From: Greg Kroah-Hartman Date: Tue, 27 Mar 2018 08:29:54 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.15.14~12 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e5c81de04d39369fe94fe612cc3133273bd27e05;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: iio-abi-fix-name-of-timestamp-sysfs-file.patch iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch staging-android-ion-zero-cma-allocated-memory.patch staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch usb-xhci-disable-slot-even-when-virt-dev-is-null.patch usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch --- diff --git a/queue-4.14/iio-abi-fix-name-of-timestamp-sysfs-file.patch b/queue-4.14/iio-abi-fix-name-of-timestamp-sysfs-file.patch new file mode 100644 index 00000000000..0f4eb805787 --- /dev/null +++ b/queue-4.14/iio-abi-fix-name-of-timestamp-sysfs-file.patch @@ -0,0 +1,33 @@ +From b9a3589332c2a25fb7edad25a26fcaada3209126 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Tue, 5 Dec 2017 11:57:27 +0100 +Subject: iio: ABI: Fix name of timestamp sysfs file + +From: Linus Walleij + +commit b9a3589332c2a25fb7edad25a26fcaada3209126 upstream. + +The name of the file is "current_timetamp_clock" not +"timestamp_clock". + +Fixes: bc2b7dab629a ("iio:core: timestamping clock selection support") +Cc: Gregor Boirie +Signed-off-by: Linus Walleij +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/ABI/testing/sysfs-bus-iio | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -32,7 +32,7 @@ Description: + Description of the physical chip / device for device X. + Typically a part number. + +-What: /sys/bus/iio/devices/iio:deviceX/timestamp_clock ++What: /sys/bus/iio/devices/iio:deviceX/current_timestamp_clock + KernelVersion: 4.5 + Contact: linux-iio@vger.kernel.org + Description: diff --git a/queue-4.14/iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch b/queue-4.14/iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch new file mode 100644 index 00000000000..73357f30281 --- /dev/null +++ b/queue-4.14/iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch @@ -0,0 +1,32 @@ +From 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Mon, 1 Jan 2018 19:54:42 +0100 +Subject: iio: imu: st_lsm6dsx: fix endianness in st_lsm6dsx_read_oneshot() + +From: Lorenzo Bianconi + +commit 7b9ebe428266fb7e0a6d769bb3ff3fcb6044b15e upstream. + +Apply le16_to_cpu() to data read from the sensor in order to take into +account architecture endianness + +Fixes: 290a6ce11d93 (iio: imu: add support to lsm6dsx driver) +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -392,7 +392,7 @@ static int st_lsm6dsx_read_oneshot(struc + + st_lsm6dsx_sensor_disable(sensor); + +- *val = (s16)data; ++ *val = (s16)le16_to_cpu(data); + + return IIO_VAL_INT; + } diff --git a/queue-4.14/series b/queue-4.14/series index 257dd471d7f..a6809a6e7fb 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -89,3 +89,9 @@ perf-stat-fix-cvs-output-format-for-non-supported-counters.patch perf-core-fix-ctx_event_type-in-ctx_resched.patch perf-x86-intel-don-t-accidentally-clear-high-bits-in-bdw_limit_period.patch perf-x86-intel-uncore-fix-multi-domain-pci-cha-enumeration-bug-on-skylake-servers.patch +iio-abi-fix-name-of-timestamp-sysfs-file.patch +iio-imu-st_lsm6dsx-fix-endianness-in-st_lsm6dsx_read_oneshot.patch +staging-android-ion-zero-cma-allocated-memory.patch +staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch +usb-xhci-disable-slot-even-when-virt-dev-is-null.patch +usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch diff --git a/queue-4.14/staging-android-ion-zero-cma-allocated-memory.patch b/queue-4.14/staging-android-ion-zero-cma-allocated-memory.patch new file mode 100644 index 00000000000..70a3e79711c --- /dev/null +++ b/queue-4.14/staging-android-ion-zero-cma-allocated-memory.patch @@ -0,0 +1,58 @@ +From 6d79bd5bb6c79a9dba4842040c9adf39e7806330 Mon Sep 17 00:00:00 2001 +From: Liam Mark +Date: Fri, 26 Jan 2018 09:48:18 -0800 +Subject: staging: android: ion: Zero CMA allocated memory + +From: Liam Mark + +commit 6d79bd5bb6c79a9dba4842040c9adf39e7806330 upstream. + +Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") +the CMA API is now used directly and therefore the allocated memory is no +longer automatically zeroed. + +Explicitly zero CMA allocated memory to ensure that no data is exposed to +userspace. + +Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") +Signed-off-by: Liam Mark +Acked-by: Laura Abbott +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/android/ion/ion_cma_heap.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/drivers/staging/android/ion/ion_cma_heap.c ++++ b/drivers/staging/android/ion/ion_cma_heap.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "ion.h" + +@@ -51,6 +52,22 @@ static int ion_cma_allocate(struct ion_h + if (!pages) + return -ENOMEM; + ++ if (PageHighMem(pages)) { ++ unsigned long nr_clear_pages = nr_pages; ++ struct page *page = pages; ++ ++ while (nr_clear_pages > 0) { ++ void *vaddr = kmap_atomic(page); ++ ++ memset(vaddr, 0, PAGE_SIZE); ++ kunmap_atomic(vaddr); ++ page++; ++ nr_clear_pages--; ++ } ++ } else { ++ memset(page_address(pages), 0, size); ++ } ++ + table = kmalloc(sizeof(*table), GFP_KERNEL); + if (!table) + goto err; diff --git a/queue-4.14/staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch b/queue-4.14/staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch new file mode 100644 index 00000000000..c7353e25c8d --- /dev/null +++ b/queue-4.14/staging-lustre-ptlrpc-kfree-used-instead-of-kvfree.patch @@ -0,0 +1,40 @@ +From c3eec59659cf25916647d2178c541302bb4822ad Mon Sep 17 00:00:00 2001 +From: Nadav Amit +Date: Tue, 5 Sep 2017 20:25:25 +0000 +Subject: staging: lustre: ptlrpc: kfree used instead of kvfree + +From: Nadav Amit + +commit c3eec59659cf25916647d2178c541302bb4822ad upstream. + +rq_reqbuf is allocated using kvmalloc() but released in one occasion +using kfree() instead of kvfree(). + +The issue was found using grep based on a similar bug. + +Fixes: d7e09d0397e8 ("add Lustre file system client support") +Fixes: ee0ec1946ec2 ("lustre: ptlrpc: Replace uses of OBD_{ALLOC,FREE}_LARGE") + +Cc: Peng Tao +Cc: Oleg Drokin +Cc: James Simmons + +Signed-off-by: Nadav Amit +Signed-off-by: Andreas Dilger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/lustre/lustre/ptlrpc/sec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/ptlrpc/sec.c ++++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c +@@ -847,7 +847,7 @@ void sptlrpc_request_out_callback(struct + if (req->rq_pool || !req->rq_reqbuf) + return; + +- kfree(req->rq_reqbuf); ++ kvfree(req->rq_reqbuf); + req->rq_reqbuf = NULL; + req->rq_reqbuf_len = 0; + } diff --git a/queue-4.14/usb-xhci-disable-slot-even-when-virt-dev-is-null.patch b/queue-4.14/usb-xhci-disable-slot-even-when-virt-dev-is-null.patch new file mode 100644 index 00000000000..c71f2dcb690 --- /dev/null +++ b/queue-4.14/usb-xhci-disable-slot-even-when-virt-dev-is-null.patch @@ -0,0 +1,57 @@ +From b64149ca016c25f30b39ac5a8f37cfb9017e19bb Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Thu, 5 Oct 2017 11:21:40 +0300 +Subject: usb: xhci: Disable slot even when virt-dev is null + +From: Lu Baolu + +commit b64149ca016c25f30b39ac5a8f37cfb9017e19bb upstream. + +xhci_disable_slot() is a helper for disabling a slot when a device +goes away or recovers from error situations. Currently, it checks +the corespoding virt-dev pointer and returns directly (w/o issuing +disable slot command) if it's null. + +This is unnecessary and will cause problems in case where virt-dev +allocation fails and xhci_disable_slot() is called to roll back the +hardware state. Refer to the implementation of xhci_alloc_dev(). + +This patch removes lines to check virt-dev in xhci_disable_slot(). + +Fixes: f9e609b82479 ("usb: xhci: Add helper function xhci_disable_slot().") +Cc: Guoqing Zhang +Signed-off-by: Lu Baolu +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 3 +++ + drivers/usb/host/xhci.c | 4 ---- + 2 files changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -634,6 +634,9 @@ static int xhci_enter_test_mode(struct x + xhci_dbg(xhci, "Disable all slots\n"); + spin_unlock_irqrestore(&xhci->lock, *flags); + for (i = 1; i <= HCS_MAX_SLOTS(xhci->hcs_params1); i++) { ++ if (!xhci->devs[i]) ++ continue; ++ + retval = xhci_disable_slot(xhci, NULL, i); + if (retval) + xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3571,11 +3571,7 @@ int xhci_disable_slot(struct xhci_hcd *x + unsigned long flags; + u32 state; + int ret = 0; +- struct xhci_virt_device *virt_dev; + +- virt_dev = xhci->devs[slot_id]; +- if (!virt_dev) +- return -EINVAL; + if (!command) + command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); + if (!command) diff --git a/queue-4.14/usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch b/queue-4.14/usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch new file mode 100644 index 00000000000..24d8fb045c8 --- /dev/null +++ b/queue-4.14/usb-xhci-fix-potential-memory-leak-in-xhci_disable_slot.patch @@ -0,0 +1,145 @@ +From cd3f1790b006d91786728c20a01da21ee277aff1 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Thu, 5 Oct 2017 11:21:41 +0300 +Subject: usb: xhci: Fix potential memory leak in xhci_disable_slot() + +From: Lu Baolu + +commit cd3f1790b006d91786728c20a01da21ee277aff1 upstream. + +xhci_disable_slot() allows the invoker to pass a command pointer +as paramenter. Otherwise, it will allocate one. This will cause +memory leak when a command structure was allocated inside of this +function while queuing command trb fails. Another problem comes up +when the invoker passed a command pointer, but xhci_disable_slot() +frees it when it detects a dead host. + +This patch fixes these two problems by removing the command parameter +from xhci_disable_slot(). + +Fixes: f9e609b82479 ("usb: xhci: Add helper function xhci_disable_slot().") +Cc: Guoqing Zhang +Signed-off-by: Lu Baolu +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/host/xhci-hub.c | 2 +- + drivers/usb/host/xhci.c | 30 +++++++++--------------------- + drivers/usb/host/xhci.h | 3 +-- + 3 files changed, 11 insertions(+), 24 deletions(-) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -637,7 +637,7 @@ static int xhci_enter_test_mode(struct x + if (!xhci->devs[i]) + continue; + +- retval = xhci_disable_slot(xhci, NULL, i); ++ retval = xhci_disable_slot(xhci, i); + if (retval) + xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", + i, retval); +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3523,11 +3523,6 @@ static void xhci_free_dev(struct usb_hcd + struct xhci_virt_device *virt_dev; + struct xhci_slot_ctx *slot_ctx; + int i, ret; +- struct xhci_command *command; +- +- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); +- if (!command) +- return; + + #ifndef CONFIG_USB_DEFAULT_PERSIST + /* +@@ -3543,10 +3538,8 @@ static void xhci_free_dev(struct usb_hcd + /* If the host is halted due to driver unload, we still need to free the + * device. + */ +- if (ret <= 0 && ret != -ENODEV) { +- kfree(command); ++ if (ret <= 0 && ret != -ENODEV) + return; +- } + + virt_dev = xhci->devs[udev->slot_id]; + slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx); +@@ -3558,22 +3551,21 @@ static void xhci_free_dev(struct usb_hcd + del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); + } + +- xhci_disable_slot(xhci, command, udev->slot_id); ++ xhci_disable_slot(xhci, udev->slot_id); + /* + * Event command completion handler will free any data structures + * associated with the slot. XXX Can free sleep? + */ + } + +-int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command, +- u32 slot_id) ++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) + { ++ struct xhci_command *command; + unsigned long flags; + u32 state; + int ret = 0; + +- if (!command) +- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); ++ command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); + if (!command) + return -ENOMEM; + +@@ -3591,7 +3583,7 @@ int xhci_disable_slot(struct xhci_hcd *x + slot_id); + if (ret) { + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "FIXME: allocate a command ring segment\n"); ++ kfree(command); + return ret; + } + xhci_ring_cmd_db(xhci); +@@ -3666,6 +3658,8 @@ int xhci_alloc_dev(struct usb_hcd *hcd, + return 0; + } + ++ xhci_free_command(xhci, command); ++ + if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) { + spin_lock_irqsave(&xhci->lock, flags); + ret = xhci_reserve_host_control_ep_resources(xhci); +@@ -3701,18 +3695,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, + pm_runtime_get_noresume(hcd->self.controller); + #endif + +- +- xhci_free_command(xhci, command); + /* Is this a LS or FS device under a HS hub? */ + /* Hub or peripherial? */ + return 1; + + disable_slot: +- /* Disable slot, if we can do it without mem alloc */ +- kfree(command->completion); +- command->completion = NULL; +- command->status = 0; +- return xhci_disable_slot(xhci, command, udev->slot_id); ++ return xhci_disable_slot(xhci, udev->slot_id); + } + + /* +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2014,8 +2014,7 @@ int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); +-int xhci_disable_slot(struct xhci_hcd *xhci, +- struct xhci_command *command, u32 slot_id); ++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); + + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); + int xhci_resume(struct xhci_hcd *xhci, bool hibernated);