From: Greg Kroah-Hartman Date: Tue, 12 Sep 2017 16:07:23 +0000 (-0700) Subject: 4.13-stable patches X-Git-Tag: v3.18.71~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=281b111bc532f950e1316ca86a9e95956fcfe170;p=thirdparty%2Fkernel%2Fstable-queue.git 4.13-stable patches added patches: arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch nfs-sync-the-correct-byte-range-during-synchronous-writes.patch nfsv4-fix-up-mirror-allocation.patch rt2800-fix-tx_pin_cfg-setting-for-non-mt7620-chips.patch --- diff --git a/queue-4.13/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch b/queue-4.13/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch new file mode 100644 index 00000000000..d9a47f19c27 --- /dev/null +++ b/queue-4.13/arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch @@ -0,0 +1,49 @@ +From 746a272e44141af24a02f6c9b0f65f4c4598ed42 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Tue, 22 Aug 2017 11:36:17 +0100 +Subject: ARM: 8692/1: mm: abort uaccess retries upon fatal signal + +From: Mark Rutland + +commit 746a272e44141af24a02f6c9b0f65f4c4598ed42 upstream. + +When there's a fatal signal pending, arm's do_page_fault() +implementation returns 0. The intent is that we'll return to the +faulting userspace instruction, delivering the signal on the way. + +However, if we take a fatal signal during fixing up a uaccess, this +results in a return to the faulting kernel instruction, which will be +instantly retried, resulting in the same fault being taken forever. As +the task never reaches userspace, the signal is not delivered, and the +task is left unkillable. While the task is stuck in this state, it can +inhibit the forward progress of the system. + +To avoid this, we must ensure that when a fatal signal is pending, we +apply any necessary fixup for a faulting kernel instruction. Thus we +will return to an error path, and it is up to that code to make forward +progress towards delivering the fatal signal. + +Signed-off-by: Mark Rutland +Reviewed-by: Steve Capper +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mm/fault.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/arm/mm/fault.c ++++ b/arch/arm/mm/fault.c +@@ -315,8 +315,11 @@ retry: + * signal first. We do not need to release the mmap_sem because + * it would already be released in __lock_page_or_retry in + * mm/filemap.c. */ +- if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) ++ if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) { ++ if (!user_mode(regs)) ++ goto no_context; + return 0; ++ } + + /* + * Major/minor page fault accounting is only done on the diff --git a/queue-4.13/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch b/queue-4.13/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch new file mode 100644 index 00000000000..bc547f4eeca --- /dev/null +++ b/queue-4.13/arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch @@ -0,0 +1,35 @@ +From 95696d292e204073433ed2ef3ff4d3d8f42a8248 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Sat, 1 Jul 2017 15:16:34 +0100 +Subject: ARM64: dts: marvell: armada-37xx: Fix GIC maintenance interrupt + +From: Marc Zyngier + +commit 95696d292e204073433ed2ef3ff4d3d8f42a8248 upstream. + +The GIC-500 integrated in the Armada-37xx SoCs is compliant with +the GICv3 architecture, and thus provides a maintenance interrupt +that is required for hypervisors to function correctly. + +With the interrupt provided in the DT, KVM now works as it should. +Tested on an Espressobin system. + +Fixes: adbc3695d9e4 ("arm64: dts: add the Marvell Armada 3700 family and a development board") +Signed-off-by: Marc Zyngier +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -323,6 +323,7 @@ + interrupt-controller; + reg = <0x1d00000 0x10000>, /* GICD */ + <0x1d40000 0x40000>; /* GICR */ ++ interrupts = ; + }; + }; + diff --git a/queue-4.13/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch b/queue-4.13/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch new file mode 100644 index 00000000000..fe18f57caf2 --- /dev/null +++ b/queue-4.13/bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch @@ -0,0 +1,357 @@ +From e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 Mon Sep 17 00:00:00 2001 +From: Ben Seri +Date: Sat, 9 Sep 2017 23:15:59 +0200 +Subject: Bluetooth: Properly check L2CAP config option output buffer length + +From: Ben Seri + +commit e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 upstream. + +Validate the output buffer length for L2CAP config requests and responses +to avoid overflowing the stack buffer used for building the option blocks. + +Signed-off-by: Ben Seri +Signed-off-by: Marcel Holtmann +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + net/bluetooth/l2cap_core.c | 80 ++++++++++++++++++++++++--------------------- + 1 file changed, 43 insertions(+), 37 deletions(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -58,7 +58,7 @@ static struct sk_buff *l2cap_build_cmd(s + u8 code, u8 ident, u16 dlen, void *data); + static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, + void *data); +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); + static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); + + static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, +@@ -1473,7 +1473,7 @@ static void l2cap_conn_start(struct l2ca + + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -2987,12 +2987,15 @@ static inline int l2cap_get_conf_opt(voi + return len; + } + +-static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) ++static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) + { + struct l2cap_conf_opt *opt = *ptr; + + BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); + ++ if (size < L2CAP_CONF_OPT_SIZE + len) ++ return; ++ + opt->type = type; + opt->len = len; + +@@ -3017,7 +3020,7 @@ static void l2cap_add_conf_opt(void **pt + *ptr += L2CAP_CONF_OPT_SIZE + len; + } + +-static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) ++static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) + { + struct l2cap_conf_efs efs; + +@@ -3045,7 +3048,7 @@ static void l2cap_add_opt_efs(void **ptr + } + + l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, size); + } + + static void l2cap_ack_timeout(struct work_struct *work) +@@ -3191,11 +3194,12 @@ static inline void l2cap_txwin_setup(str + chan->ack_win = chan->tx_win; + } + +-static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) ++static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) + { + struct l2cap_conf_req *req = data; + struct l2cap_conf_rfc rfc = { .mode = chan->mode }; + void *ptr = req->data; ++ void *endptr = data + data_size; + u16 size; + + BT_DBG("chan %p", chan); +@@ -3220,7 +3224,7 @@ static int l2cap_build_conf_req(struct l + + done: + if (chan->imtu != L2CAP_DEFAULT_MTU) +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); + + switch (chan->mode) { + case L2CAP_MODE_BASIC: +@@ -3239,7 +3243,7 @@ done: + rfc.max_pdu_size = 0; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_MODE_ERTM: +@@ -3259,21 +3263,21 @@ done: + L2CAP_DEFAULT_TX_WINDOW); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) +- l2cap_add_opt_efs(&ptr, chan); ++ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); + + if (test_bit(FLAG_EXT_CTRL, &chan->flags)) + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, +- chan->tx_win); ++ chan->tx_win, endptr - ptr); + + if (chan->conn->feat_mask & L2CAP_FEAT_FCS) + if (chan->fcs == L2CAP_FCS_NONE || + test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { + chan->fcs = L2CAP_FCS_NONE; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, +- chan->fcs); ++ chan->fcs, endptr - ptr); + } + break; + +@@ -3291,17 +3295,17 @@ done: + rfc.max_pdu_size = cpu_to_le16(size); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) +- l2cap_add_opt_efs(&ptr, chan); ++ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); + + if (chan->conn->feat_mask & L2CAP_FEAT_FCS) + if (chan->fcs == L2CAP_FCS_NONE || + test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { + chan->fcs = L2CAP_FCS_NONE; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, +- chan->fcs); ++ chan->fcs, endptr - ptr); + } + break; + } +@@ -3312,10 +3316,11 @@ done: + return ptr - data; + } + +-static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) ++static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) + { + struct l2cap_conf_rsp *rsp = data; + void *ptr = rsp->data; ++ void *endptr = data + data_size; + void *req = chan->conf_req; + int len = chan->conf_len; + int type, hint, olen; +@@ -3417,7 +3422,7 @@ done: + return -ECONNREFUSED; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + } + + if (result == L2CAP_CONF_SUCCESS) { +@@ -3430,7 +3435,7 @@ done: + chan->omtu = mtu; + set_bit(CONF_MTU_DONE, &chan->conf_state); + } +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); + + if (remote_efs) { + if (chan->local_stype != L2CAP_SERV_NOTRAFIC && +@@ -3444,7 +3449,7 @@ done: + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, + sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + } else { + /* Send PENDING Conf Rsp */ + result = L2CAP_CONF_PENDING; +@@ -3477,7 +3482,7 @@ done: + set_bit(CONF_MODE_DONE, &chan->conf_state); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, +- sizeof(rfc), (unsigned long) &rfc); ++ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); + + if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + chan->remote_id = efs.id; +@@ -3491,7 +3496,7 @@ done: + le32_to_cpu(efs.sdu_itime); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, + sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + } + break; + +@@ -3505,7 +3510,7 @@ done: + set_bit(CONF_MODE_DONE, &chan->conf_state); + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), +- (unsigned long) &rfc); ++ (unsigned long) &rfc, endptr - ptr); + + break; + +@@ -3527,10 +3532,11 @@ done: + } + + static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, +- void *data, u16 *result) ++ void *data, size_t size, u16 *result) + { + struct l2cap_conf_req *req = data; + void *ptr = req->data; ++ void *endptr = data + size; + int type, olen; + unsigned long val; + struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; +@@ -3548,13 +3554,13 @@ static int l2cap_parse_conf_rsp(struct l + chan->imtu = L2CAP_DEFAULT_MIN_MTU; + } else + chan->imtu = val; +- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); ++ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); + break; + + case L2CAP_CONF_FLUSH_TO: + chan->flush_to = val; + l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, +- 2, chan->flush_to); ++ 2, chan->flush_to, endptr - ptr); + break; + + case L2CAP_CONF_RFC: +@@ -3568,13 +3574,13 @@ static int l2cap_parse_conf_rsp(struct l + chan->fcs = 0; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, +- sizeof(rfc), (unsigned long) &rfc); ++ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); + break; + + case L2CAP_CONF_EWS: + chan->ack_win = min_t(u16, val, chan->ack_win); + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, +- chan->tx_win); ++ chan->tx_win, endptr - ptr); + break; + + case L2CAP_CONF_EFS: +@@ -3587,7 +3593,7 @@ static int l2cap_parse_conf_rsp(struct l + return -ECONNREFUSED; + + l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), +- (unsigned long) &efs); ++ (unsigned long) &efs, endptr - ptr); + break; + + case L2CAP_CONF_FCS: +@@ -3692,7 +3698,7 @@ void __l2cap_connect_rsp_defer(struct l2 + return; + + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -3900,7 +3906,7 @@ sendresp: + u8 buf[128]; + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -3978,7 +3984,7 @@ static int l2cap_connect_create_rsp(stru + break; + + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, req), req); ++ l2cap_build_conf_req(chan, req, sizeof(req)), req); + chan->num_conf_req++; + break; + +@@ -4090,7 +4096,7 @@ static inline int l2cap_config_req(struc + } + + /* Complete config. */ +- len = l2cap_parse_conf_req(chan, rsp); ++ len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto unlock; +@@ -4124,7 +4130,7 @@ static inline int l2cap_config_req(struc + if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { + u8 buf[64]; + l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + +@@ -4184,7 +4190,7 @@ static inline int l2cap_config_rsp(struc + char buf[64]; + + len = l2cap_parse_conf_rsp(chan, rsp->data, len, +- buf, &result); ++ buf, sizeof(buf), &result); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto done; +@@ -4214,7 +4220,7 @@ static inline int l2cap_config_rsp(struc + /* throw out any old stored conf requests */ + result = L2CAP_CONF_SUCCESS; + len = l2cap_parse_conf_rsp(chan, rsp->data, len, +- req, &result); ++ req, sizeof(req), &result); + if (len < 0) { + l2cap_send_disconn_req(chan, ECONNRESET); + goto done; +@@ -4791,7 +4797,7 @@ static void l2cap_do_create(struct l2cap + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), + L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), buf); ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); + chan->num_conf_req++; + } + } +@@ -7465,7 +7471,7 @@ static void l2cap_security_cfm(struct hc + set_bit(CONF_REQ_SENT, &chan->conf_state); + l2cap_send_cmd(conn, l2cap_get_ident(conn), + L2CAP_CONF_REQ, +- l2cap_build_conf_req(chan, buf), ++ l2cap_build_conf_req(chan, buf, sizeof(buf)), + buf); + chan->num_conf_req++; + } diff --git a/queue-4.13/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch b/queue-4.13/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch new file mode 100644 index 00000000000..e95a0cd3a05 --- /dev/null +++ b/queue-4.13/nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch @@ -0,0 +1,118 @@ +From 196639ebbe63a037fe9a80669140bd292d8bcd80 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 8 Sep 2017 21:28:11 -0400 +Subject: NFS: Fix 2 use after free issues in the I/O code + +From: Trond Myklebust + +commit 196639ebbe63a037fe9a80669140bd292d8bcd80 upstream. + +The writeback code wants to send a commit after processing the pages, +which is why we want to delay releasing the struct path until after +that's done. + +Also, the layout code expects that we do not free the inode before +we've put the layout segments in pnfs_writehdr_free() and +pnfs_readhdr_free() + +Fixes: 919e3bd9a875 ("NFS: Ensure we commit after writeback is complete") +Fixes: 4714fb51fd03 ("nfs: remove pgio_header refcount, related cleanup") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/internal.h | 1 - + fs/nfs/pagelist.c | 26 ++++++++++++-------------- + fs/nfs/pnfs.c | 2 -- + 3 files changed, 12 insertions(+), 17 deletions(-) + +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -251,7 +251,6 @@ int nfs_iocounter_wait(struct nfs_lock_c + extern const struct nfs_pageio_ops nfs_pgio_rw_ops; + struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *); + void nfs_pgio_header_free(struct nfs_pgio_header *); +-void nfs_pgio_data_destroy(struct nfs_pgio_header *); + int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *); + int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr, + struct rpc_cred *cred, const struct nfs_rpc_ops *rpc_ops, +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -530,16 +530,6 @@ struct nfs_pgio_header *nfs_pgio_header_ + } + EXPORT_SYMBOL_GPL(nfs_pgio_header_alloc); + +-/* +- * nfs_pgio_header_free - Free a read or write header +- * @hdr: The header to free +- */ +-void nfs_pgio_header_free(struct nfs_pgio_header *hdr) +-{ +- hdr->rw_ops->rw_free_header(hdr); +-} +-EXPORT_SYMBOL_GPL(nfs_pgio_header_free); +- + /** + * nfs_pgio_data_destroy - make @hdr suitable for reuse + * +@@ -548,14 +538,24 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free); + * + * @hdr: A header that has had nfs_generic_pgio called + */ +-void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) ++static void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) + { + if (hdr->args.context) + put_nfs_open_context(hdr->args.context); + if (hdr->page_array.pagevec != hdr->page_array.page_array) + kfree(hdr->page_array.pagevec); + } +-EXPORT_SYMBOL_GPL(nfs_pgio_data_destroy); ++ ++/* ++ * nfs_pgio_header_free - Free a read or write header ++ * @hdr: The header to free ++ */ ++void nfs_pgio_header_free(struct nfs_pgio_header *hdr) ++{ ++ nfs_pgio_data_destroy(hdr); ++ hdr->rw_ops->rw_free_header(hdr); ++} ++EXPORT_SYMBOL_GPL(nfs_pgio_header_free); + + /** + * nfs_pgio_rpcsetup - Set up arguments for a pageio call +@@ -669,7 +669,6 @@ EXPORT_SYMBOL_GPL(nfs_initiate_pgio); + static void nfs_pgio_error(struct nfs_pgio_header *hdr) + { + set_bit(NFS_IOHDR_REDO, &hdr->flags); +- nfs_pgio_data_destroy(hdr); + hdr->completion_ops->completion(hdr); + } + +@@ -680,7 +679,6 @@ static void nfs_pgio_error(struct nfs_pg + static void nfs_pgio_release(void *calldata) + { + struct nfs_pgio_header *hdr = calldata; +- nfs_pgio_data_destroy(hdr); + hdr->completion_ops->completion(hdr); + } + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2274,7 +2274,6 @@ pnfs_write_through_mds(struct nfs_pageio + nfs_pageio_reset_write_mds(desc); + mirror->pg_recoalesce = 1; + } +- nfs_pgio_data_destroy(hdr); + hdr->release(hdr); + } + +@@ -2398,7 +2397,6 @@ pnfs_read_through_mds(struct nfs_pageio_ + nfs_pageio_reset_read_mds(desc); + mirror->pg_recoalesce = 1; + } +- nfs_pgio_data_destroy(hdr); + hdr->release(hdr); + } + diff --git a/queue-4.13/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch b/queue-4.13/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch new file mode 100644 index 00000000000..ea882c3fea1 --- /dev/null +++ b/queue-4.13/nfs-sync-the-correct-byte-range-during-synchronous-writes.patch @@ -0,0 +1,49 @@ +From e973b1a5999e57da677ab50da5f5479fdc0f0c31 Mon Sep 17 00:00:00 2001 +From: "tarangg@amazon.com" +Date: Thu, 7 Sep 2017 09:29:23 -0400 +Subject: NFS: Sync the correct byte range during synchronous writes + +From: tarangg@amazon.com + +commit e973b1a5999e57da677ab50da5f5479fdc0f0c31 upstream. + +Since commit 18290650b1c8 ("NFS: Move buffered I/O locking into +nfs_file_write()") nfs_file_write() has not flushed the correct byte +range during synchronous writes. generic_write_sync() expects that +iocb->ki_pos points to the right edge of the range rather than the +left edge. + +To replicate the problem, open a file with O_DSYNC, have the client +write at increasing offsets, and then print the successful offsets. +Block port 2049 partway through that sequence, and observe that the +client application indicates successful writes in advance of what the +server received. + +Fixes: 18290650b1c8 ("NFS: Move buffered I/O locking into nfs_file_write()") +Signed-off-by: Jacob Strauss +Signed-off-by: Tarang Gupta +Tested-by: Tarang Gupta +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/file.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -631,11 +631,11 @@ ssize_t nfs_file_write(struct kiocb *ioc + if (result <= 0) + goto out; + +- result = generic_write_sync(iocb, result); +- if (result < 0) +- goto out; + written = result; + iocb->ki_pos += written; ++ result = generic_write_sync(iocb, written); ++ if (result < 0) ++ goto out; + + /* Return error values */ + if (nfs_need_check_write(file, inode)) { diff --git a/queue-4.13/nfsv4-fix-up-mirror-allocation.patch b/queue-4.13/nfsv4-fix-up-mirror-allocation.patch new file mode 100644 index 00000000000..c5bccca92c9 --- /dev/null +++ b/queue-4.13/nfsv4-fix-up-mirror-allocation.patch @@ -0,0 +1,137 @@ +From 14abcb0bf59a30cf65a74f6c6f53974cd7224bc6 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 19 Aug 2017 10:10:34 -0400 +Subject: NFSv4: Fix up mirror allocation + +From: Trond Myklebust + +commit 14abcb0bf59a30cf65a74f6c6f53974cd7224bc6 upstream. + +There are a number of callers of nfs_pageio_complete() that want to +continue using the nfs_pageio_descriptor without needing to call +nfs_pageio_init() again. Examples include nfs_pageio_resend() and +nfs_pageio_cond_complete(). + +The problem is that nfs_pageio_complete() also calls +nfs_pageio_cleanup_mirroring(), which frees up the array of mirrors. +This can lead to writeback errors, in the next call to +nfs_pageio_setup_mirroring(). + +Fix by simply moving the allocation of the mirrors to +nfs_pageio_setup_mirroring(). + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=196709 +Reported-by: JianhongYin +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/pagelist.c | 73 ++++++++++++++++++++++++++++-------------------------- + 1 file changed, 39 insertions(+), 34 deletions(-) + +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -712,9 +712,6 @@ void nfs_pageio_init(struct nfs_pageio_d + int io_flags, + gfp_t gfp_flags) + { +- struct nfs_pgio_mirror *new; +- int i; +- + desc->pg_moreio = 0; + desc->pg_inode = inode; + desc->pg_ops = pg_ops; +@@ -730,21 +727,9 @@ void nfs_pageio_init(struct nfs_pageio_d + desc->pg_mirror_count = 1; + desc->pg_mirror_idx = 0; + +- if (pg_ops->pg_get_mirror_count) { +- /* until we have a request, we don't have an lseg and no +- * idea how many mirrors there will be */ +- new = kcalloc(NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX, +- sizeof(struct nfs_pgio_mirror), gfp_flags); +- desc->pg_mirrors_dynamic = new; +- desc->pg_mirrors = new; +- +- for (i = 0; i < NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX; i++) +- nfs_pageio_mirror_init(&desc->pg_mirrors[i], bsize); +- } else { +- desc->pg_mirrors_dynamic = NULL; +- desc->pg_mirrors = desc->pg_mirrors_static; +- nfs_pageio_mirror_init(&desc->pg_mirrors[0], bsize); +- } ++ desc->pg_mirrors_dynamic = NULL; ++ desc->pg_mirrors = desc->pg_mirrors_static; ++ nfs_pageio_mirror_init(&desc->pg_mirrors[0], bsize); + } + EXPORT_SYMBOL_GPL(nfs_pageio_init); + +@@ -863,32 +848,52 @@ static int nfs_generic_pg_pgios(struct n + return ret; + } + ++static struct nfs_pgio_mirror * ++nfs_pageio_alloc_mirrors(struct nfs_pageio_descriptor *desc, ++ unsigned int mirror_count) ++{ ++ struct nfs_pgio_mirror *ret; ++ unsigned int i; ++ ++ kfree(desc->pg_mirrors_dynamic); ++ desc->pg_mirrors_dynamic = NULL; ++ if (mirror_count == 1) ++ return desc->pg_mirrors_static; ++ ret = kmalloc_array(mirror_count, sizeof(*ret), GFP_NOFS); ++ if (ret != NULL) { ++ for (i = 0; i < mirror_count; i++) ++ nfs_pageio_mirror_init(&ret[i], desc->pg_bsize); ++ desc->pg_mirrors_dynamic = ret; ++ } ++ return ret; ++} ++ + /* + * nfs_pageio_setup_mirroring - determine if mirroring is to be used + * by calling the pg_get_mirror_count op + */ +-static int nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio, ++static void nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio, + struct nfs_page *req) + { +- int mirror_count = 1; +- +- if (!pgio->pg_ops->pg_get_mirror_count) +- return 0; ++ unsigned int mirror_count = 1; + +- mirror_count = pgio->pg_ops->pg_get_mirror_count(pgio, req); +- +- if (pgio->pg_error < 0) +- return pgio->pg_error; +- +- if (!mirror_count || mirror_count > NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX) +- return -EINVAL; ++ if (pgio->pg_ops->pg_get_mirror_count) ++ mirror_count = pgio->pg_ops->pg_get_mirror_count(pgio, req); ++ if (mirror_count == pgio->pg_mirror_count || pgio->pg_error < 0) ++ return; + +- if (WARN_ON_ONCE(!pgio->pg_mirrors_dynamic)) +- return -EINVAL; ++ if (!mirror_count || mirror_count > NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX) { ++ pgio->pg_error = -EINVAL; ++ return; ++ } + ++ pgio->pg_mirrors = nfs_pageio_alloc_mirrors(pgio, mirror_count); ++ if (pgio->pg_mirrors == NULL) { ++ pgio->pg_error = -ENOMEM; ++ pgio->pg_mirrors = pgio->pg_mirrors_static; ++ mirror_count = 1; ++ } + pgio->pg_mirror_count = mirror_count; +- +- return 0; + } + + /* diff --git a/queue-4.13/rt2800-fix-tx_pin_cfg-setting-for-non-mt7620-chips.patch b/queue-4.13/rt2800-fix-tx_pin_cfg-setting-for-non-mt7620-chips.patch new file mode 100644 index 00000000000..9846770778c --- /dev/null +++ b/queue-4.13/rt2800-fix-tx_pin_cfg-setting-for-non-mt7620-chips.patch @@ -0,0 +1,41 @@ +From 83ec489193894e52bd395eec470f4f7c4286d4a5 Mon Sep 17 00:00:00 2001 +From: Stanislaw Gruszka +Date: Fri, 25 Aug 2017 17:04:15 +0200 +Subject: rt2800: fix TX_PIN_CFG setting for non MT7620 chips + +From: Stanislaw Gruszka + +commit 83ec489193894e52bd395eec470f4f7c4286d4a5 upstream. + +Since commit 41977e86c984 ("rt2x00: add support for MT7620") we do not +initialize TX_PIN_CFG setting. This cause breakage at least on some +RT3573 devices. To fix the problem patch restores previous behaviour +for non MT7620 chips. + +Fixes: 41977e86c984 ("rt2x00: add support for MT7620") +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1480829 +Reported-and-tested-by: Jussi Eloranta +Cc: Daniel Golle +Signed-off-by: Stanislaw Gruszka +Acked-by: Daniel Golle +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c +@@ -3702,7 +3702,10 @@ static void rt2800_config_channel(struct + if (rt2x00_rt(rt2x00dev, RT3572)) + rt2800_rfcsr_write(rt2x00dev, 8, 0); + +- tx_pin = rt2800_register_read(rt2x00dev, TX_PIN_CFG); ++ if (rt2x00_rt(rt2x00dev, RT6352)) ++ tx_pin = rt2800_register_read(rt2x00dev, TX_PIN_CFG); ++ else ++ tx_pin = 0; + + switch (rt2x00dev->default_ant.tx_chain_num) { + case 3: diff --git a/queue-4.13/series b/queue-4.13/series index ee4f8fd9b53..00505473942 100644 --- a/queue-4.13/series +++ b/queue-4.13/series @@ -18,3 +18,10 @@ mm-sparse.c-fix-typo-in-online_mem_sections.patch mm-memory.c-fix-mem_cgroup_oom_disable-call-missing.patch kvm-svm-limit-pferr_nested_guest_page-error_code-check-to-l1-guest.patch revert-firmware-add-sanity-check-on-shutdown-suspend.patch +rt2800-fix-tx_pin_cfg-setting-for-non-mt7620-chips.patch +bluetooth-properly-check-l2cap-config-option-output-buffer-length.patch +arm64-dts-marvell-armada-37xx-fix-gic-maintenance-interrupt.patch +arm-8692-1-mm-abort-uaccess-retries-upon-fatal-signal.patch +nfs-fix-2-use-after-free-issues-in-the-i-o-code.patch +nfs-sync-the-correct-byte-range-during-synchronous-writes.patch +nfsv4-fix-up-mirror-allocation.patch