From: Greg Kroah-Hartman Date: Fri, 11 Jan 2019 13:13:41 +0000 (+0100) Subject: 4.14-stable patches X-Git-Tag: v4.20.2~10 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=be30210fd3fbc665b0678f3e4940c4af71eb5a30;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch genwqe-fix-size-check.patch intel_th-msu-fix-an-off-by-one-in-attribute-store.patch lib-fix-build-failure-in-config_debug_virtual-test.patch power-supply-olpc_battery-correct-the-temperature-units.patch --- diff --git a/queue-4.14/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch b/queue-4.14/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch new file mode 100644 index 00000000000..7cd52bacd84 --- /dev/null +++ b/queue-4.14/ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch @@ -0,0 +1,35 @@ +From 3c1392d4c49962a31874af14ae9ff289cb2b3851 Mon Sep 17 00:00:00 2001 +From: "Yan, Zheng" +Date: Thu, 29 Nov 2018 11:22:50 +0800 +Subject: ceph: don't update importing cap's mseq when handing cap export + +From: Yan, Zheng + +commit 3c1392d4c49962a31874af14ae9ff289cb2b3851 upstream. + +Updating mseq makes client think importer mds has accepted all prior +cap messages and importer mds knows what caps client wants. Actually +some cap messages may have been dropped because of mseq mismatch. + +If mseq is left untouched, importing cap's mds_wanted later will get +reset by cap import message. + +Cc: stable@vger.kernel.org +Signed-off-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ceph/caps.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -3438,7 +3438,6 @@ retry: + tcap->cap_id = t_cap_id; + tcap->seq = t_seq - 1; + tcap->issue_seq = t_seq - 1; +- tcap->mseq = t_mseq; + tcap->issued |= issued; + tcap->implemented |= issued; + if (cap == ci->i_auth_cap) diff --git a/queue-4.14/drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch b/queue-4.14/drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch new file mode 100644 index 00000000000..b6cfd88122e --- /dev/null +++ b/queue-4.14/drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch @@ -0,0 +1,37 @@ +From 2b02a05bdc3a62d36e0d0b015351897109e25991 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Tue, 9 Oct 2018 15:24:46 +0200 +Subject: drm/vc4: Set ->is_yuv to false when num_planes == 1 + +From: Boris Brezillon + +commit 2b02a05bdc3a62d36e0d0b015351897109e25991 upstream. + +When vc4_plane_state is duplicated ->is_yuv is left assigned to its +previous value, and we never set it back to false when switching to +a non-YUV format. + +Fix that by setting ->is_yuv to false in the 'num_planes == 1' branch +of the vc4_plane_setup_clipping_and_scaling() function. + +Fixes: fc04023fafecf ("drm/vc4: Add support for YUV planes.") +Cc: +Signed-off-by: Boris Brezillon +Reviewed-by: Eric Anholt +Link: https://patchwork.freedesktop.org/patch/msgid/20181009132446.21960-1-boris.brezillon@bootlin.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vc4/vc4_plane.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -354,6 +354,7 @@ static int vc4_plane_setup_clipping_and_ + if (vc4_state->is_unity) + vc4_state->x_scaling[0] = VC4_SCALING_PPF; + } else { ++ vc4_state->is_yuv = false; + vc4_state->x_scaling[1] = VC4_SCALING_NONE; + vc4_state->y_scaling[1] = VC4_SCALING_NONE; + } diff --git a/queue-4.14/genwqe-fix-size-check.patch b/queue-4.14/genwqe-fix-size-check.patch new file mode 100644 index 00000000000..4f48cf2d253 --- /dev/null +++ b/queue-4.14/genwqe-fix-size-check.patch @@ -0,0 +1,65 @@ +From fdd669684655c07dacbdb0d753fd13833de69a33 Mon Sep 17 00:00:00 2001 +From: Christian Borntraeger +Date: Wed, 12 Dec 2018 14:45:18 +0100 +Subject: genwqe: Fix size check + +From: Christian Borntraeger + +commit fdd669684655c07dacbdb0d753fd13833de69a33 upstream. + +Calling the test program genwqe_cksum with the default buffer size of +2MB triggers the following kernel warning on s390: + +WARNING: CPU: 30 PID: 9311 at mm/page_alloc.c:3189 __alloc_pages_nodemask+0x45c/0xbe0 +CPU: 30 PID: 9311 Comm: genwqe_cksum Kdump: loaded Not tainted 3.10.0-957.el7.s390x #1 +task: 00000005e5d13980 ti: 00000005e7c6c000 task.ti: 00000005e7c6c000 +Krnl PSW : 0704c00180000000 00000000002780ac (__alloc_pages_nodemask+0x45c/0xbe0) + R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 EA:3 +Krnl GPRS: 00000000002932b8 0000000000b73d7c 0000000000000010 0000000000000009 + 0000000000000041 00000005e7c6f9b8 0000000000000001 00000000000080d0 + 0000000000000000 0000000000b70500 0000000000000001 0000000000000000 + 0000000000b70528 00000000007682c0 0000000000277df2 00000005e7c6f9a0 +Krnl Code: 000000000027809e: de7195001000 ed 1280(114,%r9),0(%r1) + 00000000002780a4: a774fead brc 7,277dfe + #00000000002780a8: a7f40001 brc 15,2780aa + >00000000002780ac: 92011000 mvi 0(%r1),1 + 00000000002780b0: a7f4fea7 brc 15,277dfe + 00000000002780b4: 9101c6b6 tm 1718(%r12),1 + 00000000002780b8: a784ff3a brc 8,277f2c + 00000000002780bc: a7f4fe2e brc 15,277d18 +Call Trace: +([<0000000000277df2>] __alloc_pages_nodemask+0x1a2/0xbe0) + [<000000000013afae>] s390_dma_alloc+0xfe/0x310 + [<000003ff8065f362>] __genwqe_alloc_consistent+0xfa/0x148 [genwqe_card] + [<000003ff80658f7a>] genwqe_mmap+0xca/0x248 [genwqe_card] + [<00000000002b2712>] mmap_region+0x4e2/0x778 + [<00000000002b2c54>] do_mmap+0x2ac/0x3e0 + [<0000000000292d7e>] vm_mmap_pgoff+0xd6/0x118 + [<00000000002b081c>] SyS_mmap_pgoff+0xdc/0x268 + [<00000000002b0a34>] SyS_old_mmap+0x8c/0xb0 + [<000000000074e518>] sysc_tracego+0x14/0x1e + [<000003ffacf87dc6>] 0x3ffacf87dc6 + +turns out the check in __genwqe_alloc_consistent uses "> MAX_ORDER" +while the mm code uses ">= MAX_ORDER". Fix genwqe. + +Cc: stable@vger.kernel.org +Signed-off-by: Christian Borntraeger +Signed-off-by: Frank Haverkamp +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/genwqe/card_utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/misc/genwqe/card_utils.c ++++ b/drivers/misc/genwqe/card_utils.c +@@ -217,7 +217,7 @@ u32 genwqe_crc32(u8 *buff, size_t len, u + void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size, + dma_addr_t *dma_handle) + { +- if (get_order(size) > MAX_ORDER) ++ if (get_order(size) >= MAX_ORDER) + return NULL; + + return dma_zalloc_coherent(&cd->pci_dev->dev, size, dma_handle, diff --git a/queue-4.14/intel_th-msu-fix-an-off-by-one-in-attribute-store.patch b/queue-4.14/intel_th-msu-fix-an-off-by-one-in-attribute-store.patch new file mode 100644 index 00000000000..42f84927ea3 --- /dev/null +++ b/queue-4.14/intel_th-msu-fix-an-off-by-one-in-attribute-store.patch @@ -0,0 +1,52 @@ +From ec5b5ad6e272d8d6b92d1007f79574919862a2d2 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 19 Dec 2018 17:19:22 +0200 +Subject: intel_th: msu: Fix an off-by-one in attribute store + +From: Alexander Shishkin + +commit ec5b5ad6e272d8d6b92d1007f79574919862a2d2 upstream. + +The 'nr_pages' attribute of the 'msc' subdevices parses a comma-separated +list of window sizes, passed from userspace. However, there is a bug in +the string parsing logic wherein it doesn't exclude the comma character +from the range of characters as it consumes them. This leads to an +out-of-bounds access given a sufficiently long list. For example: + +> # echo 8,8,8,8 > /sys/bus/intel_th/devices/0-msc0/nr_pages +> ================================================================== +> BUG: KASAN: slab-out-of-bounds in memchr+0x1e/0x40 +> Read of size 1 at addr ffff8803ffcebcd1 by task sh/825 +> +> CPU: 3 PID: 825 Comm: npktest.sh Tainted: G W 4.20.0-rc1+ +> Call Trace: +> dump_stack+0x7c/0xc0 +> print_address_description+0x6c/0x23c +> ? memchr+0x1e/0x40 +> kasan_report.cold.5+0x241/0x308 +> memchr+0x1e/0x40 +> nr_pages_store+0x203/0xd00 [intel_th_msu] + +Fix this by accounting for the comma character. + +Signed-off-by: Alexander Shishkin +Fixes: ba82664c134ef ("intel_th: Add Memory Storage Unit driver") +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/msu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -1431,7 +1431,8 @@ nr_pages_store(struct device *dev, struc + if (!end) + break; + +- len -= end - p; ++ /* consume the number and the following comma, hence +1 */ ++ len -= end - p + 1; + p = end + 1; + } while (len); + diff --git a/queue-4.14/lib-fix-build-failure-in-config_debug_virtual-test.patch b/queue-4.14/lib-fix-build-failure-in-config_debug_virtual-test.patch new file mode 100644 index 00000000000..ab41bf5d587 --- /dev/null +++ b/queue-4.14/lib-fix-build-failure-in-config_debug_virtual-test.patch @@ -0,0 +1,40 @@ +From 10fdf838e5f540beca466e9d1325999c072e5d3f Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 10 Dec 2018 08:08:28 +0000 +Subject: lib: fix build failure in CONFIG_DEBUG_VIRTUAL test + +From: Christophe Leroy + +commit 10fdf838e5f540beca466e9d1325999c072e5d3f upstream. + +On several arches, virt_to_phys() is in io.h + +Build fails without it: + + CC lib/test_debug_virtual.o +lib/test_debug_virtual.c: In function 'test_debug_virtual_init': +lib/test_debug_virtual.c:26:7: error: implicit declaration of function 'virt_to_phys' [-Werror=implicit-function-declaration] + pa = virt_to_phys(va); + ^ + +Fixes: e4dace361552 ("lib: add test module for CONFIG_DEBUG_VIRTUAL") +CC: stable@vger.kernel.org +Signed-off-by: Christophe Leroy +Reviewed-by: Kees Cook +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + lib/test_debug_virtual.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/lib/test_debug_virtual.c ++++ b/lib/test_debug_virtual.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + + #include + #ifdef CONFIG_MIPS diff --git a/queue-4.14/power-supply-olpc_battery-correct-the-temperature-units.patch b/queue-4.14/power-supply-olpc_battery-correct-the-temperature-units.patch new file mode 100644 index 00000000000..9ac069a4913 --- /dev/null +++ b/queue-4.14/power-supply-olpc_battery-correct-the-temperature-units.patch @@ -0,0 +1,51 @@ +From ed54ffbe554f0902689fd6d1712bbacbacd11376 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Fri, 16 Nov 2018 17:23:47 +0100 +Subject: power: supply: olpc_battery: correct the temperature units + +From: Lubomir Rintel + +commit ed54ffbe554f0902689fd6d1712bbacbacd11376 upstream. + +According to [1] and [2], the temperature values are in tenths of degree +Celsius. Exposing the Celsius value makes the battery appear on fire: + + $ upower -i /org/freedesktop/UPower/devices/battery_olpc_battery + ... + temperature: 236.9 degrees C + +Tested on OLPC XO-1 and OLPC XO-1.75 laptops. + +[1] include/linux/power_supply.h +[2] Documentation/power/power_supply_class.txt + +Fixes: fb972873a767 ("[BATTERY] One Laptop Per Child power/battery driver") +Cc: stable@vger.kernel.org +Signed-off-by: Lubomir Rintel +Acked-by: Pavel Machek +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/power/supply/olpc_battery.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/power/supply/olpc_battery.c ++++ b/drivers/power/supply/olpc_battery.c +@@ -427,14 +427,14 @@ static int olpc_bat_get_property(struct + if (ret) + return ret; + +- val->intval = (s16)be16_to_cpu(ec_word) * 100 / 256; ++ val->intval = (s16)be16_to_cpu(ec_word) * 10 / 256; + break; + case POWER_SUPPLY_PROP_TEMP_AMBIENT: + ret = olpc_ec_cmd(EC_AMB_TEMP, NULL, 0, (void *)&ec_word, 2); + if (ret) + return ret; + +- val->intval = (int)be16_to_cpu(ec_word) * 100 / 256; ++ val->intval = (int)be16_to_cpu(ec_word) * 10 / 256; + break; + case POWER_SUPPLY_PROP_CHARGE_COUNTER: + ret = olpc_ec_cmd(EC_BAT_ACR, NULL, 0, (void *)&ec_word, 2); diff --git a/queue-4.14/series b/queue-4.14/series index 3113e59810f..ae23373e68b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -97,3 +97,9 @@ powerpc-tm-set-msr-just-prior-to-recheckpoint.patch rxe-fix-error-completion-wr_id-and-qp_num.patch iommu-vt-d-handle-domain-agaw-being-less-than-iommu-agaw.patch sched-fair-fix-infinite-loop-in-update_blocked_averages-by-reverting-a9e7f6544b9c.patch +ceph-don-t-update-importing-cap-s-mseq-when-handing-cap-export.patch +genwqe-fix-size-check.patch +intel_th-msu-fix-an-off-by-one-in-attribute-store.patch +power-supply-olpc_battery-correct-the-temperature-units.patch +lib-fix-build-failure-in-config_debug_virtual-test.patch +drm-vc4-set-is_yuv-to-false-when-num_planes-1.patch