From: Greg Kroah-Hartman Date: Sun, 3 Nov 2019 18:01:37 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.199~37 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d1902c401052ed1c38b244516936f6a5c1fe7f05;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch fuse-truncate-pending-writes-on-o_trunc.patch uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch --- diff --git a/queue-4.4/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch b/queue-4.4/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch new file mode 100644 index 00000000000..1a007b0b118 --- /dev/null +++ b/queue-4.4/alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch @@ -0,0 +1,37 @@ +From f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sat, 26 Oct 2019 12:06:20 +0900 +Subject: ALSA: bebob: Fix prototype of helper function to return negative value + +From: Takashi Sakamoto + +commit f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 upstream. + +A helper function of ALSA bebob driver returns negative value in a +function which has a prototype to return unsigned value. + +This commit fixes it by changing the prototype. + +Fixes: eb7b3a056cd8 ("ALSA: bebob: Add commands and connections/streams management") +Cc: # v3.16+ +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20191026030620.12077-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/bebob/bebob_stream.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/firewire/bebob/bebob_stream.c ++++ b/sound/firewire/bebob/bebob_stream.c +@@ -253,8 +253,7 @@ end: + return err; + } + +-static unsigned int +-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) ++static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s) + { + unsigned int sec, sections, ch, channels; + unsigned int pcm, midi, location; diff --git a/queue-4.4/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch b/queue-4.4/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch index 1ae6ec50215..ead404807ca 100644 --- a/queue-4.4/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch +++ b/queue-4.4/ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch @@ -43,14 +43,12 @@ Reviewed-by: Greg Kroah-Hartman Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin --- - drivers/net/wireless/ath/ath6kl/usb.c | 8 ++++++++ + drivers/net/wireless/ath/ath6kl/usb.c | 8 ++++++++ 1 file changed, 8 insertions(+) -diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c -index 9da3594fd010d..fc22c5f479276 100644 --- a/drivers/net/wireless/ath/ath6kl/usb.c +++ b/drivers/net/wireless/ath/ath6kl/usb.c -@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct ath6kl_usb_pipe *pipe) +@@ -132,6 +132,10 @@ ath6kl_usb_alloc_urb_from_pipe(struct at struct ath6kl_urb_context *urb_context = NULL; unsigned long flags; @@ -61,7 +59,7 @@ index 9da3594fd010d..fc22c5f479276 100644 spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); if (!list_empty(&pipe->urb_list_head)) { urb_context = -@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe(struct ath6kl_usb_pipe *pipe, +@@ -150,6 +154,10 @@ static void ath6kl_usb_free_urb_to_pipe( { unsigned long flags; @@ -72,6 +70,3 @@ index 9da3594fd010d..fc22c5f479276 100644 spin_lock_irqsave(&pipe->ar_usb->cs_lock, flags); pipe->urb_cnt++; --- -2.20.1 - diff --git a/queue-4.4/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch b/queue-4.4/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch new file mode 100644 index 00000000000..19be3936f27 --- /dev/null +++ b/queue-4.4/fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch @@ -0,0 +1,57 @@ +From b24e7598db62386a95a3c8b9c75630c5d56fe077 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 23 Oct 2019 14:26:37 +0200 +Subject: fuse: flush dirty data/metadata before non-truncate setattr + +From: Miklos Szeredi + +commit b24e7598db62386a95a3c8b9c75630c5d56fe077 upstream. + +If writeback cache is enabled, then writes might get reordered with +chmod/chown/utimes. The problem with this is that performing the write in +the fuse daemon might itself change some of these attributes. In such case +the following sequence of operations will result in file ending up with the +wrong mode, for example: + + int fd = open ("suid", O_WRONLY|O_CREAT|O_EXCL); + write (fd, "1", 1); + fchown (fd, 0, 0); + fchmod (fd, 04755); + close (fd); + +This patch fixes this by flushing pending writes before performing +chown/chmod/utimes. + +Reported-by: Giuseppe Scrivano +Tested-by: Giuseppe Scrivano +Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on") +Cc: # v3.15+ +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/dir.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1628,6 +1628,19 @@ int fuse_do_setattr(struct inode *inode, + if (attr->ia_valid & ATTR_SIZE) + is_truncate = true; + ++ /* Flush dirty data/metadata before non-truncate SETATTR */ ++ if (is_wb && S_ISREG(inode->i_mode) && ++ attr->ia_valid & ++ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET | ++ ATTR_TIMES_SET)) { ++ err = write_inode_now(inode, true); ++ if (err) ++ return err; ++ ++ fuse_set_nowrite(inode); ++ fuse_release_nowrite(inode); ++ } ++ + if (is_truncate) { + fuse_set_nowrite(inode); + set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state); diff --git a/queue-4.4/fuse-truncate-pending-writes-on-o_trunc.patch b/queue-4.4/fuse-truncate-pending-writes-on-o_trunc.patch new file mode 100644 index 00000000000..1eb778cd932 --- /dev/null +++ b/queue-4.4/fuse-truncate-pending-writes-on-o_trunc.patch @@ -0,0 +1,55 @@ +From e4648309b85a78f8c787457832269a8712a8673e Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Wed, 23 Oct 2019 14:26:37 +0200 +Subject: fuse: truncate pending writes on O_TRUNC + +From: Miklos Szeredi + +commit e4648309b85a78f8c787457832269a8712a8673e upstream. + +Make sure cached writes are not reordered around open(..., O_TRUNC), with +the obvious wrong results. + +Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on") +Cc: # v3.15+ +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman + +--- + fs/fuse/file.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -201,7 +201,7 @@ int fuse_open_common(struct inode *inode + { + struct fuse_conn *fc = get_fuse_conn(inode); + int err; +- bool lock_inode = (file->f_flags & O_TRUNC) && ++ bool is_wb_truncate = (file->f_flags & O_TRUNC) && + fc->atomic_o_trunc && + fc->writeback_cache; + +@@ -209,16 +209,20 @@ int fuse_open_common(struct inode *inode + if (err) + return err; + +- if (lock_inode) ++ if (is_wb_truncate) { + mutex_lock(&inode->i_mutex); ++ fuse_set_nowrite(inode); ++ } + + err = fuse_do_open(fc, get_node_id(inode), file, isdir); + + if (!err) + fuse_finish_open(inode, file); + +- if (lock_inode) ++ if (is_wb_truncate) { ++ fuse_release_nowrite(inode); + mutex_unlock(&inode->i_mutex); ++ } + + return err; + } diff --git a/queue-4.4/series b/queue-4.4/series index 1ddbe38962a..33dc58ab931 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -22,3 +22,7 @@ tracing-initialize-iter-seq-after-zeroing-in-tracing.patch usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch thunderbolt-use-32-bit-writes-when-writing-ring-prod.patch ath6kl-fix-a-null-ptr-deref-bug-in-ath6kl_usb_alloc_.patch +fuse-flush-dirty-data-metadata-before-non-truncate-setattr.patch +fuse-truncate-pending-writes-on-o_trunc.patch +alsa-bebob-fix-prototype-of-helper-function-to-return-negative-value.patch +uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch diff --git a/queue-4.4/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch b/queue-4.4/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch new file mode 100644 index 00000000000..91f9ced61bd --- /dev/null +++ b/queue-4.4/uas-revert-commit-3ae62a42090f-uas-fix-alignment-of-scatter-gather-segments.patch @@ -0,0 +1,92 @@ +From 1186f86a71130a7635a20843e355bb880c7349b2 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Wed, 23 Oct 2019 11:34:33 -0400 +Subject: UAS: Revert commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") + +From: Alan Stern + +commit 1186f86a71130a7635a20843e355bb880c7349b2 upstream. + +Commit 3ae62a42090f ("UAS: fix alignment of scatter/gather segments"), +copying a similar commit for usb-storage, attempted to solve a problem +involving scatter-gather I/O and USB/IP by setting the +virt_boundary_mask for mass-storage devices. + +However, it now turns out that the analogous change in usb-storage +interacted badly with commit 09324d32d2a0 ("block: force an unlimited +segment size on queues with a virt boundary"), which was added later. +A typical error message is: + + ehci-pci 0000:00:13.2: swiotlb buffer is full (sz: 327680 bytes), + total 32768 (slots), used 97 (slots) + +There is no longer any reason to keep the virt_boundary_mask setting +in the uas driver. It was needed in the first place only for +handling devices with a block size smaller than the maxpacket size and +where the host controller was not capable of fully general +scatter-gather operation (that is, able to merge two SG segments into +a single USB packet). But: + + High-speed or slower connections never use a bulk maxpacket + value larger than 512; + + The SCSI layer does not handle block devices with a block size + smaller than 512 bytes; + + All the host controllers capable of SuperSpeed operation can + handle fully general SG; + + Since commit ea44d190764b ("usbip: Implement SG support to + vhci-hcd and stub driver") was merged, the USB/IP driver can + also handle SG. + +Therefore all supported device/controller combinations should be okay +with no need for any special virt_boundary_mask. So in order to head +off potential problems similar to those affecting usb-storage, this +patch reverts commit 3ae62a42090f. + +Signed-off-by: Alan Stern +CC: Oliver Neukum +CC: +Acked-by: Christoph Hellwig +Fixes: 3ae62a42090f ("UAS: fix alignment of scatter/gather segments") +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910231132470.1878-100000@iolanthe.rowland.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/storage/uas.c | 20 -------------------- + 1 file changed, 20 deletions(-) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -772,30 +772,10 @@ static int uas_slave_alloc(struct scsi_d + { + struct uas_dev_info *devinfo = + (struct uas_dev_info *)sdev->host->hostdata; +- int maxp; + + sdev->hostdata = devinfo; + + /* +- * We have two requirements here. We must satisfy the requirements +- * of the physical HC and the demands of the protocol, as we +- * definitely want no additional memory allocation in this path +- * ruling out using bounce buffers. +- * +- * For a transmission on USB to continue we must never send +- * a package that is smaller than maxpacket. Hence the length of each +- * scatterlist element except the last must be divisible by the +- * Bulk maxpacket value. +- * If the HC does not ensure that through SG, +- * the upper layer must do that. We must assume nothing +- * about the capabilities off the HC, so we use the most +- * pessimistic requirement. +- */ +- +- maxp = usb_maxpacket(devinfo->udev, devinfo->data_in_pipe, 0); +- blk_queue_virt_boundary(sdev->request_queue, maxp - 1); +- +- /* + * The protocol has no requirements on alignment in the strict sense. + * Controllers may or may not have alignment restrictions. + * As this is not exported, we use an extremely conservative guess. diff --git a/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch index 4b3a0615f4b..61339dc1080 100644 --- a/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch +++ b/queue-4.4/usb-legousbtower-fix-a-signedness-bug-in-tower_probe.patch @@ -18,14 +18,12 @@ Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- - drivers/usb/misc/legousbtower.c | 2 +- + drivers/usb/misc/legousbtower.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c -index 32b41eb07f00e..8350ecfbcf21a 100644 --- a/drivers/usb/misc/legousbtower.c +++ b/drivers/usb/misc/legousbtower.c -@@ -910,7 +910,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device +@@ -910,7 +910,7 @@ static int tower_probe (struct usb_inter get_version_reply, sizeof(*get_version_reply), 1000); @@ -34,6 +32,3 @@ index 32b41eb07f00e..8350ecfbcf21a 100644 if (result >= 0) result = -EIO; dev_err(idev, "get version request failed: %d\n", result); --- -2.20.1 -