Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1375066 > unrolled thread

[PATCH 3.14 00/76] 3.14.66-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.14 00/76] 3.14.66-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 07/76] PCI: Disable IO/MEM decoding for devices with non-compliant BARs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 41/76] [media] saa7134: Fix bytesperline not being set correctly for planar formats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 40/76] 8250: use callbacks to access UART_DLL/UART_DLM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 26/76] Input: powermate - fix oops with malicious USB descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 45/76] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 25/76] [media] pwc: Add USB id for Philips Spc880nc webcam Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:40 +0200
    [PATCH 3.14 11/76] aacraid: Fix memory leak in aac_fib_map_free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:50 +0200
    [PATCH 3.14 10/76] sg: fix dxferp in from_to case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:50 +0200
    [PATCH 3.14 13/76] usb: retry reset if a device times out Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 21:50 +0200
    Re: [PATCH 3.14 00/76] 3.14.66-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-10 22:10 +0200
      Re: [PATCH 3.14 00/76] 3.14.66-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
    [PATCH 3.14 68/76] target: Fix target_release_cmd_kref shutdown comp leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
    [PATCH 3.14 64/76] tracing: Fix trace_printk() to print when not using bprintk() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-10 22:40 +0200
    Re: [PATCH 3.14 00/76] 3.14.66-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-11 05:20 +0200
      Re: [PATCH 3.14 00/76] 3.14.66-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-12 16:20 +0200
    Re: [PATCH 3.14 00/76] 3.14.66-stable review shuahkh <shuahkh@osg.sisa.samsung.com> - 2016-04-11 19:30 +0200

#1375066 — [PATCH 3.14 00/76] 3.14.66-stable review

This is the start of the stable review cycle for the 3.14.66 release.
There are 76 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.66-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.14.66-rc1

Andi Kleen <ak@linux.intel.com>
    perf/x86/intel: Fix PEBS data source interpretation on Nehalem/Westmere

Jiri Olsa <jolsa@redhat.com>
    perf/x86/intel: Use PAGE_SIZE for PEBS buffer size on Core2

Thomas Gleixner <tglx@linutronix.de>
    sched/cputime: Fix steal time accounting vs. CPU hotplug

Aaro Koskinen <aaro.koskinen@iki.fi>
    mtd: onenand: fix deadlock in onenand_block_markbad

Joseph Qi <joseph.qi@huawei.com>
    ocfs2/dlm: fix BUG in dlm_move_lockres_to_recovery_list

Joseph Qi <joseph.qi@huawei.com>
    ocfs2/dlm: fix race between convert and recovery

Vladis Dronov <vdronov@redhat.com>
    Input: ati_remote2 - fix crashes on detecting device with invalid descriptor

Oliver Neukum <oneukum@suse.com>
    Input: ims-pcu - sanity check against missing interfaces

Himanshu Madhani <himanshu.madhani@qlogic.com>
    target: Fix target_release_cmd_kref shutdown comp leak

Jiri Kosina <jkosina@suse.cz>
    kbuild/mkspec: fix grub2 installkernel issue

Julia Lawall <Julia.Lawall@lip6.fr>
    scripts/coccinelle: modernize &

Peter Zijlstra <peterz@infradead.org>
    bitops: Do not default to __clear_bit() for __clear_bit_unlock()

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Fix trace_printk() to print when not using bprintk()

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Fix crash from reading trace_pipe with sendfile

Steven Rostedt (Red Hat) <rostedt@goodmis.org>
    tracing: Have preempt(irqs)off trace preempt disabled functions

Mario Kleiner <mario.kleiner.de@gmail.com>
    drm/radeon: Don't drop DP 2.7 Ghz link setup on some cards.

Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
    ipr: Fix regression when loading firmware

Insu Yun <wuninsu@gmail.com>
    ipr: Fix out-of-bounds null overwrite

Aurelien Jacquiot <a-jacquiot@ti.com>
    rapidio/rionet: fix deadlock on SMP

Jann Horn <jann@thejh.net>
    fs/coredump: prevent fsuid=0 dumps into user-controlled directories

Ming Lei <ming.lei@canonical.com>
    md: multipath: don't hardcopy bio in .make_request path

Jes Sorensen <Jes.Sorensen@redhat.com>
    md/raid5: Compare apples to apples (or sectors to sectors)

Mateusz Guzik <mguzik@redhat.com>
    xfs: fix two memory leaks in xfs_attr_list.c error paths

Max Filippov <jcmvbkbc@gmail.com>
    xtensa: clear all DBREAKC registers on start

Max Filippov <jcmvbkbc@gmail.com>
    xtensa: ISS: don't hang if stdin EOF is reached

Rabin Vincent <rabin@rab.in>
    splice: handle zero nr_pages in splice_to_pipe()

Dmitry Tunin <hanipouspilot@gmail.com>
    Bluetooth: Add new AR3012 ID 0489:e095

Michael S. Tsirkin <mst@redhat.com>
    watchdog: rc32434_wdt: fix ioctl error handling

Eric Wheeler <git@linux.ewheeler.net>
    bcache: fix cache_set_flush() NULL pointer dereference on OOM

OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
    jbd2: fix FS corruption possibility in jbd2_journal_destroy() on umount path

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix unconditional GPIO toggle via automute

Vittorio Gambaletta (VittGam) <linuxbugs@vittgam.net>
    ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.

Tiffany Lin <tiffany.lin@mediatek.com>
    media: v4l2-compat-ioctl32: fix missing length copy in put_v4l2_buffer32

Hans de Goede <hdegoede@redhat.com>
    bttv: Width must be a multiple of 16 when capturing planar formats

Hans Verkuil <hverkuil@xs4all.nl>
    adv7511: TX_EDID_PRESENT is still 1 after a disconnect

Hans de Goede <hdegoede@redhat.com>
    saa7134: Fix bytesperline not being set correctly for planar formats

Sebastian Frias <sf84@laposte.net>
    8250: use callbacks to access UART_DLL/UART_DLM

Peter Hurley <peter@hurleysoftware.com>
    net: irda: Fix use-after-free in irtty_open()

Grazvydas Ignotas <notasas@gmail.com>
    HID: logitech: fix Dual Action gamepad support

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - memset request context to zero during import

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - Don't assume export/import areas are aligned

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - Limit the amount of information exported

Tom Lendacky <thomas.lendacky@amd.com>
    crypto: ccp - Add hash state import and export support

Dmitry Tunin <hanipouspilot@gmail.com>
    Bluetooth: btusb: Add a new AR3012 ID 13d3:3472

Dmitry Tunin <hanipouspilot@gmail.com>
    Bluetooth: btusb: Add a new AR3012 ID 04ca:3014

Dmitry Tunin <hanipouspilot@gmail.com>
    Bluetooth: btusb: Add new AR3012 ID 13d3:3395

Vladis Dronov <vdronov@redhat.com>
    ALSA: usb-audio: Fix double-free in error paths after snd_usb_add_audio_stream() call

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Minor code cleanup in create_fixed_stream_quirk()

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Add sanity checks for endpoint accesses

Takashi Iwai <tiwai@suse.de>
    ALSA: usb-audio: Fix NULL dereference in create_fixed_stream_quirk()

Josh Boyer <jwboyer@fedoraproject.org>
    Input: powermate - fix oops with malicious USB descriptors

Hans de Goede <hdegoede@redhat.com>
    pwc: Add USB id for Philips Spc880nc webcam

Bjørn Mork <bjorn@mork.no>
    USB: option: add "D-Link DWM-221 B1" device id

Josh Boyer <jwboyer@fedoraproject.org>
    USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices

Martyn Welch <martyn.welch@collabora.co.uk>
    USB: serial: cp210x: Adding GE Healthcare Device ID

Oliver Neukum <oneukum@suse.com>
    USB: cypress_m8: add endpoint sanity check

Oliver Neukum <oneukum@suse.com>
    USB: digi_acceleport: do sanity checking for the number of ports

Oliver Neukum <oneukum@suse.com>
    USB: mct_u232: add sanity checking in probe

Oliver Neukum <oneukum@suse.com>
    USB: usb_driver_claim_interface: add sanity checking

Josh Boyer <jwboyer@fedoraproject.org>
    USB: iowarrior: fix oops with malicious USB descriptors

Oliver Neukum <oneukum@suse.com>
    USB: cdc-acm: more sanity checking

Hans de Goede <hdegoede@redhat.com>
    USB: uas: Reduce can_queue to MAX_CMNDS

Oliver Neukum <oneukum@suse.com>
    usb: hub: fix a typo in hub_port_init() leading to wrong logic

Oliver Neukum <oneukum@suse.com>
    usb: retry reset if a device times out

Maurizio Lombardi <mlombard@redhat.com>
    be2iscsi: set the boot_kset pointer to NULL in case of failure

Raghava Aditya Renukunta <raghavaaditya.renukunta@pmcs.com>
    aacraid: Fix memory leak in aac_fib_map_free

Douglas Gilbert <dgilbert@interlog.com>
    sg: fix dxferp in from_to case

Andy Lutomirski <luto@kernel.org>
    x86/iopl: Fix iopl capability check on Xen PV

Dave Jones <davej@codemonkey.org.uk>
    x86/apic: Fix suspicious RCU usage in smp_trace_call_function_interrupt()

Bjorn Helgaas <bhelgaas@google.com>
    PCI: Disable IO/MEM decoding for devices with non-compliant BARs

Dan Carpenter <dan.carpenter@oracle.com>
    EDAC, amd64_edac: Shift wrapping issue in f1x_get_norm_dct_addr()

Paolo Bonzini <pbonzini@redhat.com>
    KVM: VMX: avoid guest hang on invalid invept instruction

Paolo Bonzini <pbonzini@redhat.com>
    KVM: fix spin_lock_init order on x86

Radim Krčmář <rkrcmar@redhat.com>
    KVM: i8254: change PIT discard tick policy

Anton Staaf <robotboy@chromium.org>
    USB: serial: add Google simple serial SubClass support

Nicholas Bellinger <nab@linux-iscsi.org>
    target: Drop incorrect ABORT_TASK put for completed commands


-------------

Diffstat:

 Makefile                                          |  4 +--
 arch/um/drivers/mconsole_kern.c                   |  2 +-
 arch/x86/include/asm/apic.h                       |  2 +-
 arch/x86/kernel/cpu/perf_event.h                  |  3 ++
 arch/x86/kernel/cpu/perf_event_intel.c            |  2 ++
 arch/x86/kernel/cpu/perf_event_intel_ds.c         | 24 ++++++++++++--
 arch/x86/kernel/ioport.c                          | 12 +++++--
 arch/x86/kvm/i8254.c                              | 12 ++++---
 arch/x86/kvm/vmx.c                                |  1 +
 arch/xtensa/kernel/head.S                         |  2 +-
 arch/xtensa/platforms/iss/console.c               | 10 +++---
 drivers/bluetooth/ath3k.c                         |  8 +++++
 drivers/bluetooth/btusb.c                         |  4 +++
 drivers/crypto/ccp/ccp-crypto-aes-cmac.c          | 36 ++++++++++++++++++++
 drivers/crypto/ccp/ccp-crypto-sha.c               | 40 +++++++++++++++++++++++
 drivers/crypto/ccp/ccp-crypto.h                   | 22 +++++++++++++
 drivers/edac/amd64_edac.c                         |  2 +-
 drivers/gpu/drm/radeon/atombios_encoders.c        |  6 ++--
 drivers/hid/hid-core.c                            |  1 +
 drivers/input/misc/ati_remote2.c                  | 36 ++++++++++++++++----
 drivers/input/misc/ims-pcu.c                      |  4 +++
 drivers/input/misc/powermate.c                    |  3 ++
 drivers/md/bcache/super.c                         |  3 ++
 drivers/md/multipath.c                            |  4 ++-
 drivers/md/raid5.c                                |  4 +--
 drivers/media/i2c/adv7511.c                       | 21 ++++++++----
 drivers/media/pci/bt8xx/bttv-driver.c             | 26 +++++++++++----
 drivers/media/pci/saa7134/saa7134-video.c         | 18 ++++++----
 drivers/media/usb/pwc/pwc-if.c                    |  6 ++++
 drivers/media/v4l2-core/v4l2-compat-ioctl32.c     | 21 +++++-------
 drivers/mtd/onenand/onenand_base.c                |  3 +-
 drivers/net/irda/irtty-sir.c                      | 10 ------
 drivers/net/rionet.c                              |  4 +--
 drivers/pci/probe.c                               | 14 ++++++++
 drivers/scsi/aacraid/commsup.c                    |  9 +++--
 drivers/scsi/be2iscsi/be_main.c                   |  1 +
 drivers/scsi/ipr.c                                | 10 ++++--
 drivers/scsi/sg.c                                 |  3 +-
 drivers/target/target_core_tmr.c                  |  1 -
 drivers/target/target_core_transport.c            |  2 --
 drivers/tty/serial/8250/8250_core.c               | 18 ++++------
 drivers/usb/class/cdc-acm.c                       |  3 ++
 drivers/usb/core/driver.c                         |  6 +++-
 drivers/usb/core/hub.c                            | 16 ++++++---
 drivers/usb/misc/iowarrior.c                      |  6 ++++
 drivers/usb/serial/Kconfig                        |  1 +
 drivers/usb/serial/cp210x.c                       |  1 +
 drivers/usb/serial/cypress_m8.c                   | 11 +++----
 drivers/usb/serial/digi_acceleport.c              | 19 +++++++++++
 drivers/usb/serial/ftdi_sio.c                     |  4 +++
 drivers/usb/serial/ftdi_sio_ids.h                 |  8 +++++
 drivers/usb/serial/mct_u232.c                     |  9 ++++-
 drivers/usb/serial/option.c                       |  2 ++
 drivers/usb/serial/usb-serial-simple.c            | 10 ++++++
 drivers/usb/storage/uas.c                         |  2 +-
 drivers/watchdog/rc32434_wdt.c                    |  2 +-
 fs/coredump.c                                     | 30 ++++++++++++++---
 fs/fhandle.c                                      |  2 +-
 fs/jbd2/journal.c                                 | 17 +++++++---
 fs/ocfs2/dlm/dlmconvert.c                         | 24 +++++++++++++-
 fs/ocfs2/dlm/dlmrecovery.c                        |  1 -
 fs/open.c                                         |  6 ++--
 fs/splice.c                                       |  3 ++
 fs/xfs/xfs_attr_list.c                            | 19 ++++++-----
 include/asm-generic/bitops/lock.h                 | 14 ++++----
 include/linux/fs.h                                |  2 +-
 include/linux/kernel.h                            |  6 ++--
 include/linux/pci.h                               |  1 +
 kernel/sched/core.c                               |  1 +
 kernel/sched/sched.h                              | 13 ++++++++
 kernel/sysctl_binary.c                            |  2 +-
 kernel/trace/trace.c                              |  5 ++-
 kernel/trace/trace_irqsoff.c                      |  8 +++--
 kernel/trace/trace_printk.c                       |  3 ++
 scripts/coccinelle/iterators/use_after_iter.cocci |  2 +-
 scripts/package/mkspec                            |  8 ++---
 sound/pci/hda/patch_cirrus.c                      |  8 +++--
 sound/pci/intel8x0.c                              |  1 +
 sound/usb/clock.c                                 |  2 ++
 sound/usb/endpoint.c                              |  3 ++
 sound/usb/mixer_quirks.c                          |  4 +++
 sound/usb/pcm.c                                   |  2 ++
 sound/usb/quirks.c                                | 26 ++++++++++-----
 sound/usb/stream.c                                |  6 +++-
 virt/kvm/kvm_main.c                               | 21 ++++++------
 85 files changed, 575 insertions(+), 179 deletions(-)

[toc] | [next] | [standalone]

#1375067 — [PATCH 3.14 07/76] PCI: Disable IO/MEM decoding for devices with non-compliant BARs

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bjorn Helgaas <bhelgaas@google.com>

commit b84106b4e2290c081cdab521fa832596cdfea246 upstream.

The PCI config header (first 64 bytes of each device's config space) is
defined by the PCI spec so generic software can identify the device and
manage its usage of I/O, memory, and IRQ resources.

Some non-spec-compliant devices put registers other than BARs where the
BARs should be.  When the PCI core sizes these "BARs", the reads and writes
it does may have unwanted side effects, and the "BAR" may appear to
describe non-sensical address space.

Add a flag bit to mark non-compliant devices so we don't touch their BARs.
Turn off IO/MEM decoding to prevent the devices from consuming address
space, since we can't read the BARs to find out what that address space
would be.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/probe.c |   14 ++++++++++++++
 include/linux/pci.h |    1 +
 2 files changed, 15 insertions(+)

--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -175,6 +175,9 @@ int __pci_read_base(struct pci_dev *dev,
 	struct pci_bus_region region, inverted_region;
 	bool bar_too_big = false, bar_disabled = false;
 
+	if (dev->non_compliant_bars)
+		return 0;
+
 	mask = type ? PCI_ROM_ADDRESS_MASK : ~0;
 
 	/* No printks while decoding is disabled! */
@@ -1074,6 +1077,7 @@ int pci_cfg_space_size(struct pci_dev *d
 int pci_setup_device(struct pci_dev *dev)
 {
 	u32 class;
+	u16 cmd;
 	u8 hdr_type;
 	struct pci_slot *slot;
 	int pos = 0;
@@ -1121,6 +1125,16 @@ int pci_setup_device(struct pci_dev *dev
 	/* device class may be changed after fixup */
 	class = dev->class >> 8;
 
+	if (dev->non_compliant_bars) {
+		pci_read_config_word(dev, PCI_COMMAND, &cmd);
+		if (cmd & (PCI_COMMAND_IO | PCI_COMMAND_MEMORY)) {
+			dev_info(&dev->dev, "device has non-compliant BARs; disabling IO/MEM decoding\n");
+			cmd &= ~PCI_COMMAND_IO;
+			cmd &= ~PCI_COMMAND_MEMORY;
+			pci_write_config_word(dev, PCI_COMMAND, cmd);
+		}
+	}
+
 	switch (dev->hdr_type) {		    /* header type */
 	case PCI_HEADER_TYPE_NORMAL:		    /* standard header */
 		if (class == PCI_CLASS_BRIDGE_PCI)
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -344,6 +344,7 @@ struct pci_dev {
 	unsigned int	__aer_firmware_first:1;
 	unsigned int	broken_intx_masking:1;
 	unsigned int	io_window_1k:1;	/* Intel P2P bridge 1K I/O windows */
+	unsigned int	non_compliant_bars:1;	/* broken BARs; ignore them */
 	pci_dev_flags_t dev_flags;
 	atomic_t	enable_cnt;	/* pci_enable_device has been called */
 

[toc] | [prev] | [next] | [standalone]

#1375068 — [PATCH 3.14 41/76] [media] saa7134: Fix bytesperline not being set correctly for planar formats

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <hdegoede@redhat.com>

commit 3e71da19f9dc22e39a755d6ae9678661abb66adc upstream.

bytesperline should be the bytesperline for the first plane for planar
formats, not that of all planes combined.

This fixes a crash in xawtv caused by the wrong bpl.

BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1305389
Reported-and-tested-by: Stas Sergeev <stsp@list.ru>

Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/pci/saa7134/saa7134-video.c |   18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -1342,10 +1342,13 @@ static int saa7134_g_fmt_vid_cap(struct
 	f->fmt.pix.height       = dev->height;
 	f->fmt.pix.field        = dev->cap.field;
 	f->fmt.pix.pixelformat  = dev->fmt->fourcc;
-	f->fmt.pix.bytesperline =
-		(f->fmt.pix.width * dev->fmt->depth) >> 3;
+	if (dev->fmt->planar)
+		f->fmt.pix.bytesperline = f->fmt.pix.width;
+	else
+		f->fmt.pix.bytesperline =
+			(f->fmt.pix.width * dev->fmt->depth) / 8;
 	f->fmt.pix.sizeimage =
-		f->fmt.pix.height * f->fmt.pix.bytesperline;
+		(f->fmt.pix.height * f->fmt.pix.width * dev->fmt->depth) / 8;
 	f->fmt.pix.colorspace   = V4L2_COLORSPACE_SMPTE170M;
 	f->fmt.pix.priv = 0;
 	return 0;
@@ -1424,10 +1427,13 @@ static int saa7134_try_fmt_vid_cap(struc
 	if (f->fmt.pix.height > maxh)
 		f->fmt.pix.height = maxh;
 	f->fmt.pix.width &= ~0x03;
-	f->fmt.pix.bytesperline =
-		(f->fmt.pix.width * fmt->depth) >> 3;
+	if (fmt->planar)
+		f->fmt.pix.bytesperline = f->fmt.pix.width;
+	else
+		f->fmt.pix.bytesperline =
+			(f->fmt.pix.width * fmt->depth) / 8;
 	f->fmt.pix.sizeimage =
-		f->fmt.pix.height * f->fmt.pix.bytesperline;
+		(f->fmt.pix.height * f->fmt.pix.width * fmt->depth) / 8;
 	f->fmt.pix.colorspace   = V4L2_COLORSPACE_SMPTE170M;
 	f->fmt.pix.priv = 0;
 

[toc] | [prev] | [next] | [standalone]

#1375069 — [PATCH 3.14 40/76] 8250: use callbacks to access UART_DLL/UART_DLM

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Frias <sf84@laposte.net>

commit 0b41ce991052022c030fd868e03877700220b090 upstream.

Some UART HW has a single register combining UART_DLL/UART_DLM
(this was probably forgotten in the change that introduced the
callbacks, commit b32b19b8ffc05cbd3bf91c65e205f6a912ca15d9)

Fixes: b32b19b8ffc0 ("[SERIAL] 8250: set divisor register correctly ...")

Signed-off-by: Sebastian Frias <sf84@laposte.net>
Reviewed-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/8250/8250_core.c |   18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -686,22 +686,16 @@ static int size_fifo(struct uart_8250_po
  */
 static unsigned int autoconfig_read_divisor_id(struct uart_8250_port *p)
 {
-	unsigned char old_dll, old_dlm, old_lcr;
-	unsigned int id;
+	unsigned char old_lcr;
+	unsigned int id, old_dl;
 
 	old_lcr = serial_in(p, UART_LCR);
 	serial_out(p, UART_LCR, UART_LCR_CONF_MODE_A);
+	old_dl = serial_dl_read(p);
+	serial_dl_write(p, 0);
+	id = serial_dl_read(p);
+	serial_dl_write(p, old_dl);
 
-	old_dll = serial_in(p, UART_DLL);
-	old_dlm = serial_in(p, UART_DLM);
-
-	serial_out(p, UART_DLL, 0);
-	serial_out(p, UART_DLM, 0);
-
-	id = serial_in(p, UART_DLL) | serial_in(p, UART_DLM) << 8;
-
-	serial_out(p, UART_DLL, old_dll);
-	serial_out(p, UART_DLM, old_dlm);
 	serial_out(p, UART_LCR, old_lcr);
 
 	return id;

[toc] | [prev] | [next] | [standalone]

#1375070 — [PATCH 3.14 26/76] Input: powermate - fix oops with malicious USB descriptors

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Josh Boyer <jwboyer@fedoraproject.org>

commit 9c6ba456711687b794dcf285856fc14e2c76074f upstream.

The powermate driver expects at least one valid USB endpoint in its
probe function.  If given malicious descriptors that specify 0 for
the number of endpoints, it will crash.  Validate the number of
endpoints on the interface before using them.

The full report for this issue can be found here:
http://seclists.org/bugtraq/2016/Mar/85

Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
Signed-off-by: Josh Boyer <jwboyer@fedoraproject.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/misc/powermate.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -307,6 +307,9 @@ static int powermate_probe(struct usb_in
 	int error = -ENOMEM;
 
 	interface = intf->cur_altsetting;
+	if (interface->desc.bNumEndpoints < 1)
+		return -EINVAL;
+
 	endpoint = &interface->endpoint[0].desc;
 	if (!usb_endpoint_is_int_in(endpoint))
 		return -EIO;

[toc] | [prev] | [next] | [standalone]

#1375071 — [PATCH 3.14 45/76] ALSA: intel8x0: Add clock quirk entry for AD1981B on IBM ThinkPad X41.

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vittorio Gambaletta (VittGam) <linuxbugs@vittgam.net>

commit 4061db03dd71d195b9973ee466f6ed32f6a3fc16 upstream.

The clock measurement on the AC'97 audio card found in the IBM ThinkPad X41
will often fail, so add a quirk entry to fix it.

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=441087
Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/intel8x0.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -2884,6 +2884,7 @@ static void intel8x0_measure_ac97_clock(
 
 static struct snd_pci_quirk intel8x0_clock_list[] = {
 	SND_PCI_QUIRK(0x0e11, 0x008a, "AD1885", 41000),
+	SND_PCI_QUIRK(0x1014, 0x0581, "AD1981B", 48000),
 	SND_PCI_QUIRK(0x1028, 0x00be, "AD1885", 44100),
 	SND_PCI_QUIRK(0x1028, 0x0177, "AD1980", 48000),
 	SND_PCI_QUIRK(0x1028, 0x01ad, "AD1981B", 48000),

[toc] | [prev] | [next] | [standalone]

#1375072 — [PATCH 3.14 25/76] [media] pwc: Add USB id for Philips Spc880nc webcam

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hans de Goede <hdegoede@redhat.com>

commit 7445e45d19a09e5269dc85f17f9635be29d2f76c upstream.

SPC 880NC PC camera discussions:
	http://www.pclinuxos.com/forum/index.php/topic,135688.0.html

Reported-by: Kikim <klucznik0@op.pl>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/pwc/pwc-if.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/media/usb/pwc/pwc-if.c
+++ b/drivers/media/usb/pwc/pwc-if.c
@@ -91,6 +91,7 @@ static const struct usb_device_id pwc_de
 	{ USB_DEVICE(0x0471, 0x0312) },
 	{ USB_DEVICE(0x0471, 0x0313) }, /* the 'new' 720K */
 	{ USB_DEVICE(0x0471, 0x0329) }, /* Philips SPC 900NC PC Camera */
+	{ USB_DEVICE(0x0471, 0x032C) }, /* Philips SPC 880NC PC Camera */
 	{ USB_DEVICE(0x069A, 0x0001) }, /* Askey */
 	{ USB_DEVICE(0x046D, 0x08B0) }, /* Logitech QuickCam Pro 3000 */
 	{ USB_DEVICE(0x046D, 0x08B1) }, /* Logitech QuickCam Notebook Pro */
@@ -799,6 +800,11 @@ static int usb_pwc_probe(struct usb_inte
 			name = "Philips SPC 900NC webcam";
 			type_id = 740;
 			break;
+		case 0x032C:
+			PWC_INFO("Philips SPC 880NC USB webcam detected.\n");
+			name = "Philips SPC 880NC webcam";
+			type_id = 740;
+			break;
 		default:
 			return -ENODEV;
 			break;

[toc] | [prev] | [next] | [standalone]

#1375087 — [PATCH 3.14 11/76] aacraid: Fix memory leak in aac_fib_map_free

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Raghava Aditya Renukunta <raghavaaditya.renukunta@pmcs.com>

commit f88fa79a61726ce9434df9b4aede36961f709f17 upstream.

aac_fib_map_free() calls pci_free_consistent() without checking that
dev->hw_fib_va is not NULL and dev->max_fib_size is not zero.If they are
indeed NULL/0, this will result in a hang as pci_free_consistent() will
attempt to invalidate cache for the entire 64-bit address space
(which would take a very long time).

Fixed by adding a check to make sure that dev->hw_fib_va and
dev->max_fib_size are not NULL and 0 respectively.

Fixes: 9ad5204d6 - "[SCSI]aacraid: incorrect dma mapping mask during blinked recover or user initiated reset"
Signed-off-by: Raghava Aditya Renukunta <raghavaaditya.renukunta@pmcs.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/aacraid/commsup.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -83,9 +83,12 @@ static int fib_map_alloc(struct aac_dev
 
 void aac_fib_map_free(struct aac_dev *dev)
 {
-	pci_free_consistent(dev->pdev,
-	  dev->max_fib_size * (dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB),
-	  dev->hw_fib_va, dev->hw_fib_pa);
+	if (dev->hw_fib_va && dev->max_fib_size) {
+		pci_free_consistent(dev->pdev,
+		(dev->max_fib_size *
+		(dev->scsi_host_ptr->can_queue + AAC_NUM_MGT_FIB)),
+		dev->hw_fib_va, dev->hw_fib_pa);
+	}
 	dev->hw_fib_va = NULL;
 	dev->hw_fib_pa = 0;
 }

[toc] | [prev] | [next] | [standalone]

#1375093 — [PATCH 3.14 10/76] sg: fix dxferp in from_to case

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Douglas Gilbert <dgilbert@interlog.com>

commit 5ecee0a3ee8d74b6950cb41e8989b0c2174568d4 upstream.

One of the strange things that the original sg driver did was let the
user provide both a data-out buffer (it followed the sg_header+cdb)
_and_ specify a reply length greater than zero. What happened was that
the user data-out buffer was copied into some kernel buffers and then
the mid level was told a read type operation would take place with the
data from the device overwriting the same kernel buffers. The user would
then read those kernel buffers back into the user space.

>From what I can tell, the above action was broken by commit fad7f01e61bf
("sg: set dxferp to NULL for READ with the older SG interface") in 2008
and syzkaller found that out recently.

Make sure that a user space pointer is passed through when data follows
the sg_header structure and command.  Fix the abnormal case when a
non-zero reply_len is also given.

Fixes: fad7f01e61bf737fe8a3740d803f000db57ecac6
Signed-off-by: Douglas Gilbert <dgilbert@interlog.com>
Reviewed-by: Ewan Milne <emilne@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -633,7 +633,8 @@ sg_write(struct file *filp, const char _
 	else
 		hp->dxfer_direction = (mxsize > 0) ? SG_DXFER_FROM_DEV : SG_DXFER_NONE;
 	hp->dxfer_len = mxsize;
-	if (hp->dxfer_direction == SG_DXFER_TO_DEV)
+	if ((hp->dxfer_direction == SG_DXFER_TO_DEV) ||
+	    (hp->dxfer_direction == SG_DXFER_TO_FROM_DEV))
 		hp->dxferp = (char __user *)buf + cmd_size;
 	else
 		hp->dxferp = NULL;

[toc] | [prev] | [next] | [standalone]

#1375107 — [PATCH 3.14 13/76] usb: retry reset if a device times out

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oliver Neukum <oneukum@suse.com>

commit 264904ccc33c604d4b3141bbd33808152dfac45b upstream.

Some devices I got show an inability to operate right after
power on if they are already connected. They are beyond recovery
if the descriptors are requested multiple times. So in case of
a timeout we rather bail early and reset again. But it must be
done only on the first loop lest we get into a reset/time out
spiral that can be overcome with a retry.

This patch is a rework of a patch that fell through the cracks.
http://www.spinics.net/lists/linux-usb/msg103263.html

Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4224,7 +4224,13 @@ hub_port_init (struct usb_hub *hub, stru
 						r = -EPROTO;
 					break;
 				}
-				if (r == 0)
+				/*
+				 * Some devices time out if they are powered on
+				 * when already connected. They need a second
+				 * reset. But only on the first attempt,
+				 * lest we get into a time out/reset loop
+				 */
+				if (r == 0  || (r == -ETIMEDOUT && j == 0))
 					break;
 			}
 			udev->descriptor.bMaxPacketSize0 =

[toc] | [prev] | [next] | [standalone]

#1375168

On 04/10/2016 11:36 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.66 release.
> There are 76 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
> Anything received after that time might be too late.
>

Early feedback: There are multiple build failures.

Building tile:tilegx_defconfig ... failed
	(just one example, this also affects other architectures)

--------------
Error log:
In file included from include/linux/mm.h:19:0,
                  from include/linux/pid_namespace.h:6,
                  from include/linux/ptrace.h:8,
                  from arch/tile/kernel/asm-offsets.c:35:
include/linux/bit_spinlock.h: In function '__bit_spin_unlock':
include/linux/bit_spinlock.h:79:2: error: implicit declaration of function 'smp_mb__before_atomic

Bisect points to 'bitops: Do not default to __clear_bit() for
__clear_bit_unlock()'. Reverting this patch fixes the problem.

Guenter

[toc] | [prev] | [next] | [standalone]

#1375266

On Sun, Apr 10, 2016 at 01:01:19PM -0700, Guenter Roeck wrote:
> On 04/10/2016 11:36 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.14.66 release.
> > There are 76 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
> > Anything received after that time might be too late.
> > 
> 
> Early feedback: There are multiple build failures.
> 
> Building tile:tilegx_defconfig ... failed
> 	(just one example, this also affects other architectures)
> 
> --------------
> Error log:
> In file included from include/linux/mm.h:19:0,
>                  from include/linux/pid_namespace.h:6,
>                  from include/linux/ptrace.h:8,
>                  from arch/tile/kernel/asm-offsets.c:35:
> include/linux/bit_spinlock.h: In function '__bit_spin_unlock':
> include/linux/bit_spinlock.h:79:2: error: implicit declaration of function 'smp_mb__before_atomic
> 
> Bisect points to 'bitops: Do not default to __clear_bit() for
> __clear_bit_unlock()'. Reverting this patch fixes the problem.

Yeah, that wasn't added yet in 3.14, my fault, let me go delete that
patch, thanks for the report.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1375271 — [PATCH 3.14 68/76] target: Fix target_release_cmd_kref shutdown comp leak

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Himanshu Madhani <himanshu.madhani@qlogic.com>

commit 5e47f1985d7107331c3f64fb3ec83d66fd73577e upstream.

This patch fixes an active I/O shutdown bug for fabric
drivers using target_wait_for_sess_cmds(), where se_cmd
descriptor shutdown would result in hung tasks waiting
indefinitely for se_cmd->cmd_wait_comp to complete().

To address this bug, drop the incorrect list_del_init()
usage in target_wait_for_sess_cmds() and always complete()
during se_cmd target_release_cmd_kref() put, in order to
let caller invoke the final fabric release callback
into se_cmd->se_tfo->release_cmd() code.

Reported-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Tested-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Himanshu Madhani <himanshu.madhani@qlogic.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_transport.c |    2 --
 1 file changed, 2 deletions(-)

--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2484,8 +2484,6 @@ void target_wait_for_sess_cmds(struct se
 
 	list_for_each_entry_safe(se_cmd, tmp_cmd,
 				&se_sess->sess_wait_list, se_cmd_list) {
-		list_del_init(&se_cmd->se_cmd_list);
-
 		pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
 			" %d\n", se_cmd, se_cmd->t_state,
 			se_cmd->se_tfo->get_cmd_state(se_cmd));

[toc] | [prev] | [next] | [standalone]

#1375299 — [PATCH 3.14 64/76] tracing: Fix trace_printk() to print when not using bprintk()

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steven Rostedt (Red Hat) <rostedt@goodmis.org>

commit 3debb0a9ddb16526de8b456491b7db60114f7b5e upstream.

The trace_printk() code will allocate extra buffers if the compile detects
that a trace_printk() is used. To do this, the format of the trace_printk()
is saved to the __trace_printk_fmt section, and if that section is bigger
than zero, the buffers are allocated (along with a message that this has
happened).

If trace_printk() uses a format that is not a constant, and thus something
not guaranteed to be around when the print happens, the compiler optimizes
the fmt out, as it is not used, and the __trace_printk_fmt section is not
filled. This means the kernel will not allocate the special buffers needed
for the trace_printk() and the trace_printk() will not write anything to the
tracing buffer.

Adding a "__used" to the variable in the __trace_printk_fmt section will
keep it around, even though it is set to NULL. This will keep the string
from being printed in the debugfs/tracing/printk_formats section as it is
not needed.

Reported-by: Vlastimil Babka <vbabka@suse.cz>
Fixes: 07d777fe8c398 "tracing: Add percpu buffers for trace_printk()"
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/kernel.h      |    6 +++---
 kernel/trace/trace_printk.c |    3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -595,7 +595,7 @@ do {							\
 
 #define do_trace_printk(fmt, args...)					\
 do {									\
-	static const char *trace_printk_fmt				\
+	static const char *trace_printk_fmt __used			\
 		__attribute__((section("__trace_printk_fmt"))) =	\
 		__builtin_constant_p(fmt) ? fmt : NULL;			\
 									\
@@ -639,7 +639,7 @@ int __trace_printk(unsigned long ip, con
  */
 
 #define trace_puts(str) ({						\
-	static const char *trace_printk_fmt				\
+	static const char *trace_printk_fmt __used			\
 		__attribute__((section("__trace_printk_fmt"))) =	\
 		__builtin_constant_p(str) ? str : NULL;			\
 									\
@@ -661,7 +661,7 @@ extern void trace_dump_stack(int skip);
 #define ftrace_vprintk(fmt, vargs)					\
 do {									\
 	if (__builtin_constant_p(fmt)) {				\
-		static const char *trace_printk_fmt			\
+		static const char *trace_printk_fmt __used		\
 		  __attribute__((section("__trace_printk_fmt"))) =	\
 			__builtin_constant_p(fmt) ? fmt : NULL;		\
 									\
--- a/kernel/trace/trace_printk.c
+++ b/kernel/trace/trace_printk.c
@@ -292,6 +292,9 @@ static int t_show(struct seq_file *m, vo
 	const char *str = *fmt;
 	int i;
 
+	if (!*fmt)
+		return 0;
+
 	seq_printf(m, "0x%lx : \"", *(unsigned long *)fmt);
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1375446

On 04/10/2016 11:36 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.66 release.
> There are 76 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
> Anything received after that time might be too late.
>

Build results:
	total: 129 pass: 129 fail: 0
Qemu test results:
	total: 88 pass: 88 fail: 0

This is after the commit previously reported to cause problems
has been dropped (v3.14.65-75).

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1376836

On Sun, Apr 10, 2016 at 08:14:41PM -0700, Guenter Roeck wrote:
> On 04/10/2016 11:36 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 3.14.66 release.
> > There are 76 patches in this series, all will be posted as a response
> > to this one.  If anyone has any issues with these being applied, please
> > let me know.
> > 
> > Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 129 pass: 129 fail: 0
> Qemu test results:
> 	total: 88 pass: 88 fail: 0
> 
> This is after the commit previously reported to cause problems
> has been dropped (v3.14.65-75).
> 
> Details are available at http://kerneltests.org/builders.

Thanks for testing all of these and letting me know.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1376176

On 04/10/2016 12:36 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.66 release.
> There are 76 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Tue Apr 12 18:34:58 UTC 2016.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.66-rc1.gz
> and the diffstat can be found below.
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web