From c62d62952a1968700a08fb468eeb4f96c0311190 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 29 Feb 2016 22:41:45 -0800 Subject: [PATCH] 3.10-stable patches added patches: can-ems_usb-fix-possible-tx-overflow.patch dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch drm-radeon-fix-hotplug-race-at-startup.patch efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch iw_cxgb3-fix-incorrectly-returning-error-on-success.patch mips-kvm-fix-asid-restoration-logic.patch mips-kvm-fix-cache-immediate-offset-sign-extension.patch mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch splice-sendfile-at-once-fails-for-big-files.patch tools-add-a-make-all-rule.patch unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch usb-option-add-4g-lte-usb-modem-u901.patch usb-option-add-support-for-sim7100e.patch --- ...can-ems_usb-fix-possible-tx-overflow.patch | 74 +++++++++ ...-when-destroying-thin-pool-workqueue.patch | 37 +++++ ...-bug-when-taking-a-metadata-snapshot.patch | 43 +++++ ...m-radeon-fix-hotplug-race-at-startup.patch | 66 ++++++++ ...calls-not-in-the-epilog-prolog-calls.patch | 110 +++++++++++++ ...ly-and-server-reboots-on-a-4.x-mount.patch | 46 ++++++ ...correctly-returning-error-on-success.patch | 43 +++++ .../mips-kvm-fix-asid-restoration-logic.patch | 64 ++++++++ ...ache-immediate-offset-sign-extension.patch | 38 +++++ ...ninit-vcpu-in-vcpu_create-error-path.patch | 48 ++++++ ...ssion-checks-for-accessing-task-maps.patch | 58 +++++++ queue-3.10/series | 17 ++ ...sendfile-at-once-fails-for-big-files.patch | 138 ++++++++++++++++ queue-3.10/tools-add-a-make-all-rule.patch | 48 ++++++ ...t-fds-in-sending-process-user_struct.patch | 152 ++++++++++++++++++ ...-ids-for-ge-b650v3-and-b850v3-boards.patch | 31 ++++ ...usb-option-add-4g-lte-usb-modem-u901.patch | 47 ++++++ .../usb-option-add-support-for-sim7100e.patch | 75 +++++++++ 18 files changed, 1135 insertions(+) create mode 100644 queue-3.10/can-ems_usb-fix-possible-tx-overflow.patch create mode 100644 queue-3.10/dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch create mode 100644 queue-3.10/dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch create mode 100644 queue-3.10/drm-radeon-fix-hotplug-race-at-startup.patch create mode 100644 queue-3.10/efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch create mode 100644 queue-3.10/failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch create mode 100644 queue-3.10/iw_cxgb3-fix-incorrectly-returning-error-on-success.patch create mode 100644 queue-3.10/mips-kvm-fix-asid-restoration-logic.patch create mode 100644 queue-3.10/mips-kvm-fix-cache-immediate-offset-sign-extension.patch create mode 100644 queue-3.10/mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch create mode 100644 queue-3.10/proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch create mode 100644 queue-3.10/splice-sendfile-at-once-fails-for-big-files.patch create mode 100644 queue-3.10/tools-add-a-make-all-rule.patch create mode 100644 queue-3.10/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch create mode 100644 queue-3.10/usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch create mode 100644 queue-3.10/usb-option-add-4g-lte-usb-modem-u901.patch create mode 100644 queue-3.10/usb-option-add-support-for-sim7100e.patch diff --git a/queue-3.10/can-ems_usb-fix-possible-tx-overflow.patch b/queue-3.10/can-ems_usb-fix-possible-tx-overflow.patch new file mode 100644 index 00000000000..4cb5e981e7d --- /dev/null +++ b/queue-3.10/can-ems_usb-fix-possible-tx-overflow.patch @@ -0,0 +1,74 @@ +From 90cfde46586d2286488d8ed636929e936c0c9ab2 Mon Sep 17 00:00:00 2001 +From: Gerhard Uttenthaler +Date: Tue, 22 Dec 2015 17:29:16 +0100 +Subject: can: ems_usb: Fix possible tx overflow + +From: Gerhard Uttenthaler + +commit 90cfde46586d2286488d8ed636929e936c0c9ab2 upstream. + +This patch fixes the problem that more CAN messages could be sent to the +interface as could be send on the CAN bus. This was more likely for slow baud +rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under +heavy TX load this produced another bulk transfer without checking the +free_slots variable and hence caused the overflow in the interface. + +Signed-off-by: Gerhard Uttenthaler +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/can/usb/ems_usb.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -118,6 +118,9 @@ MODULE_LICENSE("GPL v2"); + */ + #define EMS_USB_ARM7_CLOCK 8000000 + ++#define CPC_TX_QUEUE_TRIGGER_LOW 25 ++#define CPC_TX_QUEUE_TRIGGER_HIGH 35 ++ + /* + * CAN-Message representation in a CPC_MSG. Message object type is + * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or +@@ -279,6 +282,11 @@ static void ems_usb_read_interrupt_callb + switch (urb->status) { + case 0: + dev->free_slots = dev->intr_in_buffer[1]; ++ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){ ++ if (netif_queue_stopped(netdev)){ ++ netif_wake_queue(netdev); ++ } ++ } + break; + + case -ECONNRESET: /* unlink */ +@@ -530,8 +538,6 @@ static void ems_usb_write_bulk_callback( + /* Release context */ + context->echo_index = MAX_TX_URBS; + +- if (netif_queue_stopped(netdev)) +- netif_wake_queue(netdev); + } + + /* +@@ -591,7 +597,7 @@ static int ems_usb_start(struct ems_usb + int err, i; + + dev->intr_in_buffer[0] = 0; +- dev->free_slots = 15; /* initial size */ ++ dev->free_slots = 50; /* initial size */ + + for (i = 0; i < MAX_RX_URBS; i++) { + struct urb *urb = NULL; +@@ -841,7 +847,7 @@ static netdev_tx_t ems_usb_start_xmit(st + + /* Slow down tx path */ + if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS || +- dev->free_slots < 5) { ++ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) { + netif_stop_queue(netdev); + } + } diff --git a/queue-3.10/dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch b/queue-3.10/dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch new file mode 100644 index 00000000000..d4ec75159d7 --- /dev/null +++ b/queue-3.10/dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch @@ -0,0 +1,37 @@ +From 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 Mon Sep 17 00:00:00 2001 +From: Nikolay Borisov +Date: Thu, 17 Dec 2015 18:03:35 +0200 +Subject: dm thin: fix race condition when destroying thin pool workqueue + +From: Nikolay Borisov + +commit 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 upstream. + +When a thin pool is being destroyed delayed work items are +cancelled using cancel_delayed_work(), which doesn't guarantee that on +return the delayed item isn't running. This can cause the work item to +requeue itself on an already destroyed workqueue. Fix this by using +cancel_delayed_work_sync() which guarantees that on return the work item +is not running anymore. + +Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second") +Fixes: 85ad643b7e7e5 ("dm thin: add timeout to stop out-of-data-space mode holding IO forever") +Signed-off-by: Nikolay Borisov +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -2281,7 +2281,7 @@ static void pool_postsuspend(struct dm_t + struct pool_c *pt = ti->private; + struct pool *pool = pt->pool; + +- cancel_delayed_work(&pool->waker); ++ cancel_delayed_work_sync(&pool->waker); + flush_workqueue(pool->wq); + (void) commit_or_fallback(pool); + } diff --git a/queue-3.10/dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch b/queue-3.10/dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch new file mode 100644 index 00000000000..3b2f1efd2f4 --- /dev/null +++ b/queue-3.10/dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch @@ -0,0 +1,43 @@ +From 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Wed, 9 Dec 2015 16:23:24 +0000 +Subject: dm thin metadata: fix bug when taking a metadata snapshot + +From: Joe Thornber + +commit 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 upstream. + +When you take a metadata snapshot the btree roots for the mapping and +details tree need to have their reference counts incremented so they +persist for the lifetime of the metadata snap. + +The roots being incremented were those currently written in the +superblock, which could possibly be out of date if concurrent IO is +triggering new mappings, breaking of sharing, etc. + +Fix this by performing a commit with the metadata lock held while taking +a metadata snapshot. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin-metadata.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -1191,6 +1191,12 @@ static int __reserve_metadata_snap(struc + dm_block_t held_root; + + /* ++ * We commit to ensure the btree roots which we increment in a ++ * moment are up to date. ++ */ ++ __commit_transaction(pmd); ++ ++ /* + * Copy the superblock. + */ + dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION); diff --git a/queue-3.10/drm-radeon-fix-hotplug-race-at-startup.patch b/queue-3.10/drm-radeon-fix-hotplug-race-at-startup.patch new file mode 100644 index 00000000000..ed955fdb8d5 --- /dev/null +++ b/queue-3.10/drm-radeon-fix-hotplug-race-at-startup.patch @@ -0,0 +1,66 @@ +From 7f98ca454ad373fc1b76be804fa7138ff68c1d27 Mon Sep 17 00:00:00 2001 +From: Dave Airlie +Date: Thu, 20 Aug 2015 10:13:55 +1000 +Subject: drm/radeon: fix hotplug race at startup + +From: Dave Airlie + +commit 7f98ca454ad373fc1b76be804fa7138ff68c1d27 upstream. + +We apparantly get a hotplug irq before we've initialised +modesetting, + +[drm] Loading R100 Microcode +BUG: unable to handle kernel NULL pointer dereference at (null) +IP: [] __mutex_lock_slowpath+0x23/0x91 +*pde = 00000000 +Oops: 0002 [#1] +Modules linked in: radeon(+) drm_kms_helper ttm drm i2c_algo_bit backlight pcspkr psmouse evdev sr_mod input_leds led_class cdrom sg parport_pc parport floppy intel_agp intel_gtt lpc_ich acpi_cpufreq processor button mfd_core agpgart uhci_hcd ehci_hcd rng_core snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm usbcore usb_common i2c_i801 i2c_core snd_timer snd soundcore thermal_sys +CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted 4.2.0-rc7-00015-gbf67402 #111 +Hardware name: MicroLink /D850MV , BIOS MV85010A.86A.0067.P24.0304081124 04/08/2003 +Workqueue: events radeon_hotplug_work_func [radeon] +task: f6ca5900 ti: f6d3e000 task.ti: f6d3e000 +EIP: 0060:[] EFLAGS: 00010282 CPU: 0 +EIP is at __mutex_lock_slowpath+0x23/0x91 +EAX: 00000000 EBX: f5e900fc ECX: 00000000 EDX: fffffffe +ESI: f6ca5900 EDI: f5e90100 EBP: f5e90000 ESP: f6d3ff0c + DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 +CR0: 8005003b CR2: 00000000 CR3: 36f61000 CR4: 000006d0 +Stack: + f5e90100 00000000 c103c4c1 f6d2a5a0 f5e900fc f6df394c c125f162 f8b0faca + f6d2a5a0 c138ca00 f6df394c f7395600 c1034741 00d40000 00000000 f6d2a5a0 + c138ca00 f6d2a5b8 c138ca10 c1034b58 00000001 f6d40000 f6ca5900 f6d0c940 +Call Trace: + [] ? dequeue_task_fair+0xa4/0xb7 + [] ? mutex_lock+0x9/0xa + [] ? radeon_hotplug_work_func+0x17/0x57 [radeon] + [] ? process_one_work+0xfc/0x194 + [] ? worker_thread+0x18d/0x218 + [] ? rescuer_thread+0x1d5/0x1d5 + [] ? kthread+0x7b/0x80 + [] ? ret_from_kernel_thread+0x20/0x30 + [] ? init_completion+0x18/0x18 +Code: 42 08 e8 8e a6 dd ff c3 57 56 53 83 ec 0c 8b 35 48 f7 37 c1 8b 10 4a 74 1a 89 c3 8d 78 04 8b 40 08 89 63 + +Reported-and-Tested-by: Meelis Roos +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_irq_kms.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c ++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c +@@ -73,6 +73,11 @@ static void radeon_hotplug_work_func(str + struct drm_mode_config *mode_config = &dev->mode_config; + struct drm_connector *connector; + ++ /* we can race here at startup, some boards seem to trigger ++ * hotplug irqs when they shouldn't. */ ++ if (!rdev->mode_info.mode_config_initialized) ++ return; ++ + mutex_lock(&mode_config->mutex); + if (mode_config->num_connector) { + list_for_each_entry(connector, &mode_config->connector_list, head) diff --git a/queue-3.10/efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch b/queue-3.10/efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch new file mode 100644 index 00000000000..3fa328d76d0 --- /dev/null +++ b/queue-3.10/efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch @@ -0,0 +1,110 @@ +From 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 Mon Sep 17 00:00:00 2001 +From: Ingo Molnar +Date: Tue, 3 Mar 2015 07:34:33 +0100 +Subject: efi: Disable interrupts around EFI calls, not in the epilog/prolog calls + +From: Ingo Molnar + +commit 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 upstream. + +Tapasweni Pathak reported that we do a kmalloc() in efi_call_phys_prolog() +on x86-64 while having interrupts disabled, which is a big no-no, as +kmalloc() can sleep. + +Solve this by removing the irq disabling from the prolog/epilog calls +around EFI calls: it's unnecessary, as in this stage we are single +threaded in the boot thread, and we don't ever execute this from +interrupt contexts. + +Reported-by: Tapasweni Pathak +Signed-off-by: Ingo Molnar +Signed-off-by: Matt Fleming +[ luis: backported to 3.10: adjusted context ] +Signed-off-by: Luis Henriques +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/platform/efi/efi.c | 7 +++++++ + arch/x86/platform/efi/efi_32.c | 11 +++-------- + arch/x86/platform/efi/efi_64.c | 3 --- + 3 files changed, 10 insertions(+), 11 deletions(-) + +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -250,12 +250,19 @@ static efi_status_t __init phys_efi_set_ + efi_memory_desc_t *virtual_map) + { + efi_status_t status; ++ unsigned long flags; + + efi_call_phys_prelog(); ++ ++ /* Disable interrupts around EFI calls: */ ++ local_irq_save(flags); + status = efi_call_phys4(efi_phys.set_virtual_address_map, + memory_map_size, descriptor_size, + descriptor_version, virtual_map); ++ local_irq_restore(flags); ++ + efi_call_phys_epilog(); ++ + return status; + } + +--- a/arch/x86/platform/efi/efi_32.c ++++ b/arch/x86/platform/efi/efi_32.c +@@ -33,19 +33,16 @@ + + /* + * To make EFI call EFI runtime service in physical addressing mode we need +- * prelog/epilog before/after the invocation to disable interrupt, to +- * claim EFI runtime service handler exclusively and to duplicate a memory in +- * low memory space say 0 - 3G. ++ * prolog/epilog before/after the invocation to claim the EFI runtime service ++ * handler exclusively and to duplicate a memory mapping in low memory space, ++ * say 0 - 3G. + */ + +-static unsigned long efi_rt_eflags; + + void efi_call_phys_prelog(void) + { + struct desc_ptr gdt_descr; + +- local_irq_save(efi_rt_eflags); +- + load_cr3(initial_page_table); + __flush_tlb_all(); + +@@ -64,6 +61,4 @@ void efi_call_phys_epilog(void) + + load_cr3(swapper_pg_dir); + __flush_tlb_all(); +- +- local_irq_restore(efi_rt_eflags); + } +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -40,7 +40,6 @@ + #include + + static pgd_t *save_pgd __initdata; +-static unsigned long efi_flags __initdata; + + static void __init early_code_mapping_set_exec(int executable) + { +@@ -66,7 +65,6 @@ void __init efi_call_phys_prelog(void) + int n_pgds; + + early_code_mapping_set_exec(1); +- local_irq_save(efi_flags); + + n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE); + save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL); +@@ -90,7 +88,6 @@ void __init efi_call_phys_epilog(void) + set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]); + kfree(save_pgd); + __flush_tlb_all(); +- local_irq_restore(efi_flags); + early_code_mapping_set_exec(0); + } + diff --git a/queue-3.10/failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch b/queue-3.10/failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch new file mode 100644 index 00000000000..fc7a65da3aa --- /dev/null +++ b/queue-3.10/failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch @@ -0,0 +1,46 @@ +From a41cbe86df3afbc82311a1640e20858c0cd7e065 Mon Sep 17 00:00:00 2001 +From: Olga Kornievskaia +Date: Mon, 14 Sep 2015 19:54:36 -0400 +Subject: Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Olga Kornievskaia + +commit a41cbe86df3afbc82311a1640e20858c0cd7e065 upstream. + +A test case is as the description says: +open(foobar, O_WRONLY); +sleep() --> reboot the server +close(foobar) + +The bug is because in nfs4state.c in nfs4_reclaim_open_state() a few +line before going to restart, there is +clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &state->flags). + +NFS4CLNT_RECLAIM_NOGRACE is a flag for the client states not open +owner states. Value of NFS4CLNT_RECLAIM_NOGRACE is 4 which is the +value of NFS_O_WRONLY_STATE in nfs4_state->flags. So clearing it wipes +out state and when we go to close it, “call_close” doesn’t get set as +state flag is not set and CLOSE doesn’t go on the wire. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/nfs4state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1452,7 +1452,7 @@ restart: + } + spin_unlock(&state->state_lock); + nfs4_put_open_state(state); +- clear_bit(NFS4CLNT_RECLAIM_NOGRACE, ++ clear_bit(NFS_STATE_RECLAIM_NOGRACE, + &state->flags); + spin_lock(&sp->so_lock); + goto restart; diff --git a/queue-3.10/iw_cxgb3-fix-incorrectly-returning-error-on-success.patch b/queue-3.10/iw_cxgb3-fix-incorrectly-returning-error-on-success.patch new file mode 100644 index 00000000000..86cac585a2c --- /dev/null +++ b/queue-3.10/iw_cxgb3-fix-incorrectly-returning-error-on-success.patch @@ -0,0 +1,43 @@ +From 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 Mon Sep 17 00:00:00 2001 +From: Hariprasad S +Date: Fri, 11 Dec 2015 13:59:17 +0530 +Subject: iw_cxgb3: Fix incorrectly returning error on success + +From: Hariprasad S + +commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 upstream. + +The cxgb3_*_send() functions return NET_XMIT_ values, which are +positive integers values. So don't treat positive return values +as an error. + +Signed-off-by: Steve Wise +Signed-off-by: Hariprasad Shenai +Signed-off-by: Doug Ledford +[a pox on developers and maintainers who do not cc: stable for bug fixes like this - gregkh] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c ++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c +@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev * + error = l2t_send(tdev, skb, l2e); + if (error < 0) + kfree_skb(skb); +- return error; ++ return error < 0 ? error : 0; + } + + int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb) +@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev * + error = cxgb3_ofld_send(tdev, skb); + if (error < 0) + kfree_skb(skb); +- return error; ++ return error < 0 ? error : 0; + } + + static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb) diff --git a/queue-3.10/mips-kvm-fix-asid-restoration-logic.patch b/queue-3.10/mips-kvm-fix-asid-restoration-logic.patch new file mode 100644 index 00000000000..fc51d1862f6 --- /dev/null +++ b/queue-3.10/mips-kvm-fix-asid-restoration-logic.patch @@ -0,0 +1,64 @@ +From 002374f371bd02df864cce1fe85d90dc5b292837 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Wed, 11 Nov 2015 14:21:18 +0000 +Subject: MIPS: KVM: Fix ASID restoration logic + +From: James Hogan + +commit 002374f371bd02df864cce1fe85d90dc5b292837 upstream. + +ASID restoration on guest resume should determine the guest execution +mode based on the guest Status register rather than bit 30 of the guest +PC. + +Fix the two places in locore.S that do this, loading the guest status +from the cop0 area. Note, this assembly is specific to the trap & +emulate implementation of KVM, so it doesn't need to check the +supervisor bit as that mode is not implemented in the guest. + +Fixes: b680f70fc111 ("KVM/MIPS32: Entry point for trampolining to...") +Signed-off-by: James Hogan +Cc: Ralf Baechle +Cc: Paolo Bonzini +Cc: Gleb Natapov +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kvm/kvm_locore.S | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/arch/mips/kvm/kvm_locore.S ++++ b/arch/mips/kvm/kvm_locore.S +@@ -156,9 +156,11 @@ FEXPORT(__kvm_mips_vcpu_run) + + FEXPORT(__kvm_mips_load_asid) + /* Set the ASID for the Guest Kernel */ +- sll t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ +- /* addresses shift to 0x80000000 */ +- bltz t0, 1f /* If kernel */ ++ PTR_L t0, VCPU_COP0(k1) ++ LONG_L t0, COP0_STATUS(t0) ++ andi t0, KSU_USER | ST0_ERL | ST0_EXL ++ xori t0, KSU_USER ++ bnez t0, 1f /* If kernel */ + addiu t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ + addiu t1, k1, VCPU_GUEST_USER_ASID /* else user */ + 1: +@@ -442,9 +444,11 @@ __kvm_mips_return_to_guest: + mtc0 t0, CP0_EPC + + /* Set the ASID for the Guest Kernel */ +- sll t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */ +- /* addresses shift to 0x80000000 */ +- bltz t0, 1f /* If kernel */ ++ PTR_L t0, VCPU_COP0(k1) ++ LONG_L t0, COP0_STATUS(t0) ++ andi t0, KSU_USER | ST0_ERL | ST0_EXL ++ xori t0, KSU_USER ++ bnez t0, 1f /* If kernel */ + addiu t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */ + addiu t1, k1, VCPU_GUEST_USER_ASID /* else user */ + 1: diff --git a/queue-3.10/mips-kvm-fix-cache-immediate-offset-sign-extension.patch b/queue-3.10/mips-kvm-fix-cache-immediate-offset-sign-extension.patch new file mode 100644 index 00000000000..e5320e7ce92 --- /dev/null +++ b/queue-3.10/mips-kvm-fix-cache-immediate-offset-sign-extension.patch @@ -0,0 +1,38 @@ +From c5c2a3b998f1ff5a586f9d37e154070b8d550d17 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Wed, 11 Nov 2015 14:21:19 +0000 +Subject: MIPS: KVM: Fix CACHE immediate offset sign extension + +From: James Hogan + +commit c5c2a3b998f1ff5a586f9d37e154070b8d550d17 upstream. + +The immediate field of the CACHE instruction is signed, so ensure that +it gets sign extended by casting it to an int16_t rather than just +masking the low 16 bits. + +Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target branch emulation.") +Signed-off-by: James Hogan +Cc: Ralf Baechle +Cc: Paolo Bonzini +Cc: Gleb Natapov +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kvm/kvm_mips_emul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/kvm/kvm_mips_emul.c ++++ b/arch/mips/kvm/kvm_mips_emul.c +@@ -935,7 +935,7 @@ kvm_mips_emulate_cache(uint32_t inst, ui + + base = (inst >> 21) & 0x1f; + op_inst = (inst >> 16) & 0x1f; +- offset = inst & 0xffff; ++ offset = (int16_t)inst; + cache = (inst >> 16) & 0x3; + op = (inst >> 18) & 0x7; + diff --git a/queue-3.10/mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch b/queue-3.10/mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch new file mode 100644 index 00000000000..5ee5232c51b --- /dev/null +++ b/queue-3.10/mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch @@ -0,0 +1,48 @@ +From 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 Mon Sep 17 00:00:00 2001 +From: James Hogan +Date: Wed, 11 Nov 2015 14:21:20 +0000 +Subject: MIPS: KVM: Uninit VCPU in vcpu_create error path + +From: James Hogan + +commit 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 upstream. + +If either of the memory allocations in kvm_arch_vcpu_create() fail, the +vcpu which has been allocated and kvm_vcpu_init'd doesn't get uninit'd +in the error handling path. Add a call to kvm_vcpu_uninit() to fix this. + +Fixes: 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM") +Signed-off-by: James Hogan +Cc: Ralf Baechle +Cc: Paolo Bonzini +Cc: Gleb Natapov +Cc: linux-mips@linux-mips.org +Cc: kvm@vger.kernel.org +Signed-off-by: Paolo Bonzini +Signed-off-by: James Hogan +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kvm/kvm_mips.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -308,7 +308,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st + + if (!gebase) { + err = -ENOMEM; +- goto out_free_cpu; ++ goto out_uninit_cpu; + } + kvm_info("Allocated %d bytes for KVM Exception Handlers @ %p\n", + ALIGN(size, PAGE_SIZE), gebase); +@@ -368,6 +368,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st + out_free_gebase: + kfree(gebase); + ++out_uninit_cpu: ++ kvm_vcpu_uninit(vcpu); ++ + out_free_cpu: + kfree(vcpu); + diff --git a/queue-3.10/proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch b/queue-3.10/proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch new file mode 100644 index 00000000000..281a52a6ef2 --- /dev/null +++ b/queue-3.10/proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch @@ -0,0 +1,58 @@ +From undefined@pobox.com Mon Feb 29 22:02:13 2016 +From: Corey Wright +Date: Sun, 28 Feb 2016 02:42:39 -0600 +Subject: proc: Fix ptrace-based permission checks for accessing task maps +To: stable@vger.kernel.org +Cc: Jann Horn +Message-ID: <20160228024239.c82b6c2db17c670611ee6b16@pobox.com> + +From: Corey Wright + +Modify mm_access() calls in fs/proc/task_mmu.c and fs/proc/task_nommu.c to +have the mode include PTRACE_MODE_FSCREDS so accessing /proc/pid/maps and +/proc/pid/pagemap is not denied to all users. + +In backporting upstream commit caaee623 to pre-3.18 kernel versions it was +overlooked that mm_access() is used in fs/proc/task_*mmu.c as those calls +were removed in 3.18 (by upstream commit 29a40ace) and did not exist at the +time of the original commit. + +Signed-off-by: Corey Wright +Acked-by: Jann Horn +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/task_mmu.c | 4 ++-- + fs/proc/task_nommu.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -170,7 +170,7 @@ static void *m_start(struct seq_file *m, + if (!priv->task) + return ERR_PTR(-ESRCH); + +- mm = mm_access(priv->task, PTRACE_MODE_READ); ++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS); + if (!mm || IS_ERR(mm)) + return mm; + down_read(&mm->mmap_sem); +@@ -1044,7 +1044,7 @@ static ssize_t pagemap_read(struct file + if (!pm.buffer) + goto out_task; + +- mm = mm_access(task, PTRACE_MODE_READ); ++ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); + ret = PTR_ERR(mm); + if (!mm || IS_ERR(mm)) + goto out_free; +--- a/fs/proc/task_nommu.c ++++ b/fs/proc/task_nommu.c +@@ -223,7 +223,7 @@ static void *m_start(struct seq_file *m, + if (!priv->task) + return ERR_PTR(-ESRCH); + +- mm = mm_access(priv->task, PTRACE_MODE_READ); ++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS); + if (!mm || IS_ERR(mm)) { + put_task_struct(priv->task); + priv->task = NULL; diff --git a/queue-3.10/series b/queue-3.10/series index a8765476e57..7a42adabf3b 100644 --- a/queue-3.10/series +++ b/queue-3.10/series @@ -2,3 +2,20 @@ tracepoints-do-not-trace-when-cpu-is-offline.patch drm-ast-initialized-data-needed-to-map-fbdev-memory.patch netfilter-nf_conntrack-fix-rcu-race-in-nf_conntrack_find_get.patch bcache-unregister-reboot-notifier-if-bcache-fails-to-unregister-device.patch +tools-add-a-make-all-rule.patch +drm-radeon-fix-hotplug-race-at-startup.patch +efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch +dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch +dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch +can-ems_usb-fix-possible-tx-overflow.patch +usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch +usb-option-add-support-for-sim7100e.patch +usb-option-add-4g-lte-usb-modem-u901.patch +proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch +iw_cxgb3-fix-incorrectly-returning-error-on-success.patch +mips-kvm-fix-asid-restoration-logic.patch +mips-kvm-fix-cache-immediate-offset-sign-extension.patch +mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch +splice-sendfile-at-once-fails-for-big-files.patch +failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch +unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch diff --git a/queue-3.10/splice-sendfile-at-once-fails-for-big-files.patch b/queue-3.10/splice-sendfile-at-once-fails-for-big-files.patch new file mode 100644 index 00000000000..34f4c13ca3c --- /dev/null +++ b/queue-3.10/splice-sendfile-at-once-fails-for-big-files.patch @@ -0,0 +1,138 @@ +From 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 6 May 2015 17:26:47 +0200 +Subject: splice: sendfile() at once fails for big files + +From: Christophe Leroy + +commit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream. + +Using sendfile with below small program to get MD5 sums of some files, +it appear that big files (over 64kbytes with 4k pages system) get a +wrong MD5 sum while small files get the correct sum. +This program uses sendfile() to send a file to an AF_ALG socket +for hashing. + +/* md5sum2.c */ +#include +#include +#include +#include +#include +#include +#include +#include +#include + +int main(int argc, char **argv) +{ + int sk = socket(AF_ALG, SOCK_SEQPACKET, 0); + struct stat st; + struct sockaddr_alg sa = { + .salg_family = AF_ALG, + .salg_type = "hash", + .salg_name = "md5", + }; + int n; + + bind(sk, (struct sockaddr*)&sa, sizeof(sa)); + + for (n = 1; n < argc; n++) { + int size; + int offset = 0; + char buf[4096]; + int fd; + int sko; + int i; + + fd = open(argv[n], O_RDONLY); + sko = accept(sk, NULL, 0); + fstat(fd, &st); + size = st.st_size; + sendfile(sko, fd, &offset, size); + size = read(sko, buf, sizeof(buf)); + for (i = 0; i < size; i++) + printf("%2.2x", buf[i]); + printf(" %s\n", argv[n]); + close(fd); + close(sko); + } + exit(0); +} + +Test below is done using official linux patch files. First result is +with a software based md5sum. Second result is with the program above. + +root@vgoip:~# ls -l patch-3.6.* +-rw-r--r-- 1 root root 64011 Aug 24 12:01 patch-3.6.2.gz +-rw-r--r-- 1 root root 94131 Aug 24 12:01 patch-3.6.3.gz + +root@vgoip:~# md5sum patch-3.6.* +b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz +c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz + +root@vgoip:~# ./md5sum2 patch-3.6.* +b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz +5fd77b24e68bb24dcc72d6e57c64790e patch-3.6.3.gz + +After investivation, it appears that sendfile() sends the files by blocks +of 64kbytes (16 times PAGE_SIZE). The problem is that at the end of each +block, the SPLICE_F_MORE flag is missing, therefore the hashing operation +is reset as if it was the end of the file. + +This patch adds SPLICE_F_MORE to the flags when more data is pending. + +With the patch applied, we get the correct sums: + +root@vgoip:~# md5sum patch-3.6.* +b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz +c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz + +root@vgoip:~# ./md5sum2 patch-3.6.* +b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz +c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz + +Signed-off-by: Christophe Leroy +Signed-off-by: Jens Axboe +Cc: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman + +--- + fs/splice.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -1189,7 +1189,7 @@ ssize_t splice_direct_to_actor(struct fi + long ret, bytes; + umode_t i_mode; + size_t len; +- int i, flags; ++ int i, flags, more; + + /* + * We require the input being a regular file, as we don't want to +@@ -1232,6 +1232,7 @@ ssize_t splice_direct_to_actor(struct fi + * Don't block on output, we have to drain the direct pipe. + */ + sd->flags &= ~SPLICE_F_NONBLOCK; ++ more = sd->flags & SPLICE_F_MORE; + + while (len) { + size_t read_len; +@@ -1245,6 +1246,15 @@ ssize_t splice_direct_to_actor(struct fi + sd->total_len = read_len; + + /* ++ * If more data is pending, set SPLICE_F_MORE ++ * If this is the last data and SPLICE_F_MORE was not set ++ * initially, clears it. ++ */ ++ if (read_len < len) ++ sd->flags |= SPLICE_F_MORE; ++ else if (!more) ++ sd->flags &= ~SPLICE_F_MORE; ++ /* + * NOTE: nonblocking mode only applies to the input. We + * must not do the output in nonblocking mode as then we + * could get stuck data in the internal pipe: diff --git a/queue-3.10/tools-add-a-make-all-rule.patch b/queue-3.10/tools-add-a-make-all-rule.patch new file mode 100644 index 00000000000..11a89d15c51 --- /dev/null +++ b/queue-3.10/tools-add-a-make-all-rule.patch @@ -0,0 +1,48 @@ +From f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 Mon Sep 17 00:00:00 2001 +From: Kamal Mostafa +Date: Wed, 11 Nov 2015 14:25:34 -0800 +Subject: tools: Add a "make all" rule + +From: Kamal Mostafa + +commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream. + +Signed-off-by: Kamal Mostafa +Acked-by: Pavel Machek +Cc: Jiri Olsa +Cc: Jonathan Cameron +Cc: Pali Rohar +Cc: Roberta Dobrescu +Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com +Signed-off-by: Arnaldo Carvalho de Melo +[ kamal: backport to 3.10-stable: build all tools for this version ] +Signed-off-by: Kamal Mostafa +Signed-off-by: Greg Kroah-Hartman +--- + tools/Makefile | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/tools/Makefile ++++ b/tools/Makefile +@@ -22,6 +22,10 @@ help: + @echo ' from the kernel command line to build and install one of' + @echo ' the tools above' + @echo '' ++ @echo ' $$ make tools/all' ++ @echo '' ++ @echo ' builds all tools.' ++ @echo '' + @echo ' $$ make tools/install' + @echo '' + @echo ' installs all tools.' +@@ -50,6 +54,10 @@ selftests: FORCE + turbostat x86_energy_perf_policy: FORCE + $(call descend,power/x86/$@) + ++all: cgroup cpupower firewire lguest \ ++ perf selftests turbostat usb \ ++ virtio vm net x86_energy_perf_policy ++ + cpupower_install: + $(call descend,power/$(@:_install=),install) + diff --git a/queue-3.10/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch b/queue-3.10/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch new file mode 100644 index 00000000000..031543e18dc --- /dev/null +++ b/queue-3.10/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch @@ -0,0 +1,152 @@ +From 415e3d3e90ce9e18727e8843ae343eda5a58fad6 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Wed, 3 Feb 2016 02:11:03 +0100 +Subject: unix: correctly track in-flight fds in sending process user_struct + +From: Hannes Frederic Sowa + +commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 upstream. + +The commit referenced in the Fixes tag incorrectly accounted the number +of in-flight fds over a unix domain socket to the original opener +of the file-descriptor. This allows another process to arbitrary +deplete the original file-openers resource limit for the maximum of +open files. Instead the sending processes and its struct cred should +be credited. + +To do so, we add a reference counted struct user_struct pointer to the +scm_fp_list and use it to account for the number of inflight unix fds. + +Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") +Reported-by: David Herrmann +Cc: David Herrmann +Cc: Willy Tarreau +Cc: Linus Torvalds +Suggested-by: Linus Torvalds +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Willy Tarreau +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/af_unix.h | 4 ++-- + include/net/scm.h | 1 + + net/core/scm.c | 7 +++++++ + net/unix/af_unix.c | 4 ++-- + net/unix/garbage.c | 8 ++++---- + 5 files changed, 16 insertions(+), 8 deletions(-) + +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -6,8 +6,8 @@ + #include + #include + +-extern void unix_inflight(struct file *fp); +-extern void unix_notinflight(struct file *fp); ++extern void unix_inflight(struct user_struct *user, struct file *fp); ++extern void unix_notinflight(struct user_struct *user, struct file *fp); + extern void unix_gc(void); + extern void wait_for_unix_gc(void); + extern struct sock *unix_get_socket(struct file *filp); +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -21,6 +21,7 @@ struct scm_creds { + struct scm_fp_list { + short count; + short max; ++ struct user_struct *user; + struct file *fp[SCM_MAX_FD]; + }; + +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *c + *fplp = fpl; + fpl->count = 0; + fpl->max = SCM_MAX_FD; ++ fpl->user = NULL; + } + fpp = &fpl->fp[fpl->count]; + +@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *c + *fpp++ = file; + fpl->count++; + } ++ ++ if (!fpl->user) ++ fpl->user = get_uid(current_user()); ++ + return num; + } + +@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *sc + scm->fp = NULL; + for (i=fpl->count-1; i>=0; i--) + fput(fpl->fp[i]); ++ free_uid(fpl->user); + kfree(fpl); + } + } +@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct sc + for (i = 0; i < fpl->count; i++) + get_file(fpl->fp[i]); + new_fpl->max = new_fpl->count; ++ new_fpl->user = get_uid(fpl->user); + } + return new_fpl; + } +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1466,7 +1466,7 @@ static void unix_detach_fds(struct scm_c + UNIXCB(skb).fp = NULL; + + for (i = scm->fp->count-1; i >= 0; i--) +- unix_notinflight(scm->fp->fp[i]); ++ unix_notinflight(scm->fp->user, scm->fp->fp[i]); + } + + static void unix_destruct_scm(struct sk_buff *skb) +@@ -1531,7 +1531,7 @@ static int unix_attach_fds(struct scm_co + return -ENOMEM; + + for (i = scm->fp->count - 1; i >= 0; i--) +- unix_inflight(scm->fp->fp[i]); ++ unix_inflight(scm->fp->user, scm->fp->fp[i]); + return max_level; + } + +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file + * descriptor if it is for an AF_UNIX socket. + */ + +-void unix_inflight(struct file *fp) ++void unix_inflight(struct user_struct *user, struct file *fp) + { + struct sock *s = unix_get_socket(fp); + +@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp) + } + unix_tot_inflight++; + } +- fp->f_cred->user->unix_inflight++; ++ user->unix_inflight++; + spin_unlock(&unix_gc_lock); + } + +-void unix_notinflight(struct file *fp) ++void unix_notinflight(struct user_struct *user, struct file *fp) + { + struct sock *s = unix_get_socket(fp); + +@@ -157,7 +157,7 @@ void unix_notinflight(struct file *fp) + list_del_init(&u->link); + unix_tot_inflight--; + } +- fp->f_cred->user->unix_inflight--; ++ user->unix_inflight--; + spin_unlock(&unix_gc_lock); + } + diff --git a/queue-3.10/usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch b/queue-3.10/usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch new file mode 100644 index 00000000000..7fbd36c6127 --- /dev/null +++ b/queue-3.10/usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch @@ -0,0 +1,31 @@ +From 6627ae19385283b89356a199d7f03c75ba35fb29 Mon Sep 17 00:00:00 2001 +From: Ken Lin +Date: Mon, 1 Feb 2016 14:57:25 -0500 +Subject: USB: cp210x: add IDs for GE B650V3 and B850V3 boards + +From: Ken Lin + +commit 6627ae19385283b89356a199d7f03c75ba35fb29 upstream. + +Add USB ID for cp2104/5 devices on GE B650v3 and B850v3 boards. + +Signed-off-by: Ken Lin +Signed-off-by: Akshay Bhat +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/cp210x.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -162,6 +162,8 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ + { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ + { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ ++ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ ++ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ + { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */ diff --git a/queue-3.10/usb-option-add-4g-lte-usb-modem-u901.patch b/queue-3.10/usb-option-add-4g-lte-usb-modem-u901.patch new file mode 100644 index 00000000000..d4d9334a6f0 --- /dev/null +++ b/queue-3.10/usb-option-add-4g-lte-usb-modem-u901.patch @@ -0,0 +1,47 @@ +From d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Fri, 12 Feb 2016 16:40:00 +0100 +Subject: USB: option: add "4G LTE usb-modem U901" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bjørn Mork + +commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 upstream. + +Thomas reports: + +T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=05c6 ProdID=6001 Rev=00.00 +S: Manufacturer=USB Modem +S: Product=USB Modem +S: SerialNumber=1234567890ABCDEF +C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA +I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage + +Reported-by: Thomas Schäfer +Signed-off-by: Bjørn Mork +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1135,6 +1135,8 @@ static const struct usb_device_id option + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) }, + { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */ ++ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */ ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ diff --git a/queue-3.10/usb-option-add-support-for-sim7100e.patch b/queue-3.10/usb-option-add-support-for-sim7100e.patch new file mode 100644 index 00000000000..2dcf2def3b6 --- /dev/null +++ b/queue-3.10/usb-option-add-support-for-sim7100e.patch @@ -0,0 +1,75 @@ +From 3158a8d416f4e1b79dcc867d67cb50013140772c Mon Sep 17 00:00:00 2001 +From: Andrey Skvortsov +Date: Fri, 29 Jan 2016 00:07:30 +0300 +Subject: USB: option: add support for SIM7100E + +From: Andrey Skvortsov + +commit 3158a8d416f4e1b79dcc867d67cb50013140772c upstream. + +$ lsusb: +Bus 001 Device 101: ID 1e0e:9001 Qualcomm / Option + +$ usb-devices: +T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=101 Spd=480 MxCh= 0 +D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 2 +P: Vendor=1e0e ProdID=9001 Rev= 2.32 +S: Manufacturer=SimTech, Incorporated +S: Product=SimTech, Incorporated +S: SerialNumber=0123456789ABCDEF +C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) + +The last interface (6) is used for Android Composite ADB interface. + +Serial port layout: +0: QCDM/DIAG +1: NMEA +2: AT +3: AT/PPP +4: audio + +Signed-off-by: Andrey Skvortsov +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/option.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -315,6 +315,7 @@ static void option_instat_callback(struc + #define TOSHIBA_PRODUCT_G450 0x0d45 + + #define ALINK_VENDOR_ID 0x1e0e ++#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */ + #define ALINK_PRODUCT_PH300 0x9100 + #define ALINK_PRODUCT_3GU 0x9200 + +@@ -615,6 +616,10 @@ static const struct option_blacklist_inf + .reserved = BIT(3) | BIT(4), + }; + ++static const struct option_blacklist_info simcom_sim7100e_blacklist = { ++ .reserved = BIT(5) | BIT(6), ++}; ++ + static const struct option_blacklist_info telit_le910_blacklist = { + .sendsetup = BIT(0), + .reserved = BIT(1) | BIT(2), +@@ -1645,6 +1650,8 @@ static const struct usb_device_id option + { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) }, + { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) }, + { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E), ++ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist }, + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200), + .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist + }, -- 2.47.3