From: Greg Kroah-Hartman Date: Tue, 4 Mar 2014 19:23:30 +0000 (-0800) Subject: 3.4-stable patches X-Git-Tag: v3.10.33~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=47606f9aaaa11fdc63adfd1d5f8670d1d9ba0967;p=thirdparty%2Fkernel%2Fstable-queue.git 3.4-stable patches added patches: dm-mpath-fix-stalls-when-handling-invalid-ioctls.patch dma-ste_dma40-don-t-dereference-free-d-descriptor.patch --- diff --git a/queue-3.4/arm64-mm-add-double-logical-invert-to-pte-accessors.patch b/queue-3.4/arm64-mm-add-double-logical-invert-to-pte-accessors.patch deleted file mode 100644 index 759e42d9fb3..00000000000 --- a/queue-3.4/arm64-mm-add-double-logical-invert-to-pte-accessors.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 84fe6826c28f69d8708bd575faed7f75e6b6f57f Mon Sep 17 00:00:00 2001 -From: Steve Capper -Date: Tue, 25 Feb 2014 11:38:53 +0000 -Subject: arm64: mm: Add double logical invert to pte accessors - -From: Steve Capper - -commit 84fe6826c28f69d8708bd575faed7f75e6b6f57f upstream. - -Page table entries on ARM64 are 64 bits, and some pte functions such as -pte_dirty return a bitwise-and of a flag with the pte value. If the -flag to be tested resides in the upper 32 bits of the pte, then we run -into the danger of the result being dropped if downcast. - -For example: - gather_stats(page, md, pte_dirty(*pte), 1); -where pte_dirty(*pte) is downcast to an int. - -This patch adds a double logical invert to all the pte_ accessors to -ensure predictable downcasting. - -Signed-off-by: Steve Capper -Signed-off-by: Catalin Marinas -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index b524dcd17243..aa3917c8b623 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -136,11 +136,11 @@ extern struct page *empty_zero_page; - /* - * The following only work if pte_present(). Undefined behaviour otherwise. - */ --#define pte_present(pte) (pte_val(pte) & (PTE_VALID | PTE_PROT_NONE)) --#define pte_dirty(pte) (pte_val(pte) & PTE_DIRTY) --#define pte_young(pte) (pte_val(pte) & PTE_AF) --#define pte_special(pte) (pte_val(pte) & PTE_SPECIAL) --#define pte_write(pte) (pte_val(pte) & PTE_WRITE) -+#define pte_present(pte) (!!(pte_val(pte) & (PTE_VALID | PTE_PROT_NONE))) -+#define pte_dirty(pte) (!!(pte_val(pte) & PTE_DIRTY)) -+#define pte_young(pte) (!!(pte_val(pte) & PTE_AF)) -+#define pte_special(pte) (!!(pte_val(pte) & PTE_SPECIAL)) -+#define pte_write(pte) (!!(pte_val(pte) & PTE_WRITE)) - #define pte_exec(pte) (!(pte_val(pte) & PTE_UXN)) - - #define pte_valid_user(pte) \ diff --git a/queue-3.4/dm-mpath-fix-stalls-when-handling-invalid-ioctls.patch b/queue-3.4/dm-mpath-fix-stalls-when-handling-invalid-ioctls.patch new file mode 100644 index 00000000000..aeae0801733 --- /dev/null +++ b/queue-3.4/dm-mpath-fix-stalls-when-handling-invalid-ioctls.patch @@ -0,0 +1,42 @@ +From a1989b330093578ea5470bea0a00f940c444c466 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Wed, 26 Feb 2014 10:07:04 +0100 +Subject: dm mpath: fix stalls when handling invalid ioctls + +From: Hannes Reinecke + +commit a1989b330093578ea5470bea0a00f940c444c466 upstream. + +An invalid ioctl will never be valid, irrespective of whether multipath +has active paths or not. So for invalid ioctls we do not have to wait +for multipath to activate any paths, but can rather return an error +code immediately. This fix resolves numerous instances of: + + udevd[]: worker [] unexpectedly returned with status 0x0100 + +that have been seen during testing. + +Signed-off-by: Hannes Reinecke +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-mpath.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -1541,8 +1541,11 @@ static int multipath_ioctl(struct dm_tar + /* + * Only pass ioctls through if the device sizes match exactly. + */ +- if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) +- r = scsi_verify_blk_ioctl(NULL, cmd); ++ if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) { ++ int err = scsi_verify_blk_ioctl(NULL, cmd); ++ if (err) ++ r = err; ++ } + + return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg); + } diff --git a/queue-3.4/dma-ste_dma40-don-t-dereference-free-d-descriptor.patch b/queue-3.4/dma-ste_dma40-don-t-dereference-free-d-descriptor.patch new file mode 100644 index 00000000000..1e7df3f10b2 --- /dev/null +++ b/queue-3.4/dma-ste_dma40-don-t-dereference-free-d-descriptor.patch @@ -0,0 +1,52 @@ +From e9baa9d9d520fb0e24cca671e430689de2d4a4b2 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 13 Feb 2014 10:39:01 +0100 +Subject: dma: ste_dma40: don't dereference free:d descriptor + +From: Linus Walleij + +commit e9baa9d9d520fb0e24cca671e430689de2d4a4b2 upstream. + +It appears that in the DMA40 driver the DMA tasklet will very +often dereference memory for a descriptor just free:d from the +DMA40 slab. Nothing happens because no other part of the driver +has yet had a chance to claim this memory, but it's really +nasty to dereference free:d memory, so let's check the flag +before the descriptor is free and store it in a bool variable. + +Reported-by: Dan Carpenter +Signed-off-by: Linus Walleij +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/ste_dma40.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/dma/ste_dma40.c ++++ b/drivers/dma/ste_dma40.c +@@ -1409,6 +1409,7 @@ static void dma_tasklet(unsigned long da + struct d40_chan *d40c = (struct d40_chan *) data; + struct d40_desc *d40d; + unsigned long flags; ++ bool callback_active; + dma_async_tx_callback callback; + void *callback_param; + +@@ -1432,6 +1433,7 @@ static void dma_tasklet(unsigned long da + } + + /* Callback to client */ ++ callback_active = !!(d40d->txd.flags & DMA_PREP_INTERRUPT); + callback = d40d->txd.callback; + callback_param = d40d->txd.callback_param; + +@@ -1456,7 +1458,7 @@ static void dma_tasklet(unsigned long da + + spin_unlock_irqrestore(&d40c->lock, flags); + +- if (callback && (d40d->txd.flags & DMA_PREP_INTERRUPT)) ++ if (callback_active && callback) + callback(callback_param); + + return; diff --git a/queue-3.4/series b/queue-3.4/series index 81ac3eb6182..2c931cf0422 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -38,4 +38,5 @@ workqueue-ensure-task-is-valid-across-kthread_stop.patch perf-fix-hotplug-splat.patch selinux-bigendian-problems-with-filename-trans-rules.patch quota-fix-race-between-dqput-and-dquot_scan_active.patch -arm64-mm-add-double-logical-invert-to-pte-accessors.patch +dma-ste_dma40-don-t-dereference-free-d-descriptor.patch +dm-mpath-fix-stalls-when-handling-invalid-ioctls.patch