From: Greg Kroah-Hartman Date: Tue, 12 Sep 2017 16:07:43 +0000 (-0700) Subject: 4.9-stable patches X-Git-Tag: v3.18.71~6 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0187871270f5958e139bdb73ce241830fc998dc7;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch nfs-sync-the-correct-byte-range-during-synchronous-writes.patch --- diff --git a/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch b/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch new file mode 100644 index 00000000000..7465a04ce81 --- /dev/null +++ b/queue-4.9/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch @@ -0,0 +1,49 @@ +From 746a272e44141af24a02f6c9b0f65f4c4598ed42 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Tue, 22 Aug 2017 11:36:17 +0100 +Subject: ARM: 8692/1: mm: abort uaccess retries upon fatal signal + +From: Mark Rutland + +commit 746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream. + +When there's a fatal signal pending, arm's do_page_fault() +implementation returns 0. The intent is that we'll return to the +faulting userspace instruction, delivering the signal on the way. + +However, if we take a fatal signal during fixing up a uaccess, this +results in a return to the faulting kernel instruction, which will be +instantly retried, resulting in the same fault being taken forever. As +the task never reaches userspace, the signal is not delivered, and the +task is left unkillable. While the task is stuck in this state, it can +inhibit the forward progress of the system. + +To avoid this, we must ensure that when a fatal signal is pending, we +apply any necessary fixup for a faulting kernel instruction. Thus we +will return to an error path, and it is up to that code to make forward +progress towards delivering the fatal signal. + +Signed-off-by: Mark Rutland +Reviewed-by: Steve Capper +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/fault.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/arm/mm/fault.c ++++ b/arch/arm/mm/fault.c +@@ -314,8 +314,11 @@ retry: + * signal first. We do not need to release the mmap_sem because + * it would already be released in __lock_page_or_retry in + * mm/filemap.c. */ +- if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) ++ if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) { ++ if (!user_mode(regs)) ++ goto no_context; + return 0; ++ } + + /* + * Major/minor page fault accounting is only done on the diff --git a/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch b/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch new file mode 100644 index 00000000000..a00ff62a0ba --- /dev/null +++ b/queue-4.9/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch @@ -0,0 +1,35 @@ +From 95696d292e204073433ed2ef3ff4d3d8f42a8248 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sat, 1 Jul 2017 15:16:34 +0100 +Subject: ARM64: dts: marvell: armada-37xx: Fix GIC maintenance interrupt + +From: Marc Zyngier + +commit 95696d292e204073433ed2ef3ff4d3d8f42a8248 upstream. + +The GIC-500 integrated in the Armada-37xx SoCs is compliant with +the GICv3 architecture, and thus provides a maintenance interrupt +that is required for hypervisors to function correctly. + +With the interrupt provided in the DT, KVM now works as it should. +Tested on an Espressobin system. + +Fixes: adbc3695d9e4 ("arm64: dts: add the Marvell Armada 3700 family and a development board") +Signed-off-by: Marc Zyngier +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -170,6 +170,7 @@ + interrupt-controller; + reg = <0x1d00000 0x10000>, /* GICD */ + <0x1d40000 0x40000>; /* GICR */ ++ interrupts = ; + }; + }; + diff --git a/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch b/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch new file mode 100644 index 00000000000..b19b41f90ba --- /dev/null +++ b/queue-4.9/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch @@ -0,0 +1,357 @@ +From e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 Mon Sep 17 00:00:00 2001 +From: Ben Seri +Date: Sat, 9 Sep 2017 23:15:59 +0200 +Subject: Bluetooth: Properly check L2CAP config option output buffer length + +From: Ben Seri + +commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream. + +Validate the output buffer length for L2CAP config requests and responses +to avoid overflowing the stack buffer used for building the option blocks. + +Signed-off-by: Ben Seri +Signed-off-by: Marcel Holtmann +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 80 ++++++++++++++++++++++++--------------------- + 1 file changed, 43 insertions(+), 37 deletions(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -58,7 +58,7 @@ static struct sk_buff *l2cap_build_cmd(s + u8 code, u8 ident, u16 dlen, void *data); + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + void *data); +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); + static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); + + static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, +@@ -1473,7 +1473,7 @@ static void l2cap_conn_start(struct l2ca + + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -2977,12 +2977,15 @@ static inline int l2cap_get_conf_opt(voi + return len; + } + +-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) ++static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) + { + struct l2cap_conf_opt *opt = *ptr; + + BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); + ++ if (size < L2CAP_CONF_OPT_SIZE + len) ++ return; ++ + opt->type = type; + opt->len = len; + +@@ -3007,7 +3010,7 @@ static void l2cap_add_conf_opt(void **pt + *ptr += L2CAP_CONF_OPT_SIZE + len; + } + +-static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) ++static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) + { + struct l2cap_conf_efs efs; + +@@ -3035,7 +3038,7 @@ static void l2cap_add_opt_efs(void **ptr + } + + l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, size); + } + + static void l2cap_ack_timeout(struct work_struct *work) +@@ -3181,11 +3184,12 @@ static inline void l2cap_txwin_setup(str + chan->ack_win = chan->tx_win; + } + +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) + { + struct l2cap_conf_req *req = data; + struct l2cap_conf_rfc rfc = { .mode = chan->mode }; + void *ptr = req->data; ++ void *endptr = data + data_size; + u16 size; + + BT_DBG("chan %p", chan); +@@ -3210,7 +3214,7 @@ static int l2cap_build_conf_req(struct l + + done: + if (chan->imtu != L2CAP_DEFAULT_MTU) +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); + + switch (chan->mode) { + case L2CAP_MODE_BASIC: +@@ -3229,7 +3233,7 @@ done: + rfc.max_pdu_size = 0; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_MODE_ERTM: +@@ -3249,21 +3253,21 @@ done: + L2CAP_DEFAULT_TX_WINDOW); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) +- l2cap_add_opt_efs(&ptr, chan); ++ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); + + if (test_bit(FLAG_EXT_CTRL, &chan->flags)) + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, +- chan->tx_win); ++ chan->tx_win, endptr - ptr); + + if (chan->conn->feat_mask & L2CAP_FEAT_FCS) + if (chan->fcs == L2CAP_FCS_NONE || + test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { + chan->fcs = L2CAP_FCS_NONE; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, +- chan->fcs); ++ chan->fcs, endptr - ptr); + } + break; + +@@ -3281,17 +3285,17 @@ done: + rfc.max_pdu_size = cpu_to_le16(size); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) +- l2cap_add_opt_efs(&ptr, chan); ++ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); + + if (chan->conn->feat_mask & L2CAP_FEAT_FCS) + if (chan->fcs == L2CAP_FCS_NONE || + test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { + chan->fcs = L2CAP_FCS_NONE; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, +- chan->fcs); ++ chan->fcs, endptr - ptr); + } + break; + } +@@ -3302,10 +3306,11 @@ done: + return ptr - data; + } + +-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) ++static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) + { + struct l2cap_conf_rsp *rsp = data; + void *ptr = rsp->data; ++ void *endptr = data + data_size; + void *req = chan->conf_req; + int len = chan->conf_len; + int type, hint, olen; +@@ -3407,7 +3412,7 @@ done: + return -ECONNREFUSED; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + } + + if (result == L2CAP_CONF_SUCCESS) { +@@ -3420,7 +3425,7 @@ done: + chan->omtu = mtu; + set_bit(CONF_MTU_DONE, &chan->conf_state); + } +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); + + if (remote_efs) { + if (chan->local_stype != L2CAP_SERV_NOTRAFIC && +@@ -3434,7 +3439,7 @@ done: + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, + sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + } else { + /* Send PENDING Conf Rsp */ + result = L2CAP_CONF_PENDING; +@@ -3467,7 +3472,7 @@ done: + set_bit(CONF_MODE_DONE, &chan->conf_state); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, +- sizeof(rfc), (unsigned long) &rfc); ++ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + chan->remote_id = efs.id; +@@ -3481,7 +3486,7 @@ done: + le32_to_cpu(efs.sdu_itime); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, + sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + } + break; + +@@ -3495,7 +3500,7 @@ done: + set_bit(CONF_MODE_DONE, &chan->conf_state); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + break; + +@@ -3517,10 +3522,11 @@ done: + } + + static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, +- void *data, u16 *result) ++ void *data, size_t size, u16 *result) + { + struct l2cap_conf_req *req = data; + void *ptr = req->data; ++ void *endptr = data + size; + int type, olen; + unsigned long val; + struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; +@@ -3538,13 +3544,13 @@ static int l2cap_parse_conf_rsp(struct l + chan->imtu = L2CAP_DEFAULT_MIN_MTU; + } else + chan->imtu = val; +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); + break; + + case L2CAP_CONF_FLUSH_TO: + chan->flush_to = val; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, +- 2, chan->flush_to); ++ 2, chan->flush_to, endptr - ptr); + break; + + case L2CAP_CONF_RFC: +@@ -3558,13 +3564,13 @@ static int l2cap_parse_conf_rsp(struct l + chan->fcs = 0; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, +- sizeof(rfc), (unsigned long) &rfc); ++ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_CONF_EWS: + chan->ack_win = min_t(u16, val, chan->ack_win); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, +- chan->tx_win); ++ chan->tx_win, endptr - ptr); + break; + + case L2CAP_CONF_EFS: +@@ -3577,7 +3583,7 @@ static int l2cap_parse_conf_rsp(struct l + return -ECONNREFUSED; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + break; + + case L2CAP_CONF_FCS: +@@ -3682,7 +3688,7 @@ void __l2cap_connect_rsp_defer(struct l2 + return; + + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -3890,7 +3896,7 @@ sendresp: + u8 buf[128]; + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -3968,7 +3974,7 @@ static int l2cap_connect_create_rsp(stru + break; + + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, req), req); ++ l2cap_build_conf_req(chan, req, sizeof(req)), req); + chan->num_conf_req++; + break; + +@@ -4080,7 +4086,7 @@ static inline int l2cap_config_req(struc + } + + /* Complete config. */ +- len = l2cap_parse_conf_req(chan, rsp); ++ len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto unlock; +@@ -4114,7 +4120,7 @@ static inline int l2cap_config_req(struc + if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { + u8 buf[64]; + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -4174,7 +4180,7 @@ static inline int l2cap_config_rsp(struc + char buf[64]; + + len = l2cap_parse_conf_rsp(chan, rsp->data, len, +- buf, &result); ++ buf, sizeof(buf), &result); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto done; +@@ -4204,7 +4210,7 @@ static inline int l2cap_config_rsp(struc + /* throw out any old stored conf requests */ + result = L2CAP_CONF_SUCCESS; + len = l2cap_parse_conf_rsp(chan, rsp->data, len, +- req, &result); ++ req, sizeof(req), &result); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto done; +@@ -4781,7 +4787,7 @@ static void l2cap_do_create(struct l2cap + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), + L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + } +@@ -7457,7 +7463,7 @@ static void l2cap_security_cfm(struct hc + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), + L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), + buf); + chan->num_conf_req++; + } diff --git a/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch b/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch new file mode 100644 index 00000000000..ccb65a12bc8 --- /dev/null +++ b/queue-4.9/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch @@ -0,0 +1,118 @@ +From 196639ebbe63a037fe9a80669140bd292d8bcd80 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 8 Sep 2017 21:28:11 -0400 +Subject: NFS: Fix 2 use after free issues in the I/O code + +From: Trond Myklebust + +commit 196639ebbe63a037fe9a80669140bd292d8bcd80 upstream. + +The writeback code wants to send a commit after processing the pages, +which is why we want to delay releasing the struct path until after +that's done. + +Also, the layout code expects that we do not free the inode before +we've put the layout segments in pnfs_writehdr_free() and +pnfs_readhdr_free() + +Fixes: 919e3bd9a875 ("NFS: Ensure we commit after writeback is complete") +Fixes: 4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/internal.h | 1 - + fs/nfs/pagelist.c | 26 ++++++++++++-------------- + fs/nfs/pnfs.c | 2 -- + 3 files changed, 12 insertions(+), 17 deletions(-) + +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -248,7 +248,6 @@ int nfs_iocounter_wait(struct nfs_lock_c + extern const struct nfs_pageio_ops nfs_pgio_rw_ops; + struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *); + void nfs_pgio_header_free(struct nfs_pgio_header *); +-void nfs_pgio_data_destroy(struct nfs_pgio_header *); + int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *); + int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr, + struct rpc_cred *cred, const struct nfs_rpc_ops *rpc_ops, +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -497,16 +497,6 @@ struct nfs_pgio_header *nfs_pgio_header_ + } + EXPORT_SYMBOL_GPL(nfs_pgio_header_alloc); + +-/* +- * nfs_pgio_header_free - Free a read or write header +- * @hdr: The header to free +- */ +-void nfs_pgio_header_free(struct nfs_pgio_header *hdr) +-{ +- hdr->rw_ops->rw_free_header(hdr); +-} +-EXPORT_SYMBOL_GPL(nfs_pgio_header_free); +- + /** + * nfs_pgio_data_destroy - make @hdr suitable for reuse + * +@@ -515,14 +505,24 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free); + * + * @hdr: A header that has had nfs_generic_pgio called + */ +-void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) ++static void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) + { + if (hdr->args.context) + put_nfs_open_context(hdr->args.context); + if (hdr->page_array.pagevec != hdr->page_array.page_array) + kfree(hdr->page_array.pagevec); + } +-EXPORT_SYMBOL_GPL(nfs_pgio_data_destroy); ++ ++/* ++ * nfs_pgio_header_free - Free a read or write header ++ * @hdr: The header to free ++ */ ++void nfs_pgio_header_free(struct nfs_pgio_header *hdr) ++{ ++ nfs_pgio_data_destroy(hdr); ++ hdr->rw_ops->rw_free_header(hdr); ++} ++EXPORT_SYMBOL_GPL(nfs_pgio_header_free); + + /** + * nfs_pgio_rpcsetup - Set up arguments for a pageio call +@@ -636,7 +636,6 @@ EXPORT_SYMBOL_GPL(nfs_initiate_pgio); + static void nfs_pgio_error(struct nfs_pgio_header *hdr) + { + set_bit(NFS_IOHDR_REDO, &hdr->flags); +- nfs_pgio_data_destroy(hdr); + hdr->completion_ops->completion(hdr); + } + +@@ -647,7 +646,6 @@ static void nfs_pgio_error(struct nfs_pg + static void nfs_pgio_release(void *calldata) + { + struct nfs_pgio_header *hdr = calldata; +- nfs_pgio_data_destroy(hdr); + hdr->completion_ops->completion(hdr); + } + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2145,7 +2145,6 @@ pnfs_write_through_mds(struct nfs_pageio + nfs_pageio_reset_write_mds(desc); + mirror->pg_recoalesce = 1; + } +- nfs_pgio_data_destroy(hdr); + hdr->release(hdr); + } + +@@ -2257,7 +2256,6 @@ pnfs_read_through_mds(struct nfs_pageio_ + nfs_pageio_reset_read_mds(desc); + mirror->pg_recoalesce = 1; + } +- nfs_pgio_data_destroy(hdr); + hdr->release(hdr); + } + diff --git a/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch b/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch new file mode 100644 index 00000000000..0b2202c0770 --- /dev/null +++ b/queue-4.9/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch @@ -0,0 +1,49 @@ +From e973b1a5999e57da677ab50da5f5479fdc0f0c31 Mon Sep 17 00:00:00 2001 +From: "tarangg@amazon.com" +Date: Thu, 7 Sep 2017 09:29:23 -0400 +Subject: NFS: Sync the correct byte range during synchronous writes + +From: tarangg@amazon.com + +commit e973b1a5999e57da677ab50da5f5479fdc0f0c31 upstream. + +Since commit 18290650b1c8 ("NFS: Move buffered I/O locking into +nfs_file_write()") nfs_file_write() has not flushed the correct byte +range during synchronous writes. generic_write_sync() expects that +iocb->ki_pos points to the right edge of the range rather than the +left edge. + +To replicate the problem, open a file with O_DSYNC, have the client +write at increasing offsets, and then print the successful offsets. +Block port 2049 partway through that sequence, and observe that the +client application indicates successful writes in advance of what the +server received. + +Fixes: 18290650b1c8 ("NFS: Move buffered I/O locking into nfs_file_write()") +Signed-off-by: Jacob Strauss +Signed-off-by: Tarang Gupta +Tested-by: Tarang Gupta +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/file.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -636,11 +636,11 @@ ssize_t nfs_file_write(struct kiocb *ioc + if (result <= 0) + goto out; + +- result = generic_write_sync(iocb, result); +- if (result < 0) +- goto out; + written = result; + iocb->ki_pos += written; ++ result = generic_write_sync(iocb, written); ++ if (result < 0) ++ goto out; + + /* Return error values */ + if (nfs_need_check_write(file, inode)) { diff --git a/queue-4.9/series b/queue-4.9/series index 9061ecd30f8..66702afcbb5 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -7,3 +7,8 @@ selftests-x86-fsgsbase-test-selectors-1-2-and-3.patch mm-memory.c-fix-mem_cgroup_oom_disable-call-missing.patch locktorture-fix-potential-memory-leak-with-rw-lock-test.patch alsa-msnd-optimize-harden-dsp-and-midi-loops.patch +bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch +arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch +arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch +nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch +nfs-sync-the-correct-byte-range-during-synchronous-writes.patch