Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1602350 > unrolled thread

[PATCH 4.10 00/48] 4.10.4-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.10 00/48] 4.10.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 23/48] powerpc/booke: Fix boot crash due to null hugepd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 21/48] i2c: add missing of_node_put in i2c_mux_del_adapters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 17/48] tracing: Add #undef to fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 41/48] KVM: s390: Fix guest migration for huge guests resulting in panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 36/48] USB: iowarrior: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 39/48] USB: serial: io_ti: fix information leak in completion handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 30/48] usb: gadget: function: f_fs: pass companion descriptor along Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 19/48] efi/arm: Fix boot crash with CONFIG_CPUMASK_OFFSTACK=y Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 04/48] USB: serial: digi_acceleport: fix OOB-event processing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 07/48] MIPS: VDSO: avoid duplicate CAC_BASE definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 29/48] usb: ohci-at91: Do not drop unhandled USB suspend control requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 15/48] MIPS: ralink: Remove unused rt*_wdt_reset functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 47/48] ext4: dont BUG when truncating encrypted inodes on the orphan list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:40 +0100
    [PATCH 4.10 44/48] [media] serial_ir: ensure were ready to receive interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 28/48] usb: dwc3-omap: Fix missing break in dwc3_omap_set_mailbox() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 35/48] USB: serial: omninet: fix reference leaks at open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 38/48] USB: serial: io_ti: fix NULL-deref in interrupt callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 08/48] MIPS: ip27: Disable qlge driver in defconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 42/48] KVM: arm/arm64: Let vcpu thread modify its own active state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 45/48] dm: flush queued bios when process blocks to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 43/48] drm/i915/gvt: Fix superfluous newline in GVT_DISPLAY_READY env var Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 06/48] MIPS: Update defconfigs for NF_CT_PROTO_DCCP/UDPLITE change Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 25/48] PCI: Prevent VPD access for QLogic ISP2722 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 05/48] crypto: improve gcc optimization flags for serpent and wp512 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 48/48] IB/mlx5: Verify that Q counters are supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 26/48] usb: gadget: dummy_hcd: clear usb_gadget region before registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 32/48] usb: host: xhci-dbg: HCIVERSION should be a binary number Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 33/48] usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 09/48] MIPS: Update ip27_defconfig for SCSI_DH change Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 37/48] USB: iowarrior: fix NULL-deref in write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 15:50 +0100
    [PATCH 4.10 11/48] MIPS: Update lemote2f_defconfig for CPU_FREQ_STAT change Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 13/48] MIPS: ralink: Cosmetic change to prom_init(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 02/48] ARM: qcom_defconfig: Enable RPM/RPM-SMD clocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 10/48] MIPS: ip22: Fix ip28 build for modern gcc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 14/48] MIPS: ralink: Remove unused timer functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 12/48] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    [PATCH 4.10 01/48] iio: 104-quad-8: Fix off-by-one error when addressing flag register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-16 16:00 +0100
    Re: [PATCH 4.10 00/48] 4.10.4-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-16 20:40 +0100
      Re: [PATCH 4.10 00/48] 4.10.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-17 02:50 +0100
    Re: [PATCH 4.10 00/48] 4.10.4-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-16 23:40 +0100
      Re: [PATCH 4.10 00/48] 4.10.4-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-17 02:50 +0100

Page 1 of 3  [1] 2 3  Next page →

#1602350 — [PATCH 4.10 00/48] 4.10.4-stable review

This is the start of the stable review cycle for the 4.10.4 release.
There are 48 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Mar 18 14:29:04 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.4-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.10.4-rc1

Kamal Heib <kamalh@mellanox.com>
    IB/mlx5: Verify that Q counters are supported

Theodore Ts'o <tytso@mit.edu>
    ext4: don't BUG when truncating encrypted inodes on the orphan list

Sean Young <sean@mess.org>
    rc: raw decoder for keymap protocol is not loaded on register

Mikulas Patocka <mpatocka@redhat.com>
    dm: flush queued bios when process blocks to avoid deadlock

Sean Young <sean@mess.org>
    serial_ir: ensure we're ready to receive interrupts

Takashi Iwai <tiwai@suse.de>
    drm/i915/gvt: Fix superfluous newline in GVT_DISPLAY_READY env var

Jintack Lim <jintack@cs.columbia.edu>
    KVM: arm/arm64: Let vcpu thread modify its own active state

Janosch Frank <frankja@linux.vnet.ibm.com>
    KVM: s390: Fix guest migration for huge guests resulting in panic

Krzysztof Kozlowski <krzk@kernel.org>
    serial: samsung: Continue to work if DMA request fails

Johan Hovold <johan@kernel.org>
    USB: serial: io_ti: fix information leak in completion handler

Johan Hovold <johan@kernel.org>
    USB: serial: io_ti: fix NULL-deref in interrupt callback

Johan Hovold <johan@kernel.org>
    USB: iowarrior: fix NULL-deref in write

Johan Hovold <johan@kernel.org>
    USB: iowarrior: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    USB: serial: omninet: fix reference leaks at open

Johan Hovold <johan@kernel.org>
    USB: serial: safe_serial: fix information leak in completion handler

Guenter Roeck <linux@roeck-us.net>
    usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers

Peter Chen <peter.chen@nxp.com>
    usb: host: xhci-dbg: HCIVERSION should be a binary number

Roger Quadros <rogerq@ti.com>
    Revert "usb: gadget: uvc: Add missing call for additional setup data"

Felipe Balbi <felipe.balbi@linux.intel.com>
    usb: gadget: function: f_fs: pass companion descriptor along

Jelle Martijn Kok <jmkok@youcom.nl>
    usb: ohci-at91: Do not drop unhandled USB suspend control requests

Roger Quadros <rogerq@ti.com>
    usb: dwc3-omap: Fix missing break in dwc3_omap_set_mailbox()

Felipe Balbi <felipe.balbi@linux.intel.com>
    usb: dwc3: gadget: make Set Endpoint Configuration macros safe

Peter Chen <peter.chen@nxp.com>
    usb: gadget: dummy_hcd: clear usb_gadget region before registration

Ethan Zhao <ethan.zhao@oracle.com>
    PCI: Prevent VPD access for QLogic ISP2722

Balbir Singh <bsingharora@gmail.com>
    powerpc/xics: Work around limitations of OPAL XICS priority handling

Laurentiu Tudor <laurentiu.tudor@nxp.com>
    powerpc/booke: Fix boot crash due to null hugepd

Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
    powerpc: Emulation support for load/store instructions on LE

Qi Hou <qi.hou@windriver.com>
    i2c: add missing of_node_put in i2c_mux_del_adapters

Jonathan McDowell <noodles@earth.li>
    dw2102: don't do DMA on stack

Ard Biesheuvel <ard.biesheuvel@linaro.org>
    efi/arm: Fix boot crash with CONFIG_CPUMASK_OFFSTACK=y

Eric W. Biederman <ebiederm@xmission.com>
    ucount: Remove the atomicity from ucount->count

Rik van Riel <riel@redhat.com>
    tracing: Add #undef to fix compile error

Stefan Wahren <stefan.wahren@i2se.com>
    i2c: bcm2835: Avoid possible NULL ptr dereference

Arnd Bergmann <arnd@arndb.de>
    MIPS: ralink: Remove unused rt*_wdt_reset functions

Arnd Bergmann <arnd@arndb.de>
    MIPS: ralink: Remove unused timer functions

John Crispin <john@phrozen.org>
    MIPS: ralink: Cosmetic change to prom_init().

Arnd Bergmann <arnd@arndb.de>
    mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy

Arnd Bergmann <arnd@arndb.de>
    MIPS: Update lemote2f_defconfig for CPU_FREQ_STAT change

Arnd Bergmann <arnd@arndb.de>
    MIPS: ip22: Fix ip28 build for modern gcc

Arnd Bergmann <arnd@arndb.de>
    MIPS: Update ip27_defconfig for SCSI_DH change

Arnd Bergmann <arnd@arndb.de>
    MIPS: ip27: Disable qlge driver in defconfig

Arnd Bergmann <arnd@arndb.de>
    MIPS: VDSO: avoid duplicate CAC_BASE definition

Arnd Bergmann <arnd@arndb.de>
    MIPS: Update defconfigs for NF_CT_PROTO_DCCP/UDPLITE change

Arnd Bergmann <arnd@arndb.de>
    crypto: improve gcc optimization flags for serpent and wp512

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix OOB-event processing

Johan Hovold <johan@kernel.org>
    USB: serial: digi_acceleport: fix OOB data sanity check

Georgi Djakov <georgi.djakov@linaro.org>
    ARM: qcom_defconfig: Enable RPM/RPM-SMD clocks

William Breathitt Gray <vilhelm.gray@gmail.com>
    iio: 104-quad-8: Fix off-by-one error when addressing flag register


-------------

Diffstat:

 Makefile                                    |   4 +-
 arch/arm/configs/qcom_defconfig             |   2 +
 arch/mips/configs/ip22_defconfig            |   4 +-
 arch/mips/configs/ip27_defconfig            |   3 +-
 arch/mips/configs/lemote2f_defconfig        |   2 +-
 arch/mips/configs/malta_defconfig           |   4 +-
 arch/mips/configs/malta_kvm_defconfig       |   4 +-
 arch/mips/configs/malta_kvm_guest_defconfig |   4 +-
 arch/mips/configs/maltaup_xpa_defconfig     |   4 +-
 arch/mips/configs/nlm_xlp_defconfig         |   2 +-
 arch/mips/configs/nlm_xlr_defconfig         |   2 +-
 arch/mips/include/asm/mach-ip27/spaces.h    |   6 +-
 arch/mips/ralink/prom.c                     |   9 +-
 arch/mips/ralink/rt288x.c                   |  10 --
 arch/mips/ralink/rt305x.c                   |  11 --
 arch/mips/ralink/rt3883.c                   |  10 --
 arch/mips/ralink/timer.c                    |  14 --
 arch/mips/sgi-ip22/Platform                 |   2 +-
 arch/powerpc/include/asm/nohash/pgtable.h   |   2 +-
 arch/powerpc/lib/sstep.c                    |  20 ---
 arch/powerpc/sysdev/xics/icp-opal.c         |  10 ++
 arch/powerpc/sysdev/xics/xics-common.c      |  17 +-
 arch/s390/mm/pgtable.c                      |  19 ++-
 crypto/Makefile                             |   2 +
 drivers/firmware/efi/arm-runtime.c          |   1 +
 drivers/gpu/drm/i915/gvt/handlers.c         |   2 +-
 drivers/i2c/busses/i2c-bcm2835.c            |   4 +-
 drivers/i2c/i2c-mux.c                       |   2 +
 drivers/iio/counter/104-quad-8.c            |   2 +-
 drivers/infiniband/hw/mlx5/main.c           |  14 +-
 drivers/md/dm.c                             |  55 +++++++
 drivers/media/rc/rc-main.c                  |   7 +-
 drivers/media/rc/serial_ir.c                | 115 ++++++-------
 drivers/media/usb/dvb-usb/dw2102.c          | 244 +++++++++++++++++-----------
 drivers/mtd/maps/pmcmsp-flash.c             |   4 +-
 drivers/pci/quirks.c                        |   1 +
 drivers/tty/serial/samsung.c                |   6 +-
 drivers/usb/dwc3/dwc3-omap.c                |   1 +
 drivers/usb/dwc3/gadget.h                   |  14 +-
 drivers/usb/gadget/function/f_fs.c          |  15 +-
 drivers/usb/gadget/function/f_uvc.c         |   7 -
 drivers/usb/gadget/udc/dummy_hcd.c          |   2 +
 drivers/usb/host/ohci-at91.c                |   4 +-
 drivers/usb/host/xhci-dbg.c                 |   2 +-
 drivers/usb/host/xhci-plat.c                |   2 +
 drivers/usb/misc/iowarrior.c                |  21 ++-
 drivers/usb/serial/digi_acceleport.c        |  14 +-
 drivers/usb/serial/io_ti.c                  |   8 +-
 drivers/usb/serial/omninet.c                |   6 -
 drivers/usb/serial/safe_serial.c            |   5 +
 fs/ext4/inode.c                             |   4 +
 include/linux/user_namespace.h              |   2 +-
 include/trace/events/syscalls.h             |   1 +
 kernel/ucount.c                             |  18 +-
 virt/kvm/arm/vgic/vgic-mmio.c               |  32 +++-
 55 files changed, 464 insertions(+), 318 deletions(-)

[toc] | [next] | [standalone]

#1602352 — [PATCH 4.10 23/48] powerpc/booke: Fix boot crash due to null hugepd

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

commit 3fb66a70a4ae886445743354e4b60e54058bb3ff upstream.

On 32-bit book-e machines, hugepd_ok() no longer takes into account null
hugepd values, causing this crash at boot:

  Unable to handle kernel paging request for data at address 0x80000000
  ...
  NIP [c0018378] follow_huge_addr+0x38/0xf0
  LR [c001836c] follow_huge_addr+0x2c/0xf0
  Call Trace:
   follow_huge_addr+0x2c/0xf0 (unreliable)
   follow_page_mask+0x40/0x3e0
   __get_user_pages+0xc8/0x450
   get_user_pages_remote+0x8c/0x250
   copy_strings+0x110/0x390
   copy_strings_kernel+0x2c/0x50
   do_execveat_common+0x478/0x630
   do_execve+0x2c/0x40
   try_to_run_init_process+0x18/0x60
   kernel_init+0xbc/0x110
   ret_from_kernel_thread+0x5c/0x64

This impacts all nxp (ex-freescale) 32-bit booke platforms.

This was caused by the change of hugepd_t.pd from signed to unsigned,
and the update to the nohash version of hugepd_ok(). Previously
hugepd_ok() could exclude all non-huge and NULL pgds using > 0, whereas
now we need to explicitly check that the value is not zero and also that
PD_HUGE is *clear*.

This isn't protected by the pgd_none() check in __find_linux_pte_or_hugepte()
because on 32-bit we use pgtable-nopud.h, which causes the pgd_none()
check to be always false.

Fixes: 20717e1ff526 ("powerpc/mm: Fix little-endian 4K hugetlb")
Reported-by: Madalin-Cristian Bucur <madalin.bucur@nxp.com>
Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
[mpe: Flesh out change log details.]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/include/asm/nohash/pgtable.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -230,7 +230,7 @@ static inline int hugepd_ok(hugepd_t hpd
 	return ((hpd_val(hpd) & 0x4) != 0);
 #else
 	/* We clear the top bit to indicate hugepd */
-	return ((hpd_val(hpd) & PD_HUGE) ==  0);
+	return (hpd_val(hpd) && (hpd_val(hpd) & PD_HUGE) == 0);
 #endif
 }
 

[toc] | [prev] | [next] | [standalone]

#1602353 — [PATCH 4.10 21/48] i2c: add missing of_node_put in i2c_mux_del_adapters

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Qi Hou <qi.hou@windriver.com>

commit 2e1e4949f9dfb053122785cd73540bb1e61f768b upstream.

Refcount of of_node is increased with of_node_get() in i2c_mux_add_adapter().
It must be decreased with of_node_put() in i2c_mux_del_adapters().

Signed-off-by: Qi Hou <qi.hou@windriver.com>
Reviewed-by: Zhang Xiao <xiao.zhang@windriver.com>
Signed-off-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/i2c-mux.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -429,6 +429,7 @@ void i2c_mux_del_adapters(struct i2c_mux
 	while (muxc->num_adapters) {
 		struct i2c_adapter *adap = muxc->adapter[--muxc->num_adapters];
 		struct i2c_mux_priv *priv = adap->algo_data;
+		struct device_node *np = adap->dev.of_node;
 
 		muxc->adapter[muxc->num_adapters] = NULL;
 
@@ -438,6 +439,7 @@ void i2c_mux_del_adapters(struct i2c_mux
 
 		sysfs_remove_link(&priv->adap.dev.kobj, "mux_device");
 		i2c_del_adapter(adap);
+		of_node_put(np);
 		kfree(priv);
 	}
 }

[toc] | [prev] | [next] | [standalone]

#1602357 — [PATCH 4.10 17/48] tracing: Add #undef to fix compile error

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rik van Riel <riel@redhat.com>

commit bf7165cfa23695c51998231c4efa080fe1d3548d upstream.

There are several trace include files that define TRACE_INCLUDE_FILE.

Include several of them in the same .c file (as I currently have in
some code I am working on), and the compile will blow up with a
"warning: "TRACE_INCLUDE_FILE" redefined #define TRACE_INCLUDE_FILE syscalls"

Every other include file in include/trace/events/ avoids that issue
by having a #undef TRACE_INCLUDE_FILE before the #define; syscalls.h
should have one, too.

Link: http://lkml.kernel.org/r/20160928225554.13bd7ac6@annuminas.surriel.com

Fixes: b8007ef74222 ("tracing: Separate raw syscall from syscall tracer")
Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/trace/events/syscalls.h |    1 +
 1 file changed, 1 insertion(+)

--- a/include/trace/events/syscalls.h
+++ b/include/trace/events/syscalls.h
@@ -1,5 +1,6 @@
 #undef TRACE_SYSTEM
 #define TRACE_SYSTEM raw_syscalls
+#undef TRACE_INCLUDE_FILE
 #define TRACE_INCLUDE_FILE syscalls
 
 #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)

[toc] | [prev] | [next] | [standalone]

#1602358 — [PATCH 4.10 41/48] KVM: s390: Fix guest migration for huge guests resulting in panic

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Janosch Frank <frankja@linux.vnet.ibm.com>

commit 2e4d88009f57057df7672fa69a32b5224af54d37 upstream.

While we can technically not run huge page guests right now, we can
setup a guest with huge pages. Trying to migrate it will trigger a
VM_BUG_ON and, if the kernel is not configured to panic on a BUG, it
will happily try to work on non-existing page table entries.

With this patch, we always return "dirty" if we encounter a large page
when migrating. This at least fixes the immediate problem until we
have proper handling for both kind of pages.

Fixes: 15f36eb ("KVM: s390: Add proper dirty bitmap support to S390 kvm.")
Signed-off-by: Janosch Frank <frankja@linux.vnet.ibm.com>
Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/s390/mm/pgtable.c |   19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -606,12 +606,29 @@ void ptep_zap_key(struct mm_struct *mm,
 bool test_and_clear_guest_dirty(struct mm_struct *mm, unsigned long addr)
 {
 	spinlock_t *ptl;
+	pgd_t *pgd;
+	pud_t *pud;
+	pmd_t *pmd;
 	pgste_t pgste;
 	pte_t *ptep;
 	pte_t pte;
 	bool dirty;
 
-	ptep = get_locked_pte(mm, addr, &ptl);
+	pgd = pgd_offset(mm, addr);
+	pud = pud_alloc(mm, pgd, addr);
+	if (!pud)
+		return false;
+	pmd = pmd_alloc(mm, pud, addr);
+	if (!pmd)
+		return false;
+	/* We can't run guests backed by huge pages, but userspace can
+	 * still set them up and then try to migrate them without any
+	 * migration support.
+	 */
+	if (pmd_large(*pmd))
+		return true;
+
+	ptep = pte_alloc_map_lock(mm, pmd, addr, &ptl);
 	if (unlikely(!ptep))
 		return false;
 

[toc] | [prev] | [next] | [standalone]

#1602359 — [PATCH 4.10 36/48] USB: iowarrior: fix NULL-deref at probe

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit b7321e81fc369abe353cf094d4f0dc2fe11ab95f upstream.

Make sure to check for the required interrupt-in endpoint to avoid
dereferencing a NULL-pointer should a malicious device lack such an
endpoint.

Note that a fairly recent change purported to fix this issue, but added
an insufficient test on the number of endpoints only, a test which can
now be removed.

Fixes: 4ec0ef3a8212 ("USB: iowarrior: fix oops with malicious USB descriptors")
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/iowarrior.c |   13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -781,12 +781,6 @@ static int iowarrior_probe(struct usb_in
 	iface_desc = interface->cur_altsetting;
 	dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
 
-	if (iface_desc->desc.bNumEndpoints < 1) {
-		dev_err(&interface->dev, "Invalid number of endpoints\n");
-		retval = -EINVAL;
-		goto error;
-	}
-
 	/* set up the endpoint information */
 	for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
 		endpoint = &iface_desc->endpoint[i].desc;
@@ -797,6 +791,13 @@ static int iowarrior_probe(struct usb_in
 			/* this one will match for the IOWarrior56 only */
 			dev->int_out_endpoint = endpoint;
 	}
+
+	if (!dev->int_in_endpoint) {
+		dev_err(&interface->dev, "no interrupt-in endpoint found\n");
+		retval = -ENODEV;
+		goto error;
+	}
+
 	/* we have to check the report_size often, so remember it in the endianness suitable for our machine */
 	dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
 	if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&

[toc] | [prev] | [next] | [standalone]

#1602364 — [PATCH 4.10 39/48] USB: serial: io_ti: fix information leak in completion handler

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 654b404f2a222f918af9b0cd18ad469d0c941a8e upstream.

Add missing sanity check to the bulk-in completion handler to avoid an
integer underflow that can be triggered by a malicious device.

This avoids leaking 128 kB of memory content from after the URB transfer
buffer to user space.

Fixes: 8c209e6782ca ("USB: make actual_length in struct urb field u32")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1761,7 +1761,7 @@ static void edge_bulk_in_callback(struct
 
 	port_number = edge_port->port->port_number;
 
-	if (edge_port->lsr_event) {
+	if (urb->actual_length > 0 && edge_port->lsr_event) {
 		edge_port->lsr_event = 0;
 		dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n",
 			__func__, port_number, edge_port->lsr_mask, *data);

[toc] | [prev] | [next] | [standalone]

#1602369 — [PATCH 4.10 30/48] usb: gadget: function: f_fs: pass companion descriptor along

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Felipe Balbi <felipe.balbi@linux.intel.com>

commit 2bfa0719ac2a9b2f3c91345873d3cdebd0296ba9 upstream.

If we're dealing with SuperSpeed endpoints, we need
to make sure to pass along the companion descriptor
and initialize fields needed by the Gadget
API. Eventually, f_fs.c should be converted to use
config_ep_by_speed() like all other functions,
though.

Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/gadget/function/f_fs.c |   15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1833,11 +1833,14 @@ static int ffs_func_eps_enable(struct ff
 	spin_lock_irqsave(&func->ffs->eps_lock, flags);
 	while(count--) {
 		struct usb_endpoint_descriptor *ds;
+		struct usb_ss_ep_comp_descriptor *comp_desc = NULL;
+		int needs_comp_desc = false;
 		int desc_idx;
 
-		if (ffs->gadget->speed == USB_SPEED_SUPER)
+		if (ffs->gadget->speed == USB_SPEED_SUPER) {
 			desc_idx = 2;
-		else if (ffs->gadget->speed == USB_SPEED_HIGH)
+			needs_comp_desc = true;
+		} else if (ffs->gadget->speed == USB_SPEED_HIGH)
 			desc_idx = 1;
 		else
 			desc_idx = 0;
@@ -1854,6 +1857,14 @@ static int ffs_func_eps_enable(struct ff
 
 		ep->ep->driver_data = ep;
 		ep->ep->desc = ds;
+
+		comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds +
+				USB_DT_ENDPOINT_SIZE);
+		ep->ep->maxburst = comp_desc->bMaxBurst + 1;
+
+		if (needs_comp_desc)
+			ep->ep->comp_desc = comp_desc;
+
 		ret = usb_ep_enable(ep->ep);
 		if (likely(!ret)) {
 			epfile->ep = ep;

[toc] | [prev] | [next] | [standalone]

#1602373 — [PATCH 4.10 19/48] efi/arm: Fix boot crash with CONFIG_CPUMASK_OFFSTACK=y

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

commit d1eb98143c56f24fef125f5bbed49ae0b52fb7d6 upstream.

On ARM and arm64, we use a dedicated mm_struct to map the UEFI
Runtime Services regions, which allows us to map those regions
on demand, and in a way that is guaranteed to be compatible
with incoming kernels across kexec.

As it turns out, we don't fully initialize the mm_struct in the
same way as process mm_structs are initialized on fork(), which
results in the following crash on ARM if CONFIG_CPUMASK_OFFSTACK=y
is enabled:

  ...
  EFI Variables Facility v0.08 2004-May-17
  Unable to handle kernel NULL pointer dereference at virtual address 00000000
  [...]
  Process swapper/0 (pid: 1)
  ...
  __memzero()
  check_and_switch_context()
  virt_efi_get_next_variable()
  efivar_init()
  efivars_sysfs_init()
  do_one_initcall()
  ...

This is due to a missing call to mm_init_cpumask(), so add it.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1488395154-29786-1-git-send-email-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/firmware/efi/arm-runtime.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/firmware/efi/arm-runtime.c
+++ b/drivers/firmware/efi/arm-runtime.c
@@ -65,6 +65,7 @@ static bool __init efi_virtmap_init(void
 	bool systab_found;
 
 	efi_mm.pgd = pgd_alloc(&efi_mm);
+	mm_init_cpumask(&efi_mm);
 	init_new_context(NULL, &efi_mm);
 
 	systab_found = false;

[toc] | [prev] | [next] | [standalone]

#1602374 — [PATCH 4.10 04/48] USB: serial: digi_acceleport: fix OOB-event processing

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 2e46565cf622dd0534a9d8bffe152a577b48d7aa upstream.

A recent change claimed to fix an off-by-one error in the OOB-port
completion handler, but instead introduced such an error. This could
specifically led to modem-status changes going unnoticed, effectively
breaking TIOCMGET.

Note that the offending commit fixes a loop-condition underflow and is
marked for stable, but should not be backported without this fix.

Reported-by: Ben Hutchings <ben@decadent.org.uk>
Fixes: 2d380889215f ("USB: serial: digi_acceleport: fix OOB data sanity
check")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/digi_acceleport.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -1491,7 +1491,7 @@ static int digi_read_oob_callback(struct
 		return -1;
 
 	/* handle each oob command */
-	for (i = 0; i < urb->actual_length - 4; i += 4) {
+	for (i = 0; i < urb->actual_length - 3; i += 4) {
 		opcode = buf[i];
 		line = buf[i + 1];
 		status = buf[i + 2];

[toc] | [prev] | [next] | [standalone]

#1602375 — [PATCH 4.10 07/48] MIPS: VDSO: avoid duplicate CAC_BASE definition

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 1742ac265046f34223e06d5d283496f0291be259 upstream.

vdso.h includes <spaces.h> implicitly after defining CONFIG_32BITS.
This defeats the override in mach-ip27/spaces.h, leading to
a build error that shows up in kernelci.org:

In file included from arch/mips/include/asm/mach-ip27/spaces.h:29:0,
                 from arch/mips/include/asm/page.h:12,
                 from arch/mips/vdso/vdso.h:26,
                 from arch/mips/vdso/gettimeofday.c:11:
arch/mips/include/asm/mach-generic/spaces.h:28:0: error: "CAC_BASE" redefined [-Werror]
 #define CAC_BASE  _AC(0x80000000, UL)

An earlier patch tried to make the second definition conditional,
but that patch had the #ifdef in the wrong place, and would lead
to another warning:

arch/mips/include/asm/io.h: In function 'phys_to_virt':
arch/mips/include/asm/io.h:138:9: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]

For all I can tell, there is no other reason than vdso32 to ever
include this file with CONFIG_32BITS set, and the vdso itself should
never refer to the base addresses as it is running in user space,
so adding an #ifdef here is safe.

Link: https://patchwork.kernel.org/patch/9418187/
Fixes: 3ffc17d8768b ("MIPS: Adjust MIPS64 CAC_BASE to reflect Config.K0")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15039/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/include/asm/mach-ip27/spaces.h |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/arch/mips/include/asm/mach-ip27/spaces.h
+++ b/arch/mips/include/asm/mach-ip27/spaces.h
@@ -12,14 +12,16 @@
 
 /*
  * IP27 uses the R10000's uncached attribute feature.  Attribute 3 selects
- * uncached memory addressing.
+ * uncached memory addressing. Hide the definitions on 32-bit compilation
+ * of the compat-vdso code.
  */
-
+#ifdef CONFIG_64BIT
 #define HSPEC_BASE		0x9000000000000000
 #define IO_BASE			0x9200000000000000
 #define MSPEC_BASE		0x9400000000000000
 #define UNCAC_BASE		0x9600000000000000
 #define CAC_BASE		0xa800000000000000
+#endif
 
 #define TO_MSPEC(x)		(MSPEC_BASE | ((x) & TO_PHYS_MASK))
 #define TO_HSPEC(x)		(HSPEC_BASE | ((x) & TO_PHYS_MASK))

[toc] | [prev] | [next] | [standalone]

#1602376 — [PATCH 4.10 29/48] usb: ohci-at91: Do not drop unhandled USB suspend control requests

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jelle Martijn Kok <jmkok@youcom.nl>

commit 85550f9148a852ed363a386577ad31b97b95dfb8 upstream.

In patch 2e2aa1bc7eff90ecm, USB suspend and wakeup control requests are
passed to SFR_OHCIICR register. If a processor does not have such a
register, this hub control request will be dropped.

If no such a SFR register is available, all USB suspend control requests
will now be processed using ohci_hub_control()
(like before patch 2e2aa1bc7eff90ecm.)

Tested on an Atmel AT91SAM9G20 with an on-board TI TUSB2046B hub chip
If the last USB device is unplugged from the USB hub, the hub goes into
sleep and will not wakeup when an USB devices is inserted.

Fixes: 2e2aa1bc7eff90ec ("usb: ohci-at91: Forcibly suspend ports while USB suspend")
Signed-off-by: Jelle Martijn Kok <jmkok@youcom.nl>
Tested-by: Wenyou Yang <wenyou.yang@atmel.com>
Cc: Wenyou Yang <wenyou.yang@atmel.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Reviewed-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/host/ohci-at91.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -350,7 +350,7 @@ static int ohci_at91_hub_control(struct
 
 		case USB_PORT_FEAT_SUSPEND:
 			dev_dbg(hcd->self.controller, "SetPortFeat: SUSPEND\n");
-			if (valid_port(wIndex)) {
+			if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
 				ohci_at91_port_suspend(ohci_at91->sfr_regmap,
 						       1);
 				return 0;
@@ -393,7 +393,7 @@ static int ohci_at91_hub_control(struct
 
 		case USB_PORT_FEAT_SUSPEND:
 			dev_dbg(hcd->self.controller, "ClearPortFeature: SUSPEND\n");
-			if (valid_port(wIndex)) {
+			if (valid_port(wIndex) && ohci_at91->sfr_regmap) {
 				ohci_at91_port_suspend(ohci_at91->sfr_regmap,
 						       0);
 				return 0;

[toc] | [prev] | [next] | [standalone]

#1602377 — [PATCH 4.10 15/48] MIPS: ralink: Remove unused rt*_wdt_reset functions

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 886f9c69fc68f56ddea34d3de51ac1fc2ac8dfbc upstream.

All pointers to these functions were removed, so now they produce
warnings:

arch/mips/ralink/rt305x.c:92:13: error: 'rt305x_wdt_reset' defined but not used [-Werror=unused-function]

This removes the functions. If we need them again, the patch can be
reverted later.

Fixes: f576fb6a0700 ("MIPS: ralink: cleanup the soc specific pinmux data")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: John Crispin <john@phrozen.org>
Cc: Colin Ian King <colin.king@canonical.com>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15044/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/ralink/rt288x.c |   10 ----------
 arch/mips/ralink/rt305x.c |   11 -----------
 arch/mips/ralink/rt3883.c |   10 ----------
 3 files changed, 31 deletions(-)

--- a/arch/mips/ralink/rt288x.c
+++ b/arch/mips/ralink/rt288x.c
@@ -40,16 +40,6 @@ static struct rt2880_pmx_group rt2880_pi
 	{ 0 }
 };
 
-static void rt288x_wdt_reset(void)
-{
-	u32 t;
-
-	/* enable WDT reset output on pin SRAM_CS_N */
-	t = rt_sysc_r32(SYSC_REG_CLKCFG);
-	t |= CLKCFG_SRAM_CS_N_WDT;
-	rt_sysc_w32(t, SYSC_REG_CLKCFG);
-}
-
 void __init ralink_clk_init(void)
 {
 	unsigned long cpu_rate, wmac_rate = 40000000;
--- a/arch/mips/ralink/rt305x.c
+++ b/arch/mips/ralink/rt305x.c
@@ -89,17 +89,6 @@ static struct rt2880_pmx_group rt5350_pi
 	{ 0 }
 };
 
-static void rt305x_wdt_reset(void)
-{
-	u32 t;
-
-	/* enable WDT reset output on pin SRAM_CS_N */
-	t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG);
-	t |= RT305X_SYSCFG_SRAM_CS0_MODE_WDT <<
-		RT305X_SYSCFG_SRAM_CS0_MODE_SHIFT;
-	rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG);
-}
-
 static unsigned long rt5350_get_mem_size(void)
 {
 	void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE);
--- a/arch/mips/ralink/rt3883.c
+++ b/arch/mips/ralink/rt3883.c
@@ -63,16 +63,6 @@ static struct rt2880_pmx_group rt3883_pi
 	{ 0 }
 };
 
-static void rt3883_wdt_reset(void)
-{
-	u32 t;
-
-	/* enable WDT reset output on GPIO 2 */
-	t = rt_sysc_r32(RT3883_SYSC_REG_SYSCFG1);
-	t |= RT3883_SYSCFG1_GPIO2_AS_WDT_OUT;
-	rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1);
-}
-
 void __init ralink_clk_init(void)
 {
 	unsigned long cpu_rate, sys_rate;

[toc] | [prev] | [next] | [standalone]

#1602379 — [PATCH 4.10 47/48] ext4: dont BUG when truncating encrypted inodes on the orphan list

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 0d06863f903ac5f4f6efb0273079d27de3e53a28 upstream.

Fix a BUG when the kernel tries to mount a file system constructed as
follows:

echo foo > foo.txt
mke2fs -Fq -t ext4 -O encrypt foo.img 100
debugfs -w foo.img << EOF
write foo.txt a
set_inode_field a i_flags 0x80800
set_super_value s_last_orphan 12
quit
EOF

root@kvm-xfstests:~# mount -o loop foo.img /mnt
[  160.238770] ------------[ cut here ]------------
[  160.240106] kernel BUG at /usr/projects/linux/ext4/fs/ext4/inode.c:3874!
[  160.240106] invalid opcode: 0000 [#1] SMP
[  160.240106] Modules linked in:
[  160.240106] CPU: 0 PID: 2547 Comm: mount Tainted: G        W       4.10.0-rc3-00034-gcdd33b941b67 #227
[  160.240106] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1 04/01/2014
[  160.240106] task: f4518000 task.stack: f47b6000
[  160.240106] EIP: ext4_block_zero_page_range+0x1a7/0x2b4
[  160.240106] EFLAGS: 00010246 CPU: 0
[  160.240106] EAX: 00000001 EBX: f7be4b50 ECX: f47b7dc0 EDX: 00000007
[  160.240106] ESI: f43b05a8 EDI: f43babec EBP: f47b7dd0 ESP: f47b7dac
[  160.240106]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[  160.240106] CR0: 80050033 CR2: bfd85b08 CR3: 34a00680 CR4: 000006f0
[  160.240106] Call Trace:
[  160.240106]  ext4_truncate+0x1e9/0x3e5
[  160.240106]  ext4_fill_super+0x286f/0x2b1e
[  160.240106]  ? set_blocksize+0x2e/0x7e
[  160.240106]  mount_bdev+0x114/0x15f
[  160.240106]  ext4_mount+0x15/0x17
[  160.240106]  ? ext4_calculate_overhead+0x39d/0x39d
[  160.240106]  mount_fs+0x58/0x115
[  160.240106]  vfs_kern_mount+0x4b/0xae
[  160.240106]  do_mount+0x671/0x8c3
[  160.240106]  ? _copy_from_user+0x70/0x83
[  160.240106]  ? strndup_user+0x31/0x46
[  160.240106]  SyS_mount+0x57/0x7b
[  160.240106]  do_int80_syscall_32+0x4f/0x61
[  160.240106]  entry_INT80_32+0x2f/0x2f
[  160.240106] EIP: 0xb76b919e
[  160.240106] EFLAGS: 00000246 CPU: 0
[  160.240106] EAX: ffffffda EBX: 08053838 ECX: 08052188 EDX: 080537e8
[  160.240106] ESI: c0ed0000 EDI: 00000000 EBP: 080537e8 ESP: bfa13660
[  160.240106]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
[  160.240106] Code: 59 8b 00 a8 01 0f 84 09 01 00 00 8b 07 66 25 00 f0 66 3d 00 80 75 61 89 f8 e8 3e e2 ff ff 84 c0 74 56 83 bf 48 02 00 00 00 75 02 <0f> 0b 81 7d e8 00 10 00 00 74 02 0f 0b 8b 43 04 8b 53 08 31 c9
[  160.240106] EIP: ext4_block_zero_page_range+0x1a7/0x2b4 SS:ESP: 0068:f47b7dac
[  160.317241] ---[ end trace d6a773a375c810a5 ]---

The problem is that when the kernel tries to truncate an inode in
ext4_truncate(), it tries to clear any on-disk data beyond i_size.
Without the encryption key, it can't do that, and so it triggers a
BUG.

E2fsck does *not* provide this service, and in practice most file
systems have their orphan list processed by e2fsck, so to avoid
crashing, this patch skips this step if we don't have access to the
encryption key (which is the case when processing the orphan list; in
all other cases, we will have the encryption key, or the kernel
wouldn't have allowed the file to be opened).

An open question is whether the fact that e2fsck isn't clearing the
bytes beyond i_size causing problems --- and if we've lived with it
not doing it for so long, can we drop this from the kernel replay of
the orphan list in all cases (not just when we don't have the key for
encrypted inodes).

Addresses-Google-Bug: #35209576

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -3927,6 +3927,10 @@ static int ext4_block_truncate_page(hand
 	unsigned blocksize;
 	struct inode *inode = mapping->host;
 
+	/* If we are processing an encrypted inode during orphan list handling */
+	if (ext4_encrypted_inode(inode) && !fscrypt_has_encryption_key(inode))
+		return 0;
+
 	blocksize = inode->i_sb->s_blocksize;
 	length = blocksize - (offset & (blocksize - 1));
 

[toc] | [prev] | [next] | [standalone]

#1602384 — [PATCH 4.10 44/48] [media] serial_ir: ensure were ready to receive interrupts

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sean Young <sean@mess.org>

commit 0265634eb9e04a16ae99941c320718c38eb865e0 upstream.

When the interrupt requested with devm_request_irq(), serial_ir.rcdev
is still null so will cause null deference if the irq handler is called
early on.

Also ensure that timeout_timer is setup.

Link: http://lkml.kernel.org/r/CA+55aFxsh2uF8gi5sN_guY3Z+tiLv7LpJYKBw+y8vqLzp+TsnQ@mail.gmail.com

[mchehab@s-opensource.com: moved serial_ir_probe() back to its original place]

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/rc/serial_ir.c |  115 +++++++++++++++++++++----------------------
 1 file changed, 58 insertions(+), 57 deletions(-)

--- a/drivers/media/rc/serial_ir.c
+++ b/drivers/media/rc/serial_ir.c
@@ -471,10 +471,65 @@ static int hardware_init_port(void)
 	return 0;
 }
 
+/* Needed by serial_ir_probe() */
+static int serial_ir_tx(struct rc_dev *dev, unsigned int *txbuf,
+			unsigned int count);
+static int serial_ir_tx_duty_cycle(struct rc_dev *dev, u32 cycle);
+static int serial_ir_tx_carrier(struct rc_dev *dev, u32 carrier);
+static int serial_ir_open(struct rc_dev *rcdev);
+static void serial_ir_close(struct rc_dev *rcdev);
+
 static int serial_ir_probe(struct platform_device *dev)
 {
+	struct rc_dev *rcdev;
 	int i, nlow, nhigh, result;
 
+	rcdev = devm_rc_allocate_device(&dev->dev);
+	if (!rcdev)
+		return -ENOMEM;
+
+	if (hardware[type].send_pulse && hardware[type].send_space)
+		rcdev->tx_ir = serial_ir_tx;
+	if (hardware[type].set_send_carrier)
+		rcdev->s_tx_carrier = serial_ir_tx_carrier;
+	if (hardware[type].set_duty_cycle)
+		rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
+
+	switch (type) {
+	case IR_HOMEBREW:
+		rcdev->input_name = "Serial IR type home-brew";
+		break;
+	case IR_IRDEO:
+		rcdev->input_name = "Serial IR type IRdeo";
+		break;
+	case IR_IRDEO_REMOTE:
+		rcdev->input_name = "Serial IR type IRdeo remote";
+		break;
+	case IR_ANIMAX:
+		rcdev->input_name = "Serial IR type AnimaX";
+		break;
+	case IR_IGOR:
+		rcdev->input_name = "Serial IR type IgorPlug";
+		break;
+	}
+
+	rcdev->input_phys = KBUILD_MODNAME "/input0";
+	rcdev->input_id.bustype = BUS_HOST;
+	rcdev->input_id.vendor = 0x0001;
+	rcdev->input_id.product = 0x0001;
+	rcdev->input_id.version = 0x0100;
+	rcdev->open = serial_ir_open;
+	rcdev->close = serial_ir_close;
+	rcdev->dev.parent = &serial_ir.pdev->dev;
+	rcdev->driver_type = RC_DRIVER_IR_RAW;
+	rcdev->allowed_protocols = RC_BIT_ALL;
+	rcdev->driver_name = KBUILD_MODNAME;
+	rcdev->map_name = RC_MAP_RC6_MCE;
+	rcdev->timeout = IR_DEFAULT_TIMEOUT;
+	rcdev->rx_resolution = 250000;
+
+	serial_ir.rcdev = rcdev;
+
 	result = devm_request_irq(&dev->dev, irq, serial_ir_irq_handler,
 				  share_irq ? IRQF_SHARED : 0,
 				  KBUILD_MODNAME, &hardware);
@@ -533,7 +588,8 @@ static int serial_ir_probe(struct platfo
 			 sense ? "low" : "high");
 
 	dev_dbg(&dev->dev, "Interrupt %d, port %04x obtained\n", irq, io);
-	return 0;
+
+	return devm_rc_register_device(&dev->dev, rcdev);
 }
 
 static int serial_ir_open(struct rc_dev *rcdev)
@@ -704,7 +760,6 @@ static void serial_ir_exit(void)
 
 static int __init serial_ir_init_module(void)
 {
-	struct rc_dev *rcdev;
 	int result;
 
 	switch (type) {
@@ -735,69 +790,15 @@ static int __init serial_ir_init_module(
 		sense = !!sense;
 
 	result = serial_ir_init();
-	if (result)
-		return result;
-
-	rcdev = devm_rc_allocate_device(&serial_ir.pdev->dev);
-	if (!rcdev) {
-		result = -ENOMEM;
-		goto serial_cleanup;
-	}
-
-	if (hardware[type].send_pulse && hardware[type].send_space)
-		rcdev->tx_ir = serial_ir_tx;
-	if (hardware[type].set_send_carrier)
-		rcdev->s_tx_carrier = serial_ir_tx_carrier;
-	if (hardware[type].set_duty_cycle)
-		rcdev->s_tx_duty_cycle = serial_ir_tx_duty_cycle;
-
-	switch (type) {
-	case IR_HOMEBREW:
-		rcdev->input_name = "Serial IR type home-brew";
-		break;
-	case IR_IRDEO:
-		rcdev->input_name = "Serial IR type IRdeo";
-		break;
-	case IR_IRDEO_REMOTE:
-		rcdev->input_name = "Serial IR type IRdeo remote";
-		break;
-	case IR_ANIMAX:
-		rcdev->input_name = "Serial IR type AnimaX";
-		break;
-	case IR_IGOR:
-		rcdev->input_name = "Serial IR type IgorPlug";
-		break;
-	}
-
-	rcdev->input_phys = KBUILD_MODNAME "/input0";
-	rcdev->input_id.bustype = BUS_HOST;
-	rcdev->input_id.vendor = 0x0001;
-	rcdev->input_id.product = 0x0001;
-	rcdev->input_id.version = 0x0100;
-	rcdev->open = serial_ir_open;
-	rcdev->close = serial_ir_close;
-	rcdev->dev.parent = &serial_ir.pdev->dev;
-	rcdev->driver_type = RC_DRIVER_IR_RAW;
-	rcdev->allowed_protocols = RC_BIT_ALL;
-	rcdev->driver_name = KBUILD_MODNAME;
-	rcdev->map_name = RC_MAP_RC6_MCE;
-	rcdev->timeout = IR_DEFAULT_TIMEOUT;
-	rcdev->rx_resolution = 250000;
-
-	serial_ir.rcdev = rcdev;
-
-	result = rc_register_device(rcdev);
-
 	if (!result)
 		return 0;
-serial_cleanup:
+
 	serial_ir_exit();
 	return result;
 }
 
 static void __exit serial_ir_exit_module(void)
 {
-	rc_unregister_device(serial_ir.rcdev);
 	serial_ir_exit();
 }
 

[toc] | [prev] | [next] | [standalone]

#1602385 — [PATCH 4.10 28/48] usb: dwc3-omap: Fix missing break in dwc3_omap_set_mailbox()

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roger Quadros <rogerq@ti.com>

commit 0913750f9fb6f26bcd00c8f9dd9a8d1b8d031246 upstream.

We need to break from all cases if we want to treat
each one of them separately.

Reported-by: Gustavo A. R. Silva <garsilva@embeddedor.com>
Fixes: d2728fb3e01f ("usb: dwc3: omap: Pass VBUS and ID events transparently")
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/dwc3-omap.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -250,6 +250,7 @@ static void dwc3_omap_set_mailbox(struct
 		val = dwc3_omap_read_utmi_ctrl(omap);
 		val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG;
 		dwc3_omap_write_utmi_ctrl(omap, val);
+		break;
 
 	case OMAP_DWC3_VBUS_OFF:
 		val = dwc3_omap_read_utmi_ctrl(omap);

[toc] | [prev] | [next] | [standalone]

#1602386 — [PATCH 4.10 35/48] USB: serial: omninet: fix reference leaks at open

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 30572418b445d85fcfe6c8fe84c947d2606767d8 upstream.

This driver needlessly took another reference to the tty on open, a
reference which was then never released on close. This lead to not just
a leak of the tty, but also a driver reference leak that prevented the
driver from being unloaded after a port had once been opened.

Fixes: 4a90f09b20f4 ("tty: usb-serial krefs")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/omninet.c |    6 ------
 1 file changed, 6 deletions(-)

--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -142,12 +142,6 @@ static int omninet_port_remove(struct us
 
 static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port)
 {
-	struct usb_serial	*serial = port->serial;
-	struct usb_serial_port	*wport;
-
-	wport = serial->port[1];
-	tty_port_tty_set(&wport->port, tty);
-
 	return usb_serial_generic_open(tty, port);
 }
 

[toc] | [prev] | [next] | [standalone]

#1602388 — [PATCH 4.10 38/48] USB: serial: io_ti: fix NULL-deref in interrupt callback

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 0b1d250afb8eb9d65afb568bac9b9f9253a82b49 upstream.

Fix a NULL-pointer dereference in the interrupt callback should a
malicious device send data containing a bad port number by adding the
missing sanity check.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/io_ti.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(stru
 	function    = TIUMP_GET_FUNC_FROM_CODE(data[0]);
 	dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__,
 		port_number, function, data[1]);
+
+	if (port_number >= edge_serial->serial->num_ports) {
+		dev_err(dev, "bad port number %d\n", port_number);
+		goto exit;
+	}
+
 	port = edge_serial->serial->port[port_number];
 	edge_port = usb_get_serial_port_data(port);
 	if (!edge_port) {

[toc] | [prev] | [next] | [standalone]

#1602390 — [PATCH 4.10 08/48] MIPS: ip27: Disable qlge driver in defconfig

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit b617649468390713db1515ea79fc772d2eb897a8 upstream.

One of the last remaining failures in kernelci.org is for a gcc bug:

drivers/net/ethernet/qlogic/qlge/qlge_main.c:4819:1: error: insn does not satisfy its constraints:
drivers/net/ethernet/qlogic/qlge/qlge_main.c:4819:1: internal compiler error: in extract_constrain_insn, at recog.c:2190

This is apparently broken in gcc-6 but fixed in gcc-7, and I cannot
reproduce the problem here. However, it is clear that ip27_defconfig
does not actually need this driver as the platform has only PCI-X but
not PCIe, and the qlge adapter in turn is PCIe-only.

The driver was originally enabled in 2010 along with lots of other
drivers.

Fixes: 59d302b342e5 ("MIPS: IP27: Make defconfig useful again.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: linux-mips@linux-mips.org
Cc: linux-kernel@vger.kernel.org
Patchwork: https://patchwork.linux-mips.org/patch/15197/
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/configs/ip27_defconfig |    1 -
 1 file changed, 1 deletion(-)

--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -205,7 +205,6 @@ CONFIG_MLX4_EN=m
 # CONFIG_MLX4_DEBUG is not set
 CONFIG_TEHUTI=m
 CONFIG_BNX2X=m
-CONFIG_QLGE=m
 CONFIG_SFC=m
 CONFIG_BE2NET=m
 CONFIG_LIBERTAS_THINFIRM=m

[toc] | [prev] | [next] | [standalone]

#1602391 — [PATCH 4.10 42/48] KVM: arm/arm64: Let vcpu thread modify its own active state

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jintack Lim <jintack@cs.columbia.edu>

commit 370a0ec1819990f8e2a93df7cc9c0146980ed45f upstream.

Currently, if a vcpu thread tries to change the active state of an
interrupt which is already on the same vcpu's AP list, it will loop
forever. Since the VGIC mmio handler is called after a vcpu has
already synced back the LR state to the struct vgic_irq, we can just
let it proceed safely.

Reviewed-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Jintack Lim <jintack@cs.columbia.edu>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 virt/kvm/arm/vgic/vgic-mmio.c |   32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

--- a/virt/kvm/arm/vgic/vgic-mmio.c
+++ b/virt/kvm/arm/vgic/vgic-mmio.c
@@ -187,21 +187,37 @@ unsigned long vgic_mmio_read_active(stru
 static void vgic_mmio_change_active(struct kvm_vcpu *vcpu, struct vgic_irq *irq,
 				    bool new_active_state)
 {
+	struct kvm_vcpu *requester_vcpu;
 	spin_lock(&irq->irq_lock);
+
+	/*
+	 * The vcpu parameter here can mean multiple things depending on how
+	 * this function is called; when handling a trap from the kernel it
+	 * depends on the GIC version, and these functions are also called as
+	 * part of save/restore from userspace.
+	 *
+	 * Therefore, we have to figure out the requester in a reliable way.
+	 *
+	 * When accessing VGIC state from user space, the requester_vcpu is
+	 * NULL, which is fine, because we guarantee that no VCPUs are running
+	 * when accessing VGIC state from user space so irq->vcpu->cpu is
+	 * always -1.
+	 */
+	requester_vcpu = kvm_arm_get_running_vcpu();
+
 	/*
 	 * If this virtual IRQ was written into a list register, we
 	 * have to make sure the CPU that runs the VCPU thread has
-	 * synced back LR state to the struct vgic_irq.  We can only
-	 * know this for sure, when either this irq is not assigned to
-	 * anyone's AP list anymore, or the VCPU thread is not
-	 * running on any CPUs.
+	 * synced back the LR state to the struct vgic_irq.
 	 *
-	 * In the opposite case, we know the VCPU thread may be on its
-	 * way back from the guest and still has to sync back this
-	 * IRQ, so we release and re-acquire the spin_lock to let the
-	 * other thread sync back the IRQ.
+	 * As long as the conditions below are true, we know the VCPU thread
+	 * may be on its way back from the guest (we kicked the VCPU thread in
+	 * vgic_change_active_prepare)  and still has to sync back this IRQ,
+	 * so we release and re-acquire the spin_lock to let the other thread
+	 * sync back the IRQ.
 	 */
 	while (irq->vcpu && /* IRQ may have state in an LR somewhere */
+	       irq->vcpu != requester_vcpu && /* Current thread is not the VCPU thread */
 	       irq->vcpu->cpu != -1) /* VCPU thread is running */
 		cond_resched_lock(&irq->irq_lock);
 

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | linux.kernel

csiph-web