From: Greg Kroah-Hartman Date: Sun, 24 Mar 2019 19:36:56 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.166~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e36271efd45abe0afcc4f16685c69d869e7877cf;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: alsa-firewire-motu-use-version-field-of-unit-directory-to-identify-model.patch alsa-hda-add-lenovo-ideacentre-b550-to-the-power_save_blacklist.patch drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch drm-vmwgfx-return-0-when-gmrid-get_node-runs-out-of-id-s.patch iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch mips-ensure-elf-appended-dtb-is-relocated.patch mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch mmc-mxcmmc-revert-mmc-mxcmmc-handle-highmem-pages.patch mmc-pxamci-fix-enum-type-confusion.patch mmc-renesas_sdhi-limit-block-count-to-16-bit-for-old-revisions.patch powerpc-vdso64-fix-clock_monotonic-inconsistencies-across-y2038.patch udf-fix-crash-on-io-error-during-truncate.patch --- diff --git a/queue-4.19/alsa-firewire-motu-use-version-field-of-unit-directory-to-identify-model.patch b/queue-4.19/alsa-firewire-motu-use-version-field-of-unit-directory-to-identify-model.patch new file mode 100644 index 00000000000..99f132bd76c --- /dev/null +++ b/queue-4.19/alsa-firewire-motu-use-version-field-of-unit-directory-to-identify-model.patch @@ -0,0 +1,94 @@ +From 2d012c65a9ca26a0ef87ea0a42f1653dd37155f5 Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Sun, 17 Mar 2019 15:49:29 +0900 +Subject: ALSA: firewire-motu: use 'version' field of unit directory to identify model + +From: Takashi Sakamoto + +commit 2d012c65a9ca26a0ef87ea0a42f1653dd37155f5 upstream. + +Current ALSA firewire-motu driver uses the value of 'model' field +of unit directory in configuration ROM for modalias for MOTU +FireWire models. However, as long as I checked, Pre8 and +828mk3(Hybrid) have the same value for the field (=0x100800). + +unit | version | model +--------------- | --------- | ---------- +828mkII | 0x000003 | 0x101800 +Traveler | 0x000009 | 0x107800 +Pre8 | 0x00000f | 0x100800 <- +828mk3(FW) | 0x000015 | 0x106800 +AudioExpress | 0x000033 | 0x104800 +828mk3(Hybrid) | 0x000035 | 0x100800 <- + +When updating firmware for MOTU 8pre FireWire from v1.0.0 to v1.0.3, +I got change of the value from 0x100800 to 0x103800. On the other +hand, the value of 'version' field is fixed to 0x00000f. As a quick +glance, the higher 12 bits of the value of 'version' field represent +firmware version, while the lower 12 bits is unknown. + +By induction, the value of 'version' field represents actual model. + +This commit changes modalias to match the value of 'version' field, +instead of 'model' field. For degug, long name of added sound card +includes hexadecimal value of 'model' field. + +Fixes: 6c5e1ac0e144 ("ALSA: firewire-motu: add support for Motu Traveler") +Signed-off-by: Takashi Sakamoto +Cc: # v4.19+ +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/firewire/motu/motu.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/sound/firewire/motu/motu.c ++++ b/sound/firewire/motu/motu.c +@@ -36,7 +36,7 @@ static void name_card(struct snd_motu *m + fw_csr_iterator_init(&it, motu->unit->directory); + while (fw_csr_iterator_next(&it, &key, &val)) { + switch (key) { +- case CSR_VERSION: ++ case CSR_MODEL: + version = val; + break; + } +@@ -46,7 +46,7 @@ static void name_card(struct snd_motu *m + strcpy(motu->card->shortname, motu->spec->name); + strcpy(motu->card->mixername, motu->spec->name); + snprintf(motu->card->longname, sizeof(motu->card->longname), +- "MOTU %s (version:%d), GUID %08x%08x at %s, S%d", ++ "MOTU %s (version:%06x), GUID %08x%08x at %s, S%d", + motu->spec->name, version, + fw_dev->config_rom[3], fw_dev->config_rom[4], + dev_name(&motu->unit->device), 100 << fw_dev->max_speed); +@@ -258,20 +258,20 @@ static const struct snd_motu_spec motu_a + #define SND_MOTU_DEV_ENTRY(model, data) \ + { \ + .match_flags = IEEE1394_MATCH_VENDOR_ID | \ +- IEEE1394_MATCH_MODEL_ID | \ +- IEEE1394_MATCH_SPECIFIER_ID, \ ++ IEEE1394_MATCH_SPECIFIER_ID | \ ++ IEEE1394_MATCH_VERSION, \ + .vendor_id = OUI_MOTU, \ +- .model_id = model, \ + .specifier_id = OUI_MOTU, \ ++ .version = model, \ + .driver_data = (kernel_ulong_t)data, \ + } + + static const struct ieee1394_device_id motu_id_table[] = { +- SND_MOTU_DEV_ENTRY(0x101800, &motu_828mk2), +- SND_MOTU_DEV_ENTRY(0x107800, &snd_motu_spec_traveler), +- SND_MOTU_DEV_ENTRY(0x106800, &motu_828mk3), /* FireWire only. */ +- SND_MOTU_DEV_ENTRY(0x100800, &motu_828mk3), /* Hybrid. */ +- SND_MOTU_DEV_ENTRY(0x104800, &motu_audio_express), ++ SND_MOTU_DEV_ENTRY(0x000003, &motu_828mk2), ++ SND_MOTU_DEV_ENTRY(0x000009, &snd_motu_spec_traveler), ++ SND_MOTU_DEV_ENTRY(0x000015, &motu_828mk3), /* FireWire only. */ ++ SND_MOTU_DEV_ENTRY(0x000035, &motu_828mk3), /* Hybrid. */ ++ SND_MOTU_DEV_ENTRY(0x000033, &motu_audio_express), + { } + }; + MODULE_DEVICE_TABLE(ieee1394, motu_id_table); diff --git a/queue-4.19/alsa-hda-add-lenovo-ideacentre-b550-to-the-power_save_blacklist.patch b/queue-4.19/alsa-hda-add-lenovo-ideacentre-b550-to-the-power_save_blacklist.patch new file mode 100644 index 00000000000..b434725d26e --- /dev/null +++ b/queue-4.19/alsa-hda-add-lenovo-ideacentre-b550-to-the-power_save_blacklist.patch @@ -0,0 +1,41 @@ +From 721f1e6c1fd137e7e2053d8e103b666faaa2d50c Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Mon, 18 Mar 2019 13:45:43 +0100 +Subject: ALSA: hda - add Lenovo IdeaCentre B550 to the power_save_blacklist + +From: Jaroslav Kysela + +commit 721f1e6c1fd137e7e2053d8e103b666faaa2d50c upstream. + +Another machine which does not like the power saving (noise): + https://bugzilla.redhat.com/show_bug.cgi?id=1689623 + +Also, reorder the Lenovo C50 entry to keep the table sorted. + +Reported-by: hs.guimaraes@outlook.com +Signed-off-by: Jaroslav Kysela +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/hda_intel.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2274,10 +2274,12 @@ static struct snd_pci_quirk power_save_b + SND_PCI_QUIRK(0x8086, 0x2057, "Intel NUC5i7RYB", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1520902 */ + SND_PCI_QUIRK(0x8086, 0x2068, "Intel NUC7i3BNB", 0), +- /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ +- SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ + SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1689623 */ ++ SND_PCI_QUIRK(0x17aa, 0x367b, "Lenovo IdeaCentre B550", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ ++ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + {} + }; + #endif /* CONFIG_PM */ diff --git a/queue-4.19/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch b/queue-4.19/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch new file mode 100644 index 00000000000..ad5c031c467 --- /dev/null +++ b/queue-4.19/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch @@ -0,0 +1,64 @@ +From c2d311553855395764e2e5bf401d987ba65c2056 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Mon, 18 Mar 2019 15:47:58 +0100 +Subject: drm/vmwgfx: Don't double-free the mode stored in par->set_mode + +From: Thomas Zimmermann + +commit c2d311553855395764e2e5bf401d987ba65c2056 upstream. + +When calling vmw_fb_set_par(), the mode stored in par->set_mode gets free'd +twice. The first free is in vmw_fb_kms_detach(), the second is near the +end of vmw_fb_set_par() under the name of 'old_mode'. The mode-setting code +only works correctly if the mode doesn't actually change. Removing +'old_mode' in favor of using par->set_mode directly fixes the problem. + +Cc: +Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2") +Signed-off-by: Thomas Zimmermann +Reviewed-by: Deepak Rawat +Signed-off-by: Thomas Hellstrom +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -564,11 +564,9 @@ static int vmw_fb_set_par(struct fb_info + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; +- struct drm_display_mode *old_mode; + struct drm_display_mode *mode; + int ret; + +- old_mode = par->set_mode; + mode = drm_mode_duplicate(vmw_priv->dev, &new_mode); + if (!mode) { + DRM_ERROR("Could not create new fb mode.\n"); +@@ -579,11 +577,7 @@ static int vmw_fb_set_par(struct fb_info + mode->vdisplay = var->yres; + vmw_guess_mode_timing(mode); + +- if (old_mode && drm_mode_equal(old_mode, mode)) { +- drm_mode_destroy(vmw_priv->dev, mode); +- mode = old_mode; +- old_mode = NULL; +- } else if (!vmw_kms_validate_mode_vram(vmw_priv, ++ if (!vmw_kms_validate_mode_vram(vmw_priv, + mode->hdisplay * + DIV_ROUND_UP(var->bits_per_pixel, 8), + mode->vdisplay)) { +@@ -620,8 +614,8 @@ static int vmw_fb_set_par(struct fb_info + schedule_delayed_work(&par->local_work, 0); + + out_unlock: +- if (old_mode) +- drm_mode_destroy(vmw_priv->dev, old_mode); ++ if (par->set_mode) ++ drm_mode_destroy(vmw_priv->dev, par->set_mode); + par->set_mode = mode; + + mutex_unlock(&par->bo_mutex); diff --git a/queue-4.19/drm-vmwgfx-return-0-when-gmrid-get_node-runs-out-of-id-s.patch b/queue-4.19/drm-vmwgfx-return-0-when-gmrid-get_node-runs-out-of-id-s.patch new file mode 100644 index 00000000000..f84aff75d41 --- /dev/null +++ b/queue-4.19/drm-vmwgfx-return-0-when-gmrid-get_node-runs-out-of-id-s.patch @@ -0,0 +1,36 @@ +From 4b9ce3a651a37c60527101db4451a315a8b9588f Mon Sep 17 00:00:00 2001 +From: Deepak Rawat +Date: Thu, 28 Feb 2019 10:29:54 -0800 +Subject: drm/vmwgfx: Return 0 when gmrid::get_node runs out of ID's + +From: Deepak Rawat + +commit 4b9ce3a651a37c60527101db4451a315a8b9588f upstream. + +If it's not a system error and get_node implementation accommodate the +buffer object then it should return 0 with memm::mm_node set to NULL. + +v2: Test for id != -ENOMEM instead of id == -ENOSPC. + +Cc: +Fixes: 4eb085e42fde ("drm/vmwgfx: Convert to new IDA API") +Signed-off-by: Deepak Rawat +Reviewed-by: Thomas Hellstrom +Signed-off-by: Thomas Hellstrom +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmrid_manager.c +@@ -57,7 +57,7 @@ static int vmw_gmrid_man_get_node(struct + + id = ida_alloc_max(&gman->gmr_ida, gman->max_gmr_ids - 1, GFP_KERNEL); + if (id < 0) +- return id; ++ return (id != -ENOMEM ? 0 : id); + + spin_lock(&gman->lock); + diff --git a/queue-4.19/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch b/queue-4.19/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch new file mode 100644 index 00000000000..cf0dc1954ac --- /dev/null +++ b/queue-4.19/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch @@ -0,0 +1,78 @@ +From 4e50ce03976fbc8ae995a000c4b10c737467beaa Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 13 Mar 2019 10:03:17 +0100 +Subject: iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE + +From: Stanislaw Gruszka + +commit 4e50ce03976fbc8ae995a000c4b10c737467beaa upstream. + +Take into account that sg->offset can be bigger than PAGE_SIZE when +setting segment sg->dma_address. Otherwise sg->dma_address will point +at diffrent page, what makes DMA not possible with erros like this: + +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020] + +Additinally with wrong sg->dma_address unmap_sg will free wrong pages, +what what can cause crashes like this: + +Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon pfn:39e8b1 +Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint +Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000() +Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000 +Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 +Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount +Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E) xhci_hcd(E) +Feb 28 19:27:45 kernel: scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E) +Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G B W E 4.20.12-arch1-1-custom #1 +Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018 +Feb 28 19:27:45 kernel: Call Trace: +Feb 28 19:27:45 kernel: dump_stack+0x5c/0x80 +Feb 28 19:27:45 kernel: bad_page.cold.29+0x7f/0xb2 +Feb 28 19:27:45 kernel: __free_pages_ok+0x2c0/0x2d0 +Feb 28 19:27:45 kernel: skb_release_data+0x96/0x180 +Feb 28 19:27:45 kernel: __kfree_skb+0xe/0x20 +Feb 28 19:27:45 kernel: tcp_recvmsg+0x894/0xc60 +Feb 28 19:27:45 kernel: ? reuse_swap_page+0x120/0x340 +Feb 28 19:27:45 kernel: ? ptep_set_access_flags+0x23/0x30 +Feb 28 19:27:45 kernel: inet_recvmsg+0x5b/0x100 +Feb 28 19:27:45 kernel: __sys_recvfrom+0xc3/0x180 +Feb 28 19:27:45 kernel: ? handle_mm_fault+0x10a/0x250 +Feb 28 19:27:45 kernel: ? syscall_trace_enter+0x1d3/0x2d0 +Feb 28 19:27:45 kernel: ? __audit_syscall_exit+0x22a/0x290 +Feb 28 19:27:45 kernel: __x64_sys_recvfrom+0x24/0x30 +Feb 28 19:27:45 kernel: do_syscall_64+0x5b/0x170 +Feb 28 19:27:45 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Cc: stable@vger.kernel.org +Reported-and-tested-by: Jan Viktorin +Reviewed-by: Alexander Duyck +Signed-off-by: Stanislaw Gruszka +Fixes: 80187fd39dcb ('iommu/amd: Optimize map_sg and unmap_sg') +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2543,7 +2543,12 @@ static int map_sg(struct device *dev, st + + /* Everything is mapped - write the right values into s->dma_address */ + for_each_sg(sglist, s, nelems, i) { +- s->dma_address += address + s->offset; ++ /* ++ * Add in the remaining piece of the scatter-gather offset that ++ * was masked out when we were determining the physical address ++ * via (sg_phys(s) & PAGE_MASK) earlier. ++ */ ++ s->dma_address += address + (s->offset & ~PAGE_MASK); + s->dma_length = s->length; + } + diff --git a/queue-4.19/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch b/queue-4.19/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch new file mode 100644 index 00000000000..bd97f8a3063 --- /dev/null +++ b/queue-4.19/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch @@ -0,0 +1,95 @@ +From bb229bbb3bf63d23128e851a1f3b85c083178fa1 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Wed, 20 Mar 2019 09:46:58 +0100 +Subject: libceph: wait for latest osdmap in ceph_monc_blacklist_add() + +From: Ilya Dryomov + +commit bb229bbb3bf63d23128e851a1f3b85c083178fa1 upstream. + +Because map updates are distributed lazily, an OSD may not know about +the new blacklist for quite some time after "osd blacklist add" command +is completed. This makes it possible for a blacklisted but still alive +client to overwrite a post-blacklist update, resulting in data +corruption. + +Waiting for latest osdmap in ceph_monc_blacklist_add() and thus using +the post-blacklist epoch for all post-blacklist requests ensures that +all such requests "wait" for the blacklist to come into force on their +respective OSDs. + +Cc: stable@vger.kernel.org +Fixes: 6305a3b41515 ("libceph: support for blacklisting clients") +Signed-off-by: Ilya Dryomov +Reviewed-by: Jason Dillaman +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/ceph/libceph.h | 2 ++ + net/ceph/ceph_common.c | 18 +++++++++++++++++- + net/ceph/mon_client.c | 9 +++++++++ + 3 files changed, 28 insertions(+), 1 deletion(-) + +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -292,6 +292,8 @@ extern void ceph_destroy_client(struct c + extern int __ceph_open_session(struct ceph_client *client, + unsigned long started); + extern int ceph_open_session(struct ceph_client *client); ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout); + + /* pagevec.c */ + extern void ceph_release_page_vector(struct page **pages, int num_pages); +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -729,7 +729,6 @@ int __ceph_open_session(struct ceph_clie + } + EXPORT_SYMBOL(__ceph_open_session); + +- + int ceph_open_session(struct ceph_client *client) + { + int ret; +@@ -745,6 +744,23 @@ int ceph_open_session(struct ceph_client + } + EXPORT_SYMBOL(ceph_open_session); + ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout) ++{ ++ u64 newest_epoch; ++ int ret; ++ ++ ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch); ++ if (ret) ++ return ret; ++ ++ if (client->osdc.osdmap->epoch >= newest_epoch) ++ return 0; ++ ++ ceph_osdc_maybe_request_map(&client->osdc); ++ return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout); ++} ++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap); + + static int __init init_ceph_lib(void) + { +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_ + mutex_unlock(&monc->mutex); + + ret = wait_generic_request(req); ++ if (!ret) ++ /* ++ * Make sure we have the osdmap that includes the blacklist ++ * entry. This is needed to ensure that the OSDs pick up the ++ * new blacklist before processing any future requests from ++ * this client. ++ */ ++ ret = ceph_wait_for_latest_osdmap(monc->client, 0); ++ + out: + put_generic_request(req); + return ret; diff --git a/queue-4.19/mips-ensure-elf-appended-dtb-is-relocated.patch b/queue-4.19/mips-ensure-elf-appended-dtb-is-relocated.patch new file mode 100644 index 00000000000..c6cbe486282 --- /dev/null +++ b/queue-4.19/mips-ensure-elf-appended-dtb-is-relocated.patch @@ -0,0 +1,61 @@ +From 3f0a53bc6482fb09770982a8447981260ea258dc Mon Sep 17 00:00:00 2001 +From: Yasha Cherikovsky +Date: Fri, 8 Mar 2019 14:58:51 +0200 +Subject: MIPS: Ensure ELF appended dtb is relocated + +From: Yasha Cherikovsky + +commit 3f0a53bc6482fb09770982a8447981260ea258dc upstream. + +This fixes booting with the combination of CONFIG_RELOCATABLE=y +and CONFIG_MIPS_ELF_APPENDED_DTB=y. + +Sections that appear after the relocation table are not relocated +on system boot (except .bss, which has special handling). + +With CONFIG_MIPS_ELF_APPENDED_DTB, the dtb is part of the +vmlinux ELF, so it must be relocated together with everything else. + +Fixes: 069fd766271d ("MIPS: Reserve space for relocation table") +Signed-off-by: Yasha Cherikovsky +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: Paul Burton +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org # v4.7+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/vmlinux.lds.S | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -140,6 +140,13 @@ SECTIONS + PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT) + #endif + ++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB ++ .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { ++ *(.appended_dtb) ++ KEEP(*(.appended_dtb)) ++ } ++#endif ++ + #ifdef CONFIG_RELOCATABLE + . = ALIGN(4); + +@@ -164,11 +171,6 @@ SECTIONS + __appended_dtb = .; + /* leave space for appended DTB */ + . += 0x100000; +-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB) +- .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { +- *(.appended_dtb) +- KEEP(*(.appended_dtb)) +- } + #endif + /* + * Align to 64K in attempt to eliminate holes before the diff --git a/queue-4.19/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch b/queue-4.19/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch new file mode 100644 index 00000000000..b87e0f31291 --- /dev/null +++ b/queue-4.19/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch @@ -0,0 +1,51 @@ +From 47c25036b60f27b86ab44b66a8861bcf81cde39b Mon Sep 17 00:00:00 2001 +From: Archer Yan +Date: Fri, 8 Mar 2019 03:29:19 +0000 +Subject: MIPS: Fix kernel crash for R6 in jump label branch function + +From: Archer Yan + +commit 47c25036b60f27b86ab44b66a8861bcf81cde39b upstream. + +Insert Branch instruction instead of NOP to make sure assembler don't +patch code in forbidden slot. In jump label function, it might +be possible to patch Control Transfer Instructions(CTIs) into +forbidden slot, which will generate Reserved Instruction exception +in MIPS release 6. + +Signed-off-by: Archer Yan +Reviewed-by: Paul Burton +[paul.burton@mips.com: + - Add MIPS prefix to subject. + - Mark for stable from v4.0, which introduced r6 support, onwards.] +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: stable@vger.kernel.org # v4.0+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/jump_label.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/include/asm/jump_label.h ++++ b/arch/mips/include/asm/jump_label.h +@@ -21,15 +21,15 @@ + #endif + + #ifdef CONFIG_CPU_MICROMIPS +-#define NOP_INSN "nop32" ++#define B_INSN "b32" + #else +-#define NOP_INSN "nop" ++#define B_INSN "b" + #endif + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm_volatile_goto("1:\t" NOP_INSN "\n\t" +- "nop\n\t" ++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t" ++ "2:\tnop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + WORD_INSN " 1b, %l[l_yes], %0\n\t" + ".popsection\n\t" diff --git a/queue-4.19/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch b/queue-4.19/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch new file mode 100644 index 00000000000..bd77afaa6f6 --- /dev/null +++ b/queue-4.19/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch @@ -0,0 +1,49 @@ +From 5f5f67da9781770df0403269bc57d7aae608fecd Mon Sep 17 00:00:00 2001 +From: Yifeng Li +Date: Tue, 5 Mar 2019 06:00:22 +0800 +Subject: mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. + +From: Yifeng Li + +commit 5f5f67da9781770df0403269bc57d7aae608fecd upstream. + +Timekeeping IRQs from CS5536 MFGPT are routed to i8259, which then +triggers the "cascade" IRQ on MIPS CPU. Without IRQF_NO_SUSPEND in +cascade_irqaction, MFGPT interrupts will be masked in suspend mode, +and the machine would be unable to resume once suspended. + +Previously, MIPS IRQs were not disabled properly, so the original +code appeared to work. Commit a3e6c1eff5 ("MIPS: IRQ: Fix disable_irq on +CPU IRQs") uncovers the bug. To fix it, add IRQF_NO_SUSPEND to +cascade_irqaction. + +This commit is functionally identical to 0add9c2f1cff ("MIPS: +Loongson-3: Add IRQF_NO_SUSPEND to Cascade irqaction"), but it forgot +to apply the same fix to Loongson2. + +Signed-off-by: Yifeng Li +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Jiaxun Yang +Cc: Huacai Chen +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org # v3.19+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/loongson64/lemote-2f/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/loongson64/lemote-2f/irq.c ++++ b/arch/mips/loongson64/lemote-2f/irq.c +@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = + static struct irqaction cascade_irqaction = { + .handler = no_action, + .name = "cascade", +- .flags = IRQF_NO_THREAD, ++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND, + }; + + void __init mach_init_irq(void) diff --git a/queue-4.19/mmc-mxcmmc-revert-mmc-mxcmmc-handle-highmem-pages.patch b/queue-4.19/mmc-mxcmmc-revert-mmc-mxcmmc-handle-highmem-pages.patch new file mode 100644 index 00000000000..dd4519b1edd --- /dev/null +++ b/queue-4.19/mmc-mxcmmc-revert-mmc-mxcmmc-handle-highmem-pages.patch @@ -0,0 +1,104 @@ +From 2b77158ffa92b820a0c5da9a3c6ead7aa069c71c Mon Sep 17 00:00:00 2001 +From: Alexander Shiyan +Date: Sun, 17 Mar 2019 12:58:25 +0300 +Subject: mmc: mxcmmc: "Revert mmc: mxcmmc: handle highmem pages" + +From: Alexander Shiyan + +commit 2b77158ffa92b820a0c5da9a3c6ead7aa069c71c upstream. + +This reverts commit b189e7589f6d3411e85c6b7ae6eef158f08f388f. + +Unable to handle kernel paging request at virtual address c8358000 +pgd = efa405c3 +[c8358000] *pgd=00000000 +Internal error: Oops: 805 [#1] PREEMPT ARM +CPU: 0 PID: 711 Comm: kworker/0:2 Not tainted 4.20.0+ #30 +Hardware name: Freescale i.MX27 (Device Tree Support) +Workqueue: events mxcmci_datawork +PC is at mxcmci_datawork+0xbc/0x2ac +LR is at mxcmci_datawork+0xac/0x2ac +pc : [] lr : [] psr: 60000013 +sp : c6c93f08 ip : 24004180 fp : 00000008 +r10: c8358000 r9 : c78b3e24 r8 : c6c92000 +r7 : 00000000 r6 : c7bb8680 r5 : c7bb86d4 r4 : c78b3de0 +r3 : 00002502 r2 : c090b2e0 r1 : 00000880 r0 : 00000000 +Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +Control: 0005317f Table: a68a8000 DAC: 00000055 +Process kworker/0:2 (pid: 711, stack limit = 0x389543bc) +Stack: (0xc6c93f08 to 0xc6c94000) +3f00: c7bb86d4 00000000 00000000 c6cbfde0 c7bb86d4 c7ee4200 +3f20: 00000000 c0907ea8 00000000 c7bb86d8 c0907ea8 c012077c c6cbfde0 c7bb86d4 +3f40: c6cbfde0 c6c92000 c6cbfdf4 c09280ba c0907ea8 c090b2e0 c0907ebc c0120c18 +3f60: c6cbfde0 00000000 00000000 c6cbb580 c7ba7c40 c7837edc c6cbb598 00000000 +3f80: c6cbfde0 c01208f8 00000000 c01254fc c7ba7c40 c0125400 00000000 00000000 +3fa0: 00000000 00000000 00000000 c01010d0 00000000 00000000 00000000 00000000 +3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000 +[] (mxcmci_datawork) from [] (process_one_work+0x1f0/0x338) +[] (process_one_work) from [] (worker_thread+0x320/0x474) +[] (worker_thread) from [] (kthread+0xfc/0x118) +[] (kthread) from [] (ret_from_fork+0x14/0x24) +Exception stack(0xc6c93fb0 to 0xc6c93ff8) +3fa0: 00000000 00000000 00000000 00000000 +3fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +3fe0: 00000000 00000000 00000000 00000000 00000013 00000000 +Code: e3500000 1a000059 e5153050 e5933038 (e48a3004) +---[ end trace 54ca629b75f0e737 ]--- +note: kworker/0:2[711] exited with preempt_count 1 + +Signed-off-by: Alexander Shiyan +Fixes: b189e7589f6d ("mmc: mxcmmc: handle highmem pages") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/mxcmmc.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +--- a/drivers/mmc/host/mxcmmc.c ++++ b/drivers/mmc/host/mxcmmc.c +@@ -292,11 +292,8 @@ static void mxcmci_swap_buffers(struct m + struct scatterlist *sg; + int i; + +- for_each_sg(data->sg, sg, data->sg_len, i) { +- void *buf = kmap_atomic(sg_page(sg) + sg->offset); +- buffer_swap32(buf, sg->length); +- kunmap_atomic(buf); +- } ++ for_each_sg(data->sg, sg, data->sg_len, i) ++ buffer_swap32(sg_virt(sg), sg->length); + } + #else + static inline void mxcmci_swap_buffers(struct mmc_data *data) {} +@@ -613,7 +610,6 @@ static int mxcmci_transfer_data(struct m + { + struct mmc_data *data = host->req->data; + struct scatterlist *sg; +- void *buf; + int stat, i; + + host->data = data; +@@ -621,18 +617,14 @@ static int mxcmci_transfer_data(struct m + + if (data->flags & MMC_DATA_READ) { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_pull(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_pull(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; + } + } else { + for_each_sg(data->sg, sg, data->sg_len, i) { +- buf = kmap_atomic(sg_page(sg) + sg->offset); +- stat = mxcmci_push(host, buf, sg->length); +- kunmap(buf); ++ stat = mxcmci_push(host, sg_virt(sg), sg->length); + if (stat) + return stat; + host->datasize += sg->length; diff --git a/queue-4.19/mmc-pxamci-fix-enum-type-confusion.patch b/queue-4.19/mmc-pxamci-fix-enum-type-confusion.patch new file mode 100644 index 00000000000..eddc0c509d9 --- /dev/null +++ b/queue-4.19/mmc-pxamci-fix-enum-type-confusion.patch @@ -0,0 +1,47 @@ +From e60a582bcde01158a64ff948fb799f21f5d31a11 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 7 Mar 2019 11:09:19 +0100 +Subject: mmc: pxamci: fix enum type confusion + +From: Arnd Bergmann + +commit e60a582bcde01158a64ff948fb799f21f5d31a11 upstream. + +clang points out several instances of mismatched types in this drivers, +all coming from a single declaration: + +drivers/mmc/host/pxamci.c:193:15: error: implicit conversion from enumeration type 'enum dma_transfer_direction' to + different enumeration type 'enum dma_data_direction' [-Werror,-Wenum-conversion] + direction = DMA_DEV_TO_MEM; + ~ ^~~~~~~~~~~~~~ +drivers/mmc/host/pxamci.c:212:62: error: implicit conversion from enumeration type 'enum dma_data_direction' to + different enumeration type 'enum dma_transfer_direction' [-Werror,-Wenum-conversion] + tx = dmaengine_prep_slave_sg(chan, data->sg, host->dma_len, direction, + +The behavior is correct, so this must be a simply typo from +dma_data_direction and dma_transfer_direction being similarly named +types with a similar purpose. + +Fixes: 6464b7140951 ("mmc: pxamci: switch over to dmaengine use") +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Acked-by: Robert Jarzmik +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/pxamci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -164,7 +164,7 @@ static void pxamci_dma_irq(void *param); + static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) + { + struct dma_async_tx_descriptor *tx; +- enum dma_data_direction direction; ++ enum dma_transfer_direction direction; + struct dma_slave_config config; + struct dma_chan *chan; + unsigned int nob = data->blocks; diff --git a/queue-4.19/mmc-renesas_sdhi-limit-block-count-to-16-bit-for-old-revisions.patch b/queue-4.19/mmc-renesas_sdhi-limit-block-count-to-16-bit-for-old-revisions.patch new file mode 100644 index 00000000000..9df429ab784 --- /dev/null +++ b/queue-4.19/mmc-renesas_sdhi-limit-block-count-to-16-bit-for-old-revisions.patch @@ -0,0 +1,58 @@ +From c9a9497ccef205ed4ed2e247011382627876d831 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Tue, 19 Mar 2019 11:12:59 +0100 +Subject: mmc: renesas_sdhi: limit block count to 16 bit for old revisions + +From: Wolfram Sang + +commit c9a9497ccef205ed4ed2e247011382627876d831 upstream. + +R-Car Gen2 has two different SDHI incarnations in the same chip. The +older one does not support the recently introduced 32 bit register +access to the block count register. Make sure we use this feature only +after the first known version. + +Thanks to the Renesas Testing team for this bug report! + +Fixes: 5603731a15ef ("mmc: tmio: fix access width of Block Count Register") +Reported-by: Yoshihiro Shimoda +Signed-off-by: Wolfram Sang +Reviewed-by: Simon Horman +Tested-by: Phong Hoang +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/renesas_sdhi_core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -557,6 +557,7 @@ int renesas_sdhi_probe(struct platform_d + struct renesas_sdhi *priv; + struct resource *res; + int irq, ret, i; ++ u16 ver; + + of_data = of_device_get_match_data(&pdev->dev); + +@@ -671,12 +672,17 @@ int renesas_sdhi_probe(struct platform_d + if (ret) + goto efree; + ++ ver = sd_ctrl_read16(host, CTL_VERSION); ++ /* GEN2_SDR104 is first known SDHI to use 32bit block count */ ++ if (ver < SDHI_VER_GEN2_SDR104 && mmc_data->max_blk_count > U16_MAX) ++ mmc_data->max_blk_count = U16_MAX; ++ + ret = tmio_mmc_host_probe(host); + if (ret < 0) + goto edisclk; + + /* One Gen2 SDHI incarnation does NOT have a CBSY bit */ +- if (sd_ctrl_read16(host, CTL_VERSION) == SDHI_VER_GEN2_SDR50) ++ if (ver == SDHI_VER_GEN2_SDR50) + mmc_data->flags &= ~TMIO_MMC_HAVE_CBSY; + + /* Enable tuning iff we have an SCC and a supported mode */ diff --git a/queue-4.19/powerpc-vdso64-fix-clock_monotonic-inconsistencies-across-y2038.patch b/queue-4.19/powerpc-vdso64-fix-clock_monotonic-inconsistencies-across-y2038.patch new file mode 100644 index 00000000000..226a0bb340d --- /dev/null +++ b/queue-4.19/powerpc-vdso64-fix-clock_monotonic-inconsistencies-across-y2038.patch @@ -0,0 +1,129 @@ +From b5b4453e7912f056da1ca7572574cada32ecb60c Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Thu, 14 Mar 2019 00:14:38 +1100 +Subject: powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 + +From: Michael Ellerman + +commit b5b4453e7912f056da1ca7572574cada32ecb60c upstream. + +Jakub Drnec reported: + Setting the realtime clock can sometimes make the monotonic clock go + back by over a hundred years. Decreasing the realtime clock across + the y2k38 threshold is one reliable way to reproduce. Allegedly this + can also happen just by running ntpd, I have not managed to + reproduce that other than booting with rtc at >2038 and then running + ntp. When this happens, anything with timers (e.g. openjdk) breaks + rather badly. + +And included a test case (slightly edited for brevity): + #define _POSIX_C_SOURCE 199309L + #include + #include + #include + #include + + long get_time(void) { + struct timespec tp; + clock_gettime(CLOCK_MONOTONIC, &tp); + return tp.tv_sec + tp.tv_nsec / 1000000000; + } + + int main(void) { + long last = get_time(); + while(1) { + long now = get_time(); + if (now < last) { + printf("clock went backwards by %ld seconds!\n", last - now); + } + last = now; + sleep(1); + } + return 0; + } + +Which when run concurrently with: + # date -s 2040-1-1 + # date -s 2037-1-1 + +Will detect the clock going backward. + +The root cause is that wtom_clock_sec in struct vdso_data is only a +32-bit signed value, even though we set its value to be equal to +tk->wall_to_monotonic.tv_sec which is 64-bits. + +Because the monotonic clock starts at zero when the system boots the +wall_to_montonic.tv_sec offset is negative for current and future +dates. Currently on a freshly booted system the offset will be in the +vicinity of negative 1.5 billion seconds. + +However if the wall clock is set past the Y2038 boundary, the offset +from wall to monotonic becomes less than negative 2^31, and no longer +fits in 32-bits. When that value is assigned to wtom_clock_sec it is +truncated and becomes positive, causing the VDSO assembly code to +calculate CLOCK_MONOTONIC incorrectly. + +That causes CLOCK_MONOTONIC to jump ahead by ~4 billion seconds which +it is not meant to do. Worse, if the time is then set back before the +Y2038 boundary CLOCK_MONOTONIC will jump backward. + +We can fix it simply by storing the full 64-bit offset in the +vdso_data, and using that in the VDSO assembly code. We also shuffle +some of the fields in vdso_data to avoid creating a hole. + +The original commit that added the CLOCK_MONOTONIC support to the VDSO +did actually use a 64-bit value for wtom_clock_sec, see commit +a7f290dad32e ("[PATCH] powerpc: Merge vdso's and add vdso support to +32 bits kernel") (Nov 2005). However just 3 days later it was +converted to 32-bits in commit 0c37ec2aa88b ("[PATCH] powerpc: vdso +fixes (take #2)"), and the bug has existed since then AFAICS. + +Fixes: 0c37ec2aa88b ("[PATCH] powerpc: vdso fixes (take #2)") +Cc: stable@vger.kernel.org # v2.6.15+ +Link: http://lkml.kernel.org/r/HaC.ZfES.62bwlnvAvMP.1STMMj@seznam.cz +Reported-by: Jakub Drnec +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/vdso_datapage.h | 8 ++++---- + arch/powerpc/kernel/vdso64/gettimeofday.S | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -82,10 +82,10 @@ struct vdso_data { + __u32 icache_block_size; /* L1 i-cache block size */ + __u32 dcache_log_block_size; /* L1 d-cache log block size */ + __u32 icache_log_block_size; /* L1 i-cache log block size */ +- __s32 wtom_clock_sec; /* Wall to monotonic clock */ +- __s32 wtom_clock_nsec; +- struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ +- __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */ ++ __s64 wtom_clock_sec; /* Wall to monotonic clock sec */ ++ struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -92,7 +92,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + * At this point, r4,r5 contain our sec/nsec values. + */ + +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* We now have our result in r6,r9. We create a fake dependency +@@ -125,7 +125,7 @@ V_FUNCTION_BEGIN(__kernel_clock_gettime) + bne cr6,75f + + /* CLOCK_MONOTONIC_COARSE */ +- lwa r6,WTOM_CLOCK_SEC(r3) ++ ld r6,WTOM_CLOCK_SEC(r3) + lwa r9,WTOM_CLOCK_NSEC(r3) + + /* check if counter has updated */ diff --git a/queue-4.19/udf-fix-crash-on-io-error-during-truncate.patch b/queue-4.19/udf-fix-crash-on-io-error-during-truncate.patch new file mode 100644 index 00000000000..56ca15cd51e --- /dev/null +++ b/queue-4.19/udf-fix-crash-on-io-error-during-truncate.patch @@ -0,0 +1,38 @@ +From d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 11 Mar 2019 15:04:18 +0100 +Subject: udf: Fix crash on IO error during truncate + +From: Jan Kara + +commit d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 upstream. + +When truncate(2) hits IO error when reading indirect extent block the +code just bugs with: + +kernel BUG at linux-4.15.0/fs/udf/truncate.c:249! +... + +Fix the problem by bailing out cleanly in case of IO error. + +CC: stable@vger.kernel.org +Reported-by: jean-luc malet +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/truncate.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/udf/truncate.c ++++ b/fs/udf/truncate.c +@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode * + epos.block = eloc; + epos.bh = udf_tread(sb, + udf_get_lb_pblock(sb, &eloc, 0)); ++ /* Error reading indirect block? */ ++ if (!epos.bh) ++ return; + if (elen) + indirect_ext_len = + (elen + sb->s_blocksize - 1) >>