From: Greg Kroah-Hartman Date: Thu, 3 Aug 2017 22:44:18 +0000 (-0700) Subject: 4.4-stable patches X-Git-Tag: v4.12.5~28 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=7119faed7b590e4e98c5d2fa66c5ea3754a59215;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch rdma-uverbs-fix-the-check-for-port-number.patch sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch --- diff --git a/queue-4.4/ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch b/queue-4.4/ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch new file mode 100644 index 00000000000..fb6df6fc9bb --- /dev/null +++ b/queue-4.4/ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch @@ -0,0 +1,43 @@ +From 860f01e96981a68553f3ca49f574ff14fe955e72 Mon Sep 17 00:00:00 2001 +From: Valentin Vidic +Date: Fri, 5 May 2017 21:07:33 +0200 +Subject: ipmi/watchdog: fix watchdog timeout set on reboot + +From: Valentin Vidic + +commit 860f01e96981a68553f3ca49f574ff14fe955e72 upstream. + +systemd by default starts watchdog on reboot and sets the timer to +ShutdownWatchdogSec=10min. Reboot handler in ipmi_watchdog than reduces +the timer to 120s which is not enough time to boot a Xen machine with +a lot of RAM. As a result the machine is rebooted the second time +during the long run of (XEN) Scrubbing Free RAM..... + +Fix this by setting the timer to 120s only if it was previously +set to a low value. + +Signed-off-by: Valentin Vidic +Signed-off-by: Corey Minyard +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ipmi/ipmi_watchdog.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/char/ipmi/ipmi_watchdog.c ++++ b/drivers/char/ipmi/ipmi_watchdog.c +@@ -1162,10 +1162,11 @@ static int wdog_reboot_handler(struct no + ipmi_watchdog_state = WDOG_TIMEOUT_NONE; + ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB); + } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { +- /* Set a long timer to let the reboot happens, but +- reboot if it hangs, but only if the watchdog ++ /* Set a long timer to let the reboot happen or ++ reset if it hangs, but only if the watchdog + timer was already running. */ +- timeout = 120; ++ if (timeout < 120) ++ timeout = 120; + pretimeout = 0; + ipmi_watchdog_state = WDOG_TIMEOUT_RESET; + ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB); diff --git a/queue-4.4/libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch b/queue-4.4/libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch new file mode 100644 index 00000000000..cda2a7d36b6 --- /dev/null +++ b/queue-4.4/libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch @@ -0,0 +1,46 @@ +From c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc Mon Sep 17 00:00:00 2001 +From: Vishal Verma +Date: Thu, 29 Jun 2017 16:59:11 -0600 +Subject: libnvdimm, btt: fix btt_rw_page not returning errors + +From: Vishal Verma + +commit c13c43d54f2c6a3be1c675766778ac1ad8dfbfcc upstream. + +btt_rw_page was not propagating errors frm btt_do_bvec, resulting in any +IO errors via the rw_page path going unnoticed. the pmem driver recently +fixed this in e10624f pmem: fail io-requests to known bad blocks +but same problem in BTT went neglected. + +Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") +Cc: Toshi Kani +Cc: Dan Williams +Cc: Jeff Moyer +Signed-off-by: Vishal Verma +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/nvdimm/btt.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1205,10 +1205,13 @@ static int btt_rw_page(struct block_devi + struct page *page, int rw) + { + struct btt *btt = bdev->bd_disk->private_data; ++ int rc; + +- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector); +- page_endio(page, rw & WRITE, 0); +- return 0; ++ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector); ++ if (rc == 0) ++ page_endio(page, rw & WRITE, 0); ++ ++ return rc; + } + + diff --git a/queue-4.4/pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch b/queue-4.4/pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch new file mode 100644 index 00000000000..e91239db82a --- /dev/null +++ b/queue-4.4/pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch @@ -0,0 +1,68 @@ +From 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 Mon Sep 17 00:00:00 2001 +From: Sudeep Holla +Date: Fri, 14 Jul 2017 11:51:48 +0100 +Subject: PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present + +From: Sudeep Holla + +commit 975e83cfb8dc16e7a2fdc58188c77c0c605876c2 upstream. + +If the genpd->attach_dev or genpd->power_on fails, genpd_dev_pm_attach +may return -EPROBE_DEFER initially. However genpd_alloc_dev_data sets +the PM domain for the device unconditionally. + +When subsequent attempts are made to call genpd_dev_pm_attach, it may +return -EEXISTS checking dev->pm_domain without re-attempting to call +attach_dev or power_on. + +platform_drv_probe then attempts to call drv->probe as the return value +-EEXIST != -EPROBE_DEFER, which may end up in a situation where the +device is accessed without it's power domain switched on. + +Fixes: f104e1e5ef57 (PM / Domains: Re-order initialization of generic_pm_domain_data) +Signed-off-by: Sudeep Holla +Acked-by: Ulf Hansson +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/base/power/domain.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -1188,7 +1188,6 @@ static struct generic_pm_domain_data *ge + } + + dev->power.subsys_data->domain_data = &gpd_data->base; +- dev->pm_domain = &genpd->domain; + + spin_unlock_irq(&dev->power.lock); + +@@ -1207,7 +1206,6 @@ static void genpd_free_dev_data(struct d + { + spin_lock_irq(&dev->power.lock); + +- dev->pm_domain = NULL; + dev->power.subsys_data->domain_data = NULL; + + spin_unlock_irq(&dev->power.lock); +@@ -1248,6 +1246,8 @@ int __pm_genpd_add_device(struct generic + if (ret) + goto out; + ++ dev->pm_domain = &genpd->domain; ++ + genpd->device_count++; + genpd->max_off_time_changed = true; + +@@ -1299,6 +1299,8 @@ int pm_genpd_remove_device(struct generi + if (genpd->detach_dev) + genpd->detach_dev(genpd, dev); + ++ dev->pm_domain = NULL; ++ + list_del_init(&pdd->list_node); + + mutex_unlock(&genpd->lock); diff --git a/queue-4.4/rdma-uverbs-fix-the-check-for-port-number.patch b/queue-4.4/rdma-uverbs-fix-the-check-for-port-number.patch new file mode 100644 index 00000000000..2fa622613b8 --- /dev/null +++ b/queue-4.4/rdma-uverbs-fix-the-check-for-port-number.patch @@ -0,0 +1,39 @@ +From 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3 Mon Sep 17 00:00:00 2001 +From: "Ismail, Mustafa" +Date: Fri, 14 Jul 2017 09:41:30 -0500 +Subject: RDMA/uverbs: Fix the check for port number + +From: Ismail, Mustafa + +commit 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3 upstream. + +The port number is only valid if IB_QP_PORT is set in the mask. +So only check port number if it is valid to prevent modify_qp from +failing due to an invalid port number. + +Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds") +Reviewed-by: Steve Wise +Signed-off-by: Mustafa Ismail +Tested-by: Mike Marciniszyn +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/infiniband/core/uverbs_cmd.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -2287,8 +2287,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv + if (copy_from_user(&cmd, buf, sizeof cmd)) + return -EFAULT; + +- if (cmd.port_num < rdma_start_port(ib_dev) || +- cmd.port_num > rdma_end_port(ib_dev)) ++ if ((cmd.attr_mask & IB_QP_PORT) && ++ (cmd.port_num < rdma_start_port(ib_dev) || ++ cmd.port_num > rdma_end_port(ib_dev))) + return -EINVAL; + + INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd, diff --git a/queue-4.4/sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch b/queue-4.4/sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch new file mode 100644 index 00000000000..4eb51347c28 --- /dev/null +++ b/queue-4.4/sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch @@ -0,0 +1,94 @@ +From 96b777452d8881480fd5be50112f791c17db4b6b Mon Sep 17 00:00:00 2001 +From: Konstantin Khlebnikov +Date: Wed, 8 Feb 2017 14:27:27 +0300 +Subject: sched/cgroup: Move sched_online_group() back into css_online() to fix crash + +From: Konstantin Khlebnikov + +commit 96b777452d8881480fd5be50112f791c17db4b6b upstream. + +Commit: + + 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init") + +.. moved sched_online_group() from css_online() to css_alloc(). +It exposes half-baked task group into global lists before initializing +generic cgroup stuff. + +LTP testcase (third in cgroup_regression_test) written for testing +similar race in kernels 2.6.26-2.6.28 easily triggers this oops: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 + IP: kernfs_path_from_node_locked+0x260/0x320 + CPU: 1 PID: 30346 Comm: cat Not tainted 4.10.0-rc5-test #4 + Call Trace: + ? kernfs_path_from_node+0x4f/0x60 + kernfs_path_from_node+0x3e/0x60 + print_rt_rq+0x44/0x2b0 + print_rt_stats+0x7a/0xd0 + print_cpu+0x2fc/0xe80 + ? __might_sleep+0x4a/0x80 + sched_debug_show+0x17/0x30 + seq_read+0xf2/0x3b0 + proc_reg_read+0x42/0x70 + __vfs_read+0x28/0x130 + ? security_file_permission+0x9b/0xc0 + ? rw_verify_area+0x4e/0xb0 + vfs_read+0xa5/0x170 + SyS_read+0x46/0xa0 + entry_SYSCALL_64_fastpath+0x1e/0xad + +Here the task group is already linked into the global RCU-protected 'task_groups' +list, but the css->cgroup pointer is still NULL. + +This patch reverts this chunk and moves online back to css_online(). + +Signed-off-by: Konstantin Khlebnikov +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Tejun Heo +Cc: Thomas Gleixner +Fixes: 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init") +Link: http://lkml.kernel.org/r/148655324740.424917.5302984537258726349.stgit@buzz +Signed-off-by: Ingo Molnar +Signed-off-by: Matt Fleming +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/sched/core.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8253,11 +8253,20 @@ cpu_cgroup_css_alloc(struct cgroup_subsy + if (IS_ERR(tg)) + return ERR_PTR(-ENOMEM); + +- sched_online_group(tg, parent); +- + return &tg->css; + } + ++/* Expose task group only after completing cgroup initialization */ ++static int cpu_cgroup_css_online(struct cgroup_subsys_state *css) ++{ ++ struct task_group *tg = css_tg(css); ++ struct task_group *parent = css_tg(css->parent); ++ ++ if (parent) ++ sched_online_group(tg, parent); ++ return 0; ++} ++ + static void cpu_cgroup_css_released(struct cgroup_subsys_state *css) + { + struct task_group *tg = css_tg(css); +@@ -8632,6 +8641,7 @@ static struct cftype cpu_files[] = { + + struct cgroup_subsys cpu_cgrp_subsys = { + .css_alloc = cpu_cgroup_css_alloc, ++ .css_online = cpu_cgroup_css_online, + .css_released = cpu_cgroup_css_released, + .css_free = cpu_cgroup_css_free, + .fork = cpu_cgroup_fork, diff --git a/queue-4.4/series b/queue-4.4/series index 5c638d245bc..cd759cee3e1 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -32,3 +32,8 @@ mailbox-handle-empty-message-in-tx_tick.patch mpt3sas-don-t-overreach-ioc-reply_post-during-initialization.patch kaweth-fix-firmware-download.patch kaweth-fix-oops-upon-failed-memory-allocation.patch +sched-cgroup-move-sched_online_group-back-into-css_online-to-fix-crash.patch +pm-domains-defer-dev_pm_domain_set-until-genpd-attach_dev-succeeds-if-present.patch +rdma-uverbs-fix-the-check-for-port-number.patch +libnvdimm-btt-fix-btt_rw_page-not-returning-errors.patch +ipmi-watchdog-fix-watchdog-timeout-set-on-reboot.patch