127001] [] sysfs_write_file+0xc6/0x140 +[ 356.127001] [] vfs_write+0xbd/0x1e0 +[ 356.127001] [] SyS_write+0x49/0xa0 +[ 356.127001] [] system_call_fastpath+0x16/0x1b + +This is caused by a race between md device initialization by multipathd and +shell script to switch the scheduler using sysfs. + + - multipathd: + SyS_ioctl -> do_vfs_ioctl -> dm_ctl_ioctl -> ctl_ioctl -> table_load + -> dm_setup_md_queue -> blk_init_allocated_queue -> elevator_init + q->elevator = elevator_alloc(q, e); // not yet initialized + + - sh -c 'echo deadline > /sys/$DEVPATH/queue/scheduler': + elevator_switch (in the call trace above) + struct elevator_queue *old = q->elevator; + q->elevator = elevator_alloc(q, new_e); + elevator_exit(old); // lockup! (*) + + - multipathd: (cont.) + err = e->ops.elevator_init_fn(q); // init fails; q->elevator is modified + +(*) When del_timer_sync() is called, lock_timer_base() will loop infinitely +while timer->base == NULL. In this case, as timer will never initialized, +it results in lockup. + +This patch introduces acquisition of q->sysfs_lock around elevator_init() +into blk_init_allocated_queue(), to provide mutual exclusion between +initialization of the q->scheduler and switching of the scheduler. + +This should fix this bugzilla: +https://bugzilla.redhat.com/show_bug.cgi?id=902012 + +Signed-off-by: Tomoki Sekiyama +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-core.c | 10 +++++++++- + block/elevator.c | 6 ++++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -741,9 +741,17 @@ blk_init_allocated_queue(struct request_ + + q->sg_reserved_size = INT_MAX; + ++ /* Protect q->elevator from elevator_change */ ++ mutex_lock(&q->sysfs_lock); ++ + /* init elevator */ +- if (elevator_init(q, NULL)) ++ if (elevator_init(q, NULL)) { ++ mutex_unlock(&q->sysfs_lock); + return NULL; ++ } ++ ++ mutex_unlock(&q->sysfs_lock); ++ + return q; + } + EXPORT_SYMBOL(blk_init_allocated_queue); +--- a/block/elevator.c ++++ b/block/elevator.c +@@ -186,6 +186,12 @@ int elevator_init(struct request_queue * + struct elevator_type *e = NULL; + int err; + ++ /* ++ * q->sysfs_lock must be held to provide mutual exclusion between ++ * elevator_switch() and here. ++ */ ++ lockdep_assert_held(&q->sysfs_lock); ++ + if (unlikely(q->elevator)) + return 0; + diff --git a/queue-3.10/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch b/queue-3.10/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch new file mode 100644 index 00000000000..042dca986ef --- /dev/null +++ b/queue-3.10/hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch @@ -0,0 +1,102 @@ +From 348cbaa800f8161168b20f85f72abb541c145132 Mon Sep 17 00:00:00 2001 +From: Simon Wood +Date: Thu, 10 Oct 2013 08:20:13 -0600 +Subject: HID: lg: fix Report Descriptor for Logitech MOMO Force (Black) + +From: Simon Wood + +commit 348cbaa800f8161168b20f85f72abb541c145132 upstream. + +By default the Logitech MOMO Force (Black) presents a combined accel/brake +axis ('Y'). This patch modifies the HID descriptor to present seperate +accel/brake axes ('Y' and 'Z'). + +Signed-off-by: Simon Wood +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-lg.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 58 insertions(+) + +--- a/drivers/hid/hid-lg.c ++++ b/drivers/hid/hid-lg.c +@@ -47,6 +47,7 @@ + #define DFP_RDESC_ORIG_SIZE 97 + #define FV_RDESC_ORIG_SIZE 130 + #define MOMO_RDESC_ORIG_SIZE 87 ++#define MOMO2_RDESC_ORIG_SIZE 87 + + /* Fixed report descriptors for Logitech Driving Force (and Pro) + * wheel controllers +@@ -284,6 +285,54 @@ static __u8 momo_rdesc_fixed[] = { + 0xC0 /* End Collection */ + }; + ++static __u8 momo2_rdesc_fixed[] = { ++0x05, 0x01, /* Usage Page (Desktop), */ ++0x09, 0x04, /* Usage (Joystik), */ ++0xA1, 0x01, /* Collection (Application), */ ++0xA1, 0x02, /* Collection (Logical), */ ++0x95, 0x01, /* Report Count (1), */ ++0x75, 0x0A, /* Report Size (10), */ ++0x15, 0x00, /* Logical Minimum (0), */ ++0x26, 0xFF, 0x03, /* Logical Maximum (1023), */ ++0x35, 0x00, /* Physical Minimum (0), */ ++0x46, 0xFF, 0x03, /* Physical Maximum (1023), */ ++0x09, 0x30, /* Usage (X), */ ++0x81, 0x02, /* Input (Variable), */ ++0x95, 0x0A, /* Report Count (10), */ ++0x75, 0x01, /* Report Size (1), */ ++0x25, 0x01, /* Logical Maximum (1), */ ++0x45, 0x01, /* Physical Maximum (1), */ ++0x05, 0x09, /* Usage Page (Button), */ ++0x19, 0x01, /* Usage Minimum (01h), */ ++0x29, 0x0A, /* Usage Maximum (0Ah), */ ++0x81, 0x02, /* Input (Variable), */ ++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ ++0x09, 0x00, /* Usage (00h), */ ++0x95, 0x04, /* Report Count (4), */ ++0x81, 0x02, /* Input (Variable), */ ++0x95, 0x01, /* Report Count (1), */ ++0x75, 0x08, /* Report Size (8), */ ++0x26, 0xFF, 0x00, /* Logical Maximum (255), */ ++0x46, 0xFF, 0x00, /* Physical Maximum (255), */ ++0x09, 0x01, /* Usage (01h), */ ++0x81, 0x02, /* Input (Variable), */ ++0x05, 0x01, /* Usage Page (Desktop), */ ++0x09, 0x31, /* Usage (Y), */ ++0x81, 0x02, /* Input (Variable), */ ++0x09, 0x32, /* Usage (Z), */ ++0x81, 0x02, /* Input (Variable), */ ++0x06, 0x00, 0xFF, /* Usage Page (FF00h), */ ++0x09, 0x00, /* Usage (00h), */ ++0x81, 0x02, /* Input (Variable), */ ++0xC0, /* End Collection, */ ++0xA1, 0x02, /* Collection (Logical), */ ++0x09, 0x02, /* Usage (02h), */ ++0x95, 0x07, /* Report Count (7), */ ++0x91, 0x02, /* Output (Variable), */ ++0xC0, /* End Collection, */ ++0xC0 /* End Collection */ ++}; ++ + /* + * Certain Logitech keyboards send in report #3 keys which are far + * above the logical maximum described in descriptor. This extends +@@ -343,6 +392,15 @@ static __u8 *lg_report_fixup(struct hid_ + } + break; + ++ case USB_DEVICE_ID_LOGITECH_MOMO_WHEEL2: ++ if (*rsize == MOMO2_RDESC_ORIG_SIZE) { ++ hid_info(hdev, ++ "fixing up Logitech Momo Racing Force (Black) report descriptor\n"); ++ rdesc = momo2_rdesc_fixed; ++ *rsize = sizeof(momo2_rdesc_fixed); ++ } ++ break; ++ + case USB_DEVICE_ID_LOGITECH_VIBRATION_WHEEL: + if (*rsize == FV_RDESC_ORIG_SIZE) { + hid_info(hdev, diff --git a/queue-3.10/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch b/queue-3.10/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch new file mode 100644 index 00000000000..6394b6177ed --- /dev/null +++ b/queue-3.10/iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch @@ -0,0 +1,52 @@ +From 05104a4e8713b27291c7bb49c1e7e68b4e243571 Mon Sep 17 00:00:00 2001 +From: Neil Horman +Date: Fri, 27 Sep 2013 12:53:35 -0400 +Subject: iommu: Remove stack trace from broken irq remapping warning + +From: Neil Horman + +commit 05104a4e8713b27291c7bb49c1e7e68b4e243571 upstream. + +The warning for the irq remapping broken check in intel_irq_remapping.c is +pretty pointless. We need the warning, but we know where its comming from, the +stack trace will always be the same, and it needlessly triggers things like +Abrt. This changes the warning to just print a text warning about BIOS being +broken, without the stack trace, then sets the appropriate taint bit. Since we +automatically disable irq remapping, theres no need to contiue making Abrt jump +at this problem + +Signed-off-by: Neil Horman +CC: Joerg Roedel +CC: Bjorn Helgaas +CC: Andy Lutomirski +CC: Konrad Rzeszutek Wilk +CC: Sebastian Andrzej Siewior +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel_irq_remapping.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/iommu/intel_irq_remapping.c ++++ b/drivers/iommu/intel_irq_remapping.c +@@ -525,12 +525,13 @@ static int __init intel_irq_remapping_su + if (disable_irq_remap) + return 0; + if (irq_remap_broken) { +- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND, +- "This system BIOS has enabled interrupt remapping\n" +- "on a chipset that contains an erratum making that\n" +- "feature unstable. To maintain system stability\n" +- "interrupt remapping is being disabled. Please\n" +- "contact your BIOS vendor for an update\n"); ++ printk(KERN_WARNING ++ "This system BIOS has enabled interrupt remapping\n" ++ "on a chipset that contains an erratum making that\n" ++ "feature unstable. To maintain system stability\n" ++ "interrupt remapping is being disabled. Please\n" ++ "contact your BIOS vendor for an update\n"); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + disable_irq_remap = 1; + return 0; + } diff --git a/queue-3.10/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch b/queue-3.10/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch new file mode 100644 index 00000000000..d6da600b34f --- /dev/null +++ b/queue-3.10/iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch @@ -0,0 +1,45 @@ +From f9423606ade08653dd8a43334f0a7fb45504c5cc Mon Sep 17 00:00:00 2001 +From: Julian Stecklina +Date: Wed, 9 Oct 2013 10:03:52 +0200 +Subject: iommu/vt-d: Fixed interaction of VFIO_IOMMU_MAP_DMA with IOMMU address limits + +From: Julian Stecklina + +commit f9423606ade08653dd8a43334f0a7fb45504c5cc upstream. + +The BUG_ON in drivers/iommu/intel-iommu.c:785 can be triggered from userspace via +VFIO by calling the VFIO_IOMMU_MAP_DMA ioctl on a vfio device with any address +beyond the addressing capabilities of the IOMMU. The problem is that the ioctl code +calls iommu_iova_to_phys before it calls iommu_map. iommu_map handles the case that +it gets addresses beyond the addressing capabilities of its IOMMU. +intel_iommu_iova_to_phys does not. + +This patch fixes iommu_iova_to_phys to return NULL for addresses beyond what the +IOMMU can handle. This in turn causes the ioctl call to fail in iommu_map and +(correctly) return EFAULT to the user with a helpful warning message in the kernel +log. + +Signed-off-by: Julian Stecklina +Acked-by: Alex Williamson +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/intel-iommu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -782,7 +782,11 @@ static struct dma_pte *pfn_to_dma_pte(st + int offset; + + BUG_ON(!domain->pgd); +- BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width); ++ ++ if (addr_width < BITS_PER_LONG && pfn >> addr_width) ++ /* Address beyond IOMMU's addressing capabilities. */ ++ return NULL; ++ + parent = domain->pgd; + + while (level > 0) { diff --git a/queue-3.10/ntp-make-periodic-rtc-update-more-reliable.patch b/queue-3.10/ntp-make-periodic-rtc-update-more-reliable.patch new file mode 100644 index 00000000000..55a35e3d25b --- /dev/null +++ b/queue-3.10/ntp-make-periodic-rtc-update-more-reliable.patch @@ -0,0 +1,46 @@ +From a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 Mon Sep 17 00:00:00 2001 +From: Miroslav Lichvar +Date: Thu, 1 Aug 2013 19:31:35 +0200 +Subject: ntp: Make periodic RTC update more reliable + +From: Miroslav Lichvar + +commit a97ad0c4b447a132a322cedc3a5f7fa4cab4b304 upstream. + +The current code requires that the scheduled update of the RTC happens +in the closest tick to the half of the second. This seems to be +difficult to achieve reliably. The scheduled work may be missing the +target time by a tick or two and be constantly rescheduled every second. + +Relax the limit to 10 ticks. As a typical RTC drifts in the 11-minute +update interval by several milliseconds, this shouldn't affect the +overall accuracy of the RTC much. + +Signed-off-by: Miroslav Lichvar +Signed-off-by: John Stultz +Cc: Josh Boyer +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/ntp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/ntp.c ++++ b/kernel/time/ntp.c +@@ -475,6 +475,7 @@ static void sync_cmos_clock(struct work_ + * called as close as possible to 500 ms before the new second starts. + * This code is run on a timer. If the clock is set, that timer + * may not expire at the correct time. Thus, we adjust... ++ * We want the clock to be within a couple of ticks from the target. + */ + if (!ntp_synced()) { + /* +@@ -485,7 +486,7 @@ static void sync_cmos_clock(struct work_ + } + + getnstimeofday(&now); +- if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec / 2) { ++ if (abs(now.tv_nsec - (NSEC_PER_SEC / 2)) <= tick_nsec * 5) { + struct timespec adjust = now; + + fail = -ENODEV; diff --git a/queue-3.10/series b/queue-3.10/series index 94ad18a3419..e668d0a556d 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -47,3 +47,10 @@ clockevents-add-module-refcount.patch clockevents-split-out-selection-logic.patch clockevents-prefer-cpu-local-devices-over-global-devices.patch mm-numa-return-the-number-of-base-pages-altered-by-protection-changes.patch +video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch +hid-lg-fix-report-descriptor-for-logitech-momo-force-black.patch +iommu-vt-d-fixed-interaction-of-vfio_iommu_map_dma-with-iommu-address-limits.patch +iommu-remove-stack-trace-from-broken-irq-remapping-warning.patch +elevator-fix-a-race-in-elevator-switching-and-md-device-initialization.patch +elevator-acquire-q-sysfs_lock-in-elevator_change.patch +ntp-make-periodic-rtc-update-more-reliable.patch diff --git a/queue-3.10/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch b/queue-3.10/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch new file mode 100644 index 00000000000..570a0b572e8 --- /dev/null +++ b/queue-3.10/video-kyro-fix-incorrect-sizes-when-copying-to-userspace.patch @@ -0,0 +1,43 @@ +From 2ab68ec927310dc488f3403bb48f9e4ad00a9491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2013 14:25:36 -0500 +Subject: video: kyro: fix incorrect sizes when copying to userspace + +From: Sasha Levin + +commit 2ab68ec927310dc488f3403bb48f9e4ad00a9491 upstream. + +kyro would copy u32s and specify sizeof(unsigned long) as the size to copy. + +This would copy more data than intended and cause memory corruption and might +leak kernel memory. + +Signed-off-by: Sasha Levin +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/kyro/fbdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/kyro/fbdev.c ++++ b/drivers/video/kyro/fbdev.c +@@ -625,15 +625,15 @@ static int kyrofb_ioctl(struct fb_info * + } + break; + case KYRO_IOCTL_UVSTRIDE: +- if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(deviceInfo.ulOverlayUVStride))) + return -EFAULT; + break; + case KYRO_IOCTL_STRIDE: +- if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(deviceInfo.ulOverlayStride))) + return -EFAULT; + break; + case KYRO_IOCTL_OVERLAY_OFFSET: +- if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long))) ++ if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(deviceInfo.ulOverlayOffset))) + return -EFAULT; + break; + }