4.9-stable patches

added patches:
	arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch
	arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch
	bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
	nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch
	nfs-sync-the-correct-byte-range-during-synchronous-writes.patch

diff --git a/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch b/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch
new file mode 100644 (file)
index 0000000..7465a04
--- /dev/null
+++ b/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch
@@ -0,0 +1,49 @@
+From 746a272e44141af24a02f6c9b0f65f4c4598ed42 Mon Sep 17 00:00:00 2001
+From: Mark Rutland <mark.rutland@arm.com>
+Date: Tue, 22 Aug 2017 11:36:17 +0100
+Subject: ARM: 8692/1: mm: abort uaccess retries upon fatal signal
+
+From: Mark Rutland <mark.rutland@arm.com>
+
+commit 746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream.
+
+When there's a fatal signal pending, arm's do_page_fault()
+implementation returns 0. The intent is that we'll return to the
+faulting userspace instruction, delivering the signal on the way.
+
+However, if we take a fatal signal during fixing up a uaccess, this
+results in a return to the faulting kernel instruction, which will be
+instantly retried, resulting in the same fault being taken forever. As
+the task never reaches userspace, the signal is not delivered, and the
+task is left unkillable. While the task is stuck in this state, it can
+inhibit the forward progress of the system.
+
+To avoid this, we must ensure that when a fatal signal is pending, we
+apply any necessary fixup for a faulting kernel instruction. Thus we
+will return to an error path, and it is up to that code to make forward
+progress towards delivering the fatal signal.
+
+Signed-off-by: Mark Rutland <mark.rutland@arm.com>
+Reviewed-by: Steve Capper <steve.capper@arm.com>
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mm/fault.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/mm/fault.c
++++ b/arch/arm/mm/fault.c
+@@ -314,8 +314,11 @@ retry:
+        * signal first. We do not need to release the mmap_sem because
+        * it would already be released in __lock_page_or_retry in
+        * mm/filemap.c. */
+-      if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
++      if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) {
++              if (!user_mode(regs))
++                      goto no_context;
+               return 0;
++      }
+ 
+       /*
+        * Major/minor page fault accounting is only done on the

diff --git a/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch b/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch
new file mode 100644 (file)
index 0000000..a00ff62
--- /dev/null
+++ b/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch
@@ -0,0 +1,35 @@
+From 95696d292e204073433ed2ef3ff4d3d8f42a8248 Mon Sep 17 00:00:00 2001
+From: Marc Zyngier <marc.zyngier@arm.com>
+Date: Sat, 1 Jul 2017 15:16:34 +0100
+Subject: ARM64: dts: marvell: armada-37xx: Fix GIC maintenance interrupt
+
+From: Marc Zyngier <marc.zyngier@arm.com>
+
+commit 95696d292e204073433ed2ef3ff4d3d8f42a8248 upstream.
+
+The GIC-500 integrated in the Armada-37xx SoCs is compliant with
+the GICv3 architecture, and thus provides a maintenance interrupt
+that is required for hypervisors to function correctly.
+
+With the interrupt provided in the DT, KVM now works as it should.
+Tested on an Espressobin system.
+
+Fixes: adbc3695d9e4 ("arm64: dts: add the Marvell Armada 3700 family and a development board")
+Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
+Signed-off-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/boot/dts/marvell/armada-37xx.dtsi |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi
+@@ -170,6 +170,7 @@
+                               interrupt-controller;
+                               reg = <0x1d00000 0x10000>, /* GICD */
+                                     <0x1d40000 0x40000>; /* GICR */
++                              interrupts = <GIC_PPI 9 IRQ_TYPE_LEVEL_HIGH>;
+                       };
+               };
+ 

diff --git a/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch b/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
new file mode 100644 (file)
index 0000000..b19b41f
--- /dev/null
+++ b/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
@@ -0,0 +1,357 @@
+From e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 Mon Sep 17 00:00:00 2001
+From: Ben Seri <ben@armis.com>
+Date: Sat, 9 Sep 2017 23:15:59 +0200
+Subject: Bluetooth: Properly check L2CAP config option output buffer length
+
+From: Ben Seri <ben@armis.com>
+
+commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream.
+
+Validate the output buffer length for L2CAP config requests and responses
+to avoid overflowing the stack buffer used for building the option blocks.
+
+Signed-off-by: Ben Seri <ben@armis.com>
+Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bluetooth/l2cap_core.c |   80 ++++++++++++++++++++++++---------------------
+ 1 file changed, 43 insertions(+), 37 deletions(-)
+
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -58,7 +58,7 @@ static struct sk_buff *l2cap_build_cmd(s
+                                      u8 code, u8 ident, u16 dlen, void *data);
+ static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
+                          void *data);
+-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
+ static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
+ 
+ static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
+@@ -1473,7 +1473,7 @@ static void l2cap_conn_start(struct l2ca
+ 
+                       set_bit(CONF_REQ_SENT, &chan->conf_state);
+                       l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+-                                     l2cap_build_conf_req(chan, buf), buf);
++                                     l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+                       chan->num_conf_req++;
+               }
+ 
+@@ -2977,12 +2977,15 @@ static inline int l2cap_get_conf_opt(voi
+       return len;
+ }
+ 
+-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
++static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
+ {
+       struct l2cap_conf_opt *opt = *ptr;
+ 
+       BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
+ 
++      if (size < L2CAP_CONF_OPT_SIZE + len)
++              return;
++
+       opt->type = type;
+       opt->len  = len;
+ 
+@@ -3007,7 +3010,7 @@ static void l2cap_add_conf_opt(void **pt
+       *ptr += L2CAP_CONF_OPT_SIZE + len;
+ }
+ 
+-static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
++static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
+ {
+       struct l2cap_conf_efs efs;
+ 
+@@ -3035,7 +3038,7 @@ static void l2cap_add_opt_efs(void **ptr
+       }
+ 
+       l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
+-                         (unsigned long) &efs);
++                         (unsigned long) &efs, size);
+ }
+ 
+ static void l2cap_ack_timeout(struct work_struct *work)
+@@ -3181,11 +3184,12 @@ static inline void l2cap_txwin_setup(str
+       chan->ack_win = chan->tx_win;
+ }
+ 
+-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
+ {
+       struct l2cap_conf_req *req = data;
+       struct l2cap_conf_rfc rfc = { .mode = chan->mode };
+       void *ptr = req->data;
++      void *endptr = data + data_size;
+       u16 size;
+ 
+       BT_DBG("chan %p", chan);
+@@ -3210,7 +3214,7 @@ static int l2cap_build_conf_req(struct l
+ 
+ done:
+       if (chan->imtu != L2CAP_DEFAULT_MTU)
+-              l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
++              l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
+ 
+       switch (chan->mode) {
+       case L2CAP_MODE_BASIC:
+@@ -3229,7 +3233,7 @@ done:
+               rfc.max_pdu_size    = 0;
+ 
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+-                                 (unsigned long) &rfc);
++                                 (unsigned long) &rfc, endptr - ptr);
+               break;
+ 
+       case L2CAP_MODE_ERTM:
+@@ -3249,21 +3253,21 @@ done:
+                                      L2CAP_DEFAULT_TX_WINDOW);
+ 
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+-                                 (unsigned long) &rfc);
++                                 (unsigned long) &rfc, endptr - ptr);
+ 
+               if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
+-                      l2cap_add_opt_efs(&ptr, chan);
++                      l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
+ 
+               if (test_bit(FLAG_EXT_CTRL, &chan->flags))
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
+-                                         chan->tx_win);
++                                         chan->tx_win, endptr - ptr);
+ 
+               if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
+                       if (chan->fcs == L2CAP_FCS_NONE ||
+                           test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
+                               chan->fcs = L2CAP_FCS_NONE;
+                               l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
+-                                                 chan->fcs);
++                                                 chan->fcs, endptr - ptr);
+                       }
+               break;
+ 
+@@ -3281,17 +3285,17 @@ done:
+               rfc.max_pdu_size = cpu_to_le16(size);
+ 
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+-                                 (unsigned long) &rfc);
++                                 (unsigned long) &rfc, endptr - ptr);
+ 
+               if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
+-                      l2cap_add_opt_efs(&ptr, chan);
++                      l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
+ 
+               if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
+                       if (chan->fcs == L2CAP_FCS_NONE ||
+                           test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
+                               chan->fcs = L2CAP_FCS_NONE;
+                               l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
+-                                                 chan->fcs);
++                                                 chan->fcs, endptr - ptr);
+                       }
+               break;
+       }
+@@ -3302,10 +3306,11 @@ done:
+       return ptr - data;
+ }
+ 
+-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
++static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
+ {
+       struct l2cap_conf_rsp *rsp = data;
+       void *ptr = rsp->data;
++      void *endptr = data + data_size;
+       void *req = chan->conf_req;
+       int len = chan->conf_len;
+       int type, hint, olen;
+@@ -3407,7 +3412,7 @@ done:
+                       return -ECONNREFUSED;
+ 
+               l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+-                                 (unsigned long) &rfc);
++                                 (unsigned long) &rfc, endptr - ptr);
+       }
+ 
+       if (result == L2CAP_CONF_SUCCESS) {
+@@ -3420,7 +3425,7 @@ done:
+                       chan->omtu = mtu;
+                       set_bit(CONF_MTU_DONE, &chan->conf_state);
+               }
+-              l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
++              l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
+ 
+               if (remote_efs) {
+                       if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
+@@ -3434,7 +3439,7 @@ done:
+ 
+                               l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
+                                                  sizeof(efs),
+-                                                 (unsigned long) &efs);
++                                                 (unsigned long) &efs, endptr - ptr);
+                       } else {
+                               /* Send PENDING Conf Rsp */
+                               result = L2CAP_CONF_PENDING;
+@@ -3467,7 +3472,7 @@ done:
+                       set_bit(CONF_MODE_DONE, &chan->conf_state);
+ 
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+-                                         sizeof(rfc), (unsigned long) &rfc);
++                                         sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
+ 
+                       if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
+                               chan->remote_id = efs.id;
+@@ -3481,7 +3486,7 @@ done:
+                                       le32_to_cpu(efs.sdu_itime);
+                               l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
+                                                  sizeof(efs),
+-                                                 (unsigned long) &efs);
++                                                 (unsigned long) &efs, endptr - ptr);
+                       }
+                       break;
+ 
+@@ -3495,7 +3500,7 @@ done:
+                       set_bit(CONF_MODE_DONE, &chan->conf_state);
+ 
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
+-                                         (unsigned long) &rfc);
++                                         (unsigned long) &rfc, endptr - ptr);
+ 
+                       break;
+ 
+@@ -3517,10 +3522,11 @@ done:
+ }
+ 
+ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
+-                              void *data, u16 *result)
++                              void *data, size_t size, u16 *result)
+ {
+       struct l2cap_conf_req *req = data;
+       void *ptr = req->data;
++      void *endptr = data + size;
+       int type, olen;
+       unsigned long val;
+       struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
+@@ -3538,13 +3544,13 @@ static int l2cap_parse_conf_rsp(struct l
+                               chan->imtu = L2CAP_DEFAULT_MIN_MTU;
+                       } else
+                               chan->imtu = val;
+-                      l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
++                      l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr);
+                       break;
+ 
+               case L2CAP_CONF_FLUSH_TO:
+                       chan->flush_to = val;
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
+-                                         2, chan->flush_to);
++                                         2, chan->flush_to, endptr - ptr);
+                       break;
+ 
+               case L2CAP_CONF_RFC:
+@@ -3558,13 +3564,13 @@ static int l2cap_parse_conf_rsp(struct l
+                       chan->fcs = 0;
+ 
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+-                                         sizeof(rfc), (unsigned long) &rfc);
++                                         sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
+                       break;
+ 
+               case L2CAP_CONF_EWS:
+                       chan->ack_win = min_t(u16, val, chan->ack_win);
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
+-                                         chan->tx_win);
++                                         chan->tx_win, endptr - ptr);
+                       break;
+ 
+               case L2CAP_CONF_EFS:
+@@ -3577,7 +3583,7 @@ static int l2cap_parse_conf_rsp(struct l
+                               return -ECONNREFUSED;
+ 
+                       l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
+-                                         (unsigned long) &efs);
++                                         (unsigned long) &efs, endptr - ptr);
+                       break;
+ 
+               case L2CAP_CONF_FCS:
+@@ -3682,7 +3688,7 @@ void __l2cap_connect_rsp_defer(struct l2
+               return;
+ 
+       l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+-                     l2cap_build_conf_req(chan, buf), buf);
++                     l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+       chan->num_conf_req++;
+ }
+ 
+@@ -3890,7 +3896,7 @@ sendresp:
+               u8 buf[128];
+               set_bit(CONF_REQ_SENT, &chan->conf_state);
+               l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+-                             l2cap_build_conf_req(chan, buf), buf);
++                             l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+               chan->num_conf_req++;
+       }
+ 
+@@ -3968,7 +3974,7 @@ static int l2cap_connect_create_rsp(stru
+                       break;
+ 
+               l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+-                             l2cap_build_conf_req(chan, req), req);
++                             l2cap_build_conf_req(chan, req, sizeof(req)), req);
+               chan->num_conf_req++;
+               break;
+ 
+@@ -4080,7 +4086,7 @@ static inline int l2cap_config_req(struc
+       }
+ 
+       /* Complete config. */
+-      len = l2cap_parse_conf_req(chan, rsp);
++      len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
+       if (len < 0) {
+               l2cap_send_disconn_req(chan, ECONNRESET);
+               goto unlock;
+@@ -4114,7 +4120,7 @@ static inline int l2cap_config_req(struc
+       if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
+               u8 buf[64];
+               l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
+-                             l2cap_build_conf_req(chan, buf), buf);
++                             l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+               chan->num_conf_req++;
+       }
+ 
+@@ -4174,7 +4180,7 @@ static inline int l2cap_config_rsp(struc
+                       char buf[64];
+ 
+                       len = l2cap_parse_conf_rsp(chan, rsp->data, len,
+-                                                 buf, &result);
++                                                 buf, sizeof(buf), &result);
+                       if (len < 0) {
+                               l2cap_send_disconn_req(chan, ECONNRESET);
+                               goto done;
+@@ -4204,7 +4210,7 @@ static inline int l2cap_config_rsp(struc
+                       /* throw out any old stored conf requests */
+                       result = L2CAP_CONF_SUCCESS;
+                       len = l2cap_parse_conf_rsp(chan, rsp->data, len,
+-                                                 req, &result);
++                                                 req, sizeof(req), &result);
+                       if (len < 0) {
+                               l2cap_send_disconn_req(chan, ECONNRESET);
+                               goto done;
+@@ -4781,7 +4787,7 @@ static void l2cap_do_create(struct l2cap
+                       set_bit(CONF_REQ_SENT, &chan->conf_state);
+                       l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
+                                      L2CAP_CONF_REQ,
+-                                     l2cap_build_conf_req(chan, buf), buf);
++                                     l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
+                       chan->num_conf_req++;
+               }
+       }
+@@ -7457,7 +7463,7 @@ static void l2cap_security_cfm(struct hc
+                               set_bit(CONF_REQ_SENT, &chan->conf_state);
+                               l2cap_send_cmd(conn, l2cap_get_ident(conn),
+                                              L2CAP_CONF_REQ,
+-                                             l2cap_build_conf_req(chan, buf),
++                                             l2cap_build_conf_req(chan, buf, sizeof(buf)),
+                                              buf);
+                               chan->num_conf_req++;
+                       }

diff --git a/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch b/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch
new file mode 100644 (file)
index 0000000..ccb65a1
--- /dev/null
+++ b/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch
@@ -0,0 +1,118 @@
+From 196639ebbe63a037fe9a80669140bd292d8bcd80 Mon Sep 17 00:00:00 2001
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+Date: Fri, 8 Sep 2017 21:28:11 -0400
+Subject: NFS: Fix 2 use after free issues in the I/O code
+
+From: Trond Myklebust <trond.myklebust@primarydata.com>
+
+commit 196639ebbe63a037fe9a80669140bd292d8bcd80 upstream.
+
+The writeback code wants to send a commit after processing the pages,
+which is why we want to delay releasing the struct path until after
+that's done.
+
+Also, the layout code expects that we do not free the inode before
+we've put the layout segments in pnfs_writehdr_free() and
+pnfs_readhdr_free()
+
+Fixes: 919e3bd9a875 ("NFS: Ensure we commit after writeback is complete")
+Fixes: 4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup")
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/internal.h |    1 -
+ fs/nfs/pagelist.c |   26 ++++++++++++--------------
+ fs/nfs/pnfs.c     |    2 --
+ 3 files changed, 12 insertions(+), 17 deletions(-)
+
+--- a/fs/nfs/internal.h
++++ b/fs/nfs/internal.h
+@@ -248,7 +248,6 @@ int nfs_iocounter_wait(struct nfs_lock_c
+ extern const struct nfs_pageio_ops nfs_pgio_rw_ops;
+ struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *);
+ void nfs_pgio_header_free(struct nfs_pgio_header *);
+-void nfs_pgio_data_destroy(struct nfs_pgio_header *);
+ int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *);
+ int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr,
+                     struct rpc_cred *cred, const struct nfs_rpc_ops *rpc_ops,
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -497,16 +497,6 @@ struct nfs_pgio_header *nfs_pgio_header_
+ }
+ EXPORT_SYMBOL_GPL(nfs_pgio_header_alloc);
+ 
+-/*
+- * nfs_pgio_header_free - Free a read or write header
+- * @hdr: The header to free
+- */
+-void nfs_pgio_header_free(struct nfs_pgio_header *hdr)
+-{
+-      hdr->rw_ops->rw_free_header(hdr);
+-}
+-EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
+-
+ /**
+  * nfs_pgio_data_destroy - make @hdr suitable for reuse
+  *
+@@ -515,14 +505,24 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
+  *
+  * @hdr: A header that has had nfs_generic_pgio called
+  */
+-void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr)
++static void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr)
+ {
+       if (hdr->args.context)
+               put_nfs_open_context(hdr->args.context);
+       if (hdr->page_array.pagevec != hdr->page_array.page_array)
+               kfree(hdr->page_array.pagevec);
+ }
+-EXPORT_SYMBOL_GPL(nfs_pgio_data_destroy);
++
++/*
++ * nfs_pgio_header_free - Free a read or write header
++ * @hdr: The header to free
++ */
++void nfs_pgio_header_free(struct nfs_pgio_header *hdr)
++{
++      nfs_pgio_data_destroy(hdr);
++      hdr->rw_ops->rw_free_header(hdr);
++}
++EXPORT_SYMBOL_GPL(nfs_pgio_header_free);
+ 
+ /**
+  * nfs_pgio_rpcsetup - Set up arguments for a pageio call
+@@ -636,7 +636,6 @@ EXPORT_SYMBOL_GPL(nfs_initiate_pgio);
+ static void nfs_pgio_error(struct nfs_pgio_header *hdr)
+ {
+       set_bit(NFS_IOHDR_REDO, &hdr->flags);
+-      nfs_pgio_data_destroy(hdr);
+       hdr->completion_ops->completion(hdr);
+ }
+ 
+@@ -647,7 +646,6 @@ static void nfs_pgio_error(struct nfs_pg
+ static void nfs_pgio_release(void *calldata)
+ {
+       struct nfs_pgio_header *hdr = calldata;
+-      nfs_pgio_data_destroy(hdr);
+       hdr->completion_ops->completion(hdr);
+ }
+ 
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -2145,7 +2145,6 @@ pnfs_write_through_mds(struct nfs_pageio
+               nfs_pageio_reset_write_mds(desc);
+               mirror->pg_recoalesce = 1;
+       }
+-      nfs_pgio_data_destroy(hdr);
+       hdr->release(hdr);
+ }
+ 
+@@ -2257,7 +2256,6 @@ pnfs_read_through_mds(struct nfs_pageio_
+               nfs_pageio_reset_read_mds(desc);
+               mirror->pg_recoalesce = 1;
+       }
+-      nfs_pgio_data_destroy(hdr);
+       hdr->release(hdr);
+ }
+ 

diff --git a/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch b/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch
new file mode 100644 (file)
index 0000000..0b2202c
--- /dev/null
+++ b/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch
@@ -0,0 +1,49 @@
+From e973b1a5999e57da677ab50da5f5479fdc0f0c31 Mon Sep 17 00:00:00 2001
+From: "tarangg@amazon.com" <tarangg@amazon.com>
+Date: Thu, 7 Sep 2017 09:29:23 -0400
+Subject: NFS: Sync the correct byte range during synchronous writes
+
+From: tarangg@amazon.com <tarangg@amazon.com>
+
+commit e973b1a5999e57da677ab50da5f5479fdc0f0c31 upstream.
+
+Since commit 18290650b1c8 ("NFS: Move buffered I/O locking into
+nfs_file_write()") nfs_file_write() has not flushed the correct byte
+range during synchronous writes.  generic_write_sync() expects that
+iocb->ki_pos points to the right edge of the range rather than the
+left edge.
+
+To replicate the problem, open a file with O_DSYNC, have the client
+write at increasing offsets, and then print the successful offsets.
+Block port 2049 partway through that sequence, and observe that the
+client application indicates successful writes in advance of what the
+server received.
+
+Fixes: 18290650b1c8 ("NFS: Move buffered I/O locking into nfs_file_write()")
+Signed-off-by: Jacob Strauss <jsstraus@amazon.com>
+Signed-off-by: Tarang Gupta <tarangg@amazon.com>
+Tested-by: Tarang Gupta <tarangg@amazon.com>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/file.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/nfs/file.c
++++ b/fs/nfs/file.c
+@@ -636,11 +636,11 @@ ssize_t nfs_file_write(struct kiocb *ioc
+       if (result <= 0)
+               goto out;
+ 
+-      result = generic_write_sync(iocb, result);
+-      if (result < 0)
+-              goto out;
+       written = result;
+       iocb->ki_pos += written;
++      result = generic_write_sync(iocb, written);
++      if (result < 0)
++              goto out;
+ 
+       /* Return error values */
+       if (nfs_need_check_write(file, inode)) {

diff --git a/queue-4.9/series b/queue-4.9/series
index 9061ecd30f89a1dfdecd2e08d21227d31b2c46b7..66702afcbb53e171f3155468695c488be2dabd14 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -7,3 +7,8 @@ selftests-x86-fsgsbase-test-selectors-1-2-and-3.patch
 mm-memory.c-fix-mem_cgroup_oom_disable-call-missing.patch
 locktorture-fix-potential-memory-leak-with-rw-lock-test.patch
 alsa-msnd-optimize-harden-dsp-and-midi-loops.patch
+bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch
+arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch
+arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch
+nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch
+nfs-sync-the-correct-byte-range-during-synchronous-writes.patch