From: Greg Kroah-Hartman Date: Fri, 17 Apr 2015 12:50:15 +0000 (+0200) Subject: 3.14-stable patches X-Git-Tag: v3.10.75~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c356a099d65fa7acb9149cdc672bcc3897ca96ae;p=thirdparty%2Fkernel%2Fstable-queue.git 3.14-stable patches added patches: be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch ioctx_alloc-fix-vma-and-file-leak-on-failure.patch iscsi-target-fix-oops-when-adding-reject-pdu.patch media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch ocfs2-_really_-sync-the-right-range.patch sh_veu-v4l2_dev-wasn-t-set.patch --- diff --git a/queue-3.14/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch b/queue-3.14/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch new file mode 100644 index 00000000000..a41d3de5989 --- /dev/null +++ b/queue-3.14/be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch @@ -0,0 +1,34 @@ +From 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 Mon Sep 17 00:00:00 2001 +From: John Soni Jose +Date: Thu, 12 Feb 2015 06:45:47 +0530 +Subject: be2iscsi: Fix kernel panic when device initialization fails + +From: John Soni Jose + +commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream. + +Kernel panic was happening as iscsi_host_remove() was called on +a host which was not yet added. + +Signed-off-by: John Soni Jose +Reviewed-by: Mike Christie +Signed-off-by: James Bottomley +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/be2iscsi/be_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -5684,9 +5684,9 @@ free_port: + hba_free: + if (phba->msix_enabled) + pci_disable_msix(phba->pcidev); +- iscsi_host_remove(phba->shost); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_disable_device(pcidev); + return ret; diff --git a/queue-3.14/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch b/queue-3.14/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch new file mode 100644 index 00000000000..c9e113346d8 --- /dev/null +++ b/queue-3.14/ioctx_alloc-fix-vma-and-file-leak-on-failure.patch @@ -0,0 +1,72 @@ +From deeb8525f9bcea60f5e86521880c1161de7a5829 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Mon, 6 Apr 2015 17:57:44 -0400 +Subject: ioctx_alloc(): fix vma (and file) leak on failure + +From: Al Viro + +commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream. + +If we fail past the aio_setup_ring(), we need to destroy the +mapping. We don't need to care about anybody having found ctx, +or added requests to it, since the last failure exit is exactly +the failure to make ctx visible to lookups. + +Reproducer (based on one by Joe Mario ): + +void count(char *p) +{ + char s[80]; + printf("%s: ", p); + fflush(stdout); + sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid()); + system(s); +} + +int main() +{ + io_context_t *ctx; + int created, limit, i, destroyed; + FILE *f; + + count("before"); + if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL) + perror("opening aio-max-nr"); + else if (fscanf(f, "%d", &limit) != 1) + fprintf(stderr, "can't parse aio-max-nr\n"); + else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL) + perror("allocating aio_context_t array"); + else { + for (i = 0, created = 0; i < limit; i++) { + if (io_setup(1000, ctx + created) == 0) + created++; + } + for (i = 0, destroyed = 0; i < created; i++) + if (io_destroy(ctx[i]) == 0) + destroyed++; + printf("created %d, failed %d, destroyed %d\n", + created, limit - created, destroyed); + count("after"); + } +} + +Found-by: Joe Mario +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/aio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -719,6 +719,9 @@ static struct kioctx *ioctx_alloc(unsign + err_cleanup: + aio_nr_sub(ctx->max_reqs); + err_ctx: ++ atomic_set(&ctx->dead, 1); ++ if (ctx->mmap_size) ++ vm_munmap(ctx->mmap_base, ctx->mmap_size); + aio_free_ring(ctx); + err: + mutex_unlock(&ctx->ring_lock); diff --git a/queue-3.14/iscsi-target-fix-oops-when-adding-reject-pdu.patch b/queue-3.14/iscsi-target-fix-oops-when-adding-reject-pdu.patch new file mode 100644 index 00000000000..8e50110aeaf --- /dev/null +++ b/queue-3.14/iscsi-target-fix-oops-when-adding-reject-pdu.patch @@ -0,0 +1,38 @@ +From b815fc12d4dd2b5586184fb4f867caff05a810d4 Mon Sep 17 00:00:00 2001 +From: Mike Christie +Date: Fri, 10 Apr 2015 02:47:27 -0500 +Subject: iscsi target: fix oops when adding reject pdu + +From: Mike Christie + +commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream. + +This fixes a oops due to a double list add when adding a reject PDU for +iscsit_allocate_iovecs allocation failures. The cmd has already been +added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call +iscsit_reject_cmd. + +Note that for ERL0 the reject PDU is not actually sent, so this patch +is not completely tested. Just verified we do not oops. The problem is the +add reject functions return -1 which is returned all the way up to +iscsi_target_rx_thread which for ERL0 will drop the connection. + +Signed-off-by: Mike Christie +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/iscsi/iscsi_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1165,7 +1165,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn + * traditional iSCSI block I/O. + */ + if (iscsit_allocate_iovecs(cmd) < 0) { +- return iscsit_add_reject_cmd(cmd, ++ return iscsit_reject_cmd(cmd, + ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); + } + immed_data = cmd->immediate_data; diff --git a/queue-3.14/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch b/queue-3.14/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch new file mode 100644 index 00000000000..016a2e29e80 --- /dev/null +++ b/queue-3.14/media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch @@ -0,0 +1,34 @@ +From 05b676ab42f624425d5f6519276e506b812fa058 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 4 Mar 2015 05:55:21 -0800 +Subject: [media] media: s5p-mfc: fix mmap support for 64bit arch + +From: Marek Szyprowski + +commit 05b676ab42f624425d5f6519276e506b812fa058 upstream. + +TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it +should not be used for defining offset boundary for mmaping buffers for +CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on +the CAPTURE queue on 64bit architectures (like ARM64). + +Signed-off-by: Marek Szyprowski +Signed-off-by: Kamil Debski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/s5p-mfc/s5p_mfc_common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h +@@ -30,7 +30,7 @@ + + /* Offset base used to differentiate between CAPTURE and OUTPUT + * while mmaping */ +-#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2) ++#define DST_QUEUE_OFF_BASE (1 << 30) + + #define MFC_BANK1_ALLOC_CTX 0 + #define MFC_BANK2_ALLOC_CTX 1 diff --git a/queue-3.14/ocfs2-_really_-sync-the-right-range.patch b/queue-3.14/ocfs2-_really_-sync-the-right-range.patch new file mode 100644 index 00000000000..94aaf36c73a --- /dev/null +++ b/queue-3.14/ocfs2-_really_-sync-the-right-range.patch @@ -0,0 +1,60 @@ +From 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Wed, 8 Apr 2015 17:00:32 -0400 +Subject: ocfs2: _really_ sync the right range + +From: Al Viro + +commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream. + +"ocfs2 syncs the wrong range" had been broken; prior to it the +code was doing the wrong thing in case of O_APPEND, all right, +but _after_ it we were syncing the wrong range in 100% cases. +*ppos, aka iocb->ki_pos is incremented prior to that point, +so we are always doing sync on the area _after_ the one we'd +written to. + +Spotted by Joseph Qi back in January; +unfortunately, I'd missed his mail back then ;-/ + +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/file.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/fs/ocfs2/file.c ++++ b/fs/ocfs2/file.c +@@ -2391,10 +2391,14 @@ out_dio: + /* buffered aio wouldn't have proper lock coverage today */ + BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT)); + ++ if (unlikely(written <= 0)) ++ goto no_sync; ++ + if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) || + ((file->f_flags & O_DIRECT) && !direct_io)) { +- ret = filemap_fdatawrite_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawrite_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + if (ret < 0) + written = ret; + +@@ -2407,10 +2411,12 @@ out_dio: + } + + if (!ret) +- ret = filemap_fdatawait_range(file->f_mapping, *ppos, +- *ppos + count - 1); ++ ret = filemap_fdatawait_range(file->f_mapping, ++ iocb->ki_pos - written, ++ iocb->ki_pos - 1); + } + ++no_sync: + /* + * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io + * function pointer which is called when o_direct io completes so that diff --git a/queue-3.14/series b/queue-3.14/series index 2f9a4232086..008cca34f1f 100644 --- a/queue-3.14/series +++ b/queue-3.14/series @@ -32,3 +32,9 @@ tty-serial-fsl_lpuart-clear-receive-flag-on-fifo-flush.patch n_tty-fix-read-buffer-overwrite-when-no-newline.patch cifs-smb2_clone_range-exit-on-unhandled-error.patch cifs-fix-use-after-free-bug-in-find_writable_file.patch +be2iscsi-fix-kernel-panic-when-device-initialization-fails.patch +ocfs2-_really_-sync-the-right-range.patch +ioctx_alloc-fix-vma-and-file-leak-on-failure.patch +iscsi-target-fix-oops-when-adding-reject-pdu.patch +sh_veu-v4l2_dev-wasn-t-set.patch +media-s5p-mfc-fix-mmap-support-for-64bit-arch.patch diff --git a/queue-3.14/sh_veu-v4l2_dev-wasn-t-set.patch b/queue-3.14/sh_veu-v4l2_dev-wasn-t-set.patch new file mode 100644 index 00000000000..c7ba2b45796 --- /dev/null +++ b/queue-3.14/sh_veu-v4l2_dev-wasn-t-set.patch @@ -0,0 +1,31 @@ +From ab3120300be067a2d41a027c41db0b2c662ab200 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Wed, 10 Dec 2014 12:35:34 -0300 +Subject: [media] sh_veu: v4l2_dev wasn't set + +From: Hans Verkuil + +commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream. + +The v4l2_dev field of struct video_device must be set correctly. +This was never done for this driver, so no video nodes were created +anymore. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/sh_veu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/sh_veu.c ++++ b/drivers/media/platform/sh_veu.c +@@ -1183,6 +1183,7 @@ static int sh_veu_probe(struct platform_ + } + + *vdev = sh_veu_videodev; ++ vdev->v4l2_dev = &veu->v4l2_dev; + spin_lock_init(&veu->lock); + mutex_init(&veu->fop_lock); + vdev->lock = &veu->fop_lock;