From: Greg Kroah-Hartman Date: Sun, 24 Mar 2019 19:36:54 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.9.166~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe37e0cf74a9ffea8047a4a38618a339a5ce6235;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch mips-ensure-elf-appended-dtb-is-relocated.patch mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch mmc-pxamci-fix-enum-type-confusion.patch udf-fix-crash-on-io-error-during-truncate.patch --- diff --git a/queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch b/queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch new file mode 100644 index 00000000000..dbda65d2a05 --- /dev/null +++ b/queue-4.14/drm-vmwgfx-don-t-double-free-the-mode-stored-in-par-set_mode.patch @@ -0,0 +1,64 @@ +From c2d311553855395764e2e5bf401d987ba65c2056 Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Mon, 18 Mar 2019 15:47:58 +0100 +Subject: drm/vmwgfx: Don't double-free the mode stored in par->set_mode + +From: Thomas Zimmermann + +commit c2d311553855395764e2e5bf401d987ba65c2056 upstream. + +When calling vmw_fb_set_par(), the mode stored in par->set_mode gets free'd +twice. The first free is in vmw_fb_kms_detach(), the second is near the +end of vmw_fb_set_par() under the name of 'old_mode'. The mode-setting code +only works correctly if the mode doesn't actually change. Removing +'old_mode' in favor of using par->set_mode directly fixes the problem. + +Cc: +Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2") +Signed-off-by: Thomas Zimmermann +Reviewed-by: Deepak Rawat +Signed-off-by: Thomas Hellstrom +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -588,11 +588,9 @@ static int vmw_fb_set_par(struct fb_info + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC) + }; +- struct drm_display_mode *old_mode; + struct drm_display_mode *mode; + int ret; + +- old_mode = par->set_mode; + mode = drm_mode_duplicate(vmw_priv->dev, &new_mode); + if (!mode) { + DRM_ERROR("Could not create new fb mode.\n"); +@@ -603,11 +601,7 @@ static int vmw_fb_set_par(struct fb_info + mode->vdisplay = var->yres; + vmw_guess_mode_timing(mode); + +- if (old_mode && drm_mode_equal(old_mode, mode)) { +- drm_mode_destroy(vmw_priv->dev, mode); +- mode = old_mode; +- old_mode = NULL; +- } else if (!vmw_kms_validate_mode_vram(vmw_priv, ++ if (!vmw_kms_validate_mode_vram(vmw_priv, + mode->hdisplay * + DIV_ROUND_UP(var->bits_per_pixel, 8), + mode->vdisplay)) { +@@ -677,8 +671,8 @@ static int vmw_fb_set_par(struct fb_info + schedule_delayed_work(&par->local_work, 0); + + out_unlock: +- if (old_mode) +- drm_mode_destroy(vmw_priv->dev, old_mode); ++ if (par->set_mode) ++ drm_mode_destroy(vmw_priv->dev, par->set_mode); + par->set_mode = mode; + + drm_modeset_unlock_all(vmw_priv->dev); diff --git a/queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch b/queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch new file mode 100644 index 00000000000..d95e55fda5a --- /dev/null +++ b/queue-4.14/iommu-amd-fix-sg-dma_address-for-sg-offset-bigger-than-page_size.patch @@ -0,0 +1,78 @@ +From 4e50ce03976fbc8ae995a000c4b10c737467beaa Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Wed, 13 Mar 2019 10:03:17 +0100 +Subject: iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE + +From: Stanislaw Gruszka + +commit 4e50ce03976fbc8ae995a000c4b10c737467beaa upstream. + +Take into account that sg->offset can be bigger than PAGE_SIZE when +setting segment sg->dma_address. Otherwise sg->dma_address will point +at diffrent page, what makes DMA not possible with erros like this: + +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa70c0 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7040 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7080 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7100 flags=0x0020] +xhci_hcd 0000:38:00.3: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0000 address=0x00000000fdaa7000 flags=0x0020] + +Additinally with wrong sg->dma_address unmap_sg will free wrong pages, +what what can cause crashes like this: + +Feb 28 19:27:45 kernel: BUG: Bad page state in process cinnamon pfn:39e8b1 +Feb 28 19:27:45 kernel: Disabling lock debugging due to kernel taint +Feb 28 19:27:45 kernel: flags: 0x2ffff0000000000() +Feb 28 19:27:45 kernel: raw: 02ffff0000000000 0000000000000000 ffffffff00000301 0000000000000000 +Feb 28 19:27:45 kernel: raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 +Feb 28 19:27:45 kernel: page dumped because: nonzero _refcount +Feb 28 19:27:45 kernel: Modules linked in: ccm fuse arc4 nct6775 hwmon_vid amdgpu nls_iso8859_1 nls_cp437 edac_mce_amd vfat fat kvm_amd ccp rng_core kvm mt76x0u mt76x0_common mt76x02_usb irqbypass mt76_usb mt76x02_lib mt76 crct10dif_pclmul crc32_pclmul chash mac80211 amd_iommu_v2 ghash_clmulni_intel gpu_sched i2c_algo_bit ttm wmi_bmof snd_hda_codec_realtek snd_hda_codec_generic drm_kms_helper snd_hda_codec_hdmi snd_hda_intel drm snd_hda_codec aesni_intel snd_hda_core snd_hwdep aes_x86_64 crypto_simd snd_pcm cfg80211 cryptd mousedev snd_timer glue_helper pcspkr r8169 input_leds realtek agpgart libphy rfkill snd syscopyarea sysfillrect sysimgblt fb_sys_fops soundcore sp5100_tco k10temp i2c_piix4 wmi evdev gpio_amdpt pinctrl_amd mac_hid pcc_cpufreq acpi_cpufreq sg ip_tables x_tables ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) fscrypto(E) sd_mod(E) hid_generic(E) usbhid(E) hid(E) dm_mod(E) serio_raw(E) atkbd(E) libps2(E) crc32c_intel(E) ahci(E) libahci(E) libata(E) xhci_pci(E) xhci_hcd(E) +Feb 28 19:27:45 kernel: scsi_mod(E) i8042(E) serio(E) bcache(E) crc64(E) +Feb 28 19:27:45 kernel: CPU: 2 PID: 896 Comm: cinnamon Tainted: G B W E 4.20.12-arch1-1-custom #1 +Feb 28 19:27:45 kernel: Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B450M Pro4, BIOS P1.20 06/26/2018 +Feb 28 19:27:45 kernel: Call Trace: +Feb 28 19:27:45 kernel: dump_stack+0x5c/0x80 +Feb 28 19:27:45 kernel: bad_page.cold.29+0x7f/0xb2 +Feb 28 19:27:45 kernel: __free_pages_ok+0x2c0/0x2d0 +Feb 28 19:27:45 kernel: skb_release_data+0x96/0x180 +Feb 28 19:27:45 kernel: __kfree_skb+0xe/0x20 +Feb 28 19:27:45 kernel: tcp_recvmsg+0x894/0xc60 +Feb 28 19:27:45 kernel: ? reuse_swap_page+0x120/0x340 +Feb 28 19:27:45 kernel: ? ptep_set_access_flags+0x23/0x30 +Feb 28 19:27:45 kernel: inet_recvmsg+0x5b/0x100 +Feb 28 19:27:45 kernel: __sys_recvfrom+0xc3/0x180 +Feb 28 19:27:45 kernel: ? handle_mm_fault+0x10a/0x250 +Feb 28 19:27:45 kernel: ? syscall_trace_enter+0x1d3/0x2d0 +Feb 28 19:27:45 kernel: ? __audit_syscall_exit+0x22a/0x290 +Feb 28 19:27:45 kernel: __x64_sys_recvfrom+0x24/0x30 +Feb 28 19:27:45 kernel: do_syscall_64+0x5b/0x170 +Feb 28 19:27:45 kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Cc: stable@vger.kernel.org +Reported-and-tested-by: Jan Viktorin +Reviewed-by: Alexander Duyck +Signed-off-by: Stanislaw Gruszka +Fixes: 80187fd39dcb ('iommu/amd: Optimize map_sg and unmap_sg') +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2548,7 +2548,12 @@ static int map_sg(struct device *dev, st + + /* Everything is mapped - write the right values into s->dma_address */ + for_each_sg(sglist, s, nelems, i) { +- s->dma_address += address + s->offset; ++ /* ++ * Add in the remaining piece of the scatter-gather offset that ++ * was masked out when we were determining the physical address ++ * via (sg_phys(s) & PAGE_MASK) earlier. ++ */ ++ s->dma_address += address + (s->offset & ~PAGE_MASK); + s->dma_length = s->length; + } + diff --git a/queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch b/queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch new file mode 100644 index 00000000000..1c9e406be82 --- /dev/null +++ b/queue-4.14/libceph-wait-for-latest-osdmap-in-ceph_monc_blacklist_add.patch @@ -0,0 +1,95 @@ +From bb229bbb3bf63d23128e851a1f3b85c083178fa1 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Wed, 20 Mar 2019 09:46:58 +0100 +Subject: libceph: wait for latest osdmap in ceph_monc_blacklist_add() + +From: Ilya Dryomov + +commit bb229bbb3bf63d23128e851a1f3b85c083178fa1 upstream. + +Because map updates are distributed lazily, an OSD may not know about +the new blacklist for quite some time after "osd blacklist add" command +is completed. This makes it possible for a blacklisted but still alive +client to overwrite a post-blacklist update, resulting in data +corruption. + +Waiting for latest osdmap in ceph_monc_blacklist_add() and thus using +the post-blacklist epoch for all post-blacklist requests ensures that +all such requests "wait" for the blacklist to come into force on their +respective OSDs. + +Cc: stable@vger.kernel.org +Fixes: 6305a3b41515 ("libceph: support for blacklisting clients") +Signed-off-by: Ilya Dryomov +Reviewed-by: Jason Dillaman +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/ceph/libceph.h | 2 ++ + net/ceph/ceph_common.c | 18 +++++++++++++++++- + net/ceph/mon_client.c | 9 +++++++++ + 3 files changed, 28 insertions(+), 1 deletion(-) + +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -291,6 +291,8 @@ extern void ceph_destroy_client(struct c + extern int __ceph_open_session(struct ceph_client *client, + unsigned long started); + extern int ceph_open_session(struct ceph_client *client); ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout); + + /* pagevec.c */ + extern void ceph_release_page_vector(struct page **pages, int num_pages); +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -720,7 +720,6 @@ int __ceph_open_session(struct ceph_clie + } + EXPORT_SYMBOL(__ceph_open_session); + +- + int ceph_open_session(struct ceph_client *client) + { + int ret; +@@ -736,6 +735,23 @@ int ceph_open_session(struct ceph_client + } + EXPORT_SYMBOL(ceph_open_session); + ++int ceph_wait_for_latest_osdmap(struct ceph_client *client, ++ unsigned long timeout) ++{ ++ u64 newest_epoch; ++ int ret; ++ ++ ret = ceph_monc_get_version(&client->monc, "osdmap", &newest_epoch); ++ if (ret) ++ return ret; ++ ++ if (client->osdc.osdmap->epoch >= newest_epoch) ++ return 0; ++ ++ ceph_osdc_maybe_request_map(&client->osdc); ++ return ceph_monc_wait_osdmap(&client->monc, newest_epoch, timeout); ++} ++EXPORT_SYMBOL(ceph_wait_for_latest_osdmap); + + static int __init init_ceph_lib(void) + { +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -922,6 +922,15 @@ int ceph_monc_blacklist_add(struct ceph_ + mutex_unlock(&monc->mutex); + + ret = wait_generic_request(req); ++ if (!ret) ++ /* ++ * Make sure we have the osdmap that includes the blacklist ++ * entry. This is needed to ensure that the OSDs pick up the ++ * new blacklist before processing any future requests from ++ * this client. ++ */ ++ ret = ceph_wait_for_latest_osdmap(monc->client, 0); ++ + out: + put_generic_request(req); + return ret; diff --git a/queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch b/queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch new file mode 100644 index 00000000000..c6cbe486282 --- /dev/null +++ b/queue-4.14/mips-ensure-elf-appended-dtb-is-relocated.patch @@ -0,0 +1,61 @@ +From 3f0a53bc6482fb09770982a8447981260ea258dc Mon Sep 17 00:00:00 2001 +From: Yasha Cherikovsky +Date: Fri, 8 Mar 2019 14:58:51 +0200 +Subject: MIPS: Ensure ELF appended dtb is relocated + +From: Yasha Cherikovsky + +commit 3f0a53bc6482fb09770982a8447981260ea258dc upstream. + +This fixes booting with the combination of CONFIG_RELOCATABLE=y +and CONFIG_MIPS_ELF_APPENDED_DTB=y. + +Sections that appear after the relocation table are not relocated +on system boot (except .bss, which has special handling). + +With CONFIG_MIPS_ELF_APPENDED_DTB, the dtb is part of the +vmlinux ELF, so it must be relocated together with everything else. + +Fixes: 069fd766271d ("MIPS: Reserve space for relocation table") +Signed-off-by: Yasha Cherikovsky +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: Paul Burton +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org # v4.7+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/vmlinux.lds.S | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/arch/mips/kernel/vmlinux.lds.S ++++ b/arch/mips/kernel/vmlinux.lds.S +@@ -140,6 +140,13 @@ SECTIONS + PERCPU_SECTION(1 << CONFIG_MIPS_L1_CACHE_SHIFT) + #endif + ++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB ++ .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { ++ *(.appended_dtb) ++ KEEP(*(.appended_dtb)) ++ } ++#endif ++ + #ifdef CONFIG_RELOCATABLE + . = ALIGN(4); + +@@ -164,11 +171,6 @@ SECTIONS + __appended_dtb = .; + /* leave space for appended DTB */ + . += 0x100000; +-#elif defined(CONFIG_MIPS_ELF_APPENDED_DTB) +- .appended_dtb : AT(ADDR(.appended_dtb) - LOAD_OFFSET) { +- *(.appended_dtb) +- KEEP(*(.appended_dtb)) +- } + #endif + /* + * Align to 64K in attempt to eliminate holes before the diff --git a/queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch b/queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch new file mode 100644 index 00000000000..b87e0f31291 --- /dev/null +++ b/queue-4.14/mips-fix-kernel-crash-for-r6-in-jump-label-branch-function.patch @@ -0,0 +1,51 @@ +From 47c25036b60f27b86ab44b66a8861bcf81cde39b Mon Sep 17 00:00:00 2001 +From: Archer Yan +Date: Fri, 8 Mar 2019 03:29:19 +0000 +Subject: MIPS: Fix kernel crash for R6 in jump label branch function + +From: Archer Yan + +commit 47c25036b60f27b86ab44b66a8861bcf81cde39b upstream. + +Insert Branch instruction instead of NOP to make sure assembler don't +patch code in forbidden slot. In jump label function, it might +be possible to patch Control Transfer Instructions(CTIs) into +forbidden slot, which will generate Reserved Instruction exception +in MIPS release 6. + +Signed-off-by: Archer Yan +Reviewed-by: Paul Burton +[paul.burton@mips.com: + - Add MIPS prefix to subject. + - Mark for stable from v4.0, which introduced r6 support, onwards.] +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: stable@vger.kernel.org # v4.0+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/include/asm/jump_label.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/mips/include/asm/jump_label.h ++++ b/arch/mips/include/asm/jump_label.h +@@ -21,15 +21,15 @@ + #endif + + #ifdef CONFIG_CPU_MICROMIPS +-#define NOP_INSN "nop32" ++#define B_INSN "b32" + #else +-#define NOP_INSN "nop" ++#define B_INSN "b" + #endif + + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) + { +- asm_volatile_goto("1:\t" NOP_INSN "\n\t" +- "nop\n\t" ++ asm_volatile_goto("1:\t" B_INSN " 2f\n\t" ++ "2:\tnop\n\t" + ".pushsection __jump_table, \"aw\"\n\t" + WORD_INSN " 1b, %l[l_yes], %0\n\t" + ".popsection\n\t" diff --git a/queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch b/queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch new file mode 100644 index 00000000000..bd77afaa6f6 --- /dev/null +++ b/queue-4.14/mips-loongson64-lemote-2f-add-irqf_no_suspend-to-cascade-irqaction.patch @@ -0,0 +1,49 @@ +From 5f5f67da9781770df0403269bc57d7aae608fecd Mon Sep 17 00:00:00 2001 +From: Yifeng Li +Date: Tue, 5 Mar 2019 06:00:22 +0800 +Subject: mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction. + +From: Yifeng Li + +commit 5f5f67da9781770df0403269bc57d7aae608fecd upstream. + +Timekeeping IRQs from CS5536 MFGPT are routed to i8259, which then +triggers the "cascade" IRQ on MIPS CPU. Without IRQF_NO_SUSPEND in +cascade_irqaction, MFGPT interrupts will be masked in suspend mode, +and the machine would be unable to resume once suspended. + +Previously, MIPS IRQs were not disabled properly, so the original +code appeared to work. Commit a3e6c1eff5 ("MIPS: IRQ: Fix disable_irq on +CPU IRQs") uncovers the bug. To fix it, add IRQF_NO_SUSPEND to +cascade_irqaction. + +This commit is functionally identical to 0add9c2f1cff ("MIPS: +Loongson-3: Add IRQF_NO_SUSPEND to Cascade irqaction"), but it forgot +to apply the same fix to Loongson2. + +Signed-off-by: Yifeng Li +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Jiaxun Yang +Cc: Huacai Chen +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-kernel@vger.kernel.org +Cc: stable@vger.kernel.org # v3.19+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/loongson64/lemote-2f/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/loongson64/lemote-2f/irq.c ++++ b/arch/mips/loongson64/lemote-2f/irq.c +@@ -103,7 +103,7 @@ static struct irqaction ip6_irqaction = + static struct irqaction cascade_irqaction = { + .handler = no_action, + .name = "cascade", +- .flags = IRQF_NO_THREAD, ++ .flags = IRQF_NO_THREAD | IRQF_NO_SUSPEND, + }; + + void __init mach_init_irq(void) diff --git a/queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch b/queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch new file mode 100644 index 00000000000..0b0ed09f174 --- /dev/null +++ b/queue-4.14/mmc-pxamci-fix-enum-type-confusion.patch @@ -0,0 +1,47 @@ +From e60a582bcde01158a64ff948fb799f21f5d31a11 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 7 Mar 2019 11:09:19 +0100 +Subject: mmc: pxamci: fix enum type confusion + +From: Arnd Bergmann + +commit e60a582bcde01158a64ff948fb799f21f5d31a11 upstream. + +clang points out several instances of mismatched types in this drivers, +all coming from a single declaration: + +drivers/mmc/host/pxamci.c:193:15: error: implicit conversion from enumeration type 'enum dma_transfer_direction' to + different enumeration type 'enum dma_data_direction' [-Werror,-Wenum-conversion] + direction = DMA_DEV_TO_MEM; + ~ ^~~~~~~~~~~~~~ +drivers/mmc/host/pxamci.c:212:62: error: implicit conversion from enumeration type 'enum dma_data_direction' to + different enumeration type 'enum dma_transfer_direction' [-Werror,-Wenum-conversion] + tx = dmaengine_prep_slave_sg(chan, data->sg, host->dma_len, direction, + +The behavior is correct, so this must be a simply typo from +dma_data_direction and dma_transfer_direction being similarly named +types with a similar purpose. + +Fixes: 6464b7140951 ("mmc: pxamci: switch over to dmaengine use") +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Acked-by: Robert Jarzmik +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/pxamci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -181,7 +181,7 @@ static void pxamci_dma_irq(void *param); + static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data) + { + struct dma_async_tx_descriptor *tx; +- enum dma_data_direction direction; ++ enum dma_transfer_direction direction; + struct dma_slave_config config; + struct dma_chan *chan; + unsigned int nob = data->blocks; diff --git a/queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch b/queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch new file mode 100644 index 00000000000..56ca15cd51e --- /dev/null +++ b/queue-4.14/udf-fix-crash-on-io-error-during-truncate.patch @@ -0,0 +1,38 @@ +From d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 11 Mar 2019 15:04:18 +0100 +Subject: udf: Fix crash on IO error during truncate + +From: Jan Kara + +commit d3ca4651d05c0ff7259d087d8c949bcf3e14fb46 upstream. + +When truncate(2) hits IO error when reading indirect extent block the +code just bugs with: + +kernel BUG at linux-4.15.0/fs/udf/truncate.c:249! +... + +Fix the problem by bailing out cleanly in case of IO error. + +CC: stable@vger.kernel.org +Reported-by: jean-luc malet +Signed-off-by: Jan Kara +Signed-off-by: Greg Kroah-Hartman + +--- + fs/udf/truncate.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/udf/truncate.c ++++ b/fs/udf/truncate.c +@@ -260,6 +260,9 @@ void udf_truncate_extents(struct inode * + epos.block = eloc; + epos.bh = udf_tread(sb, + udf_get_lb_pblock(sb, &eloc, 0)); ++ /* Error reading indirect block? */ ++ if (!epos.bh) ++ return; + if (elen) + indirect_ext_len = + (elen + sb->s_blocksize - 1) >>