From: Greg Kroah-Hartman Date: Wed, 4 Jun 2014 22:57:30 +0000 (-0700) Subject: 3.10-stable patches X-Git-Tag: v3.14.6~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9d6e43f8d3cc75dbc4f66218ed45d2f4d965acfb;p=thirdparty%2Fkernel%2Fstable-queue.git 3.10-stable patches added patches: crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch media-fc2580-fix-tuning-failure-on-32-bit-arch.patch powerpc-fix-64-bit-builds-with-binutils-2.24.patch --- diff --git a/queue-3.10/crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch b/queue-3.10/crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch new file mode 100644 index 00000000000..ef05f83fb8c --- /dev/null +++ b/queue-3.10/crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch @@ -0,0 +1,40 @@ +From 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 Mon Sep 17 00:00:00 2001 +From: Horia Geanta +Date: Fri, 18 Apr 2014 13:01:42 +0300 +Subject: crypto: caam - add allocation failure handling in SPRINTFCAT macro + +From: Horia Geanta + +commit 27c5fb7a84242b66bf1e0b2fe6bf40d19bcc5c04 upstream. + +GFP_ATOMIC memory allocation could fail. +In this case, avoid NULL pointer dereference and notify user. + +Cc: Kim Phillips +Signed-off-by: Horia Geanta +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/crypto/caam/error.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/crypto/caam/error.c ++++ b/drivers/crypto/caam/error.c +@@ -16,9 +16,13 @@ + char *tmp; \ + \ + tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC); \ +- sprintf(tmp, format, param); \ +- strcat(str, tmp); \ +- kfree(tmp); \ ++ if (likely(tmp)) { \ ++ sprintf(tmp, format, param); \ ++ strcat(str, tmp); \ ++ kfree(tmp); \ ++ } else { \ ++ strcat(str, "kmalloc failure in SPRINTFCAT"); \ ++ } \ + } + + static void report_jump_idx(u32 status, char *outstr) diff --git a/queue-3.10/crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch b/queue-3.10/crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch new file mode 100644 index 00000000000..d4b8eb5010d --- /dev/null +++ b/queue-3.10/crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch @@ -0,0 +1,48 @@ +From 3901c1124ec5099254a9396085f7798153a7293f Mon Sep 17 00:00:00 2001 +From: Harald Freudenberger +Date: Wed, 7 May 2014 16:51:29 +0200 +Subject: crypto: s390 - fix aes,des ctr mode concurrency finding. + +From: Harald Freudenberger + +commit 3901c1124ec5099254a9396085f7798153a7293f upstream. + +An additional testcase found an issue with the last +series of patches applied: the fallback solution may +not save the iv value after operation. This very small +fix just makes sure the iv is copied back to the +walk/desc struct. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/s390/crypto/aes_s390.c | 3 +++ + arch/s390/crypto/des_s390.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -818,6 +818,9 @@ static int ctr_aes_crypt(struct blkciphe + else + memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); + spin_unlock(&ctrblk_lock); ++ } else { ++ if (!nbytes) ++ memcpy(walk->iv, ctrptr, AES_BLOCK_SIZE); + } + /* + * final block may be < AES_BLOCK_SIZE, copy only nbytes +--- a/arch/s390/crypto/des_s390.c ++++ b/arch/s390/crypto/des_s390.c +@@ -429,6 +429,9 @@ static int ctr_desall_crypt(struct blkci + else + memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); + spin_unlock(&ctrblk_lock); ++ } else { ++ if (!nbytes) ++ memcpy(walk->iv, ctrptr, DES_BLOCK_SIZE); + } + /* final block may be < DES_BLOCK_SIZE, copy only nbytes */ + if (nbytes) { diff --git a/queue-3.10/iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch b/queue-3.10/iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch new file mode 100644 index 00000000000..599d3b2afc9 --- /dev/null +++ b/queue-3.10/iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch @@ -0,0 +1,37 @@ +From e028a9e6b8a637af09ac4114083280df4a7045f1 Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Tue, 22 Apr 2014 10:08:40 -0600 +Subject: iommu/amd: Fix interrupt remapping for aliased devices + +From: Alex Williamson + +commit e028a9e6b8a637af09ac4114083280df4a7045f1 upstream. + +An apparent cut and paste error prevents the correct flags from being +set on the alias device resulting in MSI on conventional PCI devices +failing to work. This also produces error events from the IOMMU like: + +AMD-Vi: Event logged [INVALID_DEVICE_REQUEST device=00:14.4 address=0x000000fdf8000000 flags=0x0a00] + +Where 14.4 is a PCIe-to-PCI bridge with a device behind it trying to +use MSI interrupts. + +Signed-off-by: Alex Williamson +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/amd_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -3959,7 +3959,7 @@ static struct irq_remap_table *get_irq_t + iommu_flush_dte(iommu, devid); + if (devid != alias) { + irq_lookup_table[alias] = table; +- set_dte_irq_entry(devid, table); ++ set_dte_irq_entry(alias, table); + iommu_flush_dte(iommu, alias); + } + diff --git a/queue-3.10/libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch b/queue-3.10/libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch new file mode 100644 index 00000000000..51a4a525a19 --- /dev/null +++ b/queue-3.10/libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch @@ -0,0 +1,70 @@ +From 178eda29ca721842f2146378e73d43e0044c4166 Mon Sep 17 00:00:00 2001 +From: Chunwei Chen +Date: Wed, 23 Apr 2014 12:35:09 +0800 +Subject: libceph: fix corruption when using page_count 0 page in rbd + +From: Chunwei Chen + +commit 178eda29ca721842f2146378e73d43e0044c4166 upstream. + +It has been reported that using ZFSonLinux on rbd will result in memory +corruption. The bug report can be found here: + +https://github.com/zfsonlinux/spl/issues/241 +http://tracker.ceph.com/issues/7790 + +The reason is that ZFS will send pages with page_count 0 into rbd, which in +turns send them to tcp_sendpage. However, tcp_sendpage cannot deal with +page_count 0, as it will do get_page and put_page, and erroneously free the +page. + +This type of issue has been noted before, and handled in iscsi, drbd, +etc. So, rbd should also handle this. This fix address this issue by fall back +to slower sendmsg when page_count 0 detected. + +Cc: Sage Weil +Cc: Yehuda Sadeh +Signed-off-by: Chunwei Chen +Reviewed-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + net/ceph/messenger.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -556,7 +556,7 @@ static int ceph_tcp_sendmsg(struct socke + return r; + } + +-static int ceph_tcp_sendpage(struct socket *sock, struct page *page, ++static int __ceph_tcp_sendpage(struct socket *sock, struct page *page, + int offset, size_t size, bool more) + { + int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR); +@@ -569,6 +569,24 @@ static int ceph_tcp_sendpage(struct sock + return ret; + } + ++static int ceph_tcp_sendpage(struct socket *sock, struct page *page, ++ int offset, size_t size, bool more) ++{ ++ int ret; ++ struct kvec iov; ++ ++ /* sendpage cannot properly handle pages with page_count == 0, ++ * we need to fallback to sendmsg if that's the case */ ++ if (page_count(page) >= 1) ++ return __ceph_tcp_sendpage(sock, page, offset, size, more); ++ ++ iov.iov_base = kmap(page) + offset; ++ iov.iov_len = size; ++ ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more); ++ kunmap(page); ++ ++ return ret; ++} + + /* + * Shutdown/close the socket for the given connection. diff --git a/queue-3.10/media-fc2580-fix-tuning-failure-on-32-bit-arch.patch b/queue-3.10/media-fc2580-fix-tuning-failure-on-32-bit-arch.patch new file mode 100644 index 00000000000..6b4e4d5f725 --- /dev/null +++ b/queue-3.10/media-fc2580-fix-tuning-failure-on-32-bit-arch.patch @@ -0,0 +1,57 @@ +From 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f Mon Sep 17 00:00:00 2001 +From: Antti Palosaari +Date: Thu, 10 Apr 2014 21:18:16 -0300 +Subject: media: fc2580: fix tuning failure on 32-bit arch + +From: Antti Palosaari + +commit 8845cc6415ec28ef8d57b3fb81c75ef9bce69c5f upstream. + +There was some frequency calculation overflows which caused tuning +failure on 32-bit architecture. Use 64-bit numbers where needed in +order to avoid calculation overflows. + +Thanks for the Finnish person, who asked remain anonymous, reporting, +testing and suggesting the fix. + +Signed-off-by: Antti Palosaari +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/tuners/fc2580.c | 6 +++--- + drivers/media/tuners/fc2580_priv.h | 1 + + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/tuners/fc2580.c ++++ b/drivers/media/tuners/fc2580.c +@@ -195,7 +195,7 @@ static int fc2580_set_params(struct dvb_ + + f_ref = 2UL * priv->cfg->clock / r_val; + n_val = div_u64_rem(f_vco, f_ref, &k_val); +- k_val_reg = 1UL * k_val * (1 << 20) / f_ref; ++ k_val_reg = div_u64(1ULL * k_val * (1 << 20), f_ref); + + ret = fc2580_wr_reg(priv, 0x18, r18_val | ((k_val_reg >> 16) & 0xff)); + if (ret < 0) +@@ -348,8 +348,8 @@ static int fc2580_set_params(struct dvb_ + if (ret < 0) + goto err; + +- ret = fc2580_wr_reg(priv, 0x37, 1UL * priv->cfg->clock * \ +- fc2580_if_filter_lut[i].mul / 1000000000); ++ ret = fc2580_wr_reg(priv, 0x37, div_u64(1ULL * priv->cfg->clock * ++ fc2580_if_filter_lut[i].mul, 1000000000)); + if (ret < 0) + goto err; + +--- a/drivers/media/tuners/fc2580_priv.h ++++ b/drivers/media/tuners/fc2580_priv.h +@@ -22,6 +22,7 @@ + #define FC2580_PRIV_H + + #include "fc2580.h" ++#include + + struct fc2580_reg_val { + u8 reg; diff --git a/queue-3.10/powerpc-fix-64-bit-builds-with-binutils-2.24.patch b/queue-3.10/powerpc-fix-64-bit-builds-with-binutils-2.24.patch new file mode 100644 index 00000000000..1354776d730 --- /dev/null +++ b/queue-3.10/powerpc-fix-64-bit-builds-with-binutils-2.24.patch @@ -0,0 +1,80 @@ +From 7998eb3dc700aaf499f93f50b3d77da834ef9e1d Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Thu, 15 May 2014 09:33:42 -0700 +Subject: powerpc: Fix 64 bit builds with binutils 2.24 + +From: Guenter Roeck + +commit 7998eb3dc700aaf499f93f50b3d77da834ef9e1d upstream. + +With binutils 2.24, various 64 bit builds fail with relocation errors +such as + +arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e': + (.text+0x165ee): relocation truncated to fit: R_PPC64_ADDR16_HI + against symbol `interrupt_base_book3e' defined in .text section + in arch/powerpc/kernel/built-in.o +arch/powerpc/kernel/built-in.o: In function `exc_debug_crit_book3e': + (.text+0x16602): relocation truncated to fit: R_PPC64_ADDR16_HI + against symbol `interrupt_end_book3e' defined in .text section + in arch/powerpc/kernel/built-in.o + +The assembler maintainer says: + + I changed the ABI, something that had to be done but unfortunately + happens to break the booke kernel code. When building up a 64-bit + value with lis, ori, shl, oris, ori or similar sequences, you now + should use @high and @higha in place of @h and @ha. @h and @ha + (and their associated relocs R_PPC64_ADDR16_HI and R_PPC64_ADDR16_HA) + now report overflow if the value is out of 32-bit signed range. + ie. @h and @ha assume you're building a 32-bit value. This is needed + to report out-of-range -mcmodel=medium toc pointer offsets in @toc@h + and @toc@ha expressions, and for consistency I did the same for all + other @h and @ha relocs. + +Replacing @h with @high in one strategic location fixes the relocation +errors. This has to be done conditionally since the assembler either +supports @h or @high but not both. + +Signed-off-by: Guenter Roeck +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/Makefile | 4 +++- + arch/powerpc/include/asm/ppc_asm.h | 7 ++++++- + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -97,7 +97,9 @@ CFLAGS-$(CONFIG_POWER7_CPU) += $(call cc + + CFLAGS-$(CONFIG_TUNE_CELL) += $(call cc-option,-mtune=cell) + +-KBUILD_CPPFLAGS += -Iarch/$(ARCH) ++asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1) ++ ++KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr) + KBUILD_AFLAGS += -Iarch/$(ARCH) + KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y) + CPP = $(CC) -E $(KBUILD_CFLAGS) +--- a/arch/powerpc/include/asm/ppc_asm.h ++++ b/arch/powerpc/include/asm/ppc_asm.h +@@ -390,11 +390,16 @@ n: + * ld rY,ADDROFF(name)(rX) + */ + #ifdef __powerpc64__ ++#ifdef HAVE_AS_ATHIGH ++#define __AS_ATHIGH high ++#else ++#define __AS_ATHIGH h ++#endif + #define LOAD_REG_IMMEDIATE(reg,expr) \ + lis reg,(expr)@highest; \ + ori reg,reg,(expr)@higher; \ + rldicr reg,reg,32,31; \ +- oris reg,reg,(expr)@h; \ ++ oris reg,reg,(expr)@__AS_ATHIGH; \ + ori reg,reg,(expr)@l; + + #define LOAD_REG_ADDR(reg,name) \ diff --git a/queue-3.10/series b/queue-3.10/series index 03a01006e8d..b5527520e57 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -93,3 +93,9 @@ acpi-blacklist-add-dmi_enable_osi_linux-quirk-for-asus-eee-pc-1015px.patch i2c-rcar-bail-out-on-zero-length-transfers.patch i2c-designware-mask-all-interrupts-during-i2c-controller-enable.patch i2c-s3c2410-resume-race-fix.patch +crypto-caam-add-allocation-failure-handling-in-sprintfcat-macro.patch +crypto-s390-fix-aes-des-ctr-mode-concurrency-finding.patch +powerpc-fix-64-bit-builds-with-binutils-2.24.patch +libceph-fix-corruption-when-using-page_count-0-page-in-rbd.patch +iommu-amd-fix-interrupt-remapping-for-aliased-devices.patch +media-fc2580-fix-tuning-failure-on-32-bit-arch.patch