From: Greg Kroah-Hartman Date: Thu, 11 May 2017 08:26:30 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v4.4.68~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d32e754384d7e3059b5f6f7741598dfa43dee259;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch staging-emxx_udc-remove-incorrect-__init-annotations.patch staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch staging-wlan-ng-add-missing-byte-order-conversion.patch --- diff --git a/queue-4.9/alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch b/queue-4.9/alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch new file mode 100644 index 00000000000..7347c67ab4e --- /dev/null +++ b/queue-4.9/alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch @@ -0,0 +1,71 @@ +From ab949d519601880fd46e8bc1445d6a453bf2dc09 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 2 Jan 2017 11:37:04 +0100 +Subject: ALSA: hda - Fix deadlock of controller device lock at unbinding + +From: Takashi Iwai + +commit ab949d519601880fd46e8bc1445d6a453bf2dc09 upstream. + +Imre Deak reported a deadlock of HD-audio driver at unbinding while +it's still in probing. Since we probe the codecs asynchronously in a +work, the codec driver probe may still be kicked off while the +controller itself is being unbound. And, azx_remove() tries to +process all pending tasks via cancel_work_sync() for fixing the other +races (see commit [0b8c82190c12: ALSA: hda - Cancel probe work instead +of flush at remove]), now we may meet a bizarre deadlock: + +Unbind snd_hda_intel via sysfs: + device_release_driver() -> + device_lock(snd_hda_intel) -> + azx_remove() -> + cancel_work_sync(azx_probe_work) + +azx_probe_work(): + codec driver probe() -> + __driver_attach() -> + device_lock(snd_hda_intel) + +This deadlock is caused by the fact that both device_release_driver() +and driver_probe_device() take both the device and its parent locks at +the same time. The codec device sets the controller device as its +parent, and this lock is taken before the probe() callback is called, +while the controller remove() callback gets called also with the same +lock. + +In this patch, as an ugly workaround, we unlock the controller device +temporarily during cancel_work_sync() call. The race against another +bind call should be still suppressed by the parent's device lock. + +Reported-by: Imre Deak +Fixes: 0b8c82190c12 ("ALSA: hda - Cancel probe work instead of flush at remove") +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2155,7 +2155,20 @@ static void azx_remove(struct pci_dev *p + /* cancel the pending probing work */ + chip = card->private_data; + hda = container_of(chip, struct hda_intel, chip); ++ /* FIXME: below is an ugly workaround. ++ * Both device_release_driver() and driver_probe_device() ++ * take *both* the device's and its parent's lock before ++ * calling the remove() and probe() callbacks. The codec ++ * probe takes the locks of both the codec itself and its ++ * parent, i.e. the PCI controller dev. Meanwhile, when ++ * the PCI controller is unbound, it takes its lock, too ++ * ==> ouch, a deadlock! ++ * As a workaround, we unlock temporarily here the controller ++ * device during cancel_work_sync() call. ++ */ ++ device_unlock(&pci->dev); + cancel_work_sync(&hda->probe_work); ++ device_lock(&pci->dev); + + snd_card_free(card); + } diff --git a/queue-4.9/series b/queue-4.9/series index 048ac97ca43..27d8008e792 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -75,3 +75,9 @@ scsi-smartpqi-fix-time-handling.patch mips-r2-on-r6-multu-maddu-msubu-emulation-bugfix.patch brcmfmac-ensure-pointer-correctly-set-if-skb-data-location-changes.patch brcmfmac-make-skb-header-writable-before-use.patch +staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch +staging-wlan-ng-add-missing-byte-order-conversion.patch +staging-emxx_udc-remove-incorrect-__init-annotations.patch +staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch +alsa-hda-fix-deadlock-of-controller-device-lock-at-unbinding.patch +sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch diff --git a/queue-4.9/sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch b/queue-4.9/sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch new file mode 100644 index 00000000000..8f27acf54fd --- /dev/null +++ b/queue-4.9/sparc64-fix-fault-handling-in-ngbzero.s-and-genbzero.s.patch @@ -0,0 +1,67 @@ +From 3c7f62212018b904ae17f5636ead18a4dca3a88f Mon Sep 17 00:00:00 2001 +From: Dave Aldridge +Date: Tue, 9 May 2017 02:57:35 -0600 +Subject: sparc64: fix fault handling in NGbzero.S and GENbzero.S + +From: Dave Aldridge + +commit 3c7f62212018b904ae17f5636ead18a4dca3a88f upstream. + +When any of the functions contained in NGbzero.S and GENbzero.S +vector through *bzero_from_clear_user, we may end up taking a +fault when executing one of the store alternate address space +instructions. If this happens, the exception handler does not +restore the %asi register. + +This commit fixes the issue by introducing a new exception +handler that ensures the %asi register is restored when +a fault is handled. + +Orabug: 25577560 + +Signed-off-by: Dave Aldridge +Reviewed-by: Rob Gardner +Reviewed-by: Babu Moger +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/head_64.S | 6 ++++++ + arch/sparc/lib/GENbzero.S | 2 +- + arch/sparc/lib/NGbzero.S | 2 +- + 3 files changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/head_64.S ++++ b/arch/sparc/kernel/head_64.S +@@ -935,3 +935,9 @@ ENTRY(__retl_o1) + retl + mov %o1, %o0 + ENDPROC(__retl_o1) ++ ++ENTRY(__retl_o1_asi) ++ wr %o5, 0x0, %asi ++ retl ++ mov %o1, %o0 ++ENDPROC(__retl_o1_asi) +--- a/arch/sparc/lib/GENbzero.S ++++ b/arch/sparc/lib/GENbzero.S +@@ -8,7 +8,7 @@ + 98: x,y; \ + .section __ex_table,"a";\ + .align 4; \ +- .word 98b, __retl_o1; \ ++ .word 98b, __retl_o1_asi;\ + .text; \ + .align 4; + +--- a/arch/sparc/lib/NGbzero.S ++++ b/arch/sparc/lib/NGbzero.S +@@ -8,7 +8,7 @@ + 98: x,y; \ + .section __ex_table,"a";\ + .align 4; \ +- .word 98b, __retl_o1; \ ++ .word 98b, __retl_o1_asi;\ + .text; \ + .align 4; + diff --git a/queue-4.9/staging-emxx_udc-remove-incorrect-__init-annotations.patch b/queue-4.9/staging-emxx_udc-remove-incorrect-__init-annotations.patch new file mode 100644 index 00000000000..f632559c326 --- /dev/null +++ b/queue-4.9/staging-emxx_udc-remove-incorrect-__init-annotations.patch @@ -0,0 +1,46 @@ +From 4f3445067d5f78fb8d1970b02610f85c2f377ea4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 16 Dec 2016 10:09:39 +0100 +Subject: staging: emxx_udc: remove incorrect __init annotations + +From: Arnd Bergmann + +commit 4f3445067d5f78fb8d1970b02610f85c2f377ea4 upstream. + +The probe function is not marked __init, but some other functions +are. This leads to a warning on older compilers (e.g. gcc-4.3), +and can cause executing freed memory when built with those +compilers: + +WARNING: drivers/staging/emxx_udc/emxx_udc.o(.text+0x2d78): Section mismatch in reference from the function nbu2ss_drv_probe() to the function .init.text:nbu2ss_drv_contest_init() + +This removes the annotations. + +Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/emxx_udc/emxx_udc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/emxx_udc/emxx_udc.c ++++ b/drivers/staging/emxx_udc/emxx_udc.c +@@ -3160,7 +3160,7 @@ static const struct { + }; + + /*-------------------------------------------------------------------------*/ +-static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc) ++static void nbu2ss_drv_ep_init(struct nbu2ss_udc *udc) + { + int i; + +@@ -3191,7 +3191,7 @@ static void __init nbu2ss_drv_ep_init(st + + /*-------------------------------------------------------------------------*/ + /* platform_driver */ +-static int __init nbu2ss_drv_contest_init( ++static int nbu2ss_drv_contest_init( + struct platform_device *pdev, + struct nbu2ss_udc *udc) + { diff --git a/queue-4.9/staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch b/queue-4.9/staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch new file mode 100644 index 00000000000..8b71a21f0c3 --- /dev/null +++ b/queue-4.9/staging-lustre-llite-move-root_squash-from-sysfs-to-debugfs.patch @@ -0,0 +1,85 @@ +From 4c13990e35b9f053857d4ad83bf0f58e612ec414 Mon Sep 17 00:00:00 2001 +From: Oleg Drokin +Date: Wed, 7 Dec 2016 17:41:27 -0500 +Subject: staging/lustre/llite: move root_squash from sysfs to debugfs + +From: Oleg Drokin + +commit 4c13990e35b9f053857d4ad83bf0f58e612ec414 upstream. + +root_squash control got accidentally moved to sysfs instead of +debugfs, and the write side of it was also broken expecting a +userspace buffer. +It contains both uid and gid values in a single file, so debugfs +is a clear place for it. + +Reported-by: Al Viro +Fixes: c948390f10ccc "fix inconsistencies of root squash feature" +Signed-off-by: Oleg Drokin +Reviewed-by: James Simmons +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/lustre/lustre/llite/lproc_llite.c | 27 ++++++++++++---------- + 1 file changed, 15 insertions(+), 12 deletions(-) + +--- a/drivers/staging/lustre/lustre/llite/lproc_llite.c ++++ b/drivers/staging/lustre/lustre/llite/lproc_llite.c +@@ -924,27 +924,29 @@ static ssize_t ll_unstable_stats_seq_wri + } + LPROC_SEQ_FOPS(ll_unstable_stats); + +-static ssize_t root_squash_show(struct kobject *kobj, struct attribute *attr, +- char *buf) ++static int ll_root_squash_seq_show(struct seq_file *m, void *v) + { +- struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info, +- ll_kobj); ++ struct super_block *sb = m->private; ++ struct ll_sb_info *sbi = ll_s2sbi(sb); + struct root_squash_info *squash = &sbi->ll_squash; + +- return sprintf(buf, "%u:%u\n", squash->rsi_uid, squash->rsi_gid); ++ seq_printf(m, "%u:%u\n", squash->rsi_uid, squash->rsi_gid); ++ return 0; + } + +-static ssize_t root_squash_store(struct kobject *kobj, struct attribute *attr, +- const char *buffer, size_t count) ++static ssize_t ll_root_squash_seq_write(struct file *file, ++ const char __user *buffer, ++ size_t count, loff_t *off) + { +- struct ll_sb_info *sbi = container_of(kobj, struct ll_sb_info, +- ll_kobj); ++ struct seq_file *m = file->private_data; ++ struct super_block *sb = m->private; ++ struct ll_sb_info *sbi = ll_s2sbi(sb); + struct root_squash_info *squash = &sbi->ll_squash; + + return lprocfs_wr_root_squash(buffer, count, squash, +- ll_get_fsname(sbi->ll_sb, NULL, 0)); ++ ll_get_fsname(sb, NULL, 0)); + } +-LUSTRE_RW_ATTR(root_squash); ++LPROC_SEQ_FOPS(ll_root_squash); + + static int ll_nosquash_nids_seq_show(struct seq_file *m, void *v) + { +@@ -997,6 +999,8 @@ static struct lprocfs_vars lprocfs_llite + { "statahead_stats", &ll_statahead_stats_fops, NULL, 0 }, + { "unstable_stats", &ll_unstable_stats_fops, NULL }, + { "sbi_flags", &ll_sbi_flags_fops, NULL, 0 }, ++ { .name = "root_squash", ++ .fops = &ll_root_squash_fops }, + { .name = "nosquash_nids", + .fops = &ll_nosquash_nids_fops }, + { NULL } +@@ -1027,7 +1031,6 @@ static struct attribute *llite_attrs[] = + &lustre_attr_max_easize.attr, + &lustre_attr_default_easize.attr, + &lustre_attr_xattr_cache.attr, +- &lustre_attr_root_squash.attr, + NULL, + }; + diff --git a/queue-4.9/staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch b/queue-4.9/staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch new file mode 100644 index 00000000000..317be443786 --- /dev/null +++ b/queue-4.9/staging-lustre-mdc-make-it_open-take-lookup-bits-lock.patch @@ -0,0 +1,38 @@ +From 26d2bf1e71525f4c0f644820c30d1344633159e2 Mon Sep 17 00:00:00 2001 +From: Patrick Farrell +Date: Sat, 28 Jan 2017 19:05:14 -0500 +Subject: staging: lustre: mdc: Make IT_OPEN take lookup bits lock + +From: Patrick Farrell + +commit 26d2bf1e71525f4c0f644820c30d1344633159e2 upstream. + +An earlier commit accidentally changed handling of IT_OPEN, +making it take the MDS_INODELOCK_UPDATE bits lock instead of +MDS_INODELOCK_LOOKUP. This does not cause any known bugs. + +Signed-off-by: Patrick Farrell +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8842 +Reviewed-on: https://review.whamcloud.com/23797 +Fixes: 70a251f68dea ("staging: lustre: obd: decruft md_enqueue() and md_intent_lock()" +Reviewed-by: John L. Hammond +Reviewed-by: Lai Siyao +Reviewed-by: Oleg Drokin +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/lustre/lustre/mdc/mdc_locks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/mdc/mdc_locks.c ++++ b/drivers/staging/lustre/lustre/mdc/mdc_locks.c +@@ -721,7 +721,7 @@ int mdc_enqueue(struct obd_export *exp, + LASSERT(!policy); + + saved_flags |= LDLM_FL_HAS_INTENT; +- if (it->it_op & (IT_OPEN | IT_UNLINK | IT_GETATTR | IT_READDIR)) ++ if (it->it_op & (IT_UNLINK | IT_GETATTR | IT_READDIR)) + policy = &update_policy; + else if (it->it_op & IT_LAYOUT) + policy = &layout_policy; diff --git a/queue-4.9/staging-wlan-ng-add-missing-byte-order-conversion.patch b/queue-4.9/staging-wlan-ng-add-missing-byte-order-conversion.patch new file mode 100644 index 00000000000..3f46710a536 --- /dev/null +++ b/queue-4.9/staging-wlan-ng-add-missing-byte-order-conversion.patch @@ -0,0 +1,35 @@ +From 2c474b8579e9b67ff72b2bcefce9f53c7f4469d4 Mon Sep 17 00:00:00 2001 +From: Igor Pylypiv +Date: Mon, 30 Jan 2017 21:39:54 -0800 +Subject: staging: wlan-ng: add missing byte order conversion + +From: Igor Pylypiv + +commit 2c474b8579e9b67ff72b2bcefce9f53c7f4469d4 upstream. + +Conversion macros le16_to_cpu was removed and that caused new sparse warning + +sparse output: +drivers/staging/wlan-ng/p80211netdev.c:241:44: warning: incorrect type in argument 2 (different base types) +drivers/staging/wlan-ng/p80211netdev.c:241:44: expected unsigned short [unsigned] [usertype] fc +drivers/staging/wlan-ng/p80211netdev.c:241:44: got restricted __le16 [usertype] fc + +Fixes: 7ad82572348c ("staging:wlan-ng:Fix sparse warning") +Signed-off-by: Igor Pylypiv +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/wlan-ng/p80211netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/wlan-ng/p80211netdev.c ++++ b/drivers/staging/wlan-ng/p80211netdev.c +@@ -232,7 +232,7 @@ static int p80211_convert_to_ether(struc + struct p80211_hdr_a3 *hdr; + + hdr = (struct p80211_hdr_a3 *)skb->data; +- if (p80211_rx_typedrop(wlandev, hdr->fc)) ++ if (p80211_rx_typedrop(wlandev, le16_to_cpu(hdr->fc))) + return CONV_TO_ETHER_SKIPPED; + + /* perform mcast filtering: allow my local address through but reject