Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1648658 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-05-23 23:00 +0200 |
| Last post | 2017-05-24 22:30 +0200 |
| Articles | 20 on this page of 35 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 099/103] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 098/103] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 097/103] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 095/103] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 012/103] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 037/103] proc: Fix unbalanced hard link numbers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 029/103] drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 034/103] drm/nouveau/tmr: avoid processing completed alarms when adding a new one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 030/103] drm/amdgpu: Make display watermark calculations more accurate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 078/103] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 014/103] dm cache metadata: fail operations if fail_io mode has been established Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:00 +0200
[PATCH 4.4 077/103] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 4.4 080/103] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
[PATCH 4.4 073/103] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 4.4 082/103] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 4.4 081/103] powerpc/64e: Fix hang when debugging programs with relocated kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 4.4 079/103] powerpc/book3s/mce: Move add_taint() later in virtual mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:20 +0200
[PATCH 4.4 102/103] nfsd: encoders mustnt use unitialized values in error cases Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:30 +0200
[PATCH 4.4 103/103] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:30 +0200
[PATCH 4.4 101/103] drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:30 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 06:10 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 09:00 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 09:00 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 09:10 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Thomas Voegtle <tv@lio96.de> - 2017-05-24 11:40 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 13:40 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Thomas Voegtle <tv@lio96.de> - 2017-05-24 14:10 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 15:00 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 14:50 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Mark Brown <broonie@kernel.org> - 2017-05-24 15:10 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 15:20 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Mark Brown <broonie@kernel.org> - 2017-05-24 17:10 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 15:40 +0200
Re: [PATCH 4.4 000/103] 4.4.70-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 22:30 +0200
Page 1 of 2 [1] 2 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 000/103] 4.4.70-stable review |
| Message-ID | <tKoKZ-8pv-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.4.70 release.
There are 103 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu May 25 20:08:25 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.70-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.4.70-rc1
Julius Werner <jwerner@chromium.org>
drivers: char: mem: Check for address space wraparound with mmap()
J. Bruce Fields <bfields@redhat.com>
nfsd: encoders mustn't use unitialized values in error cases
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2
Lukas Wunner <lukas@wunner.de>
PCI: Freeze PME scan before suspending devices
David Woodhouse <dwmw@amazon.co.uk>
PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms
Thomas Gleixner <tglx@linutronix.de>
tracing/kprobes: Enforce kprobes teardown after testing
Al Viro <viro@zeniv.linux.org.uk>
osf_wait4(): fix infoleak
Thomas Gleixner <tglx@linutronix.de>
genirq: Fix chained interrupt data ordering
Johan Hovold <johan@kernel.org>
uwb: fix device quirk on big-endian hosts
Daniel Micay <danielmicay@gmail.com>
stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Check access_ok in strncpy_from_user
James Hogan <james.hogan@imgtec.com>
metag/uaccess: Fix access_ok()
KarimAllah Ahmed <karahmed@amazon.de>
iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.
Malcolm Priestley <tvboxspy@gmail.com>
staging: rtl8192e: fix 2 byte alignment of register BSSIDR.
Keno Fischer <keno@juliacomputing.com>
mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp
Takashi Iwai <tiwai@suse.de>
xc2028: Fix use-after-free bug properly
Kristina Martsenko <kristina.martsenko@arm.com>
arm64: documentation: document tagged pointer stack constraints
Mark Rutland <mark.rutland@arm.com>
arm64: uaccess: ensure extension of access_ok() addr
Mark Rutland <mark.rutland@arm.com>
arm64: xchg: hazard against entire exchange variable
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: not all ADC channels are available
Ludovic Desroches <ludovic.desroches@microchip.com>
ARM: dts: at91: sama5d3_xplained: fix ADC vref
LiuHailong <liu.hailong6@zte.com.cn>
powerpc/64e: Fix hang when debugging programs with relocated kernel
Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
powerpc/pseries: Fix of_node_put() underflow during DLPAR remove
Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
powerpc/book3s/mce: Move add_taint() later in virtual mode
Johan Hovold <johan@kernel.org>
cx231xx-cards: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
cx231xx-audio: fix init error path
Daniel Scheller <d.scheller@gmx.net>
dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops
Alyssa Milburn <amilburn@zall.org>
zr364xx: enforce minimum size when reading header
Johan Hovold <johan@kernel.org>
dib0700: fix NULL-deref at probe
Marek Szyprowski <m.szyprowski@samsung.com>
s5p-mfc: Fix unbalanced call to clock management
Johan Hovold <johan@kernel.org>
gspca: konica: add missing endpoint sanity check
Yan, Zheng <zyan@redhat.com>
ceph: fix recursion between ceph_set_acl() and __ceph_setattr()
Matt Ranostay <matt.ranostay@konsulko.com>
iio: proximity: as3935: fix as3935_write
Dan Carpenter <dan.carpenter@oracle.com>
ipx: call ipxitf_put() in ioctl error path
Peter Hurley <peter@hurleysoftware.com>
tty: Prevent ldisc drivers from re-using stale tty fields
Johan Hovold <johan@kernel.org>
USB: hub: fix non-SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: hub: fix SS hub-descriptor handling
Johan Hovold <johan@kernel.org>
USB: serial: io_ti: fix div-by-zero in set_termios
Johan Hovold <johan@kernel.org>
USB: serial: mct_u232: fix big-endian baud-rate handling
Bjørn Mork <bjorn@mork.no>
USB: serial: qcserial: add more Lenovo EM74xx device IDs
Daniele Palmas <dnlplm@gmail.com>
usb: serial: option: add Telit ME910 support
Johan Hovold <johan@kernel.org>
USB: iowarrior: fix info ioctl on big-endian hosts
Peter Ujfalusi <peter.ujfalusi@ti.com>
usb: musb: tusb6010_omap: Do not reset the other direction's packet size
Alyssa Milburn <amilburn@zall.org>
ttusb2: limit messages to buffer size
Johan Hovold <johan@kernel.org>
mceusb: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
usbvision: fix NULL-deref at probe
Johan Hovold <johan@kernel.org>
net: irda: irda-usb: fix firmware name on big-endian hosts
Peter Chen <peter.chen@nxp.com>
usb: host: xhci-mem: allocate zeroed Scratchpad Buffer
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton
Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
usb: host: xhci-plat: propagate return value of platform_get_irq()
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
sched/fair: Initialize throttle_count for new task-groups lazily
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
sched/fair: Do not announce throttled next buddy in dequeue_task_fair()
Eric Biggers <ebiggers@google.com>
fscrypt: avoid collisions when presenting long encrypted filenames
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: check entire encrypted bigname when finding a dentry
Eric Biggers <ebiggers@google.com>
fscrypt: fix context consistency check when key(s) unavailable
Kristian Evensen <kristian.evensen@gmail.com>
net: qmi_wwan: Add SIMCom 7230E
Dan Carpenter <dan.carpenter@oracle.com>
ext4 crypto: fix some error handling
Theodore Ts'o <tytso@mit.edu>
ext4 crypto: don't let data integrity writebacks fail with ENOMEM
Andrey Korolyov <andrey@xdel.ru>
USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs
Anthony Mallet <anthony.mallet@laas.fr>
USB: serial: ftdi_sio: fix setting latency for unprivileged users
Kirill Tkhai <ktkhai@virtuozzo.com>
pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes()
Eric W. Biederman <ebiederm@xmission.com>
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
Pavel Roskin <plroskin@gmail.com>
iio: dac: ad7303: fix channel description
Rob Herring <robh@kernel.org>
of: fix sparse warning in of_pci_range_parser_one
Takashi Iwai <tiwai@suse.de>
proc: Fix unbalanced hard link numbers
Tobias Herzog <t-herzog@gmx.de>
cdc-acm: fix possible invalid access when processing notification
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: handle races with hw when updating the next alarm time
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: avoid processing completed alarms when adding a new one
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/tmr: ack interrupt before processing alarms
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/therm: remove ineffective workarounds for alarm bugs
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Make display watermark calculations more accurate
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations.
Johan Hovold <johan@kernel.org>
ath9k_htc: fix NULL-deref at probe
Dmitry Tunin <hanipouspilot@gmail.com>
ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device
Martin Schwidefsky <schwidefsky@de.ibm.com>
s390/cputime: fix incorrect system time
Michael Holzheu <holzheu@linux.vnet.ibm.com>
s390/kdump: Add final note
Richard Cochran <rcochran@linutronix.de>
regulator: tps65023: Fix inverted core enable logic.
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation
Wanpeng Li <wanpeng.li@hotmail.com>
KVM: x86: Fix load damaged SSEx MXCSR register
Daniel Glöckner <dg@emlix.com>
ima: accept previously set IMA_NEW_FILE
Brian Norris <briannorris@chromium.org>
mwifiex: pcie: fix cmd_buf use-after-free in remove/reset
Larry Finger <Larry.Finger@lwfinger.net>
rtlwifi: rtl8821ae: setup 8812ae RFE according to device type
Dennis Yang <dennisyang@qnap.com>
md: update slab_cache before releasing new stripes when stripes resizing
Joe Thornber <ejt@redhat.com>
dm space map disk: fix some book keeping in the disk space map
Joe Thornber <ejt@redhat.com>
dm thin metadata: call precommit before saving the roots
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: make the parameter "retain_bytes" unsigned long
Mike Snitzer <snitzer@redhat.com>
dm cache metadata: fail operations if fail_io mode has been established
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: check new buffer allocation watermark every 30 seconds
Mikulas Patocka <mpatocka@redhat.com>
dm bufio: avoid a possible ABBA deadlock
Mikulas Patocka <mpatocka@redhat.com>
dm raid: select the Kconfig option CONFIG_MD_RAID0
Vinothkumar Raja <vinraja@cs.stonybrook.edu>
dm btree: fix for dm_btree_find_lowest_key()
Paolo Abeni <pabeni@redhat.com>
infiniband: call ipv6 route lookup via the stub interface
Jerry Snitselaar <jsnitsel@redhat.com>
tpm_crb: check for bad response size
Marc Dietrich <marvin24@gmx.de>
ARM: tegra: paz00: Mark panel regulator as enabled on boot
Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
USB: core: replace %p with %pK
Willy Tarreau <w@1wt.eu>
char: lp: fix possible integer overflow in lp_setup()
Johan Hovold <johan@kernel.org>
watchdog: pcwd_usb: fix NULL-deref at probe
Alan Stern <stern@rowland.harvard.edu>
USB: ene_usb6250: fix DMA to the stack
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix memory leak
Maksim Salau <maksim.salau@gmail.com>
usb: misc: legousbtower: Fix buffers on stack
-------------
Diffstat:
Documentation/arm64/tagged-pointers.txt | 62 ++++++++---
Makefile | 4 +-
arch/alpha/kernel/osf_sys.c | 6 +-
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 5 +-
arch/arm/boot/dts/tegra20-paz00.dts | 1 +
arch/arm64/include/asm/cmpxchg.h | 2 +-
arch/arm64/include/asm/uaccess.h | 3 +-
arch/metag/include/asm/uaccess.h | 49 ++++++---
arch/powerpc/kernel/exceptions-64e.S | 12 ++
arch/powerpc/kernel/mce.c | 2 +
arch/powerpc/kernel/traps.c | 4 +-
arch/powerpc/platforms/pseries/dlpar.c | 1 -
arch/s390/kernel/crash_dump.c | 15 +++
arch/s390/kernel/entry.S | 21 +++-
arch/x86/kernel/fpu/init.c | 1 +
arch/x86/kvm/x86.c | 33 ++++--
drivers/char/lp.c | 6 +-
drivers/char/mem.c | 5 +
drivers/char/tpm/tpm_crb.c | 3 +-
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 29 ++---
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 29 ++---
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 29 ++---
drivers/gpu/drm/drm_edid.c | 8 ++
drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 59 ++++++----
drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c | 2 +-
drivers/iio/dac/ad7303.c | 6 +-
drivers/iio/proximity/as3935.c | 3 +-
drivers/infiniband/core/addr.c | 4 +-
drivers/iommu/intel-iommu.c | 5 +-
drivers/md/Kconfig | 1 +
drivers/md/dm-bufio.c | 35 ++++--
drivers/md/dm-cache-metadata.c | 12 +-
drivers/md/dm-thin-metadata.c | 4 +-
drivers/md/persistent-data/dm-btree.c | 8 +-
drivers/md/persistent-data/dm-space-map-disk.c | 15 ++-
drivers/md/raid5.c | 6 +-
drivers/media/dvb-frontends/cxd2841er.c | 4 +-
drivers/media/platform/s5p-mfc/s5p_mfc.c | 1 +
drivers/media/rc/mceusb.c | 4 +-
drivers/media/tuners/tuner-xc2028.c | 37 +++----
drivers/media/usb/cx231xx/cx231xx-audio.c | 42 ++++---
drivers/media/usb/cx231xx/cx231xx-cards.c | 45 +++++++-
drivers/media/usb/dvb-usb/dib0700_core.c | 3 +
drivers/media/usb/dvb-usb/ttusb2.c | 19 ++++
drivers/media/usb/gspca/konica.c | 3 +
drivers/media/usb/usbvision/usbvision-video.c | 9 +-
drivers/media/usb/zr364xx/zr364xx.c | 8 ++
drivers/net/irda/irda-usb.c | 2 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/wireless/ath/ath9k/hif_usb.c | 4 +
drivers/net/wireless/mwifiex/pcie.c | 7 ++
.../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 122 ++++++++++++++++++---
.../net/wireless/realtek/rtlwifi/rtl8821ae/reg.h | 1 +
drivers/of/address.c | 2 +-
drivers/pci/pci-sysfs.c | 10 +-
drivers/pci/pci.c | 9 +-
drivers/regulator/tps65023-regulator.c | 3 +-
drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 11 +-
drivers/tty/tty_ldisc.c | 7 ++
drivers/usb/class/cdc-acm.c | 13 ++-
drivers/usb/core/devio.c | 4 +-
drivers/usb/core/hcd.c | 4 +-
drivers/usb/core/hub.c | 19 +++-
drivers/usb/core/urb.c | 2 +-
drivers/usb/host/xhci-mem.c | 2 +-
drivers/usb/host/xhci-pci.c | 7 +-
drivers/usb/host/xhci-plat.c | 2 +-
drivers/usb/misc/iowarrior.c | 2 +-
drivers/usb/misc/legousbtower.c | 38 +++++--
drivers/usb/musb/tusb6010_omap.c | 13 ++-
drivers/usb/serial/ftdi_sio.c | 10 +-
drivers/usb/serial/ftdi_sio_ids.h | 2 +
drivers/usb/serial/io_ti.c | 5 +-
drivers/usb/serial/mct_u232.c | 2 +-
drivers/usb/serial/option.c | 8 ++
drivers/usb/serial/qcserial.c | 2 +
drivers/usb/storage/ene_ub6250.c | 90 +++++++++------
drivers/uwb/i1480/dfu/usb.c | 5 +-
drivers/watchdog/pcwd_usb.c | 3 +
fs/ceph/acl.c | 4 +-
fs/ceph/inode.c | 27 +++--
fs/ceph/super.h | 1 +
fs/ext4/crypto.c | 37 ++++---
fs/ext4/crypto_fname.c | 2 +-
fs/ext4/crypto_policy.c | 66 ++++++++---
fs/ext4/ext4.h | 6 +-
fs/ext4/namei.c | 4 +-
fs/ext4/page-io.c | 14 ++-
fs/ext4/readpage.c | 2 +-
fs/f2fs/crypto_fname.c | 2 +-
fs/f2fs/crypto_policy.c | 65 ++++++++---
fs/f2fs/dir.c | 32 ++++--
fs/f2fs/f2fs.h | 3 +-
fs/f2fs/hash.c | 7 +-
fs/f2fs/inline.c | 4 +-
fs/nfsd/nfs4xdr.c | 8 +-
fs/proc/generic.c | 1 +
include/linux/kprobes.h | 4 +-
kernel/fork.c | 10 +-
kernel/irq/chip.c | 2 +-
kernel/kprobes.c | 2 +-
kernel/pid_namespace.c | 2 +-
kernel/sched/fair.c | 29 ++++-
kernel/sched/sched.h | 2 +-
kernel/trace/trace_kprobe.c | 5 +
mm/huge_memory.c | 12 +-
net/ipx/af_ipx.c | 5 +-
security/integrity/ima/ima_appraise.c | 5 +-
112 files changed, 1005 insertions(+), 443 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 099/103] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms |
| Message-ID | <tKp4o-7w-53@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
commit 6bccc7f426abd640f08d8c75fb22f99483f201b4 upstream.
In the PCI_MMAP_PROCFS case when the address being passed by the user is a
'user visible' resource address based on the bus window, and not the actual
contents of the resource, that's what we need to be checking it against.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-sysfs.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -973,15 +973,19 @@ void pci_remove_legacy_files(struct pci_
int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
enum pci_mmap_api mmap_api)
{
- unsigned long nr, start, size, pci_start;
+ unsigned long nr, start, size;
+ resource_size_t pci_start = 0, pci_end;
if (pci_resource_len(pdev, resno) == 0)
return 0;
nr = vma_pages(vma);
start = vma->vm_pgoff;
size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
- pci_start = (mmap_api == PCI_MMAP_PROCFS) ?
- pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
+ if (mmap_api == PCI_MMAP_PROCFS) {
+ pci_resource_to_user(pdev, resno, &pdev->resource[resno],
+ &pci_start, &pci_end);
+ pci_start >>= PAGE_SHIFT;
+ }
if (start >= pci_start && start < pci_start + size &&
start + nr <= pci_start + size)
return 1;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 098/103] tracing/kprobes: Enforce kprobes teardown after testing |
| Message-ID | <tKp4o-7w-61@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.
Enabling the tracer selftest triggers occasionally the warning in
text_poke(), which warns when the to be modified page is not marked
reserved.
The reason is that the tracer selftest installs kprobes on functions marked
__init for testing. These probes are removed after the tests, but that
removal schedules the delayed kprobes_optimizer work, which will do the
actual text poke. If the work is executed after the init text is freed,
then the warning triggers. The bug can be reproduced reliably when the work
delay is increased.
Flush the optimizer work and wait for the optimizing/unoptimizing lists to
become empty before returning from the kprobes tracer selftest. That
ensures that all operations which were queued due to the probes removal
have completed.
Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 6274de498 ("kprobes: Support delayed unoptimizing")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/kprobes.h | 4 +++-
kernel/kprobes.c | 2 +-
kernel/trace/trace_kprobe.c | 5 +++++
3 files changed, 9 insertions(+), 2 deletions(-)
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -330,7 +330,9 @@ extern int proc_kprobes_optimization_han
int write, void __user *buffer,
size_t *length, loff_t *ppos);
#endif
-
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
#endif /* CONFIG_OPTPROBES */
#ifdef CONFIG_KPROBES_ON_FTRACE
extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -563,7 +563,7 @@ static void kprobe_optimizer(struct work
}
/* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
{
mutex_lock(&kprobe_mutex);
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1471,6 +1471,11 @@ static __init int kprobe_trace_self_test
end:
release_all_trace_kprobes();
+ /*
+ * Wait for the optimizer work to finish. Otherwise it might fiddle
+ * with probes in already freed __init text.
+ */
+ wait_for_kprobe_optimizer();
if (warn)
pr_cont("NG: Some tests are failed. Please check them.\n");
else
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 097/103] osf_wait4(): fix infoleak |
| Message-ID | <tKp4o-7w-57@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Al Viro <viro@zeniv.linux.org.uk> commit a8c39544a6eb2093c04afd5005b6192bd0e880c6 upstream. failing sys_wait4() won't fill struct rusage... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/alpha/kernel/osf_sys.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/arch/alpha/kernel/osf_sys.c +++ b/arch/alpha/kernel/osf_sys.c @@ -1188,8 +1188,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, i if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur))) return -EFAULT; - err = 0; - err |= put_user(status, ustatus); + err = put_user(status, ustatus); + if (ret < 0) + return err ? err : ret; + err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec); err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec); err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 095/103] uwb: fix device quirk on big-endian hosts |
| Message-ID | <tKp4o-7w-63@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 41318a2b82f5d5fe1fb408f6d6e0b22aa557111d upstream.
Add missing endianness conversion when using the USB device-descriptor
idProduct field to apply a hardware quirk.
Fixes: 1ba47da52712 ("uwb: add the i1480 DFU driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uwb/i1480/dfu/usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/uwb/i1480/dfu/usb.c
+++ b/drivers/uwb/i1480/dfu/usb.c
@@ -341,6 +341,7 @@ error_submit_ep1:
static
int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id)
{
+ struct usb_device *udev = interface_to_usbdev(iface);
struct i1480_usb *i1480_usb;
struct i1480 *i1480;
struct device *dev = &iface->dev;
@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface
iface->cur_altsetting->desc.bInterfaceNumber);
goto error;
}
- if (iface->num_altsetting > 1
- && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) {
+ if (iface->num_altsetting > 1 &&
+ le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) {
/* Need altsetting #1 [HW QUIRK] or EP1 won't work */
result = usb_set_interface(interface_to_usbdev(iface), 0, 1);
if (result < 0)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 012/103] dm bufio: avoid a possible ABBA deadlock |
| Message-ID | <tKp4o-7w-65@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 upstream.
__get_memory_limit() tests if dm_bufio_cache_size changed and calls
__cache_size_refresh() if it did. It takes dm_bufio_clients_lock while
it already holds the client lock. However, lock ordering is violated
because in cleanup_old_buffers() dm_bufio_clients_lock is taken before
the client lock.
This results in a possible deadlock and lockdep engine warning.
Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the
lock can't be taken, it will be re-checked next time when a new buffer
is allocated.
Also add "unlikely" to the if condition, so that the optimizer assumes
that the condition is false.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-bufio.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -914,10 +914,11 @@ static void __get_memory_limit(struct dm
{
unsigned long buffers;
- if (ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch) {
- mutex_lock(&dm_bufio_clients_lock);
- __cache_size_refresh();
- mutex_unlock(&dm_bufio_clients_lock);
+ if (unlikely(ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch)) {
+ if (mutex_trylock(&dm_bufio_clients_lock)) {
+ __cache_size_refresh();
+ mutex_unlock(&dm_bufio_clients_lock);
+ }
}
buffers = dm_bufio_cache_size_per_client >>
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 037/103] proc: Fix unbalanced hard link numbers |
| Message-ID | <tKp4o-7w-67@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit d66bb1607e2d8d384e53f3d93db5c18483c8c4f7 upstream.
proc_create_mount_point() forgot to increase the parent's nlink, and
it resulted in unbalanced hard link numbers, e.g. /proc/fs shows one
less than expected.
Fixes: eb6d38d5427b ("proc: Allow creating permanently empty directories...")
Reported-by: Tristan Ye <tristan.ye@suse.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -469,6 +469,7 @@ struct proc_dir_entry *proc_create_mount
ent->data = NULL;
ent->proc_fops = NULL;
ent->proc_iops = NULL;
+ parent->nlink++;
if (proc_register(parent, ent) < 0) {
kfree(ent);
parent->nlink--;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 029/103] drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. |
| Message-ID | <tKp4o-7w-71@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit e190ed1ea7458e446230de4113cc5d53b8dc4ec8 upstream.
At dot clocks > approx. 250 Mhz, some of these calcs will overflow and
cause miscalculation of latency watermarks, and for some overflows also
divide-by-zero driver crash ("divide error: 0000 [#1] PREEMPT SMP" in
"dce_v10_0_latency_watermark+0x12d/0x190").
This zero-divide happened, e.g., on AMD Tonga Pro under DCE-10,
on a Displayport panel when trying to set a video mode of 2560x1440
at 165 Hz vrefresh with a dot clock of 635.540 Mhz.
Refine calculations to avoid the overflows.
Tested for DCE-10 with R9 380 Tonga + ASUS ROG PG279 panel.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 19 +++----------------
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 19 +++----------------
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 19 +++----------------
3 files changed, 9 insertions(+), 48 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1126,23 +1126,10 @@ static u32 dce_v10_0_latency_watermark(s
a.full = dfixed_const(available_bandwidth);
b.full = dfixed_const(wm->num_heads);
a.full = dfixed_div(a, b);
+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512);
+ tmp = min(dfixed_trunc(a), tmp);
- b.full = dfixed_const(mc_latency + 512);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(b, c);
-
- c.full = dfixed_const(dmif_size);
- b.full = dfixed_div(c, b);
-
- tmp = min(dfixed_trunc(a), dfixed_trunc(b));
-
- b.full = dfixed_const(1000);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(c, b);
- c.full = dfixed_const(wm->bytes_per_pixel);
- b.full = dfixed_mul(b, c);
-
- lb_fill_bw = min(tmp, dfixed_trunc(b));
+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000);
a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel);
b.full = dfixed_const(1000);
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1114,23 +1114,10 @@ static u32 dce_v11_0_latency_watermark(s
a.full = dfixed_const(available_bandwidth);
b.full = dfixed_const(wm->num_heads);
a.full = dfixed_div(a, b);
+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512);
+ tmp = min(dfixed_trunc(a), tmp);
- b.full = dfixed_const(mc_latency + 512);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(b, c);
-
- c.full = dfixed_const(dmif_size);
- b.full = dfixed_div(c, b);
-
- tmp = min(dfixed_trunc(a), dfixed_trunc(b));
-
- b.full = dfixed_const(1000);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(c, b);
- c.full = dfixed_const(wm->bytes_per_pixel);
- b.full = dfixed_mul(b, c);
-
- lb_fill_bw = min(tmp, dfixed_trunc(b));
+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000);
a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel);
b.full = dfixed_const(1000);
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1096,23 +1096,10 @@ static u32 dce_v8_0_latency_watermark(st
a.full = dfixed_const(available_bandwidth);
b.full = dfixed_const(wm->num_heads);
a.full = dfixed_div(a, b);
+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512);
+ tmp = min(dfixed_trunc(a), tmp);
- b.full = dfixed_const(mc_latency + 512);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(b, c);
-
- c.full = dfixed_const(dmif_size);
- b.full = dfixed_div(c, b);
-
- tmp = min(dfixed_trunc(a), dfixed_trunc(b));
-
- b.full = dfixed_const(1000);
- c.full = dfixed_const(wm->disp_clk);
- b.full = dfixed_div(c, b);
- c.full = dfixed_const(wm->bytes_per_pixel);
- b.full = dfixed_mul(b, c);
-
- lb_fill_bw = min(tmp, dfixed_trunc(b));
+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000);
a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel);
b.full = dfixed_const(1000);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 034/103] drm/nouveau/tmr: avoid processing completed alarms when adding a new one |
| Message-ID | <tKp4o-7w-69@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Skeggs <bskeggs@redhat.com>
commit 330bdf62fe6a6c5b99a647f7bf7157107c9348b3 upstream.
The idea here was to avoid having to "manually" program the HW if there's
a new earliest alarm. This was lazy and bad, as it leads to loads of fun
races between inter-related callers (ie. therm).
Turns out, it's not so difficult after all. Go figure ;)
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c
@@ -80,12 +80,22 @@ nvkm_timer_alarm(struct nvkm_timer *tmr,
if (list->timestamp > alarm->timestamp)
break;
}
+
list_add_tail(&alarm->head, &list->head);
+
+ /* Update HW if this is now the earliest alarm. */
+ list = list_first_entry(&tmr->alarms, typeof(*list), head);
+ if (list == alarm) {
+ tmr->func->alarm_init(tmr, alarm->timestamp);
+ /* This shouldn't happen if callers aren't stupid.
+ *
+ * Worst case scenario is that it'll take roughly
+ * 4 seconds for the next alarm to trigger.
+ */
+ WARN_ON(alarm->timestamp <= nvkm_timer_read(tmr));
+ }
}
spin_unlock_irqrestore(&tmr->lock, flags);
-
- /* process pending alarms */
- nvkm_timer_alarm_trigger(tmr);
}
void
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 030/103] drm/amdgpu: Make display watermark calculations more accurate |
| Message-ID | <tKp4o-7w-75@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit d63c277dc672e0c568481af043359420fa9d4736 upstream.
Avoid big roundoff errors in scanline/hactive durations for
high pixel clocks, especially for >= 500 Mhz, and thereby
program more accurate display fifo watermarks.
Implemented here for DCE 6,8,10,11.
Successfully tested on DCE 10 with AMD R9 380 Tonga.
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/dce_v10_0.c | 10 +++++-----
drivers/gpu/drm/amd/amdgpu/dce_v11_0.c | 10 +++++-----
drivers/gpu/drm/amd/amdgpu/dce_v8_0.c | 10 +++++-----
3 files changed, 15 insertions(+), 15 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@@ -1237,14 +1237,14 @@ static void dce_v10_0_program_watermarks
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce10_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1259,7 +1259,7 @@ static void dce_v10_0_program_watermarks
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1298,7 +1298,7 @@ static void dce_v10_0_program_watermarks
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@@ -1225,14 +1225,14 @@ static void dce_v11_0_program_watermarks
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce10_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1247,7 +1247,7 @@ static void dce_v11_0_program_watermarks
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1286,7 +1286,7 @@ static void dce_v11_0_program_watermarks
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@@ -1207,14 +1207,14 @@ static void dce_v8_0_program_watermarks(
{
struct drm_display_mode *mode = &amdgpu_crtc->base.mode;
struct dce8_wm_params wm_low, wm_high;
- u32 pixel_period;
+ u32 active_time;
u32 line_time = 0;
u32 latency_watermark_a = 0, latency_watermark_b = 0;
u32 tmp, wm_mask, lb_vblank_lead_lines = 0;
if (amdgpu_crtc->base.enabled && num_heads && mode) {
- pixel_period = 1000000 / (u32)mode->clock;
- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535);
+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock;
+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535);
/* watermark for high clocks */
if (adev->pm.dpm_enabled) {
@@ -1229,7 +1229,7 @@ static void dce_v8_0_program_watermarks(
wm_high.disp_clk = mode->clock;
wm_high.src_width = mode->crtc_hdisplay;
- wm_high.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_high.active_time = active_time;
wm_high.blank_time = line_time - wm_high.active_time;
wm_high.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
@@ -1268,7 +1268,7 @@ static void dce_v8_0_program_watermarks(
wm_low.disp_clk = mode->clock;
wm_low.src_width = mode->crtc_hdisplay;
- wm_low.active_time = mode->crtc_hdisplay * pixel_period;
+ wm_low.active_time = active_time;
wm_low.blank_time = line_time - wm_low.active_time;
wm_low.interlaced = false;
if (mode->flags & DRM_MODE_FLAG_INTERLACE)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 078/103] [media] cx231xx-cards: fix NULL-deref at probe |
| Message-ID | <tKp4p-7w-77@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0cd273bb5e4d1828efaaa8dfd11b7928131ed149 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-cards.c | 45 ++++++++++++++++++++++++++----
1 file changed, 40 insertions(+), 5 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-cards.c
+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c
@@ -1447,6 +1447,9 @@ static int cx231xx_init_v4l2(struct cx23
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->video_mode.end_point_addr = uif->altsetting[0].endpoint[isoc_pipe].desc.bEndpointAddress;
dev->video_mode.num_alt = uif->num_altsetting;
@@ -1460,7 +1463,12 @@ static int cx231xx_init_v4l2(struct cx23
return -ENOMEM;
for (i = 0; i < dev->video_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize);
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize);
dev->video_mode.alt_max_pkt_size[i] = (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
dev_dbg(dev->dev,
"Alternate setting %i, max size= %i\n", i,
@@ -1477,6 +1485,9 @@ static int cx231xx_init_v4l2(struct cx23
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->vbi_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -1493,8 +1504,12 @@ static int cx231xx_init_v4l2(struct cx23
return -ENOMEM;
for (i = 0; i < dev->vbi_mode.num_alt; i++) {
- u16 tmp =
- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize);
dev->vbi_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -1514,6 +1529,9 @@ static int cx231xx_init_v4l2(struct cx23
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
dev->sliced_cc_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -1528,7 +1546,12 @@ static int cx231xx_init_v4l2(struct cx23
return -ENOMEM;
for (i = 0; i < dev->sliced_cc_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1)
+ return -ENODEV;
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].
desc.wMaxPacketSize);
dev->sliced_cc_mode.alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -1693,6 +1716,11 @@ static int cx231xx_usb_probe(struct usb_
}
uif = udev->actconfig->interface[idx];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+ retval = -ENODEV;
+ goto err_video_alt;
+ }
+
dev->ts1_mode.end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].
desc.bEndpointAddress;
@@ -1710,7 +1738,14 @@ static int cx231xx_usb_probe(struct usb_
}
for (i = 0; i < dev->ts1_mode.num_alt; i++) {
- u16 tmp = le16_to_cpu(uif->altsetting[i].
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+ retval = -ENODEV;
+ goto err_video_alt;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].
endpoint[isoc_pipe].desc.
wMaxPacketSize);
dev->ts1_mode.alt_max_pkt_size[i] =
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:00 +0200 |
| Subject | [PATCH 4.4 014/103] dm cache metadata: fail operations if fail_io mode has been established |
| Message-ID | <tKp4p-7w-79@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <snitzer@redhat.com>
commit 10add84e276432d9dd8044679a1028dd4084117e upstream.
Otherwise it is possible to trigger crashes due to the metadata being
inaccessible yet these methods don't safely account for that possibility
without these checks.
Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-cache-metadata.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/md/dm-cache-metadata.c
+++ b/drivers/md/dm-cache-metadata.c
@@ -1326,17 +1326,19 @@ void dm_cache_metadata_set_stats(struct
int dm_cache_commit(struct dm_cache_metadata *cmd, bool clean_shutdown)
{
- int r;
+ int r = -EINVAL;
flags_mutator mutator = (clean_shutdown ? set_clean_shutdown :
clear_clean_shutdown);
WRITE_LOCK(cmd);
+ if (cmd->fail_io)
+ goto out;
+
r = __commit_transaction(cmd, mutator);
if (r)
goto out;
r = __begin_transaction(cmd);
-
out:
WRITE_UNLOCK(cmd);
return r;
@@ -1348,7 +1350,8 @@ int dm_cache_get_free_metadata_block_cou
int r = -EINVAL;
READ_LOCK(cmd);
- r = dm_sm_get_nr_free(cmd->metadata_sm, result);
+ if (!cmd->fail_io)
+ r = dm_sm_get_nr_free(cmd->metadata_sm, result);
READ_UNLOCK(cmd);
return r;
@@ -1360,7 +1363,8 @@ int dm_cache_get_metadata_dev_size(struc
int r = -EINVAL;
READ_LOCK(cmd);
- r = dm_sm_get_nr_blocks(cmd->metadata_sm, result);
+ if (!cmd->fail_io)
+ r = dm_sm_get_nr_blocks(cmd->metadata_sm, result);
READ_UNLOCK(cmd);
return r;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:10 +0200 |
| Subject | [PATCH 4.4 077/103] [media] cx231xx-audio: fix NULL-deref at probe |
| Message-ID | <tKpe2-rD-33@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.
Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")
Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/cx231xx/cx231xx-audio.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -698,6 +698,11 @@ static int cx231xx_audio_init(struct cx2
hs_config_info[0].interface_info.
audio_index + 1];
+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+ err = -ENODEV;
+ goto err_free_card;
+ }
+
adev->end_point_addr =
uif->altsetting[0].endpoint[isoc_pipe].desc.
bEndpointAddress;
@@ -713,8 +718,14 @@ static int cx231xx_audio_init(struct cx2
}
for (i = 0; i < adev->num_alt; i++) {
- u16 tmp =
- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
+ u16 tmp;
+
+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+ err = -ENODEV;
+ goto err_free_pkt_size;
+ }
+
+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
wMaxPacketSize);
adev->alt_max_pkt_size[i] =
(tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -725,6 +736,8 @@ static int cx231xx_audio_init(struct cx2
return 0;
+err_free_pkt_size:
+ kfree(adev->alt_max_pkt_size);
err_free_card:
snd_card_free(card);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:10 +0200 |
| Subject | [PATCH 4.4 080/103] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove |
| Message-ID | <tKpe4-rD-67@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
commit 68baf692c435339e6295cb470ea5545cbc28160e upstream.
Historically struct device_node references were tracked using a kref embedded as
a struct field. Commit 75b57ecf9d1d ("of: Make device nodes kobjects so they
show up in sysfs") (Mar 2014) refactored device_nodes to be kobjects such that
the device tree could by more simply exposed to userspace using sysfs.
Commit 0829f6d1f69e ("of: device_node kobject lifecycle fixes") (Mar 2014)
followed up these changes to better control the kobject lifecycle and in
particular the referecne counting via of_node_get(), of_node_put(), and
of_node_init().
A result of this second commit was that it introduced an of_node_put() call when
a dynamic node is detached, in of_node_remove(), that removes the initial kobj
reference created by of_node_init().
Traditionally as the original dynamic device node user the pseries code had
assumed responsibilty for releasing this final reference in its platform
specific DLPAR detach code.
This patch fixes a refcount underflow introduced by commit 0829f6d1f6, and
recently exposed by the upstreaming of the recount API.
Messages like the following are no longer seen in the kernel log with this
patch following DLPAR remove operations of cpus and pci devices.
rpadlpar_io: slot PHB 72 removed
refcount_t: underflow; use-after-free.
------------[ cut here ]------------
WARNING: CPU: 5 PID: 3335 at lib/refcount.c:128 refcount_sub_and_test+0xf4/0x110
Fixes: 0829f6d1f69e ("of: device_node kobject lifecycle fixes")
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
[mpe: Make change log commit references more verbose]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/dlpar.c | 1 -
1 file changed, 1 deletion(-)
--- a/arch/powerpc/platforms/pseries/dlpar.c
+++ b/arch/powerpc/platforms/pseries/dlpar.c
@@ -280,7 +280,6 @@ int dlpar_detach_node(struct device_node
if (rc)
return rc;
- of_node_put(dn); /* Must decrement the refcount */
return 0;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:20 +0200 |
| Subject | [PATCH 4.4 073/103] [media] dib0700: fix NULL-deref at probe |
| Message-ID | <tKpnJ-w5-41@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d5823511c0f8719a39e72ede1bce65411ac653b7 upstream.
Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.
Fixes: c4018fa2e4c0 ("[media] dib0700: fix RC support on Hauppauge
Nova-TD")
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dib0700_core.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/usb/dvb-usb/dib0700_core.c
+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
@@ -783,6 +783,9 @@ int dib0700_rc_setup(struct dvb_usb_devi
/* Starting in firmware 1.20, the RC info is provided on a bulk pipe */
+ if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1)
+ return -ENODEV;
+
purb = usb_alloc_urb(0, GFP_KERNEL);
if (purb == NULL) {
err("rc usb alloc urb failed");
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:20 +0200 |
| Subject | [PATCH 4.4 082/103] ARM: dts: at91: sama5d3_xplained: fix ADC vref |
| Message-ID | <tKpnJ-w5-47@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <ludovic.desroches@microchip.com>
commit 9cdd31e5913c1f86dce7e201b086155b3f24896b upstream.
The voltage reference for the ADC is not 3V but 3.3V since it is connected to
VDDANA.
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/at91-sama5d3_xplained.dts | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts
+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts
@@ -162,6 +162,7 @@
};
adc0: adc@f8018000 {
+ atmel,adc-vref = <3300>;
pinctrl-0 = <
&pinctrl_adc0_adtrg
&pinctrl_adc0_ad0
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:20 +0200 |
| Subject | [PATCH 4.4 081/103] powerpc/64e: Fix hang when debugging programs with relocated kernel |
| Message-ID | <tKpnJ-w5-63@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: LiuHailong <liu.hailong6@zte.com.cn>
commit fd615f69a18a9d4aa5ef02a1dc83f319f75da8e7 upstream.
Debug interrupts can be taken during interrupt entry, since interrupt
entry does not automatically turn them off. The kernel will check
whether the faulting instruction is between [interrupt_base_book3e,
__end_interrupts], and if so clear MSR[DE] and return.
However, when the kernel is built with CONFIG_RELOCATABLE, it can't use
LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) and
LOAD_REG_IMMEDIATE(r15,__end_interrupts), as they ignore relocation.
Thus, if the kernel is actually running at a different address than it
was built at, the address comparison will fail, and the exception entry
code will hang at kernel_dbg_exc.
r2(toc) is also not usable here, as r2 still holds data from the
interrupted context, so LOAD_REG_ADDR() doesn't work either. So we use
the *name@got* to get the EV of two labels directly.
Test programs test.c shows as follows:
int main(int argc, char *argv[])
{
if (access("/proc/sys/kernel/perf_event_paranoid", F_OK) == -1)
printf("Kernel doesn't have perf_event support\n");
}
Steps to reproduce the bug, for example:
1) ./gdb ./test
2) (gdb) b access
3) (gdb) r
4) (gdb) s
Signed-off-by: Liu Hailong <liu.hailong6@zte.com.cn>
Signed-off-by: Jiang Xuexin <jiang.xuexin@zte.com.cn>
Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
Reviewed-by: Liu Song <liu.song11@zte.com.cn>
Reviewed-by: Huang Jian <huang.jian@zte.com.cn>
[scottwood: cleaned up commit message, and specified bad behavior
as a hang rather than an oops to correspond to mainline kernel behavior]
Fixes: 1cb6e0649248 ("powerpc/book3e: support CONFIG_RELOCATABLE")
Signed-off-by: Scott Wood <oss@buserror.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/exceptions-64e.S | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
andis. r15,r14,(DBSR_IC|DBSR_BT)@h
beq+ 1f
+#ifdef CONFIG_RELOCATABLE
+ ld r15,PACATOC(r13)
+ ld r14,interrupt_base_book3e@got(r15)
+ ld r15,__end_interrupts@got(r15)
+#else
LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
cmpld cr0,r10,r14
cmpld cr1,r10,r15
blt+ cr0,1f
@@ -799,8 +805,14 @@ kernel_dbg_exc:
andis. r15,r14,(DBSR_IC|DBSR_BT)@h
beq+ 1f
+#ifdef CONFIG_RELOCATABLE
+ ld r15,PACATOC(r13)
+ ld r14,interrupt_base_book3e@got(r15)
+ ld r15,__end_interrupts@got(r15)
+#else
LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
cmpld cr0,r10,r14
cmpld cr1,r10,r15
blt+ cr0,1f
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:20 +0200 |
| Subject | [PATCH 4.4 079/103] powerpc/book3s/mce: Move add_taint() later in virtual mode |
| Message-ID | <tKpnJ-w5-65@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
commit d93b0ac01a9ce276ec39644be47001873d3d183c upstream.
machine_check_early() gets called in real mode. The very first time when
add_taint() is called, it prints a warning which ends up calling opal
call (that uses OPAL_CALL wrapper) for writing it to console. If we get a
very first machine check while we are in opal we are doomed. OPAL_CALL
overwrites the PACASAVEDMSR in r13 and in this case when we are done with
MCE handling the original opal call will use this new MSR on it's way
back to opal_return. This usually leads to unexpected behaviour or the
kernel to panic. Instead move the add_taint() call later in the virtual
mode where it is safe to call.
This is broken with current FW level. We got lucky so far for not getting
very first MCE hit while in OPAL. But easily reproducible on Mambo.
Fixes: 27ea2c420cad ("powerpc: Set the correct kernel taint on machine check errors.")
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/mce.c | 2 ++
arch/powerpc/kernel/traps.c | 4 ++--
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/arch/powerpc/kernel/mce.c
+++ b/arch/powerpc/kernel/mce.c
@@ -204,6 +204,8 @@ static void machine_check_process_queued
{
int index;
+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
/*
* For now just print it to console.
* TODO: log this error event to FSP or nvram.
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -297,8 +297,6 @@ long machine_check_early(struct pt_regs
__this_cpu_inc(irq_stat.mce_exceptions);
- add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
-
if (cur_cpu_spec && cur_cpu_spec->machine_check_early)
handled = cur_cpu_spec->machine_check_early(regs);
return handled;
@@ -704,6 +702,8 @@ void machine_check_exception(struct pt_r
__this_cpu_inc(irq_stat.mce_exceptions);
+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE);
+
/* See if any machine dependent calls. In theory, we would want
* to call the CPU first, and call the ppc_md. one if the CPU
* one returns a positive number. However there is existing code
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:30 +0200 |
| Subject | [PATCH 4.4 102/103] nfsd: encoders mustnt use unitialized values in error cases |
| Message-ID | <tKpxn-AI-3@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <bfields@redhat.com>
commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.
In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.
This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.
GETDEVICEINFO has the same problem.
Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4xdr.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4041,8 +4041,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_
struct nfsd4_getdeviceinfo *gdev)
{
struct xdr_stream *xdr = &resp->xdr;
- const struct nfsd4_layout_ops *ops =
- nfsd4_layout_ops[gdev->gd_layout_type];
+ const struct nfsd4_layout_ops *ops;
u32 starting_len = xdr->buf->len, needed_len;
__be32 *p;
@@ -4059,6 +4058,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_
/* If maxcount is 0 then just update notifications */
if (gdev->gd_maxcount != 0) {
+ ops = nfsd4_layout_ops[gdev->gd_layout_type];
nfserr = ops->encode_getdeviceinfo(xdr, gdev);
if (nfserr) {
/*
@@ -4111,8 +4111,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp
struct nfsd4_layoutget *lgp)
{
struct xdr_stream *xdr = &resp->xdr;
- const struct nfsd4_layout_ops *ops =
- nfsd4_layout_ops[lgp->lg_layout_type];
+ const struct nfsd4_layout_ops *ops;
__be32 *p;
dprintk("%s: err %d\n", __func__, nfserr);
@@ -4135,6 +4134,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp
*p++ = cpu_to_be32(lgp->lg_seg.iomode);
*p++ = cpu_to_be32(lgp->lg_layout_type);
+ ops = nfsd4_layout_ops[lgp->lg_layout_type];
nfserr = ops->encode_layoutget(xdr, lgp);
out:
kfree(lgp->lg_content);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-05-23 23:30 +0200 |
| Subject | [PATCH 4.4 103/103] drivers: char: mem: Check for address space wraparound with mmap() |
| Message-ID | <tKpxp-AI-57@gated-at.bofh.it> |
| In reply to | #1648658 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julius Werner <jwerner@chromium.org>
commit b299cde245b0b76c977f4291162cf668e087b408 upstream.
/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).
This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/mem.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -343,6 +343,11 @@ static const struct vm_operations_struct
static int mmap_mem(struct file *file, struct vm_area_struct *vma)
{
size_t size = vma->vm_end - vma->vm_start;
+ phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+ /* It's illegal to wrap around the end of the physical address space. */
+ if (offset + (phys_addr_t)size < offset)
+ return -EINVAL;
if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
return -EINVAL;
[toc] | [prev] | [next] | [standalone]
Page 1 of 2 [1] 2 Next page →
Back to top | Article view | linux.kernel
csiph-web