Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1639601 > unrolled thread

[PATCH 4.4 00/60] 4.4.68-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 10/60] power: supply: bq24190_charger: Handle fault before status on interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 05/60] power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 49/60] tcp: do not underestimate skb->truesize in tcp_trim_head() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 11/60] leds: ktd2692: avoid harmless maybe-uninitialized warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 45/60] brcmfmac: Make skb header writable before use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 25/60] usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 41/60] scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
      Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus  alternate-setting assumption Ben Hutchings <ben.hutchings@codethink.co.uk> - 2017-05-12 13:30 +0200
        Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus  alternate-setting assumption Johan Hovold <johan@kernel.org> - 2017-05-12 14:20 +0200
          Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus  alternate-setting assumption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-12 15:20 +0200
    [PATCH 4.4 40/60] serial: 8250_omap: Fix probe and remove for PM runtime Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 02/60] ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 19/60] kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 44/60] brcmfmac: Ensure pointer correctly set if skb data location changes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 47/60] staging: emxx_udc: remove incorrect __init annotations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 18/60] clk: Make x86/ conditional on CONFIG_COMMON_CLK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 13/60] mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 55/60] ipv6: initialize route null entry in addrconf_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 08/60] power: supply: bq24190_charger: Call power_supply_changed() for relevant component Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 50/60] bpf, arm64: fix jit branch offset related to ldimm64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:40 +0200
    [PATCH 4.4 15/60] mwifiex: Avoid skipping WEP key deletion for AP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:50 +0200
    [PATCH 4.4 01/60] 9p: fix a potential acl leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:50 +0200
    [PATCH 4.4 14/60] mwifiex: remove redundant dma padding in AMSDU Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 16:50 +0200
    Re: [PATCH 4.4 00/60] 4.4.68-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-11 23:10 +0200
      Re: [PATCH 4.4 00/60] 4.4.68-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-12 18:00 +0200
    Re: [PATCH 4.4 00/60] 4.4.68-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-12 17:30 +0200
    Re: [PATCH 4.4 00/60] 4.4.68-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-12 21:50 +0200

Page 1 of 2  [1] 2  Next page →

#1639601 — [PATCH 4.4 00/60] 4.4.68-stable review

This is the start of the stable review cycle for the 4.4.68 release.
There are 60 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat May 13 14:12:22 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.68-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.4.68-rc1

Ilya Dryomov <idryomov@gmail.com>
    block: get rid of blk_integrity_revalidate()

Nicolai Hähnle <nicolai.haehnle@amd.com>
    drm/ttm: fix use-after-free races in vm fault handling

Jin Qian <jinqian@google.com>
    f2fs: sanity check segment count

Dan Carpenter <dan.carpenter@oracle.com>
    bnxt_en: allocate enough space for ->ntp_fltr_bmap

WANG Cong <xiyou.wangcong@gmail.com>
    ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf

WANG Cong <xiyou.wangcong@gmail.com>
    ipv6: initialize route null entry in addrconf_init()

Michal Schmidt <mschmidt@redhat.com>
    rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string

Alexander Potapenko <glider@google.com>
    ipv4, ipv6: ensure raw socket message is big enough to hold an IP header

Eric Dumazet <edumazet@google.com>
    tcp: do not inherit fastopen_req from parent

Eric Dumazet <edumazet@google.com>
    tcp: fix wraparound issue in tcp_lp

Daniel Borkmann <daniel@iogearbox.net>
    bpf, arm64: fix jit branch offset related to ldimm64

Eric Dumazet <edumazet@google.com>
    tcp: do not underestimate skb->truesize in tcp_trim_head()

Takashi Iwai <tiwai@suse.de>
    ALSA: hda - Fix deadlock of controller device lock at unbinding

Arnd Bergmann <arnd@arndb.de>
    staging: emxx_udc: remove incorrect __init annotations

Igor Pylypiv <igor.pylypiv@gmail.com>
    staging: wlan-ng: add missing byte order conversion

James Hughes <james.hughes@raspberrypi.org>
    brcmfmac: Make skb header writable before use

James Hughes <james.hughes@raspberrypi.org>
    brcmfmac: Ensure pointer correctly set if skb data location changes

Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
    MIPS: R2-on-R6 MULTU/MADDU/MSUBU emulation bugfix

Dan Carpenter <dan.carpenter@oracle.com>
    scsi: scsi_dh_emc: return success in clariion_std_inquiry()

Finn Thain <fthain@telegraphics.com.au>
    scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m

Tony Lindgren <tony@atomide.com>
    serial: 8250_omap: Fix probe and remove for PM runtime

Stephen Boyd <stephen.boyd@linaro.org>
    phy: qcom-usb-hs: Add depends on EXTCON

Johan Hovold <johan@kernel.org>
    USB: serial: sierra: fix bogus alternate-setting assumption

Johan Hovold <johan@kernel.org>
    USB: serial: io_edgeport: fix descriptor error handling

Johan Hovold <johan@kernel.org>
    USB: serial: mct_u232: fix modem-status error handling

Johan Hovold <johan@kernel.org>
    USB: serial: quatech2: fix control-message error handling

Johan Hovold <johan@kernel.org>
    USB: serial: ftdi_sio: fix latency-timer error handling

Johan Hovold <johan@kernel.org>
    USB: serial: ark3116: fix open error handling

Johan Hovold <johan@kernel.org>
    USB: serial: ti_usb_3410_5052: fix control-message error handling

Johan Hovold <johan@kernel.org>
    USB: serial: io_edgeport: fix epic-descriptor handling

Johan Hovold <johan@kernel.org>
    USB: serial: ssu100: fix control-message error handling

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix incomplete rx sanity check

Johan Hovold <johan@kernel.org>
    USB: serial: keyspan_pda: fix receive sanity checks

Stephen Boyd <stephen.boyd@linaro.org>
    usb: chipidea: Handle extcon events properly

Stephen Boyd <stephen.boyd@linaro.org>
    usb: chipidea: Only read/write OTGSC from one place

Krzysztof Kozlowski <krzk@kernel.org>
    usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths

Krzysztof Kozlowski <krzk@kernel.org>
    usb: host: ehci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths

Ladi Prosek <lprosek@redhat.com>
    KVM: nVMX: do not leak PML full vmexit to L1

Ladi Prosek <lprosek@redhat.com>
    KVM: nVMX: initialize PML fields in vmcs02

Jim Mattson <jmattson@google.com>
    Revert "KVM: nested VMX: disable perf cpuid reporting"

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    x86/platform/intel-mid: Correct MSI IRQ line for watchdog device

Masami Hiramatsu <mhiramat@kernel.org>
    kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed

Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
    clk: Make x86/ conditional on CONFIG_COMMON_CLK

Nikola Pajkovsky <npajkovsky@suse.cz>
    x86/pci-calgary: Fix iommu_free() comparison of unsigned expression >= 0

Ruslan Ruslichenko <rruslich@cisco.com>
    x86/ioapic: Restore IO-APIC irq_chip retrigger callback

Ganapathi Bhat <gbhat@marvell.com>
    mwifiex: Avoid skipping WEP key deletion for AP

Xinming Hu <huxm@marvell.com>
    mwifiex: remove redundant dma padding in AMSDU

Brian Norris <briannorris@chromium.org>
    mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print

Matthijs van Duin <matthijsvanduin@gmail.com>
    ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build

Arnd Bergmann <arnd@arndb.de>
    leds: ktd2692: avoid harmless maybe-uninitialized warning

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Handle fault before status on interrupt

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Don't read fault register outside irq_handle_thread()

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Call power_supply_changed() for relevant component

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Install irq_handler_thread() at end of probe()

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Call set_mode_host() on pm_resume()

Liam Breck <liam@networkimprov.net>
    power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/powernv: Fix opal_exit tracepoint opcode

Ben Hutchings <ben@decadent.org.uk>
    cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode

Cong Wang <xiyou.wangcong@gmail.com>
    9p: fix a potential acl leak


-------------

Diffstat:

 Makefile                                           |   4 +-
 arch/arm/kernel/Makefile                           |   1 -
 arch/arm/kernel/pj4-cp0.c                          |   4 +
 arch/arm/mach-omap2/omap-headsmp.S                 |   3 +-
 arch/arm64/net/bpf_jit_comp.c                      |   8 +-
 arch/mips/kernel/mips-r2-to-r6-emul.c              |  12 +-
 arch/powerpc/platforms/powernv/opal-wrappers.S     |   2 +-
 arch/x86/kernel/apic/io_apic.c                     |   2 +
 arch/x86/kernel/kprobes/common.h                   |   2 +-
 arch/x86/kernel/kprobes/core.c                     |   6 +-
 arch/x86/kernel/kprobes/opt.c                      |   2 +-
 arch/x86/kernel/pci-calgary_64.c                   |   2 +-
 arch/x86/kvm/cpuid.c                               |   6 -
 arch/x86/kvm/vmx.c                                 |  17 +-
 .../platform/intel-mid/device_libs/platform_wdt.c  |   2 +-
 block/blk-integrity.c                              |  19 +--
 block/partition-generic.c                          |   1 -
 drivers/clk/Makefile                               |   2 +
 drivers/gpu/drm/ttm/ttm_bo_vm.c                    |  12 ++
 drivers/leds/leds-ktd2692.c                        |   8 +-
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |   3 +-
 drivers/net/wireless/brcm80211/brcmfmac/core.c     |  23 +--
 drivers/net/wireless/mwifiex/11n_aggr.c            |  19 +--
 drivers/net/wireless/mwifiex/debugfs.c             |   3 +-
 drivers/net/wireless/mwifiex/sta_ioctl.c           |   2 -
 drivers/phy/Kconfig                                |   1 +
 drivers/power/bq24190_charger.c                    | 182 +++++++++------------
 drivers/scsi/Kconfig                               |   2 +-
 drivers/scsi/device_handler/scsi_dh_emc.c          |   2 +-
 drivers/staging/emxx_udc/emxx_udc.c                |   4 +-
 drivers/staging/wlan-ng/p80211netdev.c             |   2 +-
 drivers/tty/serial/8250/8250_omap.c                |   8 +-
 drivers/usb/chipidea/ci.h                          |   3 -
 drivers/usb/chipidea/core.c                        |  32 ----
 drivers/usb/chipidea/otg.c                         |  80 ++++++++-
 drivers/usb/host/ehci-exynos.c                     |   2 +
 drivers/usb/host/ohci-exynos.c                     |   2 +
 drivers/usb/serial/ark3116.c                       |  25 ++-
 drivers/usb/serial/digi_acceleport.c               |  38 +++--
 drivers/usb/serial/ftdi_sio.c                      |   7 +-
 drivers/usb/serial/io_edgeport.c                   |  48 ++++--
 drivers/usb/serial/keyspan_pda.c                   |  19 ++-
 drivers/usb/serial/mct_u232.c                      |   6 +-
 drivers/usb/serial/quatech2.c                      |  24 +--
 drivers/usb/serial/sierra.c                        |  28 +---
 drivers/usb/serial/ssu100.c                        |  31 +++-
 drivers/usb/serial/ti_usb_3410_5052.c              |  12 +-
 fs/9p/acl.c                                        |   2 +
 fs/block_dev.c                                     |   1 -
 fs/f2fs/super.c                                    |   7 +
 include/linux/f2fs_fs.h                            |   6 +
 include/linux/genhd.h                              |   2 -
 include/linux/usb/chipidea.h                       |   2 +
 include/net/addrconf.h                             |   2 +
 include/net/ip6_route.h                            |   1 +
 lib/test_bpf.c                                     |  45 +++++
 net/core/rtnetlink.c                               |   2 +-
 net/ipv4/raw.c                                     |   3 +
 net/ipv4/tcp_lp.c                                  |   6 +-
 net/ipv4/tcp_minisocks.c                           |   1 +
 net/ipv4/tcp_output.c                              |  19 ++-
 net/ipv6/addrconf.c                                |   3 +
 net/ipv6/raw.c                                     |   2 +
 net/ipv6/route.c                                   |  39 +++--
 sound/pci/hda/hda_intel.c                          |  13 ++
 tools/power/cpupower/utils/helpers/cpuid.c         |   1 +
 66 files changed, 520 insertions(+), 360 deletions(-)

[toc] | [next] | [standalone]

#1639604 — [PATCH 4.4 10/60] power: supply: bq24190_charger: Handle fault before status on interrupt

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liam Breck <liam@networkimprov.net>

commit ba52e75718784fda1b683ee0bfded72a0b83b047 upstream.

Reading both fault and status registers and logging any fault should
take priority over handling status register update.

Fix by moving the status handling to later in interrupt routine.

Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/bq24190_charger.c |   46 ++++++++++++++++++++--------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1175,29 +1175,6 @@ static irqreturn_t bq24190_irq_handler_t
 		goto out;
 	}
 
-	if (ss_reg != bdi->ss_reg) {
-		/*
-		 * The device is in host mode so when PG_STAT goes from 1->0
-		 * (i.e., power removed) HIZ needs to be disabled.
-		 */
-		if ((bdi->ss_reg & BQ24190_REG_SS_PG_STAT_MASK) &&
-				!(ss_reg & BQ24190_REG_SS_PG_STAT_MASK)) {
-			ret = bq24190_write_mask(bdi, BQ24190_REG_ISC,
-					BQ24190_REG_ISC_EN_HIZ_MASK,
-					BQ24190_REG_ISC_EN_HIZ_SHIFT,
-					0);
-			if (ret < 0)
-				dev_err(bdi->dev, "Can't access ISC reg: %d\n",
-					ret);
-		}
-
-		if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss))
-			alert_battery = true;
-		if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
-			alert_charger = true;
-		bdi->ss_reg = ss_reg;
-	}
-
 	i = 0;
 	do {
 		ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg);
@@ -1224,6 +1201,29 @@ static irqreturn_t bq24190_irq_handler_t
 		mutex_unlock(&bdi->f_reg_lock);
 	}
 
+	if (ss_reg != bdi->ss_reg) {
+		/*
+		 * The device is in host mode so when PG_STAT goes from 1->0
+		 * (i.e., power removed) HIZ needs to be disabled.
+		 */
+		if ((bdi->ss_reg & BQ24190_REG_SS_PG_STAT_MASK) &&
+				!(ss_reg & BQ24190_REG_SS_PG_STAT_MASK)) {
+			ret = bq24190_write_mask(bdi, BQ24190_REG_ISC,
+					BQ24190_REG_ISC_EN_HIZ_MASK,
+					BQ24190_REG_ISC_EN_HIZ_SHIFT,
+					0);
+			if (ret < 0)
+				dev_err(bdi->dev, "Can't access ISC reg: %d\n",
+					ret);
+		}
+
+		if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss))
+			alert_battery = true;
+		if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss))
+			alert_charger = true;
+		bdi->ss_reg = ss_reg;
+	}
+
 	if (alert_charger)
 		power_supply_changed(bdi->charger);
 	if (alert_battery)

[toc] | [prev] | [next] | [standalone]

#1639605 — [PATCH 4.4 05/60] power: supply: bq24190_charger: Fix irq trigger to IRQF_TRIGGER_FALLING

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Liam Breck <liam@networkimprov.net>

commit 767eee362fd72bb2ca44cc80419ca4b38c6d8369 upstream.

The interrupt signal is TRIGGER_FALLING. This is is specified in the
data sheet PIN FUNCTIONS: "The INT pin sends active low, 256us
pulse to host to report charger device status and fault."

Also the direction can be seen in the data sheet Figure 37 "BQ24190
with D+/D- Detection and USB On-The-Go (OTG)" which shows a 10k
pull-up resistor installed for the sample configurations.

Fixes: d7bf353fd0aa3 ("bq24190_charger: Add support for TI BQ24190 Battery Charger")
Signed-off-by: Liam Breck <kernel@networkimprov.net>
Acked-by: Mark Greer <mgreer@animalcreek.com>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/power/bq24190_charger.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1394,7 +1394,7 @@ static int bq24190_probe(struct i2c_clie
 
 	ret = devm_request_threaded_irq(dev, bdi->irq, NULL,
 			bq24190_irq_handler_thread,
-			IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+			IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
 			"bq24190-charger", bdi);
 	if (ret < 0) {
 		dev_err(dev, "Can't set up irq handler\n");

[toc] | [prev] | [next] | [standalone]

#1639606 — [PATCH 4.4 49/60] tcp: do not underestimate skb->truesize in tcp_trim_head()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>


[ Upstream commit 7162fb242cb8322beb558828fd26b33c3e9fc805 ]

Andrey found a way to trigger the WARN_ON_ONCE(delta < len) in
skb_try_coalesce() using syzkaller and a filter attached to a TCP
socket over loopback interface.

I believe one issue with looped skbs is that tcp_trim_head() can end up
producing skb with under estimated truesize.

It hardly matters for normal conditions, since packets sent over
loopback are never truncated.

Bytes trimmed from skb->head should not change skb truesize, since
skb->head is not reallocated.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_output.c |   19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1221,7 +1221,7 @@ int tcp_fragment(struct sock *sk, struct
  * eventually). The difference is that pulled data not copied, but
  * immediately discarded.
  */
-static void __pskb_trim_head(struct sk_buff *skb, int len)
+static int __pskb_trim_head(struct sk_buff *skb, int len)
 {
 	struct skb_shared_info *shinfo;
 	int i, k, eat;
@@ -1231,7 +1231,7 @@ static void __pskb_trim_head(struct sk_b
 		__skb_pull(skb, eat);
 		len -= eat;
 		if (!len)
-			return;
+			return 0;
 	}
 	eat = len;
 	k = 0;
@@ -1257,23 +1257,28 @@ static void __pskb_trim_head(struct sk_b
 	skb_reset_tail_pointer(skb);
 	skb->data_len -= len;
 	skb->len = skb->data_len;
+	return len;
 }
 
 /* Remove acked data from a packet in the transmit queue. */
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
 {
+	u32 delta_truesize;
+
 	if (skb_unclone(skb, GFP_ATOMIC))
 		return -ENOMEM;
 
-	__pskb_trim_head(skb, len);
+	delta_truesize = __pskb_trim_head(skb, len);
 
 	TCP_SKB_CB(skb)->seq += len;
 	skb->ip_summed = CHECKSUM_PARTIAL;
 
-	skb->truesize	     -= len;
-	sk->sk_wmem_queued   -= len;
-	sk_mem_uncharge(sk, len);
-	sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+	if (delta_truesize) {
+		skb->truesize	   -= delta_truesize;
+		sk->sk_wmem_queued -= delta_truesize;
+		sk_mem_uncharge(sk, delta_truesize);
+		sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
+	}
 
 	/* Any change of skb->len requires recalculation of tso factor. */
 	if (tcp_skb_pcount(skb) > 1)

[toc] | [prev] | [next] | [standalone]

#1639608 — [PATCH 4.4 11/60] leds: ktd2692: avoid harmless maybe-uninitialized warning

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit cbe99c538d1776009e8710755bb6e726f7fffa9b upstream.

gcc gets confused about the control flow in ktd2692_parse_dt(), causing
it to warn about what seems like a potential bug:

drivers/leds/leds-ktd2692.c: In function 'ktd2692_probe':
drivers/leds/leds-ktd2692.c:244:15: error: '*((void *)&led_cfg+8)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/leds/leds-ktd2692.c:225:7: error: 'led_cfg.flash_max_microamp' may be used uninitialized in this function [-Werror=maybe-uninitialized]
drivers/leds/leds-ktd2692.c:232:3: error: 'led_cfg.movie_max_microamp' may be used uninitialized in this function [-Werror=maybe-uninitialized]

The code is fine, and slightly reworking it in an equivalent way lets
gcc figure that out too, which gets rid of the warning.

Fixes: 77e7915b15bb ("leds: ktd2692: Add missing of_node_put")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/leds/leds-ktd2692.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/drivers/leds/leds-ktd2692.c
+++ b/drivers/leds/leds-ktd2692.c
@@ -296,15 +296,15 @@ static int ktd2692_parse_dt(struct ktd26
 		return -ENXIO;
 
 	led->ctrl_gpio = devm_gpiod_get(dev, "ctrl", GPIOD_ASIS);
-	if (IS_ERR(led->ctrl_gpio)) {
-		ret = PTR_ERR(led->ctrl_gpio);
+	ret = PTR_ERR_OR_ZERO(led->ctrl_gpio);
+	if (ret) {
 		dev_err(dev, "cannot get ctrl-gpios %d\n", ret);
 		return ret;
 	}
 
 	led->aux_gpio = devm_gpiod_get(dev, "aux", GPIOD_ASIS);
-	if (IS_ERR(led->aux_gpio)) {
-		ret = PTR_ERR(led->aux_gpio);
+	ret = PTR_ERR_OR_ZERO(led->aux_gpio);
+	if (ret) {
 		dev_err(dev, "cannot get aux-gpios %d\n", ret);
 		return ret;
 	}

[toc] | [prev] | [next] | [standalone]

#1639609 — [PATCH 4.4 45/60] brcmfmac: Make skb header writable before use

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hughes <james.hughes@raspberrypi.org>

commit 9cc4b7cb86cbcc6330a3faa8cd65268cd2d3c227 upstream.

The driver was making changes to the skb_header without
ensuring it was writable (i.e. uncloned).
This patch also removes some boiler plate header size
checking/adjustment code as that is also handled by the
skb_cow_header function used to make header writable.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/core.c |   19 +++++--------------
 1 file changed, 5 insertions(+), 14 deletions(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -232,22 +232,13 @@ static netdev_tx_t brcmf_netdev_start_xm
 		goto done;
 	}
 
-	/* Make sure there's enough room for any header */
-	if (skb_headroom(skb) < drvr->hdrlen) {
-		struct sk_buff *skb2;
-
-		brcmf_dbg(INFO, "%s: insufficient headroom\n",
+	/* Make sure there's enough writable headroom*/
+	ret = skb_cow_head(skb, drvr->hdrlen);
+	if (ret < 0) {
+		brcmf_err("%s: skb_cow_head failed\n",
 			  brcmf_ifname(drvr, ifp->bssidx));
-		drvr->bus_if->tx_realloc++;
-		skb2 = skb_realloc_headroom(skb, drvr->hdrlen);
 		dev_kfree_skb(skb);
-		skb = skb2;
-		if (skb == NULL) {
-			brcmf_err("%s: skb_realloc_headroom failed\n",
-				  brcmf_ifname(drvr, ifp->bssidx));
-			ret = -ENOMEM;
-			goto done;
-		}
+		goto done;
 	}
 
 	/* validate length for ether packet */

[toc] | [prev] | [next] | [standalone]

#1639610 — [PATCH 4.4 25/60] usb: host: ohci-exynos: Decrese node refcount on exynos_ehci_get_phy() error paths

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <krzk@kernel.org>

commit 68bd6fc3cfa98ef253e17307ccafd8ef907b5556 upstream.

Returning from for_each_available_child_of_node() loop requires cleaning
up node refcount.  Error paths lacked it so for example in case of
deferred probe, the refcount of phy node was left increased.

Fixes: 6d40500ac9b6 ("usb: ehci/ohci-exynos: Fix of_node_put() for child when getting PHYs")
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ohci-exynos.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -66,10 +66,12 @@ static int exynos_ohci_get_phy(struct de
 		if (IS_ERR(phy)) {
 			ret = PTR_ERR(phy);
 			if (ret == -EPROBE_DEFER) {
+				of_node_put(child);
 				return ret;
 			} else if (ret != -ENOSYS && ret != -ENODEV) {
 				dev_err(dev,
 					"Error retrieving usb2 phy: %d\n", ret);
+				of_node_put(child);
 				return ret;
 			}
 		}

[toc] | [prev] | [next] | [standalone]

#1639611 — [PATCH 4.4 41/60] scsi: mac_scsi: Fix MAC_SCSI=m option when SCSI=m

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Finn Thain <fthain@telegraphics.com.au>

commit 2559a1ef688f933835912c731bed2254146a9b04 upstream.

The mac_scsi driver still gets disabled when SCSI=m. This should have
been fixed back when I enabled the tristate but I didn't see the bug.

Fixes: 6e9ae6d560e1 ("[PATCH] mac_scsi: Add module option to Kconfig")
Signed-off-by: Finn Thain <fthain@telegraphics.com.au>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -1637,7 +1637,7 @@ config ATARI_SCSI_RESET_BOOT
 
 config MAC_SCSI
 	tristate "Macintosh NCR5380 SCSI"
-	depends on MAC && SCSI=y
+	depends on MAC && SCSI
 	select SCSI_SPI_ATTRS
 	help
 	  This is the NCR 5380 SCSI controller included on most of the 68030

[toc] | [prev] | [next] | [standalone]

#1639612 — [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.

Interface numbers do not change when enabling alternate settings as
comment and code in this driver suggested.

Remove the confusing comment and redundant retrieval of the interface
number in probe, while simplifying and renaming the interface-number
helper.

Fixes: 4db2299da213 ("sierra: driver interface blacklisting")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/sierra.c |   28 +++++-----------------------
 1 file changed, 5 insertions(+), 23 deletions(-)

--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -137,24 +137,9 @@ static int is_himemory(const u8 ifnum,
 	return 0;
 }
 
-static int sierra_calc_interface(struct usb_serial *serial)
+static u8 sierra_interface_num(struct usb_serial *serial)
 {
-	int interface;
-	struct usb_interface *p_interface;
-	struct usb_host_interface *p_host_interface;
-
-	/* Get the interface structure pointer from the serial struct */
-	p_interface = serial->interface;
-
-	/* Get a pointer to the host interface structure */
-	p_host_interface = p_interface->cur_altsetting;
-
-	/* read the interface descriptor for this active altsetting
-	 * to find out the interface number we are on
-	*/
-	interface = p_host_interface->desc.bInterfaceNumber;
-
-	return interface;
+	return serial->interface->cur_altsetting->desc.bInterfaceNumber;
 }
 
 static int sierra_probe(struct usb_serial *serial,
@@ -165,7 +150,7 @@ static int sierra_probe(struct usb_seria
 	u8 ifnum;
 
 	udev = serial->dev;
-	ifnum = sierra_calc_interface(serial);
+	ifnum = sierra_interface_num(serial);
 
 	/*
 	 * If this interface supports more than 1 alternate
@@ -178,9 +163,6 @@ static int sierra_probe(struct usb_seria
 		usb_set_interface(udev, ifnum, 1);
 	}
 
-	/* ifnum could have changed - by calling usb_set_interface */
-	ifnum = sierra_calc_interface(serial);
-
 	if (is_blacklisted(ifnum,
 				(struct sierra_iface_info *)id->driver_info)) {
 		dev_dbg(&serial->dev->dev,
@@ -342,7 +324,7 @@ static int sierra_send_setup(struct usb_
 
 	/* If composite device then properly report interface */
 	if (serial->num_ports == 1) {
-		interface = sierra_calc_interface(serial);
+		interface = sierra_interface_num(serial);
 		/* Control message is sent only to interfaces with
 		 * interrupt_in endpoints
 		 */
@@ -916,7 +898,7 @@ static int sierra_port_probe(struct usb_
 	/* Determine actual memory requirements */
 	if (serial->num_ports == 1) {
 		/* Get interface number for composite device */
-		ifnum = sierra_calc_interface(serial);
+		ifnum = sierra_interface_num(serial);
 		himemoryp = &typeB_interface_list;
 	} else {
 		/* This is really the usb-serial port number of the interface

[toc] | [prev] | [next] | [standalone]

#1640402 — Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption

On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Johan Hovold <johan@kernel.org>
> 
> commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
> 
> Interface numbers do not change when enabling alternate settings as
> comment and code in this driver suggested.
> 
> Remove the confusing comment and redundant retrieval of the interface
> number in probe, while simplifying and renaming the interface-number
> helper.

This looks like cleanup with no functional impact, so unless it's needed
as preparation for something else I think it should be dropped.

Ben.

> Fixes: 4db2299da213 ("sierra: driver interface blacklisting")
> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
>  drivers/usb/serial/sierra.c |   28 +++++-----------------------
>  1 file changed, 5 insertions(+), 23 deletions(-)
> 
> --- a/drivers/usb/serial/sierra.c
> +++ b/drivers/usb/serial/sierra.c
> @@ -137,24 +137,9 @@ static int is_himemory(const u8 ifnum,
>  	return 0;
>  }
>  
> -static int sierra_calc_interface(struct usb_serial *serial)
> +static u8 sierra_interface_num(struct usb_serial *serial)
>  {
> -	int interface;
> -	struct usb_interface *p_interface;
> -	struct usb_host_interface *p_host_interface;
> -
> -	/* Get the interface structure pointer from the serial struct */
> -	p_interface = serial->interface;
> -
> -	/* Get a pointer to the host interface structure */
> -	p_host_interface = p_interface->cur_altsetting;
> -
> -	/* read the interface descriptor for this active altsetting
> -	 * to find out the interface number we are on
> -	*/
> -	interface = p_host_interface->desc.bInterfaceNumber;
> -
> -	return interface;
> +	return serial->interface->cur_altsetting->desc.bInterfaceNumber;
>  }
>  
>  static int sierra_probe(struct usb_serial *serial,
> @@ -165,7 +150,7 @@ static int sierra_probe(struct usb_seria
>  	u8 ifnum;
>  
>  	udev = serial->dev;
> -	ifnum = sierra_calc_interface(serial);
> +	ifnum = sierra_interface_num(serial);
>  
>  	/*
>  	 * If this interface supports more than 1 alternate
> @@ -178,9 +163,6 @@ static int sierra_probe(struct usb_seria
>  		usb_set_interface(udev, ifnum, 1);
>  	}
>  
> -	/* ifnum could have changed - by calling usb_set_interface */
> -	ifnum = sierra_calc_interface(serial);
> -
>  	if (is_blacklisted(ifnum,
>  				(struct sierra_iface_info *)id->driver_info)) {
>  		dev_dbg(&serial->dev->dev,
> @@ -342,7 +324,7 @@ static int sierra_send_setup(struct usb_
>  
>  	/* If composite device then properly report interface */
>  	if (serial->num_ports == 1) {
> -		interface = sierra_calc_interface(serial);
> +		interface = sierra_interface_num(serial);
>  		/* Control message is sent only to interfaces with
>  		 * interrupt_in endpoints
>  		 */
> @@ -916,7 +898,7 @@ static int sierra_port_probe(struct usb_
>  	/* Determine actual memory requirements */
>  	if (serial->num_ports == 1) {
>  		/* Get interface number for composite device */
> -		ifnum = sierra_calc_interface(serial);
> +		ifnum = sierra_interface_num(serial);
>  		himemoryp = &typeB_interface_list;
>  	} else {
>  		/* This is really the usb-serial port number of the interface
> 
> 
> 

-- 
Ben Hutchings
Software Developer, Codethink Ltd.

[toc] | [prev] | [next] | [standalone]

#1640423 — Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption

On Fri, May 12, 2017 at 12:26:17PM +0100, Ben Hutchings wrote:
> On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> > 4.4-stable review patch.  If anyone has any objections, please let me know.
> > 
> > ------------------
> > 
> > From: Johan Hovold <johan@kernel.org>
> > 
> > commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
> > 
> > Interface numbers do not change when enabling alternate settings as
> > comment and code in this driver suggested.
> > 
> > Remove the confusing comment and redundant retrieval of the interface
> > number in probe, while simplifying and renaming the interface-number
> > helper.
> 
> This looks like cleanup with no functional impact, so unless it's needed
> as preparation for something else I think it should be dropped.

Indeed, this one is not needed in -stable.

Thanks,
Johan

[toc] | [prev] | [next] | [standalone]

#1640440 — Re: [PATCH 4.4 38/60] USB: serial: sierra: fix bogus alternate-setting assumption

On Fri, May 12, 2017 at 02:14:03PM +0200, Johan Hovold wrote:
> On Fri, May 12, 2017 at 12:26:17PM +0100, Ben Hutchings wrote:
> > On Thu, 2017-05-11 at 16:13 +0200, Greg Kroah-Hartman wrote:
> > > 4.4-stable review patch.  If anyone has any objections, please let me know.
> > > 
> > > ------------------
> > > 
> > > From: Johan Hovold <johan@kernel.org>
> > > 
> > > commit 16620b483eaf7750413bae472f4363b6b959fcaa upstream.
> > > 
> > > Interface numbers do not change when enabling alternate settings as
> > > comment and code in this driver suggested.
> > > 
> > > Remove the confusing comment and redundant retrieval of the interface
> > > number in probe, while simplifying and renaming the interface-number
> > > helper.
> > 
> > This looks like cleanup with no functional impact, so unless it's needed
> > as preparation for something else I think it should be dropped.
> 
> Indeed, this one is not needed in -stable.

Ah, my fault, I thought this was fixing an issue there, sorry about
that.

Now removed from all of the queues, thanks Ben.

greg k-h

[toc] | [prev] | [next] | [standalone]

#1639613 — [PATCH 4.4 40/60] serial: 8250_omap: Fix probe and remove for PM runtime

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <tony@atomide.com>

commit 4e0f5cc65098ea32a1e77baae74215b9bd5276b1 upstream.

Otherwise the interconnect related code implementing PM runtime will
produce these errors on a failed probe:

omap_uart 48066000.serial: omap_device: omap_device_enable() called from invalid state 1
omap_uart 48066000.serial: use pm_runtime_put_sync_suspend() in driver?

Note that we now also need to check for priv in omap8250_runtime_suspend()
as it has not yet been registered if probe fails. And we need to use
pm_runtime_put_sync() to properly idle the device like we already do
in omap8250_remove().

Fixes: 61929cf0169d ("tty: serial: Add 8250-core based omap driver")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/tty/serial/8250/8250_omap.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1235,7 +1235,8 @@ static int omap8250_probe(struct platfor
 	pm_runtime_put_autosuspend(&pdev->dev);
 	return 0;
 err:
-	pm_runtime_put(&pdev->dev);
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
+	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	return ret;
 }
@@ -1244,6 +1245,7 @@ static int omap8250_remove(struct platfo
 {
 	struct omap8250_priv *priv = platform_get_drvdata(pdev);
 
+	pm_runtime_dont_use_autosuspend(&pdev->dev);
 	pm_runtime_put_sync(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 	serial8250_unregister_port(priv->line);
@@ -1343,6 +1345,10 @@ static int omap8250_runtime_suspend(stru
 	struct omap8250_priv *priv = dev_get_drvdata(dev);
 	struct uart_8250_port *up;
 
+	/* In case runtime-pm tries this before we are setup */
+	if (!priv)
+		return 0;
+
 	up = serial8250_get_port(priv->line);
 	/*
 	 * When using 'no_console_suspend', the console UART must not be

[toc] | [prev] | [next] | [standalone]

#1639615 — [PATCH 4.4 02/60] ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

commit 5008efc83bf85b647aa1cbc44718b1675bbb7444 upstream.

The PJ4 inline asm sequence to write to cp15 cannot be built in Thumb-2
mode, due to the way it performs arithmetic on the program counter, so it
is built in ARM mode instead. However, building C files in ARM mode under
CONFIG_THUMB2_KERNEL is problematic, since the instrumentation performed
by subsystems like ftrace does not expect having to deal with interworking
branches.

Since the sequence in question is simply a poor man's ISB instruction,
let's use a straight 'isb' instead when building in Thumb2 mode. Thumb2
implies V7, so 'isb' should always be supported in that case.

Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kernel/Makefile  |    1 -
 arch/arm/kernel/pj4-cp0.c |    4 ++++
 2 files changed, 4 insertions(+), 1 deletion(-)

--- a/arch/arm/kernel/Makefile
+++ b/arch/arm/kernel/Makefile
@@ -73,7 +73,6 @@ obj-$(CONFIG_IWMMXT)		+= iwmmxt.o
 obj-$(CONFIG_PERF_EVENTS)	+= perf_regs.o perf_callchain.o
 obj-$(CONFIG_HW_PERF_EVENTS)	+= perf_event_xscale.o perf_event_v6.o \
 				   perf_event_v7.o
-CFLAGS_pj4-cp0.o		:= -marm
 AFLAGS_iwmmxt.o			:= -Wa,-mcpu=iwmmxt
 obj-$(CONFIG_ARM_CPU_TOPOLOGY)  += topology.o
 obj-$(CONFIG_VDSO)		+= vdso.o
--- a/arch/arm/kernel/pj4-cp0.c
+++ b/arch/arm/kernel/pj4-cp0.c
@@ -66,9 +66,13 @@ static void __init pj4_cp_access_write(u
 
 	__asm__ __volatile__ (
 		"mcr	p15, 0, %1, c1, c0, 2\n\t"
+#ifdef CONFIG_THUMB2_KERNEL
+		"isb\n\t"
+#else
 		"mrc	p15, 0, %0, c1, c0, 2\n\t"
 		"mov	%0, %0\n\t"
 		"sub	pc, pc, #4\n\t"
+#endif
 		: "=r" (temp) : "r" (value));
 }
 

[toc] | [prev] | [next] | [standalone]

#1639618 — [PATCH 4.4 19/60] kprobes/x86: Fix kernel panic when certain exception-handling addresses are probed

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Masami Hiramatsu <mhiramat@kernel.org>

commit 75013fb16f8484898eaa8d0b08fed942d790f029 upstream.

Fix to the exception table entry check by using probed address
instead of the address of copied instruction.

This bug may cause unexpected kernel panic if user probe an address
where an exception can happen which should be fixup by __ex_table
(e.g. copy_from_user.)

Unless user puts a kprobe on such address, this doesn't
cause any problem.

This bug has been introduced years ago, by commit:

  464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently").

Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 464846888d9a ("x86/kprobes: Fix a bug which can modify kernel code permanently")
Link: http://lkml.kernel.org/r/148829899399.28855.12581062400757221722.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/kprobes/common.h |    2 +-
 arch/x86/kernel/kprobes/core.c   |    6 +++---
 arch/x86/kernel/kprobes/opt.c    |    2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

--- a/arch/x86/kernel/kprobes/common.h
+++ b/arch/x86/kernel/kprobes/common.h
@@ -67,7 +67,7 @@
 #endif
 
 /* Ensure if the instruction can be boostable */
-extern int can_boost(kprobe_opcode_t *instruction);
+extern int can_boost(kprobe_opcode_t *instruction, void *addr);
 /* Recover instruction if given address is probed */
 extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf,
 					 unsigned long addr);
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -163,12 +163,12 @@ NOKPROBE_SYMBOL(skip_prefixes);
  * Returns non-zero if opcode is boostable.
  * RIP relative instructions are adjusted at copying time in 64 bits mode
  */
-int can_boost(kprobe_opcode_t *opcodes)
+int can_boost(kprobe_opcode_t *opcodes, void *addr)
 {
 	kprobe_opcode_t opcode;
 	kprobe_opcode_t *orig_opcodes = opcodes;
 
-	if (search_exception_tables((unsigned long)opcodes))
+	if (search_exception_tables((unsigned long)addr))
 		return 0;	/* Page fault may occur on this address. */
 
 retry:
@@ -413,7 +413,7 @@ static int arch_copy_kprobe(struct kprob
 	 * __copy_instruction can modify the displacement of the instruction,
 	 * but it doesn't affect boostable check.
 	 */
-	if (can_boost(p->ainsn.insn))
+	if (can_boost(p->ainsn.insn, p->addr))
 		p->ainsn.boostable = 0;
 	else
 		p->ainsn.boostable = -1;
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -177,7 +177,7 @@ static int copy_optimized_instructions(u
 
 	while (len < RELATIVEJUMP_SIZE) {
 		ret = __copy_instruction(dest + len, src + len);
-		if (!ret || !can_boost(dest + len))
+		if (!ret || !can_boost(dest + len, src + len))
 			return -EINVAL;
 		len += ret;
 	}

[toc] | [prev] | [next] | [standalone]

#1639619 — [PATCH 4.4 44/60] brcmfmac: Ensure pointer correctly set if skb data location changes

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hughes <james.hughes@raspberrypi.org>

commit 455a1eb4654c24560eb9dfc634f29cba3d87601e upstream.

The incoming skb header may be resized if header space is
insufficient, which might change the data adddress in the skb.
Ensure that a cached pointer to that data is correctly set by
moving assignment to after any possible changes.

Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/brcm80211/brcmfmac/core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c
@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xm
 	int ret;
 	struct brcmf_if *ifp = netdev_priv(ndev);
 	struct brcmf_pub *drvr = ifp->drvr;
-	struct ethhdr *eh = (struct ethhdr *)(skb->data);
+	struct ethhdr *eh;
 
 	brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -257,6 +257,8 @@ static netdev_tx_t brcmf_netdev_start_xm
 		goto done;
 	}
 
+	eh = (struct ethhdr *)(skb->data);
+
 	if (eh->h_proto == htons(ETH_P_PAE))
 		atomic_inc(&ifp->pend_8021x_cnt);
 

[toc] | [prev] | [next] | [standalone]

#1639620 — [PATCH 4.4 47/60] staging: emxx_udc: remove incorrect __init annotations

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 4f3445067d5f78fb8d1970b02610f85c2f377ea4 upstream.

The probe function is not marked __init, but some other functions
are. This leads to a warning on older compilers (e.g. gcc-4.3),
and can cause executing freed memory when built with those
compilers:

WARNING: drivers/staging/emxx_udc/emxx_udc.o(.text+0x2d78): Section mismatch in reference from the function nbu2ss_drv_probe() to the function .init.text:nbu2ss_drv_contest_init()

This removes the annotations.

Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/emxx_udc/emxx_udc.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/staging/emxx_udc/emxx_udc.c
+++ b/drivers/staging/emxx_udc/emxx_udc.c
@@ -3181,7 +3181,7 @@ static const struct {
 };
 
 /*-------------------------------------------------------------------------*/
-static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
+static void nbu2ss_drv_ep_init(struct nbu2ss_udc *udc)
 {
 	int	i;
 
@@ -3211,7 +3211,7 @@ static void __init nbu2ss_drv_ep_init(st
 
 /*-------------------------------------------------------------------------*/
 /* platform_driver */
-static int __init nbu2ss_drv_contest_init(
+static int nbu2ss_drv_contest_init(
 	struct platform_device *pdev,
 	struct nbu2ss_udc *udc)
 {

[toc] | [prev] | [next] | [standalone]

#1639621 — [PATCH 4.4 18/60] clk: Make x86/ conditional on CONFIG_COMMON_CLK

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>

commit f35b6542c3ac3f28056d298348a81f7d56d3a041 upstream.

Fix Makefile for x86 support, dependency on CONFIG_COMMON_CLK
was not explicit

Fixes: 701190fd7419 ('clk: x86: add support for Lynxpoint LPSS clocks')
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/clk/Makefile |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -78,7 +78,9 @@ obj-$(CONFIG_ARCH_TEGRA)		+= tegra/
 obj-$(CONFIG_ARCH_OMAP2PLUS)		+= ti/
 obj-$(CONFIG_ARCH_U8500)		+= ux500/
 obj-$(CONFIG_COMMON_CLK_VERSATILE)	+= versatile/
+ifeq ($(CONFIG_COMMON_CLK), y)
 obj-$(CONFIG_X86)			+= x86/
+endif
 obj-$(CONFIG_ARCH_ZX)			+= zte/
 obj-$(CONFIG_ARCH_ZYNQ)			+= zynq/
 obj-$(CONFIG_H8300)		+= h8300/

[toc] | [prev] | [next] | [standalone]

#1639622 — [PATCH 4.4 13/60] mwifiex: debugfs: Fix (sometimes) off-by-1 SSID print

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Brian Norris <briannorris@chromium.org>

commit 6183468a23fc6b6903f8597982017ad2c7fdefcf upstream.

Similar to commit fcd2042e8d36 ("mwifiex: printk() overflow with 32-byte
SSIDs"), we failed to account for the existence of 32-char SSIDs in our
debugfs code. Unlike in that case though, we zeroed out the containing
struct first, and I'm pretty sure we're guaranteed to have some padding
after the 'ssid.ssid' and 'ssid.ssid_len' fields (the struct is 33 bytes
long).

So, this is the difference between:

  # cat /sys/kernel/debug/mwifiex/mlan0/info
  ...
  essid="0123456789abcdef0123456789abcdef "
  ...

and the correct output:

  # cat /sys/kernel/debug/mwifiex/mlan0/info
  ...
  essid="0123456789abcdef0123456789abcdef"
  ...

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/debugfs.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -115,7 +115,8 @@ mwifiex_info_read(struct file *file, cha
 	if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) {
 		p += sprintf(p, "multicast_count=\"%d\"\n",
 			     netdev_mc_count(netdev));
-		p += sprintf(p, "essid=\"%s\"\n", info.ssid.ssid);
+		p += sprintf(p, "essid=\"%.*s\"\n", info.ssid.ssid_len,
+			     info.ssid.ssid);
 		p += sprintf(p, "bssid=\"%pM\"\n", info.bssid);
 		p += sprintf(p, "channel=\"%d\"\n", (int) info.bss_chan);
 		p += sprintf(p, "country_code = \"%s\"\n", info.country_code);

[toc] | [prev] | [next] | [standalone]

#1639624 — [PATCH 4.4 55/60] ipv6: initialize route null entry in addrconf_init()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: WANG Cong <xiyou.wangcong@gmail.com>


[ Upstream commit 2f460933f58eee3393aba64f0f6d14acb08d1724 ]

Andrey reported a crash on init_net.ipv6.ip6_null_entry->rt6i_idev
since it is always NULL.

This is clearly wrong, we have code to initialize it to loopback_dev,
unfortunately the order is still not correct.

loopback_dev is registered very early during boot, we lose a chance
to re-initialize it in notifier. addrconf_init() is called after
ip6_route_init(), which means we have no chance to correct it.

Fix it by moving this initialization explicitly after
ipv6_add_dev(init_net.loopback_dev) in addrconf_init().

Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/net/ip6_route.h |    1 +
 net/ipv6/addrconf.c     |    2 ++
 net/ipv6/route.c        |   26 +++++++++++++++-----------
 3 files changed, 18 insertions(+), 11 deletions(-)

--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -77,6 +77,7 @@ static inline struct dst_entry *ip6_rout
 struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6,
 				   int flags);
 
+void ip6_route_init_special_entries(void);
 int ip6_route_init(void);
 void ip6_route_cleanup(void);
 
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5940,6 +5940,8 @@ int __init addrconf_init(void)
 		goto errlo;
 	}
 
+	ip6_route_init_special_entries();
+
 	for (i = 0; i < IN6_ADDR_HSIZE; i++)
 		INIT_HLIST_HEAD(&inet6_addr_lst[i]);
 
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3681,6 +3681,21 @@ static struct notifier_block ip6_route_d
 	.priority = 0,
 };
 
+void __init ip6_route_init_special_entries(void)
+{
+	/* Registering of the loopback is done before this portion of code,
+	 * the loopback reference in rt6_info will not be taken, do it
+	 * manually for init_net */
+	init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
+	init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
+	init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
+	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
+	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+  #endif
+}
+
 int __init ip6_route_init(void)
 {
 	int ret;
@@ -3707,17 +3722,6 @@ int __init ip6_route_init(void)
 
 	ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep;
 
-	/* Registering of the loopback is done before this portion of code,
-	 * the loopback reference in rt6_info will not be taken, do it
-	 * manually for init_net */
-	init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev;
-	init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-	init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev;
-	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
-	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
-  #endif
 	ret = fib6_init();
 	if (ret)
 		goto out_register_subsys;

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.kernel

csiph-web