4.4-stable patches

added patches:
	block-do-not-leak-memory-in-bio_copy_user_iov.patch
	genirq-respect-irqchip_skip_set_wake-in-irq_chip_set_wake_parent.patch

diff --git a/queue-4.4/block-do-not-leak-memory-in-bio_copy_user_iov.patch b/queue-4.4/block-do-not-leak-memory-in-bio_copy_user_iov.patch
new file mode 100644 (file)
index 0000000..33261da
--- /dev/null
+++ b/queue-4.4/block-do-not-leak-memory-in-bio_copy_user_iov.patch
@@ -0,0 +1,42 @@
+From a3761c3c91209b58b6f33bf69dd8bb8ec0c9d925 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>
+Date: Wed, 10 Apr 2019 16:27:51 -0400
+Subject: block: do not leak memory in bio_copy_user_iov()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Jérôme Glisse <jglisse@redhat.com>
+
+commit a3761c3c91209b58b6f33bf69dd8bb8ec0c9d925 upstream.
+
+When bio_add_pc_page() fails in bio_copy_user_iov() we should free
+the page we just allocated otherwise we are leaking it.
+
+Cc: linux-block@vger.kernel.org
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: stable@vger.kernel.org
+Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
+Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/bio.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/block/bio.c
++++ b/block/bio.c
+@@ -1216,8 +1216,11 @@ struct bio *bio_copy_user_iov(struct req
+                       }
+               }
+ 
+-              if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes)
++              if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) {
++                      if (!map_data)
++                              __free_page(page);
+                       break;
++              }
+ 
+               len -= bytes;
+               offset = 0;

diff --git a/queue-4.4/genirq-respect-irqchip_skip_set_wake-in-irq_chip_set_wake_parent.patch b/queue-4.4/genirq-respect-irqchip_skip_set_wake-in-irq_chip_set_wake_parent.patch
new file mode 100644 (file)
index 0000000..7c91a25
--- /dev/null
+++ b/queue-4.4/genirq-respect-irqchip_skip_set_wake-in-irq_chip_set_wake_parent.patch
@@ -0,0 +1,69 @@
+From 325aa19598e410672175ed50982f902d4e3f31c5 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <swboyd@chromium.org>
+Date: Mon, 25 Mar 2019 11:10:26 -0700
+Subject: genirq: Respect IRQCHIP_SKIP_SET_WAKE in irq_chip_set_wake_parent()
+
+From: Stephen Boyd <swboyd@chromium.org>
+
+commit 325aa19598e410672175ed50982f902d4e3f31c5 upstream.
+
+If a child irqchip calls irq_chip_set_wake_parent() but its parent irqchip
+has the IRQCHIP_SKIP_SET_WAKE flag set an error is returned.
+
+This is inconsistent behaviour vs. set_irq_wake_real() which returns 0 when
+the irqchip has the IRQCHIP_SKIP_SET_WAKE flag set. It doesn't attempt to
+walk the chain of parents and set irq wake on any chips that don't have the
+flag set either. If the intent is to call the .irq_set_wake() callback of
+the parent irqchip, then we expect irqchip implementations to omit the
+IRQCHIP_SKIP_SET_WAKE flag and implement an .irq_set_wake() function that
+calls irq_chip_set_wake_parent().
+
+The problem has been observed on a Qualcomm sdm845 device where set wake
+fails on any GPIO interrupts after applying work in progress wakeup irq
+patches to the GPIO driver. The chain of chips looks like this:
+
+     QCOM GPIO -> QCOM PDC (SKIP) -> ARM GIC (SKIP)
+
+The GPIO controllers parent is the QCOM PDC irqchip which in turn has ARM
+GIC as parent.  The QCOM PDC irqchip has the IRQCHIP_SKIP_SET_WAKE flag
+set, and so does the grandparent ARM GIC.
+
+The GPIO driver doesn't know if the parent needs to set wake or not, so it
+unconditionally calls irq_chip_set_wake_parent() causing this function to
+return a failure because the parent irqchip (PDC) doesn't have the
+.irq_set_wake() callback set. Returning 0 instead makes everything work and
+irqs from the GPIO controller can be configured for wakeup.
+
+Make it consistent by returning 0 (success) from irq_chip_set_wake_parent()
+when a parent chip has IRQCHIP_SKIP_SET_WAKE set.
+
+[ tglx: Massaged changelog ]
+
+Fixes: 08b55e2a9208e ("genirq: Add irqchip_set_wake_parent")
+Signed-off-by: Stephen Boyd <swboyd@chromium.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Marc Zyngier <marc.zyngier@arm.com>
+Cc: linux-arm-kernel@lists.infradead.org
+Cc: linux-gpio@vger.kernel.org
+Cc: Lina Iyer <ilina@codeaurora.org>
+Cc: stable@vger.kernel.org
+Link: https://lkml.kernel.org/r/20190325181026.247796-1-swboyd@chromium.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/irq/chip.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -1056,6 +1056,10 @@ int irq_chip_set_vcpu_affinity_parent(st
+ int irq_chip_set_wake_parent(struct irq_data *data, unsigned int on)
+ {
+       data = data->parent_data;
++
++      if (data->chip->flags & IRQCHIP_SKIP_SET_WAKE)
++              return 0;
++
+       if (data->chip->irq_set_wake)
+               return data->chip->irq_set_wake(data, on);
+ 

diff --git a/queue-4.4/series b/queue-4.4/series
index 72a187f94958c2e4d56643334fb9bfe8438fe160..1135fa2e2d1ccbfe9840b36124152b9f0b2cf3af 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -87,3 +87,5 @@ ip6_tunnel-match-to-arphrd_tunnel6-for-dev-type.patch
 alsa-seq-fix-oob-reads-from-strlcpy.patch
 include-linux-bitrev.h-fix-constant-bitrev.patch
 asoc-fsl_esai-fix-channel-swap-issue-when-stream-starts.patch
+block-do-not-leak-memory-in-bio_copy_user_iov.patch
+genirq-respect-irqchip_skip_set_wake-in-irq_chip_set_wake_parent.patch