From: Greg Kroah-Hartman Date: Tue, 10 Apr 2018 09:02:31 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.16.2~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b98d88acb1b94ad82c36cf67eda7630b6f567086;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch acpica-events-add-runtime-stub-support-for-event-apis.patch af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch arp-honour-gratuitous-arp-_replies_.patch asoc-intel-cht_bsw_rt5645-analog-mic-support.patch asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch bcache-segregate-flash-only-volume-write-streams.patch bcache-stop-writeback-thread-after-detaching.patch bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch block-fix-an-error-code-in-add_partition.patch bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch bna-avoid-reading-past-end-of-buffer.patch bnx2x-allow-vfs-to-disable-txvlan-offload.patch bonding-don-t-update-slave-link-until-ready-to-commit.patch btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch cfg80211-make-rate_info_bw_20-the-default.patch cifs-silence-lockdep-splat-in-cifs_relock_file.patch clk-fix-__set_clk_rates-error-print-string.patch clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch cpuidle-dt-add-missing-of_node_put.patch cx25840-fix-unchecked-return-values.patch cxgb4-fix-incorrect-cim_la-output-for-t6.patch cxgb4-fw-upgrade-fixes.patch cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch drm-omap-fix-tiled-buffer-stride-calculations.patch e1000e-fix-race-condition-around-skb_tstamp_tx.patch e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch edac-mv64x60-fix-an-error-handling-path.patch ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch fix-loop-device-flush-before-configure-v3.patch fix-race-in-drivers-char-random.c-get_reg.patch fix-serial-console-on-sni-rm400-machines.patch gpio-label-descriptors-using-the-device-name.patch hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch hwmon-ina2xx-make-calibration-register-value-fixed.patch ib-srpt-fix-abort-handling.patch iio-hi8435-avoid-garbage-event-at-first-enable.patch iio-hi8435-cleanup-reset-gpio.patch iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch input-elan_i2c-check-if-device-is-there-before-really-probing.patch input-elan_i2c-clear-int-before-resetting-controller.patch input-elantech-force-relative-mode-on-a-certain-module.patch ipmi_ssif-unlock-on-allocation-failure.patch ipsec-check-return-value-of-skb_to_sgvec-always.patch ipv6-avoid-dad-failures-for-addresses-with-nodad.patch kvm-nvmx-fix-handling-of-lmsw-instruction.patch kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch l2tp-fix-missing-print-session-offset-info.patch leds-pca955x-correct-i2c-functionality.patch libceph-null-deref-on-crush_decode-error-path.patch lockd-fix-lockd-shutdown-race.patch mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch mceusb-sporadic-rx-truncation-corruption-fix.patch md-cluster-fix-potential-lock-issue-in-add_new_disk.patch md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch mips-mm-adjust-pkmap-location.patch mips-mm-fixed-mappings-correct-initialisation.patch misdn-fix-a-sleep-in-atomic-bug.patch mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch neighbour-update-neigh-timestamps-iff-update-is-effective.patch net-cdc_ncm-fix-tx-zero-padding.patch net-emac-fix-reset-timeout-with-ar8035-phy.patch net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch net-freescale-fix-potential-null-pointer-dereference.patch net-ieee802154-fix-net_device-reference-release-too-early.patch net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch net-mlx4-fix-the-check-in-attaching-steering-rules.patch net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch net-mlx5-avoid-build-warning-for-uniprocessor.patch net-mlx5-tolerate-irq_set_affinity_hint-failures.patch net-move-somaxconn-init-from-sysctl-code.patch net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch net-qca_spi-fix-alignment-issues-in-rx-path.patch net-x25-fix-one-potential-use-after-free-issue.patch netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch nfsv4.1-work-around-a-linux-server-bug.patch ovl-filter-trusted-xattr-for-non-admin.patch perf-core-correct-event-creation-with-perf_format_group.patch perf-header-set-proper-module-name-when-build-id-event-found.patch perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch perf-tests-decompress-kernel-module-before-objdump.patch perf-tools-fix-copyfile_offset-update-of-output-offset.patch perf-trace-add-mmap-alias-for-s390.patch pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch powercap-fix-an-error-code-in-powercap_register_zone.patch powerpc-don-t-clobber-tcr-when-setting-tcr.patch powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch powerpc-spufs-fix-coredump-of-spu-contexts.patch qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch qlge-avoid-reading-past-end-of-buffer.patch ray_cs-avoid-reading-past-end-of-buffer.patch rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch rtc-interface-validate-alarm-time-before-handling-rollover.patch rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch rtc-snvs-fix-an-incorrect-check-of-return-value.patch rxrpc-check-return-value-of-skb_to_sgvec-always.patch s390-dasd-fix-hanging-safe-offline.patch s390-move-_text-symbol-to-address-higher-than-zero.patch sched-numa-use-down_read_trylock-for-the-mmap_sem.patch scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch scsi-libsas-fix-error-when-getting-phy-events.patch scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch selinux-do-not-check-open-permission-on-sockets.patch serial-8250-omap-disable-dma-for-console-uart.patch serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch sh_eth-use-platform-device-for-printing-before-register_netdev.patch signal-arm-document-conflicts-with-si_user-and-sigfpe.patch signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch sit-reload-iphdr-in-ipip6_rcv.patch skbuff-only-inherit-relevant-tx_flags.patch skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch smb2-fix-share-type-handling.patch sparc64-ldc-abort-during-vds-iso-boot.patch staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch tags-honor-compiled_source-with-apart-output-directory.patch tcp-better-validation-of-received-ack-sequences.patch thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch usb-dwc3-keystone-check-return-value.patch usb-ene_usb6250-fix-first-command-execution.patch usb-ene_usb6250-fix-scsi-residue-overwriting.patch vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch virtio_net-check-return-value-of-skb_to_sgvec-always.patch virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch x86-tsc-provide-tsc-unstable-boot-parameter.patch xen-avoid-type-warning-in-xchg_xen_ulong.patch xfrm-fix-state-migration-copy-replay-sequence-numbers.patch --- diff --git a/queue-4.4/acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch b/queue-4.4/acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch new file mode 100644 index 00000000000..495c5179c02 --- /dev/null +++ b/queue-4.4/acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch @@ -0,0 +1,67 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Bob Moore +Date: Mon, 5 Jun 2017 16:40:34 +0800 +Subject: ACPICA: Disassembler: Abort on an invalid/unknown AML opcode + +From: Bob Moore + + +[ Upstream commit 6f0527b77d9e0129dd8e50945b0d610ed943d6b2 ] + +ACPICA commit ed0389cb11a61e63c568ac1f67948fc6a7bd1aeb + +An invalid opcode indicates something seriously wrong with the +input AML file. The AML parser is immediately confused and lost, +causing the resulting parse tree to be ill-formed. The actual +disassembly can then cause numerous unrelated errors and faults. + +This change aborts the disassembly upon discovery of such an +opcode during the AML parse phase. + +Link: https://github.com/acpica/acpica/commit/ed0389cb +Signed-off-by: Bob Moore +Signed-off-by: Lv Zheng +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpica/psobject.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +--- a/drivers/acpi/acpica/psobject.c ++++ b/drivers/acpi/acpica/psobject.c +@@ -121,6 +121,9 @@ static acpi_status acpi_ps_get_aml_opcod + (u32)(aml_offset + + sizeof(struct acpi_table_header))); + ++ ACPI_ERROR((AE_INFO, ++ "Aborting disassembly, AML byte code is corrupt")); ++ + /* Dump the context surrounding the invalid opcode */ + + acpi_ut_dump_buffer(((u8 *)walk_state->parser_state. +@@ -129,6 +132,14 @@ static acpi_status acpi_ps_get_aml_opcod + sizeof(struct acpi_table_header) - + 16)); + acpi_os_printf(" */\n"); ++ ++ /* ++ * Just abort the disassembly, cannot continue because the ++ * parser is essentially lost. The disassembler can then ++ * randomly fail because an ill-constructed parse tree ++ * can result. ++ */ ++ return_ACPI_STATUS(AE_AML_BAD_OPCODE); + #endif + } + +@@ -293,6 +304,9 @@ acpi_ps_create_op(struct acpi_walk_state + if (status == AE_CTRL_PARSE_CONTINUE) { + return_ACPI_STATUS(AE_CTRL_PARSE_CONTINUE); + } ++ if (ACPI_FAILURE(status)) { ++ return_ACPI_STATUS(status); ++ } + + /* Create Op structure and append to parent's argument list */ + diff --git a/queue-4.4/acpica-events-add-runtime-stub-support-for-event-apis.patch b/queue-4.4/acpica-events-add-runtime-stub-support-for-event-apis.patch new file mode 100644 index 00000000000..f7ede7b9eb3 --- /dev/null +++ b/queue-4.4/acpica-events-add-runtime-stub-support-for-event-apis.patch @@ -0,0 +1,71 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Lv Zheng +Date: Mon, 5 Jun 2017 16:40:02 +0800 +Subject: ACPICA: Events: Add runtime stub support for event APIs + +From: Lv Zheng + + +[ Upstream commit 861ba6351c520328e94a78c923b415faa9116287 ] + +ACPICA commit 99bc3beca92c6574ea1d69de42e54f872e6373ce + +It is reported that on Linux, RTC driver complains wrong errors on +hardware reduced platform: + [ 4.085420] ACPI Warning: Could not enable fixed event - real_time_clock (4) (20160422/evxface-654) + +This patch fixes this by correctly adding runtime reduced hardware check. +Reported by Chandan Tagore, fixed by Lv Zheng. + +Link: https://github.com/acpica/acpica/commit/99bc3bec +Tested-by: Chandan Tagore +Signed-off-by: Lv Zheng +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpica/evxfevnt.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/drivers/acpi/acpica/evxfevnt.c ++++ b/drivers/acpi/acpica/evxfevnt.c +@@ -180,6 +180,12 @@ acpi_status acpi_enable_event(u32 event, + + ACPI_FUNCTION_TRACE(acpi_enable_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { +@@ -237,6 +243,12 @@ acpi_status acpi_disable_event(u32 event + + ACPI_FUNCTION_TRACE(acpi_disable_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { +@@ -290,6 +302,12 @@ acpi_status acpi_clear_event(u32 event) + + ACPI_FUNCTION_TRACE(acpi_clear_event); + ++ /* If Hardware Reduced flag is set, there are no fixed events */ ++ ++ if (acpi_gbl_reduced_hardware) { ++ return_ACPI_STATUS(AE_OK); ++ } ++ + /* Decode the Fixed Event */ + + if (event > ACPI_EVENT_MAX) { diff --git a/queue-4.4/af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch b/queue-4.4/af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch new file mode 100644 index 00000000000..e9c02856648 --- /dev/null +++ b/queue-4.4/af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch @@ -0,0 +1,36 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Steffen Klassert +Date: Fri, 5 May 2017 07:40:42 +0200 +Subject: af_key: Fix slab-out-of-bounds in pfkey_compile_policy. + +From: Steffen Klassert + + +[ Upstream commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 ] + +The sadb_x_sec_len is stored in the unit 'byte divided by eight'. +So we have to multiply this value by eight before we can do +size checks. Otherwise we may get a slab-out-of-bounds when +we memcpy the user sec_ctx. + +Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.") +Reported-by: Andrey Konovalov +Tested-by: Andrey Konovalov +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/key/af_key.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -3305,7 +3305,7 @@ static struct xfrm_policy *pfkey_compile + p += pol->sadb_x_policy_len*8; + sec_ctx = (struct sadb_x_sec_ctx *)p; + if (len < pol->sadb_x_policy_len*8 + +- sec_ctx->sadb_x_sec_len) { ++ sec_ctx->sadb_x_sec_len*8) { + *dir = -EINVAL; + goto out; + } diff --git a/queue-4.4/arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch b/queue-4.4/arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch new file mode 100644 index 00000000000..f09343bce6a --- /dev/null +++ b/queue-4.4/arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch @@ -0,0 +1,60 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Suman Anna +Date: Tue, 16 May 2017 17:13:45 -0500 +Subject: ARM: davinci: da8xx: Create DSP device only when assigned memory + +From: Suman Anna + + +[ Upstream commit f97f03578b997a8ec2b9bc4928f958a865137268 ] + +The DSP device on Davinci platforms does not have an MMU and requires +specific DDR memory to boot. This memory is reserved using the rproc_mem +kernel boot parameter and is assigned to the device on non-DT boots. +The remoteproc core uses the DMA API and so will fall back to assigning +random memory if this memory is not assigned to the device, but the DSP +remote processor boot will not be successful in such cases. So, check +that memory has been reserved and assigned to the device specifically +before even creating the DSP device. + +Signed-off-by: Suman Anna +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-davinci/devices-da8xx.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/arm/mach-davinci/devices-da8xx.c ++++ b/arch/arm/mach-davinci/devices-da8xx.c +@@ -795,6 +795,8 @@ static struct platform_device da8xx_dsp + .resource = da8xx_rproc_resources, + }; + ++static bool rproc_mem_inited __initdata; ++ + #if IS_ENABLED(CONFIG_DA8XX_REMOTEPROC) + + static phys_addr_t rproc_base __initdata; +@@ -833,6 +835,8 @@ void __init da8xx_rproc_reserve_cma(void + ret = dma_declare_contiguous(&da8xx_dsp.dev, rproc_size, rproc_base, 0); + if (ret) + pr_err("%s: dma_declare_contiguous failed %d\n", __func__, ret); ++ else ++ rproc_mem_inited = true; + } + + #else +@@ -847,6 +851,12 @@ int __init da8xx_register_rproc(void) + { + int ret; + ++ if (!rproc_mem_inited) { ++ pr_warn("%s: memory not reserved for DSP, not registering DSP device\n", ++ __func__); ++ return -ENOMEM; ++ } ++ + ret = platform_device_register(&da8xx_dsp); + if (ret) + pr_err("%s: can't register DSP device: %d\n", __func__, ret); diff --git a/queue-4.4/arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch b/queue-4.4/arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch new file mode 100644 index 00000000000..f6d65974923 --- /dev/null +++ b/queue-4.4/arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch @@ -0,0 +1,58 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Fabio Estevam +Date: Wed, 12 Apr 2017 18:31:18 -0300 +Subject: ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin + +From: Fabio Estevam + + +[ Upstream commit 2fe4bff3516924a37e083e3211364abe59db1161 ] + +Currently the following errors are seen: + +[ 14.015056] mc13xxx 0-0008: Failed to read IRQ status: -6 +[ 27.321093] mc13xxx 0-0008: Failed to read IRQ status: -6 +[ 27.411681] mc13xxx 0-0008: Failed to read IRQ status: -6 +[ 27.456281] mc13xxx 0-0008: Failed to read IRQ status: -6 +[ 30.527106] mc13xxx 0-0008: Failed to read IRQ status: -6 +[ 36.596900] mc13xxx 0-0008: Failed to read IRQ status: -6 + +Also when reading the interrupts via 'cat /proc/interrupts' the +PMIC GPIO interrupt counter does not stop increasing. + +The reason for the storm of interrupts is that the PUS field of +register IOMUXC_SW_PAD_CTL_PAD_CSI0_DAT5 is currently configured as: +10 : 100k pullup + +and the PMIC interrupt is being registered as IRQ_TYPE_LEVEL_HIGH type, +which is the correct type as per the MC34708 datasheet. + +Use the default power on value for the IOMUX, which sets PUS field as: +00: 360k pull down + +This prevents the spurious PMIC interrupts from happening. + +Commit e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level") +correctly described the irq type as IRQ_TYPE_LEVEL_HIGH, but +missed to update the IOMUX of the PMIC GPIO as pull down. + +Fixes: e1ffceb078c6 ("ARM: imx53: qsrb: fix PMIC interrupt level") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx53-qsrb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/imx53-qsrb.dts ++++ b/arch/arm/boot/dts/imx53-qsrb.dts +@@ -23,7 +23,7 @@ + imx53-qsrb { + pinctrl_pmic: pmicgrp { + fsl,pins = < +- MX53_PAD_CSI0_DAT5__GPIO5_23 0x1e4 /* IRQ */ ++ MX53_PAD_CSI0_DAT5__GPIO5_23 0x1c4 /* IRQ */ + >; + }; + }; diff --git a/queue-4.4/arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch b/queue-4.4/arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch new file mode 100644 index 00000000000..8941167dcf6 --- /dev/null +++ b/queue-4.4/arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Fabio Estevam +Date: Sun, 14 May 2017 11:50:50 -0300 +Subject: ARM: dts: imx6qdl-wandboard: Fix audio channel swap + +From: Fabio Estevam + + +[ Upstream commit 79935915300c5eb88a0e94fa9148a7505c14a02a ] + +When running a stress playback/stop loop test on a mx6wandboard channel +swaps can be noticed randomly. + +Increasing the SGTL5000 LRCLK pad strength to its maximum value fixes +the issue, so add the 'lrclk-strength' property to avoid the audio +channel swaps. + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi +@@ -88,6 +88,7 @@ + clocks = <&clks 201>; + VDDA-supply = <®_2p5v>; + VDDIO-supply = <®_3p3v>; ++ lrclk-strength = <3>; + }; + }; + diff --git a/queue-4.4/arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch b/queue-4.4/arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch new file mode 100644 index 00000000000..ce0a351977a --- /dev/null +++ b/queue-4.4/arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Rasmus Villemoes +Date: Thu, 16 Nov 2017 13:15:26 +0100 +Subject: ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node + +From: Rasmus Villemoes + + +[ Upstream commit d5c7b4d5ac2237a6da7ced3adfe6b8bf769f8cc6 ] + +Commit a22950c888e3 (mmc: sdhci-of-esdhc: add quirk +SDHCI_QUIRK_BROKEN_TIMEOUT_VAL for ls1021a) added logic to the driver to +enable the broken timeout val quirk for ls1021a, but did not add the +corresponding compatible string to the device tree, so it didn't really +have any effect. Fix that. + +Signed-off-by: Rasmus Villemoes +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/ls1021a.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -132,7 +132,7 @@ + }; + + esdhc: esdhc@1560000 { +- compatible = "fsl,esdhc"; ++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc"; + reg = <0x0 0x1560000 0x0 0x10000>; + interrupts = ; + clock-frequency = <0>; diff --git a/queue-4.4/arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch b/queue-4.4/arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch new file mode 100644 index 00000000000..264f16383db --- /dev/null +++ b/queue-4.4/arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch @@ -0,0 +1,60 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Leonard Crestez +Date: Tue, 6 Jun 2017 20:50:42 +0300 +Subject: ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull + +From: Leonard Crestez + + +[ Upstream commit b3ea575770c7eeb259c77b6861cd14d00eb309df ] + +Support for imx6ull is already present but it's based on +of_machine_is_compatible("fsl,imx6ull") checks. Add it to the MXC_CPU_* +enumeration as well. + +This also fixes /sys/devices/soc0/soc_id reading "Unknown". + +Signed-off-by: Leonard Crestez +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-imx/cpu.c | 3 +++ + arch/arm/mach-imx/mxc.h | 6 ++++++ + 2 files changed, 9 insertions(+) + +--- a/arch/arm/mach-imx/cpu.c ++++ b/arch/arm/mach-imx/cpu.c +@@ -133,6 +133,9 @@ struct device * __init imx_soc_device_in + case MXC_CPU_IMX6UL: + soc_id = "i.MX6UL"; + break; ++ case MXC_CPU_IMX6ULL: ++ soc_id = "i.MX6ULL"; ++ break; + case MXC_CPU_IMX7D: + soc_id = "i.MX7D"; + break; +--- a/arch/arm/mach-imx/mxc.h ++++ b/arch/arm/mach-imx/mxc.h +@@ -39,6 +39,7 @@ + #define MXC_CPU_IMX6SX 0x62 + #define MXC_CPU_IMX6Q 0x63 + #define MXC_CPU_IMX6UL 0x64 ++#define MXC_CPU_IMX6ULL 0x65 + #define MXC_CPU_IMX7D 0x72 + + #define IMX_DDR_TYPE_LPDDR2 1 +@@ -171,6 +172,11 @@ static inline bool cpu_is_imx6ul(void) + return __mxc_cpu_type == MXC_CPU_IMX6UL; + } + ++static inline bool cpu_is_imx6ull(void) ++{ ++ return __mxc_cpu_type == MXC_CPU_IMX6ULL; ++} ++ + static inline bool cpu_is_imx6q(void) + { + return __mxc_cpu_type == MXC_CPU_IMX6Q; diff --git a/queue-4.4/arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch b/queue-4.4/arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch new file mode 100644 index 00000000000..e0d4a32772f --- /dev/null +++ b/queue-4.4/arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch @@ -0,0 +1,83 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Will Deacon +Date: Wed, 5 Apr 2017 11:14:05 +0100 +Subject: arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage + +From: Will Deacon + + +[ Upstream commit 5f16a046f8e144c294ef98cd29d9458b5f8273e5 ] + +FUTEX_OP_OPARG_SHIFT instructs the futex code to treat the 12-bit oparg +field as a shift value, potentially leading to a left shift value that +is negative or with an absolute value that is significantly larger then +the size of the type. UBSAN chokes with: + +================================================================================ +UBSAN: Undefined behaviour in ./arch/arm64/include/asm/futex.h:60:13 +shift exponent -1 is negative +CPU: 1 PID: 1449 Comm: syz-executor0 Not tainted 4.11.0-rc4-00005-g977eb52-dirty #11 +Hardware name: linux,dummy-virt (DT) +Call trace: +[] dump_backtrace+0x0/0x538 arch/arm64/kernel/traps.c:73 +[] show_stack+0x20/0x30 arch/arm64/kernel/traps.c:228 +[] __dump_stack lib/dump_stack.c:16 [inline] +[] dump_stack+0x120/0x188 lib/dump_stack.c:52 +[] ubsan_epilogue+0x18/0x98 lib/ubsan.c:164 +[] __ubsan_handle_shift_out_of_bounds+0x250/0x294 lib/ubsan.c:421 +[] futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] +[] futex_wake_op kernel/futex.c:1489 [inline] +[] do_futex+0x137c/0x1740 kernel/futex.c:3231 +[] SYSC_futex kernel/futex.c:3281 [inline] +[] SyS_futex+0x114/0x268 kernel/futex.c:3249 +[] el0_svc_naked+0x24/0x28 +================================================================================ +syz-executor1 uses obsolete (PF_INET,SOCK_PACKET) +sock: process `syz-executor0' is using obsolete setsockopt SO_BSDCOMPAT + +This patch attempts to fix some of this by: + + * Making encoded_op an unsigned type, so we can shift it left even if + the top bit is set. + + * Casting to signed prior to shifting right when extracting oparg + and cmparg + + * Consider only the bottom 5 bits of oparg when using it as a left-shift + value. + +Whilst I think this catches all of the issues, I'd much prefer to remove +this stuff, as I think it's unused and the bugs are copy-pasted between +a bunch of architectures. + +Reviewed-by: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/futex.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm64/include/asm/futex.h ++++ b/arch/arm64/include/asm/futex.h +@@ -53,16 +53,16 @@ + : "memory") + + static inline int +-futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr) ++futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr) + { + int op = (encoded_op >> 28) & 7; + int cmp = (encoded_op >> 24) & 15; +- int oparg = (encoded_op << 8) >> 20; +- int cmparg = (encoded_op << 20) >> 20; ++ int oparg = (int)(encoded_op << 8) >> 20; ++ int cmparg = (int)(encoded_op << 20) >> 20; + int oldval = 0, ret, tmp; + + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) +- oparg = 1 << oparg; ++ oparg = 1U << (oparg & 0x1f); + + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) + return -EFAULT; diff --git a/queue-4.4/arp-honour-gratuitous-arp-_replies_.patch b/queue-4.4/arp-honour-gratuitous-arp-_replies_.patch new file mode 100644 index 00000000000..214505122f7 --- /dev/null +++ b/queue-4.4/arp-honour-gratuitous-arp-_replies_.patch @@ -0,0 +1,81 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ihar Hrachyshka +Date: Tue, 16 May 2017 07:53:43 -0700 +Subject: arp: honour gratuitous ARP _replies_ + +From: Ihar Hrachyshka + + +[ Upstream commit 23d268eb240954e6e78f7cfab04f2b1e79f84489 ] + +When arp_accept is 1, gratuitous ARPs are supposed to override matching +entries irrespective of whether they arrive during locktime. This was +implemented in commit 56022a8fdd87 ("ipv4: arp: update neighbour address +when a gratuitous arp is received and arp_accept is set") + +There is a glitch in the patch though. RFC 2002, section 4.6, "ARP, +Proxy ARP, and Gratuitous ARP", defines gratuitous ARPs so that they can +be either of Request or Reply type. Those Reply gratuitous ARPs can be +triggered with standard tooling, for example, arping -A option does just +that. + +This patch fixes the glitch, making both Request and Reply flavours of +gratuitous ARPs to behave identically. + +As per RFC, if gratuitous ARPs are of Reply type, their Target Hardware +Address field should also be set to the link-layer address to which this +cache entry should be updated. The field is present in ARP over Ethernet +but not in IEEE 1394. In this patch, I don't consider any broadcasted +ARP replies as gratuitous if the field is not present, to conform the +standard. It's not clear whether there is such a thing for IEEE 1394 as +a gratuitous ARP reply; until it's cleared up, we will ignore such +broadcasts. Note that they will still update existing ARP cache entries, +assuming they arrive out of locktime time interval. + +Signed-off-by: Ihar Hrachyshka +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/arp.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -658,6 +658,7 @@ static int arp_process(struct net *net, + unsigned char *arp_ptr; + struct rtable *rt; + unsigned char *sha; ++ unsigned char *tha = NULL; + __be32 sip, tip; + u16 dev_type = dev->type; + int addr_type; +@@ -729,6 +730,7 @@ static int arp_process(struct net *net, + break; + #endif + default: ++ tha = arp_ptr; + arp_ptr += dev->addr_len; + } + memcpy(&tip, arp_ptr, 4); +@@ -839,8 +841,18 @@ static int arp_process(struct net *net, + It is possible, that this option should be enabled for some + devices (strip is candidate) + */ +- is_garp = arp->ar_op == htons(ARPOP_REQUEST) && tip == sip && +- addr_type == RTN_UNICAST; ++ is_garp = tip == sip && addr_type == RTN_UNICAST; ++ ++ /* Unsolicited ARP _replies_ also require target hwaddr to be ++ * the same as source. ++ */ ++ if (is_garp && arp->ar_op == htons(ARPOP_REPLY)) ++ is_garp = ++ /* IPv4 over IEEE 1394 doesn't provide target ++ * hardware address field in its ARP payload. ++ */ ++ tha && ++ !memcmp(tha, sha, dev->addr_len); + + if (!n && + ((arp->ar_op == htons(ARPOP_REPLY) && diff --git a/queue-4.4/asoc-intel-cht_bsw_rt5645-analog-mic-support.patch b/queue-4.4/asoc-intel-cht_bsw_rt5645-analog-mic-support.patch new file mode 100644 index 00000000000..dfb568d592b --- /dev/null +++ b/queue-4.4/asoc-intel-cht_bsw_rt5645-analog-mic-support.patch @@ -0,0 +1,67 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Hans de Goede +Date: Tue, 2 Jan 2018 19:53:14 +0100 +Subject: ASoC: Intel: cht_bsw_rt5645: Analog Mic support + +From: Hans de Goede + + +[ Upstream commit b70b309950418437bbd2a30afd169c4f09dee3e5 ] + +Various Cherry Trail boards with a rt5645 codec have an analog mic +connected to IN2P + IN2N. The mic on this boards also needs micbias to +be enabled, on some boards micbias1 is used and on others micbias2, so +we enable both. + +This commit adds a new "Int Analog Mic" DAPM widget for this, so that we +do not end up enabling micbias on boards with a digital mic which uses +the already present "Int Mic" widget. Some existing UCM files already +refer to "Int Mic" for their "Internal Analog Microphones" SectionDevice, +but these don't work anyways since they enable the RECMIX BST1 Switch +instead of the BST2 switch. + +Signed-off-by: Hans de Goede +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/intel/boards/cht_bsw_rt5645.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -96,6 +96,7 @@ static const struct snd_soc_dapm_widget + SND_SOC_DAPM_HP("Headphone", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_MIC("Int Mic", NULL), ++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL), + SND_SOC_DAPM_SPK("Ext Spk", NULL), + SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, + platform_clock_control, SND_SOC_DAPM_POST_PMD), +@@ -106,6 +107,8 @@ static const struct snd_soc_dapm_route c + {"IN1N", NULL, "Headset Mic"}, + {"DMIC L1", NULL, "Int Mic"}, + {"DMIC R1", NULL, "Int Mic"}, ++ {"IN2P", NULL, "Int Analog Mic"}, ++ {"IN2N", NULL, "Int Analog Mic"}, + {"Headphone", NULL, "HPOL"}, + {"Headphone", NULL, "HPOR"}, + {"Ext Spk", NULL, "SPOL"}, +@@ -119,6 +122,9 @@ static const struct snd_soc_dapm_route c + {"Headphone", NULL, "Platform Clock"}, + {"Headset Mic", NULL, "Platform Clock"}, + {"Int Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "micbias1"}, ++ {"Int Analog Mic", NULL, "micbias2"}, + {"Ext Spk", NULL, "Platform Clock"}, + }; + +@@ -147,6 +153,7 @@ static const struct snd_kcontrol_new cht + SOC_DAPM_PIN_SWITCH("Headphone"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Int Mic"), ++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"), + SOC_DAPM_PIN_SWITCH("Ext Spk"), + }; + diff --git a/queue-4.4/asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch b/queue-4.4/asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch new file mode 100644 index 00000000000..5714a1a09a4 --- /dev/null +++ b/queue-4.4/asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Christophe JAILLET +Date: Sat, 6 Jan 2018 21:18:24 +0100 +Subject: ASoC: Intel: sst: Fix the return value of 'sst_send_byte_stream_mrfld()' + +From: Christophe JAILLET + + +[ Upstream commit eaadb1caa966a91128297b754e90b7c92b350a00 ] + +In some error handling paths, an error code is assiegned to 'ret'. +However, the function always return 0. + +Fix it and return the error code if such an error paths is taken. + +Fixes: 3d9ff34622ba ("ASoC: Intel: sst: add stream operations") +Signed-off-by: Christophe JAILLET +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/intel/atom/sst/sst_stream.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/intel/atom/sst/sst_stream.c ++++ b/sound/soc/intel/atom/sst/sst_stream.c +@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct in + sst_free_block(sst_drv_ctx, block); + out: + test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id); +- return 0; ++ return ret; + } + + /* diff --git a/queue-4.4/asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch b/queue-4.4/asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch new file mode 100644 index 00000000000..fc0167f0f61 --- /dev/null +++ b/queue-4.4/asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Kuninori Morimoto +Date: Wed, 24 May 2017 01:17:10 +0000 +Subject: ASoC: rsnd: SSI PIO adjust to 24bit mode + +From: Kuninori Morimoto + + +[ Upstream commit 7819a942de7b993771bd9377babc80485fe7606b ] + +commit 90431eb49bff ("ASoC: rsnd: don't use PDTA bit for 24bit on SSI") +fixups 24bit mode data alignment, but PIO was not cared. +This patch fixes PIO mode 24bit data alignment + +Signed-off-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sh/rcar/ssi.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -453,6 +453,13 @@ static void __rsnd_ssi_interrupt(struct + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + u32 *buf = (u32 *)(runtime->dma_area + + rsnd_dai_pointer_offset(io, 0)); ++ int shift = 0; ++ ++ switch (runtime->sample_bits) { ++ case 32: ++ shift = 8; ++ break; ++ } + + /* + * 8/16/32 data can be assesse to TDR/RDR register +@@ -460,9 +467,9 @@ static void __rsnd_ssi_interrupt(struct + * see rsnd_ssi_init() + */ + if (rsnd_io_is_play(io)) +- rsnd_mod_write(mod, SSITDR, *buf); ++ rsnd_mod_write(mod, SSITDR, (*buf) << shift); + else +- *buf = rsnd_mod_read(mod, SSIRDR); ++ *buf = (rsnd_mod_read(mod, SSIRDR) >> shift); + + elapsed = rsnd_dai_pointer_update(io, sizeof(*buf)); + } diff --git a/queue-4.4/async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch b/queue-4.4/async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch new file mode 100644 index 00000000000..9419b9da5ab --- /dev/null +++ b/queue-4.4/async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch @@ -0,0 +1,54 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Anup Patel +Date: Mon, 15 May 2017 10:34:53 +0530 +Subject: async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() + +From: Anup Patel + + +[ Upstream commit baae03a0e2497f49704628fd0aaf993cf98e1b99 ] + +The DMA_PREP_FENCE is to be used when preparing Tx descriptor if output +of Tx descriptor is to be used by next/dependent Tx descriptor. + +The DMA_PREP_FENSE will not be set correctly in do_async_gen_syndrome() +when calling dma->device_prep_dma_pq() under following conditions: +1. ASYNC_TX_FENCE not set in submit->flags +2. DMA_PREP_FENCE not set in dma_flags +3. src_cnt (= (disks - 2)) is greater than dma_maxpq(dma, dma_flags) + +This patch fixes DMA_PREP_FENCE usage in do_async_gen_syndrome() taking +inspiration from do_async_xor() implementation. + +Signed-off-by: Anup Patel +Reviewed-by: Ray Jui +Reviewed-by: Scott Branden +Acked-by: Dan Williams +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/async_tx/async_pq.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/crypto/async_tx/async_pq.c ++++ b/crypto/async_tx/async_pq.c +@@ -62,9 +62,6 @@ do_async_gen_syndrome(struct dma_chan *c + dma_addr_t dma_dest[2]; + int src_off = 0; + +- if (submit->flags & ASYNC_TX_FENCE) +- dma_flags |= DMA_PREP_FENCE; +- + while (src_cnt > 0) { + submit->flags = flags_orig; + pq_src_cnt = min(src_cnt, dma_maxpq(dma, dma_flags)); +@@ -83,6 +80,8 @@ do_async_gen_syndrome(struct dma_chan *c + if (cb_fn_orig) + dma_flags |= DMA_PREP_INTERRUPT; + } ++ if (submit->flags & ASYNC_TX_FENCE) ++ dma_flags |= DMA_PREP_FENCE; + + /* Drivers force forward progress in case they can not provide + * a descriptor diff --git a/queue-4.4/ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch b/queue-4.4/ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch new file mode 100644 index 00000000000..8dcbbd107df --- /dev/null +++ b/queue-4.4/ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch @@ -0,0 +1,45 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Thomas Petazzoni +Date: Tue, 16 May 2017 14:06:12 +0200 +Subject: ata: libahci: properly propagate return value of platform_get_irq() + +From: Thomas Petazzoni + + +[ Upstream commit c034640a32f8456018d9c8c83799ead683046b95 ] + +When platform_get_irq() fails, it returns an error code, which +libahci_platform and replaces it by -EINVAL. This commit fixes that by +propagating the error code. It fixes the situation where +platform_get_irq() returns -EPROBE_DEFER because the interrupt +controller is not available yet, and generally looks like the right +thing to do. + +We pay attention to not show the "no irq" message when we are in an +EPROBE_DEFER situation, because the driver probing will be retried +later on, once the interrupt controller becomes available to provide +the interrupt. + +Signed-off-by: Thomas Petazzoni +Reviewed-by: Hans de Goede +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libahci_platform.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libahci_platform.c ++++ b/drivers/ata/libahci_platform.c +@@ -514,8 +514,9 @@ int ahci_platform_init_host(struct platf + + irq = platform_get_irq(pdev, 0); + if (irq <= 0) { +- dev_err(dev, "no irq\n"); +- return -EINVAL; ++ if (irq != -EPROBE_DEFER) ++ dev_err(dev, "no irq\n"); ++ return irq; + } + + hpriv->irq = irq; diff --git a/queue-4.4/ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch b/queue-4.4/ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch new file mode 100644 index 00000000000..5f496a63dfd --- /dev/null +++ b/queue-4.4/ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Colin Ian King +Date: Wed, 3 May 2017 15:26:00 +0100 +Subject: ath5k: fix memory leak on buf on failed eeprom read + +From: Colin Ian King + + +[ Upstream commit 8fed6823e06e43ee9cf7c0ffecec2f9111ce6201 ] + +The AR5K_EEPROM_READ macro returns with -EIO if a read error +occurs causing a memory leak on the allocated buffer buf. Fix +this by explicitly calling ath5k_hw_nvram_read and exiting on +the via the freebuf label that performs the necessary free'ing +of buf when a read error occurs. + +Detected by CoverityScan, CID#1248782 ("Resource Leak") + +Signed-off-by: Colin Ian King +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath5k/debug.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath5k/debug.c ++++ b/drivers/net/wireless/ath/ath5k/debug.c +@@ -939,7 +939,10 @@ static int open_file_eeprom(struct inode + } + + for (i = 0; i < eesize; ++i) { +- AR5K_EEPROM_READ(i, val); ++ if (!ath5k_hw_nvram_read(ah, i, &val)) { ++ ret = -EIO; ++ goto freebuf; ++ } + buf[i] = val; + } + diff --git a/queue-4.4/bcache-segregate-flash-only-volume-write-streams.patch b/queue-4.4/bcache-segregate-flash-only-volume-write-streams.patch new file mode 100644 index 00000000000..567d02913f8 --- /dev/null +++ b/queue-4.4/bcache-segregate-flash-only-volume-write-streams.patch @@ -0,0 +1,83 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tang Junhui +Date: Mon, 8 Jan 2018 12:21:21 -0800 +Subject: bcache: segregate flash only volume write streams + +From: Tang Junhui + + +[ Upstream commit 4eca1cb28d8b0574ca4f1f48e9331c5f852d43b9 ] + +In such scenario that there are some flash only volumes +, and some cached devices, when many tasks request these devices in +writeback mode, the write IOs may fall to the same bucket as bellow: +| cached data | flash data | cached data | cached data| flash data| +then after writeback of these cached devices, the bucket would +be like bellow bucket: +| free | flash data | free | free | flash data | + +So, there are many free space in this bucket, but since data of flash +only volumes still exists, so this bucket cannot be reclaimable, +which would cause waste of bucket space. + +In this patch, we segregate flash only volume write streams from +cached devices, so data from flash only volumes and cached devices +can store in different buckets. + +Compare to v1 patch, this patch do not add a additionally open bucket +list, and it is try best to segregate flash only volume write streams +from cached devices, sectors of flash only volumes may still be mixed +with dirty sectors of cached device, but the number is very small. + +[mlyle: fixed commit log formatting, permissions, line endings] + +Signed-off-by: Tang Junhui +Reviewed-by: Michael Lyle +Signed-off-by: Michael Lyle +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/alloc.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -514,15 +514,21 @@ struct open_bucket { + + /* + * We keep multiple buckets open for writes, and try to segregate different +- * write streams for better cache utilization: first we look for a bucket where +- * the last write to it was sequential with the current write, and failing that +- * we look for a bucket that was last used by the same task. ++ * write streams for better cache utilization: first we try to segregate flash ++ * only volume write streams from cached devices, secondly we look for a bucket ++ * where the last write to it was sequential with the current write, and ++ * failing that we look for a bucket that was last used by the same task. + * + * The ideas is if you've got multiple tasks pulling data into the cache at the + * same time, you'll get better cache utilization if you try to segregate their + * data and preserve locality. + * +- * For example, say you've starting Firefox at the same time you're copying a ++ * For example, dirty sectors of flash only volume is not reclaimable, if their ++ * dirty sectors mixed with dirty sectors of cached device, such buckets will ++ * be marked as dirty and won't be reclaimed, though the dirty data of cached ++ * device have been written back to backend device. ++ * ++ * And say you've starting Firefox at the same time you're copying a + * bunch of files. Firefox will likely end up being fairly hot and stay in the + * cache awhile, but the data you copied might not be; if you wrote all that + * data to the same buckets it'd get invalidated at the same time. +@@ -539,7 +545,10 @@ static struct open_bucket *pick_data_buc + struct open_bucket *ret, *ret_task = NULL; + + list_for_each_entry_reverse(ret, &c->data_buckets, list) +- if (!bkey_cmp(&ret->key, search)) ++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) != ++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)])) ++ continue; ++ else if (!bkey_cmp(&ret->key, search)) + goto found; + else if (ret->last_write_point == write_point) + ret_task = ret; diff --git a/queue-4.4/bcache-stop-writeback-thread-after-detaching.patch b/queue-4.4/bcache-stop-writeback-thread-after-detaching.patch new file mode 100644 index 00000000000..64e658e906b --- /dev/null +++ b/queue-4.4/bcache-stop-writeback-thread-after-detaching.patch @@ -0,0 +1,52 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tang Junhui +Date: Mon, 8 Jan 2018 12:21:19 -0800 +Subject: bcache: stop writeback thread after detaching + +From: Tang Junhui + + +[ Upstream commit 8d29c4426b9f8afaccf28de414fde8a722b35fdf ] + +Currently, when a cached device detaching from cache, writeback thread is +not stopped, and writeback_rate_update work is not canceled. For example, +after the following command: +echo 1 >/sys/block/sdb/bcache/detach +you can still see the writeback thread. Then you attach the device to the +cache again, bcache will create another writeback thread, for example, +after below command: +echo ba0fb5cd-658a-4533-9806-6ce166d883b9 > /sys/block/sdb/bcache/attach +then you will see 2 writeback threads. +This patch stops writeback thread and cancels writeback_rate_update work +when cached device detaching from cache. + +Compare with patch v1, this v2 patch moves code down into the register +lock for safety in case of any future changes as Coly and Mike suggested. + +[edit by mlyle: commit log spelling/formatting] + +Signed-off-by: Tang Junhui +Reviewed-by: Michael Lyle +Signed-off-by: Michael Lyle +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -890,6 +890,12 @@ static void cached_dev_detach_finish(str + + mutex_lock(&bch_register_lock); + ++ cancel_delayed_work_sync(&dc->writeback_rate_update); ++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) { ++ kthread_stop(dc->writeback_thread); ++ dc->writeback_thread = NULL; ++ } ++ + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + diff --git a/queue-4.4/bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch b/queue-4.4/bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch new file mode 100644 index 00000000000..1308ae6ddf5 --- /dev/null +++ b/queue-4.4/bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch @@ -0,0 +1,68 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dmitry Monakhov +Date: Wed, 10 May 2017 19:20:44 +0400 +Subject: bio-integrity: Do not allocate integrity context for bio w/o data + +From: Dmitry Monakhov + + +[ Upstream commit 3116a23bb30272d74ea81baf5d0ee23f602dd15b ] + +If bio has no data, such as ones from blkdev_issue_flush(), +then we have nothing to protect. + +This patch prevent bugon like follows: + +kfree_debugcheck: out of range ptr ac1fa1d106742a5ah +kernel BUG at mm/slab.c:2773! +invalid opcode: 0000 [#1] SMP +Modules linked in: bcache +CPU: 0 PID: 4428 Comm: xfs_io Tainted: G W 4.11.0-rc4-ext4-00041-g2ef0043-dirty #43 +Hardware name: Virtuozzo KVM, BIOS seabios-1.7.5-11.vz7.4 04/01/2014 +task: ffff880137786440 task.stack: ffffc90000ba8000 +RIP: 0010:kfree_debugcheck+0x25/0x2a +RSP: 0018:ffffc90000babde0 EFLAGS: 00010082 +RAX: 0000000000000034 RBX: ac1fa1d106742a5a RCX: 0000000000000007 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88013f3ccb40 +RBP: ffffc90000babde8 R08: 0000000000000000 R09: 0000000000000000 +R10: 00000000fcb76420 R11: 00000000725172ed R12: 0000000000000282 +R13: ffffffff8150e766 R14: ffff88013a145e00 R15: 0000000000000001 +FS: 00007fb09384bf40(0000) GS:ffff88013f200000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fd0172f9e40 CR3: 0000000137fa9000 CR4: 00000000000006f0 +Call Trace: + kfree+0xc8/0x1b3 + bio_integrity_free+0xc3/0x16b + bio_free+0x25/0x66 + bio_put+0x14/0x26 + blkdev_issue_flush+0x7a/0x85 + blkdev_fsync+0x35/0x42 + vfs_fsync_range+0x8e/0x9f + vfs_fsync+0x1c/0x1e + do_fsync+0x31/0x4a + SyS_fsync+0x10/0x14 + entry_SYSCALL_64_fastpath+0x1f/0xc2 + +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Reviewed-by: Martin K. Petersen +Signed-off-by: Dmitry Monakhov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/bio-integrity.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -175,6 +175,9 @@ bool bio_integrity_enabled(struct bio *b + if (!bio_is_rw(bio)) + return false; + ++ if (!bio_sectors(bio)) ++ return false; ++ + /* Already protected? */ + if (bio_integrity(bio)) + return false; diff --git a/queue-4.4/blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch b/queue-4.4/blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch new file mode 100644 index 00000000000..d964ab7ced6 --- /dev/null +++ b/queue-4.4/blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch @@ -0,0 +1,70 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ming Lei +Date: Tue, 9 Jan 2018 21:28:29 +0800 +Subject: blk-mq: fix kernel oops in blk_mq_tag_idle() + +From: Ming Lei + + +[ Upstream commit 8ab0b7dc73e1b3e2987d42554b2bff503f692772 ] + +HW queues may be unmapped in some cases, such as blk_mq_update_nr_hw_queues(), +then we need to check it before calling blk_mq_tag_idle(), otherwise +the following kernel oops can be triggered, so fix it by checking if +the hw queue is unmapped since it doesn't make sense to idle the tags +any more after hw queues are unmapped. + +[ 440.771298] Workqueue: nvme-wq nvme_rdma_del_ctrl_work [nvme_rdma] +[ 440.779104] task: ffff894bae755ee0 ti: ffff893bf9bc8000 task.ti: ffff893bf9bc8000 +[ 440.788359] RIP: 0010:[] [] __blk_mq_tag_idle+0x24/0x40 +[ 440.798697] RSP: 0018:ffff893bf9bcbd10 EFLAGS: 00010286 +[ 440.805538] RAX: 0000000000000000 RBX: ffff895bb131dc00 RCX: 000000000000011f +[ 440.814426] RDX: 00000000ffffffff RSI: 0000000000000120 RDI: ffff895bb131dc00 +[ 440.823301] RBP: ffff893bf9bcbd10 R08: 000000000001b860 R09: 4a51d361c00c0000 +[ 440.832193] R10: b5907f32b4cc7003 R11: ffffd6cabfb57000 R12: ffff894bafd1e008 +[ 440.841091] R13: 0000000000000001 R14: ffff895baf770000 R15: 0000000000000080 +[ 440.849988] FS: 0000000000000000(0000) GS:ffff894bbdcc0000(0000) knlGS:0000000000000000 +[ 440.859955] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 440.867274] CR2: 0000000000000008 CR3: 000000103d098000 CR4: 00000000001407e0 +[ 440.876169] Call Trace: +[ 440.879818] [] blk_mq_exit_hctx+0xd8/0xe0 +[ 440.887051] [] blk_mq_free_queue+0xf0/0x160 +[ 440.894465] [] blk_cleanup_queue+0xd9/0x150 +[ 440.901881] [] nvme_ns_remove+0x5b/0xb0 [nvme_core] +[ 440.910068] [] nvme_remove_namespaces+0x3b/0x60 [nvme_core] +[ 440.919026] [] __nvme_rdma_remove_ctrl+0x2b/0xb0 [nvme_rdma] +[ 440.928079] [] nvme_rdma_del_ctrl_work+0x17/0x20 [nvme_rdma] +[ 440.937126] [] process_one_work+0x17a/0x440 +[ 440.944517] [] worker_thread+0x278/0x3c0 +[ 440.951607] [] ? manage_workers.isra.24+0x2a0/0x2a0 +[ 440.959760] [] kthread+0xcf/0xe0 +[ 440.966055] [] ? insert_kthread_work+0x40/0x40 +[ 440.973715] [] ret_from_fork+0x58/0x90 +[ 440.980586] [] ? insert_kthread_work+0x40/0x40 +[ 440.988229] Code: 5b 41 5c 5d c3 66 90 0f 1f 44 00 00 48 8b 87 20 01 00 00 f0 0f ba 77 40 01 19 d2 85 d2 75 08 c3 0f 1f 80 00 00 00 00 55 48 89 e5 ff 48 08 48 8d 78 10 e8 7f 0f 05 00 5d c3 0f 1f 00 66 2e 0f +[ 441.011620] RIP [] __blk_mq_tag_idle+0x24/0x40 +[ 441.019301] RSP +[ 441.024052] CR2: 0000000000000008 + +Reported-by: Zhang Yi +Tested-by: Zhang Yi +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1634,7 +1634,8 @@ static void blk_mq_exit_hctx(struct requ + { + unsigned flush_start_tag = set->queue_depth; + +- blk_mq_tag_idle(hctx); ++ if (blk_mq_hw_queue_mapped(hctx)) ++ blk_mq_tag_idle(hctx); + + if (set->ops->exit_request) + set->ops->exit_request(set->driver_data, diff --git a/queue-4.4/blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch b/queue-4.4/blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch new file mode 100644 index 00000000000..c4f00e45c41 --- /dev/null +++ b/queue-4.4/blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch @@ -0,0 +1,70 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Wen Xiong +Date: Wed, 10 May 2017 08:54:11 -0500 +Subject: blk-mq: NVMe 512B/4K+T10 DIF/DIX format returns I/O error on dd with split op + +From: Wen Xiong + + +[ Upstream commit f36ea50ca0043e7b1204feaf1d2ba6bd68c08d36 ] + +When formatting NVMe to 512B/4K + T10 DIf/DIX, dd with split op returns +"Input/output error". Looks block layer split the bio after calling +bio_integrity_prep(bio). This patch fixes the issue. + +Below is how we debug this issue: +(1)format nvme to 4K block # size with type 2 DIF +(2)dd with block size bigger than 1024k. +oflag=direct +dd: error writing '/dev/nvme0n1': Input/output error + +We added some debug code in nvme device driver. It showed us the first +op and the second op have the same bi and pi address. This is not +correct. + +1st op: nvme0n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400, + dsmgmt=0x0, AT=0x0 & RT=0x505 + Guard 0x00b1, AT 0x0000, RT physical 0x00000505 RT virtual 0x00002828 + +2nd op: nvme0n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0, + AT=0x0 & RT=0x605 ==> This op fails and subsequent 5 retires.. + Guard 0x00b1, AT 0x0000, RT physical 0x00000605 RT virtual 0x00002828 + +With the fix, It showed us both of the first op and the second op have +correct bi and pi address. + +1st op: nvme2n1 Op:Wr slba 0x505 length 0x100, PI ctrl=0x1400, + dsmgmt=0x0, AT=0x0 & RT=0x505 + Guard 0x5ccb, AT 0x0000, RT physical 0x00000505 RT virtual + 0x00002828 +2nd op: nvme2n1 Op:Wr slba 0x605 length 0x1, PI ctrl=0x1400, dsmgmt=0x0, + AT=0x0 & RT=0x605 + Guard 0xab4c, AT 0x0000, RT physical 0x00000605 RT virtual + 0x00003028 + +Signed-off-by: Wen Xiong +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1252,13 +1252,13 @@ static blk_qc_t blk_mq_make_request(stru + + blk_queue_bounce(q, &bio); + ++ blk_queue_split(q, &bio, q->bio_split); ++ + if (bio_integrity_enabled(bio) && bio_integrity_prep(bio)) { + bio_io_error(bio); + return BLK_QC_T_NONE; + } + +- blk_queue_split(q, &bio, q->bio_split); +- + if (!is_flush_fua && !blk_queue_nomerges(q) && + blk_attempt_plug_merge(q, bio, &request_count, &same_queue_rq)) + return BLK_QC_T_NONE; diff --git a/queue-4.4/block-fix-an-error-code-in-add_partition.patch b/queue-4.4/block-fix-an-error-code-in-add_partition.patch new file mode 100644 index 00000000000..f755d0f7223 --- /dev/null +++ b/queue-4.4/block-fix-an-error-code-in-add_partition.patch @@ -0,0 +1,36 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Tue, 23 May 2017 17:28:36 +0300 +Subject: block: fix an error code in add_partition() + +From: Dan Carpenter + + +[ Upstream commit 7bd897cfce1eb373892d35d7f73201b0f9b221c4 ] + +We don't set an error code on this path. It means that we return NULL +instead of an error pointer and the caller does a NULL dereference. + +Fixes: 6d1d8050b4bc ("block, partition: add partition_meta_info to hd_struct") +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/partition-generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -309,8 +309,10 @@ struct hd_struct *add_partition(struct g + + if (info) { + struct partition_meta_info *pinfo = alloc_part_info(disk); +- if (!pinfo) ++ if (!pinfo) { ++ err = -ENOMEM; + goto out_free_stats; ++ } + memcpy(pinfo, info, sizeof(*info)); + p->info = pinfo; + } diff --git a/queue-4.4/bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch b/queue-4.4/bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch new file mode 100644 index 00000000000..3dfe2178c12 --- /dev/null +++ b/queue-4.4/bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch @@ -0,0 +1,122 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Marcel Holtmann +Date: Fri, 9 Jun 2017 18:43:56 +0200 +Subject: Bluetooth: Send HCI Set Event Mask Page 2 command only when needed + +From: Marcel Holtmann + + +[ Upstream commit 313f6888c8fbb1bc8b36c9012ce4e1de848df696 ] + +The Broadcom BCM20702 Bluetooth controller in ThinkPad-T530 devices +report support for the Set Event Mask Page 2 command, but actually do +return an error when trying to use it. + + < HCI Command: Read Local Supported Commands (0x04|0x0002) plen 0 + > HCI Event: Command Complete (0x0e) plen 68 + Read Local Supported Commands (0x04|0x0002) ncmd 1 + Status: Success (0x00) + Commands: 162 entries + ... + Set Event Mask Page 2 (Octet 22 - Bit 2) + ... + + < HCI Command: Set Event Mask Page 2 (0x03|0x0063) plen 8 + Mask: 0x0000000000000000 + > HCI Event: Command Complete (0x0e) plen 4 + Set Event Mask Page 2 (0x03|0x0063) ncmd 1 + Status: Unknown HCI Command (0x01) + +Since these controllers do not support any feature that would require +the event mask page 2 to be modified, it is safe to not send this +command at all. The default value is all bits set to zero. + +T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 9 Spd=12 MxCh= 0 +D: Ver= 2.00 Cls=ff(vend.) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=0a5c ProdID=21e6 Rev= 1.12 +S: Manufacturer=Broadcom Corp +S: Product=BCM20702A0 +S: SerialNumber=F82FA8E8CFC0 +C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr= 0mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=ff(vend.) Sub=01 Prot=01 Driver=btusb +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=btusb +E: Ad=84(I) Atr=02(Bulk) MxPS= 32 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 0 Cls=fe(app. ) Sub=01 Prot=01 Driver=(none) + +Signed-off-by: Marcel Holtmann +Reported-by: Sedat Dilek +Tested-by: Sedat Dilek +Signed-off-by: Szymon Janc +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_core.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -716,6 +716,7 @@ static void hci_set_event_mask_page_2(st + { + struct hci_dev *hdev = req->hdev; + u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; ++ bool changed = false; + + /* If Connectionless Slave Broadcast master role is supported + * enable all necessary events for it. +@@ -725,6 +726,7 @@ static void hci_set_event_mask_page_2(st + events[1] |= 0x80; /* Synchronization Train Complete */ + events[2] |= 0x10; /* Slave Page Response Timeout */ + events[2] |= 0x20; /* CSB Channel Map Change */ ++ changed = true; + } + + /* If Connectionless Slave Broadcast slave role is supported +@@ -735,13 +737,24 @@ static void hci_set_event_mask_page_2(st + events[2] |= 0x02; /* CSB Receive */ + events[2] |= 0x04; /* CSB Timeout */ + events[2] |= 0x08; /* Truncated Page Complete */ ++ changed = true; + } + + /* Enable Authenticated Payload Timeout Expired event if supported */ +- if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) ++ if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) { + events[2] |= 0x80; ++ changed = true; ++ } + +- hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events); ++ /* Some Broadcom based controllers indicate support for Set Event ++ * Mask Page 2 command, but then actually do not support it. Since ++ * the default value is all bits set to zero, the command is only ++ * required if the event mask has to be changed. In case no change ++ * to the event mask is needed, skip this command. ++ */ ++ if (changed) ++ hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, ++ sizeof(events), events); + } + + static void hci_init3_req(struct hci_request *req, unsigned long opt) diff --git a/queue-4.4/bna-avoid-reading-past-end-of-buffer.patch b/queue-4.4/bna-avoid-reading-past-end-of-buffer.patch new file mode 100644 index 00000000000..a472ab44682 --- /dev/null +++ b/queue-4.4/bna-avoid-reading-past-end-of-buffer.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Kees Cook +Date: Fri, 5 May 2017 15:25:32 -0700 +Subject: bna: Avoid reading past end of buffer + +From: Kees Cook + + +[ Upstream commit 9e4eb1ce472fbf7b007f23c88ec11c37265e401c ] + +Using memcpy() from a string that is shorter than the length copied means +the destination buffer is being filled with arbitrary data from the kernel +rodata segment. Instead, use strncpy() which will fill the trailing bytes +with zeros. + +This was found with the future CONFIG_FORTIFY_SOURCE feature. + +Cc: Daniel Micay +Signed-off-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/brocade/bna/bfa_ioc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c ++++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c +@@ -2845,7 +2845,7 @@ bfa_ioc_get_adapter_optrom_ver(struct bf + static void + bfa_ioc_get_adapter_manufacturer(struct bfa_ioc *ioc, char *manufacturer) + { +- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); ++ strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); + } + + static void diff --git a/queue-4.4/bnx2x-allow-vfs-to-disable-txvlan-offload.patch b/queue-4.4/bnx2x-allow-vfs-to-disable-txvlan-offload.patch new file mode 100644 index 00000000000..85e75c2e880 --- /dev/null +++ b/queue-4.4/bnx2x-allow-vfs-to-disable-txvlan-offload.patch @@ -0,0 +1,57 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Mintz, Yuval" +Date: Fri, 9 Jun 2017 17:17:01 +0300 +Subject: bnx2x: Allow vfs to disable txvlan offload + +From: "Mintz, Yuval" + + +[ Upstream commit 92f85f05caa51d844af6ea14ffbc7a786446a644 ] + +VF clients are configured as enforced, meaning firmware is validating +the correctness of their ethertype/vid during transmission. +Once txvlan is disabled, VF would start getting SKBs for transmission +here vlan is on the payload - but it'll pass the packet's ethertype +instead of the vid, leading to firmware declaring it as malicious. + +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3943,15 +3943,26 @@ netdev_tx_t bnx2x_start_xmit(struct sk_b + /* when transmitting in a vf, start bd must hold the ethertype + * for fw to enforce it + */ ++ u16 vlan_tci = 0; + #ifndef BNX2X_STOP_ON_ERROR +- if (IS_VF(bp)) ++ if (IS_VF(bp)) { + #endif +- tx_start_bd->vlan_or_ethertype = +- cpu_to_le16(ntohs(eth->h_proto)); ++ /* Still need to consider inband vlan for enforced */ ++ if (__vlan_get_tag(skb, &vlan_tci)) { ++ tx_start_bd->vlan_or_ethertype = ++ cpu_to_le16(ntohs(eth->h_proto)); ++ } else { ++ tx_start_bd->bd_flags.as_bitfield |= ++ (X_ETH_INBAND_VLAN << ++ ETH_TX_BD_FLAGS_VLAN_MODE_SHIFT); ++ tx_start_bd->vlan_or_ethertype = ++ cpu_to_le16(vlan_tci); ++ } + #ifndef BNX2X_STOP_ON_ERROR +- else ++ } else { + /* used by FW for packet accounting */ + tx_start_bd->vlan_or_ethertype = cpu_to_le16(pkt_prod); ++ } + #endif + } + diff --git a/queue-4.4/bonding-don-t-update-slave-link-until-ready-to-commit.patch b/queue-4.4/bonding-don-t-update-slave-link-until-ready-to-commit.patch new file mode 100644 index 00000000000..82276089d08 --- /dev/null +++ b/queue-4.4/bonding-don-t-update-slave-link-until-ready-to-commit.patch @@ -0,0 +1,86 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Nithin Sujir +Date: Wed, 24 May 2017 19:45:17 -0700 +Subject: bonding: Don't update slave->link until ready to commit + +From: Nithin Sujir + + +[ Upstream commit 797a93647a48d6cb8a20641a86a71713a947f786 ] + +In the loadbalance arp monitoring scheme, when a slave link change is +detected, the slave->link is immediately updated and slave_state_changed +is set. Later down the function, the rtnl_lock is acquired and the +changes are committed, updating the bond link state. + +However, the acquisition of the rtnl_lock can fail. The next time the +monitor runs, since slave->link is already updated, it determines that +link is unchanged. This results in the bond link state permanently out +of sync with the slave link. + +This patch modifies bond_loadbalance_arp_mon() to handle link changes +identical to bond_ab_arp_{inspect/commit}(). The new link state is +maintained in slave->new_link until we're ready to commit at which point +it's copied into slave->link. + +NOTE: miimon_{inspect/commit}() has a more complex state machine +requiring the use of the bond_{propose,commit}_link_state() functions +which maintains the intermediate state in slave->link_new_state. The arp +monitors don't require that. + +Testing: This bug is very easy to reproduce with the following steps. +1. In a loop, toggle a slave link of a bond slave interface. +2. In a separate loop, do ifconfig up/down of an unrelated interface to +create contention for rtnl_lock. +Within a few iterations, the bond link goes out of sync with the slave +link. + +Signed-off-by: Nithin Nayak Sujir +Cc: Mahesh Bandewar +Cc: Jay Vosburgh +Acked-by: Mahesh Bandewar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2555,11 +2555,13 @@ static void bond_loadbalance_arp_mon(str + bond_for_each_slave_rcu(bond, slave, iter) { + unsigned long trans_start = dev_trans_start(slave->dev); + ++ slave->new_link = BOND_LINK_NOCHANGE; ++ + if (slave->link != BOND_LINK_UP) { + if (bond_time_in_interval(bond, trans_start, 1) && + bond_time_in_interval(bond, slave->last_rx, 1)) { + +- slave->link = BOND_LINK_UP; ++ slave->new_link = BOND_LINK_UP; + slave_state_changed = 1; + + /* primary_slave has no meaning in round-robin +@@ -2586,7 +2588,7 @@ static void bond_loadbalance_arp_mon(str + if (!bond_time_in_interval(bond, trans_start, 2) || + !bond_time_in_interval(bond, slave->last_rx, 2)) { + +- slave->link = BOND_LINK_DOWN; ++ slave->new_link = BOND_LINK_DOWN; + slave_state_changed = 1; + + if (slave->link_failure_count < UINT_MAX) +@@ -2617,6 +2619,11 @@ static void bond_loadbalance_arp_mon(str + if (!rtnl_trylock()) + goto re_arm; + ++ bond_for_each_slave(bond, slave, iter) { ++ if (slave->new_link != BOND_LINK_NOCHANGE) ++ slave->link = slave->new_link; ++ } ++ + if (slave_state_changed) { + bond_slave_state_change(bond); + if (BOND_MODE(bond) == BOND_MODE_XOR) diff --git a/queue-4.4/btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch b/queue-4.4/btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch new file mode 100644 index 00000000000..5eba2eff95f --- /dev/null +++ b/queue-4.4/btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Colin Ian King +Date: Tue, 9 May 2017 18:14:01 +0100 +Subject: btrfs: fix incorrect error return ret being passed to mapping_set_error + +From: Colin Ian King + + +[ Upstream commit bff5baf8aa37a97293725a16c03f49872249c07e ] + +The setting of return code ret should be based on the error code +passed into function end_extent_writepage and not on ret. Thanks +to Liu Bo for spotting this mistake in the original fix I submitted. + +Detected by CoverityScan, CID#1414312 ("Logically dead code") + +Fixes: 5dca6eea91653e ("Btrfs: mark mapping with error flag to report errors to userspace") +Signed-off-by: Colin Ian King +Reviewed-by: Liu Bo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/extent_io.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -2534,7 +2534,7 @@ int end_extent_writepage(struct page *pa + if (!uptodate) { + ClearPageUptodate(page); + SetPageError(page); +- ret = ret < 0 ? ret : -EIO; ++ ret = err < 0 ? err : -EIO; + mapping_set_error(page->mapping, ret); + } + return 0; diff --git a/queue-4.4/bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch b/queue-4.4/bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch new file mode 100644 index 00000000000..41ca4ab3ce7 --- /dev/null +++ b/queue-4.4/bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch @@ -0,0 +1,142 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Doug Berger +Date: Wed, 29 Mar 2017 17:29:10 -0700 +Subject: bus: brcmstb_gisb: correct support for 64-bit address output + +From: Doug Berger + + +[ Upstream commit 0c2aa0e4b308815e877601845c1a89913f9bd2b9 ] + +The GISB bus can support addresses beyond 32-bits. So this commit +corrects support for reading a captured 64-bit address into a 64-bit +variable by obtaining the high bits from the ARB_ERR_CAP_HI_ADDR +register (when present) and then outputting the full 64-bit value. + +It also removes unused definitions. + +Fixes: 44127b771d9c ("bus: add Broadcom GISB bus arbiter timeout/error handler") +Signed-off-by: Doug Berger +Acked-by: Gregory Fong +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/brcmstb_gisb.c | 36 ++++++++++++++++++++---------------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +--- a/drivers/bus/brcmstb_gisb.c ++++ b/drivers/bus/brcmstb_gisb.c +@@ -33,8 +33,6 @@ + #define ARB_ERR_CAP_CLEAR (1 << 0) + #define ARB_ERR_CAP_STATUS_TIMEOUT (1 << 12) + #define ARB_ERR_CAP_STATUS_TEA (1 << 11) +-#define ARB_ERR_CAP_STATUS_BS_SHIFT (1 << 2) +-#define ARB_ERR_CAP_STATUS_BS_MASK 0x3c + #define ARB_ERR_CAP_STATUS_WRITE (1 << 1) + #define ARB_ERR_CAP_STATUS_VALID (1 << 0) + +@@ -43,7 +41,6 @@ enum { + ARB_ERR_CAP_CLR, + ARB_ERR_CAP_HI_ADDR, + ARB_ERR_CAP_ADDR, +- ARB_ERR_CAP_DATA, + ARB_ERR_CAP_STATUS, + ARB_ERR_CAP_MASTER, + }; +@@ -53,7 +50,6 @@ static const int gisb_offsets_bcm7038[] + [ARB_ERR_CAP_CLR] = 0x0c4, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x0c8, +- [ARB_ERR_CAP_DATA] = 0x0cc, + [ARB_ERR_CAP_STATUS] = 0x0d0, + [ARB_ERR_CAP_MASTER] = -1, + }; +@@ -63,7 +59,6 @@ static const int gisb_offsets_bcm7400[] + [ARB_ERR_CAP_CLR] = 0x0c8, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x0cc, +- [ARB_ERR_CAP_DATA] = 0x0d0, + [ARB_ERR_CAP_STATUS] = 0x0d4, + [ARB_ERR_CAP_MASTER] = 0x0d8, + }; +@@ -73,7 +68,6 @@ static const int gisb_offsets_bcm7435[] + [ARB_ERR_CAP_CLR] = 0x168, + [ARB_ERR_CAP_HI_ADDR] = -1, + [ARB_ERR_CAP_ADDR] = 0x16c, +- [ARB_ERR_CAP_DATA] = 0x170, + [ARB_ERR_CAP_STATUS] = 0x174, + [ARB_ERR_CAP_MASTER] = 0x178, + }; +@@ -83,7 +77,6 @@ static const int gisb_offsets_bcm7445[] + [ARB_ERR_CAP_CLR] = 0x7e4, + [ARB_ERR_CAP_HI_ADDR] = 0x7e8, + [ARB_ERR_CAP_ADDR] = 0x7ec, +- [ARB_ERR_CAP_DATA] = 0x7f0, + [ARB_ERR_CAP_STATUS] = 0x7f4, + [ARB_ERR_CAP_MASTER] = 0x7f8, + }; +@@ -105,9 +98,13 @@ static u32 gisb_read(struct brcmstb_gisb + { + int offset = gdev->gisb_offsets[reg]; + +- /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */ +- if (offset == -1) +- return 1; ++ if (offset < 0) { ++ /* return 1 if the hardware doesn't have ARB_ERR_CAP_MASTER */ ++ if (reg == ARB_ERR_CAP_MASTER) ++ return 1; ++ else ++ return 0; ++ } + + if (gdev->big_endian) + return ioread32be(gdev->base + offset); +@@ -115,6 +112,16 @@ static u32 gisb_read(struct brcmstb_gisb + return ioread32(gdev->base + offset); + } + ++static u64 gisb_read_address(struct brcmstb_gisb_arb_device *gdev) ++{ ++ u64 value; ++ ++ value = gisb_read(gdev, ARB_ERR_CAP_ADDR); ++ value |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32; ++ ++ return value; ++} ++ + static void gisb_write(struct brcmstb_gisb_arb_device *gdev, u32 val, int reg) + { + int offset = gdev->gisb_offsets[reg]; +@@ -181,7 +188,7 @@ static int brcmstb_gisb_arb_decode_addr( + const char *reason) + { + u32 cap_status; +- unsigned long arb_addr; ++ u64 arb_addr; + u32 master; + const char *m_name; + char m_fmt[11]; +@@ -193,10 +200,7 @@ static int brcmstb_gisb_arb_decode_addr( + return 1; + + /* Read the address and master */ +- arb_addr = gisb_read(gdev, ARB_ERR_CAP_ADDR) & 0xffffffff; +-#if (IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT)) +- arb_addr |= (u64)gisb_read(gdev, ARB_ERR_CAP_HI_ADDR) << 32; +-#endif ++ arb_addr = gisb_read_address(gdev); + master = gisb_read(gdev, ARB_ERR_CAP_MASTER); + + m_name = brcmstb_gisb_master_to_str(gdev, master); +@@ -205,7 +209,7 @@ static int brcmstb_gisb_arb_decode_addr( + m_name = m_fmt; + } + +- pr_crit("%s: %s at 0x%lx [%c %s], core: %s\n", ++ pr_crit("%s: %s at 0x%llx [%c %s], core: %s\n", + __func__, reason, arb_addr, + cap_status & ARB_ERR_CAP_STATUS_WRITE ? 'W' : 'R', + cap_status & ARB_ERR_CAP_STATUS_TIMEOUT ? "timeout" : "", diff --git a/queue-4.4/bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch b/queue-4.4/bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch new file mode 100644 index 00000000000..ad12bf1fbeb --- /dev/null +++ b/queue-4.4/bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Doug Berger +Date: Wed, 29 Mar 2017 17:29:09 -0700 +Subject: bus: brcmstb_gisb: Use register offsets with writes too + +From: Doug Berger + + +[ Upstream commit 856c7ccb9ce7a061f04bdf586f649cb93654e294 ] + +This commit corrects the bug introduced in commit f80835875d3d +("bus: brcmstb_gisb: Look up register offsets in a table") such +that gisb_write() translates the register enumeration into an +offset from the base address for writes as well as reads. + +Fixes: f80835875d3d ("bus: brcmstb_gisb: Look up register offsets in a table") +Signed-off-by: Doug Berger +Acked-by: Gregory Fong +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/brcmstb_gisb.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/bus/brcmstb_gisb.c ++++ b/drivers/bus/brcmstb_gisb.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (C) 2014 Broadcom Corporation ++ * Copyright (C) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -123,9 +123,9 @@ static void gisb_write(struct brcmstb_gi + return; + + if (gdev->big_endian) +- iowrite32be(val, gdev->base + reg); ++ iowrite32be(val, gdev->base + offset); + else +- iowrite32(val, gdev->base + reg); ++ iowrite32(val, gdev->base + offset); + } + + static ssize_t gisb_arb_get_timeout(struct device *dev, diff --git a/queue-4.4/cfg80211-make-rate_info_bw_20-the-default.patch b/queue-4.4/cfg80211-make-rate_info_bw_20-the-default.patch new file mode 100644 index 00000000000..b182f8e06c6 --- /dev/null +++ b/queue-4.4/cfg80211-make-rate_info_bw_20-the-default.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Johannes Berg +Date: Thu, 4 May 2017 08:42:30 +0200 +Subject: cfg80211: make RATE_INFO_BW_20 the default + +From: Johannes Berg + + +[ Upstream commit 842be75c77cb72ee546a2b19da9c285fb3ded660 ] + +Due to the way I did the RX bitrate conversions in mac80211 with +spatch, going setting flags to setting the value, many drivers now +don't set the bandwidth value for 20 MHz, since with the flags it +wasn't necessary to (there was no 20 MHz flag, only the others.) + +Rather than go through and try to fix up all the drivers, instead +renumber the enum so that 20 MHz, which is the typical bandwidth, +actually has the value 0, making those drivers all work again. + +If VHT was hit used with a driver not reporting it, e.g. iwlmvm, +this manifested in hitting the bandwidth warning in +cfg80211_calculate_bitrate_vht(). + +Reported-by: Linus Torvalds +Tested-by: Jens Axboe +Signed-off-by: Johannes Berg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/cfg80211.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -933,9 +933,9 @@ enum rate_info_flags { + * @RATE_INFO_BW_160: 160 MHz bandwidth + */ + enum rate_info_bw { ++ RATE_INFO_BW_20 = 0, + RATE_INFO_BW_5, + RATE_INFO_BW_10, +- RATE_INFO_BW_20, + RATE_INFO_BW_40, + RATE_INFO_BW_80, + RATE_INFO_BW_160, diff --git a/queue-4.4/cifs-silence-lockdep-splat-in-cifs_relock_file.patch b/queue-4.4/cifs-silence-lockdep-splat-in-cifs_relock_file.patch new file mode 100644 index 00000000000..e9087bb50ec --- /dev/null +++ b/queue-4.4/cifs-silence-lockdep-splat-in-cifs_relock_file.patch @@ -0,0 +1,87 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Rabin Vincent +Date: Wed, 3 May 2017 17:17:21 +0200 +Subject: CIFS: silence lockdep splat in cifs_relock_file() + +From: Rabin Vincent + + +[ Upstream commit 560d388950ceda5e7c7cdef7f3d9a8ff297bbf9d ] + +cifs_relock_file() can perform a down_write() on the inode's lock_sem even +though it was already performed in cifs_strict_readv(). Lockdep complains +about this. AFAICS, there is no problem here, and lockdep just needs to be +told that this nesting is OK. + + ============================================= + [ INFO: possible recursive locking detected ] + 4.11.0+ #20 Not tainted + --------------------------------------------- + cat/701 is trying to acquire lock: + (&cifsi->lock_sem){++++.+}, at: cifs_reopen_file+0x7a7/0xc00 + + but task is already holding lock: + (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&cifsi->lock_sem); + lock(&cifsi->lock_sem); + + *** DEADLOCK *** + + May be due to missing lock nesting notation + + 1 lock held by cat/701: + #0: (&cifsi->lock_sem){++++.+}, at: cifs_strict_readv+0x177/0x310 + + stack backtrace: + CPU: 0 PID: 701 Comm: cat Not tainted 4.11.0+ #20 + Call Trace: + dump_stack+0x85/0xc2 + __lock_acquire+0x17dd/0x2260 + ? trace_hardirqs_on_thunk+0x1a/0x1c + ? preempt_schedule_irq+0x6b/0x80 + lock_acquire+0xcc/0x260 + ? lock_acquire+0xcc/0x260 + ? cifs_reopen_file+0x7a7/0xc00 + down_read+0x2d/0x70 + ? cifs_reopen_file+0x7a7/0xc00 + cifs_reopen_file+0x7a7/0xc00 + ? printk+0x43/0x4b + cifs_readpage_worker+0x327/0x8a0 + cifs_readpage+0x8c/0x2a0 + generic_file_read_iter+0x692/0xd00 + cifs_strict_readv+0x29f/0x310 + generic_file_splice_read+0x11c/0x1c0 + do_splice_to+0xa5/0xc0 + splice_direct_to_actor+0xfa/0x350 + ? generic_pipe_buf_nosteal+0x10/0x10 + do_splice_direct+0xb5/0xe0 + do_sendfile+0x278/0x3a0 + SyS_sendfile64+0xc4/0xe0 + entry_SYSCALL_64_fastpath+0x1f/0xbe + +Signed-off-by: Rabin Vincent +Acked-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -589,7 +589,7 @@ cifs_relock_file(struct cifsFileInfo *cf + struct cifs_tcon *tcon = tlink_tcon(cfile->tlink); + int rc = 0; + +- down_read(&cinode->lock_sem); ++ down_read_nested(&cinode->lock_sem, SINGLE_DEPTH_NESTING); + if (cinode->can_cache_brlcks) { + /* can cache locks - no need to relock */ + up_read(&cinode->lock_sem); diff --git a/queue-4.4/clk-fix-__set_clk_rates-error-print-string.patch b/queue-4.4/clk-fix-__set_clk_rates-error-print-string.patch new file mode 100644 index 00000000000..eca7e118b5c --- /dev/null +++ b/queue-4.4/clk-fix-__set_clk_rates-error-print-string.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Bryan O'Donoghue +Date: Mon, 15 May 2017 11:58:59 +0100 +Subject: clk: Fix __set_clk_rates error print-string + +From: Bryan O'Donoghue + + +[ Upstream commit ee177c5d6369f8e5d3e4793dce501cf4431313a1 ] + +When failing to set a clock the printout emitted is incorrect. +"u32 rate" is formatted as %d and should be %u whereas "unsigned long +clk_set_rate()" is formatted as %ld and should be %lu as per +Documentation/printk-formats.txt. + +Fixes: 2885c3b2a3da ("clk: Show correct information when fail to set clock rate") +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk-conf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-conf.c ++++ b/drivers/clk/clk-conf.c +@@ -106,7 +106,7 @@ static int __set_clk_rates(struct device + + rc = clk_set_rate(clk, rate); + if (rc < 0) +- pr_err("clk: couldn't set %s clk rate to %d (%d), current rate: %ld\n", ++ pr_err("clk: couldn't set %s clk rate to %u (%d), current rate: %lu\n", + __clk_get_name(clk), rate, rc, + clk_get_rate(clk)); + clk_put(clk); diff --git a/queue-4.4/clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch b/queue-4.4/clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch new file mode 100644 index 00000000000..b1c8d75da44 --- /dev/null +++ b/queue-4.4/clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch @@ -0,0 +1,48 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Sudeep Holla +Date: Thu, 18 May 2017 17:19:28 +0100 +Subject: clk: scpi: fix return type of __scpi_dvfs_round_rate + +From: Sudeep Holla + + +[ Upstream commit 7374aec95636ca39409545eba4ef5ff3125c2346 ] + +The frequencies above the maximum value of signed integer(i.e. 2^31 -1) +will overflow with the current code. + +This patch fixes the return type of __scpi_dvfs_round_rate from 'int' +to 'unsigned long'. + +Fixes: cd52c2a4b5c4 ("clk: add support for clocks provided by SCP(System Control Processor)") +Cc: Michael Turquette +Cc: Stephen Boyd +Signed-off-by: Sudeep Holla +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk-scpi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/clk/clk-scpi.c ++++ b/drivers/clk/clk-scpi.c +@@ -71,15 +71,15 @@ static const struct clk_ops scpi_clk_ops + }; + + /* find closest match to given frequency in OPP table */ +-static int __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate) ++static long __scpi_dvfs_round_rate(struct scpi_clk *clk, unsigned long rate) + { + int idx; +- u32 fmin = 0, fmax = ~0, ftmp; ++ unsigned long fmin = 0, fmax = ~0, ftmp; + const struct scpi_opp *opp = clk->info->opps; + + for (idx = 0; idx < clk->info->count; idx++, opp++) { + ftmp = opp->freq; +- if (ftmp >= (u32)rate) { ++ if (ftmp >= rate) { + if (ftmp <= fmax) + fmax = ftmp; + break; diff --git a/queue-4.4/cpuidle-dt-add-missing-of_node_put.patch b/queue-4.4/cpuidle-dt-add-missing-of_node_put.patch new file mode 100644 index 00000000000..5250a9f70c1 --- /dev/null +++ b/queue-4.4/cpuidle-dt-add-missing-of_node_put.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Christophe Jaillet +Date: Sun, 11 Jun 2017 14:28:54 +0200 +Subject: cpuidle: dt: Add missing 'of_node_put()' + +From: Christophe Jaillet + + +[ Upstream commit b2cdd8e1b54849477a32d820acc2e87828a38f3d ] + +'of_node_put()' should be called on pointer returned by +'of_parse_phandle()' when done. In this function this is done in all path +except this 'continue', so add it. + +Fixes: 97735da074fd (drivers: cpuidle: Add status property to ARM idle states) +Signed-off-by: Christophe Jaillet +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpuidle/dt_idle_states.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/cpuidle/dt_idle_states.c ++++ b/drivers/cpuidle/dt_idle_states.c +@@ -174,8 +174,10 @@ int dt_init_idle_driver(struct cpuidle_d + if (!state_node) + break; + +- if (!of_device_is_available(state_node)) ++ if (!of_device_is_available(state_node)) { ++ of_node_put(state_node); + continue; ++ } + + if (!idle_state_valid(state_node, i, cpumask)) { + pr_warn("%s idle state not valid, bailing out\n", diff --git a/queue-4.4/cx25840-fix-unchecked-return-values.patch b/queue-4.4/cx25840-fix-unchecked-return-values.patch new file mode 100644 index 00000000000..7ef0a63c61c --- /dev/null +++ b/queue-4.4/cx25840-fix-unchecked-return-values.patch @@ -0,0 +1,83 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Pan Bian +Date: Sun, 23 Apr 2017 10:06:36 -0300 +Subject: [media] cx25840: fix unchecked return values + +From: Pan Bian + + +[ Upstream commit 35378ce143071c2a6bad4b59a000e9b9f8f6ea67 ] + +In functions cx25840_initialize(), cx231xx_initialize(), and +cx23885_initialize(), the return value of create_singlethread_workqueue() +is used without validation. This may result in NULL dereference and cause +kernel crash. This patch fixes it. + +Signed-off-by: Pan Bian +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/cx25840/cx25840-core.c | 36 ++++++++++++++++++------------- + 1 file changed, 21 insertions(+), 15 deletions(-) + +--- a/drivers/media/i2c/cx25840/cx25840-core.c ++++ b/drivers/media/i2c/cx25840/cx25840-core.c +@@ -420,11 +420,13 @@ static void cx25840_initialize(struct i2 + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + /* 6. */ + cx25840_write(client, 0x115, 0x8c); +@@ -631,11 +633,13 @@ static void cx23885_initialize(struct i2 + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + /* Call the cx23888 specific std setup func, we no longer rely on + * the generic cx24840 func. +@@ -746,11 +750,13 @@ static void cx231xx_initialize(struct i2 + INIT_WORK(&state->fw_work, cx25840_work_handler); + init_waitqueue_head(&state->fw_wait); + q = create_singlethread_workqueue("cx25840_fw"); +- prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); +- queue_work(q, &state->fw_work); +- schedule(); +- finish_wait(&state->fw_wait, &wait); +- destroy_workqueue(q); ++ if (q) { ++ prepare_to_wait(&state->fw_wait, &wait, TASK_UNINTERRUPTIBLE); ++ queue_work(q, &state->fw_work); ++ schedule(); ++ finish_wait(&state->fw_wait, &wait); ++ destroy_workqueue(q); ++ } + + cx25840_std_setup(client); + diff --git a/queue-4.4/cxgb4-fix-incorrect-cim_la-output-for-t6.patch b/queue-4.4/cxgb4-fix-incorrect-cim_la-output-for-t6.patch new file mode 100644 index 00000000000..53ded948e8a --- /dev/null +++ b/queue-4.4/cxgb4-fix-incorrect-cim_la-output-for-t6.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ganesh Goudar +Date: Wed, 31 May 2017 19:10:21 +0530 +Subject: cxgb4: fix incorrect cim_la output for T6 + +From: Ganesh Goudar + + +[ Upstream commit a97051f4553551d13e586ab3cb6ae13093a44a81 ] + +take care of UpDbgLaRdPtr[0-3] restriction for T6. + +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -7711,7 +7711,16 @@ int t4_cim_read_la(struct adapter *adap, + ret = t4_cim_read(adap, UP_UP_DBG_LA_DATA_A, 1, &la_buf[i]); + if (ret) + break; +- idx = (idx + 1) & UPDBGLARDPTR_M; ++ ++ /* Bits 0-3 of UpDbgLaRdPtr can be between 0000 to 1001 to ++ * identify the 32-bit portion of the full 312-bit data ++ */ ++ if (is_t6(adap->params.chip) && (idx & 0xf) >= 9) ++ idx = (idx & 0xff0) + 0x10; ++ else ++ idx++; ++ /* address can't exceed 0xfff */ ++ idx &= UPDBGLARDPTR_M; + } + restart: + if (cfg & UPDBGLAEN_F) { diff --git a/queue-4.4/cxgb4-fw-upgrade-fixes.patch b/queue-4.4/cxgb4-fw-upgrade-fixes.patch new file mode 100644 index 00000000000..f9021db8b4b --- /dev/null +++ b/queue-4.4/cxgb4-fw-upgrade-fixes.patch @@ -0,0 +1,69 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Arjun Vynipadath +Date: Tue, 30 May 2017 18:06:06 +0530 +Subject: cxgb4: FW upgrade fixes + +From: Arjun Vynipadath + + +[ Upstream commit 26747211486c5bc7dd014c3caab206576e00c0d0 ] + +Disable FW_OK flag while flashing Firmware. This will help to fix any +potential mailbox timeouts during Firmware flash. + +Grab new devlog parameters after Firmware restart. When we FLASH new +Firmware onto an adapter, the new Firmware may have the Firmware Device Log +located at a different memory address or have a different size for it. + +Signed-off-by: Arjun Vynipadath +Signed-off-by: Casey Leedom +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -6076,13 +6076,18 @@ int t4_fw_upgrade(struct adapter *adap, + if (!t4_fw_matches_chip(adap, fw_hdr)) + return -EINVAL; + ++ /* Disable FW_OK flag so that mbox commands with FW_OK flag set ++ * wont be sent when we are flashing FW. ++ */ ++ adap->flags &= ~FW_OK; ++ + ret = t4_fw_halt(adap, mbox, force); + if (ret < 0 && !force) +- return ret; ++ goto out; + + ret = t4_load_fw(adap, fw_data, size); + if (ret < 0) +- return ret; ++ goto out; + + /* + * Older versions of the firmware don't understand the new +@@ -6093,7 +6098,17 @@ int t4_fw_upgrade(struct adapter *adap, + * its header flags to see if it advertises the capability. + */ + reset = ((be32_to_cpu(fw_hdr->flags) & FW_HDR_FLAGS_RESET_HALT) == 0); +- return t4_fw_restart(adap, mbox, reset); ++ ret = t4_fw_restart(adap, mbox, reset); ++ ++ /* Grab potentially new Firmware Device Log parameters so we can see ++ * how healthy the new Firmware is. It's okay to contact the new ++ * Firmware for these parameters even though, as far as it's ++ * concerned, we've never said "HELLO" to it ... ++ */ ++ (void)t4_init_devlog_params(adap); ++out: ++ adap->flags |= FW_OK; ++ return ret; + } + + /** diff --git a/queue-4.4/cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch b/queue-4.4/cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch new file mode 100644 index 00000000000..446f490bec7 --- /dev/null +++ b/queue-4.4/cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch @@ -0,0 +1,72 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Arjun Vynipadath +Date: Wed, 10 Jan 2018 12:02:13 +0530 +Subject: cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages + +From: Arjun Vynipadath + + +[ Upstream commit ea0a42109aee7b92e631c4eb3f2219fadf58acdd ] + +We'd come in with SGE_FL_BUFFER_SIZE[0] and [1] both equal to 64KB and +the extant logic would flag that as an error. This was already fixed in +cxgb4 driver with "92ddcc7 cxgb4: Fix some small bugs in +t4_sge_init_soft() when our Page Size is 64KB". + +Original Work by: Casey Leedom +Signed-off-by: Arjun Vynipadath +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/chelsio/cxgb4vf/sge.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +@@ -2604,8 +2604,8 @@ void t4vf_sge_stop(struct adapter *adapt + int t4vf_sge_init(struct adapter *adapter) + { + struct sge_params *sge_params = &adapter->params.sge; +- u32 fl0 = sge_params->sge_fl_buffer_size[0]; +- u32 fl1 = sge_params->sge_fl_buffer_size[1]; ++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0]; ++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1]; + struct sge *s = &adapter->sge; + unsigned int ingpadboundary, ingpackboundary; + +@@ -2614,9 +2614,20 @@ int t4vf_sge_init(struct adapter *adapte + * the Physical Function Driver. Ideally we should be able to deal + * with _any_ configuration. Practice is different ... + */ +- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) { ++ ++ /* We only bother using the Large Page logic if the Large Page Buffer ++ * is larger than our Page Size Buffer. ++ */ ++ if (fl_large_pg <= fl_small_pg) ++ fl_large_pg = 0; ++ ++ /* The Page Size Buffer must be exactly equal to our Page Size and the ++ * Large Page Size Buffer should be 0 (per above) or a power of 2. ++ */ ++ if (fl_small_pg != PAGE_SIZE || ++ (fl_large_pg & (fl_large_pg - 1)) != 0) { + dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n", +- fl0, fl1); ++ fl_small_pg, fl_large_pg); + return -EINVAL; + } + if ((sge_params->sge_control & RXPKTCPLMODE_F) == 0) { +@@ -2627,8 +2638,8 @@ int t4vf_sge_init(struct adapter *adapte + /* + * Now translate the adapter parameters into our internal forms. + */ +- if (fl1) +- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT; ++ if (fl_large_pg) ++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT; + s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F) + ? 128 : 64); + s->pktshift = PKTSHIFT_G(sge_params->sge_control); diff --git a/queue-4.4/dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch b/queue-4.4/dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch new file mode 100644 index 00000000000..d7ad28503b8 --- /dev/null +++ b/queue-4.4/dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch @@ -0,0 +1,72 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Arvind Yadav +Date: Wed, 24 May 2017 12:09:53 +0530 +Subject: dmaengine: imx-sdma: Handle return value of clk_prepare_enable + +From: Arvind Yadav + + +[ Upstream commit fb9caf370f4d0457789d13a1a1b110a8db846e5e ] + +clk_prepare_enable() can fail here and we must check its return value. + +Signed-off-by: Arvind Yadav +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/imx-sdma.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -1722,17 +1722,24 @@ static int sdma_probe(struct platform_de + if (IS_ERR(sdma->clk_ahb)) + return PTR_ERR(sdma->clk_ahb); + +- clk_prepare(sdma->clk_ipg); +- clk_prepare(sdma->clk_ahb); ++ ret = clk_prepare(sdma->clk_ipg); ++ if (ret) ++ return ret; ++ ++ ret = clk_prepare(sdma->clk_ahb); ++ if (ret) ++ goto err_clk; + + ret = devm_request_irq(&pdev->dev, irq, sdma_int_handler, 0, "sdma", + sdma); + if (ret) +- return ret; ++ goto err_irq; + + sdma->script_addrs = kzalloc(sizeof(*sdma->script_addrs), GFP_KERNEL); +- if (!sdma->script_addrs) +- return -ENOMEM; ++ if (!sdma->script_addrs) { ++ ret = -ENOMEM; ++ goto err_irq; ++ } + + /* initially no scripts available */ + saddr_arr = (s32 *)sdma->script_addrs; +@@ -1847,6 +1854,10 @@ err_register: + dma_async_device_unregister(&sdma->dma_device); + err_init: + kfree(sdma->script_addrs); ++err_irq: ++ clk_unprepare(sdma->clk_ahb); ++err_clk: ++ clk_unprepare(sdma->clk_ipg); + return ret; + } + +@@ -1857,6 +1868,8 @@ static int sdma_remove(struct platform_d + + dma_async_device_unregister(&sdma->dma_device); + kfree(sdma->script_addrs); ++ clk_unprepare(sdma->clk_ahb); ++ clk_unprepare(sdma->clk_ipg); + /* Kill the tasklet */ + for (i = 0; i < MAX_DMA_CHANNELS; i++) { + struct sdma_channel *sdmac = &sdma->channel[i]; diff --git a/queue-4.4/drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch b/queue-4.4/drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch new file mode 100644 index 00000000000..98f6f6ddbfa --- /dev/null +++ b/queue-4.4/drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Mon, 8 May 2017 15:55:14 -0700 +Subject: drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests + +From: Dan Carpenter + + +[ Upstream commit 146180c052a00172f4dc08eaade836fd02f61fb5 ] + +The "DIV_ROUND_UP(size, PAGE_SIZE)" operation can overflow if "size" is +more than ULLONG_MAX - PAGE_SIZE. + +Link: http://lkml.kernel.org/r/20170322111950.GA11279@mwanda +Signed-off-by: Dan Carpenter +Cc: Jorgen Hansen +Cc: Masahiro Yamada +Cc: Michal Hocko +Cc: Greg Kroah-Hartman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -298,8 +298,11 @@ static void *qp_alloc_queue(u64 size, u3 + size_t pas_size; + size_t vas_size; + size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if); +- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; ++ u64 num_pages; + ++ if (size > SIZE_MAX - PAGE_SIZE) ++ return NULL; ++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; + if (num_pages > + (SIZE_MAX - queue_size) / + (sizeof(*queue->kernel_if->u.g.pas) + +@@ -624,9 +627,12 @@ static struct vmci_queue *qp_host_alloc_ + { + struct vmci_queue *queue; + size_t queue_page_size; +- const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; ++ u64 num_pages; + const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if)); + ++ if (size > SIZE_MAX - PAGE_SIZE) ++ return NULL; ++ num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1; + if (num_pages > (SIZE_MAX - queue_size) / + sizeof(*queue->kernel_if->u.h.page)) + return NULL; diff --git a/queue-4.4/drm-omap-fix-tiled-buffer-stride-calculations.patch b/queue-4.4/drm-omap-fix-tiled-buffer-stride-calculations.patch new file mode 100644 index 00000000000..3aba501768c --- /dev/null +++ b/queue-4.4/drm-omap-fix-tiled-buffer-stride-calculations.patch @@ -0,0 +1,45 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tomi Valkeinen +Date: Thu, 18 May 2017 11:51:51 +0300 +Subject: drm/omap: fix tiled buffer stride calculations + +From: Tomi Valkeinen + + +[ Upstream commit cc8dd7661ccc2d8dc88921da8e6cc7c2fcdb0341 ] + +omap_gem uses page alignment for buffer stride. The related calculations +are a bit off, though, as byte stride of 4096 gets aligned to 8192, +instead of 4096. + +This patch changes the code to use DIV_ROUND_UP(), which fixes those +calculations and makes them more readable. + +Signed-off-by: Tomi Valkeinen +Reviewed-by: Laurent Pinchart +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/omapdrm/omap_gem.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/omapdrm/omap_gem.c ++++ b/drivers/gpu/drm/omapdrm/omap_gem.c +@@ -158,7 +158,7 @@ static void evict_entry(struct drm_gem_o + size_t size = PAGE_SIZE * n; + loff_t off = mmap_offset(obj) + + (entry->obj_pgoff << PAGE_SHIFT); +- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE); ++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE); + + if (m > 1) { + int i; +@@ -415,7 +415,7 @@ static int fault_2d(struct drm_gem_objec + * into account in some of the math, so figure out virtual stride + * in pages + */ +- const int m = 1 + ((omap_obj->width << fmt) / PAGE_SIZE); ++ const int m = DIV_ROUND_UP(omap_obj->width << fmt, PAGE_SIZE); + + /* We don't use vmf->pgoff since that has the fake offset: */ + pgoff = ((unsigned long)vmf->virtual_address - diff --git a/queue-4.4/e1000e-fix-race-condition-around-skb_tstamp_tx.patch b/queue-4.4/e1000e-fix-race-condition-around-skb_tstamp_tx.patch new file mode 100644 index 00000000000..759a02c56a2 --- /dev/null +++ b/queue-4.4/e1000e-fix-race-condition-around-skb_tstamp_tx.patch @@ -0,0 +1,72 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jacob Keller +Date: Wed, 3 May 2017 10:28:50 -0700 +Subject: e1000e: fix race condition around skb_tstamp_tx() + +From: Jacob Keller + + +[ Upstream commit 5012863b7347866764c4a4e58b62fb05346b0d06 ] + +The e1000e driver and related hardware has a limitation on Tx PTP +packets which requires we limit to timestamping a single packet at once. +We do this by verifying that we never request a new Tx timestamp while +we still have a tx_hwtstamp_skb pointer. + +Unfortunately the driver suffers from a race condition around this. The +tx_hwtstamp_skb pointer is not set to NULL until after skb_tstamp_tx() +is called. This function notifies the stack and applications of a new +timestamp. Even a well behaved application that only sends a new request +when the first one is finished might be woken up and possibly send +a packet before we can free the timestamp in the driver again. The +result is that we needlessly ignore some Tx timestamp requests in this +corner case. + +Fix this by assigning the tx_hwtstamp_skb pointer prior to calling +skb_tstamp_tx() and use a temporary pointer to hold the timestamped skb +until that function finishes. This ensures that the application is not +woken up until the driver is ready to begin timestamping a new packet. + +This ensures that well behaved applications do not accidentally race +with condition to skip Tx timestamps. Obviously an application which +sends multiple Tx timestamp requests at once will still only timestamp +one packet at a time. Unfortunately there is nothing we can do about +this. + +Reported-by: David Mirabito +Signed-off-by: Jacob Keller +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -1182,6 +1182,7 @@ static void e1000e_tx_hwtstamp_work(stru + struct e1000_hw *hw = &adapter->hw; + + if (er32(TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID) { ++ struct sk_buff *skb = adapter->tx_hwtstamp_skb; + struct skb_shared_hwtstamps shhwtstamps; + u64 txstmp; + +@@ -1190,9 +1191,14 @@ static void e1000e_tx_hwtstamp_work(stru + + e1000e_systim_to_hwtstamp(adapter, &shhwtstamps, txstmp); + +- skb_tstamp_tx(adapter->tx_hwtstamp_skb, &shhwtstamps); +- dev_kfree_skb_any(adapter->tx_hwtstamp_skb); ++ /* Clear the global tx_hwtstamp_skb pointer and force writes ++ * prior to notifying the stack of a Tx timestamp. ++ */ + adapter->tx_hwtstamp_skb = NULL; ++ wmb(); /* force write prior to skb_tstamp_tx */ ++ ++ skb_tstamp_tx(skb, &shhwtstamps); ++ dev_kfree_skb_any(skb); + } else if (time_after(jiffies, adapter->tx_hwtstamp_start + + adapter->tx_timeout_factor * HZ)) { + dev_kfree_skb_any(adapter->tx_hwtstamp_skb); diff --git a/queue-4.4/e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch b/queue-4.4/e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch new file mode 100644 index 00000000000..5f9d1eb69c3 --- /dev/null +++ b/queue-4.4/e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch @@ -0,0 +1,91 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Chris Wilson +Date: Wed, 31 May 2017 18:50:43 +0300 +Subject: e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails + +From: Chris Wilson + + +[ Upstream commit 833521ebc65b1c3092e5c0d8a97092f98eec595d ] + +An error during suspend (e100e_pm_suspend), + +[ 429.994338] ACPI : EC: event blocked +[ 429.994633] e1000e: EEE TX LPI TIMER: 00000011 +[ 430.955451] pci_pm_suspend(): e1000e_pm_suspend+0x0/0x30 [e1000e] returns -2 +[ 430.955454] dpm_run_callback(): pci_pm_suspend+0x0/0x140 returns -2 +[ 430.955458] PM: Device 0000:00:19.0 failed to suspend async: error -2 +[ 430.955581] PM: Some devices failed to suspend, or early wake event detected +[ 430.957709] ACPI : EC: event unblocked + +lead to complete failure: + +[ 432.585002] ------------[ cut here ]------------ +[ 432.585013] WARNING: CPU: 3 PID: 8372 at kernel/irq/manage.c:1478 __free_irq+0x9f/0x280 +[ 432.585015] Trying to free already-free IRQ 20 +[ 432.585016] Modules linked in: cdc_ncm usbnet x86_pkg_temp_thermal intel_powerclamp coretemp mii crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep lpc_ich snd_hda_core snd_pcm mei_me mei sdhci_pci sdhci i915 mmc_core e1000e ptp pps_core prime_numbers +[ 432.585042] CPU: 3 PID: 8372 Comm: kworker/u16:40 Tainted: G U 4.10.0-rc8-CI-Patchwork_3870+ #1 +[ 432.585044] Hardware name: LENOVO 2356GCG/2356GCG, BIOS G7ET31WW (1.13 ) 07/02/2012 +[ 432.585050] Workqueue: events_unbound async_run_entry_fn +[ 432.585051] Call Trace: +[ 432.585058] dump_stack+0x67/0x92 +[ 432.585062] __warn+0xc6/0xe0 +[ 432.585065] warn_slowpath_fmt+0x4a/0x50 +[ 432.585070] ? _raw_spin_lock_irqsave+0x49/0x60 +[ 432.585072] __free_irq+0x9f/0x280 +[ 432.585075] free_irq+0x34/0x80 +[ 432.585089] e1000_free_irq+0x65/0x70 [e1000e] +[ 432.585098] e1000e_pm_freeze+0x7a/0xb0 [e1000e] +[ 432.585106] e1000e_pm_suspend+0x21/0x30 [e1000e] +[ 432.585113] pci_pm_suspend+0x71/0x140 +[ 432.585118] dpm_run_callback+0x6f/0x330 +[ 432.585122] ? pci_pm_freeze+0xe0/0xe0 +[ 432.585125] __device_suspend+0xea/0x330 +[ 432.585128] async_suspend+0x1a/0x90 +[ 432.585132] async_run_entry_fn+0x34/0x160 +[ 432.585137] process_one_work+0x1f4/0x6d0 +[ 432.585140] ? process_one_work+0x16e/0x6d0 +[ 432.585143] worker_thread+0x49/0x4a0 +[ 432.585145] kthread+0x107/0x140 +[ 432.585148] ? process_one_work+0x6d0/0x6d0 +[ 432.585150] ? kthread_create_on_node+0x40/0x40 +[ 432.585154] ret_from_fork+0x2e/0x40 +[ 432.585156] ---[ end trace 6712df7f8c4b9124 ]--- + +The unwind failures stems from commit 2800209994f8 ("e1000e: Refactor PM +flows"), but it may be a later patch that introduced the non-recoverable +behaviour. + +Fixes: 2800209994f8 ("e1000e: Refactor PM flows") +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99847 +Signed-off-by: Chris Wilson +Signed-off-by: Jani Nikula +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -6595,12 +6595,17 @@ static int e1000e_pm_thaw(struct device + static int e1000e_pm_suspend(struct device *dev) + { + struct pci_dev *pdev = to_pci_dev(dev); ++ int rc; + + e1000e_flush_lpic(pdev); + + e1000e_pm_freeze(dev); + +- return __e1000_shutdown(pdev, false); ++ rc = __e1000_shutdown(pdev, false); ++ if (rc) ++ e1000e_pm_thaw(dev); ++ ++ return rc; + } + + static int e1000e_pm_resume(struct device *dev) diff --git a/queue-4.4/edac-mv64x60-fix-an-error-handling-path.patch b/queue-4.4/edac-mv64x60-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..dec2822aba2 --- /dev/null +++ b/queue-4.4/edac-mv64x60-fix-an-error-handling-path.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Christophe JAILLET +Date: Sun, 7 Jan 2018 21:54:00 +0100 +Subject: EDAC, mv64x60: Fix an error handling path + +From: Christophe JAILLET + + +[ Upstream commit 68fa24f9121c04ef146b5158f538c8b32f285be5 ] + +We should not call edac_mc_del_mc() if a corresponding call to +edac_mc_add_mc() has not been performed yet. + +So here, we should go to err instead of err2 to branch at the right +place of the error handling path. + +Signed-off-by: Christophe JAILLET +Cc: linux-edac +Link: http://lkml.kernel.org/r/20180107205400.14068-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/mv64x60_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/mv64x60_edac.c ++++ b/drivers/edac/mv64x60_edac.c +@@ -763,7 +763,7 @@ static int mv64x60_mc_err_probe(struct p + /* Non-ECC RAM? */ + printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__); + res = -ENODEV; +- goto err2; ++ goto err; + } + + edac_dbg(3, "init mci\n"); diff --git a/queue-4.4/ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch b/queue-4.4/ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch new file mode 100644 index 00000000000..8394a70b5d5 --- /dev/null +++ b/queue-4.4/ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch @@ -0,0 +1,54 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Eryu Guan +Date: Wed, 24 May 2017 18:02:20 -0400 +Subject: ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() + +From: Eryu Guan + + +[ Upstream commit 624327f8794704c5066b11a52f9da6a09dce7f9a ] + +ext4_find_unwritten_pgoff() is used to search for offset of hole or +data in page range [index, end] (both inclusive), and the max number +of pages to search should be at least one, if end == index. +Otherwise the only page is missed and no hole or data is found, +which is not correct. + +When block size is smaller than page size, this can be demonstrated +by preallocating a file with size smaller than page size and writing +data to the last block. E.g. run this xfs_io command on a 1k block +size ext4 on x86_64 host. + + # xfs_io -fc "falloc 0 3k" -c "pwrite 2k 1k" \ + -c "seek -d 0" /mnt/ext4/testfile + wrote 1024/1024 bytes at offset 2048 + 1 KiB, 1 ops; 0.0000 sec (42.459 MiB/sec and 43478.2609 ops/sec) + Whence Result + DATA EOF + +Data at offset 2k was missed, and lseek(2) returned ENXIO. + +This is unconvered by generic/285 subtest 07 and 08 on ppc64 host, +where pagesize is 64k. Because a recent change to generic/285 +reduced the preallocated file size to smaller than 64k. + +Signed-off-by: Eryu Guan +Signed-off-by: Theodore Ts'o +Reviewed-by: Jan Kara +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -460,7 +460,7 @@ static int ext4_find_unwritten_pgoff(str + int i, num; + unsigned long nr_pages; + +- num = min_t(pgoff_t, end - index, PAGEVEC_SIZE); ++ num = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1; + nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index, + (pgoff_t)num); + if (nr_pages == 0) diff --git a/queue-4.4/ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch b/queue-4.4/ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch new file mode 100644 index 00000000000..cce8c14918d --- /dev/null +++ b/queue-4.4/ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch @@ -0,0 +1,89 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Konstantin Khlebnikov +Date: Sun, 21 May 2017 22:35:23 -0400 +Subject: ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors + +From: Konstantin Khlebnikov + + +[ Upstream commit 9651e6b2e20648d04d5e1fe6479a3056047e8781 ] + +I've got another report about breaking ext4 by ENOMEM error returned from +ext4_mb_load_buddy() caused by memory shortage in memory cgroup. +This time inside ext4_discard_preallocations(). + +This patch replaces ext4_error() with ext4_warning() where errors returned +from ext4_mb_load_buddy() are not fatal and handled by caller: +* ext4_mb_discard_group_preallocations() - called before generating ENOSPC, + we'll try to discard other group or return ENOSPC into user-space. +* ext4_trim_all_free() - just stop trimming and return ENOMEM from ioctl. + +Some callers cannot handle errors, thus __GFP_NOFAIL is used for them: +* ext4_discard_preallocations() +* ext4_mb_discard_lg_preallocations() + +Fixes: adb7ef600cc9 ("ext4: use __GFP_NOFAIL in ext4_free_blocks()") +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/mballoc.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3874,7 +3874,8 @@ ext4_mb_discard_group_preallocations(str + + err = ext4_mb_load_buddy(sb, group, &e4b); + if (err) { +- ext4_error(sb, "Error loading buddy information for %u", group); ++ ext4_warning(sb, "Error %d loading buddy information for %u", ++ err, group); + put_bh(bitmap_bh); + return 0; + } +@@ -4031,10 +4032,11 @@ repeat: + BUG_ON(pa->pa_type != MB_INODE_PA); + group = ext4_get_group_number(sb, pa->pa_pstart); + +- err = ext4_mb_load_buddy(sb, group, &e4b); ++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b, ++ GFP_NOFS|__GFP_NOFAIL); + if (err) { +- ext4_error(sb, "Error loading buddy information for %u", +- group); ++ ext4_error(sb, "Error %d loading buddy information for %u", ++ err, group); + continue; + } + +@@ -4290,11 +4292,14 @@ ext4_mb_discard_lg_preallocations(struct + spin_unlock(&lg->lg_prealloc_lock); + + list_for_each_entry_safe(pa, tmp, &discard_list, u.pa_tmp_list) { ++ int err; + + group = ext4_get_group_number(sb, pa->pa_pstart); +- if (ext4_mb_load_buddy(sb, group, &e4b)) { +- ext4_error(sb, "Error loading buddy information for %u", +- group); ++ err = ext4_mb_load_buddy_gfp(sb, group, &e4b, ++ GFP_NOFS|__GFP_NOFAIL); ++ if (err) { ++ ext4_error(sb, "Error %d loading buddy information for %u", ++ err, group); + continue; + } + ext4_lock_group(sb, group); +@@ -5116,8 +5121,8 @@ ext4_trim_all_free(struct super_block *s + + ret = ext4_mb_load_buddy(sb, group, &e4b); + if (ret) { +- ext4_error(sb, "Error in loading buddy " +- "information for %u", group); ++ ext4_warning(sb, "Error %d loading buddy information for %u", ++ ret, group); + return ret; + } + bitmap = e4b.bd_bitmap; diff --git a/queue-4.4/fix-loop-device-flush-before-configure-v3.patch b/queue-4.4/fix-loop-device-flush-before-configure-v3.patch new file mode 100644 index 00000000000..c37a0b9d1e4 --- /dev/null +++ b/queue-4.4/fix-loop-device-flush-before-configure-v3.patch @@ -0,0 +1,66 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: James Wang +Date: Thu, 8 Jun 2017 14:52:51 +0800 +Subject: Fix loop device flush before configure v3 + +From: James Wang + + +[ Upstream commit 6460495709aeb651896bc8e5c134b2e4ca7d34a8 ] + +While installing SLES-12 (based on v4.4), I found that the installer +will stall for 60+ seconds during LVM disk scan. The root cause was +determined to be the removal of a bound device check in loop_flush() +by commit b5dd2f6047ca ("block: loop: improve performance via blk-mq"). + +Restoring this check, examining ->lo_state as set by loop_set_fd() +eliminates the bad behavior. + +Test method: +modprobe loop max_loop=64 +dd if=/dev/zero of=disk bs=512 count=200K +for((i=0;i<4;i++))do losetup -f disk; done +mkfs.ext4 -F /dev/loop0 +for((i=0;i<4;i++))do mkdir t$i; mount /dev/loop$i t$i;done +for f in `ls /dev/loop[0-9]*|sort`; do \ + echo $f; dd if=$f of=/dev/null bs=512 count=1; \ + done + +Test output: stock patched +/dev/loop0 18.1217e-05 8.3842e-05 +/dev/loop1 6.1114e-05 0.000147979 +/dev/loop10 0.414701 0.000116564 +/dev/loop11 0.7474 6.7942e-05 +/dev/loop12 0.747986 8.9082e-05 +/dev/loop13 0.746532 7.4799e-05 +/dev/loop14 0.480041 9.3926e-05 +/dev/loop15 1.26453 7.2522e-05 + +Note that from loop10 onward, the device is not mounted, yet the +stock kernel consumes several orders of magnitude more wall time +than it does for a mounted device. +(Thanks for Mike Galbraith , give a changelog review.) + +Reviewed-by: Hannes Reinecke +Reviewed-by: Ming Lei +Signed-off-by: James Wang +Fixes: b5dd2f6047ca ("block: loop: improve performance via blk-mq") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/loop.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -623,6 +623,9 @@ static int loop_switch(struct loop_devic + */ + static int loop_flush(struct loop_device *lo) + { ++ /* loop not yet configured, no running thread, nothing to flush */ ++ if (lo->lo_state != Lo_bound) ++ return 0; + return loop_switch(lo, NULL); + } + diff --git a/queue-4.4/fix-race-in-drivers-char-random.c-get_reg.patch b/queue-4.4/fix-race-in-drivers-char-random.c-get_reg.patch new file mode 100644 index 00000000000..39a5fe52352 --- /dev/null +++ b/queue-4.4/fix-race-in-drivers-char-random.c-get_reg.patch @@ -0,0 +1,49 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Michael Schmitz +Date: Sun, 30 Apr 2017 19:49:21 +1200 +Subject: fix race in drivers/char/random.c:get_reg() + +From: Michael Schmitz + + +[ Upstream commit 9dfa7bba35ac08a63565d58c454dccb7e1bb0a08 ] + +get_reg() can be reentered on architectures with prioritized interrupts +(m68k in this case), causing f->reg_index to be incremented after the +range check. Out of bounds memory access past the pt_regs struct results. +This will go mostly undetected unless access is beyond end of memory. + +Prevent the race by disabling interrupts in get_reg(). + +Tested on m68k (Atari Falcon, and ARAnyM emulator). + +Kudos to Geert Uytterhoeven for helping to trace this race. + +Signed-off-by: Michael Schmitz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/random.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -886,12 +886,16 @@ static void add_interrupt_bench(cycles_t + static __u32 get_reg(struct fast_pool *f, struct pt_regs *regs) + { + __u32 *ptr = (__u32 *) regs; ++ unsigned long flags; + + if (regs == NULL) + return 0; ++ local_irq_save(flags); + if (f->reg_idx >= sizeof(struct pt_regs) / sizeof(__u32)) + f->reg_idx = 0; +- return *(ptr + f->reg_idx++); ++ ptr += f->reg_idx++; ++ local_irq_restore(flags); ++ return *ptr; + } + + void add_interrupt_randomness(int irq, int irq_flags) diff --git a/queue-4.4/fix-serial-console-on-sni-rm400-machines.patch b/queue-4.4/fix-serial-console-on-sni-rm400-machines.patch new file mode 100644 index 00000000000..00cb26867a9 --- /dev/null +++ b/queue-4.4/fix-serial-console-on-sni-rm400-machines.patch @@ -0,0 +1,51 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Thomas Bogendoerfer +Date: Wed, 31 May 2017 22:21:03 +0200 +Subject: Fix serial console on SNI RM400 machines + +From: Thomas Bogendoerfer + + +[ Upstream commit e279e6d98e0cf2c2fe008b3c29042b92f0e17b1d ] + +sccnxp driver doesn't get the correct uart clock rate, if CONFIG_HAVE_CLOCK +is disabled. Correct usage of clk API to make it work with/without it. + +Fixes: 90efa75f7ab0 (serial: sccnxp: Using CLK API for getting UART clock) + +Suggested-by: Russell King - ARM Linux +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sccnxp.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/tty/serial/sccnxp.c ++++ b/drivers/tty/serial/sccnxp.c +@@ -884,14 +884,19 @@ static int sccnxp_probe(struct platform_ + + clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(clk)) { +- if (PTR_ERR(clk) == -EPROBE_DEFER) { +- ret = -EPROBE_DEFER; ++ ret = PTR_ERR(clk); ++ if (ret == -EPROBE_DEFER) + goto err_out; +- } ++ uartclk = 0; ++ } else { ++ clk_prepare_enable(clk); ++ uartclk = clk_get_rate(clk); ++ } ++ ++ if (!uartclk) { + dev_notice(&pdev->dev, "Using default clock frequency\n"); + uartclk = s->chip->freq_std; +- } else +- uartclk = clk_get_rate(clk); ++ } + + /* Check input frequency */ + if ((uartclk < s->chip->freq_min) || (uartclk > s->chip->freq_max)) { diff --git a/queue-4.4/gpio-label-descriptors-using-the-device-name.patch b/queue-4.4/gpio-label-descriptors-using-the-device-name.patch new file mode 100644 index 00000000000..d96e6def495 --- /dev/null +++ b/queue-4.4/gpio-label-descriptors-using-the-device-name.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Linus Walleij +Date: Thu, 4 Jan 2018 22:31:11 +0100 +Subject: gpio: label descriptors using the device name + +From: Linus Walleij + + +[ Upstream commit 24e78079bf2250874e33da2e7cfbb6db72d3caf4 ] + +Some GPIO lines appear named "?" in the lsgpio dump due to their +requesting drivers not passing a reasonable label. + +Most typically this happens if a device tree node just defines +gpios = <...> and not foo-gpios = <...>, the former gets named +"foo" and the latter gets named "?". + +However the struct device passed in is always valid so let's +just label the GPIO with dev_name() on the device if no proper +label was passed. + +Cc: Reported-by: Jason Kridner +Reported-by: Jason Kridner +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpiolib.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2145,7 +2145,8 @@ struct gpio_desc *__must_check gpiod_get + return desc; + } + +- status = gpiod_request(desc, con_id); ++ /* If a connection label was passed use that, else use the device name as label */ ++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev)); + if (status < 0) + return ERR_PTR(status); + diff --git a/queue-4.4/hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch b/queue-4.4/hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch new file mode 100644 index 00000000000..55abbd192f7 --- /dev/null +++ b/queue-4.4/hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Firo Yang +Date: Fri, 26 May 2017 22:37:38 +0800 +Subject: hdlcdrv: Fix divide by zero in hdlcdrv_ioctl + +From: Firo Yang + + +[ Upstream commit fb3ce90b7d7761b6f7f28f0ff5c456ef6b5229a1 ] + +syszkaller fuzzer triggered a divide by zero, when set calibration +through ioctl(). + +To fix it, test 'bitrate' if it is negative or 0, just return -EINVAL. + +Reported-by: Andrey Konovalov +Signed-off-by: Firo Yang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hamradio/hdlcdrv.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/hamradio/hdlcdrv.c ++++ b/drivers/net/hamradio/hdlcdrv.c +@@ -574,6 +574,8 @@ static int hdlcdrv_ioctl(struct net_devi + case HDLCDRVCTL_CALIBRATE: + if(!capable(CAP_SYS_RAWIO)) + return -EPERM; ++ if (s->par.bitrate <= 0) ++ return -EINVAL; + if (bi.data.calibrate > INT_MAX / s->par.bitrate) + return -EINVAL; + s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16; diff --git a/queue-4.4/hwmon-ina2xx-make-calibration-register-value-fixed.patch b/queue-4.4/hwmon-ina2xx-make-calibration-register-value-fixed.patch new file mode 100644 index 00000000000..cf3ff3a84a8 --- /dev/null +++ b/queue-4.4/hwmon-ina2xx-make-calibration-register-value-fixed.patch @@ -0,0 +1,214 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Maciej Purski +Date: Wed, 22 Nov 2017 16:32:15 +0100 +Subject: hwmon: (ina2xx) Make calibration register value fixed + +From: Maciej Purski + + +[ Upstream commit 5d389b125186cf254ad5b8015763ac07c151aea4 ] + +Calibration register is used for calculating current register in +hardware according to datasheet: +current = shunt_volt * calib_register / 2048 (ina 226) +current = shunt_volt * calib_register / 4096 (ina 219) + +Fix calib_register value to 2048 for ina226 and 4096 for ina 219 in +order to avoid truncation error and provide best precision allowed +by shunt_voltage measurement. Make current scale value follow changes +of shunt_resistor from sysfs as calib_register value is now fixed. + +Power_lsb value should also follow shunt_resistor changes as stated in +datasheet: +power_lsb = 25 * current_lsb (ina 226) +power_lsb = 20 * current_lsb (ina 219) + +Signed-off-by: Maciej Purski +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/ina2xx.c | 87 ++++++++++++++++++++++++++++--------------------- + 1 file changed, 50 insertions(+), 37 deletions(-) + +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -94,18 +94,20 @@ enum ina2xx_ids { ina219, ina226 }; + + struct ina2xx_config { + u16 config_default; +- int calibration_factor; ++ int calibration_value; + int registers; + int shunt_div; + int bus_voltage_shift; + int bus_voltage_lsb; /* uV */ +- int power_lsb; /* uW */ ++ int power_lsb_factor; + }; + + struct ina2xx_data { + const struct ina2xx_config *config; + + long rshunt; ++ long current_lsb_uA; ++ long power_lsb_uW; + struct mutex config_lock; + struct regmap *regmap; + +@@ -115,21 +117,21 @@ struct ina2xx_data { + static const struct ina2xx_config ina2xx_config[] = { + [ina219] = { + .config_default = INA219_CONFIG_DEFAULT, +- .calibration_factor = 40960000, ++ .calibration_value = 4096, + .registers = INA219_REGISTERS, + .shunt_div = 100, + .bus_voltage_shift = 3, + .bus_voltage_lsb = 4000, +- .power_lsb = 20000, ++ .power_lsb_factor = 20, + }, + [ina226] = { + .config_default = INA226_CONFIG_DEFAULT, +- .calibration_factor = 5120000, ++ .calibration_value = 2048, + .registers = INA226_REGISTERS, + .shunt_div = 400, + .bus_voltage_shift = 0, + .bus_voltage_lsb = 1250, +- .power_lsb = 25000, ++ .power_lsb_factor = 25, + }, + }; + +@@ -168,12 +170,16 @@ static u16 ina226_interval_to_reg(int in + return INA226_SHIFT_AVG(avg_bits); + } + ++/* ++ * Calibration register is set to the best value, which eliminates ++ * truncation errors on calculating current register in hardware. ++ * According to datasheet (eq. 3) the best values are 2048 for ++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value. ++ */ + static int ina2xx_calibrate(struct ina2xx_data *data) + { +- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- data->rshunt); +- +- return regmap_write(data->regmap, INA2XX_CALIBRATION, val); ++ return regmap_write(data->regmap, INA2XX_CALIBRATION, ++ data->config->calibration_value); + } + + /* +@@ -186,10 +192,6 @@ static int ina2xx_init(struct ina2xx_dat + if (ret < 0) + return ret; + +- /* +- * Set current LSB to 1mA, shunt is in uOhms +- * (equation 13 in datasheet). +- */ + return ina2xx_calibrate(data); + } + +@@ -267,15 +269,15 @@ static int ina2xx_get_value(struct ina2x + val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_POWER: +- val = regval * data->config->power_lsb; ++ val = regval * data->power_lsb_uW; + break; + case INA2XX_CURRENT: +- /* signed register, LSB=1mA (selected), in mA */ +- val = (s16)regval; ++ /* signed register, result in mA */ ++ val = regval * data->current_lsb_uA; ++ val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_CALIBRATION: +- val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- regval); ++ val = regval; + break; + default: + /* programmer goofed */ +@@ -303,9 +305,32 @@ static ssize_t ina2xx_show_value(struct + ina2xx_get_value(data, attr->index, regval)); + } + +-static ssize_t ina2xx_set_shunt(struct device *dev, +- struct device_attribute *da, +- const char *buf, size_t count) ++/* ++ * In order to keep calibration register value fixed, the product ++ * of current_lsb and shunt_resistor should also be fixed and equal ++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order ++ * to keep the scale. ++ */ ++static int ina2xx_set_shunt(struct ina2xx_data *data, long val) ++{ ++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000, ++ data->config->shunt_div); ++ if (val <= 0 || val > dividend) ++ return -EINVAL; ++ ++ mutex_lock(&data->config_lock); ++ data->rshunt = val; ++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val); ++ data->power_lsb_uW = data->config->power_lsb_factor * ++ data->current_lsb_uA; ++ mutex_unlock(&data->config_lock); ++ ++ return 0; ++} ++ ++static ssize_t ina2xx_store_shunt(struct device *dev, ++ struct device_attribute *da, ++ const char *buf, size_t count) + { + unsigned long val; + int status; +@@ -315,18 +340,9 @@ static ssize_t ina2xx_set_shunt(struct d + if (status < 0) + return status; + +- if (val == 0 || +- /* Values greater than the calibration factor make no sense. */ +- val > data->config->calibration_factor) +- return -EINVAL; +- +- mutex_lock(&data->config_lock); +- data->rshunt = val; +- status = ina2xx_calibrate(data); +- mutex_unlock(&data->config_lock); ++ status = ina2xx_set_shunt(data, val); + if (status < 0) + return status; +- + return count; + } + +@@ -386,7 +402,7 @@ static SENSOR_DEVICE_ATTR(power1_input, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_set_shunt, ++ ina2xx_show_value, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +@@ -441,10 +457,7 @@ static int ina2xx_probe(struct i2c_clien + val = INA2XX_RSHUNT_DEFAULT; + } + +- if (val <= 0 || val > data->config->calibration_factor) +- return -ENODEV; +- +- data->rshunt = val; ++ ina2xx_set_shunt(data, val); + + ina2xx_regmap_config.max_register = data->config->registers; + diff --git a/queue-4.4/ib-srpt-fix-abort-handling.patch b/queue-4.4/ib-srpt-fix-abort-handling.patch new file mode 100644 index 00000000000..58226487eda --- /dev/null +++ b/queue-4.4/ib-srpt-fix-abort-handling.patch @@ -0,0 +1,49 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Bart Van Assche +Date: Thu, 4 May 2017 15:50:53 -0700 +Subject: IB/srpt: Fix abort handling + +From: Bart Van Assche + + +[ Upstream commit 55d694275f41a1c0eef4ef49044ff29bc3999490 ] + +Let the target core check the CMD_T_ABORTED flag instead of the SRP +target driver. Hence remove the transport_check_aborted_status() +call. Since state == SRPT_STATE_CMD_RSP_SENT is something that really +should not happen, do not try to recover if srpt_queue_response() is +called for an I/O context that is in that state. This patch is a bug +fix because the srpt_abort_cmd() call is misplaced - if that function +is called from srpt_queue_response() it should either be called +before the command state is changed or after the response has been +sent. + +Signed-off-by: Bart Van Assche +Reviewed-by: Hannes Reinecke +Cc: Doug Ledford +Cc: Christoph Hellwig +Cc: Andy Grover +Cc: David Disseldorp +Signed-off-by: Nicholas Bellinger +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -2974,12 +2974,8 @@ static void srpt_queue_response(struct s + } + spin_unlock_irqrestore(&ioctx->spinlock, flags); + +- if (unlikely(transport_check_aborted_status(&ioctx->cmd, false) +- || WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) { +- atomic_inc(&ch->req_lim_delta); +- srpt_abort_cmd(ioctx); ++ if (unlikely(WARN_ON_ONCE(state == SRPT_STATE_CMD_RSP_SENT))) + return; +- } + + dir = ioctx->cmd.data_direction; + diff --git a/queue-4.4/iio-hi8435-avoid-garbage-event-at-first-enable.patch b/queue-4.4/iio-hi8435-avoid-garbage-event-at-first-enable.patch new file mode 100644 index 00000000000..f34156dd41f --- /dev/null +++ b/queue-4.4/iio-hi8435-avoid-garbage-event-at-first-enable.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Nikita Yushchenko +Date: Fri, 19 May 2017 17:48:00 +0300 +Subject: iio: hi8435: avoid garbage event at first enable + +From: Nikita Yushchenko + + +[ Upstream commit ee19ac340c5fdfd89c6348be4563453c61ab54a9 ] + +Currently, driver generates events for channels if new reading differs +from previous one. This "previous value" is initialized to zero, which +results into event if value is constant-one. + +Fix that by initializing "previous value" by reading at event enable +time. + +This provides reliable sequence for userspace: +- enable event, +- AFTER THAT read current value, +- AFTER THAT each event will correspond to change. + +Signed-off-by: Nikita Yushchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/hi8435.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/iio/adc/hi8435.c ++++ b/drivers/iio/adc/hi8435.c +@@ -121,10 +121,21 @@ static int hi8435_write_event_config(str + enum iio_event_direction dir, int state) + { + struct hi8435_priv *priv = iio_priv(idev); ++ int ret; ++ u32 tmp; ++ ++ if (state) { ++ ret = hi8435_readl(priv, HI8435_SO31_0_REG, &tmp); ++ if (ret < 0) ++ return ret; ++ if (tmp & BIT(chan->channel)) ++ priv->event_prev_val |= BIT(chan->channel); ++ else ++ priv->event_prev_val &= ~BIT(chan->channel); + +- priv->event_scan_mask &= ~BIT(chan->channel); +- if (state) + priv->event_scan_mask |= BIT(chan->channel); ++ } else ++ priv->event_scan_mask &= ~BIT(chan->channel); + + return 0; + } diff --git a/queue-4.4/iio-hi8435-cleanup-reset-gpio.patch b/queue-4.4/iio-hi8435-cleanup-reset-gpio.patch new file mode 100644 index 00000000000..c4c5755913b --- /dev/null +++ b/queue-4.4/iio-hi8435-cleanup-reset-gpio.patch @@ -0,0 +1,54 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Nikita Yushchenko +Date: Fri, 19 May 2017 17:48:02 +0300 +Subject: iio: hi8435: cleanup reset gpio + +From: Nikita Yushchenko + + +[ Upstream commit 61305664a542f874283f74bf0b27ddb31f5045d7 ] + +Reset GPIO is active low. + +Currently driver uses gpiod_set_value(1) to clean reset, which depends +on device tree to contain GPIO_ACTIVE_HIGH - that does not match reality. + +This fixes driver to use _raw version of gpiod_set_value() to enforce +active-low semantics despite of what's written in device tree. Allowing +device tree to override that only opens possibility for errors and does +not add any value. + +Additionally, use _cansleep version to make things work with i2c-gpio +and other sleeping gpio drivers. + +Signed-off-by: Nikita Yushchenko +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/hi8435.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/iio/adc/hi8435.c ++++ b/drivers/iio/adc/hi8435.c +@@ -453,13 +453,15 @@ static int hi8435_probe(struct spi_devic + priv->spi = spi; + + reset_gpio = devm_gpiod_get(&spi->dev, NULL, GPIOD_OUT_LOW); +- if (IS_ERR(reset_gpio)) { +- /* chip s/w reset if h/w reset failed */ ++ if (!IS_ERR(reset_gpio)) { ++ /* need >=100ns low pulse to reset chip */ ++ gpiod_set_raw_value_cansleep(reset_gpio, 0); ++ udelay(1); ++ gpiod_set_raw_value_cansleep(reset_gpio, 1); ++ } else { ++ /* s/w reset chip if h/w reset is not available */ + hi8435_writeb(priv, HI8435_CTRL_REG, HI8435_CTRL_SRST); + hi8435_writeb(priv, HI8435_CTRL_REG, 0); +- } else { +- udelay(5); +- gpiod_set_value(reset_gpio, 1); + } + + spi_set_drvdata(spi, idev); diff --git a/queue-4.4/iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch b/queue-4.4/iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch new file mode 100644 index 00000000000..4b8753c04f0 --- /dev/null +++ b/queue-4.4/iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch @@ -0,0 +1,33 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Lorenzo Bianconi +Date: Tue, 6 Jun 2017 22:51:24 +0200 +Subject: iio: magnetometer: st_magn_spi: fix spi_device_id table + +From: Lorenzo Bianconi + + +[ Upstream commit c83761ff0aac954aa368c623bb0f0d1a3214e834 ] + +Remove LSM303DLHC, LSM303DLM from st_magn_id_table since LSM303DL series +does not support spi interface + +Fixes: 872e79add756 (iio: magn: Add STMicroelectronics magn driver) +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/st_magn_spi.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/iio/magnetometer/st_magn_spi.c ++++ b/drivers/iio/magnetometer/st_magn_spi.c +@@ -48,8 +48,6 @@ static int st_magn_spi_remove(struct spi + } + + static const struct spi_device_id st_magn_id_table[] = { +- { LSM303DLHC_MAGN_DEV_NAME }, +- { LSM303DLM_MAGN_DEV_NAME }, + { LIS3MDL_MAGN_DEV_NAME }, + { LSM303AGR_MAGN_DEV_NAME }, + {}, diff --git a/queue-4.4/input-elan_i2c-check-if-device-is-there-before-really-probing.patch b/queue-4.4/input-elan_i2c-check-if-device-is-there-before-really-probing.patch new file mode 100644 index 00000000000..f0721de31f0 --- /dev/null +++ b/queue-4.4/input-elan_i2c-check-if-device-is-there-before-really-probing.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dmitry Torokhov +Date: Fri, 19 Dec 2014 12:57:49 -0800 +Subject: Input: elan_i2c - check if device is there before really probing + +From: Dmitry Torokhov + + +[ Upstream commit c5928551fd41b2eecdad78fa2be2a4a13ed5fde9 ] + +Before trying to properly initialize the touchpad and generate bunch of +errors, let's first see it there is anything at the given address. If we +get error, fail silently with -ENXIO. + +Reviewed-by: Guenter Roeck +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/elan_i2c_core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1082,6 +1082,13 @@ static int elan_probe(struct i2c_client + return error; + } + ++ /* Make sure there is something at this address */ ++ error = i2c_smbus_read_byte(client); ++ if (error < 0) { ++ dev_dbg(&client->dev, "nothing at this address: %d\n", error); ++ return -ENXIO; ++ } ++ + /* Initialize the touchpad. */ + error = elan_initialize(data); + if (error) diff --git a/queue-4.4/input-elan_i2c-clear-int-before-resetting-controller.patch b/queue-4.4/input-elan_i2c-clear-int-before-resetting-controller.patch new file mode 100644 index 00000000000..bdc3dcc7cb0 --- /dev/null +++ b/queue-4.4/input-elan_i2c-clear-int-before-resetting-controller.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: KT Liao +Date: Thu, 25 May 2017 10:06:21 -0700 +Subject: Input: elan_i2c - clear INT before resetting controller + +From: KT Liao + + +[ Upstream commit 4b3c7dbbfff0673e8a89575414b864d8b001d3bb ] + +Some old touchpad FWs need to have interrupt cleared before issuing reset +command after updating firmware. We clear interrupt by attempting to read +full report from the controller, and discarding any data read. + +Signed-off-by: KT Liao +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/elan_i2c_i2c.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/input/mouse/elan_i2c_i2c.c ++++ b/drivers/input/mouse/elan_i2c_i2c.c +@@ -557,7 +557,14 @@ static int elan_i2c_finish_fw_update(str + long ret; + int error; + int len; +- u8 buffer[ETP_I2C_INF_LENGTH]; ++ u8 buffer[ETP_I2C_REPORT_LEN]; ++ ++ len = i2c_master_recv(client, buffer, ETP_I2C_REPORT_LEN); ++ if (len != ETP_I2C_REPORT_LEN) { ++ error = len < 0 ? len : -EIO; ++ dev_warn(dev, "failed to read I2C data after FW WDT reset: %d (%d)\n", ++ error, len); ++ } + + reinit_completion(completion); + enable_irq(client->irq); diff --git a/queue-4.4/input-elantech-force-relative-mode-on-a-certain-module.patch b/queue-4.4/input-elantech-force-relative-mode-on-a-certain-module.patch new file mode 100644 index 00000000000..a5f0493c335 --- /dev/null +++ b/queue-4.4/input-elantech-force-relative-mode-on-a-certain-module.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: KT Liao +Date: Mon, 12 Dec 2016 11:03:42 -0800 +Subject: Input: elantech - force relative mode on a certain module + +From: KT Liao + + +[ Upstream commit d899520b0431e70279bfb5066ecb6dc91d0b7072 ] + +One of Elan modules with sample version is 0x74 and hw_version is 0x03 has +a bug in absolute mode implementation, so let it run in default PS/2 +relative mode. + +Signed-off-by: KT Liao +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/mouse/elantech.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1715,6 +1715,17 @@ int elantech_init(struct psmouse *psmous + etd->samples[0], etd->samples[1], etd->samples[2]); + } + ++ if (etd->samples[1] == 0x74 && etd->hw_version == 0x03) { ++ /* ++ * This module has a bug which makes absolute mode ++ * unusable, so let's abort so we'll be using standard ++ * PS/2 protocol. ++ */ ++ psmouse_info(psmouse, ++ "absolute mode broken, forcing standard PS/2 protocol\n"); ++ goto init_fail; ++ } ++ + if (elantech_set_absolute_mode(psmouse)) { + psmouse_err(psmouse, + "failed to put touchpad into absolute mode.\n"); diff --git a/queue-4.4/ipmi_ssif-unlock-on-allocation-failure.patch b/queue-4.4/ipmi_ssif-unlock-on-allocation-failure.patch new file mode 100644 index 00000000000..6b5b66d7d2c --- /dev/null +++ b/queue-4.4/ipmi_ssif-unlock-on-allocation-failure.patch @@ -0,0 +1,39 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Fri, 5 May 2017 08:33:24 +0300 +Subject: ipmi_ssif: unlock on allocation failure + +From: Dan Carpenter + + +[ Upstream commit cf9806f32ef63b745f2486e0dbb2ac21f4ca44f0 ] + +We should unlock and re-enable IRQs if this allocation fails. + +Fixes: 259307074bfc ("ipmi: Add SMBus interface driver (SSIF) ") +Signed-off-by: Dan Carpenter +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/ipmi/ipmi_ssif.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -409,6 +409,7 @@ static void start_event_fetch(struct ssi + msg = ipmi_alloc_smi_msg(); + if (!msg) { + ssif_info->ssif_state = SSIF_NORMAL; ++ ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } + +@@ -431,6 +432,7 @@ static void start_recv_msg_fetch(struct + msg = ipmi_alloc_smi_msg(); + if (!msg) { + ssif_info->ssif_state = SSIF_NORMAL; ++ ipmi_ssif_unlock_cond(ssif_info, flags); + return; + } + diff --git a/queue-4.4/ipsec-check-return-value-of-skb_to_sgvec-always.patch b/queue-4.4/ipsec-check-return-value-of-skb_to_sgvec-always.patch new file mode 100644 index 00000000000..d6332dc6839 --- /dev/null +++ b/queue-4.4/ipsec-check-return-value-of-skb_to_sgvec-always.patch @@ -0,0 +1,129 @@ +From 3f29770723fe498a5c5f57c3a31a996ebdde03e1 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Sun, 4 Jun 2017 04:16:23 +0200 +Subject: ipsec: check return value of skb_to_sgvec always + +From: Jason A. Donenfeld + +commit 3f29770723fe498a5c5f57c3a31a996ebdde03e1 upstream. + +Signed-off-by: Jason A. Donenfeld +Cc: Steffen Klassert +Cc: Herbert Xu +Cc: "David S. Miller" +Signed-off-by: David S. Miller +[natechancellor: Adjusted context due to lack of fca11ebde3f0] +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ah4.c | 8 ++++++-- + net/ipv4/esp4.c | 13 ++++++++----- + net/ipv6/ah6.c | 8 ++++++-- + net/ipv6/esp6.c | 12 ++++++++---- + 4 files changed, 28 insertions(+), 13 deletions(-) + +--- a/net/ipv4/ah4.c ++++ b/net/ipv4/ah4.c +@@ -220,7 +220,9 @@ static int ah_output(struct xfrm_state * + ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +@@ -393,7 +395,9 @@ static int ah_input(struct xfrm_state *x + skb_push(skb, ihl); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -268,10 +268,11 @@ static int esp_output(struct xfrm_state + esph->spi = x->id.spi; + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, +- (unsigned char *)esph - skb->data, +- assoclen + ivlen + clen + alen); +- ++ err = skb_to_sgvec(skb, sg, ++ (unsigned char *)esph - skb->data, ++ assoclen + ivlen + clen + alen); ++ if (unlikely(err < 0)) ++ goto error; + aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); + aead_request_set_ad(req, assoclen); + +@@ -481,7 +482,9 @@ static int esp_input(struct xfrm_state * + } + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ err = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out; + + aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); + aead_request_set_ad(req, assoclen); +--- a/net/ipv6/ah6.c ++++ b/net/ipv6/ah6.c +@@ -423,7 +423,9 @@ static int ah6_output(struct xfrm_state + ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.low); + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +@@ -603,7 +605,9 @@ static int ah6_input(struct xfrm_state * + ip6h->hop_limit = 0; + + sg_init_table(sg, nfrags + sglists); +- skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ err = skb_to_sgvec_nomark(skb, sg, 0, skb->len); ++ if (unlikely(err < 0)) ++ goto out_free; + + if (x->props.flags & XFRM_STATE_ESN) { + /* Attach seqhi sg right after packet payload */ +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -248,9 +248,11 @@ static int esp6_output(struct xfrm_state + esph->spi = x->id.spi; + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, +- (unsigned char *)esph - skb->data, +- assoclen + ivlen + clen + alen); ++ err = skb_to_sgvec(skb, sg, ++ (unsigned char *)esph - skb->data, ++ assoclen + ivlen + clen + alen); ++ if (unlikely(err < 0)) ++ goto error; + + aead_request_set_crypt(req, sg, sg, ivlen + clen, iv); + aead_request_set_ad(req, assoclen); +@@ -423,7 +425,9 @@ static int esp6_input(struct xfrm_state + } + + sg_init_table(sg, nfrags); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ ret = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(ret < 0)) ++ goto out; + + aead_request_set_crypt(req, sg, sg, elen + ivlen, iv); + aead_request_set_ad(req, assoclen); diff --git a/queue-4.4/ipv6-avoid-dad-failures-for-addresses-with-nodad.patch b/queue-4.4/ipv6-avoid-dad-failures-for-addresses-with-nodad.patch new file mode 100644 index 00000000000..6cf8ab36ae3 --- /dev/null +++ b/queue-4.4/ipv6-avoid-dad-failures-for-addresses-with-nodad.patch @@ -0,0 +1,45 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Mahesh Bandewar +Date: Fri, 12 May 2017 17:03:39 -0700 +Subject: ipv6: avoid dad-failures for addresses with NODAD + +From: Mahesh Bandewar + + +[ Upstream commit 66eb9f86e50547ec2a8ff7a75997066a74ef584b ] + +Every address gets added with TENTATIVE flag even for the addresses with +IFA_F_NODAD flag and dad-work is scheduled for them. During this DAD process +we realize it's an address with NODAD and complete the process without +sending any probe. However the TENTATIVE flags stays on the +address for sometime enough to cause misinterpretation when we receive a NS. +While processing NS, if the address has TENTATIVE flag, we mark it DADFAILED +and endup with an address that was originally configured as NODAD with +DADFAILED. + +We can't avoid scheduling dad_work for addresses with NODAD but we can +avoid adding TENTATIVE flag to avoid this racy situation. + +Signed-off-by: Mahesh Bandewar +Acked-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/addrconf.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -957,7 +957,10 @@ ipv6_add_addr(struct inet6_dev *idev, co + INIT_HLIST_NODE(&ifa->addr_lst); + ifa->scope = scope; + ifa->prefix_len = pfxlen; +- ifa->flags = flags | IFA_F_TENTATIVE; ++ ifa->flags = flags; ++ /* No need to add the TENTATIVE flag for addresses with NODAD */ ++ if (!(flags & IFA_F_NODAD)) ++ ifa->flags |= IFA_F_TENTATIVE; + ifa->valid_lft = valid_lft; + ifa->prefered_lft = prefered_lft; + ifa->cstamp = ifa->tstamp = jiffies; diff --git a/queue-4.4/kvm-nvmx-fix-handling-of-lmsw-instruction.patch b/queue-4.4/kvm-nvmx-fix-handling-of-lmsw-instruction.patch new file mode 100644 index 00000000000..a17ce332931 --- /dev/null +++ b/queue-4.4/kvm-nvmx-fix-handling-of-lmsw-instruction.patch @@ -0,0 +1,58 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Jan H. Schönherr" +Date: Sat, 20 May 2017 13:22:56 +0200 +Subject: KVM: nVMX: Fix handling of lmsw instruction + +From: "Jan H. Schönherr" + + +[ Upstream commit e1d39b17e044e8ae819827810d87d809ba5f58c0 ] + +The decision whether or not to exit from L2 to L1 on an lmsw instruction is +based on bogus values: instead of using the information encoded within the +exit qualification, it uses the data also used for the mov-to-cr +instruction, which boils down to using whatever is in %eax at that point. + +Use the correct values instead. + +Without this fix, an L1 may not get notified when a 32-bit Linux L2 +switches its secondary CPUs to protected mode; the L1 is only notified on +the next modification of CR0. This short time window poses a problem, when +there is some other reason to exit to L1 in between. Then, L2 will be +resumed in real mode and chaos ensues. + +Signed-off-by: Jan H. Schönherr +Reviewed-by: Wanpeng Li +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/vmx.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7657,11 +7657,13 @@ static bool nested_vmx_exit_handled_cr(s + { + unsigned long exit_qualification = vmcs_readl(EXIT_QUALIFICATION); + int cr = exit_qualification & 15; +- int reg = (exit_qualification >> 8) & 15; +- unsigned long val = kvm_register_readl(vcpu, reg); ++ int reg; ++ unsigned long val; + + switch ((exit_qualification >> 4) & 3) { + case 0: /* mov to cr */ ++ reg = (exit_qualification >> 8) & 15; ++ val = kvm_register_readl(vcpu, reg); + switch (cr) { + case 0: + if (vmcs12->cr0_guest_host_mask & +@@ -7716,6 +7718,7 @@ static bool nested_vmx_exit_handled_cr(s + * lmsw can change bits 1..3 of cr0, and only set bit 0 of + * cr0. Other attempted changes are ignored, with no exit. + */ ++ val = (exit_qualification >> LMSW_SOURCE_DATA_SHIFT) & 0x0f; + if (vmcs12->cr0_guest_host_mask & 0xe & + (val ^ vmcs12->cr0_read_shadow)) + return true; diff --git a/queue-4.4/kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch b/queue-4.4/kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch new file mode 100644 index 00000000000..e78f943e606 --- /dev/null +++ b/queue-4.4/kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch @@ -0,0 +1,138 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Paul Mackerras +Date: Thu, 11 May 2017 11:33:30 +1000 +Subject: KVM: PPC: Book3S PR: Check copy_to/from_user return values + +From: Paul Mackerras + + +[ Upstream commit 67325e988faea735d663799b6d152b5f4254093c ] + +The PR KVM implementation of the PAPR HPT hypercalls (H_ENTER etc.) +access an image of the HPT in userspace memory using copy_from_user +and copy_to_user. Recently, the declarations of those functions were +annotated to indicate that the return value must be checked. Since +this code doesn't currently check the return value, this causes +compile warnings like the ones shown below, and since on PPC the +default is to compile arch/powerpc with -Werror, this causes the +build to fail. + +To fix this, we check the return values, and if non-zero, fail the +hypercall being processed with a H_FUNCTION error return value. +There is really no good error return value to use since PAPR didn't +envisage the possibility that the hypervisor may not be able to access +the guest's HPT, and H_FUNCTION (function not supported) seems as +good as any. + +The typical compile warnings look like this: + + CC arch/powerpc/kvm/book3s_pr_papr.o +/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c: In function ‘kvmppc_h_pr_enter’: +/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:53:2: error: ignoring return value of ‘copy_from_user’, declared with attribute warn_unused_result [-Werror=unused-result] + copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)); + ^ +/home/paulus/kernel/kvm/arch/powerpc/kvm/book3s_pr_papr.c:74:2: error: ignoring return value of ‘copy_to_user’, declared with attribute warn_unused_result [-Werror=unused-result] + copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE); + ^ + +... etc. + +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kvm/book3s_pr_papr.c | 34 ++++++++++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 8 deletions(-) + +--- a/arch/powerpc/kvm/book3s_pr_papr.c ++++ b/arch/powerpc/kvm/book3s_pr_papr.c +@@ -50,7 +50,9 @@ static int kvmppc_h_pr_enter(struct kvm_ + pteg_addr = get_pteg_addr(vcpu, pte_index); + + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pteg, (void __user *)pteg_addr, sizeof(pteg))) ++ goto done; + hpte = pteg; + + ret = H_PTEG_FULL; +@@ -71,7 +73,9 @@ static int kvmppc_h_pr_enter(struct kvm_ + hpte[0] = cpu_to_be64(kvmppc_get_gpr(vcpu, 6)); + hpte[1] = cpu_to_be64(kvmppc_get_gpr(vcpu, 7)); + pteg_addr += i * HPTE_SIZE; +- copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg_addr, hpte, HPTE_SIZE)) ++ goto done; + kvmppc_set_gpr(vcpu, 4, pte_index | i); + ret = H_SUCCESS; + +@@ -93,7 +97,9 @@ static int kvmppc_h_pr_remove(struct kvm + + pteg = get_pteg_addr(vcpu, pte_index); + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) ++ goto done; + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -103,7 +109,9 @@ static int kvmppc_h_pr_remove(struct kvm + ((flags & H_ANDCOND) && (pte[0] & avpn) != 0)) + goto done; + +- copy_to_user((void __user *)pteg, &v, sizeof(v)); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) ++ goto done; + + rb = compute_tlbie_rb(pte[0], pte[1], pte_index); + vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false); +@@ -171,7 +179,10 @@ static int kvmppc_h_pr_bulk_remove(struc + } + + pteg = get_pteg_addr(vcpu, tsh & H_BULK_REMOVE_PTEX); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) { ++ ret = H_FUNCTION; ++ break; ++ } + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -184,7 +195,10 @@ static int kvmppc_h_pr_bulk_remove(struc + tsh |= H_BULK_REMOVE_NOT_FOUND; + } else { + /* Splat the pteg in (userland) hpt */ +- copy_to_user((void __user *)pteg, &v, sizeof(v)); ++ if (copy_to_user((void __user *)pteg, &v, sizeof(v))) { ++ ret = H_FUNCTION; ++ break; ++ } + + rb = compute_tlbie_rb(pte[0], pte[1], + tsh & H_BULK_REMOVE_PTEX); +@@ -211,7 +225,9 @@ static int kvmppc_h_pr_protect(struct kv + + pteg = get_pteg_addr(vcpu, pte_index); + mutex_lock(&vcpu->kvm->arch.hpt_mutex); +- copy_from_user(pte, (void __user *)pteg, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_from_user(pte, (void __user *)pteg, sizeof(pte))) ++ goto done; + pte[0] = be64_to_cpu((__force __be64)pte[0]); + pte[1] = be64_to_cpu((__force __be64)pte[1]); + +@@ -234,7 +250,9 @@ static int kvmppc_h_pr_protect(struct kv + vcpu->arch.mmu.tlbie(vcpu, rb, rb & 1 ? true : false); + pte[0] = (__force u64)cpu_to_be64(pte[0]); + pte[1] = (__force u64)cpu_to_be64(pte[1]); +- copy_to_user((void __user *)pteg, pte, sizeof(pte)); ++ ret = H_FUNCTION; ++ if (copy_to_user((void __user *)pteg, pte, sizeof(pte))) ++ goto done; + ret = H_SUCCESS; + + done: diff --git a/queue-4.4/kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch b/queue-4.4/kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch new file mode 100644 index 00000000000..cc425c8285f --- /dev/null +++ b/queue-4.4/kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch @@ -0,0 +1,89 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Roman Pen +Date: Thu, 1 Jun 2017 10:55:03 +0200 +Subject: KVM: SVM: do not zero out segment attributes if segment is unusable or not present + +From: Roman Pen + + +[ Upstream commit d9c1b5431d5f0e07575db785a022bce91051ac1d ] + +This is a fix for the problem [1], where VMCB.CPL was set to 0 and interrupt +was taken on userspace stack. The root cause lies in the specific AMD CPU +behaviour which manifests itself as unusable segment attributes on SYSRET. +The corresponding work around for the kernel is the following: + +61f01dd941ba ("x86_64, asm: Work around AMD SYSRET SS descriptor attribute issue") + +In other turn virtualization side treated unusable segment incorrectly and +restored CPL from SS attributes, which were zeroed out few lines above. + +In current patch it is assured only that P bit is cleared in VMCB.save state +and segment attributes are not zeroed out if segment is not presented or is +unusable, therefore CPL can be safely restored from DPL field. + +This is only one part of the fix, since QEMU side should be fixed accordingly +not to zero out attributes on its side. Corresponding patch will follow. + +[1] Message id: CAJrWOzD6Xq==b-zYCDdFLgSRMPM-NkNuTSDFEtX=7MreT45i7Q@mail.gmail.com + +Signed-off-by: Roman Pen +Signed-off-by: Mikhail Sennikovskii +Cc: Paolo Bonzini +Cc: Radim KrÄmář +Cc: kvm@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1386,6 +1386,7 @@ static void svm_get_segment(struct kvm_v + */ + if (var->unusable) + var->db = 0; ++ /* This is symmetric with svm_set_segment() */ + var->dpl = to_svm(vcpu)->vmcb->save.cpl; + break; + } +@@ -1531,18 +1532,14 @@ static void svm_set_segment(struct kvm_v + s->base = var->base; + s->limit = var->limit; + s->selector = var->selector; +- if (var->unusable) +- s->attrib = 0; +- else { +- s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK); +- s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT; +- s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT; +- s->attrib |= (var->present & 1) << SVM_SELECTOR_P_SHIFT; +- s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT; +- s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT; +- s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT; +- s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT; +- } ++ s->attrib = (var->type & SVM_SELECTOR_TYPE_MASK); ++ s->attrib |= (var->s & 1) << SVM_SELECTOR_S_SHIFT; ++ s->attrib |= (var->dpl & 3) << SVM_SELECTOR_DPL_SHIFT; ++ s->attrib |= ((var->present & 1) && !var->unusable) << SVM_SELECTOR_P_SHIFT; ++ s->attrib |= (var->avl & 1) << SVM_SELECTOR_AVL_SHIFT; ++ s->attrib |= (var->l & 1) << SVM_SELECTOR_L_SHIFT; ++ s->attrib |= (var->db & 1) << SVM_SELECTOR_DB_SHIFT; ++ s->attrib |= (var->g & 1) << SVM_SELECTOR_G_SHIFT; + + /* + * This is always accurate, except if SYSRET returned to a segment +@@ -1551,7 +1548,8 @@ static void svm_set_segment(struct kvm_v + * would entail passing the CPL to userspace and back. + */ + if (seg == VCPU_SREG_SS) +- svm->vmcb->save.cpl = (s->attrib >> SVM_SELECTOR_DPL_SHIFT) & 3; ++ /* This is symmetric with svm_get_segment() */ ++ svm->vmcb->save.cpl = (var->dpl & 3); + + mark_dirty(svm->vmcb, VMCB_SEG); + } diff --git a/queue-4.4/l2tp-fix-missing-print-session-offset-info.patch b/queue-4.4/l2tp-fix-missing-print-session-offset-info.patch new file mode 100644 index 00000000000..cb984c49715 --- /dev/null +++ b/queue-4.4/l2tp-fix-missing-print-session-offset-info.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Hangbin Liu +Date: Fri, 22 Dec 2017 15:10:17 +0100 +Subject: l2tp: fix missing print session offset info + +From: Hangbin Liu + + +[ Upstream commit 820da5357572715c6235ba3b3daa2d5b43a1198f ] + +Report offset parameter in L2TP_CMD_SESSION_GET command if +it has been configured by userspace + +Fixes: 309795f4bec ("l2tp: Add netlink control API for L2TP") +Reported-by: Jianlin Shi +Signed-off-by: Hangbin Liu +Signed-off-by: Lorenzo Bianconi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -732,6 +732,8 @@ static int l2tp_nl_session_send(struct s + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || ++ (session->offset && ++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || diff --git a/queue-4.4/leds-pca955x-correct-i2c-functionality.patch b/queue-4.4/leds-pca955x-correct-i2c-functionality.patch new file mode 100644 index 00000000000..e343f72a08c --- /dev/null +++ b/queue-4.4/leds-pca955x-correct-i2c-functionality.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tin Huynh +Date: Mon, 22 May 2017 16:19:20 +0700 +Subject: leds: pca955x: Correct I2C Functionality + +From: Tin Huynh + + +[ Upstream commit aace34c0bb8ea3c8bdcec865b6a4be4db0a68e33 ] + +The driver checks an incorrect flag of functionality of adapter. +When a driver requires i2c_smbus_read_byte_data and +i2c_smbus_write_byte_data, it should check I2C_FUNC_SMBUS_BYTE_DATA +instead I2C_FUNC_I2C. +This patch fixes the problem. + +Signed-off-by: Tin Huynh +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/leds/leds-pca955x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/leds/leds-pca955x.c ++++ b/drivers/leds/leds-pca955x.c +@@ -281,7 +281,7 @@ static int pca955x_probe(struct i2c_clie + "slave address 0x%02x\n", + id->name, chip->bits, client->addr); + +- if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) ++ if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA)) + return -EIO; + + if (pdata) { diff --git a/queue-4.4/libceph-null-deref-on-crush_decode-error-path.patch b/queue-4.4/libceph-null-deref-on-crush_decode-error-path.patch new file mode 100644 index 00000000000..2c7d901bdfa --- /dev/null +++ b/queue-4.4/libceph-null-deref-on-crush_decode-error-path.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Tue, 23 May 2017 17:25:10 +0300 +Subject: libceph: NULL deref on crush_decode() error path + +From: Dan Carpenter + + +[ Upstream commit 293dffaad8d500e1a5336eeb90d544cf40d4fbd8 ] + +If there is not enough space then ceph_decode_32_safe() does a goto bad. +We need to return an error code in that situation. The current code +returns ERR_PTR(0) which is NULL. The callers are not expecting that +and it results in a NULL dereference. + +Fixes: f24e9980eb86 ("ceph: OSD client") +Signed-off-by: Dan Carpenter +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ceph/osdmap.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -295,6 +295,7 @@ static struct crush_map *crush_decode(vo + u32 yes; + struct crush_rule *r; + ++ err = -EINVAL; + ceph_decode_32_safe(p, end, yes, bad); + if (!yes) { + dout("crush_decode NO rule %d off %x %p to %p\n", diff --git a/queue-4.4/lockd-fix-lockd-shutdown-race.patch b/queue-4.4/lockd-fix-lockd-shutdown-race.patch new file mode 100644 index 00000000000..919939ef75f --- /dev/null +++ b/queue-4.4/lockd-fix-lockd-shutdown-race.patch @@ -0,0 +1,59 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "J. Bruce Fields" +Date: Tue, 28 Mar 2017 21:25:08 -0400 +Subject: lockd: fix lockd shutdown race + +From: "J. Bruce Fields" + + +[ Upstream commit efda760fe95ea15291853c8fa9235c32d319cd98 ] + +As reported by David Jeffery: "a signal was sent to lockd while lockd +was shutting down from a request to stop nfs. The signal causes lockd +to call restart_grace() which puts the lockd_net structure on the grace +list. If this signal is received at the wrong time, it will occur after +lockd_down_net() has called locks_end_grace() but before +lockd_down_net() stops the lockd thread. This leads to lockd putting +the lockd_net structure back on the grace list, then exiting without +anything removing it from the list." + +So, perform the final locks_end_grace() from the the lockd thread; this +ensures it's serialized with respect to restart_grace(). + +Reported-by: David Jeffery +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/lockd/svc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/lockd/svc.c ++++ b/fs/lockd/svc.c +@@ -129,6 +129,8 @@ lockd(void *vrqstp) + { + int err = 0; + struct svc_rqst *rqstp = vrqstp; ++ struct net *net = &init_net; ++ struct lockd_net *ln = net_generic(net, lockd_net_id); + + /* try_to_freeze() is called from svc_recv() */ + set_freezable(); +@@ -173,6 +175,8 @@ lockd(void *vrqstp) + if (nlmsvc_ops) + nlmsvc_invalidate_all(); + nlm_shutdown_hosts(); ++ cancel_delayed_work_sync(&ln->grace_period_end); ++ locks_end_grace(&ln->lockd_manager); + return 0; + } + +@@ -267,8 +271,6 @@ static void lockd_down_net(struct svc_se + if (ln->nlmsvc_users) { + if (--ln->nlmsvc_users == 0) { + nlm_shutdown_hosts_net(net); +- cancel_delayed_work_sync(&ln->grace_period_end); +- locks_end_grace(&ln->lockd_manager); + svc_shutdown_net(serv, net); + dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net); + } diff --git a/queue-4.4/mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch b/queue-4.4/mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch new file mode 100644 index 00000000000..9206016f11e --- /dev/null +++ b/queue-4.4/mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch @@ -0,0 +1,39 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Luca Coelho +Date: Tue, 2 May 2017 17:56:21 +0300 +Subject: mac80211: bail out from prep_connection() if a reconfig is ongoing + +From: Luca Coelho + + +[ Upstream commit f8860ce836f2d502b07ef99559707fe55d90f5bc ] + +If ieee80211_hw_restart() is called during authentication, the +authentication process will continue, causing the driver to be called +in a wrong state. This ultimately causes an oops in the iwlwifi +driver (at least). + +This fixes bugzilla 195299 partly. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=195299 +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/mlme.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -4326,6 +4326,10 @@ static int ieee80211_prep_connection(str + if (WARN_ON(!ifmgd->auth_data && !ifmgd->assoc_data)) + return -EINVAL; + ++ /* If a reconfig is happening, bail out */ ++ if (local->in_reconfig) ++ return -EBUSY; ++ + if (assoc) { + rcu_read_lock(); + have_sta = sta_info_get(sdata, cbss->bssid); diff --git a/queue-4.4/mceusb-sporadic-rx-truncation-corruption-fix.patch b/queue-4.4/mceusb-sporadic-rx-truncation-corruption-fix.patch new file mode 100644 index 00000000000..ffafd1fd935 --- /dev/null +++ b/queue-4.4/mceusb-sporadic-rx-truncation-corruption-fix.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: A Sun +Date: Sun, 26 Mar 2017 15:33:07 -0300 +Subject: [media] mceusb: sporadic RX truncation corruption fix + +From: A Sun + + +[ Upstream commit 8e175b22e8640bf3a58e071af54190b909e4a944 ] + +Intermittent RX truncation and loss of IR received data. This resulted +in receive stream synchronization errors where driver attempted to +incorrectly parse IR data (eg 0x90 below) as command response. + +[ 3969.139898] mceusb 1-1.2:1.0: processed IR data +[ 3969.151315] mceusb 1-1.2:1.0: rx data: 00 90 (length=2) +[ 3969.151321] mceusb 1-1.2:1.0: Unknown command 0x00 0x90 +[ 3969.151336] mceusb 1-1.2:1.0: rx data: 98 0a 8d 0a 8e 0a 8e 0a 8e 0a 8e 0a 9a 0a 8e 0a 0b 3a 8e 00 80 41 59 00 00 (length=25) +[ 3969.151341] mceusb 1-1.2:1.0: Raw IR data, 24 pulse/space samples +[ 3969.151348] mceusb 1-1.2:1.0: Storing space with duration 500000 + +Bug trigger appears to be normal, but heavy, IR receiver use. + +Signed-off-by: A Sun +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/mceusb.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1370,8 +1370,13 @@ static int mceusb_dev_probe(struct usb_i + goto rc_dev_fail; + + /* wire up inbound data handler */ +- usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, +- mceusb_dev_recv, ir, ep_in->bInterval); ++ if (usb_endpoint_xfer_int(ep_in)) ++ usb_fill_int_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, ++ mceusb_dev_recv, ir, ep_in->bInterval); ++ else ++ usb_fill_bulk_urb(ir->urb_in, dev, pipe, ir->buf_in, maxp, ++ mceusb_dev_recv, ir); ++ + ir->urb_in->transfer_dma = ir->dma_in; + ir->urb_in->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + diff --git a/queue-4.4/md-cluster-fix-potential-lock-issue-in-add_new_disk.patch b/queue-4.4/md-cluster-fix-potential-lock-issue-in-add_new_disk.patch new file mode 100644 index 00000000000..a5803bc846d --- /dev/null +++ b/queue-4.4/md-cluster-fix-potential-lock-issue-in-add_new_disk.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Guoqing Jiang +Date: Tue, 16 May 2017 14:01:25 +0800 +Subject: md-cluster: fix potential lock issue in add_new_disk + +From: Guoqing Jiang + + +[ Upstream commit 2dffdc0724004f38f5e39907747b53e4b0d80e59 ] + +The add_new_disk returns with communication locked if +__sendmsg returns failure, fix it with call unlock_comm +before return. + +Reported-by: Dan Carpenter +CC: Goldwyn Rodrigues +Signed-off-by: Guoqing Jiang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md-cluster.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -945,8 +945,10 @@ static int add_new_disk(struct mddev *md + cmsg.raid_slot = cpu_to_le32(rdev->desc_nr); + lock_comm(cinfo); + ret = __sendmsg(cinfo, &cmsg); +- if (ret) ++ if (ret) { ++ unlock_comm(cinfo); + return ret; ++ } + cinfo->no_new_dev_lockres->flags |= DLM_LKF_NOQUEUE; + ret = dlm_lock_sync(cinfo->no_new_dev_lockres, DLM_LOCK_EX); + cinfo->no_new_dev_lockres->flags &= ~DLM_LKF_NOQUEUE; diff --git a/queue-4.4/md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch b/queue-4.4/md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch new file mode 100644 index 00000000000..53061b7f1f1 --- /dev/null +++ b/queue-4.4/md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch @@ -0,0 +1,90 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Julia Cartwright +Date: Fri, 28 Apr 2017 12:41:02 -0500 +Subject: md/raid5: make use of spin_lock_irq over local_irq_disable + spin_lock + +From: Julia Cartwright + + +[ Upstream commit 3d05f3aed5d721c2c77d20288c29ab26c6193ed5 ] + +On mainline, there is no functional difference, just less code, and +symmetric lock/unlock paths. + +On PREEMPT_RT builds, this fixes the following warning, seen by +Alexander GQ Gerasiov, due to the sleeping nature of spinlocks. + + BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:993 + in_atomic(): 0, irqs_disabled(): 1, pid: 58, name: kworker/u12:1 + CPU: 5 PID: 58 Comm: kworker/u12:1 Tainted: G W 4.9.20-rt16-stand6-686 #1 + Hardware name: Supermicro SYS-5027R-WRF/X9SRW-F, BIOS 3.2a 10/28/2015 + Workqueue: writeback wb_workfn (flush-253:0) + Call Trace: + dump_stack+0x47/0x68 + ? migrate_enable+0x4a/0xf0 + ___might_sleep+0x101/0x180 + rt_spin_lock+0x17/0x40 + add_stripe_bio+0x4e3/0x6c0 [raid456] + ? preempt_count_add+0x42/0xb0 + raid5_make_request+0x737/0xdd0 [raid456] + +Reported-by: Alexander GQ Gerasiov +Tested-by: Alexander GQ Gerasiov +Signed-off-by: Julia Cartwright +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid5.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -110,8 +110,7 @@ static inline void unlock_device_hash_lo + static inline void lock_all_device_hash_locks_irq(struct r5conf *conf) + { + int i; +- local_irq_disable(); +- spin_lock(conf->hash_locks); ++ spin_lock_irq(conf->hash_locks); + for (i = 1; i < NR_STRIPE_HASH_LOCKS; i++) + spin_lock_nest_lock(conf->hash_locks + i, conf->hash_locks); + spin_lock(&conf->device_lock); +@@ -121,9 +120,9 @@ static inline void unlock_all_device_has + { + int i; + spin_unlock(&conf->device_lock); +- for (i = NR_STRIPE_HASH_LOCKS; i; i--) +- spin_unlock(conf->hash_locks + i - 1); +- local_irq_enable(); ++ for (i = NR_STRIPE_HASH_LOCKS - 1; i; i--) ++ spin_unlock(conf->hash_locks + i); ++ spin_unlock_irq(conf->hash_locks); + } + + /* bio's attached to a stripe+device for I/O are linked together in bi_sector +@@ -726,12 +725,11 @@ static bool is_full_stripe_write(struct + + static void lock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2) + { +- local_irq_disable(); + if (sh1 > sh2) { +- spin_lock(&sh2->stripe_lock); ++ spin_lock_irq(&sh2->stripe_lock); + spin_lock_nested(&sh1->stripe_lock, 1); + } else { +- spin_lock(&sh1->stripe_lock); ++ spin_lock_irq(&sh1->stripe_lock); + spin_lock_nested(&sh2->stripe_lock, 1); + } + } +@@ -739,8 +737,7 @@ static void lock_two_stripes(struct stri + static void unlock_two_stripes(struct stripe_head *sh1, struct stripe_head *sh2) + { + spin_unlock(&sh1->stripe_lock); +- spin_unlock(&sh2->stripe_lock); +- local_irq_enable(); ++ spin_unlock_irq(&sh2->stripe_lock); + } + + /* Only freshly new full stripe normal write stripe can be added to a batch list */ diff --git a/queue-4.4/media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch b/queue-4.4/media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch new file mode 100644 index 00000000000..d57da0d09b8 --- /dev/null +++ b/queue-4.4/media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch @@ -0,0 +1,82 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Mauro Carvalho Chehab +Date: Thu, 28 Dec 2017 09:16:47 -0500 +Subject: media: videobuf2-core: don't go out of the buffer range + +From: Mauro Carvalho Chehab + + +[ Upstream commit df93dc61b0d8b19a5c9db545cf3fcc24f88dfde4 ] + +Currently, there's no check if an invalid buffer range +is passed. However, while testing DVB memory mapped apps, +I got this: + + videobuf2_core: VB: num_buffers -2143943680, buffer 33, index -2143943647 + unable to handle kernel paging request at ffff888b773c0890 + IP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] + PGD 4142c7067 P4D 4142c7067 PUD 0 + Oops: 0002 [#1] SMP + Modules linked in: xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc rc_dvbsky sp2 ts2020 intel_rapl x86_pkg_temp_thermal dvb_usb_dvbsky intel_powerclamp dvb_usb_v2 coretemp m88ds3103 kvm_intel i2c_mux dvb_core snd_hda_codec_hdmi crct10dif_pclmul crc32_pclmul videobuf2_vmalloc videobuf2_memops snd_hda_intel ghash_clmulni_intel videobuf2_core snd_hda_codec rc_core mei_me intel_cstate snd_hwdep snd_hda_core videodev intel_uncore snd_pcm mei media tpm_tis tpm_tis_core intel_rapl_perf tpm snd_timer lpc_ich snd soundcore kvm irqbypass libcrc32c i915 i2c_algo_bit drm_kms_helper + e1000e ptp drm crc32c_intel video pps_core + CPU: 3 PID: 1776 Comm: dvbv5-zap Not tainted 4.14.0+ #78 + Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 + task: ffff88877c73bc80 task.stack: ffffb7c402418000 + RIP: 0010:__vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] + RSP: 0018:ffffb7c40241bc60 EFLAGS: 00010246 + RAX: 0000000080360421 RBX: 0000000000000021 RCX: 000000000000000a + RDX: ffffb7c40241bcf4 RSI: ffff888780362c60 RDI: ffff888796d8e130 + RBP: ffffb7c40241bcc8 R08: 0000000000000316 R09: 0000000000000004 + R10: ffff888780362c00 R11: 0000000000000001 R12: 000000000002f000 + R13: ffff8887758be700 R14: 0000000000021000 R15: 0000000000000001 + FS: 00007f2849024740(0000) GS:ffff888796d80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffff888b773c0890 CR3: 000000043beb2005 CR4: 00000000003606e0 + Call Trace: + vb2_core_reqbufs+0x226/0x420 [videobuf2_core] + dvb_vb2_reqbufs+0x2d/0xc0 [dvb_core] + dvb_dvr_do_ioctl+0x98/0x1d0 [dvb_core] + dvb_usercopy+0x53/0x1b0 [dvb_core] + ? dvb_demux_ioctl+0x20/0x20 [dvb_core] + ? tty_ldisc_deref+0x16/0x20 + ? tty_write+0x1f9/0x310 + ? process_echoes+0x70/0x70 + dvb_dvr_ioctl+0x15/0x20 [dvb_core] + do_vfs_ioctl+0xa5/0x600 + SyS_ioctl+0x79/0x90 + entry_SYSCALL_64_fastpath+0x1a/0xa5 + RIP: 0033:0x7f28486f7ea7 + RSP: 002b:00007ffc13b2db18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 000055b10fc06130 RCX: 00007f28486f7ea7 + RDX: 00007ffc13b2db48 RSI: 00000000c0086f3c RDI: 0000000000000007 + RBP: 0000000000000203 R08: 000055b10df1e02c R09: 000000000000002e + R10: 0036b42415108357 R11: 0000000000000246 R12: 0000000000000000 + R13: 00007f2849062f60 R14: 00000000000001f1 R15: 00007ffc13b2da54 + Code: 74 0a 60 8b 0a 48 83 c0 30 48 83 c2 04 89 48 d0 89 48 d4 48 39 f0 75 eb 41 8b 42 08 83 7d d4 01 41 c7 82 ec 01 00 00 ff ff ff ff <4d> 89 94 c5 88 00 00 00 74 14 83 c3 01 41 39 dc 0f 85 f1 fe ff + RIP: __vb2_queue_alloc+0x134/0x4e0 [videobuf2_core] RSP: ffffb7c40241bc60 + CR2: ffff888b773c0890 + +So, add a sanity check in order to prevent going past array. + +Signed-off-by: Mauro Carvalho Chehab +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/v4l2-core/videobuf2-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -205,6 +205,10 @@ static int __vb2_queue_alloc(struct vb2_ + struct vb2_buffer *vb; + int ret; + ++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ ++ num_buffers = min_t(unsigned int, num_buffers, ++ VB2_MAX_FRAME - q->num_buffers); ++ + for (buffer = 0; buffer < num_buffers; ++buffer) { + /* Allocate videobuf buffer structures */ + vb = kzalloc(q->buf_struct_size, GFP_KERNEL); diff --git a/queue-4.4/mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch b/queue-4.4/mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch new file mode 100644 index 00000000000..a67403c9ebd --- /dev/null +++ b/queue-4.4/mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Marcin Nowakowski +Date: Thu, 8 Jun 2017 15:20:32 +0200 +Subject: MIPS: kprobes: flush_insn_slot should flush only if probe initialised + +From: Marcin Nowakowski + + +[ Upstream commit 698b851073ddf5a894910d63ca04605e0473414e ] + +When ftrace is used with kprobes, it is possible for a kprobe to contain +an invalid location (ie. only initialised to 0 and not to a specific +location in the code). Trying to perform a cache flush on such location +leads to a crash r4k_flush_icache_range(). + +Fixes: c1bf207d6ee1 ("MIPS: kprobe: Add support.") +Signed-off-by: Marcin Nowakowski +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/16296/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/include/asm/kprobes.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/mips/include/asm/kprobes.h ++++ b/arch/mips/include/asm/kprobes.h +@@ -40,7 +40,8 @@ typedef union mips_instruction kprobe_op + + #define flush_insn_slot(p) \ + do { \ +- flush_icache_range((unsigned long)p->addr, \ ++ if (p->addr) \ ++ flush_icache_range((unsigned long)p->addr, \ + (unsigned long)p->addr + \ + (MAX_INSN_SIZE * sizeof(kprobe_opcode_t))); \ + } while (0) diff --git a/queue-4.4/mips-mm-adjust-pkmap-location.patch b/queue-4.4/mips-mm-adjust-pkmap-location.patch new file mode 100644 index 00000000000..32d7c8ac918 --- /dev/null +++ b/queue-4.4/mips-mm-adjust-pkmap-location.patch @@ -0,0 +1,54 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Marcin Nowakowski +Date: Tue, 11 Apr 2017 09:00:36 +0200 +Subject: MIPS: mm: adjust PKMAP location + +From: Marcin Nowakowski + + +[ Upstream commit c56e7a4c3e77f6fbd9b55c06c14eda65aae58958 ] + +Space reserved for PKMap should span from PKMAP_BASE to FIXADDR_START. +For large page sizes this is not the case as eg. for 64k pages the range +currently defined is from 0xfe000000 to 0x102000000(!!) which obviously +isn't right. +Remove the hardcoded location and set the BASE address as an offset from +FIXADDR_START. + +Since all PKMAP ptes have to be placed in a contiguous memory, ensure +that this is the case by placing them all in a single page. This is +achieved by aligning the end address to pkmap pages count pages. + +Signed-off-by: Marcin Nowakowski +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/15950/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/include/asm/pgtable-32.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/mips/include/asm/pgtable-32.h ++++ b/arch/mips/include/asm/pgtable-32.h +@@ -18,6 +18,10 @@ + + #include + ++#ifdef CONFIG_HIGHMEM ++#include ++#endif ++ + extern int temp_tlb_entry; + + /* +@@ -61,7 +65,8 @@ extern int add_temporary_entry(unsigned + + #define VMALLOC_START MAP_BASE + +-#define PKMAP_BASE (0xfe000000UL) ++#define PKMAP_END ((FIXADDR_START) & ~((LAST_PKMAP << PAGE_SHIFT)-1)) ++#define PKMAP_BASE (PKMAP_END - PAGE_SIZE * LAST_PKMAP) + + #ifdef CONFIG_HIGHMEM + # define VMALLOC_END (PKMAP_BASE-2*PAGE_SIZE) diff --git a/queue-4.4/mips-mm-fixed-mappings-correct-initialisation.patch b/queue-4.4/mips-mm-fixed-mappings-correct-initialisation.patch new file mode 100644 index 00000000000..f20e9aa8eb3 --- /dev/null +++ b/queue-4.4/mips-mm-fixed-mappings-correct-initialisation.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Marcin Nowakowski +Date: Tue, 11 Apr 2017 09:00:34 +0200 +Subject: MIPS: mm: fixed mappings: correct initialisation + +From: Marcin Nowakowski + + +[ Upstream commit 71eb989ab5a110df8bcbb9609bacde73feacbedd ] + +fixrange_init operates at PMD-granularity and expects the addresses to +be PMD-size aligned, but currently that might not be the case for +PKMAP_BASE unless it is defined properly, so ensure a correct alignment +is used before passing the address to fixrange_init. + +fixed mappings: only align the start address that is passed to +fixrange_init rather than the value before adding the size, as we may +end up with uninitialised upper part of the range. + +Signed-off-by: Marcin Nowakowski +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/15948/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/mm/pgtable-32.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/mips/mm/pgtable-32.c ++++ b/arch/mips/mm/pgtable-32.c +@@ -51,15 +51,15 @@ void __init pagetable_init(void) + /* + * Fixed mappings: + */ +- vaddr = __fix_to_virt(__end_of_fixed_addresses - 1) & PMD_MASK; +- fixrange_init(vaddr, vaddr + FIXADDR_SIZE, pgd_base); ++ vaddr = __fix_to_virt(__end_of_fixed_addresses - 1); ++ fixrange_init(vaddr & PMD_MASK, vaddr + FIXADDR_SIZE, pgd_base); + + #ifdef CONFIG_HIGHMEM + /* + * Permanent kmaps: + */ + vaddr = PKMAP_BASE; +- fixrange_init(vaddr, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base); ++ fixrange_init(vaddr & PMD_MASK, vaddr + PAGE_SIZE*LAST_PKMAP, pgd_base); + + pgd = swapper_pg_dir + __pgd_offset(vaddr); + pud = pud_offset(pgd, vaddr); diff --git a/queue-4.4/misdn-fix-a-sleep-in-atomic-bug.patch b/queue-4.4/misdn-fix-a-sleep-in-atomic-bug.patch new file mode 100644 index 00000000000..a3fa63dc906 --- /dev/null +++ b/queue-4.4/misdn-fix-a-sleep-in-atomic-bug.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jia-Ju Bai +Date: Wed, 31 May 2017 15:08:25 +0800 +Subject: mISDN: Fix a sleep-in-atomic bug + +From: Jia-Ju Bai + + +[ Upstream commit 93818da5eed63fbc17b64080406ea53b86b23309 ] + +The driver may sleep under a read spin lock, and the function call path is: +send_socklist (acquire the lock by read_lock) + skb_copy(GFP_KERNEL) --> may sleep + +To fix it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC". + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/isdn/mISDN/stack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/isdn/mISDN/stack.c ++++ b/drivers/isdn/mISDN/stack.c +@@ -72,7 +72,7 @@ send_socklist(struct mISDN_sock_list *sl + if (sk->sk_state != MISDN_BOUND) + continue; + if (!cskb) +- cskb = skb_copy(skb, GFP_KERNEL); ++ cskb = skb_copy(skb, GFP_ATOMIC); + if (!cskb) { + printk(KERN_WARNING "%s no skb\n", __func__); + break; diff --git a/queue-4.4/mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch b/queue-4.4/mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch new file mode 100644 index 00000000000..4a19adbf138 --- /dev/null +++ b/queue-4.4/mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch @@ -0,0 +1,49 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jesper Dangaard Brouer +Date: Mon, 22 May 2017 20:13:07 +0200 +Subject: mlx5: fix bug reading rss_hash_type from CQE + +From: Jesper Dangaard Brouer + + +[ Upstream commit 12e8b570e732eaa5eae3a2895ba3fbcf91bde2b4 ] + +Masks for extracting part of the Completion Queue Entry (CQE) +field rss_hash_type was swapped, namely CQE_RSS_HTYPE_IP and +CQE_RSS_HTYPE_L4. + +The bug resulted in setting skb->l4_hash, even-though the +rss_hash_type indicated that hash was NOT computed over the +L4 (UDP or TCP) part of the packet. + +Added comments from the datasheet, to make it more clear what +these masks are selecting. + +Signed-off-by: Jesper Dangaard Brouer +Acked-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/mlx5/device.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/include/linux/mlx5/device.h ++++ b/include/linux/mlx5/device.h +@@ -635,8 +635,14 @@ enum { + }; + + enum { +- CQE_RSS_HTYPE_IP = 0x3 << 6, +- CQE_RSS_HTYPE_L4 = 0x3 << 2, ++ CQE_RSS_HTYPE_IP = 0x3 << 2, ++ /* cqe->rss_hash_type[3:2] - IP destination selected for hash ++ * (00 = none, 01 = IPv4, 10 = IPv6, 11 = Reserved) ++ */ ++ CQE_RSS_HTYPE_L4 = 0x3 << 6, ++ /* cqe->rss_hash_type[7:6] - L4 destination selected for hash ++ * (00 = none, 01 = TCP. 10 = UDP, 11 = IPSEC.SPI ++ */ + }; + + enum { diff --git a/queue-4.4/mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch b/queue-4.4/mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch new file mode 100644 index 00000000000..f4efe3011bc --- /dev/null +++ b/queue-4.4/mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch @@ -0,0 +1,59 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Boris Brezillon +Date: Mon, 10 Apr 2017 10:35:17 +0200 +Subject: mtd: nand: gpmi: Fix gpmi_nand_init() error path + +From: Boris Brezillon + + +[ Upstream commit 4d02423e9afe6c46142ce98bbcaf5167316dbfbf ] + +The GPMI driver is wrongly assuming that nand_release() can safely be +called on an uninitialized/unregistered NAND device. + +Add a new err_nand_cleanup label in the error path and only execute if +nand_scan_tail() succeeded. + +Note that we now call nand_cleanup() instead of nand_release() +(nand_release() is actually grouping the mtd_device_unregister() and +nand_cleanup() in one call) because there's no point in trying to +unregister a device that has never been registered. + +Signed-off-by: Boris Brezillon +Reviewed-by: Marek Vasut +Acked-by: Han Xu +Reviewed-by: Marek Vasut +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/gpmi-nand/gpmi-nand.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1949,19 +1949,21 @@ static int gpmi_nand_init(struct gpmi_na + + ret = nand_boot_init(this); + if (ret) +- goto err_out; ++ goto err_nand_cleanup; + ret = chip->scan_bbt(mtd); + if (ret) +- goto err_out; ++ goto err_nand_cleanup; + + ppdata.of_node = this->pdev->dev.of_node; + ret = mtd_device_parse_register(mtd, NULL, &ppdata, NULL, 0); + if (ret) +- goto err_out; ++ goto err_nand_cleanup; + return 0; + ++err_nand_cleanup: ++ nand_cleanup(chip); + err_out: +- gpmi_nand_exit(this); ++ gpmi_free_dma_buffer(this); + return ret; + } + diff --git a/queue-4.4/neighbour-update-neigh-timestamps-iff-update-is-effective.patch b/queue-4.4/neighbour-update-neigh-timestamps-iff-update-is-effective.patch new file mode 100644 index 00000000000..f379fc9da1b --- /dev/null +++ b/queue-4.4/neighbour-update-neigh-timestamps-iff-update-is-effective.patch @@ -0,0 +1,95 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ihar Hrachyshka +Date: Tue, 16 May 2017 08:44:24 -0700 +Subject: neighbour: update neigh timestamps iff update is effective + +From: Ihar Hrachyshka + + +[ Upstream commit 77d7123342dcf6442341b67816321d71da8b2b16 ] + +It's a common practice to send gratuitous ARPs after moving an +IP address to another device to speed up healing of a service. To +fulfill service availability constraints, the timing of network peers +updating their caches to point to a new location of an IP address can be +particularly important. + +Sometimes neigh_update calls won't touch neither lladdr nor state, for +example if an update arrives in locktime interval. The neigh->updated +value is tested by the protocol specific neigh code, which in turn +will influence whether NEIGH_UPDATE_F_OVERRIDE gets set in the +call to neigh_update() or not. As a result, we may effectively ignore +the update request, bailing out of touching the neigh entry, except that +we still bump its timestamps inside neigh_update. + +This may be a problem for updates arriving in quick succession. For +example, consider the following scenario: + +A service is moved to another device with its IP address. The new device +sends three gratuitous ARP requests into the network with ~1 seconds +interval between them. Just before the first request arrives to one of +network peer nodes, its neigh entry for the IP address transitions from +STALE to DELAY. This transition, among other things, updates +neigh->updated. Once the kernel receives the first gratuitous ARP, it +ignores it because its arrival time is inside the locktime interval. The +kernel still bumps neigh->updated. Then the second gratuitous ARP +request arrives, and it's also ignored because it's still in the (new) +locktime interval. Same happens for the third request. The node +eventually heals itself (after delay_first_probe_time seconds since the +initial transition to DELAY state), but it just wasted some time and +require a new ARP request/reply round trip. This unfortunate behaviour +both puts more load on the network, as well as reduces service +availability. + +This patch changes neigh_update so that it bumps neigh->updated (as well +as neigh->confirmed) only once we are sure that either lladdr or entry +state will change). In the scenario described above, it means that the +second gratuitous ARP request will actually update the entry lladdr. + +Ideally, we would update the neigh entry on the very first gratuitous +ARP request. The locktime mechanism is designed to ignore ARP updates in +a short timeframe after a previous ARP update was honoured by the kernel +layer. This would require tracking timestamps for state transitions +separately from timestamps when actual updates are received. This would +probably involve changes in neighbour struct. Therefore, the patch +doesn't tackle the issue of the first gratuitous APR ignored, leaving +it for a follow-up. + +Signed-off-by: Ihar Hrachyshka +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/neighbour.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh + lladdr = neigh->ha; + } + +- if (new & NUD_CONNECTED) +- neigh->confirmed = jiffies; +- neigh->updated = jiffies; +- + /* If entry was valid and address is not changed, + do not change entry state, if new one is STALE. + */ +@@ -1159,6 +1155,16 @@ int neigh_update(struct neighbour *neigh + } + } + ++ /* Update timestamps only once we know we will make a change to the ++ * neighbour entry. Otherwise we risk to move the locktime window with ++ * noop updates and ignore relevant ARP updates. ++ */ ++ if (new != old || lladdr != neigh->ha) { ++ if (new & NUD_CONNECTED) ++ neigh->confirmed = jiffies; ++ neigh->updated = jiffies; ++ } ++ + if (new != old) { + neigh_del_timer(neigh); + if (new & NUD_PROBE) diff --git a/queue-4.4/net-cdc_ncm-fix-tx-zero-padding.patch b/queue-4.4/net-cdc_ncm-fix-tx-zero-padding.patch new file mode 100644 index 00000000000..9a493737f38 --- /dev/null +++ b/queue-4.4/net-cdc_ncm-fix-tx-zero-padding.patch @@ -0,0 +1,58 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jim Baxter +Date: Mon, 8 May 2017 13:49:57 +0100 +Subject: net: cdc_ncm: Fix TX zero padding + +From: Jim Baxter + + +[ Upstream commit aeca3a77b1e0ed06a095933b89c86aed007383eb ] + +The zero padding that is added to NTB's does +not zero the memory correctly. +This is because the skb_put modifies the value +of skb_out->len which results in the memset +command not setting any memory to zero as +(ctx->tx_max - skb_out->len) == 0. + +I have resolved this by storing the size of +the memory to be zeroed before the skb_put +and using this in the memset call. + +Signed-off-by: Jim Baxter +Reviewed-by: Bjørn Mork +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/cdc_ncm.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1069,6 +1069,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev + u16 n = 0, index, ndplen; + u8 ready2send = 0; + u32 delayed_ndp_size; ++ size_t padding_count; + + /* When our NDP gets written in cdc_ncm_ndp(), then skb_out->len gets updated + * accordingly. Otherwise, we should check here. +@@ -1225,11 +1226,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev + * a ZLP after full sized NTBs. + */ + if (!(dev->driver_info->flags & FLAG_SEND_ZLP) && +- skb_out->len > ctx->min_tx_pkt) +- memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0, +- ctx->tx_max - skb_out->len); +- else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0) ++ skb_out->len > ctx->min_tx_pkt) { ++ padding_count = ctx->tx_max - skb_out->len; ++ memset(skb_put(skb_out, padding_count), 0, padding_count); ++ } else if (skb_out->len < ctx->tx_max && ++ (skb_out->len % dev->maxpacket) == 0) { + *skb_put(skb_out, 1) = 0; /* force short packet */ ++ } + + /* set final frame length */ + nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; diff --git a/queue-4.4/net-emac-fix-reset-timeout-with-ar8035-phy.patch b/queue-4.4/net-emac-fix-reset-timeout-with-ar8035-phy.patch new file mode 100644 index 00000000000..16432f6d67b --- /dev/null +++ b/queue-4.4/net-emac-fix-reset-timeout-with-ar8035-phy.patch @@ -0,0 +1,119 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Christian Lamparter +Date: Wed, 7 Jun 2017 15:51:15 +0200 +Subject: net: emac: fix reset timeout with AR8035 phy + +From: Christian Lamparter + + +[ Upstream commit 19d90ece81da802207a9b91ce95a29fbdc40626e ] + +This patch fixes a problem where the AR8035 PHY can't be +detected on an Cisco Meraki MR24, if the ethernet cable is +not connected on boot. + +Russell Senior provided steps to reproduce the issue: +|Disconnect ethernet cable, apply power, wait until device has booted, +|plug in ethernet, check for interfaces, no eth0 is listed. +| +|This appears to be a problem during probing of the AR8035 Phy chip. +|When ethernet has no link, the phy detection fails, and eth0 is not +|created. Plugging ethernet later has no effect, because there is no +|interface as far as the kernel is concerned. The relevant part of +|the boot log looks like this: +|this is the failing case: +| +|[ 0.876611] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode +|[ 0.882532] /plb/opb/ethernet@ef600c00: reset timeout +|[ 0.888546] /plb/opb/ethernet@ef600c00: can't find PHY! +|and the succeeding case: +| +|[ 0.876672] /plb/opb/emac-rgmii@ef601500: input 0 in RGMII mode +|[ 0.883952] eth0: EMAC-0 /plb/opb/ethernet@ef600c00, MAC 00:01:.. +|[ 0.890822] eth0: found Atheros 8035 Gigabit Ethernet PHY (0x01) + +Based on the comment and the commit message of +commit 23fbb5a87c56 ("emac: Fix EMAC soft reset on 460EX/GT"). +This is because the AR8035 PHY doesn't provide the TX Clock, +if the ethernet cable is not attached. This causes the reset +to timeout and the PHY detection code in emac_init_phy() is +unable to detect the AR8035 PHY. As a result, the emac driver +bails out early and the user left with no ethernet. + +In order to stay compatible with existing configurations, the driver +tries the current reset approach at first. Only if the first attempt +timed out, it does perform one more retry with the clock temporarily +switched to the internal source for just the duration of the reset. + +LEDE-Bug: #687 + +Cc: Chris Blake +Reported-by: Russell Senior +Fixes: 23fbb5a87c56e98 ("emac: Fix EMAC soft reset on 460EX/GT") +Signed-off-by: Christian Lamparter +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/emac/core.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/ibm/emac/core.c ++++ b/drivers/net/ethernet/ibm/emac/core.c +@@ -342,6 +342,7 @@ static int emac_reset(struct emac_instan + { + struct emac_regs __iomem *p = dev->emacp; + int n = 20; ++ bool __maybe_unused try_internal_clock = false; + + DBG(dev, "reset" NL); + +@@ -354,6 +355,7 @@ static int emac_reset(struct emac_instan + } + + #ifdef CONFIG_PPC_DCR_NATIVE ++do_retry: + /* + * PPC460EX/GT Embedded Processor Advanced User's Manual + * section 28.10.1 Mode Register 0 (EMACx_MR0) states: +@@ -361,10 +363,19 @@ static int emac_reset(struct emac_instan + * of the EMAC. If none is present, select the internal clock + * (SDR0_ETH_CFG[EMACx_PHY_CLK] = 1). + * After a soft reset, select the external clock. ++ * ++ * The AR8035-A PHY Meraki MR24 does not provide a TX Clk if the ++ * ethernet cable is not attached. This causes the reset to timeout ++ * and the PHY detection code in emac_init_phy() is unable to ++ * communicate and detect the AR8035-A PHY. As a result, the emac ++ * driver bails out early and the user has no ethernet. ++ * In order to stay compatible with existing configurations, the ++ * driver will temporarily switch to the internal clock, after ++ * the first reset fails. + */ + if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) { +- if (dev->phy_address == 0xffffffff && +- dev->phy_map == 0xffffffff) { ++ if (try_internal_clock || (dev->phy_address == 0xffffffff && ++ dev->phy_map == 0xffffffff)) { + /* No PHY: select internal loop clock before reset */ + dcri_clrset(SDR0, SDR0_ETH_CFG, + 0, SDR0_ETH_CFG_ECS << dev->cell_index); +@@ -382,8 +393,15 @@ static int emac_reset(struct emac_instan + + #ifdef CONFIG_PPC_DCR_NATIVE + if (emac_has_feature(dev, EMAC_FTR_460EX_PHY_CLK_FIX)) { +- if (dev->phy_address == 0xffffffff && +- dev->phy_map == 0xffffffff) { ++ if (!n && !try_internal_clock) { ++ /* first attempt has timed out. */ ++ n = 20; ++ try_internal_clock = true; ++ goto do_retry; ++ } ++ ++ if (try_internal_clock || (dev->phy_address == 0xffffffff && ++ dev->phy_map == 0xffffffff)) { + /* No PHY: restore external clock source after reset */ + dcri_clrset(SDR0, SDR0_ETH_CFG, + SDR0_ETH_CFG_ECS << dev->cell_index, 0); diff --git a/queue-4.4/net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch b/queue-4.4/net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch new file mode 100644 index 00000000000..3a4634b3c24 --- /dev/null +++ b/queue-4.4/net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch @@ -0,0 +1,68 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Grygorii Strashko +Date: Mon, 8 May 2017 14:21:21 -0500 +Subject: net: ethernet: ti: cpsw: adjust cpsw fifos depth for fullduplex flow control + +From: Grygorii Strashko + + +[ Upstream commit 48f5bccc60675f8426a6159935e8636a1fd89f56 ] + +When users set flow control using ethtool the bits are set properly in the +CPGMAC_SL MACCONTROL register, but the FIFO depth in the respective Port n +Maximum FIFO Blocks (Pn_MAX_BLKS) registers remains set to the minimum size +reset value. When receive flow control is enabled on a port, the port's +associated FIFO block allocation must be adjusted. The port RX allocation +must increase to accommodate the flow control runout. The TRM recommends +numbers of 5 or 6. + +Hence, apply required Port FIFO configuration to +Pn_MAX_BLKS.Pn_TX_MAX_BLKS=0xF and Pn_MAX_BLKS.Pn_RX_MAX_BLKS=0x5 during +interface initialization. + +Cc: Schuyler Patton +Signed-off-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -280,6 +280,10 @@ struct cpsw_ss_regs { + /* Bit definitions for the CPSW1_TS_SEQ_LTYPE register */ + #define CPSW_V1_SEQ_ID_OFS_SHIFT 16 + ++#define CPSW_MAX_BLKS_TX 15 ++#define CPSW_MAX_BLKS_TX_SHIFT 4 ++#define CPSW_MAX_BLKS_RX 5 ++ + struct cpsw_host_regs { + u32 max_blks; + u32 blk_cnt; +@@ -1127,11 +1131,23 @@ static void cpsw_slave_open(struct cpsw_ + switch (priv->version) { + case CPSW_VERSION_1: + slave_write(slave, TX_PRIORITY_MAPPING, CPSW1_TX_PRI_MAP); ++ /* Increase RX FIFO size to 5 for supporting fullduplex ++ * flow control mode ++ */ ++ slave_write(slave, ++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) | ++ CPSW_MAX_BLKS_RX, CPSW1_MAX_BLKS); + break; + case CPSW_VERSION_2: + case CPSW_VERSION_3: + case CPSW_VERSION_4: + slave_write(slave, TX_PRIORITY_MAPPING, CPSW2_TX_PRI_MAP); ++ /* Increase RX FIFO size to 5 for supporting fullduplex ++ * flow control mode ++ */ ++ slave_write(slave, ++ (CPSW_MAX_BLKS_TX << CPSW_MAX_BLKS_TX_SHIFT) | ++ CPSW_MAX_BLKS_RX, CPSW2_MAX_BLKS); + break; + } + diff --git a/queue-4.4/net-freescale-fix-potential-null-pointer-dereference.patch b/queue-4.4/net-freescale-fix-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..b5da5d1b495 --- /dev/null +++ b/queue-4.4/net-freescale-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,47 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Gustavo A. R. Silva" +Date: Tue, 30 May 2017 17:38:43 -0500 +Subject: net: freescale: fix potential null pointer dereference + +From: "Gustavo A. R. Silva" + + +[ Upstream commit 06d2d6431bc8d41ef5ffd8bd4b52cea9f72aed22 ] + +Add NULL check before dereferencing pointer _id_ in order to avoid +a potential NULL pointer dereference. + +Addresses-Coverity-ID: 1397995 +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/fsl_pq_mdio.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/fsl_pq_mdio.c ++++ b/drivers/net/ethernet/freescale/fsl_pq_mdio.c +@@ -382,7 +382,7 @@ static int fsl_pq_mdio_probe(struct plat + { + const struct of_device_id *id = + of_match_device(fsl_pq_mdio_match, &pdev->dev); +- const struct fsl_pq_mdio_data *data = id->data; ++ const struct fsl_pq_mdio_data *data; + struct device_node *np = pdev->dev.of_node; + struct resource res; + struct device_node *tbi; +@@ -390,6 +390,13 @@ static int fsl_pq_mdio_probe(struct plat + struct mii_bus *new_bus; + int err; + ++ if (!id) { ++ dev_err(&pdev->dev, "Failed to match device\n"); ++ return -ENODEV; ++ } ++ ++ data = id->data; ++ + dev_dbg(&pdev->dev, "found %s compatible node\n", id->compatible); + + new_bus = mdiobus_alloc_size(sizeof(*priv)); diff --git a/queue-4.4/net-ieee802154-fix-net_device-reference-release-too-early.patch b/queue-4.4/net-ieee802154-fix-net_device-reference-release-too-early.patch new file mode 100644 index 00000000000..4358209c490 --- /dev/null +++ b/queue-4.4/net-ieee802154-fix-net_device-reference-release-too-early.patch @@ -0,0 +1,176 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Lin Zhang +Date: Tue, 23 May 2017 13:29:39 +0800 +Subject: net: ieee802154: fix net_device reference release too early + +From: Lin Zhang + + +[ Upstream commit a611c58b3d42a92e6b23423e166dd17c0c7fffce ] + +This patch fixes the kernel oops when release net_device reference in +advance. In function raw_sendmsg(i think the dgram_sendmsg has the same +problem), there is a race condition between dev_put and dev_queue_xmit +when the device is gong that maybe lead to dev_queue_ximt to see +an illegal net_device pointer. + +My test kernel is 3.13.0-32 and because i am not have a real 802154 +device, so i change lowpan_newlink function to this: + + /* find and hold real wpan device */ + real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK])); + if (!real_dev) + return -ENODEV; +// if (real_dev->type != ARPHRD_IEEE802154) { +// dev_put(real_dev); +// return -EINVAL; +// } + lowpan_dev_info(dev)->real_dev = real_dev; + lowpan_dev_info(dev)->fragment_tag = 0; + mutex_init(&lowpan_dev_info(dev)->dev_list_mtx); + +Also, in order to simulate preempt, i change the raw_sendmsg function +to this: + + skb->dev = dev; + skb->sk = sk; + skb->protocol = htons(ETH_P_IEEE802154); + dev_put(dev); + //simulate preempt + schedule_timeout_uninterruptible(30 * HZ); + err = dev_queue_xmit(skb); + if (err > 0) + err = net_xmit_errno(err); + +and this is my userspace test code named test_send_data: + +int main(int argc, char **argv) +{ + char buf[127]; + int sockfd; + sockfd = socket(AF_IEEE802154, SOCK_RAW, 0); + if (sockfd < 0) { + printf("create sockfd error: %s\n", strerror(errno)); + return -1; + } + send(sockfd, buf, sizeof(buf), 0); + return 0; +} + +This is my test case: + +root@zhanglin-x-computer:~/develop/802154# uname -a +Linux zhanglin-x-computer 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 +03:51:08 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux +root@zhanglin-x-computer:~/develop/802154# ip link add link eth0 name +lowpan0 type lowpan +root@zhanglin-x-computer:~/develop/802154# +//keep the lowpan0 device down +root@zhanglin-x-computer:~/develop/802154# ./test_send_data & +//wait a while +root@zhanglin-x-computer:~/develop/802154# ip link del link dev lowpan0 +//the device is gone +//oops +[381.303307] general protection fault: 0000 [#1]SMP +[381.303407] Modules linked in: af_802154 6lowpan bnep rfcomm +bluetooth nls_iso8859_1 snd_hda_codec_hdmi snd_hda_codec_realtek +rts5139(C) snd_hda_intel +snd_had_codec snd_hwdep snd_pcm snd_page_alloc snd_seq_midi +snd_seq_midi_event snd_rawmidi snd_req intel_rapl snd_seq_device +coretemp i915 kvm_intel +kvm snd_timer snd crct10dif_pclmul crc32_pclmul ghash_clmulni_intel +cypted drm_kms_helper drm i2c_algo_bit soundcore video mac_hid +parport_pc ppdev ip parport hid_generic +usbhid hid ahci r8169 mii libahdi +[381.304286] CPU:1 PID: 2524 Commm: 1 Tainted: G C 0 3.13.0-32-generic +[381.304409] Hardware name: Haier Haier DT Computer/Haier DT Codputer, +BIOS FIBT19H02_X64 06/09/2014 +[381.304546] tasks: ffff000096965fc0 ti: ffffB0013779c000 task.ti: +ffffB8013779c000 +[381.304659] RIP: 0010:[] [] +__dev_queue_ximt+0x61/0x500 +[381.304798] RSP: 0018:ffffB8013779dca0 EFLAGS: 00010202 +[381.304880] RAX: 272b031d57565351 RBX: 0000000000000000 RCX: ffff8800968f1a00 +[381.304987] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8800968f1a00 +[381.305095] RBP: ffff8e013773dce0 R08: 0000000000000266 R09: 0000000000000004 +[381.305202] R10: 0000000000000004 R11: 0000000000000005 R12: ffff88013902e000 +[381.305310] R13: 000000000000007f R14: 000000000000007f R15: ffff8800968f1a00 +[381.305418] FS: 00007fc57f50f740(0000) GS: ffff88013fc80000(0000) +knlGS: 0000000000000000 +[381.305540] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +[381.305627] CR2: 00007fad0841c000 CR3: 00000001368dd000 CR4: 00000000001007e0 +[361.905734] Stack: +[381.305768] 00000000002052d0 000000003facb30a ffff88013779dcc0 +ffff880137764000 +[381.305898] ffff88013779de70 000000000000007f 000000000000007f +ffff88013902e000 +[381.306026] ffff88013779dcf0 ffffffff81622490 ffff88013779dd39 +ffffffffa03af9f1 +[381.306155] Call Trace: +[381.306202] [] dev_queue_xmit+0x10/0x20 +[381.306294] [] raw_sendmsg+0x1b1/0x270 [af_802154] +[381.306396] [] ieee802154_sock_sendmsg+0x14/0x20 [af_802154] +[381.306512] [] sock_sendmsg+0x8b/0xc0 +[381.306600] [] ? __d_alloc+0x25/0x180 +[381.306687] [] ? kmem_cache_alloc_trace+0x1c6/0x1f0 +[381.306791] [] SYSC_sendto+0x121/0x1c0 +[381.306878] [] ? vtime_account_user+x54/0x60 +[381.306975] [] ? syscall_trace_enter+0x145/0x250 +[381.307073] [] SyS_sendto+0xe/0x10 +[381.307156] [] tracesys+0xe1/0xe6 +[381.307233] Code: c6 a1 a4 ff 41 8b 57 78 49 8b 47 20 85 d2 48 8b 80 +78 07 00 00 75 21 49 8b 57 18 48 85 d2 74 18 48 85 c0 74 13 8b 92 ac +01 00 00 <3b> 50 10 73 08 8b 44 90 14 41 89 47 78 41 f6 84 24 d5 00 00 +00 +[381.307801] RIP [] _dev_queue_xmit+0x61/0x500 +[381.307901] RSP +[381.347512] Kernel panic - not syncing: Fatal exception in interrupt +[381.347747] drm_kms_helper: panic occurred, switching back to text console + +In my opinion, there is always exist a chance that the device is gong +before call dev_queue_xmit. + +I think the latest kernel is have the same problem and that +dev_put should be behind of the dev_queue_xmit. + +Signed-off-by: Lin Zhang +Acked-by: Stefan Schmidt +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ieee802154/socket.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ieee802154/socket.c ++++ b/net/ieee802154/socket.c +@@ -302,12 +302,12 @@ static int raw_sendmsg(struct sock *sk, + skb->sk = sk; + skb->protocol = htons(ETH_P_IEEE802154); + +- dev_put(dev); +- + err = dev_queue_xmit(skb); + if (err > 0) + err = net_xmit_errno(err); + ++ dev_put(dev); ++ + return err ?: size; + + out_skb: +@@ -689,12 +689,12 @@ static int dgram_sendmsg(struct sock *sk + skb->sk = sk; + skb->protocol = htons(ETH_P_IEEE802154); + +- dev_put(dev); +- + err = dev_queue_xmit(skb); + if (err > 0) + err = net_xmit_errno(err); + ++ dev_put(dev); ++ + return err ?: size; + + out_skb: diff --git a/queue-4.4/net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch b/queue-4.4/net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch new file mode 100644 index 00000000000..f3d2d1033a1 --- /dev/null +++ b/queue-4.4/net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch @@ -0,0 +1,51 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: linzhang +Date: Thu, 25 May 2017 14:07:18 +0800 +Subject: net: llc: add lock_sock in llc_ui_bind to avoid a race condition + +From: linzhang + + +[ Upstream commit 0908cf4dfef35fc6ac12329007052ebe93ff1081 ] + +There is a race condition in llc_ui_bind if two or more processes/threads +try to bind a same socket. + +If more processes/threads bind a same socket success that will lead to +two problems, one is this action is not what we expected, another is +will lead to kernel in unstable status or oops(in my simple test case, +cause llc2.ko can't unload). + +The current code is test SOCK_ZAPPED bit to avoid a process to +bind a same socket twice but that is can't avoid more processes/threads +try to bind a same socket at the same time. + +So, add lock_sock in llc_ui_bind like others, such as llc_ui_connect. + +Signed-off-by: Lin Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/llc/af_llc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -309,6 +309,8 @@ static int llc_ui_bind(struct socket *so + int rc = -EINVAL; + + dprintk("%s: binding %02X\n", __func__, addr->sllc_sap); ++ ++ lock_sock(sk); + if (unlikely(!sock_flag(sk, SOCK_ZAPPED) || addrlen != sizeof(*addr))) + goto out; + rc = -EAFNOSUPPORT; +@@ -380,6 +382,7 @@ static int llc_ui_bind(struct socket *so + out_put: + llc_sap_put(sap); + out: ++ release_sock(sk); + return rc; + } + diff --git a/queue-4.4/net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch b/queue-4.4/net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch new file mode 100644 index 00000000000..ed76a2ff47a --- /dev/null +++ b/queue-4.4/net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch @@ -0,0 +1,76 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ido Shamay +Date: Mon, 5 Jun 2017 10:44:56 +0300 +Subject: net/mlx4: Check if Granular QoS per VF has been enabled before updating QP qos_vport + +From: Ido Shamay + + +[ Upstream commit 269f9883fe254d109afdfc657875c456d6fabb08 ] + +The Granular QoS per VF feature must be enabled in FW before it can be +used. + +Thus, the driver cannot modify a QP's qos_vport value (via the UPDATE_QP FW +command) if the feature has not been enabled -- the FW returns an error if +this is attempted. + +Fixes: 08068cd5683f ("net/mlx4: Added qos_vport QP configuration in VST mode") +Signed-off-by: Ido Shamay +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/qp.c | 6 ++++++ + drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 16 +++++++++++----- + 2 files changed, 17 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c +@@ -481,6 +481,12 @@ int mlx4_update_qp(struct mlx4_dev *dev, + } + + if (attr & MLX4_UPDATE_QP_QOS_VPORT) { ++ if (!(dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_QOS_VPP)) { ++ mlx4_warn(dev, "Granular QoS per VF is not enabled\n"); ++ err = -EOPNOTSUPP; ++ goto out; ++ } ++ + qp_mask |= 1ULL << MLX4_UPD_QP_MASK_QOS_VPP; + cmd->qp_context.qos_vport = params->qos_vport; + } +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -5040,6 +5040,13 @@ void mlx4_delete_all_resources_for_slave + mutex_unlock(&priv->mfunc.master.res_tracker.slave_list[slave].mutex); + } + ++static void update_qos_vpp(struct mlx4_update_qp_context *ctx, ++ struct mlx4_vf_immed_vlan_work *work) ++{ ++ ctx->qp_mask |= cpu_to_be64(1ULL << MLX4_UPD_QP_MASK_QOS_VPP); ++ ctx->qp_context.qos_vport = work->qos_vport; ++} ++ + void mlx4_vf_immed_vlan_work_handler(struct work_struct *_work) + { + struct mlx4_vf_immed_vlan_work *work = +@@ -5144,11 +5151,10 @@ void mlx4_vf_immed_vlan_work_handler(str + qp->sched_queue & 0xC7; + upd_context->qp_context.pri_path.sched_queue |= + ((work->qos & 0x7) << 3); +- upd_context->qp_mask |= +- cpu_to_be64(1ULL << +- MLX4_UPD_QP_MASK_QOS_VPP); +- upd_context->qp_context.qos_vport = +- work->qos_vport; ++ ++ if (dev->caps.flags2 & ++ MLX4_DEV_CAP_FLAG2_QOS_VPP) ++ update_qos_vpp(upd_context, work); + } + + err = mlx4_cmd(dev, mailbox->dma, diff --git a/queue-4.4/net-mlx4-fix-the-check-in-attaching-steering-rules.patch b/queue-4.4/net-mlx4-fix-the-check-in-attaching-steering-rules.patch new file mode 100644 index 00000000000..13609310dd0 --- /dev/null +++ b/queue-4.4/net-mlx4-fix-the-check-in-attaching-steering-rules.patch @@ -0,0 +1,123 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Talat Batheesh +Date: Sun, 4 Jun 2017 14:30:07 +0300 +Subject: net/mlx4: Fix the check in attaching steering rules + +From: Talat Batheesh + + +[ Upstream commit 6dc06c08bef1c746ff8da33dab677cfbacdcad32 ] + +Our previous patch (cited below) introduced a regression +for RAW Eth QPs. + +Fix it by checking if the QP number provided by user-space +exists, hence allowing steering rules to be added for valid +QPs only. + +Fixes: 89c557687a32 ("net/mlx4_en: Avoid adding steering rules with invalid ring") +Reported-by: Or Gerlitz +Signed-off-by: Talat Batheesh +Signed-off-by: Tariq Toukan +Acked-by: Or Gerlitz +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 ----- + drivers/net/ethernet/mellanox/mlx4/mcg.c | 15 +++++++++++---- + drivers/net/ethernet/mellanox/mlx4/qp.c | 13 +++++++++++++ + include/linux/mlx4/qp.h | 1 + + 4 files changed, 25 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1513,11 +1513,6 @@ static int mlx4_en_flow_replace(struct n + qpn = priv->drop_qp.qpn; + else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) { + qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1); +- if (qpn < priv->rss_map.base_qpn || +- qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) { +- en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn); +- return -EINVAL; +- } + } else { + if (cmd->fs.ring_cookie >= priv->rx_ring_num) { + en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n", +--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c +@@ -35,6 +35,7 @@ + #include + + #include ++#include + #include + + #include "mlx4.h" +@@ -985,16 +986,21 @@ int mlx4_flow_attach(struct mlx4_dev *de + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + ++ if (!mlx4_qp_lookup(dev, rule->qpn)) { ++ mlx4_err_rule(dev, "QP doesn't exist\n", rule); ++ ret = -EINVAL; ++ goto out; ++ } ++ + trans_rule_ctrl_to_hw(rule, mailbox->buf); + + size += sizeof(struct mlx4_net_trans_rule_hw_ctrl); + + list_for_each_entry(cur, &rule->list, list) { + ret = parse_trans_rule(dev, cur, mailbox->buf + size); +- if (ret < 0) { +- mlx4_free_cmd_mailbox(dev, mailbox); +- return ret; +- } ++ if (ret < 0) ++ goto out; ++ + size += ret; + } + +@@ -1021,6 +1027,7 @@ int mlx4_flow_attach(struct mlx4_dev *de + } + } + ++out: + mlx4_free_cmd_mailbox(dev, mailbox); + + return ret; +--- a/drivers/net/ethernet/mellanox/mlx4/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c +@@ -381,6 +381,19 @@ static void mlx4_qp_free_icm(struct mlx4 + __mlx4_qp_free_icm(dev, qpn); + } + ++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn) ++{ ++ struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table; ++ struct mlx4_qp *qp; ++ ++ spin_lock(&qp_table->lock); ++ ++ qp = __mlx4_qp_lookup(dev, qpn); ++ ++ spin_unlock(&qp_table->lock); ++ return qp; ++} ++ + int mlx4_qp_alloc(struct mlx4_dev *dev, int qpn, struct mlx4_qp *qp, gfp_t gfp) + { + struct mlx4_priv *priv = mlx4_priv(dev); +--- a/include/linux/mlx4/qp.h ++++ b/include/linux/mlx4/qp.h +@@ -465,6 +465,7 @@ struct mlx4_update_qp_params { + u16 rate_val; + }; + ++struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn); + int mlx4_update_qp(struct mlx4_dev *dev, u32 qpn, + enum mlx4_update_qp_attr attr, + struct mlx4_update_qp_params *params); diff --git a/queue-4.4/net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch b/queue-4.4/net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch new file mode 100644 index 00000000000..fbc686c18eb --- /dev/null +++ b/queue-4.4/net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch @@ -0,0 +1,37 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Talat Batheesh +Date: Tue, 9 May 2017 14:45:23 +0300 +Subject: net/mlx4_en: Avoid adding steering rules with invalid ring + +From: Talat Batheesh + + +[ Upstream commit 89c557687a32c294e9d25670a96e9287c09f2d5f ] + +Inserting steering rules with illegal ring is an invalid operation, +block it. + +Fixes: 820672812f82 ('net/mlx4_en: Manage flow steering rules with ethtool') +Signed-off-by: Talat Batheesh +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1513,6 +1513,11 @@ static int mlx4_en_flow_replace(struct n + qpn = priv->drop_qp.qpn; + else if (cmd->fs.ring_cookie & EN_ETHTOOL_QP_ATTACH) { + qpn = cmd->fs.ring_cookie & (EN_ETHTOOL_QP_ATTACH - 1); ++ if (qpn < priv->rss_map.base_qpn || ++ qpn >= priv->rss_map.base_qpn + priv->rx_ring_num) { ++ en_warn(priv, "rxnfc: QP (0x%x) doesn't exist\n", qpn); ++ return -EINVAL; ++ } + } else { + if (cmd->fs.ring_cookie >= priv->rx_ring_num) { + en_warn(priv, "rxnfc: RX ring (%llu) doesn't exist\n", diff --git a/queue-4.4/net-mlx5-avoid-build-warning-for-uniprocessor.patch b/queue-4.4/net-mlx5-avoid-build-warning-for-uniprocessor.patch new file mode 100644 index 00000000000..a9d666a8848 --- /dev/null +++ b/queue-4.4/net-mlx5-avoid-build-warning-for-uniprocessor.patch @@ -0,0 +1,45 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Arnd Bergmann +Date: Mon, 29 May 2017 15:00:17 +0200 +Subject: net/mlx5: avoid build warning for uniprocessor + +From: Arnd Bergmann + + +[ Upstream commit f0d7ae95fff4ab444b8433f07afc4b077ef1a285 ] + +Building the driver with CONFIG_SMP disabled results in a harmless +warning: + +ethernet/mellanox/mlx5/core/main.c: In function 'mlx5_irq_set_affinity_hint': +ethernet/mellanox/mlx5/core/main.c:615:6: error: unused variable 'irq' [-Werror=unused-variable] + +It's better to express the conditional compilation using IS_ENABLED() +here, as that lets the compiler see what the intented use for the variable +is, and that it can be silently discarded. + +Fixes: b665d98edc9a ("net/mlx5: Tolerate irq_set_affinity_hint() failures") +Signed-off-by: Arnd Bergmann +Acked-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -522,10 +522,9 @@ static int mlx5_irq_set_affinity_hint(st + cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node), + priv->irq_info[i].mask); + +-#ifdef CONFIG_SMP +- if (irq_set_affinity_hint(irq, priv->irq_info[i].mask)) ++ if (IS_ENABLED(CONFIG_SMP) && ++ irq_set_affinity_hint(irq, priv->irq_info[i].mask)) + mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq); +-#endif + + return 0; + } diff --git a/queue-4.4/net-mlx5-tolerate-irq_set_affinity_hint-failures.patch b/queue-4.4/net-mlx5-tolerate-irq_set_affinity_hint-failures.patch new file mode 100644 index 00000000000..502a79c9675 --- /dev/null +++ b/queue-4.4/net-mlx5-tolerate-irq_set_affinity_hint-failures.patch @@ -0,0 +1,62 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tariq Toukan +Date: Thu, 18 May 2017 13:34:43 +0300 +Subject: net/mlx5: Tolerate irq_set_affinity_hint() failures + +From: Tariq Toukan + + +[ Upstream commit b665d98edc9ab295169be2fc5bb4e89a46de0a1a ] + +Add tolerance to failures of irq_set_affinity_hint(). +Its role is to give hints that optimizes performance, +and should not block the driver load. + +In non-SMP systems, functionality is not available as +there is a single core, and all these calls definitely +fail. Hence, do not call the function and avoid the +warning prints. + +Fixes: db058a186f98 ("net/mlx5_core: Set irq affinity hints") +Signed-off-by: Tariq Toukan +Cc: kernel-team@fb.com +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -513,7 +513,6 @@ static int mlx5_irq_set_affinity_hint(st + struct mlx5_priv *priv = &mdev->priv; + struct msix_entry *msix = priv->msix_arr; + int irq = msix[i + MLX5_EQ_VEC_COMP_BASE].vector; +- int err; + + if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) { + mlx5_core_warn(mdev, "zalloc_cpumask_var failed"); +@@ -523,18 +522,12 @@ static int mlx5_irq_set_affinity_hint(st + cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node), + priv->irq_info[i].mask); + +- err = irq_set_affinity_hint(irq, priv->irq_info[i].mask); +- if (err) { +- mlx5_core_warn(mdev, "irq_set_affinity_hint failed,irq 0x%.4x", +- irq); +- goto err_clear_mask; +- } ++#ifdef CONFIG_SMP ++ if (irq_set_affinity_hint(irq, priv->irq_info[i].mask)) ++ mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq); ++#endif + + return 0; +- +-err_clear_mask: +- free_cpumask_var(priv->irq_info[i].mask); +- return err; + } + + static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i) diff --git a/queue-4.4/net-move-somaxconn-init-from-sysctl-code.patch b/queue-4.4/net-move-somaxconn-init-from-sysctl-code.patch new file mode 100644 index 00000000000..53f8248e7fc --- /dev/null +++ b/queue-4.4/net-move-somaxconn-init-from-sysctl-code.patch @@ -0,0 +1,69 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Roman Kapl +Date: Wed, 24 May 2017 10:22:22 +0200 +Subject: net: move somaxconn init from sysctl code + +From: Roman Kapl + + +[ Upstream commit 7c3f1875c66fbc19762760097cabc91849ea0bbb ] + +The default value for somaxconn is set in sysctl_core_net_init(), but this +function is not called when kernel is configured without CONFIG_SYSCTL. + +This results in the kernel not being able to accept TCP connections, +because the backlog has zero size. Usually, the user ends up with: +"TCP: request_sock_TCP: Possible SYN flooding on port 7. Dropping request. Check SNMP counters." +If SYN cookies are not enabled the connection is rejected. + +Before ef547f2ac16 (tcp: remove max_qlen_log), the effects were less +severe, because the backlog was always at least eight slots long. + +Signed-off-by: Roman Kapl +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/net_namespace.c | 19 +++++++++++++++++++ + net/core/sysctl_net_core.c | 2 -- + 2 files changed, 19 insertions(+), 2 deletions(-) + +--- a/net/core/net_namespace.c ++++ b/net/core/net_namespace.c +@@ -310,6 +310,25 @@ out_undo: + goto out; + } + ++static int __net_init net_defaults_init_net(struct net *net) ++{ ++ net->core.sysctl_somaxconn = SOMAXCONN; ++ return 0; ++} ++ ++static struct pernet_operations net_defaults_ops = { ++ .init = net_defaults_init_net, ++}; ++ ++static __init int net_defaults_init(void) ++{ ++ if (register_pernet_subsys(&net_defaults_ops)) ++ panic("Cannot initialize net default settings"); ++ ++ return 0; ++} ++ ++core_initcall(net_defaults_init); + + #ifdef CONFIG_NET_NS + static struct kmem_cache *net_cachep; +--- a/net/core/sysctl_net_core.c ++++ b/net/core/sysctl_net_core.c +@@ -429,8 +429,6 @@ static __net_init int sysctl_core_net_in + { + struct ctl_table *tbl; + +- net->core.sysctl_somaxconn = SOMAXCONN; +- + tbl = netns_core_table; + if (!net_eq(net, &init_net)) { + tbl = kmemdup(tbl, sizeof(netns_core_table), GFP_KERNEL); diff --git a/queue-4.4/net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch b/queue-4.4/net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch new file mode 100644 index 00000000000..c20e229559b --- /dev/null +++ b/queue-4.4/net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Russell King +Date: Mon, 5 Jun 2017 12:22:55 +0100 +Subject: net: phy: avoid genphy_aneg_done() for PHYs without clause 22 support + +From: Russell King + + +[ Upstream commit 41408ad519f7a2a1c5229e61f2a97f4df1b61adc ] + +Avoid calling genphy_aneg_done() for PHYs that do not implement the +Clause 22 register set. + +Clause 45 PHYs may implement the Clause 22 register set along with the +Clause 22 extension MMD. Hence, we can't simply block access to the +Clause 22 functions based on the PHY being a Clause 45 PHY. + +Signed-off-by: Russell King +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phy.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -148,6 +148,12 @@ static inline int phy_aneg_done(struct p + if (phydev->drv->aneg_done) + return phydev->drv->aneg_done(phydev); + ++ /* Avoid genphy_aneg_done() if the Clause 45 PHY does not ++ * implement Clause 22 registers ++ */ ++ if (phydev->is_c45 && !(phydev->c45_ids.devices_in_package & BIT(0))) ++ return -EINVAL; ++ + return genphy_aneg_done(phydev); + } + diff --git a/queue-4.4/net-qca_spi-fix-alignment-issues-in-rx-path.patch b/queue-4.4/net-qca_spi-fix-alignment-issues-in-rx-path.patch new file mode 100644 index 00000000000..d73961b4b45 --- /dev/null +++ b/queue-4.4/net-qca_spi-fix-alignment-issues-in-rx-path.patch @@ -0,0 +1,55 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Stefan Wahren +Date: Tue, 9 May 2017 15:40:38 +0200 +Subject: net: qca_spi: Fix alignment issues in rx path + +From: Stefan Wahren + + +[ Upstream commit 8d66c30b12ed3cb533696dea8b9a9eadd5da426a ] + +The qca_spi driver causes alignment issues on ARM devices. +So fix this by using netdev_alloc_skb_ip_align(). + +Signed-off-by: Stefan Wahren +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -296,8 +296,9 @@ qcaspi_receive(struct qcaspi *qca) + + /* Allocate rx SKB if we don't have one available. */ + if (!qca->rx_skb) { +- qca->rx_skb = netdev_alloc_skb(net_dev, +- net_dev->mtu + VLAN_ETH_HLEN); ++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, ++ net_dev->mtu + ++ VLAN_ETH_HLEN); + if (!qca->rx_skb) { + netdev_dbg(net_dev, "out of RX resources\n"); + qca->stats.out_of_mem++; +@@ -377,7 +378,7 @@ qcaspi_receive(struct qcaspi *qca) + qca->rx_skb, qca->rx_skb->dev); + qca->rx_skb->ip_summed = CHECKSUM_UNNECESSARY; + netif_rx_ni(qca->rx_skb); +- qca->rx_skb = netdev_alloc_skb(net_dev, ++ qca->rx_skb = netdev_alloc_skb_ip_align(net_dev, + net_dev->mtu + VLAN_ETH_HLEN); + if (!qca->rx_skb) { + netdev_dbg(net_dev, "out of RX resources\n"); +@@ -759,7 +760,8 @@ qcaspi_netdev_init(struct net_device *de + if (!qca->rx_buffer) + return -ENOBUFS; + +- qca->rx_skb = netdev_alloc_skb(dev, qca->net_dev->mtu + VLAN_ETH_HLEN); ++ qca->rx_skb = netdev_alloc_skb_ip_align(dev, qca->net_dev->mtu + ++ VLAN_ETH_HLEN); + if (!qca->rx_skb) { + kfree(qca->rx_buffer); + netdev_info(qca->net_dev, "Failed to allocate RX sk_buff.\n"); diff --git a/queue-4.4/net-x25-fix-one-potential-use-after-free-issue.patch b/queue-4.4/net-x25-fix-one-potential-use-after-free-issue.patch new file mode 100644 index 00000000000..105bdabe18c --- /dev/null +++ b/queue-4.4/net-x25-fix-one-potential-use-after-free-issue.patch @@ -0,0 +1,109 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: linzhang +Date: Wed, 17 May 2017 12:05:07 +0800 +Subject: net: x25: fix one potential use-after-free issue + +From: linzhang + + +[ Upstream commit 64df6d525fcff1630098db9238bfd2b3e092d5c1 ] + +The function x25_init is not properly unregister related resources +on error handler.It is will result in kernel oops if x25_init init +failed, so add properly unregister call on error handler. + +Also, i adjust the coding style and make x25_register_sysctl properly +return failure. + +Signed-off-by: linzhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/net/x25.h | 4 ++-- + net/x25/af_x25.c | 24 ++++++++++++++++-------- + net/x25/sysctl_net_x25.c | 5 ++++- + 3 files changed, 22 insertions(+), 11 deletions(-) + +--- a/include/net/x25.h ++++ b/include/net/x25.h +@@ -298,10 +298,10 @@ void x25_check_rbuf(struct sock *); + + /* sysctl_net_x25.c */ + #ifdef CONFIG_SYSCTL +-void x25_register_sysctl(void); ++int x25_register_sysctl(void); + void x25_unregister_sysctl(void); + #else +-static inline void x25_register_sysctl(void) {}; ++static inline int x25_register_sysctl(void) { return 0; }; + static inline void x25_unregister_sysctl(void) {}; + #endif /* CONFIG_SYSCTL */ + +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1794,32 +1794,40 @@ void x25_kill_by_neigh(struct x25_neigh + + static int __init x25_init(void) + { +- int rc = proto_register(&x25_proto, 0); ++ int rc; + +- if (rc != 0) ++ rc = proto_register(&x25_proto, 0); ++ if (rc) + goto out; + + rc = sock_register(&x25_family_ops); +- if (rc != 0) ++ if (rc) + goto out_proto; + + dev_add_pack(&x25_packet_type); + + rc = register_netdevice_notifier(&x25_dev_notifier); +- if (rc != 0) ++ if (rc) + goto out_sock; + +- pr_info("Linux Version 0.2\n"); ++ rc = x25_register_sysctl(); ++ if (rc) ++ goto out_dev; + +- x25_register_sysctl(); + rc = x25_proc_init(); +- if (rc != 0) +- goto out_dev; ++ if (rc) ++ goto out_sysctl; ++ ++ pr_info("Linux Version 0.2\n"); ++ + out: + return rc; ++out_sysctl: ++ x25_unregister_sysctl(); + out_dev: + unregister_netdevice_notifier(&x25_dev_notifier); + out_sock: ++ dev_remove_pack(&x25_packet_type); + sock_unregister(AF_X25); + out_proto: + proto_unregister(&x25_proto); +--- a/net/x25/sysctl_net_x25.c ++++ b/net/x25/sysctl_net_x25.c +@@ -73,9 +73,12 @@ static struct ctl_table x25_table[] = { + { 0, }, + }; + +-void __init x25_register_sysctl(void) ++int __init x25_register_sysctl(void) + { + x25_table_header = register_net_sysctl(&init_net, "net/x25", x25_table); ++ if (!x25_table_header) ++ return -ENOMEM; ++ return 0; + } + + void x25_unregister_sysctl(void) diff --git a/queue-4.4/netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch b/queue-4.4/netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch new file mode 100644 index 00000000000..fbb7239206d --- /dev/null +++ b/queue-4.4/netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch @@ -0,0 +1,60 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Liping Zhang +Date: Sun, 21 May 2017 07:22:49 +0800 +Subject: netfilter: ctnetlink: fix incorrect nf_ct_put during hash resize + +From: Liping Zhang + + +[ Upstream commit fefa92679dbe0c613e62b6c27235dcfbe9640ad1 ] + +If nf_conntrack_htable_size was adjusted by the user during the ct +dump operation, we may invoke nf_ct_put twice for the same ct, i.e. +the "last" ct. This will cause the ct will be freed but still linked +in hash buckets. + +It's very easy to reproduce the problem by the following commands: + # while : ; do + echo $RANDOM > /proc/sys/net/netfilter/nf_conntrack_buckets + done + # while : ; do + conntrack -L + done + # iperf -s 127.0.0.1 & + # iperf -c 127.0.0.1 -P 60 -t 36000 + +After a while, the system will hang like this: + NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [bash:20184] + NMI watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [iperf:20382] + ... + +So at last if we find cb->args[1] is equal to "last", this means hash +resize happened, then we can set cb->args[1] to 0 to fix the above +issue. + +Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") +Signed-off-by: Liping Zhang +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_netlink.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -887,8 +887,13 @@ restart: + } + out: + local_bh_enable(); +- if (last) ++ if (last) { ++ /* nf ct hash resize happened, now clear the leftover. */ ++ if ((struct nf_conn *)cb->args[1] == last) ++ cb->args[1] = 0; ++ + nf_ct_put(last); ++ } + + return skb->len; + } diff --git a/queue-4.4/netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch b/queue-4.4/netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch new file mode 100644 index 00000000000..fee8f875886 --- /dev/null +++ b/queue-4.4/netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Colin Ian King +Date: Tue, 9 May 2017 17:19:42 +0100 +Subject: netxen_nic: set rcode to the return status from the call to netxen_issue_cmd + +From: Colin Ian King + + +[ Upstream commit 0fe20fafd1791f993806d417048213ec57b81045 ] + +Currently rcode is being initialized to NX_RCODE_SUCCESS and later it +is checked to see if it is not NX_RCODE_SUCCESS which is never true. It +appears that there is an unintentional missing assignment of rcode from +the return of the call to netxen_issue_cmd() that was dropped in +an earlier fix, so add it in. + +Detected by CoverityScan, CID#401900 ("Logically dead code") + +Fixes: 2dcd5d95ad6b2 ("netxen_nic: fix cdrp race condition") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_ctx.c +@@ -247,7 +247,7 @@ nx_fw_cmd_set_mtu(struct netxen_adapter + cmd.req.arg3 = 0; + + if (recv_ctx->state == NX_HOST_CTX_STATE_ACTIVE) +- netxen_issue_cmd(adapter, &cmd); ++ rcode = netxen_issue_cmd(adapter, &cmd); + + if (rcode != NX_RCODE_SUCCESS) + return -EIO; diff --git a/queue-4.4/nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch b/queue-4.4/nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch new file mode 100644 index 00000000000..4c34333c94f --- /dev/null +++ b/queue-4.4/nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch @@ -0,0 +1,84 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Trond Myklebust +Date: Thu, 4 May 2017 13:44:04 -0400 +Subject: NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION + +From: Trond Myklebust + + +[ Upstream commit 0048fdd06614a4ea088f9fcad11511956b795698 ] + +If the server returns NFS4ERR_CONN_NOT_BOUND_TO_SESSION because we +are trunking, then RECLAIM_COMPLETE must handle that by calling +nfs4_schedule_session_recovery() and then retrying. + +Reported-by: Chuck Lever +Signed-off-by: Trond Myklebust +Tested-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 7 ++++++- + fs/nfs/nfs4state.c | 10 +++++++--- + 2 files changed, 13 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7670,6 +7670,12 @@ static int nfs41_reclaim_complete_handle + /* fall through */ + case -NFS4ERR_RETRY_UNCACHED_REP: + return -EAGAIN; ++ case -NFS4ERR_BADSESSION: ++ case -NFS4ERR_DEADSESSION: ++ case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: ++ nfs4_schedule_session_recovery(clp->cl_session, ++ task->tk_status); ++ break; + default: + nfs4_schedule_lease_recovery(clp); + } +@@ -7748,7 +7754,6 @@ static int nfs41_proc_reclaim_complete(s + if (status == 0) + status = task->tk_status; + rpc_put_task(task); +- return 0; + out: + dprintk("<-- %s status=%d\n", __func__, status); + return status; +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1593,13 +1593,14 @@ static void nfs4_state_start_reclaim_reb + nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_reboot); + } + +-static void nfs4_reclaim_complete(struct nfs_client *clp, ++static int nfs4_reclaim_complete(struct nfs_client *clp, + const struct nfs4_state_recovery_ops *ops, + struct rpc_cred *cred) + { + /* Notify the server we're done reclaiming our state */ + if (ops->reclaim_complete) +- (void)ops->reclaim_complete(clp, cred); ++ return ops->reclaim_complete(clp, cred); ++ return 0; + } + + static void nfs4_clear_reclaim_server(struct nfs_server *server) +@@ -1646,13 +1647,16 @@ static void nfs4_state_end_reclaim_reboo + { + const struct nfs4_state_recovery_ops *ops; + struct rpc_cred *cred; ++ int err; + + if (!nfs4_state_clear_reclaim_reboot(clp)) + return; + ops = clp->cl_mvops->reboot_recovery_ops; + cred = nfs4_get_clid_cred(clp); +- nfs4_reclaim_complete(clp, ops, cred); ++ err = nfs4_reclaim_complete(clp, ops, cred); + put_rpccred(cred); ++ if (err == -NFS4ERR_CONN_NOT_BOUND_TO_SESSION) ++ set_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state); + } + + static void nfs_delegation_clear_all(struct nfs_client *clp) diff --git a/queue-4.4/nfsv4.1-work-around-a-linux-server-bug.patch b/queue-4.4/nfsv4.1-work-around-a-linux-server-bug.patch new file mode 100644 index 00000000000..d2d66f03a2f --- /dev/null +++ b/queue-4.4/nfsv4.1-work-around-a-linux-server-bug.patch @@ -0,0 +1,48 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Trond Myklebust +Date: Tue, 9 May 2017 15:47:15 -0400 +Subject: NFSv4.1: Work around a Linux server bug... + +From: Trond Myklebust + + +[ Upstream commit f4b23de3dda1536590787c9e5c3d16b8738ab108 ] + +It turns out the Linux server has a bug in its implementation of +supattr_exclcreat; it returns the set of all attributes, whether +or not they are supported by minor version 1. +In order to avoid a regression, we therefore apply the supported_attrs +as a mask on top of whatever the server sent us. + +Reported-by: Anna Schumaker +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3025,6 +3025,7 @@ static int _nfs4_server_capabilities(str + .rpc_resp = &res, + }; + int status; ++ int i; + + bitmask[0] = FATTR4_WORD0_SUPPORTED_ATTRS | + FATTR4_WORD0_FH_EXPIRE_TYPE | +@@ -3090,8 +3091,13 @@ static int _nfs4_server_capabilities(str + server->cache_consistency_bitmask[0] &= FATTR4_WORD0_CHANGE|FATTR4_WORD0_SIZE; + server->cache_consistency_bitmask[1] &= FATTR4_WORD1_TIME_METADATA|FATTR4_WORD1_TIME_MODIFY; + server->cache_consistency_bitmask[2] = 0; ++ ++ /* Avoid a regression due to buggy server */ ++ for (i = 0; i < ARRAY_SIZE(res.exclcreat_bitmask); i++) ++ res.exclcreat_bitmask[i] &= res.attr_bitmask[i]; + memcpy(server->exclcreat_bitmask, res.exclcreat_bitmask, + sizeof(server->exclcreat_bitmask)); ++ + server->acl_bitmask = res.acl_bitmask; + server->fh_expire_type = res.fh_expire_type; + } diff --git a/queue-4.4/ovl-filter-trusted-xattr-for-non-admin.patch b/queue-4.4/ovl-filter-trusted-xattr-for-non-admin.patch new file mode 100644 index 00000000000..b881a342fc4 --- /dev/null +++ b/queue-4.4/ovl-filter-trusted-xattr-for-non-admin.patch @@ -0,0 +1,51 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Miklos Szeredi +Date: Mon, 29 May 2017 15:15:27 +0200 +Subject: ovl: filter trusted xattr for non-admin + +From: Miklos Szeredi + + +[ Upstream commit a082c6f680da298cf075886ff032f32ccb7c5e1a ] + +Filesystems filter out extended attributes in the "trusted." domain for +unprivlieged callers. + +Overlay calls underlying filesystem's method with elevated privs, so need +to do the filtering in overlayfs too. + +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/inode.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -272,6 +272,16 @@ ssize_t ovl_getxattr(struct dentry *dent + return vfs_getxattr(realpath.dentry, name, value, size); + } + ++static bool ovl_can_list(const char *s) ++{ ++ /* List all non-trusted xatts */ ++ if (strncmp(s, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) != 0) ++ return true; ++ ++ /* Never list trusted.overlay, list other trusted for superuser only */ ++ return !ovl_is_private_xattr(s) && capable(CAP_SYS_ADMIN); ++} ++ + ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size) + { + struct path realpath; +@@ -296,7 +306,7 @@ ssize_t ovl_listxattr(struct dentry *den + return -EIO; + + len -= slen; +- if (ovl_is_private_xattr(s)) { ++ if (!ovl_can_list(s)) { + res -= slen; + memmove(s, s + slen, len); + } else { diff --git a/queue-4.4/perf-core-correct-event-creation-with-perf_format_group.patch b/queue-4.4/perf-core-correct-event-creation-with-perf_format_group.patch new file mode 100644 index 00000000000..546ce45ec48 --- /dev/null +++ b/queue-4.4/perf-core-correct-event-creation-with-perf_format_group.patch @@ -0,0 +1,85 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Peter Zijlstra +Date: Tue, 30 May 2017 11:45:12 +0200 +Subject: perf/core: Correct event creation with PERF_FORMAT_GROUP + +From: Peter Zijlstra + + +[ Upstream commit ba5213ae6b88fb170c4771fef6553f759c7d8cdd ] + +Andi was asking about PERF_FORMAT_GROUP vs inherited events, which led +to the discovery of a bug from commit: + + 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff") + + - PERF_SAMPLE_GROUP = 1U << 4, + + PERF_SAMPLE_READ = 1U << 4, + + - if (attr->inherit && (attr->sample_type & PERF_SAMPLE_GROUP)) + + if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP)) + +is a clear fail :/ + +While this changes user visible behaviour; it was previously possible +to create an inherited event with PERF_SAMPLE_READ; this is deemed +acceptible because its results were always incorrect. + +Reported-by: Andi Kleen +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Fixes: 3dab77fb1bf8 ("perf: Rework/fix the whole read vs group stuff") +Link: http://lkml.kernel.org/r/20170530094512.dy2nljns2uq7qa3j@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/events/core.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5271,9 +5271,6 @@ static void perf_output_read_one(struct + __output_copy(handle, values, n * sizeof(u64)); + } + +-/* +- * XXX PERF_FORMAT_GROUP vs inherited events seems difficult. +- */ + static void perf_output_read_group(struct perf_output_handle *handle, + struct perf_event *event, + u64 enabled, u64 running) +@@ -5318,6 +5315,13 @@ static void perf_output_read_group(struc + #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\ + PERF_FORMAT_TOTAL_TIME_RUNNING) + ++/* ++ * XXX PERF_SAMPLE_READ vs inherited events seems difficult. ++ * ++ * The problem is that its both hard and excessively expensive to iterate the ++ * child list, not to mention that its impossible to IPI the children running ++ * on another CPU, from interrupt/NMI context. ++ */ + static void perf_output_read(struct perf_output_handle *handle, + struct perf_event *event) + { +@@ -7958,9 +7962,10 @@ perf_event_alloc(struct perf_event_attr + local64_set(&hwc->period_left, hwc->sample_period); + + /* +- * we currently do not support PERF_FORMAT_GROUP on inherited events ++ * We currently do not support PERF_SAMPLE_READ on inherited events. ++ * See perf_output_read(). + */ +- if (attr->inherit && (attr->read_format & PERF_FORMAT_GROUP)) ++ if (attr->inherit && (attr->sample_type & PERF_SAMPLE_READ)) + goto err_ns; + + if (!has_branch_stack(event)) diff --git a/queue-4.4/perf-header-set-proper-module-name-when-build-id-event-found.patch b/queue-4.4/perf-header-set-proper-module-name-when-build-id-event-found.patch new file mode 100644 index 00000000000..501673d7299 --- /dev/null +++ b/queue-4.4/perf-header-set-proper-module-name-when-build-id-event-found.patch @@ -0,0 +1,73 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Namhyung Kim +Date: Wed, 31 May 2017 21:01:03 +0900 +Subject: perf header: Set proper module name when build-id event found + +From: Namhyung Kim + + +[ Upstream commit 1deec1bd96ccd8beb04d2112a6d12fe20505c3a6 ] + +When perf processes build-id event, it creates DSOs with the build-id. +But it didn't set the module short name (like '[module-name]') so when +processing a kernel mmap event of the module, it cannot found the DSO as +it only checks the short names. + +That leads for perf to create a same DSO without the build-id info and +it'll lookup the system path even if the DSO is already in the build-id +cache. After kernel was updated, perf cannot find the DSO and cannot +show symbols in it anymore. + +You can see this if you have an old data file (w/ old kernel version): + + $ perf report -i perf.data.old -v |& grep scsi_mod + build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz : cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 + Failed to open /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz, continuing without symbols + ... + +The second message didn't show the build-id. With this patch: + + $ perf report -i perf.data.old -v |& grep scsi_mod + build id event received for /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz: cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 + /lib/modules/3.19.2-1-ARCH/kernel/drivers/scsi/scsi_mod.ko.gz with build id cafe1ce6ca13a98a5d9ed3425cde249e57a27fc1 not found, continuing without symbols + ... + +Now it shows the build-id but still cannot load the symbol table. This +is a different problem which will be fixed in the next patch. + +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Andi Kleen +Cc: David Ahern +Cc: Peter Zijlstra +Cc: kernel-team@lge.com +Link: http://lkml.kernel.org/r/20170531120105.21731-1-namhyung@kernel.org +[ Fix the build on older compilers (debian <= 8, fedora <= 21, etc) wrt kmod_path var init ] +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/header.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -1258,8 +1258,16 @@ static int __event_process_build_id(stru + + dso__set_build_id(dso, &bev->build_id); + +- if (!is_kernel_module(filename, cpumode)) +- dso->kernel = dso_type; ++ if (dso_type != DSO_TYPE_USER) { ++ struct kmod_path m = { .name = NULL, }; ++ ++ if (!kmod_path__parse_name(&m, filename) && m.kmod) ++ dso__set_short_name(dso, strdup(m.name), true); ++ else ++ dso->kernel = dso_type; ++ ++ free(m.name); ++ } + + build_id__sprintf(dso->build_id, sizeof(dso->build_id), + sbuild_id); diff --git a/queue-4.4/perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch b/queue-4.4/perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch new file mode 100644 index 00000000000..c36a2c3a3ca --- /dev/null +++ b/queue-4.4/perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch @@ -0,0 +1,53 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Masami Hiramatsu +Date: Sat, 9 Dec 2017 01:26:46 +0900 +Subject: perf probe: Add warning message if there is unexpected event name + +From: Masami Hiramatsu + + +[ Upstream commit 9f5c6d8777a2d962b0eeacb2a16f37da6bea545b ] + +This improve the error message so that user can know event-name error +before writing new events to kprobe-events interface. + +E.g. + ====== + #./perf probe -x /lib64/libc-2.25.so malloc_get_state* + Internal error: "malloc_get_state@GLIBC_2" is an invalid event name. + Error: Failed to add events. + ====== + +Reported-by: Arnaldo Carvalho de Melo +Signed-off-by: Masami Hiramatsu +Acked-by: Ravi Bangoria +Reviewed-by: Thomas Richter +Tested-by: Arnaldo Carvalho de Melo +Cc: Paul Clarke +Cc: bhargavb +Cc: linux-rt-users@vger.kernel.org +Link: http://lkml.kernel.org/r/151275040665.24652.5188568529237584489.stgit@devbox +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/probe-event.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -2349,6 +2349,14 @@ static int get_new_event_name(char *buf, + + out: + free(nbase); ++ ++ /* Final validation */ ++ if (ret >= 0 && !is_c_func_name(buf)) { ++ pr_warning("Internal error: \"%s\" is an invalid event name.\n", ++ buf); ++ ret = -EINVAL; ++ } ++ + return ret; + } + diff --git a/queue-4.4/perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch b/queue-4.4/perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch new file mode 100644 index 00000000000..5fe32a290f5 --- /dev/null +++ b/queue-4.4/perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch @@ -0,0 +1,68 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Milian Wolff +Date: Fri, 2 Jun 2017 16:37:52 +0200 +Subject: perf report: Ensure the perf DSO mapping matches what libdw sees + +From: Milian Wolff + + +[ Upstream commit 2538b9e2450ae255337c04356e9e0f8cb9ec48d9 ] + +In some situations the libdw unwinder stopped working properly. I.e. +with libunwind we see: + +~~~~~ +heaptrack_gui 2228 135073.400112: 641314 cycles: + e8ed _dl_fixup (/usr/lib/ld-2.25.so) + 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so) + ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) + 608f3 _GLOBAL__sub_I_kdynamicjobtracker.cpp (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) + f199 call_init.part.0 (/usr/lib/ld-2.25.so) + f2a5 _dl_init (/usr/lib/ld-2.25.so) + db9 _dl_start_user (/usr/lib/ld-2.25.so) +~~~~~ + +But with libdw and without this patch this sample is not properly +unwound: + +~~~~~ +heaptrack_gui 2228 135073.400112: 641314 cycles: + e8ed _dl_fixup (/usr/lib/ld-2.25.so) + 15f06 _dl_runtime_resolve_sse_vex (/usr/lib/ld-2.25.so) + ed94c KDynamicJobTracker::KDynamicJobTracker (/home/milian/projects/compiled/kf5/lib64/libKF5KIOWidgets.so.5.35.0) +~~~~~ + +Debug output showed me that libdw found a module for the last frame +address, but it thinks it belongs to /usr/lib/ld-2.25.so. This patch +double-checks what libdw sees and what perf knows. If the mappings +mismatch, we now report the elf known to perf. This fixes the situation +above, and the libdw unwinder produces the same stack as libunwind. + +Signed-off-by: Milian Wolff +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: http://lkml.kernel.org/r/20170602143753.16907-1-milian.wolff@kdab.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/unwind-libdw.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -37,6 +37,14 @@ static int __report_module(struct addr_l + return 0; + + mod = dwfl_addrmodule(ui->dwfl, ip); ++ if (mod) { ++ Dwarf_Addr s; ++ ++ dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); ++ if (s != al->map->start) ++ mod = 0; ++ } ++ + if (!mod) + mod = dwfl_report_elf(ui->dwfl, dso->short_name, + dso->long_name, -1, al->map->start, diff --git a/queue-4.4/perf-tests-decompress-kernel-module-before-objdump.patch b/queue-4.4/perf-tests-decompress-kernel-module-before-objdump.patch new file mode 100644 index 00000000000..ed3bd551e17 --- /dev/null +++ b/queue-4.4/perf-tests-decompress-kernel-module-before-objdump.patch @@ -0,0 +1,67 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Namhyung Kim +Date: Thu, 8 Jun 2017 16:31:07 +0900 +Subject: perf tests: Decompress kernel module before objdump + +From: Namhyung Kim + + +[ Upstream commit 94df1040b1e6aacd8dec0ba3c61d7e77cd695f26 ] + +If a kernel modules is compressed, it should be decompressed before +running objdump to parse binary data correctly. This fixes a failure of +object code reading test for me. + +Signed-off-by: Namhyung Kim +Acked-by: Adrian Hunter +Acked-by: Jiri Olsa +Cc: David Ahern +Cc: Peter Zijlstra +Cc: Wang Nan +Cc: kernel-team@lge.com +Link: http://lkml.kernel.org/r/20170608073109.30699-8-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/code-reading.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/tools/perf/tests/code-reading.c ++++ b/tools/perf/tests/code-reading.c +@@ -182,6 +182,8 @@ static int read_object_code(u64 addr, si + unsigned char buf2[BUFSZ]; + size_t ret_len; + u64 objdump_addr; ++ const char *objdump_name; ++ char decomp_name[KMOD_DECOMP_LEN]; + int ret; + + pr_debug("Reading object code for memory address: %#"PRIx64"\n", addr); +@@ -242,9 +244,25 @@ static int read_object_code(u64 addr, si + state->done[state->done_cnt++] = al.map->start; + } + ++ objdump_name = al.map->dso->long_name; ++ if (dso__needs_decompress(al.map->dso)) { ++ if (dso__decompress_kmodule_path(al.map->dso, objdump_name, ++ decomp_name, ++ sizeof(decomp_name)) < 0) { ++ pr_debug("decompression failed\n"); ++ return -1; ++ } ++ ++ objdump_name = decomp_name; ++ } ++ + /* Read the object code using objdump */ + objdump_addr = map__rip_2objdump(al.map, al.addr); +- ret = read_via_objdump(al.map->dso->long_name, objdump_addr, buf2, len); ++ ret = read_via_objdump(objdump_name, objdump_addr, buf2, len); ++ ++ if (dso__needs_decompress(al.map->dso)) ++ unlink(objdump_name); ++ + if (ret > 0) { + /* + * The kernel maps are inaccurate - assume objdump is right in diff --git a/queue-4.4/perf-tools-fix-copyfile_offset-update-of-output-offset.patch b/queue-4.4/perf-tools-fix-copyfile_offset-update-of-output-offset.patch new file mode 100644 index 00000000000..9edf1c3c1fa --- /dev/null +++ b/queue-4.4/perf-tools-fix-copyfile_offset-update-of-output-offset.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jiri Olsa +Date: Tue, 9 Jan 2018 14:39:23 +0100 +Subject: perf tools: Fix copyfile_offset update of output offset + +From: Jiri Olsa + + +[ Upstream commit fa1195ccc0af2d121abe0fe266a1caee8c265eea ] + +We need to increase output offset in each iteration, not decrease it as +we currently do. + +I guess we were lucky to finish in most cases in first iteration, so the +bug never showed. However it shows a lot when working with big (~4GB) +size data. + +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Fixes: 9c9f5a2f1944 ("perf tools: Introduce copyfile_offset() function") +Link: http://lkml.kernel.org/r/20180109133923.25406-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/util.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/util.c ++++ b/tools/perf/util/util.c +@@ -162,7 +162,7 @@ int copyfile_offset(int ifd, loff_t off_ + + size -= ret; + off_in += ret; +- off_out -= ret; ++ off_out += ret; + } + munmap(ptr, off_in + size); + diff --git a/queue-4.4/perf-trace-add-mmap-alias-for-s390.patch b/queue-4.4/perf-trace-add-mmap-alias-for-s390.patch new file mode 100644 index 00000000000..d63ecce76be --- /dev/null +++ b/queue-4.4/perf-trace-add-mmap-alias-for-s390.patch @@ -0,0 +1,52 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jiri Olsa +Date: Wed, 31 May 2017 13:35:57 +0200 +Subject: perf trace: Add mmap alias for s390 + +From: Jiri Olsa + + +[ Upstream commit 54265664c15a68905d8d67d19205e9a767636434 ] + +The s390 architecture maps sys_mmap (nr 90) into sys_old_mmap. For this +reason perf trace can't find the proper syscall event to get args format +from and displays it wrongly as 'continued'. + +To fix that fill the "alias" field with "old_mmap" for trace's mmap record +to get the correct translation. + +Before: + 0.042 ( 0.011 ms): vest/43052 fstat(statbuf: 0x3ffff89fd90 ) = 0 + 0.042 ( 0.028 ms): vest/43052 ... [continued]: mmap()) = 0x3fffd6e2000 + 0.072 ( 0.025 ms): vest/43052 read(buf: 0x3fffd6e2000, count: 4096 ) = 6 + +After: + 0.045 ( 0.011 ms): fstat(statbuf: 0x3ffff8a0930 ) = 0 + 0.057 ( 0.018 ms): mmap(arg: 0x3ffff8a0858 ) = 0x3fffd14a000 + 0.076 ( 0.025 ms): read(buf: 0x3fffd14a000, count: 4096 ) = 6 + +Signed-off-by: Jiri Olsa +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20170531113557.19175-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/builtin-trace.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -1152,6 +1152,10 @@ static struct syscall_fmt { + { .name = "mlockall", .errmsg = true, + .arg_scnprintf = { [0] = SCA_HEX, /* addr */ }, }, + { .name = "mmap", .hexret = true, ++/* The standard mmap maps to old_mmap on s390x */ ++#if defined(__s390x__) ++ .alias = "old_mmap", ++#endif + .arg_scnprintf = { [0] = SCA_HEX, /* addr */ + [2] = SCA_MMAP_PROT, /* prot */ + [3] = SCA_MMAP_FLAGS, /* flags */ diff --git a/queue-4.4/pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch b/queue-4.4/pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch new file mode 100644 index 00000000000..cc7ec909a6f --- /dev/null +++ b/queue-4.4/pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch @@ -0,0 +1,68 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Kirill Tkhai +Date: Mon, 8 May 2017 15:56:34 -0700 +Subject: pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid() + +From: Kirill Tkhai + + +[ Upstream commit 8896c23d2ef803f1883fea73117a435925c2b4c4 ] + +alloc_pidmap() advances pid_namespace::last_pid. When first pid +allocation fails, then next created process will have pid 2 and +pid_ns_prepare_proc() won't be called. So, pid_namespace::proc_mnt will +never be initialized (not to mention that there won't be a child +reaper). + +I saw crash stack of such case on kernel 3.10: + + BUG: unable to handle kernel NULL pointer dereference at (null) + IP: proc_flush_task+0x8f/0x1b0 + Call Trace: + release_task+0x3f/0x490 + wait_consider_task.part.10+0x7ff/0xb00 + do_wait+0x11f/0x280 + SyS_wait4+0x7d/0x110 + +We may fix this by restore of last_pid in 0 or by prohibiting of futher +allocations. Since there was a similar issue in Oleg Nesterov's commit +314a8ad0f18a ("pidns: fix free_pid() to handle the first fork failure"). +and it was fixed via prohibiting allocation, let's follow this way, and +do the same. + +Link: http://lkml.kernel.org/r/149201021004.4863.6762095011554287922.stgit@localhost.localdomain +Signed-off-by: Kirill Tkhai +Acked-by: Cyrill Gorcunov +Cc: Andrei Vagin +Cc: Andreas Gruenbacher +Cc: Kees Cook +Cc: Michael Kerrisk +Cc: Al Viro +Cc: Oleg Nesterov +Cc: Paul Moore +Cc: Eric Biederman +Cc: Andy Lutomirski +Cc: Ingo Molnar +Cc: Serge Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/pid.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/pid.c ++++ b/kernel/pid.c +@@ -322,8 +322,10 @@ struct pid *alloc_pid(struct pid_namespa + } + + if (unlikely(is_child_reaper(pid))) { +- if (pid_ns_prepare_proc(ns)) ++ if (pid_ns_prepare_proc(ns)) { ++ disable_pid_allocation(ns); + goto out_free; ++ } + } + + get_pid_ns(ns); diff --git a/queue-4.4/pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch b/queue-4.4/pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch new file mode 100644 index 00000000000..26d88cd6490 --- /dev/null +++ b/queue-4.4/pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch @@ -0,0 +1,33 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Sat, 20 May 2017 00:31:12 +0300 +Subject: pNFS/flexfiles: missing error code in ff_layout_alloc_lseg() + +From: Dan Carpenter + + +[ Upstream commit 662f9a105b4322b8559d448f86110e6ec24b8738 ] + +If xdr_inline_decode() fails then we end up returning ERR_PTR(0). The +caller treats NULL returns as -ENOMEM so it doesn't really hurt runtime, +but obviously we intended to set an error code here. + +Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/flexfilelayout/flexfilelayout.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/flexfilelayout/flexfilelayout.c ++++ b/fs/nfs/flexfilelayout/flexfilelayout.c +@@ -461,6 +461,7 @@ ff_layout_alloc_lseg(struct pnfs_layout_ + goto out_err_free; + + /* fh */ ++ rc = -EIO; + p = xdr_inline_decode(&stream, 4); + if (!p) + goto out_err_free; diff --git a/queue-4.4/powercap-fix-an-error-code-in-powercap_register_zone.patch b/queue-4.4/powercap-fix-an-error-code-in-powercap_register_zone.patch new file mode 100644 index 00000000000..0f5ecd46520 --- /dev/null +++ b/queue-4.4/powercap-fix-an-error-code-in-powercap_register_zone.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Dan Carpenter +Date: Wed, 10 May 2017 22:40:06 +0300 +Subject: PowerCap: Fix an error code in powercap_register_zone() + +From: Dan Carpenter + + +[ Upstream commit 216c4e9db4c9d1d2a382b42880442dc632cd47d9 ] + +In the current code we accidentally return the successful result from +idr_alloc() instead of a negative error pointer. The caller is looking +for an error pointer and so it treats the returned value as a valid +pointer. + +This one might be a bit serious because if it lets people get around the +kernel's protection for remapping NULL. I'm not sure. + +Fixes: 75d2364ea0ca (PowerCap: Add class driver) +Signed-off-by: Dan Carpenter +Reviewed-by: Srinivas Pandruvada +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/powercap/powercap_sys.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/powercap/powercap_sys.c ++++ b/drivers/powercap/powercap_sys.c +@@ -538,6 +538,7 @@ struct powercap_zone *powercap_register_ + + power_zone->id = result; + idr_init(&power_zone->idr); ++ result = -ENOMEM; + power_zone->name = kstrdup(name, GFP_KERNEL); + if (!power_zone->name) + goto err_name_alloc; diff --git a/queue-4.4/powerpc-don-t-clobber-tcr-when-setting-tcr.patch b/queue-4.4/powerpc-don-t-clobber-tcr-when-setting-tcr.patch new file mode 100644 index 00000000000..4a6f561de93 --- /dev/null +++ b/queue-4.4/powerpc-don-t-clobber-tcr-when-setting-tcr.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Ivan Mikhaylov +Date: Fri, 19 May 2017 18:47:05 +0300 +Subject: powerpc/[booke|4xx]: Don't clobber TCR[WP] when setting TCR[DIE] + +From: Ivan Mikhaylov + + +[ Upstream commit 6e2f03e292ef46eed2b31b0a344a91d514f9cd81 ] + +Prevent a kernel panic caused by unintentionally clearing TCR watchdog +bits. At this point in the kernel boot, the watchdog may have already +been enabled by u-boot. The original code's attempt to write to the TCR +register results in an inadvertent clearing of the watchdog +configuration bits, causing the 476 to reset. + +Signed-off-by: Ivan Mikhaylov +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/time.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -686,12 +686,20 @@ static int __init get_freq(char *name, i + static void start_cpu_decrementer(void) + { + #if defined(CONFIG_BOOKE) || defined(CONFIG_40x) ++ unsigned int tcr; ++ + /* Clear any pending timer interrupts */ + mtspr(SPRN_TSR, TSR_ENW | TSR_WIS | TSR_DIS | TSR_FIS); + +- /* Enable decrementer interrupt */ +- mtspr(SPRN_TCR, TCR_DIE); +-#endif /* defined(CONFIG_BOOKE) || defined(CONFIG_40x) */ ++ tcr = mfspr(SPRN_TCR); ++ /* ++ * The watchdog may have already been enabled by u-boot. So leave ++ * TRC[WP] (Watchdog Period) alone. ++ */ ++ tcr &= TCR_WP_MASK; /* Clear all bits except for TCR[WP] */ ++ tcr |= TCR_DIE; /* Enable decrementer */ ++ mtspr(SPRN_TCR, tcr); ++#endif + } + + void __init generic_calibrate_decr(void) diff --git a/queue-4.4/powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch b/queue-4.4/powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch new file mode 100644 index 00000000000..7d8b7f2dc36 --- /dev/null +++ b/queue-4.4/powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch @@ -0,0 +1,65 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Michael Ellerman +Date: Thu, 18 May 2017 20:37:31 +1000 +Subject: powerpc/mm: Fix virt_addr_valid() etc. on 64-bit hash + +From: Michael Ellerman + + +[ Upstream commit e41e53cd4fe331d0d1f06f8e4ed7e2cc63ee2c34 ] + +virt_addr_valid() is supposed to tell you if it's OK to call virt_to_page() on +an address. What this means in practice is that it should only return true for +addresses in the linear mapping which are backed by a valid PFN. + +We are failing to properly check that the address is in the linear mapping, +because virt_to_pfn() will return a valid looking PFN for more or less any +address. That bug is actually caused by __pa(), used in virt_to_pfn(). + +eg: __pa(0xc000000000010000) = 0x10000 # Good + __pa(0xd000000000010000) = 0x10000 # Bad! + __pa(0x0000000000010000) = 0x10000 # Bad! + +This started happening after commit bdbc29c19b26 ("powerpc: Work around gcc +miscompilation of __pa() on 64-bit") (Aug 2013), where we changed the definition +of __pa() to work around a GCC bug. Prior to that we subtracted PAGE_OFFSET from +the value passed to __pa(), meaning __pa() of a 0xd or 0x0 address would give +you something bogus back. + +Until we can verify if that GCC bug is no longer an issue, or come up with +another solution, this commit does the minimal fix to make virt_addr_valid() +work, by explicitly checking that the address is in the linear mapping region. + +Fixes: bdbc29c19b26 ("powerpc: Work around gcc miscompilation of __pa() on 64-bit") +Signed-off-by: Michael Ellerman +Reviewed-by: Paul Mackerras +Reviewed-by: Balbir Singh +Tested-by: Breno Leitao +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/page.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -132,7 +132,19 @@ extern long long virt_phys_offset; + #define virt_to_pfn(kaddr) (__pa(kaddr) >> PAGE_SHIFT) + #define virt_to_page(kaddr) pfn_to_page(virt_to_pfn(kaddr)) + #define pfn_to_kaddr(pfn) __va((pfn) << PAGE_SHIFT) ++ ++#ifdef CONFIG_PPC_BOOK3S_64 ++/* ++ * On hash the vmalloc and other regions alias to the kernel region when passed ++ * through __pa(), which virt_to_pfn() uses. That means virt_addr_valid() can ++ * return true for some vmalloc addresses, which is incorrect. So explicitly ++ * check that the address is in the kernel region. ++ */ ++#define virt_addr_valid(kaddr) (REGION_ID(kaddr) == KERNEL_REGION_ID && \ ++ pfn_valid(virt_to_pfn(kaddr))) ++#else + #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) ++#endif + + /* + * On Book-E parts we need __va to parse the device tree and we can't diff --git a/queue-4.4/powerpc-spufs-fix-coredump-of-spu-contexts.patch b/queue-4.4/powerpc-spufs-fix-coredump-of-spu-contexts.patch new file mode 100644 index 00000000000..103cbf78876 --- /dev/null +++ b/queue-4.4/powerpc-spufs-fix-coredump-of-spu-contexts.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Michael Ellerman +Date: Mon, 29 May 2017 20:26:07 +1000 +Subject: powerpc/spufs: Fix coredump of SPU contexts + +From: Michael Ellerman + + +[ Upstream commit 99acc9bede06bbb2662aafff51f5b9e529fa845e ] + +If a process dumps core while it has SPU contexts active then we have +code to also dump information about the SPU contexts. + +Unfortunately it's been broken for 3 1/2 years, and we didn't notice. In +commit 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") the nread +variable was removed and rc used instead. That means when the loop exits +successfully, rc has the number of bytes read, but it's then used as the +return value for the function, which should return 0 on success. + +So fix it by setting rc = 0 before returning in the success case. + +Fixes: 7b1f4020d0d1 ("spufs: get rid of dump_emit() wrappers") +Signed-off-by: Michael Ellerman +Acked-by: Jeremy Kerr +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/cell/spufs/coredump.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/powerpc/platforms/cell/spufs/coredump.c ++++ b/arch/powerpc/platforms/cell/spufs/coredump.c +@@ -174,6 +174,8 @@ static int spufs_arch_write_note(struct + if (!dump_skip(cprm, + roundup(cprm->written - total + sz, 4) - cprm->written)) + goto Eio; ++ ++ rc = 0; + out: + free_page((unsigned long)buf); + return rc; diff --git a/queue-4.4/qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch b/queue-4.4/qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch new file mode 100644 index 00000000000..d1168fc1f8c --- /dev/null +++ b/queue-4.4/qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jia-Ju Bai +Date: Thu, 1 Jun 2017 16:18:10 +0800 +Subject: qlcnic: Fix a sleep-in-atomic bug in qlcnic_82xx_hw_write_wx_2M and qlcnic_82xx_hw_read_wx_2M + +From: Jia-Ju Bai + + +[ Upstream commit 5ea6d691aac6c93b790f0905e3460d44cc4c449b ] + +The driver may sleep under a write spin lock, and the function +call path is: +qlcnic_82xx_hw_write_wx_2M (acquire the lock by write_lock_irqsave) + crb_win_lock + qlcnic_pcie_sem_lock + usleep_range +qlcnic_82xx_hw_read_wx_2M (acquire the lock by write_lock_irqsave) + crb_win_lock + qlcnic_pcie_sem_lock + usleep_range + +To fix it, the usleep_range is replaced with udelay. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_hw.c +@@ -341,7 +341,7 @@ qlcnic_pcie_sem_lock(struct qlcnic_adapt + } + return -EIO; + } +- usleep_range(1000, 1500); ++ udelay(1200); + } + + if (id_reg) diff --git a/queue-4.4/qlge-avoid-reading-past-end-of-buffer.patch b/queue-4.4/qlge-avoid-reading-past-end-of-buffer.patch new file mode 100644 index 00000000000..7bbad0766fa --- /dev/null +++ b/queue-4.4/qlge-avoid-reading-past-end-of-buffer.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Kees Cook +Date: Fri, 5 May 2017 15:34:34 -0700 +Subject: qlge: Avoid reading past end of buffer + +From: Kees Cook + + +[ Upstream commit df5303a8aa9a0a6934f4cea7427f1edf771f21c2 ] + +Using memcpy() from a string that is shorter than the length copied means +the destination buffer is being filled with arbitrary data from the kernel +rodata segment. Instead, use strncpy() which will fill the trailing bytes +with zeros. + +This was found with the future CONFIG_FORTIFY_SOURCE feature. + +Cc: Daniel Micay +Signed-off-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c +@@ -765,7 +765,7 @@ int ql_core_dump(struct ql_adapter *qdev + sizeof(struct mpi_coredump_global_header); + mpi_coredump->mpi_global_header.imageSize = + sizeof(struct ql_mpi_coredump); +- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", ++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", + sizeof(mpi_coredump->mpi_global_header.idString)); + + /* Get generic NIC reg dump */ +@@ -1255,7 +1255,7 @@ static void ql_gen_reg_dump(struct ql_ad + sizeof(struct mpi_coredump_global_header); + mpi_coredump->mpi_global_header.imageSize = + sizeof(struct ql_reg_dump); +- memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", ++ strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump", + sizeof(mpi_coredump->mpi_global_header.idString)); + + diff --git a/queue-4.4/ray_cs-avoid-reading-past-end-of-buffer.patch b/queue-4.4/ray_cs-avoid-reading-past-end-of-buffer.patch new file mode 100644 index 00000000000..86050f33a18 --- /dev/null +++ b/queue-4.4/ray_cs-avoid-reading-past-end-of-buffer.patch @@ -0,0 +1,49 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Kees Cook +Date: Fri, 5 May 2017 15:38:41 -0700 +Subject: ray_cs: Avoid reading past end of buffer + +From: Kees Cook + + +[ Upstream commit e48d661eb13f2f83861428f001c567fdb3f317e8 ] + +Using memcpy() from a buffer that is shorter than the length copied means +the destination buffer is being filled with arbitrary data from the kernel +rodata segment. In this case, the source was made longer, since it did not +match the destination structure size. Additionally removes a needless cast. + +This was found with the future CONFIG_FORTIFY_SOURCE feature. + +Cc: Daniel Micay +Signed-off-by: Kees Cook +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ray_cs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -247,7 +247,10 @@ static const UCHAR b4_default_startup_pa + 0x04, 0x08, /* Noise gain, limit offset */ + 0x28, 0x28, /* det rssi, med busy offsets */ + 7, /* det sync thresh */ +- 0, 2, 2 /* test mode, min, max */ ++ 0, 2, 2, /* test mode, min, max */ ++ 0, /* rx/tx delay */ ++ 0, 0, 0, 0, 0, 0, /* current BSS id */ ++ 0 /* hop set */ + }; + + /*===========================================================================*/ +@@ -598,7 +601,7 @@ static void init_startup_params(ray_dev_ + * a_beacon_period = hops a_beacon_period = KuS + *//* 64ms = 010000 */ + if (local->fw_ver == 0x55) { +- memcpy((UCHAR *) &local->sparm.b4, b4_default_startup_parms, ++ memcpy(&local->sparm.b4, b4_default_startup_parms, + sizeof(struct b4_startup_params)); + /* Translate sane kus input values to old build 4/5 format */ + /* i = hop time in uS truncated to 3 bytes */ diff --git a/queue-4.4/rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch b/queue-4.4/rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch new file mode 100644 index 00000000000..285dbabcfb0 --- /dev/null +++ b/queue-4.4/rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch @@ -0,0 +1,54 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Sowmini Varadhan +Date: Fri, 22 Dec 2017 09:38:59 -0800 +Subject: rds; Reset rs->rs_bound_addr in rds_add_bound() failure path + +From: Sowmini Varadhan + + +[ Upstream commit 7ae0c649c47f1c5d2db8cee6dd75855970af1669 ] + +If the rds_sock is not added to the bind_hash_table, we must +reset rs_bound_addr so that rds_remove_bound will not trip on +this rds_sock. + +rds_add_bound() does a rds_sock_put() in this failure path, so +failing to reset rs_bound_addr will result in a socket refcount +bug, and will trigger a WARN_ON with the stack shown below when +the application subsequently tries to close the PF_RDS socket. + + WARNING: CPU: 20 PID: 19499 at net/rds/af_rds.c:496 \ + rds_sock_destruct+0x15/0x30 [rds] + : + __sk_destruct+0x21/0x190 + rds_remove_bound.part.13+0xb6/0x140 [rds] + rds_release+0x71/0x120 [rds] + sock_release+0x1a/0x70 + sock_close+0xe/0x20 + __fput+0xd5/0x210 + task_work_run+0x82/0xa0 + do_exit+0x2ce/0xb30 + ? syscall_trace_enter+0x1cc/0x2b0 + do_group_exit+0x39/0xa0 + SyS_exit_group+0x10/0x10 + do_syscall_64+0x61/0x1a0 + +Signed-off-by: Sowmini Varadhan +Acked-by: Santosh Shilimkar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rds/bind.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -108,6 +108,7 @@ static int rds_add_bound(struct rds_sock + rs, &addr, (int)ntohs(*port)); + break; + } else { ++ rs->rs_bound_addr = 0; + rds_sock_put(rs); + ret = -ENOMEM; + break; diff --git a/queue-4.4/rtc-interface-validate-alarm-time-before-handling-rollover.patch b/queue-4.4/rtc-interface-validate-alarm-time-before-handling-rollover.patch new file mode 100644 index 00000000000..5205b2176bb --- /dev/null +++ b/queue-4.4/rtc-interface-validate-alarm-time-before-handling-rollover.patch @@ -0,0 +1,71 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Vaibhav Jain +Date: Fri, 19 May 2017 22:18:55 +0530 +Subject: rtc: interface: Validate alarm-time before handling rollover + +From: Vaibhav Jain + + +[ Upstream commit da96aea0ed177105cb13ee83b328f6c61e061d3f ] + +In function __rtc_read_alarm() its possible for an alarm time-stamp to +be invalid even after replacing missing components with current +time-stamp. The condition 'alarm->time.tm_year < 70' will trigger this +case and will cause the call to 'rtc_tm_to_time64(&alarm->time)' +return a negative value for variable t_alm. + +While handling alarm rollover this negative t_alm (assumed to seconds +offset from '1970-01-01 00:00:00') is converted back to rtc_time via +rtc_time64_to_tm() which results in this error log with seemingly +garbage values: + +"rtc rtc0: invalid alarm value: -2-1--1041528741 +2005511117:71582844:32" + +This error was generated when the rtc driver (rtc-opal in this case) +returned an alarm time-stamp of '00-00-00 00:00:00' to indicate that +the alarm is disabled. Though I have submitted a separate fix for the +rtc-opal driver, this issue may potentially impact other +existing/future rtc drivers. + +To fix this issue the patch validates the alarm time-stamp just after +filling up the missing datetime components and if rtc_valid_tm() still +reports it to be invalid then bails out of the function without +handling the rollover. + +Reported-by: Steve Best +Signed-off-by: Vaibhav Jain +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/interface.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -217,6 +217,13 @@ int __rtc_read_alarm(struct rtc_device * + missing = year; + } + ++ /* Can't proceed if alarm is still invalid after replacing ++ * missing fields. ++ */ ++ err = rtc_valid_tm(&alarm->time); ++ if (err) ++ goto done; ++ + /* with luck, no rollover is needed */ + t_now = rtc_tm_to_time64(&now); + t_alm = rtc_tm_to_time64(&alarm->time); +@@ -268,9 +275,9 @@ int __rtc_read_alarm(struct rtc_device * + dev_warn(&rtc->dev, "alarm rollover not handled\n"); + } + +-done: + err = rtc_valid_tm(&alarm->time); + ++done: + if (err) { + dev_warn(&rtc->dev, "invalid alarm value: %d-%d-%d %d:%d:%d\n", + alarm->time.tm_year + 1900, alarm->time.tm_mon + 1, diff --git a/queue-4.4/rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch b/queue-4.4/rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch new file mode 100644 index 00000000000..7f22427330b --- /dev/null +++ b/queue-4.4/rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Vaibhav Jain +Date: Fri, 19 May 2017 15:35:09 +0530 +Subject: rtc: opal: Handle disabled TPO in opal_get_tpo_time() + +From: Vaibhav Jain + + +[ Upstream commit 6dc1cf6f932bb0ea4d8f5e913a0a401ecacd2f03 ] + +On PowerNV platform when Timed-Power-On(TPO) is disabled, read of +stored TPO yields value with all date components set to '0' inside +opal_get_tpo_time(). The function opal_to_tm() then converts it to an +offset from year 1900 yielding alarm-time == "1900-00-01 +00:00:00". This causes problems with __rtc_read_alarm() that +expecting an offset from "1970-00-01 00:00:00" and returned alarm-time +results in a -ve value for time64_t. Which ultimately results in this +error reported in kernel logs with a seemingly garbage value: + +"rtc rtc0: invalid alarm value: -2-1--1041528741 +2005511117:71582844:32" + +We fix this by explicitly handling the case of all alarm date-time +components being '0' inside opal_get_tpo_time() and returning -ENOENT +in such a case. This signals generic rtc that no alarm is set and it +bails out from the alarm initialization flow without reporting the +above error. + +Signed-off-by: Vaibhav Jain +Reported-by: Steve Best +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-opal.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/rtc/rtc-opal.c ++++ b/drivers/rtc/rtc-opal.c +@@ -150,6 +150,16 @@ static int opal_get_tpo_time(struct devi + + y_m_d = be32_to_cpu(__y_m_d); + h_m_s_ms = ((u64)be32_to_cpu(__h_m) << 32); ++ ++ /* check if no alarm is set */ ++ if (y_m_d == 0 && h_m_s_ms == 0) { ++ pr_debug("No alarm is set\n"); ++ rc = -ENOENT; ++ goto exit; ++ } else { ++ pr_debug("Alarm set to %x %llx\n", y_m_d, h_m_s_ms); ++ } ++ + opal_to_tm(y_m_d, h_m_s_ms, &alarm->time); + + exit: diff --git a/queue-4.4/rtc-snvs-fix-an-incorrect-check-of-return-value.patch b/queue-4.4/rtc-snvs-fix-an-incorrect-check-of-return-value.patch new file mode 100644 index 00000000000..f63760374fb --- /dev/null +++ b/queue-4.4/rtc-snvs-fix-an-incorrect-check-of-return-value.patch @@ -0,0 +1,33 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Pan Bian +Date: Sun, 23 Apr 2017 13:43:24 +0800 +Subject: rtc: snvs: fix an incorrect check of return value + +From: Pan Bian + + +[ Upstream commit 758929005f06f954b7e1c87a1c9fdb44157b228f ] + +Function devm_regmap_init_mmio() returns an ERR_PTR on error. However, +in function snvs_rtc_probe() its return value is checked against NULL. +This patch fixes it by checking the return value with IS_ERR(). + +Signed-off-by: Pan Bian +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-snvs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -257,7 +257,7 @@ static int snvs_rtc_probe(struct platfor + of_property_read_u32(pdev->dev.of_node, "offset", &data->offset); + } + +- if (!data->regmap) { ++ if (IS_ERR(data->regmap)) { + dev_err(&pdev->dev, "Can't find snvs syscon\n"); + return -ENODEV; + } diff --git a/queue-4.4/rxrpc-check-return-value-of-skb_to_sgvec-always.patch b/queue-4.4/rxrpc-check-return-value-of-skb_to_sgvec-always.patch new file mode 100644 index 00000000000..d031248bd3b --- /dev/null +++ b/queue-4.4/rxrpc-check-return-value-of-skb_to_sgvec-always.patch @@ -0,0 +1,84 @@ +From 89a5ea99662505d2d61f2a3030a6896c2cb3cdb0 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Sun, 4 Jun 2017 04:16:24 +0200 +Subject: rxrpc: check return value of skb_to_sgvec always + +From: Jason A. Donenfeld + +commit 89a5ea99662505d2d61f2a3030a6896c2cb3cdb0 upstream. + +Signed-off-by: Jason A. Donenfeld +Acked-by: David Howells +Signed-off-by: David S. Miller +[natechancellor: backport to 4.4] +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/rxkad.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -209,7 +209,7 @@ static int rxkad_secure_packet_encrypt(c + struct sk_buff *trailer; + unsigned int len; + u16 check; +- int nsg; ++ int nsg, err; + + sp = rxrpc_skb(skb); + +@@ -240,7 +240,9 @@ static int rxkad_secure_packet_encrypt(c + len &= ~(call->conn->size_align - 1); + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, len); ++ err = skb_to_sgvec(skb, sg, 0, len); ++ if (unlikely(err < 0)) ++ return err; + crypto_blkcipher_encrypt_iv(&desc, sg, sg, len); + + _leave(" = 0"); +@@ -336,7 +338,7 @@ static int rxkad_verify_packet_auth(cons + struct sk_buff *trailer; + u32 data_size, buf; + u16 check; +- int nsg; ++ int nsg, ret; + + _enter(""); + +@@ -348,7 +350,9 @@ static int rxkad_verify_packet_auth(cons + goto nomem; + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, 8); ++ ret = skb_to_sgvec(skb, sg, 0, 8); ++ if (unlikely(ret < 0)) ++ return ret; + + /* start the decryption afresh */ + memset(&iv, 0, sizeof(iv)); +@@ -411,7 +415,7 @@ static int rxkad_verify_packet_encrypt(c + struct sk_buff *trailer; + u32 data_size, buf; + u16 check; +- int nsg; ++ int nsg, ret; + + _enter(",{%d}", skb->len); + +@@ -430,7 +434,12 @@ static int rxkad_verify_packet_encrypt(c + } + + sg_init_table(sg, nsg); +- skb_to_sgvec(skb, sg, 0, skb->len); ++ ret = skb_to_sgvec(skb, sg, 0, skb->len); ++ if (unlikely(ret < 0)) { ++ if (sg != _sg) ++ kfree(sg); ++ return ret; ++ } + + /* decrypt from the session key */ + token = call->conn->key->payload.data[0]; diff --git a/queue-4.4/s390-dasd-fix-hanging-safe-offline.patch b/queue-4.4/s390-dasd-fix-hanging-safe-offline.patch new file mode 100644 index 00000000000..d701c9ae5e3 --- /dev/null +++ b/queue-4.4/s390-dasd-fix-hanging-safe-offline.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Stefan Haberland +Date: Thu, 18 May 2017 13:24:45 +0200 +Subject: s390/dasd: fix hanging safe offline + +From: Stefan Haberland + + +[ Upstream commit e8ac01555d9e464249e8bb122337d6d6e5589ccc ] + +The safe offline processing may hang forever because it waits for I/O +which can not be started because of the offline flag that prevents new +I/O from being started. + +Allow I/O to be started during safe offline processing because in this +special case we take care that the queues are empty before throwing away +the device. + +Signed-off-by: Stefan Haberland +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1881,8 +1881,12 @@ static int __dasd_device_is_unusable(str + { + int mask = ~(DASD_STOPPED_DC_WAIT | DASD_UNRESUMED_PM); + +- if (test_bit(DASD_FLAG_OFFLINE, &device->flags)) { +- /* dasd is being set offline. */ ++ if (test_bit(DASD_FLAG_OFFLINE, &device->flags) && ++ !test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) { ++ /* ++ * dasd is being set offline ++ * but it is no safe offline where we have to allow I/O ++ */ + return 1; + } + if (device->stopped) { diff --git a/queue-4.4/s390-move-_text-symbol-to-address-higher-than-zero.patch b/queue-4.4/s390-move-_text-symbol-to-address-higher-than-zero.patch new file mode 100644 index 00000000000..6a48e1275be --- /dev/null +++ b/queue-4.4/s390-move-_text-symbol-to-address-higher-than-zero.patch @@ -0,0 +1,58 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Heiko Carstens +Date: Thu, 4 May 2017 09:42:22 +0200 +Subject: s390: move _text symbol to address higher than zero + +From: Heiko Carstens + + +[ Upstream commit d04a4c76f71dd5335f8e499b59617382d84e2b8d ] + +The perf tool assumes that kernel symbols are never present at address +zero. In fact it assumes if functions that map symbols to addresses +return zero, that the symbol was not found. + +Given that s390's _text symbol historically is located at address zero +this yields at least a couple of false errors and warnings in one of +perf's test cases about not present symbols ("perf test 1"). + +To fix this simply move the _text symbol to address 0x200, just behind +the initial psw and channel program located at the beginning of the +kernel image. This is now hard coded within the linker script. + +I tried a nicer solution which moves the initial psw and channel +program into an own section. However that would move the symbols +within the "real" head.text section to different addresses, since the +".org" statements within head.S are relative to the head.text +section. If there is a new section in front, everything else will be +moved. Alternatively I could have adjusted all ".org" statements. But +this current solution seems to be the easiest one, since nobody really +cares where the _text symbol is actually located. + +Reported-by: Zvonko Kosic +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/vmlinux.lds.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -21,8 +21,14 @@ SECTIONS + { + . = 0x00000000; + .text : { +- _text = .; /* Text and read-only data */ ++ /* Text and read-only data */ + HEAD_TEXT ++ /* ++ * E.g. perf doesn't like symbols starting at address zero, ++ * therefore skip the initial PSW and channel program located ++ * at address zero and let _text start at 0x200. ++ */ ++ _text = 0x200; + TEXT_TEXT + SCHED_TEXT + LOCK_TEXT diff --git a/queue-4.4/sched-numa-use-down_read_trylock-for-the-mmap_sem.patch b/queue-4.4/sched-numa-use-down_read_trylock-for-the-mmap_sem.patch new file mode 100644 index 00000000000..e5aebc74ca3 --- /dev/null +++ b/queue-4.4/sched-numa-use-down_read_trylock-for-the-mmap_sem.patch @@ -0,0 +1,63 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Vlastimil Babka +Date: Mon, 15 May 2017 15:13:16 +0200 +Subject: sched/numa: Use down_read_trylock() for the mmap_sem + +From: Vlastimil Babka + + +[ Upstream commit 8655d5497735b288f8a9b458bd22e7d1bf95bb61 ] + +A customer has reported a soft-lockup when running an intensive +memory stress test, where the trace on multiple CPU's looks like this: + + RIP: 0010:[] + [] native_queued_spin_lock_slowpath+0x10e/0x190 +... + Call Trace: + [] queued_spin_lock_slowpath+0x7/0xa + [] change_protection_range+0x3b1/0x930 + [] change_prot_numa+0x18/0x30 + [] task_numa_work+0x1fe/0x310 + [] task_work_run+0x72/0x90 + +Further investigation showed that the lock contention here is pmd_lock(). + +The task_numa_work() function makes sure that only one thread is let to perform +the work in a single scan period (via cmpxchg), but if there's a thread with +mmap_sem locked for writing for several periods, multiple threads in +task_numa_work() can build up a convoy waiting for mmap_sem for read and then +all get unblocked at once. + +This patch changes the down_read() to the trylock version, which prevents the +build up. For a workload experiencing mmap_sem contention, it's probably better +to postpone the NUMA balancing work anyway. This seems to have fixed the soft +lockups involving pmd_lock(), which is in line with the convoy theory. + +Signed-off-by: Vlastimil Babka +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Rik van Riel +Acked-by: Mel Gorman +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/20170515131316.21909-1-vbabka@suse.cz +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/fair.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -2223,7 +2223,8 @@ void task_numa_work(struct callback_head + return; + + +- down_read(&mm->mmap_sem); ++ if (!down_read_trylock(&mm->mmap_sem)) ++ return; + vma = find_vma(mm, start); + if (!vma) { + reset_ptenuma_scan(p); diff --git a/queue-4.4/scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch b/queue-4.4/scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch new file mode 100644 index 00000000000..72bb8d5d13e --- /dev/null +++ b/queue-4.4/scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch @@ -0,0 +1,101 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Maurizio Lombardi +Date: Wed, 24 May 2017 14:09:44 +0200 +Subject: scsi: bnx2fc: fix race condition in bnx2fc_get_host_stats() + +From: Maurizio Lombardi + + +[ Upstream commit c2dd893a3b0772d1c680e109b9d5715d7f73022b ] + +If multiple tasks attempt to read the stats, it may happen that the +start_req_done completion is re-initialized while still being used by +another task, causing a list corruption. + +This patch fixes the bug by adding a mutex to serialize the calls to +bnx2fc_get_host_stats(). + +WARNING: at lib/list_debug.c:48 list_del+0x6e/0xa0() (Not tainted) +Hardware name: PowerEdge R820 +list_del corruption. prev->next should be ffff882035627d90, but was ffff884069541588 + +Pid: 40267, comm: perl Not tainted 2.6.32-642.3.1.el6.x86_64 #1 +Call Trace: + [] ? warn_slowpath_common+0x91/0xe0 + [] ? warn_slowpath_fmt+0x46/0x60 + [] ? list_del+0x6e/0xa0 + [] ? wait_for_common+0x14d/0x180 + [] ? default_wake_function+0x0/0x20 + [] ? wait_for_completion_timeout+0x13/0x20 + [] ? bnx2fc_get_host_stats+0xa1/0x280 [bnx2fc] + [] ? fc_stat_show+0x90/0xc0 [scsi_transport_fc] + [] ? show_fcstat_tx_frames+0x16/0x20 [scsi_transport_fc] + [] ? dev_attr_show+0x27/0x50 + [] ? __get_free_pages+0xe/0x50 + [] ? sysfs_read_file+0x111/0x200 + [] ? vfs_read+0xb5/0x1a0 + [] ? fget_light_pos+0x16/0x50 + [] ? sys_read+0x51/0xb0 + [] ? __audit_syscall_exit+0x25e/0x290 + [] ? system_call_fastpath+0x16/0x1b + +Signed-off-by: Maurizio Lombardi +Acked-by: Chad Dupuis +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/bnx2fc/bnx2fc.h | 1 + + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 10 ++++++++-- + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/bnx2fc/bnx2fc.h ++++ b/drivers/scsi/bnx2fc/bnx2fc.h +@@ -191,6 +191,7 @@ struct bnx2fc_hba { + struct bnx2fc_cmd_mgr *cmd_mgr; + spinlock_t hba_lock; + struct mutex hba_mutex; ++ struct mutex hba_stats_mutex; + unsigned long adapter_state; + #define ADAPTER_STATE_UP 0 + #define ADAPTER_STATE_GOING_DOWN 1 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -641,15 +641,17 @@ static struct fc_host_statistics *bnx2fc + if (!fw_stats) + return NULL; + ++ mutex_lock(&hba->hba_stats_mutex); ++ + bnx2fc_stats = fc_get_host_stats(shost); + + init_completion(&hba->stat_req_done); + if (bnx2fc_send_stat_req(hba)) +- return bnx2fc_stats; ++ goto unlock_stats_mutex; + rc = wait_for_completion_timeout(&hba->stat_req_done, (2 * HZ)); + if (!rc) { + BNX2FC_HBA_DBG(lport, "FW stat req timed out\n"); +- return bnx2fc_stats; ++ goto unlock_stats_mutex; + } + BNX2FC_STATS(hba, rx_stat2, fc_crc_cnt); + bnx2fc_stats->invalid_crc_count += hba->bfw_stats.fc_crc_cnt; +@@ -671,6 +673,9 @@ static struct fc_host_statistics *bnx2fc + + memcpy(&hba->prev_stats, hba->stats_buffer, + sizeof(struct fcoe_statistics_params)); ++ ++unlock_stats_mutex: ++ mutex_unlock(&hba->hba_stats_mutex); + return bnx2fc_stats; + } + +@@ -1302,6 +1307,7 @@ static struct bnx2fc_hba *bnx2fc_hba_cre + } + spin_lock_init(&hba->hba_lock); + mutex_init(&hba->hba_mutex); ++ mutex_init(&hba->hba_stats_mutex); + + hba->cnic = cnic; + diff --git a/queue-4.4/scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch b/queue-4.4/scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch new file mode 100644 index 00000000000..57ec643f03c --- /dev/null +++ b/queue-4.4/scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch @@ -0,0 +1,44 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Varun Prakash +Date: Wed, 17 May 2017 20:30:43 +0530 +Subject: scsi: csiostor: fix use after free in csio_hw_use_fwconfig() + +From: Varun Prakash + + +[ Upstream commit a351e40b6de550049423a26f7ded7b639e363d89 ] + +mbp pointer is passed to csio_hw_validate_caps() so call mempool_free() +after calling csio_hw_validate_caps(). + +Signed-off-by: Varun Prakash +Fixes: 541c571fa2fd ("csiostor:Use firmware version from cxgb4/t4fw_version.h") +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/csiostor/csio_hw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/csiostor/csio_hw.c ++++ b/drivers/scsi/csiostor/csio_hw.c +@@ -1769,7 +1769,6 @@ csio_hw_use_fwconfig(struct csio_hw *hw, + goto bye; + } + +- mempool_free(mbp, hw->mb_mempool); + if (finicsum != cfcsum) { + csio_warn(hw, + "Config File checksum mismatch: csum=%#x, computed=%#x\n", +@@ -1780,6 +1779,10 @@ csio_hw_use_fwconfig(struct csio_hw *hw, + rv = csio_hw_validate_caps(hw, mbp); + if (rv != 0) + goto bye; ++ ++ mempool_free(mbp, hw->mb_mempool); ++ mbp = NULL; ++ + /* + * Note that we're operating with parameters + * not supplied by the driver, rather than from hard-wired diff --git a/queue-4.4/scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch b/queue-4.4/scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch new file mode 100644 index 00000000000..df418c90ede --- /dev/null +++ b/queue-4.4/scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch @@ -0,0 +1,104 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Rafael David Tinoco +Date: Thu, 7 Dec 2017 19:59:13 -0200 +Subject: scsi: libiscsi: Allow sd_shutdown on bad transport + +From: Rafael David Tinoco + + +[ Upstream commit d754941225a7dbc61f6dd2173fa9498049f9a7ee ] + +If, for any reason, userland shuts down iscsi transport interfaces +before proper logouts - like when logging in to LUNs manually, without +logging out on server shutdown, or when automated scripts can't +umount/logout from logged LUNs - kernel will hang forever on its +sd_sync_cache() logic, after issuing the SYNCHRONIZE_CACHE cmd to all +still existent paths. + +PID: 1 TASK: ffff8801a69b8000 CPU: 1 COMMAND: "systemd-shutdow" + #0 [ffff8801a69c3a30] __schedule at ffffffff8183e9ee + #1 [ffff8801a69c3a80] schedule at ffffffff8183f0d5 + #2 [ffff8801a69c3a98] schedule_timeout at ffffffff81842199 + #3 [ffff8801a69c3b40] io_schedule_timeout at ffffffff8183e604 + #4 [ffff8801a69c3b70] wait_for_completion_io_timeout at ffffffff8183fc6c + #5 [ffff8801a69c3bd0] blk_execute_rq at ffffffff813cfe10 + #6 [ffff8801a69c3c88] scsi_execute at ffffffff815c3fc7 + #7 [ffff8801a69c3cc8] scsi_execute_req_flags at ffffffff815c60fe + #8 [ffff8801a69c3d30] sd_sync_cache at ffffffff815d37d7 + #9 [ffff8801a69c3da8] sd_shutdown at ffffffff815d3c3c + +This happens because iscsi_eh_cmd_timed_out(), the transport layer +timeout helper, would tell the queue timeout function (scsi_times_out) +to reset the request timer over and over, until the session state is +back to logged in state. Unfortunately, during server shutdown, this +might never happen again. + +Other option would be "not to handle" the issue in the transport +layer. That would trigger the error handler logic, which would also need +the session state to be logged in again. + +Best option, for such case, is to tell upper layers that the command was +handled during the transport layer error handler helper, marking it as +DID_NO_CONNECT, which will allow completion and inform about the +problem. + +After the session was marked as ISCSI_STATE_FAILED, due to the first +timeout during the server shutdown phase, all subsequent cmds will fail +to be queued, allowing upper logic to fail faster. + +Signed-off-by: Rafael David Tinoco +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/libiscsi.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1695,6 +1695,15 @@ int iscsi_queuecommand(struct Scsi_Host + */ + switch (session->state) { + case ISCSI_STATE_FAILED: ++ /* ++ * cmds should fail during shutdown, if the session ++ * state is bad, allowing completion to happen ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ reason = FAILURE_SESSION_FAILED; ++ sc->result = DID_NO_CONNECT << 16; ++ break; ++ } + case ISCSI_STATE_IN_RECOVERY: + reason = FAILURE_SESSION_IN_RECOVERY; + sc->result = DID_IMM_RETRY << 16; +@@ -1980,6 +1989,19 @@ static enum blk_eh_timer_return iscsi_eh + + if (session->state != ISCSI_STATE_LOGGED_IN) { + /* ++ * During shutdown, if session is prematurely disconnected, ++ * recovery won't happen and there will be hung cmds. Not ++ * handling cmds would trigger EH, also bad in this case. ++ * Instead, handle cmd, allow completion to happen and let ++ * upper layer to deal with the result. ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ sc->result = DID_NO_CONNECT << 16; ++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n"); ++ rc = BLK_EH_HANDLED; ++ goto done; ++ } ++ /* + * We are probably in the middle of iscsi recovery so let + * that complete and handle the error. + */ +@@ -2083,7 +2105,7 @@ done: + task->last_timeout = jiffies; + spin_unlock(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? +- "timer reset" : "nh"); ++ "timer reset" : "shutdown or nh"); + return rc; + } + diff --git a/queue-4.4/scsi-libsas-fix-error-when-getting-phy-events.patch b/queue-4.4/scsi-libsas-fix-error-when-getting-phy-events.patch new file mode 100644 index 00000000000..db2f50e3d29 --- /dev/null +++ b/queue-4.4/scsi-libsas-fix-error-when-getting-phy-events.patch @@ -0,0 +1,51 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jason Yan +Date: Thu, 4 Jan 2018 21:04:32 +0800 +Subject: scsi: libsas: fix error when getting phy events + +From: Jason Yan + + +[ Upstream commit 2b23d9509fd7174b362482cf5f3b5f9a2265bc33 ] + +The intend purpose here was to goto out if smp_execute_task() returned +error. Obviously something got screwed up. We will never get these link +error statistics below: + +~:/sys/class/sas_phy/phy-1:0:12 # cat invalid_dword_count +0 +~:/sys/class/sas_phy/phy-1:0:12 # cat running_disparity_error_count +0 +~:/sys/class/sas_phy/phy-1:0:12 # cat loss_of_dword_sync_count +0 +~:/sys/class/sas_phy/phy-1:0:12 # cat phy_reset_problem_count +0 + +Obviously we should goto error handler if smp_execute_task() returns +non-zero. + +Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") +Signed-off-by: Jason Yan +CC: John Garry +CC: chenqilin +CC: chenxiang +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/libsas/sas_expander.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -675,7 +675,7 @@ int sas_smp_get_phy_events(struct sas_ph + res = smp_execute_task(dev, req, RPEL_REQ_SIZE, + resp, RPEL_RESP_SIZE); + +- if (!res) ++ if (res) + goto out; + + phy->invalid_dword_count = scsi_to_u32(&resp[12]); diff --git a/queue-4.4/scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch b/queue-4.4/scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch new file mode 100644 index 00000000000..e2ef666d1bc --- /dev/null +++ b/queue-4.4/scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jason Yan +Date: Thu, 4 Jan 2018 21:04:31 +0800 +Subject: scsi: libsas: fix memory leak in sas_smp_get_phy_events() + +From: Jason Yan + + +[ Upstream commit 4a491b1ab11ca0556d2fda1ff1301e862a2d44c4 ] + +We've got a memory leak with the following producer: + +while true; +do cat /sys/class/sas_phy/phy-1:0:12/invalid_dword_count >/dev/null; +done + +The buffer req is allocated and not freed after we return. Fix it. + +Fixes: 2908d778ab3e ("[SCSI] aic94xx: new driver") +Signed-off-by: Jason Yan +CC: John Garry +CC: chenqilin +CC: chenxiang +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/libsas/sas_expander.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -684,6 +684,7 @@ int sas_smp_get_phy_events(struct sas_ph + phy->phy_reset_problem_count = scsi_to_u32(&resp[24]); + + out: ++ kfree(req); + kfree(resp); + return res; + diff --git a/queue-4.4/scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch b/queue-4.4/scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch new file mode 100644 index 00000000000..e9e9721dcf6 --- /dev/null +++ b/queue-4.4/scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch @@ -0,0 +1,44 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: chenxiang +Date: Thu, 4 Jan 2018 21:04:33 +0800 +Subject: scsi: libsas: initialize sas_phy status according to response of DISCOVER + +From: chenxiang + + +[ Upstream commit affc67788fe5dfffad5cda3d461db5cf2b2ff2b0 ] + +The status of SAS PHY is in sas_phy->enabled. There is an issue that the +status of a remote SAS PHY may be initialized incorrectly: if disable +remote SAS PHY through sysfs interface (such as echo 0 > +/sys/class/sas_phy/phy-1:0:0/enable), then reboot the system, and we +will find the status of remote SAS PHY which is disabled before is +1 (cat /sys/class/sas_phy/phy-1:0:0/enable). But actually the status of +remote SAS PHY is disabled and the device attached is not found. + +In SAS protocol, NEGOTIATED LOGICAL LINK RATE field of DISCOVER response +is 0x1 when remote SAS PHY is disabled. So initialize sas_phy->enabled +according to the value of NEGOTIATED LOGICAL LINK RATE field. + +Signed-off-by: chenxiang +Reviewed-by: John Garry +Signed-off-by: Jason Yan +Reviewed-by: Christoph Hellwig +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/libsas/sas_expander.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -282,6 +282,7 @@ static void sas_set_ex_phy(struct domain + phy->phy->minimum_linkrate = dr->pmin_linkrate; + phy->phy->maximum_linkrate = dr->pmax_linkrate; + phy->phy->negotiated_linkrate = phy->linkrate; ++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED); + + skip: + if (new_phy) diff --git a/queue-4.4/scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch b/queue-4.4/scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch new file mode 100644 index 00000000000..82a555bb7ff --- /dev/null +++ b/queue-4.4/scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch @@ -0,0 +1,99 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Chaitra P B +Date: Wed, 27 Dec 2017 23:09:11 -0800 +Subject: scsi: mpt3sas: Proper handling of set/clear of "ATA command pending" flag. + +From: Chaitra P B + + +[ Upstream commit f49d4aed1315a7b766d855f1367142e682b0cc87 ] + +1. In IO path, setting of "ATA command pending" flag early before device + removal, invalid device handle etc., checks causes any new commands + to be always returned with SAM_STAT_BUSY and when the driver removes + the drive the SML issues SYNC Cache command and that command is + always returned with SAM_STAT_BUSY and thus making SYNC Cache command + to requeued. + +2. If the driver gets an ATA PT command for a SATA drive then the driver + set "ATA command pending" flag in device specific data structure not + to allow any further commands until the ATA PT command is completed. + However, after setting the flag if the driver decides to return the + command back to upper layers without actually issuing to the firmware + (i.e., returns from qcmd failure return paths) then the corresponding + flag is not cleared and this prevents the driver from sending any new + commands to the drive. + +This patch fixes above two issues by setting of "ATA command pending" +flag after checking for whether device deleted, invalid device handle, +device busy with task management. And by setting "ATA command pending" +flag to false in all of the qcmd failure return paths after setting the +flag. + +Signed-off-by: Chaitra P B +Signed-off-by: Suganath Prabu S +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -3886,19 +3886,6 @@ scsih_qcmd(struct Scsi_Host *shost, stru + return 0; + } + +- /* +- * Bug work around for firmware SATL handling. The loop +- * is based on atomic operations and ensures consistency +- * since we're lockless at this point +- */ +- do { +- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { +- scmd->result = SAM_STAT_BUSY; +- scmd->scsi_done(scmd); +- return 0; +- } +- } while (_scsih_set_satl_pending(scmd, true)); +- + sas_target_priv_data = sas_device_priv_data->sas_target; + + /* invalid device handle */ +@@ -3924,6 +3911,19 @@ scsih_qcmd(struct Scsi_Host *shost, stru + sas_device_priv_data->block) + return SCSI_MLQUEUE_DEVICE_BUSY; + ++ /* ++ * Bug work around for firmware SATL handling. The loop ++ * is based on atomic operations and ensures consistency ++ * since we're lockless at this point ++ */ ++ do { ++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { ++ scmd->result = SAM_STAT_BUSY; ++ scmd->scsi_done(scmd); ++ return 0; ++ } ++ } while (_scsih_set_satl_pending(scmd, true)); ++ + if (scmd->sc_data_direction == DMA_FROM_DEVICE) + mpi_control = MPI2_SCSIIO_CONTROL_READ; + else if (scmd->sc_data_direction == DMA_TO_DEVICE) +@@ -3945,6 +3945,7 @@ scsih_qcmd(struct Scsi_Host *shost, stru + if (!smid) { + pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", + ioc->name, __func__); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); +@@ -3975,6 +3976,7 @@ scsih_qcmd(struct Scsi_Host *shost, stru + if (mpi_request->DataLength) { + if (ioc->build_sg_scmd(ioc, scmd, smid)) { + mpt3sas_base_free_smid(ioc, smid); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + } else diff --git a/queue-4.4/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch b/queue-4.4/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch new file mode 100644 index 00000000000..136d2eea589 --- /dev/null +++ b/queue-4.4/sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch @@ -0,0 +1,74 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Xin Long +Date: Sat, 10 Jun 2017 14:56:56 +0800 +Subject: sctp: fix recursive locking warning in sctp_do_peeloff + +From: Xin Long + + +[ Upstream commit 6dfe4b97e08ec3d1a593fdaca099f0ef0a3a19e6 ] + +Dmitry got the following recursive locking report while running syzkaller +fuzzer, the Call Trace: + __dump_stack lib/dump_stack.c:16 [inline] + dump_stack+0x2ee/0x3ef lib/dump_stack.c:52 + print_deadlock_bug kernel/locking/lockdep.c:1729 [inline] + check_deadlock kernel/locking/lockdep.c:1773 [inline] + validate_chain kernel/locking/lockdep.c:2251 [inline] + __lock_acquire+0xef2/0x3430 kernel/locking/lockdep.c:3340 + lock_acquire+0x2a1/0x630 kernel/locking/lockdep.c:3755 + lock_sock_nested+0xcb/0x120 net/core/sock.c:2536 + lock_sock include/net/sock.h:1460 [inline] + sctp_close+0xcd/0x9d0 net/sctp/socket.c:1497 + inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425 + inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432 + sock_release+0x8d/0x1e0 net/socket.c:597 + __sock_create+0x38b/0x870 net/socket.c:1226 + sock_create+0x7f/0xa0 net/socket.c:1237 + sctp_do_peeloff+0x1a2/0x440 net/sctp/socket.c:4879 + sctp_getsockopt_peeloff net/sctp/socket.c:4914 [inline] + sctp_getsockopt+0x111a/0x67e0 net/sctp/socket.c:6628 + sock_common_getsockopt+0x95/0xd0 net/core/sock.c:2690 + SYSC_getsockopt net/socket.c:1817 [inline] + SyS_getsockopt+0x240/0x380 net/socket.c:1799 + entry_SYSCALL_64_fastpath+0x1f/0xc2 + +This warning is caused by the lock held by sctp_getsockopt() is on one +socket, while the other lock that sctp_close() is getting later is on +the newly created (which failed) socket during peeloff operation. + +This patch is to avoid this warning by use lock_sock with subclass +SINGLE_DEPTH_NESTING as Wang Cong and Marcelo's suggestion. + +Reported-by: Dmitry Vyukov +Suggested-by: Marcelo Ricardo Leitner +Suggested-by: Cong Wang +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/socket.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -1518,7 +1518,7 @@ static void sctp_close(struct sock *sk, + + pr_debug("%s: sk:%p, timeout:%ld\n", __func__, sk, timeout); + +- lock_sock(sk); ++ lock_sock_nested(sk, SINGLE_DEPTH_NESTING); + sk->sk_shutdown = SHUTDOWN_MASK; + sk->sk_state = SCTP_SS_CLOSING; + +@@ -1569,7 +1569,7 @@ static void sctp_close(struct sock *sk, + * held and that should be grabbed before socket lock. + */ + spin_lock_bh(&net->sctp.addr_wq_lock); +- bh_lock_sock(sk); ++ bh_lock_sock_nested(sk); + + /* Hold the sock, since sk_common_release() will put sock_put() + * and we have just a little more cleanup. diff --git a/queue-4.4/selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch b/queue-4.4/selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch new file mode 100644 index 00000000000..19beaf292d5 --- /dev/null +++ b/queue-4.4/selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Michael Ellerman +Date: Fri, 19 May 2017 11:29:04 +1000 +Subject: selftests/powerpc: Fix TM resched DSCR test with some compilers + +From: Michael Ellerman + + +[ Upstream commit fe06fe860250a4f01d0eaf70a2563b1997174a74 ] + +The tm-resched-dscr test has started failing sometimes, depending on +what compiler it's built with, eg: + + test: tm_resched_dscr + Check DSCR TM context switch: tm-resched-dscr: tm-resched-dscr.c:76: test_body: Assertion `rv' failed. + !! child died by signal 6 + +When it fails we see that the compiler doesn't initialise rv to 1 before +entering the inline asm block. Although that's counter intuitive, it +is allowed because we tell the compiler that the inline asm will write +to rv (using "=r"), meaning the original value is irrelevant. + +Marking it as a read/write parameter would presumably work, but it seems +simpler to fix it by setting the initial value of rv in the inline asm. + +Fixes: 96d016108640 ("powerpc: Correct DSCR during TM context switch") +Signed-off-by: Michael Ellerman +Acked-by: Michael Neuling +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/powerpc/tm/tm-resched-dscr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c ++++ b/tools/testing/selftests/powerpc/tm/tm-resched-dscr.c +@@ -45,12 +45,12 @@ int test_body(void) + printf("Check DSCR TM context switch: "); + fflush(stdout); + for (;;) { +- rv = 1; + asm __volatile__ ( + /* set a known value into the DSCR */ + "ld 3, %[dscr1];" + "mtspr %[sprn_dscr], 3;" + ++ "li %[rv], 1;" + /* start and suspend a transaction */ + TBEGIN + "beq 1f;" diff --git a/queue-4.4/selinux-do-not-check-open-permission-on-sockets.patch b/queue-4.4/selinux-do-not-check-open-permission-on-sockets.patch new file mode 100644 index 00000000000..ff3dc95f391 --- /dev/null +++ b/queue-4.4/selinux-do-not-check-open-permission-on-sockets.patch @@ -0,0 +1,63 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Stephen Smalley +Date: Fri, 12 May 2017 12:41:24 -0400 +Subject: selinux: do not check open permission on sockets + +From: Stephen Smalley + + +[ Upstream commit ccb544781d34afdb73a9a73ae53035d824d193bf ] + +open permission is currently only defined for files in the kernel +(COMMON_FILE_PERMS rather than COMMON_FILE_SOCK_PERMS). Construction of +an artificial test case that tries to open a socket via /proc/pid/fd will +generate a recvfrom avc denial because recvfrom and open happen to map to +the same permission bit in socket vs file classes. + +open of a socket via /proc/pid/fd is not supported by the kernel regardless +and will ultimately return ENXIO. But we hit the permission check first and +can thus produce these odd/misleading denials. Omit the open check when +operating on a socket. + +Signed-off-by: Stephen Smalley +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1942,8 +1942,9 @@ static inline u32 file_to_av(struct file + static inline u32 open_file_to_av(struct file *file) + { + u32 av = file_to_av(file); ++ struct inode *inode = file_inode(file); + +- if (selinux_policycap_openperm) ++ if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC) + av |= FILE__OPEN; + + return av; +@@ -2912,6 +2913,7 @@ static int selinux_inode_permission(stru + static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) + { + const struct cred *cred = current_cred(); ++ struct inode *inode = d_backing_inode(dentry); + unsigned int ia_valid = iattr->ia_valid; + __u32 av = FILE__WRITE; + +@@ -2927,8 +2929,10 @@ static int selinux_inode_setattr(struct + ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) + return dentry_has_perm(cred, dentry, FILE__SETATTR); + +- if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE) +- && !(ia_valid & ATTR_FILE)) ++ if (selinux_policycap_openperm && ++ inode->i_sb->s_magic != SOCKFS_MAGIC && ++ (ia_valid & ATTR_SIZE) && ++ !(ia_valid & ATTR_FILE)) + av |= FILE__OPEN; + + return dentry_has_perm(cred, dentry, av); diff --git a/queue-4.4/serial-8250-omap-disable-dma-for-console-uart.patch b/queue-4.4/serial-8250-omap-disable-dma-for-console-uart.patch new file mode 100644 index 00000000000..8a068acbe53 --- /dev/null +++ b/queue-4.4/serial-8250-omap-disable-dma-for-console-uart.patch @@ -0,0 +1,46 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Vignesh R +Date: Sat, 22 Apr 2017 18:37:19 +0530 +Subject: serial: 8250: omap: Disable DMA for console UART + +From: Vignesh R + + +[ Upstream commit 84b40e3b57eef1417479c00490dd4c9f6e5ffdbc ] + +Kernel always writes log messages to console via +serial8250_console_write()->serial8250_console_putchar() which directly +accesses UART_TX register _without_ using DMA. + +But, if other processes like systemd using same UART port, then these +writes are handled by a different code flow using 8250_omap driver where +there is provision to use DMA. + +It seems that it is possible that both DMA and CPU might simultaneously +put data to UART FIFO and lead to potential loss of data due to FIFO +overflow and weird data corruption. This happens when both kernel +console and userspace tries to write simultaneously to the same UART +port. Therefore, disable DMA on kernel console port to avoid potential +race between CPU and DMA. + +Signed-off-by: Vignesh R +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_omap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -608,6 +608,10 @@ static int omap_8250_startup(struct uart + up->lsr_saved_flags = 0; + up->msr_saved_flags = 0; + ++ /* Disable DMA for console UART */ ++ if (uart_console(port)) ++ up->dma = NULL; ++ + if (up->dma) { + ret = serial8250_request_dma(up); + if (ret) { diff --git a/queue-4.4/serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch b/queue-4.4/serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch new file mode 100644 index 00000000000..ea510649d81 --- /dev/null +++ b/queue-4.4/serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch @@ -0,0 +1,69 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Geert Uytterhoeven +Date: Tue, 25 Apr 2017 20:15:35 +0200 +Subject: serial: sh-sci: Fix race condition causing garbage during shutdown + +From: Geert Uytterhoeven + + +[ Upstream commit 1cf4a7efdc71cab84c42cfea7200608711ea954f ] + +If DMA is enabled and used, a burst of old data may be seen on the +serial console during "poweroff" or "reboot". uart_flush_buffer() +clears the circular buffer, but sci_port.tx_dma_len is not reset. +This leads to a circular buffer overflow, dumping (UART_XMIT_SIZE - +sci_port.tx_dma_len) bytes. + +To fix this, add a .flush_buffer() callback that resets +sci_port.tx_dma_len. + +Inspired by commit 31ca2c63fdc0aee7 ("tty/serial: atmel: fix race +condition (TX+DMA)"). + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/sh-sci.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1457,7 +1457,16 @@ static void sci_free_dma(struct uart_por + if (s->chan_rx) + sci_rx_dma_release(s, false); + } +-#else ++ ++static void sci_flush_buffer(struct uart_port *port) ++{ ++ /* ++ * In uart_flush_buffer(), the xmit circular buffer has just been ++ * cleared, so we have to reset tx_dma_len accordingly. ++ */ ++ to_sci_port(port)->tx_dma_len = 0; ++} ++#else /* !CONFIG_SERIAL_SH_SCI_DMA */ + static inline void sci_request_dma(struct uart_port *port) + { + } +@@ -1465,7 +1474,9 @@ static inline void sci_request_dma(struc + static inline void sci_free_dma(struct uart_port *port) + { + } +-#endif ++ ++#define sci_flush_buffer NULL ++#endif /* !CONFIG_SERIAL_SH_SCI_DMA */ + + static irqreturn_t sci_rx_interrupt(int irq, void *ptr) + { +@@ -2205,6 +2216,7 @@ static struct uart_ops sci_uart_ops = { + .break_ctl = sci_break_ctl, + .startup = sci_startup, + .shutdown = sci_shutdown, ++ .flush_buffer = sci_flush_buffer, + .set_termios = sci_set_termios, + .pm = sci_pm, + .type = sci_type, diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..226dd287ff0 --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,166 @@ +cfg80211-make-rate_info_bw_20-the-default.patch +md-raid5-make-use-of-spin_lock_irq-over-local_irq_disable-spin_lock.patch +rtc-snvs-fix-an-incorrect-check-of-return-value.patch +x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch +nfsv4.1-reclaim_complete-must-handle-nfs4err_conn_not_bound_to_session.patch +ib-srpt-fix-abort-handling.patch +af_key-fix-slab-out-of-bounds-in-pfkey_compile_policy.patch +mac80211-bail-out-from-prep_connection-if-a-reconfig-is-ongoing.patch +bna-avoid-reading-past-end-of-buffer.patch +qlge-avoid-reading-past-end-of-buffer.patch +ipmi_ssif-unlock-on-allocation-failure.patch +net-cdc_ncm-fix-tx-zero-padding.patch +net-ethernet-ti-cpsw-adjust-cpsw-fifos-depth-for-fullduplex-flow-control.patch +lockd-fix-lockd-shutdown-race.patch +drivers-misc-vmw_vmci-vmci_queue_pair.c-fix-a-couple-integer-overflow-tests.patch +pidns-disable-pid-allocation-if-pid_ns_prepare_proc-is-failed-in-alloc_pid.patch +s390-move-_text-symbol-to-address-higher-than-zero.patch +net-mlx4_en-avoid-adding-steering-rules-with-invalid-ring.patch +nfsv4.1-work-around-a-linux-server-bug.patch +cifs-silence-lockdep-splat-in-cifs_relock_file.patch +blk-mq-nvme-512b-4k-t10-dif-dix-format-returns-i-o-error-on-dd-with-split-op.patch +net-qca_spi-fix-alignment-issues-in-rx-path.patch +netxen_nic-set-rcode-to-the-return-status-from-the-call-to-netxen_issue_cmd.patch +input-elan_i2c-check-if-device-is-there-before-really-probing.patch +input-elantech-force-relative-mode-on-a-certain-module.patch +kvm-ppc-book3s-pr-check-copy_to-from_user-return-values.patch +vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch +smb2-fix-share-type-handling.patch +bus-brcmstb_gisb-use-register-offsets-with-writes-too.patch +bus-brcmstb_gisb-correct-support-for-64-bit-address-output.patch +powercap-fix-an-error-code-in-powercap_register_zone.patch +arm-dts-imx53-qsrb-pulldown-pmic-irq-pin.patch +staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch +x86-tsc-provide-tsc-unstable-boot-parameter.patch +arm-dts-imx6qdl-wandboard-fix-audio-channel-swap.patch +ipv6-avoid-dad-failures-for-addresses-with-nodad.patch +async_tx-fix-dma_prep_fence-usage-in-do_async_gen_syndrome.patch +usb-dwc3-keystone-check-return-value.patch +btrfs-fix-incorrect-error-return-ret-being-passed-to-mapping_set_error.patch +ata-libahci-properly-propagate-return-value-of-platform_get_irq.patch +neighbour-update-neigh-timestamps-iff-update-is-effective.patch +arp-honour-gratuitous-arp-_replies_.patch +usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch +usb-ene_usb6250-fix-first-command-execution.patch +net-x25-fix-one-potential-use-after-free-issue.patch +usb-ene_usb6250-fix-scsi-residue-overwriting.patch +serial-8250-omap-disable-dma-for-console-uart.patch +serial-sh-sci-fix-race-condition-causing-garbage-during-shutdown.patch +sh_eth-use-platform-device-for-printing-before-register_netdev.patch +scsi-csiostor-fix-use-after-free-in-csio_hw_use_fwconfig.patch +powerpc-mm-fix-virt_addr_valid-etc.-on-64-bit-hash.patch +ath5k-fix-memory-leak-on-buf-on-failed-eeprom-read.patch +selftests-powerpc-fix-tm-resched-dscr-test-with-some-compilers.patch +xfrm-fix-state-migration-copy-replay-sequence-numbers.patch +iio-hi8435-avoid-garbage-event-at-first-enable.patch +iio-hi8435-cleanup-reset-gpio.patch +ext4-handle-the-rest-of-ext4_mb_load_buddy-enomem-errors.patch +md-cluster-fix-potential-lock-issue-in-add_new_disk.patch +arm-davinci-da8xx-create-dsp-device-only-when-assigned-memory.patch +ray_cs-avoid-reading-past-end-of-buffer.patch +leds-pca955x-correct-i2c-functionality.patch +sched-numa-use-down_read_trylock-for-the-mmap_sem.patch +net-mlx5-tolerate-irq_set_affinity_hint-failures.patch +selinux-do-not-check-open-permission-on-sockets.patch +block-fix-an-error-code-in-add_partition.patch +mlx5-fix-bug-reading-rss_hash_type-from-cqe.patch +net-ieee802154-fix-net_device-reference-release-too-early.patch +libceph-null-deref-on-crush_decode-error-path.patch +netfilter-ctnetlink-fix-incorrect-nf_ct_put-during-hash-resize.patch +pnfs-flexfiles-missing-error-code-in-ff_layout_alloc_lseg.patch +asoc-rsnd-ssi-pio-adjust-to-24bit-mode.patch +scsi-bnx2fc-fix-race-condition-in-bnx2fc_get_host_stats.patch +fix-race-in-drivers-char-random.c-get_reg.patch +ext4-fix-off-by-one-on-max-nr_pages-in-ext4_find_unwritten_pgoff.patch +tcp-better-validation-of-received-ack-sequences.patch +net-move-somaxconn-init-from-sysctl-code.patch +input-elan_i2c-clear-int-before-resetting-controller.patch +bonding-don-t-update-slave-link-until-ready-to-commit.patch +kvm-nvmx-fix-handling-of-lmsw-instruction.patch +net-llc-add-lock_sock-in-llc_ui_bind-to-avoid-a-race-condition.patch +arm-dts-ls1021a-add-fsl-ls1021a-esdhc-compatible-string-to-esdhc-node.patch +thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch +perf-probe-add-warning-message-if-there-is-unexpected-event-name.patch +l2tp-fix-missing-print-session-offset-info.patch +rds-reset-rs-rs_bound_addr-in-rds_add_bound-failure-path.patch +hwmon-ina2xx-make-calibration-register-value-fixed.patch +media-videobuf2-core-don-t-go-out-of-the-buffer-range.patch +asoc-intel-cht_bsw_rt5645-analog-mic-support.patch +scsi-libiscsi-allow-sd_shutdown-on-bad-transport.patch +scsi-mpt3sas-proper-handling-of-set-clear-of-ata-command-pending-flag.patch +vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch +gpio-label-descriptors-using-the-device-name.patch +asoc-intel-sst-fix-the-return-value-of-sst_send_byte_stream_mrfld.patch +wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch +hdlcdrv-fix-divide-by-zero-in-hdlcdrv_ioctl.patch +ovl-filter-trusted-xattr-for-non-admin.patch +powerpc-don-t-clobber-tcr-when-setting-tcr.patch +dmaengine-imx-sdma-handle-return-value-of-clk_prepare_enable.patch +arm64-futex-fix-undefined-behaviour-with-futex_op_oparg_shift-usage.patch +net-mlx5-avoid-build-warning-for-uniprocessor.patch +cxgb4-fw-upgrade-fixes.patch +rtc-opal-handle-disabled-tpo-in-opal_get_tpo_time.patch +rtc-interface-validate-alarm-time-before-handling-rollover.patch +sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch +net-freescale-fix-potential-null-pointer-dereference.patch +mtd-nand-gpmi-fix-gpmi_nand_init-error-path.patch +kvm-svm-do-not-zero-out-segment-attributes-if-segment-is-unusable-or-not-present.patch +clk-scpi-fix-return-type-of-__scpi_dvfs_round_rate.patch +clk-fix-__set_clk_rates-error-print-string.patch +powerpc-spufs-fix-coredump-of-spu-contexts.patch +perf-trace-add-mmap-alias-for-s390.patch +qlcnic-fix-a-sleep-in-atomic-bug-in-qlcnic_82xx_hw_write_wx_2m-and-qlcnic_82xx_hw_read_wx_2m.patch +misdn-fix-a-sleep-in-atomic-bug.patch +drm-omap-fix-tiled-buffer-stride-calculations.patch +cxgb4-fix-incorrect-cim_la-output-for-t6.patch +fix-serial-console-on-sni-rm400-machines.patch +bio-integrity-do-not-allocate-integrity-context-for-bio-w-o-data.patch +skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch +sit-reload-iphdr-in-ipip6_rcv.patch +net-mlx4-fix-the-check-in-attaching-steering-rules.patch +net-mlx4-check-if-granular-qos-per-vf-has-been-enabled-before-updating-qp-qos_vport.patch +perf-header-set-proper-module-name-when-build-id-event-found.patch +perf-report-ensure-the-perf-dso-mapping-matches-what-libdw-sees.patch +tags-honor-compiled_source-with-apart-output-directory.patch +e1000e-fix-race-condition-around-skb_tstamp_tx.patch +cx25840-fix-unchecked-return-values.patch +mceusb-sporadic-rx-truncation-corruption-fix.patch +net-phy-avoid-genphy_aneg_done-for-phys-without-clause-22-support.patch +arm-imx-add-mxc_cpu_imx6ull-and-cpu_is_imx6ull.patch +e1000e-undo-e1000e_pm_freeze-if-__e1000_shutdown-fails.patch +perf-core-correct-event-creation-with-perf_format_group.patch +mips-mm-fixed-mappings-correct-initialisation.patch +mips-mm-adjust-pkmap-location.patch +mips-kprobes-flush_insn_slot-should-flush-only-if-probe-initialised.patch +fix-loop-device-flush-before-configure-v3.patch +net-emac-fix-reset-timeout-with-ar8035-phy.patch +perf-tests-decompress-kernel-module-before-objdump.patch +skbuff-only-inherit-relevant-tx_flags.patch +xen-avoid-type-warning-in-xchg_xen_ulong.patch +bnx2x-allow-vfs-to-disable-txvlan-offload.patch +sctp-fix-recursive-locking-warning-in-sctp_do_peeloff.patch +sparc64-ldc-abort-during-vds-iso-boot.patch +iio-magnetometer-st_magn_spi-fix-spi_device_id-table.patch +bluetooth-send-hci-set-event-mask-page-2-command-only-when-needed.patch +cpuidle-dt-add-missing-of_node_put.patch +acpica-events-add-runtime-stub-support-for-event-apis.patch +acpica-disassembler-abort-on-an-invalid-unknown-aml-opcode.patch +s390-dasd-fix-hanging-safe-offline.patch +vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch +bcache-stop-writeback-thread-after-detaching.patch +bcache-segregate-flash-only-volume-write-streams.patch +scsi-libsas-fix-memory-leak-in-sas_smp_get_phy_events.patch +scsi-libsas-fix-error-when-getting-phy-events.patch +scsi-libsas-initialize-sas_phy-status-according-to-response-of-discover.patch +blk-mq-fix-kernel-oops-in-blk_mq_tag_idle.patch +tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch +edac-mv64x60-fix-an-error-handling-path.patch +cxgb4vf-fix-sge-fl-buffer-initialization-logic-for-64k-pages.patch +perf-tools-fix-copyfile_offset-update-of-output-offset.patch +signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch +signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch +signal-arm-document-conflicts-with-si_user-and-sigfpe.patch +ipsec-check-return-value-of-skb_to_sgvec-always.patch +rxrpc-check-return-value-of-skb_to_sgvec-always.patch +virtio_net-check-return-value-of-skb_to_sgvec-always.patch +virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch diff --git a/queue-4.4/sh_eth-use-platform-device-for-printing-before-register_netdev.patch b/queue-4.4/sh_eth-use-platform-device-for-printing-before-register_netdev.patch new file mode 100644 index 00000000000..7d9d9c26680 --- /dev/null +++ b/queue-4.4/sh_eth-use-platform-device-for-printing-before-register_netdev.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Geert Uytterhoeven +Date: Thu, 18 May 2017 15:01:34 +0200 +Subject: sh_eth: Use platform device for printing before register_netdev() + +From: Geert Uytterhoeven + + +[ Upstream commit 5f5c5449acad0cd3322e53e1ac68c044483b0aa5 ] + +The MDIO initialization failure message is printed using the network +device, before it has been registered, leading to: + + (null): failed to initialise MDIO + +Use the platform device instead to fix this: + + sh-eth ee700000.ethernet: failed to initialise MDIO + +Fixes: daacf03f0bbfefee ("sh_eth: Register MDIO bus before registering the network device") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Laurent Pinchart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/sh_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3222,7 +3222,7 @@ static int sh_eth_drv_probe(struct platf + /* MDIO bus init */ + ret = sh_mdio_init(mdp, pd); + if (ret) { +- dev_err(&ndev->dev, "failed to initialise MDIO\n"); ++ dev_err(&pdev->dev, "failed to initialise MDIO\n"); + goto out_release; + } + diff --git a/queue-4.4/signal-arm-document-conflicts-with-si_user-and-sigfpe.patch b/queue-4.4/signal-arm-document-conflicts-with-si_user-and-sigfpe.patch new file mode 100644 index 00000000000..32e4c3066a7 --- /dev/null +++ b/queue-4.4/signal-arm-document-conflicts-with-si_user-and-sigfpe.patch @@ -0,0 +1,70 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Eric W. Biederman" +Date: Thu, 17 Aug 2017 17:07:46 -0500 +Subject: signal/arm: Document conflicts with SI_USER and SIGFPE + +From: "Eric W. Biederman" + + +[ Upstream commit 7771c66457004977b616bab785209f49d164f527 ] + +Setting si_code to 0 results in a userspace seeing an si_code of 0. +This is the same si_code as SI_USER. Posix and common sense requires +that SI_USER not be a signal specific si_code. As such this use of 0 +for the si_code is a pretty horribly broken ABI. + +Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a +value of __SI_KILL and now sees a value of SIL_KILL with the result +that uid and pid fields are copied and which might copying the si_addr +field by accident but certainly not by design. Making this a very +flakey implementation. + +Utilizing FPE_FIXME, siginfo_layout will now return SIL_FAULT and the +appropriate fields will be reliably copied. + +Possible ABI fixes includee: +- Send the signal without siginfo +- Don't generate a signal +- Possibly assign and use an appropriate si_code +- Don't handle cases which can't happen + +Cc: Russell King +Cc: linux-arm-kernel@lists.infradead.org +Ref: 451436b7bbb2 ("[ARM] Add support code for ARM hardware vector floating point") +History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/uapi/asm/siginfo.h | 13 +++++++++++++ + arch/arm/vfp/vfpmodule.c | 2 +- + 2 files changed, 14 insertions(+), 1 deletion(-) + create mode 100644 arch/arm/include/uapi/asm/siginfo.h + +--- /dev/null ++++ b/arch/arm/include/uapi/asm/siginfo.h +@@ -0,0 +1,13 @@ ++#ifndef __ASM_SIGINFO_H ++#define __ASM_SIGINFO_H ++ ++#include ++ ++/* ++ * SIGFPE si_codes ++ */ ++#ifdef __KERNEL__ ++#define FPE_FIXME 0 /* Broken dup of SI_USER */ ++#endif /* __KERNEL__ */ ++ ++#endif +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -261,7 +261,7 @@ static void vfp_raise_exceptions(u32 exc + + if (exceptions == VFP_EXCEPTION_ERROR) { + vfp_panic("unhandled bounce", inst); +- vfp_raise_sigfpe(0, regs); ++ vfp_raise_sigfpe(FPE_FIXME, regs); + return; + } + diff --git a/queue-4.4/signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch b/queue-4.4/signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch new file mode 100644 index 00000000000..d631dc27cb9 --- /dev/null +++ b/queue-4.4/signal-metag-document-a-conflict-with-si_user-with-sigfpe.patch @@ -0,0 +1,66 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Eric W. Biederman" +Date: Tue, 1 Aug 2017 10:37:40 -0500 +Subject: signal/metag: Document a conflict with SI_USER with SIGFPE + +From: "Eric W. Biederman" + + +[ Upstream commit b80328be53c215346b153769267b38f531d89b4f ] + +Setting si_code to 0 results in a userspace seeing an si_code of 0. +This is the same si_code as SI_USER. Posix and common sense requires +that SI_USER not be a signal specific si_code. As such this use of 0 +for the si_code is a pretty horribly broken ABI. + +Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a +value of __SI_KILL and now sees a value of SIL_KILL with the result +hat uid and pid fields are copied and which might copying the si_addr +field by accident but certainly not by design. Making this a very +flakey implementation. + +Utilizing FPE_FIXME siginfo_layout will now return SIL_FAULT and the +appropriate fields will reliably be copied. + +Possible ABI fixes includee: + - Send the signal without siginfo + - Don't generate a signal + - Possibly assign and use an appropriate si_code + - Don't handle cases which can't happen + +Cc: James Hogan +Cc: linux-metag@vger.kernel.org +Ref: ac919f0883e5 ("metag: Traps") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/metag/include/uapi/asm/siginfo.h | 7 +++++++ + arch/metag/kernel/traps.c | 2 +- + 2 files changed, 8 insertions(+), 1 deletion(-) + +--- a/arch/metag/include/uapi/asm/siginfo.h ++++ b/arch/metag/include/uapi/asm/siginfo.h +@@ -5,4 +5,11 @@ + + #include + ++/* ++ * SIGFPE si_codes ++ */ ++#ifdef __KERNEL__ ++#define FPE_FIXME 0 /* Broken dup of SI_USER */ ++#endif /* __KERNEL__ */ ++ + #endif +--- a/arch/metag/kernel/traps.c ++++ b/arch/metag/kernel/traps.c +@@ -732,7 +732,7 @@ TBIRES fpe_handler(TBIRES State, int Sig + else if (error_state & TXSTAT_FPE_INEXACT_BIT) + info.si_code = FPE_FLTRES; + else +- info.si_code = 0; ++ info.si_code = FPE_FIXME; + info.si_errno = 0; + info.si_addr = (__force void __user *)regs->ctx.CurrPC; + force_sig_info(SIGFPE, &info, current); diff --git a/queue-4.4/signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch b/queue-4.4/signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch new file mode 100644 index 00000000000..83822292b63 --- /dev/null +++ b/queue-4.4/signal-powerpc-document-conflicts-with-si_user-and-sigfpe-and-sigtrap.patch @@ -0,0 +1,114 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Eric W. Biederman" +Date: Sat, 19 Aug 2017 15:26:01 -0500 +Subject: signal/powerpc: Document conflicts with SI_USER and SIGFPE and SIGTRAP + +From: "Eric W. Biederman" + + +[ Upstream commit cf4674c46c66e45f238f8f7e81af2a444b970c0a ] + +Setting si_code to 0 results in a userspace seeing an si_code of 0. +This is the same si_code as SI_USER. Posix and common sense requires +that SI_USER not be a signal specific si_code. As such this use of 0 +for the si_code is a pretty horribly broken ABI. + +Further use of si_code == 0 guaranteed that copy_siginfo_to_user saw a +value of __SI_KILL and now sees a value of SIL_KILL with the result +that uid and pid fields are copied and which might copying the si_addr +field by accident but certainly not by design. Making this a very +flakey implementation. + +Utilizing FPE_FIXME and TRAP_FIXME, siginfo_layout() will now return +SIL_FAULT and the appropriate fields will be reliably copied. + +Possible ABI fixes includee: +- Send the signal without siginfo +- Don't generate a signal +- Possibly assign and use an appropriate si_code +- Don't handle cases which can't happen +Cc: Paul Mackerras +Cc: Kumar Gala +Cc: Michael Ellerman +Cc: Benjamin Herrenschmidt +Cc: linuxppc-dev@lists.ozlabs.org +Ref: 9bad068c24d7 ("[PATCH] ppc32: support for e500 and 85xx") +Ref: 0ed70f6105ef ("PPC32: Provide proper siginfo information on various exceptions.") +History Tree: https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/uapi/asm/siginfo.h | 15 +++++++++++++++ + arch/powerpc/kernel/traps.c | 10 +++++----- + 2 files changed, 20 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/include/uapi/asm/siginfo.h ++++ b/arch/powerpc/include/uapi/asm/siginfo.h +@@ -17,4 +17,19 @@ + #undef NSIGTRAP + #define NSIGTRAP 4 + ++/* ++ * SIGFPE si_codes ++ */ ++#ifdef __KERNEL__ ++#define FPE_FIXME 0 /* Broken dup of SI_USER */ ++#endif /* __KERNEL__ */ ++ ++/* ++ * SIGTRAP si_codes ++ */ ++#ifdef __KERNEL__ ++#define TRAP_FIXME 0 /* Broken dup of SI_USER */ ++#endif /* __KERNEL__ */ ++ ++ + #endif /* _ASM_POWERPC_SIGINFO_H */ +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -771,7 +771,7 @@ void unknown_exception(struct pt_regs *r + printk("Bad trap at PC: %lx, SR: %lx, vector=%lx\n", + regs->nip, regs->msr, regs->trap); + +- _exception(SIGTRAP, regs, 0, 0); ++ _exception(SIGTRAP, regs, TRAP_FIXME, 0); + + exception_exit(prev_state); + } +@@ -793,7 +793,7 @@ bail: + + void RunModeException(struct pt_regs *regs) + { +- _exception(SIGTRAP, regs, 0, 0); ++ _exception(SIGTRAP, regs, TRAP_FIXME, 0); + } + + void __kprobes single_step_exception(struct pt_regs *regs) +@@ -828,7 +828,7 @@ static void emulate_single_step(struct p + + static inline int __parse_fpscr(unsigned long fpscr) + { +- int ret = 0; ++ int ret = FPE_FIXME; + + /* Invalid operation */ + if ((fpscr & FPSCR_VE) && (fpscr & FPSCR_VX)) +@@ -1764,7 +1764,7 @@ void SPEFloatingPointException(struct pt + extern int do_spe_mathemu(struct pt_regs *regs); + unsigned long spefscr; + int fpexc_mode; +- int code = 0; ++ int code = FPE_FIXME; + int err; + + flush_spe_to_thread(current); +@@ -1833,7 +1833,7 @@ void SPEFloatingPointRoundException(stru + printk(KERN_ERR "unrecognized spe instruction " + "in %s at %lx\n", current->comm, regs->nip); + } else { +- _exception(SIGFPE, regs, 0, regs->nip); ++ _exception(SIGFPE, regs, FPE_FIXME, regs->nip); + return; + } + } diff --git a/queue-4.4/sit-reload-iphdr-in-ipip6_rcv.patch b/queue-4.4/sit-reload-iphdr-in-ipip6_rcv.patch new file mode 100644 index 00000000000..4ab7ba80f14 --- /dev/null +++ b/queue-4.4/sit-reload-iphdr-in-ipip6_rcv.patch @@ -0,0 +1,32 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Haishuang Yan +Date: Sun, 4 Jun 2017 14:43:43 +0800 +Subject: sit: reload iphdr in ipip6_rcv + +From: Haishuang Yan + + +[ Upstream commit b699d0035836f6712917a41e7ae58d84359b8ff9 ] + +Since iptunnel_pull_header() can call pskb_may_pull(), +we must reload any pointer that was related to skb->head. + +Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap") +Signed-off-by: Haishuang Yan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/sit.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -690,6 +690,7 @@ static int ipip6_rcv(struct sk_buff *skb + + if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6))) + goto out; ++ iph = ip_hdr(skb); + + err = IP_ECN_decapsulate(iph, skb); + if (unlikely(err)) { diff --git a/queue-4.4/skbuff-only-inherit-relevant-tx_flags.patch b/queue-4.4/skbuff-only-inherit-relevant-tx_flags.patch new file mode 100644 index 00000000000..fd8baa20f49 --- /dev/null +++ b/queue-4.4/skbuff-only-inherit-relevant-tx_flags.patch @@ -0,0 +1,64 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Willem de Bruijn +Date: Thu, 8 Jun 2017 11:35:03 -0400 +Subject: skbuff: only inherit relevant tx_flags + +From: Willem de Bruijn + + +[ Upstream commit fff88030b3ff930ca7a3d74acfee0472f33887ea ] + +When inheriting tx_flags from one skbuff to another, always apply a +mask to avoid overwriting unrelated other bits in the field. + +The two SKBTX_SHARED_FRAG cases clears all other bits. In practice, +tx_flags are zero at this point now. But this is fragile. Timestamp +flags are set, for instance, if in tcp_gso_segment, after this clear +in skb_segment. + +The SKBTX_ANY_TSTAMP mask in __skb_tstamp_tx ensures that new +skbs do not accidentally inherit flags such as SKBTX_SHARED_FRAG. + +Signed-off-by: Willem de Bruijn +Acked-by: Soheil Hassas Yeganeh +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/skbuff.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2551,7 +2551,8 @@ void skb_split(struct sk_buff *skb, stru + { + int pos = skb_headlen(skb); + +- skb_shinfo(skb1)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG; ++ skb_shinfo(skb1)->tx_flags |= skb_shinfo(skb)->tx_flags & ++ SKBTX_SHARED_FRAG; + if (len < pos) /* Split line is inside header. */ + skb_split_inside_header(skb, skb1, len, pos); + else /* Second chunk has no header, nothing to copy. */ +@@ -3115,8 +3116,8 @@ struct sk_buff *skb_segment(struct sk_bu + skb_copy_from_linear_data_offset(head_skb, offset, + skb_put(nskb, hsize), hsize); + +- skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags & +- SKBTX_SHARED_FRAG; ++ skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags & ++ SKBTX_SHARED_FRAG; + + while (pos < offset + len) { + if (i >= nfrags) { +@@ -3734,7 +3735,8 @@ void __skb_tstamp_tx(struct sk_buff *ori + return; + + if (tsonly) { +- skb_shinfo(skb)->tx_flags = skb_shinfo(orig_skb)->tx_flags; ++ skb_shinfo(skb)->tx_flags |= skb_shinfo(orig_skb)->tx_flags & ++ SKBTX_ANY_TSTAMP; + skb_shinfo(skb)->tskey = skb_shinfo(orig_skb)->tskey; + } + diff --git a/queue-4.4/skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch b/queue-4.4/skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch new file mode 100644 index 00000000000..21aee439f19 --- /dev/null +++ b/queue-4.4/skbuff-return-emsgsize-in-skb_to_sgvec-to-prevent-overflow.patch @@ -0,0 +1,183 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Jason A. Donenfeld" +Date: Sun, 4 Jun 2017 04:16:22 +0200 +Subject: skbuff: return -EMSGSIZE in skb_to_sgvec to prevent overflow + +From: "Jason A. Donenfeld" + + +[ Upstream commit 48a1df65334b74bd7531f932cca5928932abf769 ] + +This is a defense-in-depth measure in response to bugs like +4d6fa57b4dab ("macsec: avoid heap overflow in skb_to_sgvec"). There's +not only a potential overflow of sglist items, but also a stack overflow +potential, so we fix this by limiting the amount of recursion this function +is allowed to do. Not actually providing a bounded base case is a future +disaster that we can easily avoid here. + +As a small matter of house keeping, we take this opportunity to move the +documentation comment over the actual function the documentation is for. + +While this could be implemented by using an explicit stack of skbuffs, +when implementing this, the function complexity increased considerably, +and I don't think such complexity and bloat is actually worth it. So, +instead I built this and tested it on x86, x86_64, ARM, ARM64, and MIPS, +and measured the stack usage there. I also reverted the recent MIPS +changes that give it a separate IRQ stack, so that I could experience +some worst-case situations. I found that limiting it to 24 layers deep +yielded a good stack usage with room for safety, as well as being much +deeper than any driver actually ever creates. + +Signed-off-by: Jason A. Donenfeld +Cc: Steffen Klassert +Cc: Herbert Xu +Cc: "David S. Miller" +Cc: David Howells +Cc: Sabrina Dubroca +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 8 +++--- + net/core/skbuff.c | 65 +++++++++++++++++++++++++++++++------------------ + 2 files changed, 46 insertions(+), 27 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -879,10 +879,10 @@ struct sk_buff *skb_realloc_headroom(str + unsigned int headroom); + struct sk_buff *skb_copy_expand(const struct sk_buff *skb, int newheadroom, + int newtailroom, gfp_t priority); +-int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, +- int offset, int len); +-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, +- int len); ++int __must_check skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, ++ int offset, int len); ++int __must_check skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, ++ int offset, int len); + int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer); + int skb_pad(struct sk_buff *skb, int pad); + #define dev_kfree_skb(a) consume_skb(a) +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3329,24 +3329,18 @@ void __init skb_init(void) + NULL); + } + +-/** +- * skb_to_sgvec - Fill a scatter-gather list from a socket buffer +- * @skb: Socket buffer containing the buffers to be mapped +- * @sg: The scatter-gather list to map into +- * @offset: The offset into the buffer's contents to start mapping +- * @len: Length of buffer space to be mapped +- * +- * Fill the specified scatter-gather list with mappings/pointers into a +- * region of the buffer space attached to a socket buffer. +- */ + static int +-__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) ++__skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len, ++ unsigned int recursion_level) + { + int start = skb_headlen(skb); + int i, copy = start - offset; + struct sk_buff *frag_iter; + int elt = 0; + ++ if (unlikely(recursion_level >= 24)) ++ return -EMSGSIZE; ++ + if (copy > 0) { + if (copy > len) + copy = len; +@@ -3365,6 +3359,8 @@ __skb_to_sgvec(struct sk_buff *skb, stru + end = start + skb_frag_size(&skb_shinfo(skb)->frags[i]); + if ((copy = end - offset) > 0) { + skb_frag_t *frag = &skb_shinfo(skb)->frags[i]; ++ if (unlikely(elt && sg_is_last(&sg[elt - 1]))) ++ return -EMSGSIZE; + + if (copy > len) + copy = len; +@@ -3379,16 +3375,22 @@ __skb_to_sgvec(struct sk_buff *skb, stru + } + + skb_walk_frags(skb, frag_iter) { +- int end; ++ int end, ret; + + WARN_ON(start > offset + len); + + end = start + frag_iter->len; + if ((copy = end - offset) > 0) { ++ if (unlikely(elt && sg_is_last(&sg[elt - 1]))) ++ return -EMSGSIZE; ++ + if (copy > len) + copy = len; +- elt += __skb_to_sgvec(frag_iter, sg+elt, offset - start, +- copy); ++ ret = __skb_to_sgvec(frag_iter, sg+elt, offset - start, ++ copy, recursion_level + 1); ++ if (unlikely(ret < 0)) ++ return ret; ++ elt += ret; + if ((len -= copy) == 0) + return elt; + offset += copy; +@@ -3399,6 +3401,31 @@ __skb_to_sgvec(struct sk_buff *skb, stru + return elt; + } + ++/** ++ * skb_to_sgvec - Fill a scatter-gather list from a socket buffer ++ * @skb: Socket buffer containing the buffers to be mapped ++ * @sg: The scatter-gather list to map into ++ * @offset: The offset into the buffer's contents to start mapping ++ * @len: Length of buffer space to be mapped ++ * ++ * Fill the specified scatter-gather list with mappings/pointers into a ++ * region of the buffer space attached to a socket buffer. Returns either ++ * the number of scatterlist items used, or -EMSGSIZE if the contents ++ * could not fit. ++ */ ++int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) ++{ ++ int nsg = __skb_to_sgvec(skb, sg, offset, len, 0); ++ ++ if (nsg <= 0) ++ return nsg; ++ ++ sg_mark_end(&sg[nsg - 1]); ++ ++ return nsg; ++} ++EXPORT_SYMBOL_GPL(skb_to_sgvec); ++ + /* As compared with skb_to_sgvec, skb_to_sgvec_nomark only map skb to given + * sglist without mark the sg which contain last skb data as the end. + * So the caller can mannipulate sg list as will when padding new data after +@@ -3421,19 +3448,11 @@ __skb_to_sgvec(struct sk_buff *skb, stru + int skb_to_sgvec_nomark(struct sk_buff *skb, struct scatterlist *sg, + int offset, int len) + { +- return __skb_to_sgvec(skb, sg, offset, len); ++ return __skb_to_sgvec(skb, sg, offset, len, 0); + } + EXPORT_SYMBOL_GPL(skb_to_sgvec_nomark); + +-int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, int len) +-{ +- int nsg = __skb_to_sgvec(skb, sg, offset, len); + +- sg_mark_end(&sg[nsg - 1]); +- +- return nsg; +-} +-EXPORT_SYMBOL_GPL(skb_to_sgvec); + + /** + * skb_cow_data - Check that a socket buffer's data buffers are writable diff --git a/queue-4.4/smb2-fix-share-type-handling.patch b/queue-4.4/smb2-fix-share-type-handling.patch new file mode 100644 index 00000000000..18376d7fef2 --- /dev/null +++ b/queue-4.4/smb2-fix-share-type-handling.patch @@ -0,0 +1,57 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Christophe JAILLET +Date: Fri, 12 May 2017 17:59:32 +0200 +Subject: SMB2: Fix share type handling + +From: Christophe JAILLET + + +[ Upstream commit cd1230070ae1c12fd34cf6a557bfa81bf9311009 ] + +In fs/cifs/smb2pdu.h, we have: +#define SMB2_SHARE_TYPE_DISK 0x01 +#define SMB2_SHARE_TYPE_PIPE 0x02 +#define SMB2_SHARE_TYPE_PRINT 0x03 + +Knowing that, with the current code, the SMB2_SHARE_TYPE_PRINT case can +never trigger and printer share would be interpreted as disk share. + +So, test the ShareType value for equality instead. + +Fixes: faaf946a7d5b ("CIFS: Add tree connect/disconnect capability for SMB2") +Signed-off-by: Christophe JAILLET +Acked-by: Aurelien Aptel +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2pdu.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -999,15 +999,19 @@ SMB2_tcon(const unsigned int xid, struct + goto tcon_exit; + } + +- if (rsp->ShareType & SMB2_SHARE_TYPE_DISK) ++ switch (rsp->ShareType) { ++ case SMB2_SHARE_TYPE_DISK: + cifs_dbg(FYI, "connection to disk share\n"); +- else if (rsp->ShareType & SMB2_SHARE_TYPE_PIPE) { ++ break; ++ case SMB2_SHARE_TYPE_PIPE: + tcon->ipc = true; + cifs_dbg(FYI, "connection to pipe share\n"); +- } else if (rsp->ShareType & SMB2_SHARE_TYPE_PRINT) { +- tcon->print = true; ++ break; ++ case SMB2_SHARE_TYPE_PRINT: ++ tcon->ipc = true; + cifs_dbg(FYI, "connection to printer\n"); +- } else { ++ break; ++ default: + cifs_dbg(VFS, "unknown share type %d\n", rsp->ShareType); + rc = -EOPNOTSUPP; + goto tcon_error_exit; diff --git a/queue-4.4/sparc64-ldc-abort-during-vds-iso-boot.patch b/queue-4.4/sparc64-ldc-abort-during-vds-iso-boot.patch new file mode 100644 index 00000000000..84446e92175 --- /dev/null +++ b/queue-4.4/sparc64-ldc-abort-during-vds-iso-boot.patch @@ -0,0 +1,58 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jag Raman +Date: Fri, 9 Jun 2017 12:29:31 -0400 +Subject: sparc64: ldc abort during vds iso boot + +From: Jag Raman + + +[ Upstream commit 6c95483b768c62f8ee933ae08a1bdbcb78b5410f ] + +Orabug: 20902628 + +When an ldc control-only packet is received during data exchange in +read_nonraw(), a new rx head is calculated but the rx queue head is not +actually advanced (rx_set_head() is not called) and a branch is taken to +'no_data' at which point two things can happen depending on the value +of the newly calculated rx head and the current rx tail: + +- If the rx queue is determined to be not empty, then the wrong packet + is picked up. + +- If the rx queue is determined to be empty, then a read error (EAGAIN) + is eventually returned since it is falsely assumed that more data was + expected. + +The fix is to update the rx head and return in case of a control only +packet during data exchange. + +Signed-off-by: Jagannathan Raman +Reviewed-by: Aaron Young +Reviewed-by: Alexandre Chartre +Reviewed-by: Bijan Mottahedeh +Reviewed-by: Liam Merwick +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/kernel/ldc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1733,9 +1733,14 @@ static int read_nonraw(struct ldc_channe + + lp->rcv_nxt = p->seqid; + ++ /* ++ * If this is a control-only packet, there is nothing ++ * else to do but advance the rx queue since the packet ++ * was already processed above. ++ */ + if (!(p->type & LDC_DATA)) { + new = rx_advance(lp, new); +- goto no_data; ++ break; + } + if (p->stype & (LDC_ACK | LDC_NACK)) { + err = data_ack_nack(lp, p); diff --git a/queue-4.4/staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch b/queue-4.4/staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch new file mode 100644 index 00000000000..ab8e738bc58 --- /dev/null +++ b/queue-4.4/staging-wlan-ng-prism2mgmt.c-fixed-a-double-endian-conversion-before-calling-hfa384x_drvr_setconfig16-also-fixes-relative-sparse-warning.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Andrea della Porta +Date: Sat, 29 Apr 2017 07:30:23 +0100 +Subject: staging: wlan-ng: prism2mgmt.c: fixed a double endian conversion before calling hfa384x_drvr_setconfig16, also fixes relative sparse warning + +From: Andrea della Porta + + +[ Upstream commit dea20579a69ab68cdca6adf79bb7c0c162eb9b72 ] + +staging: wlan-ng: prism2mgmt.c: This patches fixes a double endian conversion. +cpu_to_le16() was called twice first in prism2mgmt_scan and again inside +hfa384x_drvr_setconfig16() for the same variable, hence it was swapped +twice. Incidentally, it also fixed the following sparse warning: + +drivers/staging/wlan-ng/prism2mgmt.c:173:30: warning: incorrect type in assignment (different base types) +drivers/staging/wlan-ng/prism2mgmt.c:173:30: expected unsigned short [unsigned] [usertype] word +drivers/staging/wlan-ng/prism2mgmt.c:173:30: got restricted __le16 [usertype] + +Unfortunately, only compile tested. + +Signed-off-by: Andrea della Porta +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/wlan-ng/prism2mgmt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/wlan-ng/prism2mgmt.c ++++ b/drivers/staging/wlan-ng/prism2mgmt.c +@@ -169,7 +169,7 @@ int prism2mgmt_scan(wlandevice_t *wlande + hw->ident_sta_fw.variant) > + HFA384x_FIRMWARE_VERSION(1, 5, 0)) { + if (msg->scantype.data != P80211ENUM_scantype_active) +- word = cpu_to_le16(msg->maxchanneltime.data); ++ word = msg->maxchanneltime.data; + else + word = 0; + diff --git a/queue-4.4/sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch b/queue-4.4/sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch new file mode 100644 index 00000000000..894ebeca764 --- /dev/null +++ b/queue-4.4/sunrpc-ensure-correct-error-is-reported-by-xs_tcp_setup_socket.patch @@ -0,0 +1,55 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: NeilBrown +Date: Thu, 25 May 2017 17:00:32 +1000 +Subject: SUNRPC: ensure correct error is reported by xs_tcp_setup_socket() + +From: NeilBrown + + +[ Upstream commit 6ea44adce91526700535b3150f77f8639ae8c82d ] + +If you attempt a TCP mount from an host that is unreachable in a way +that triggers an immediate error from kernel_connect(), that error +does not propagate up, instead EAGAIN is reported. + +This results in call_connect_status receiving the wrong error. + +A case that it easy to demonstrate is to attempt to mount from an +address that results in ENETUNREACH, but first deleting any default +route. +Without this patch, the mount.nfs process is persistently runnable +and is hard to kill. With this patch it exits as it should. + +The problem is caused by the fact that xs_tcp_force_close() eventually +calls + xprt_wake_pending_tasks(xprt, -EAGAIN); +which causes an error return of -EAGAIN. so when xs_tcp_setup_sock() +calls + xprt_wake_pending_tasks(xprt, status); +the status is ignored. + +Fixes: 4efdd92c9211 ("SUNRPC: Remove TCP client connection reset hack") +Signed-off-by: NeilBrown +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/xprtsock.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -2363,7 +2363,12 @@ static void xs_tcp_setup_socket(struct w + case -EHOSTUNREACH: + case -EADDRINUSE: + case -ENOBUFS: +- /* retry with existing socket, after a delay */ ++ /* ++ * xs_tcp_force_close() wakes tasks with -EIO. ++ * We need to wake them first to ensure the ++ * correct error code. ++ */ ++ xprt_wake_pending_tasks(xprt, status); + xs_tcp_force_close(xprt); + goto out; + } diff --git a/queue-4.4/tags-honor-compiled_source-with-apart-output-directory.patch b/queue-4.4/tags-honor-compiled_source-with-apart-output-directory.patch new file mode 100644 index 00000000000..145d0b1d5f7 --- /dev/null +++ b/queue-4.4/tags-honor-compiled_source-with-apart-output-directory.patch @@ -0,0 +1,34 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Robert Jarzmik +Date: Mon, 5 Jun 2017 13:59:15 +0200 +Subject: tags: honor COMPILED_SOURCE with apart output directory + +From: Robert Jarzmik + + +[ Upstream commit cbf52a3e6a8a92beec6e0c70abf4111cd8f8faf7 ] + +When the kernel is compiled with an "O=" argument, the object files are +not in the source tree, but in the build tree. + +This patch fixes O= build by looking for object files in the build tree. + +Fixes: 923e02ecf3f8 ("scripts/tags.sh: Support compiled source") +Signed-off-by: Robert Jarzmik +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + scripts/tags.sh | 1 + + 1 file changed, 1 insertion(+) + +--- a/scripts/tags.sh ++++ b/scripts/tags.sh +@@ -106,6 +106,7 @@ all_compiled_sources() + case "$i" in + *.[cS]) + j=${i/\.[cS]/\.o} ++ j="${j#$tree}" + if [ -e $j ]; then + echo $i + fi diff --git a/queue-4.4/tcp-better-validation-of-received-ack-sequences.patch b/queue-4.4/tcp-better-validation-of-received-ack-sequences.patch new file mode 100644 index 00000000000..25d8bad794a --- /dev/null +++ b/queue-4.4/tcp-better-validation-of-received-ack-sequences.patch @@ -0,0 +1,140 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Eric Dumazet +Date: Tue, 23 May 2017 15:24:46 -0700 +Subject: tcp: better validation of received ack sequences + +From: Eric Dumazet + + +[ Upstream commit d0e1a1b5a833b625c93d3d49847609350ebd79db ] + +Paul Fiterau Brostean reported : + + +Linux TCP stack we analyze exhibits behavior that seems odd to me. +The scenario is as follows (all packets have empty payloads, no window +scaling, rcv/snd window size should not be a factor): + + TEST HARNESS (CLIENT) LINUX SERVER + + 1. - LISTEN (server listen, +then accepts) + + 2. - --> --> SYN-RECEIVED + + 3. - <-- <-- SYN-RECEIVED + + 4. - --> --> ESTABLISHED + + 5. - <-- <-- FIN WAIT-1 (server +opts to close the data connection calling "close" on the connection +socket) + + 6. - --> --> CLOSING (client sends +FIN,ACK with not yet sent acknowledgement number) + + 7. - <-- <-- CLOSING (ACK is 102 +instead of 101, why?) + +... (silence from CLIENT) + + 8. - <-- <-- CLOSING +(retransmission, again ACK is 102) + +Now, note that packet 6 while having the expected sequence number, +acknowledges something that wasn't sent by the server. So I would +expect +the packet to maybe prompt an ACK response from the server, and then be +ignored. Yet it is not ignored and actually leads to an increase of the +acknowledgement number in the server's retransmission of the FIN,ACK +packet. The explanation I found is that the FIN in packet 6 was +processed, despite the acknowledgement number being unacceptable. +Further experiments indeed show that the server processes this FIN, +transitioning to CLOSING, then on receiving an ACK for the FIN it had +send in packet 5, the server (or better said connection) transitions +from CLOSING to TIME_WAIT (as signaled by netstat). + + + +Indeed, tcp_rcv_state_process() calls tcp_ack() but +does not exploit the @acceptable status but for TCP_SYN_RECV +state. + +What we want here is to send a challenge ACK, if not in TCP_SYN_RECV +state. TCP_FIN_WAIT1 state is not the only state we should fix. + +Add a FLAG_NO_CHALLENGE_ACK so that tcp_rcv_state_process() +can choose to send a challenge ACK and discard the packet instead +of wrongly change socket state. + +With help from Neal Cardwell. + +Signed-off-by: Eric Dumazet +Reported-by: Paul Fiterau Brostean +Cc: Neal Cardwell +Cc: Yuchung Cheng +Cc: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/tcp_input.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -117,6 +117,7 @@ int sysctl_tcp_invalid_ratelimit __read_ + #define FLAG_DSACKING_ACK 0x800 /* SACK blocks contained D-SACK info */ + #define FLAG_SACK_RENEGING 0x2000 /* snd_una advanced to a sacked seq */ + #define FLAG_UPDATE_TS_RECENT 0x4000 /* tcp_replace_ts_recent() */ ++#define FLAG_NO_CHALLENGE_ACK 0x8000 /* do not call tcp_send_challenge_ack() */ + + #define FLAG_ACKED (FLAG_DATA_ACKED|FLAG_SYN_ACKED) + #define FLAG_NOT_DUP (FLAG_DATA|FLAG_WIN_UPDATE|FLAG_ACKED) +@@ -3543,7 +3544,8 @@ static int tcp_ack(struct sock *sk, cons + if (before(ack, prior_snd_una)) { + /* RFC 5961 5.2 [Blind Data Injection Attack].[Mitigation] */ + if (before(ack, prior_snd_una - tp->max_window)) { +- tcp_send_challenge_ack(sk, skb); ++ if (!(flag & FLAG_NO_CHALLENGE_ACK)) ++ tcp_send_challenge_ack(sk, skb); + return -1; + } + goto old_ack; +@@ -5832,13 +5834,17 @@ int tcp_rcv_state_process(struct sock *s + + /* step 5: check the ACK field */ + acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH | +- FLAG_UPDATE_TS_RECENT) > 0; ++ FLAG_UPDATE_TS_RECENT | ++ FLAG_NO_CHALLENGE_ACK) > 0; + ++ if (!acceptable) { ++ if (sk->sk_state == TCP_SYN_RECV) ++ return 1; /* send one RST */ ++ tcp_send_challenge_ack(sk, skb); ++ goto discard; ++ } + switch (sk->sk_state) { + case TCP_SYN_RECV: +- if (!acceptable) +- return 1; +- + if (!tp->srtt_us) + tcp_synack_rtt_meas(sk, req); + +@@ -5907,14 +5913,6 @@ int tcp_rcv_state_process(struct sock *s + * our SYNACK so stop the SYNACK timer. + */ + if (req) { +- /* Return RST if ack_seq is invalid. +- * Note that RFC793 only says to generate a +- * DUPACK for it but for TCP Fast Open it seems +- * better to treat this case like TCP_SYN_RECV +- * above. +- */ +- if (!acceptable) +- return 1; + /* We no longer need the request sock. */ + reqsk_fastopen_remove(sk, req, false); + tcp_rearm_rto(sk); diff --git a/queue-4.4/thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch b/queue-4.4/thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch new file mode 100644 index 00000000000..4f725742a66 --- /dev/null +++ b/queue-4.4/thermal-power_allocator-fix-one-race-condition-issue-for-thermal_instances-list.patch @@ -0,0 +1,69 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Yi Zeng +Date: Tue, 26 Dec 2017 19:22:26 +0800 +Subject: thermal: power_allocator: fix one race condition issue for thermal_instances list + +From: Yi Zeng + + +[ Upstream commit a5de11d67dcd268b8d0beb73dc374de5e97f0caf ] + +When invoking allow_maximum_power and traverse tz->thermal_instances, +we should grab thermal_zone_device->lock to avoid race condition. For +example, during the system reboot, if the mali GPU device implements +device shutdown callback and unregister GPU devfreq cooling device, +the deleted list head may be accessed to cause panic, as the following +log shows: + +[ 33.551070] c3 25 (kworker/3:0) Unable to handle kernel paging request at virtual address dead000000000070 +[ 33.566708] c3 25 (kworker/3:0) pgd = ffffffc0ed290000 +[ 33.572071] c3 25 (kworker/3:0) [dead000000000070] *pgd=00000001ed292003, *pud=00000001ed292003, *pmd=0000000000000000 +[ 33.581515] c3 25 (kworker/3:0) Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 33.599761] c3 25 (kworker/3:0) CPU: 3 PID: 25 Comm: kworker/3:0 Not tainted 4.4.35+ #912 +[ 33.614137] c3 25 (kworker/3:0) Workqueue: events_freezable thermal_zone_device_check +[ 33.620245] c3 25 (kworker/3:0) task: ffffffc0f32e4200 ti: ffffffc0f32f0000 task.ti: ffffffc0f32f0000 +[ 33.629466] c3 25 (kworker/3:0) PC is at power_allocator_throttle+0x7c8/0x8a4 +[ 33.636609] c3 25 (kworker/3:0) LR is at power_allocator_throttle+0x808/0x8a4 +[ 33.643742] c3 25 (kworker/3:0) pc : [] lr : [] pstate: 20000145 +[ 33.652874] c3 25 (kworker/3:0) sp : ffffffc0f32f3bb0 +[ 34.468519] c3 25 (kworker/3:0) Process kworker/3:0 (pid: 25, stack limit = 0xffffffc0f32f0020) +[ 34.477220] c3 25 (kworker/3:0) Stack: (0xffffffc0f32f3bb0 to 0xffffffc0f32f4000) +[ 34.819822] c3 25 (kworker/3:0) Call trace: +[ 34.824021] c3 25 (kworker/3:0) Exception stack(0xffffffc0f32f39c0 to 0xffffffc0f32f3af0) +[ 34.924993] c3 25 (kworker/3:0) [] power_allocator_throttle+0x7c8/0x8a4 +[ 34.933184] c3 25 (kworker/3:0) [] handle_thermal_trip.part.25+0x70/0x224 +[ 34.941545] c3 25 (kworker/3:0) [] thermal_zone_device_update+0xc0/0x20c +[ 34.949818] c3 25 (kworker/3:0) [] thermal_zone_device_check+0x20/0x2c +[ 34.957924] c3 25 (kworker/3:0) [] process_one_work+0x168/0x458 +[ 34.965414] c3 25 (kworker/3:0) [] worker_thread+0x13c/0x4b4 +[ 34.972650] c3 25 (kworker/3:0) [] kthread+0xe8/0xfc +[ 34.979187] c3 25 (kworker/3:0) [] ret_from_fork+0x10/0x40 +[ 34.986244] c3 25 (kworker/3:0) Code: f9405e73 eb1302bf d102e273 54ffc460 (b9402a61) +[ 34.994339] c3 25 (kworker/3:0) ---[ end trace 32057901e3b7e1db ]--- + +Signed-off-by: Yi Zeng +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/power_allocator.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/thermal/power_allocator.c ++++ b/drivers/thermal/power_allocator.c +@@ -523,6 +523,7 @@ static void allow_maximum_power(struct t + struct thermal_instance *instance; + struct power_allocator_params *params = tz->governor_data; + ++ mutex_lock(&tz->lock); + list_for_each_entry(instance, &tz->thermal_instances, tz_node) { + if ((instance->trip != params->trip_max_desired_temperature) || + (!cdev_is_power_actor(instance->cdev))) +@@ -532,6 +533,7 @@ static void allow_maximum_power(struct t + instance->cdev->updated = false; + thermal_cdev_update(instance->cdev); + } ++ mutex_unlock(&tz->lock); + } + + /** diff --git a/queue-4.4/tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch b/queue-4.4/tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch new file mode 100644 index 00000000000..45d8488921d --- /dev/null +++ b/queue-4.4/tty-n_gsm-allow-adm-response-in-addition-to-ua-for-control-dlci.patch @@ -0,0 +1,119 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Tony Lindgren +Date: Wed, 3 Jan 2018 10:18:03 -0800 +Subject: tty: n_gsm: Allow ADM response in addition to UA for control dlci + +From: Tony Lindgren + + +[ Upstream commit ea3d8465ab9b3e01be329ac5195970a84bef76c5 ] + +Some devices have the control dlci stay in ADM mode instead of the UA +mode. This can seen at least on droid 4 when trying to open the ts +27.010 mux port. Enabling n_gsm debug mode shows the control dlci +always respond with DM to SABM instead of UA: + +# modprobe n_gsm debug=0xff +# ldattach -d GSM0710 /dev/ttyS0 & +gsmld_output: 00000000: f9 03 3f 01 1c f9 +--> 0) C: SABM(P) +gsmld_receive: 00000000: f9 03 1f 01 36 f9 +<-- 0) C: DM(P) +... +$ minicom -D /dev/gsmtty1 +minicom: cannot open /dev/gsmtty1: No error information +$ strace minicom -D /dev/gsmtty1 +... +open("/dev/gsmtty1", O_RDWR|O_NOCTTY|O_NONBLOCK|O_LARGEFILE) = -1 EL2HLT + +Note that this is different issue from other n_gsm -EL2HLT issues such +as timeouts when the control dlci does not respond at all. + +The ADM mode seems to be a quite common according to "RF Wireless World" +article "GSM Issue-UE sends SABM and gets a DM response instead of +UA response": + + This issue is most commonly observed in GSM networks where in UE sends + SABM and expects network to send UA response but it ends up receiving + DM response from the network. SABM stands for Set asynchronous balanced + mode, UA stands for Unnumbered Acknowledge and DA stands for + Disconnected Mode. + + An RLP entity can be in one of two modes: + - Asynchronous Balanced Mode (ABM) + - Asynchronous Disconnected Mode (ADM) + +Currently Linux kernel closes the control dlci after several retries +in gsm_dlci_t1() on DM. This causes n_gsm /dev/gsmtty ports to produce +error code -EL2HLT when trying to open them as the closing of control +dlci has already set gsm->dead. + +Let's fix the issue by allowing control dlci stay in ADM mode after the +retries so the /dev/gsmtty ports can be opened and used. It seems that +it might take several attempts to get any response from the control +dlci, so it's best to allow ADM mode only after the SABM retries are +done. + +Note that for droid 4 additional patches are needed to mux the ttyS0 +pins and to toggle RTS gpio_149 to wake up the mdm6600 modem are also +needed to use n_gsm. And the mdm6600 modem needs to be powered on. + +Cc: linux-serial@vger.kernel.org +Cc: Alan Cox +Cc: Jiri Prchal +Cc: Jiri Slaby +Cc: Marcel Partap +Cc: Michael Scott +Cc: Peter Hurley +Cc: Russ Gorby +Cc: Sascha Hauer +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/n_gsm.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1467,6 +1467,10 @@ static void gsm_dlci_open(struct gsm_dlc + * in which case an opening port goes back to closed and a closing port + * is simply put into closed state (any further frames from the other + * end will get a DM response) ++ * ++ * Some control dlci can stay in ADM mode with other dlci working just ++ * fine. In that case we can just keep the control dlci open after the ++ * DLCI_OPENING retries time out. + */ + + static void gsm_dlci_t1(unsigned long data) +@@ -1480,8 +1484,15 @@ static void gsm_dlci_t1(unsigned long da + if (dlci->retries) { + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); +- } else ++ } else if (!dlci->addr && gsm->control == (DM | PF)) { ++ if (debug & 8) ++ pr_info("DLCI %d opening in ADM mode.\n", ++ dlci->addr); ++ gsm_dlci_open(dlci); ++ } else { + gsm_dlci_close(dlci); ++ } ++ + break; + case DLCI_CLOSING: + dlci->retries--; +@@ -1499,8 +1510,8 @@ static void gsm_dlci_t1(unsigned long da + * @dlci: DLCI to open + * + * Commence opening a DLCI from the Linux side. We issue SABM messages +- * to the modem which should then reply with a UA, at which point we +- * will move into open state. Opening is done asynchronously with retry ++ * to the modem which should then reply with a UA or ADM, at which point ++ * we will move into open state. Opening is done asynchronously with retry + * running off timers and the responses. + */ + diff --git a/queue-4.4/usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch b/queue-4.4/usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch new file mode 100644 index 00000000000..3ef0ca669f2 --- /dev/null +++ b/queue-4.4/usb-chipidea-properly-handle-host-or-gadget-initialization-failure.patch @@ -0,0 +1,93 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Jisheng Zhang +Date: Wed, 26 Apr 2017 16:59:34 +0800 +Subject: usb: chipidea: properly handle host or gadget initialization failure + +From: Jisheng Zhang + + +[ Upstream commit c4a0bbbdb7f6e3c37fa6deb3ef28c5ed99da6175 ] + +If ci_hdrc_host_init() or ci_hdrc_gadget_init() returns error and the +error != -ENXIO, as Peter pointed out, "it stands for initialization +for host or gadget has failed", so we'd better return failure rather +continue. + +And before destroying the otg, i.e ci_hdrc_otg_destroy(ci), we should +also check ci->roles[CI_ROLE_GADGET]. + +Signed-off-by: Jisheng Zhang +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/core.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +--- a/drivers/usb/chipidea/core.c ++++ b/drivers/usb/chipidea/core.c +@@ -851,7 +851,7 @@ static inline void ci_role_destroy(struc + { + ci_hdrc_gadget_destroy(ci); + ci_hdrc_host_destroy(ci); +- if (ci->is_otg) ++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) + ci_hdrc_otg_destroy(ci); + } + +@@ -951,27 +951,35 @@ static int ci_hdrc_probe(struct platform + /* initialize role(s) before the interrupt is requested */ + if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_HOST) { + ret = ci_hdrc_host_init(ci); +- if (ret) +- dev_info(dev, "doesn't support host\n"); ++ if (ret) { ++ if (ret == -ENXIO) ++ dev_info(dev, "doesn't support host\n"); ++ else ++ goto deinit_phy; ++ } + } + + if (dr_mode == USB_DR_MODE_OTG || dr_mode == USB_DR_MODE_PERIPHERAL) { + ret = ci_hdrc_gadget_init(ci); +- if (ret) +- dev_info(dev, "doesn't support gadget\n"); ++ if (ret) { ++ if (ret == -ENXIO) ++ dev_info(dev, "doesn't support gadget\n"); ++ else ++ goto deinit_host; ++ } + } + + if (!ci->roles[CI_ROLE_HOST] && !ci->roles[CI_ROLE_GADGET]) { + dev_err(dev, "no supported roles\n"); + ret = -ENODEV; +- goto deinit_phy; ++ goto deinit_gadget; + } + + if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) { + ret = ci_hdrc_otg_init(ci); + if (ret) { + dev_err(dev, "init otg fails, ret = %d\n", ret); +- goto stop; ++ goto deinit_gadget; + } + } + +@@ -1036,7 +1044,12 @@ static int ci_hdrc_probe(struct platform + + ci_extcon_unregister(ci); + stop: +- ci_role_destroy(ci); ++ if (ci->is_otg && ci->roles[CI_ROLE_GADGET]) ++ ci_hdrc_otg_destroy(ci); ++deinit_gadget: ++ ci_hdrc_gadget_destroy(ci); ++deinit_host: ++ ci_hdrc_host_destroy(ci); + deinit_phy: + ci_usb_phy_exit(ci); + diff --git a/queue-4.4/usb-dwc3-keystone-check-return-value.patch b/queue-4.4/usb-dwc3-keystone-check-return-value.patch new file mode 100644 index 00000000000..7c5bb9043e4 --- /dev/null +++ b/queue-4.4/usb-dwc3-keystone-check-return-value.patch @@ -0,0 +1,35 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Pan Bian +Date: Sun, 23 Apr 2017 13:55:13 +0800 +Subject: usb: dwc3: keystone: check return value + +From: Pan Bian + + +[ Upstream commit 018047a1dba7636e1f7fdae2cc290a528991d648 ] + +Function devm_clk_get() returns an ERR_PTR when it fails. However, in +function kdwc3_probe(), its return value is not checked, which may +result in a bad memory access bug. This patch fixes the bug. + +Signed-off-by: Pan Bian +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/dwc3-keystone.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/dwc3/dwc3-keystone.c ++++ b/drivers/usb/dwc3/dwc3-keystone.c +@@ -112,6 +112,10 @@ static int kdwc3_probe(struct platform_d + dev->dma_mask = &kdwc3_dma_mask; + + kdwc->clk = devm_clk_get(kdwc->dev, "usb"); ++ if (IS_ERR(kdwc->clk)) { ++ dev_err(kdwc->dev, "unable to get usb clock\n"); ++ return PTR_ERR(kdwc->clk); ++ } + + error = clk_prepare_enable(kdwc->clk); + if (error < 0) { diff --git a/queue-4.4/usb-ene_usb6250-fix-first-command-execution.patch b/queue-4.4/usb-ene_usb6250-fix-first-command-execution.patch new file mode 100644 index 00000000000..4b1ae0a5a67 --- /dev/null +++ b/queue-4.4/usb-ene_usb6250-fix-first-command-execution.patch @@ -0,0 +1,65 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Alan Stern +Date: Tue, 16 May 2017 11:47:42 -0400 +Subject: USB: ene_usb6250: fix first command execution + +From: Alan Stern + + +[ Upstream commit 4b309f1c4972c8f09e03ac64fc63510dbf5591a4 ] + +In the ene_usb6250 sub-driver for usb-storage, the ene_transport() +routine is supposed to initialize the driver before executing the +current command, if the initialization has not already been performed. +However, a bug in the routine causes it to skip the command after +doing the initialization. Also, the routine does not return an +appropriate error code if either the initialization or the command +fails. + +As a result of the first bug, the first command (a SCSI INQUIRY) is +not carried out. The results can be seen in the system log, in the +form of a warning message and empty or garbage INQUIRY data: + +Apr 18 22:40:08 notebook2 kernel: scsi host6: scsi scan: INQUIRY result too short (5), using 36 +Apr 18 22:40:08 notebook2 kernel: scsi 6:0:0:0: Direct-Access PQ: 0 ANSI: 0 + +This patch fixes both errors. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Andreas Hartmann +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/ene_ub6250.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -2306,21 +2306,22 @@ static int ms_scsi_irp(struct us_data *u + + static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) + { +- int result = 0; ++ int result = USB_STOR_XFER_GOOD; + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) { ++ if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) + result = ene_init(us); +- } else { ++ if (result == USB_STOR_XFER_GOOD) { ++ result = USB_STOR_TRANSPORT_ERROR; + if (info->SD_Status.Ready) + result = sd_scsi_irp(us, srb); + + if (info->MS_Status.Ready) + result = ms_scsi_irp(us, srb); + } +- return 0; ++ return result; + } + + static struct scsi_host_template ene_ub6250_host_template; diff --git a/queue-4.4/usb-ene_usb6250-fix-scsi-residue-overwriting.patch b/queue-4.4/usb-ene_usb6250-fix-scsi-residue-overwriting.patch new file mode 100644 index 00000000000..a784fd83e0e --- /dev/null +++ b/queue-4.4/usb-ene_usb6250-fix-scsi-residue-overwriting.patch @@ -0,0 +1,40 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Alan Stern +Date: Tue, 16 May 2017 11:47:52 -0400 +Subject: USB: ene_usb6250: fix SCSI residue overwriting + +From: Alan Stern + + +[ Upstream commit aa18c4b6e0e39bfb00af48734ec24bc189ac9909 ] + +In the ene_usb6250 sub-driver for usb-storage, the SCSI residue is not +reported correctly. The residue is initialized to 0, but this value +is overwritten whenever the driver sends firmware to the card reader +before performing the current command. As a result, a valid READ or +WRITE operation appears to have failed, causing the SCSI core to retry +the command multiple times and eventually fail. + +This patch fixes the problem by resetting the SCSI residue to 0 after +sending firmware to the device. + +Signed-off-by: Alan Stern +Reported-and-tested-by: Andreas Hartmann +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/storage/ene_ub6250.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -1953,6 +1953,8 @@ static int ene_load_bincode(struct us_da + bcb->CDB[0] = 0xEF; + + result = ene_send_scsi_cmd(us, FDIR_WRITE, buf, 0); ++ if (us->srb != NULL) ++ scsi_set_resid(us->srb, 0); + info->BIN_FLAG = flag; + kfree(buf); + diff --git a/queue-4.4/vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch b/queue-4.4/vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch new file mode 100644 index 00000000000..b1158165d38 --- /dev/null +++ b/queue-4.4/vfb-fix-video-mode-and-line_length-being-set-when-loaded.patch @@ -0,0 +1,105 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: "Pieter \\\"PoroCYon\\\" Sluys" +Date: Thu, 4 Jan 2018 16:53:50 +0100 +Subject: vfb: fix video mode and line_length being set when loaded + +From: "Pieter \\\"PoroCYon\\\" Sluys" + + +[ Upstream commit 7b9faf5df0ac495a1a3d7cdb64921c179f9008ac ] + +Currently, when loading the vfb module, the newly created fbdev +has a line_length of 0, and its video mode would be PSEUDOCOLOR +regardless of color depth. (The former could be worked around by +calling the FBIOPUT_VSCREENINFO ioctl with having the FBACTIVIATE_FORCE +flag set.) This patch automatically sets the line_length correctly, +and the video mode is derived from the bit depth now as well. + +Thanks to Geert Uytterhoeven for confirming the bug and helping me with +the patch. + +Output of `fbset -i' before the patch: +mode "1366x768-60" + # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz + geometry 1366 768 1366 768 32 + timings 13806 120 10 14 3 32 5 + rgba 8/0,8/8,8/16,8/24 +endmode + +Frame buffer device information: + Name : Virtual FB + Address : 0xffffaa1405d85000 + Size : 4196352 + Type : PACKED PIXELS + Visual : PSEUDOCOLOR + XPanStep : 1 + YPanStep : 1 + YWrapStep : 1 + LineLength : 0 <-- note this + Accelerator : No + +After: +mode "1366x768-60" + # D: 72.432 MHz, H: 47.403 kHz, V: 60.004 Hz + geometry 1366 768 1366 768 32 + timings 13806 120 10 14 3 32 5 + rgba 8/0,8/8,8/16,8/24 +endmode + +Frame buffer device information: + Name : Virtual FB + Address : 0xffffaa1405d85000 + Size : 4196352 + Type : PACKED PIXELS + Visual : TRUECOLOR + XPanStep : 1 + YPanStep : 1 + YWrapStep : 1 + LineLength : 5464 + Accelerator : No + +Signed-off-by: "Pieter \"PoroCYon\" Sluys" +Reviewed-by: Geert Uytterhoeven +[b.zolnierkie: minor fixups] +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/vfb.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/video/fbdev/vfb.c ++++ b/drivers/video/fbdev/vfb.c +@@ -291,8 +291,23 @@ static int vfb_check_var(struct fb_var_s + */ + static int vfb_set_par(struct fb_info *info) + { ++ switch (info->var.bits_per_pixel) { ++ case 1: ++ info->fix.visual = FB_VISUAL_MONO01; ++ break; ++ case 8: ++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR; ++ break; ++ case 16: ++ case 24: ++ case 32: ++ info->fix.visual = FB_VISUAL_TRUECOLOR; ++ break; ++ } ++ + info->fix.line_length = get_line_length(info->var.xres_virtual, + info->var.bits_per_pixel); ++ + return 0; + } + +@@ -525,6 +540,8 @@ static int vfb_probe(struct platform_dev + goto err2; + platform_set_drvdata(dev, info); + ++ vfb_set_par(info); ++ + fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n", + videomemorysize >> 10); + return 0; diff --git a/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-always.patch b/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-always.patch new file mode 100644 index 00000000000..7c9bf9fc3b0 --- /dev/null +++ b/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-always.patch @@ -0,0 +1,50 @@ +From e2fcad58fd230f635a74e4e983c6f4ea893642d2 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Sun, 4 Jun 2017 04:16:26 +0200 +Subject: virtio_net: check return value of skb_to_sgvec always + +From: Jason A. Donenfeld + +commit e2fcad58fd230f635a74e4e983c6f4ea893642d2 upstream. + +Signed-off-by: Jason A. Donenfeld +Reviewed-by: Sergei Shtylyov +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Signed-off-by: David S. Miller +[natechancellor: backport to 4.4] +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/virtio_net.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -858,7 +858,7 @@ static int xmit_skb(struct send_queue *s + struct virtio_net_hdr_mrg_rxbuf *hdr; + const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest; + struct virtnet_info *vi = sq->vq->vdev->priv; +- unsigned num_sg; ++ int num_sg; + unsigned hdr_len = vi->hdr_len; + bool can_push; + +@@ -911,11 +911,16 @@ static int xmit_skb(struct send_queue *s + if (can_push) { + __skb_push(skb, hdr_len); + num_sg = skb_to_sgvec(skb, sq->sg, 0, skb->len); ++ if (unlikely(num_sg < 0)) ++ return num_sg; + /* Pull header back to avoid skew in tx bytes calculations. */ + __skb_pull(skb, hdr_len); + } else { + sg_set_buf(sq->sg, hdr, hdr_len); +- num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len) + 1; ++ num_sg = skb_to_sgvec(skb, sq->sg + 1, 0, skb->len); ++ if (unlikely(num_sg < 0)) ++ return num_sg; ++ num_sg++; + } + return virtqueue_add_outbuf(sq->vq, sq->sg, num_sg, skb, GFP_ATOMIC); + } diff --git a/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch b/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch new file mode 100644 index 00000000000..7839d24689b --- /dev/null +++ b/queue-4.4/virtio_net-check-return-value-of-skb_to_sgvec-in-one-more-location.patch @@ -0,0 +1,44 @@ +From natechancellor@gmail.com Tue Apr 10 10:36:56 2018 +From: Nathan Chancellor +Date: Mon, 9 Apr 2018 18:21:47 -0700 +Subject: virtio_net: check return value of skb_to_sgvec in one more location +To: Greg Kroah-Hartman , stable@vger.kernel.org +Cc: Nathan Chancellor , "Jason A . Donenfeld" , Sergei Shtylyov , "Michael S. Tsirkin" , Jason Wang , "David S . Miller" +Message-ID: <20180410012150.6573-7-natechancellor@gmail.com> + +From: Nathan Chancellor + +Kernels that do not have f6b10209b90d ("virtio-net: switch to use +build_skb() for small buffer") will have an extra call to skb_to_sgvec +that is not handled by e2fcad58fd23 ("virtio_net: check return value of +skb_to_sgvec always"). Since the former does not appear to be stable +material, just fix the call up directly. + +Cc: Jason A. Donenfeld +Cc: Sergei Shtylyov +Cc: "Michael S. Tsirkin" +Cc: Jason Wang +Cc: David S. Miller +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/virtio_net.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -556,7 +556,12 @@ static int add_recvbuf_small(struct virt + hdr = skb_vnet_hdr(skb); + sg_init_table(rq->sg, 2); + sg_set_buf(rq->sg, hdr, vi->hdr_len); +- skb_to_sgvec(skb, rq->sg + 1, 0, skb->len); ++ ++ err = skb_to_sgvec(skb, rq->sg + 1, 0, skb->len); ++ if (unlikely(err < 0)) { ++ dev_kfree_skb(skb); ++ return err; ++ } + + err = virtqueue_add_inbuf(rq->vq, rq->sg, 2, skb, gfp); + if (err < 0) diff --git a/queue-4.4/vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch b/queue-4.4/vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch new file mode 100644 index 00000000000..4db1312c9dc --- /dev/null +++ b/queue-4.4/vmxnet3-ensure-that-adapter-is-in-proper-state-during-force_close.patch @@ -0,0 +1,50 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Neil Horman +Date: Fri, 12 May 2017 12:00:01 -0400 +Subject: vmxnet3: ensure that adapter is in proper state during force_close + +From: Neil Horman + + +[ Upstream commit 1c4d5f51a812a82de97beee24f48ed05c65ebda5 ] + +There are several paths in vmxnet3, where settings changes cause the +adapter to be brought down and back up (vmxnet3_set_ringparam among +them). Should part of the reset operation fail, these paths call +vmxnet3_force_close, which enables all napi instances prior to calling +dev_close (with the expectation that vmxnet3_close will then properly +disable them again). However, vmxnet3_force_close neglects to clear +VMXNET3_STATE_BIT_QUIESCED prior to calling dev_close. As a result +vmxnet3_quiesce_dev (called from vmxnet3_close), returns early, and +leaves all the napi instances in a enabled state while the device itself +is closed. If a device in this state is activated again, napi_enable +will be called on already enabled napi_instances, leading to a BUG halt. + +The fix is to simply enausre that the QUIESCED bit is cleared in +vmxnet3_force_close to allow quesence to be completed properly on close. + +Signed-off-by: Neil Horman +CC: Shrikrishna Khare +CC: "VMware, Inc." +CC: "David S. Miller" +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vmxnet3/vmxnet3_drv.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -2789,6 +2789,11 @@ vmxnet3_force_close(struct vmxnet3_adapt + /* we need to enable NAPI, otherwise dev_close will deadlock */ + for (i = 0; i < adapter->num_rx_queues; i++) + napi_enable(&adapter->rx_queue[i].napi); ++ /* ++ * Need to clear the quiesce bit to ensure that vmxnet3_close ++ * can quiesce the device properly ++ */ ++ clear_bit(VMXNET3_STATE_BIT_QUIESCED, &adapter->state); + dev_close(adapter->netdev); + } + diff --git a/queue-4.4/vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch b/queue-4.4/vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch new file mode 100644 index 00000000000..0d044dc4c69 --- /dev/null +++ b/queue-4.4/vxlan-dont-migrate-permanent-fdb-entries-during-learn.patch @@ -0,0 +1,34 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Roopa Prabhu +Date: Sun, 11 Jun 2017 16:32:50 -0700 +Subject: vxlan: dont migrate permanent fdb entries during learn + +From: Roopa Prabhu + + +[ Upstream commit e0090a9e979de5202c7d16c635dea2f005221073 ] + +This patch fixes vxlan_snoop to not move permanent fdb entries +on learn events. This is consistent with the bridge fdb +handling of permanent entries. + +Fixes: 26a41ae60438 ("vxlan: only migrate dynamic FDB entries") +Signed-off-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/vxlan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -962,7 +962,7 @@ static bool vxlan_snoop(struct net_devic + return false; + + /* Don't migrate static entries, drop packets */ +- if (f->state & NUD_NOARP) ++ if (f->state & (NUD_PERMANENT | NUD_NOARP)) + return true; + + if (net_ratelimit()) diff --git a/queue-4.4/wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch b/queue-4.4/wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch new file mode 100644 index 00000000000..736366225e1 --- /dev/null +++ b/queue-4.4/wl1251-check-return-from-call-to-wl1251_acx_arp_ip_filter.patch @@ -0,0 +1,38 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Colin Ian King +Date: Tue, 26 Dec 2017 17:33:18 +0000 +Subject: wl1251: check return from call to wl1251_acx_arp_ip_filter + +From: Colin Ian King + + +[ Upstream commit ac1181c60822292176ab96912208ec9f9819faf8 ] + +Currently the less than zero error check on ret is incorrect +as it is checking a far earlier ret assignment rather than the +return from the call to wl1251_acx_arp_ip_filter. Fix this by +adding in the missing assginment. + +Detected by CoverityScan, CID#1164835 ("Logically dead code") + +Fixes: 204cc5c44fb6 ("wl1251: implement hardware ARP filtering") +Signed-off-by: Colin Ian King +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ti/wl1251/main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/ti/wl1251/main.c ++++ b/drivers/net/wireless/ti/wl1251/main.c +@@ -1196,8 +1196,7 @@ static void wl1251_op_bss_info_changed(s + WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS); + + enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc; +- wl1251_acx_arp_ip_filter(wl, enable, addr); +- ++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr); + if (ret < 0) + goto out_sleep; + } diff --git a/queue-4.4/x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch b/queue-4.4/x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch new file mode 100644 index 00000000000..7e91823aff9 --- /dev/null +++ b/queue-4.4/x86-asm-don-t-use-rbp-as-a-temporary-register-in-csum_partial_copy_generic.patch @@ -0,0 +1,106 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Josh Poimboeuf +Date: Thu, 4 May 2017 09:51:40 -0500 +Subject: x86/asm: Don't use RBP as a temporary register in csum_partial_copy_generic() + +From: Josh Poimboeuf + + +[ Upstream commit 42fc6c6cb1662ba2fa727dd01c9473c63be4e3b6 ] + +Andrey Konovalov reported the following warning while fuzzing the kernel +with syzkaller: + + WARNING: kernel stack regs at ffff8800686869f8 in a.out:4933 has bad 'bp' value c3fc855a10167ec0 + +The unwinder dump revealed that RBP had a bad value when an interrupt +occurred in csum_partial_copy_generic(). + +That function saves RBP on the stack and then overwrites it, using it as +a scratch register. That's problematic because it breaks stack traces +if an interrupt occurs in the middle of the function. + +Replace the usage of RBP with another callee-saved register (R15) so +stack traces are no longer affected. + +Reported-by: Andrey Konovalov +Tested-by: Andrey Konovalov +Signed-off-by: Josh Poimboeuf +Cc: Cong Wang +Cc: David S . Miller +Cc: Dmitry Vyukov +Cc: Eric Dumazet +Cc: Kostya Serebryany +Cc: Linus Torvalds +Cc: Marcelo Ricardo Leitner +Cc: Neil Horman +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Vlad Yasevich +Cc: linux-sctp@vger.kernel.org +Cc: netdev +Cc: syzkaller +Link: http://lkml.kernel.org/r/4b03a961efda5ec9bfe46b7b9c9ad72d1efad343.1493909486.git.jpoimboe@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/lib/csum-copy_64.S | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/x86/lib/csum-copy_64.S ++++ b/arch/x86/lib/csum-copy_64.S +@@ -55,7 +55,7 @@ ENTRY(csum_partial_copy_generic) + movq %r12, 3*8(%rsp) + movq %r14, 4*8(%rsp) + movq %r13, 5*8(%rsp) +- movq %rbp, 6*8(%rsp) ++ movq %r15, 6*8(%rsp) + + movq %r8, (%rsp) + movq %r9, 1*8(%rsp) +@@ -74,7 +74,7 @@ ENTRY(csum_partial_copy_generic) + /* main loop. clear in 64 byte blocks */ + /* r9: zero, r8: temp2, rbx: temp1, rax: sum, rcx: saved length */ + /* r11: temp3, rdx: temp4, r12 loopcnt */ +- /* r10: temp5, rbp: temp6, r14 temp7, r13 temp8 */ ++ /* r10: temp5, r15: temp6, r14 temp7, r13 temp8 */ + .p2align 4 + .Lloop: + source +@@ -89,7 +89,7 @@ ENTRY(csum_partial_copy_generic) + source + movq 32(%rdi), %r10 + source +- movq 40(%rdi), %rbp ++ movq 40(%rdi), %r15 + source + movq 48(%rdi), %r14 + source +@@ -103,7 +103,7 @@ ENTRY(csum_partial_copy_generic) + adcq %r11, %rax + adcq %rdx, %rax + adcq %r10, %rax +- adcq %rbp, %rax ++ adcq %r15, %rax + adcq %r14, %rax + adcq %r13, %rax + +@@ -121,7 +121,7 @@ ENTRY(csum_partial_copy_generic) + dest + movq %r10, 32(%rsi) + dest +- movq %rbp, 40(%rsi) ++ movq %r15, 40(%rsi) + dest + movq %r14, 48(%rsi) + dest +@@ -203,7 +203,7 @@ ENTRY(csum_partial_copy_generic) + movq 3*8(%rsp), %r12 + movq 4*8(%rsp), %r14 + movq 5*8(%rsp), %r13 +- movq 6*8(%rsp), %rbp ++ movq 6*8(%rsp), %r15 + addq $7*8, %rsp + ret + diff --git a/queue-4.4/x86-tsc-provide-tsc-unstable-boot-parameter.patch b/queue-4.4/x86-tsc-provide-tsc-unstable-boot-parameter.patch new file mode 100644 index 00000000000..e70912066d4 --- /dev/null +++ b/queue-4.4/x86-tsc-provide-tsc-unstable-boot-parameter.patch @@ -0,0 +1,42 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Peter Zijlstra +Date: Thu, 13 Apr 2017 14:56:44 +0200 +Subject: x86/tsc: Provide 'tsc=unstable' boot parameter + +From: Peter Zijlstra + + +[ Upstream commit 8309f86cd41e8714526867177facf7a316d9be53 ] + +Since the clocksource watchdog will only detect broken TSC after the +fact, all TSC based clocks will likely have observed non-continuous +values before/when switching away from TSC. + +Therefore only thing to fully avoid random clock movement when your +BIOS randomly mucks with TSC values from SMI handlers is reporting the +TSC as unstable at boot. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Mike Galbraith +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/tsc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -365,6 +365,8 @@ static int __init tsc_setup(char *str) + tsc_clocksource_reliable = 1; + if (!strncmp(str, "noirqtime", 9)) + no_sched_irq_time = 1; ++ if (!strcmp(str, "unstable")) ++ mark_tsc_unstable("boot parameter"); + return 1; + } + diff --git a/queue-4.4/xen-avoid-type-warning-in-xchg_xen_ulong.patch b/queue-4.4/xen-avoid-type-warning-in-xchg_xen_ulong.patch new file mode 100644 index 00000000000..db8308a4c67 --- /dev/null +++ b/queue-4.4/xen-avoid-type-warning-in-xchg_xen_ulong.patch @@ -0,0 +1,43 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Arnd Bergmann +Date: Thu, 8 Jun 2017 10:53:10 +0200 +Subject: xen: avoid type warning in xchg_xen_ulong + +From: Arnd Bergmann + + +[ Upstream commit 9cc91f212111cdcbefa02dcdb7dd443f224bf52c ] + +The improved type-checking version of container_of() triggers a warning for +xchg_xen_ulong, pointing out that 'xen_ulong_t' is unsigned, but atomic64_t +contains a signed value: + +drivers/xen/events/events_2l.c: In function 'evtchn_2l_handle_events': +drivers/xen/events/events_2l.c:187:1020: error: call to '__compiletime_assert_187' declared with attribute error: pointer type mismatch in container_of() + +This adds a cast to work around the warning. + +Cc: Ian Abbott +Fixes: 85323a991d40 ("xen: arm: mandate EABI and use generic atomic operations.") +Fixes: daa2ac80834d ("kernel.h: handle pointers to arrays better in container_of()") +Signed-off-by: Arnd Bergmann +Signed-off-by: Stefano Stabellini +Reviewed-by: Stefano Stabellini +Acked-by: Ian Abbott +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/include/asm/xen/events.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/include/asm/xen/events.h ++++ b/arch/arm/include/asm/xen/events.h +@@ -16,7 +16,7 @@ static inline int xen_irqs_disabled(stru + return raw_irqs_disabled_flags(regs->ARM_cpsr); + } + +-#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((ptr), \ ++#define xchg_xen_ulong(ptr, val) atomic64_xchg(container_of((long long*)(ptr),\ + atomic64_t, \ + counter), (val)) + diff --git a/queue-4.4/xfrm-fix-state-migration-copy-replay-sequence-numbers.patch b/queue-4.4/xfrm-fix-state-migration-copy-replay-sequence-numbers.patch new file mode 100644 index 00000000000..dcf1f1a5650 --- /dev/null +++ b/queue-4.4/xfrm-fix-state-migration-copy-replay-sequence-numbers.patch @@ -0,0 +1,56 @@ +From foo@baz Tue Apr 10 10:31:53 CEST 2018 +From: Antony Antony +Date: Fri, 19 May 2017 12:47:00 +0200 +Subject: xfrm: fix state migration copy replay sequence numbers + +From: Antony Antony + + +[ Upstream commit a486cd23661c9387fb076c3f6ae8b2aa9d20d54a ] + +During xfrm migration copy replay and preplay sequence numbers +from the previous state. + +Here is a tcpdump output showing the problem. +10.0.10.46 is running vanilla kernel, is the IKE/IPsec responder. +After the migration it sent wrong sequence number, reset to 1. +The migration is from 10.0.0.52 to 10.0.0.53. + +IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7cf), length 136 +IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7cf), length 136 +IP 10.0.0.52.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d0), length 136 +IP 10.0.10.46.4500 > 10.0.0.52.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x7d0), length 136 + +IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] +IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] +IP 10.0.0.53.4500 > 10.0.10.46.4500: NONESP-encap: isakmp: child_sa inf2[I] +IP 10.0.10.46.4500 > 10.0.0.53.4500: NONESP-encap: isakmp: child_sa inf2[R] + +IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d1), length 136 + +NOTE: next sequence is wrong 0x1 + +IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x1), length 136 +IP 10.0.0.53.4500 > 10.0.10.46.4500: UDP-encap: ESP(spi=0x43ef462d,seq=0x7d2), length 136 +IP 10.0.10.46.4500 > 10.0.0.53.4500: UDP-encap: ESP(spi=0xca1c282d,seq=0x2), length 136 + +Signed-off-by: Antony Antony +Reviewed-by: Richard Guy Briggs +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/xfrm/xfrm_state.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1208,6 +1208,8 @@ static struct xfrm_state *xfrm_state_clo + x->curlft.add_time = orig->curlft.add_time; + x->km.state = orig->km.state; + x->km.seq = orig->km.seq; ++ x->replay = orig->replay; ++ x->preplay = orig->preplay; + + return x; +