Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1620311 > unrolled thread

[PATCH 4.9 000/152] 4.9.22-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 18:50 +0200
    [PATCH 4.9 151/152] usb-storage: Add ignore-residue quirk for Initio INIC-3619 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:00 +0200
    [PATCH 4.9 149/152] x86/reboot/quirks: Add ASUS EeeBook X205TA reboot quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:00 +0200
    [PATCH 4.9 152/152] x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:00 +0200
    [PATCH 4.9 109/152] ARM: OMAP2+: Fix init for multiple quirks for the same SoC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 128/152] ASoC: Intel: Baytrail: add quirk for Lenovo Thinkpad 10 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 115/152] ARM: davinci: add skeleton for pdata-quirks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
      Re: [PATCH 4.9 115/152] ARM: davinci: add skeleton for pdata-quirks Sekhar Nori <nsekhar@ti.com> - 2017-04-11 08:50 +0200
        Re: [PATCH 4.9 115/152] ARM: davinci: add skeleton for pdata-quirks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 16:40 +0200
          Re: [PATCH 4.9 115/152] ARM: davinci: add skeleton for pdata-quirks Sekhar Nori <nsekhar@ti.com> - 2017-04-11 16:50 +0200
    [PATCH 4.9 114/152] ARM: davinci: PM: support da8xx DT platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 118/152] usb: dwc3: host: pass quirk-broken-port-ped property for known broken revisions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 122/152] PCI: xgene: Fix double free on init error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 121/152] PCI: Add ACS quirk for Intel Union Point Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 148/152] tools/power turbostat: dump Atom P-states correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 143/152] PCI: Add ACS quirk for Qualcomm QDF2400 and QDF2432 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 127/152] ASoC: codecs: rt5670: add quirk for Lenovo Thinkpad 10 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 142/152] PCI: Sort the list of devices with D3 delay quirk by ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 070/152] HID: sensor-hub: add quirk for Microchip MM7150 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 147/152] tools/power turbostat: decode Baytrail CC6 and MC6 demotion configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 125/152] ACPI / button: Change default behavior to lid_init_state=open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 108/152] scsi: ufs: issue link starup 2 times if device isnt active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 150/152] x86/reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 112/152] Input: gpio_keys - add support for GPIO descriptors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
      Re: [PATCH 4.9 112/152] Input: gpio_keys - add support for GPIO descriptors Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2017-04-10 19:50 +0200
    [PATCH 4.9 134/152] HID: wacom: dont apply generic settings to old devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 131/152] ACPI: save NVS memory for Lenovo G50-45 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 126/152] ASoC: rt5670: Add missing 10EC5072 ACPI ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 129/152] ASoC: Intel: cht_bsw_rt5645: harden ACPI device detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 123/152] [media] rx51: broken build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 144/152] watchdog: s3c2410: Fix infinite interrupt in soft mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 135/152] arm: kernel: Add SMC structure parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 130/152] ASoC: Intel: cht_bsw_rt5645: add Baytrail MCLK support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:30 +0200
    [PATCH 4.9 028/152] brcmfmac: use local iftype avoiding use-after-free of virtual interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 099/152] ACPI / sysfs: Provide quirk mechanism to prevent GPE flooding Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 027/152] mac80211: unconditionally start new netdev queues with iTXQ support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 081/152] PCI/ACPI: Check for platform-specific MCFG quirks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 030/152] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 104/152] drm/i915: more .is_mobile cleanups for BDW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 029/152] metag/usercopy: Drop unused macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 067/152] clocksource/drivers/arm_arch_timer: Dont assume clock runs in suspend Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 069/152] HID: sensor-hub add quirk for Microsoft Surface 3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 077/152] arm64: PCI: Manage controller-specific data on per-controller basis Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 102/152] drm/edid: constify edid quirk list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 094/152] HID: asus: Add i2c touchpad support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 063/152] usb: dwc3: gadget: delay unmap of bounced requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 087/152] PCI: Add MCFG quirks for X-Gene host controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 082/152] PCI: Add MCFG quirks for Qualcomm QDF2432 host controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 092/152] ALSA: usb-audio: Add native DSD support for TEAC 501/503 DAC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 091/152] PCI: Expand "VPD access disabled" quirk message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 096/152] HID: microsoft: Add Surface 4 type cover pro 4 not JP versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
      Re: [PATCH 4.9 096/152] HID: microsoft: Add Surface 4 type cover pro  4 not JP versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 16:40 +0200
    [PATCH 4.9 085/152] PCI: Add MCFG quirks for Cavium ThunderX pass2.x host controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 089/152] scsi: ufs: add quirk to increase host PA_SaveConfigTime Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 072/152] HID: multitouch: do not retrieve all reports for all devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 095/152] HID: asus: Fix keyboard support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 097/152] HID: multitouch: enable the Surface 4 Type Cover Pro (JP) to report multitouch data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 076/152] x86/intel_idle: Add CPU model 0x4a (Atom Z34xx series) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 103/152] drm/i915: fix INTEL_BDW_IDS definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 031/152] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 090/152] ALSA: usb-audio: add implicit fb quirk for Axe-Fx II Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 098/152] nvme: simplify stripe quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 066/152] net/mlx4_core: Use device ID defines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 105/152] drm/i915: actually drive the BDW reserved IDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 065/152] arm64: dts: hisi: fix hip06 sas am-max-trans quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 084/152] PCI: thunder-pem: Factor out resource lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:40 +0200
    [PATCH 4.9 034/152] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 046/152] MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 057/152] drm/sun4i: tcon: Move SoC specific quirks to a DT matched data structure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 039/152] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 045/152] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 062/152] HID: i2c-hid: add a simple quirk to fix device defects Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 049/152] MIPS: Lantiq: fix missing xbar kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 052/152] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 037/152] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 036/152] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 038/152] powerpc/64: Fix flush_(d|i)cache_range() called from modules Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 058/152] drm/sun4i: Add compatible strings for A31/A31s display pipelines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 044/152] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 054/152] Documentation: stable-kernel-rules: fix stable-tag format Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 059/152] drm/sun4i: Add compatible string for A31/A31s TCON (timing controller) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 043/152] xtensa: make __pa work with uncached KSEG addresses Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 053/152] MIPS: c-r4k: Fix Loongson-3s vcache/scache waysize calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 025/152] xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 056/152] random: use chacha20 for get_random_int/long Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 032/152] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 042/152] nios2: reserve boot memory for device tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 008/152] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 19:50 +0200
    [PATCH 4.9 015/152] arm64: mm: unaligned access by user-land should be received as SIGBUS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 012/152] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 005/152] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 014/152] iio: bmg160: reset chip when probing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 021/152] dm verity fec: fix bufio leaks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 010/152] staging: android: ashmem: lseek failed due to no FMODE_LSEEK. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 013/152] kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 009/152] sysfs: be careful of error returns from ops->show() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 011/152] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 004/152] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 016/152] cfg80211: check rdev resume callback only for registered wiphy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 017/152] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 020/152] dm verity fec: limit error correction recursion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 019/152] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    [PATCH 4.9 001/152] ppdev: check before attaching port Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-10 20:00 +0200
    Re: [PATCH 4.9 000/152] 4.9.22-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-10 22:40 +0200
    Re: [PATCH 4.9 000/152] 4.9.22-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 01:00 +0200
      Re: [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 06:40 +0200
    Re: [PATCH 4.9 000/152] 4.9.22-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 05:10 +0200
      Re: [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 06:50 +0200
        Re: [PATCH 4.9 000/152] 4.9.22-stable review Tony Lindgren <tony@atomide.com> - 2017-04-11 17:20 +0200
          Re: [PATCH 4.9 000/152] 4.9.22-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-12 03:50 +0200
            Re: [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-12 08:30 +0200
    Re: [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 07:10 +0200
      Re: [PATCH 4.9 000/152] 4.9.22-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-11 14:50 +0200
        Re: [PATCH 4.9 000/152] 4.9.22-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-11 16:40 +0200

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

#1620523 — [PATCH 4.9 059/152] drm/sun4i: Add compatible string for A31/A31s TCON (timing controller)

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chen-Yu Tsai <wens@csie.org>

commit 93a5ec14da24a8abbac5bcb953b45cc7a5d0198a upstream.

The A31 TCON has mux controls for how TCON outputs are routed to the
HDMI and MIPI DSI blocks.

Since the A31s does not have MIPI DSI, it only has a mux for the HDMI
controller input.

This patch only adds support for the compatible strings. Actual support
for the mux controls should be added with HDMI and MIPI DSI support.

Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt |    4 +++-
 drivers/gpu/drm/sun4i/sun4i_drv.c                             |    2 ++
 drivers/gpu/drm/sun4i/sun4i_tcon.c                            |   10 ++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

--- a/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt
+++ b/Documentation/devicetree/bindings/display/sunxi/sun4i-drm.txt
@@ -28,6 +28,8 @@ The TCON acts as a timing controller for
 Required properties:
  - compatible: value must be either:
    * allwinner,sun5i-a13-tcon
+   * allwinner,sun6i-a31-tcon
+   * allwinner,sun6i-a31s-tcon
    * allwinner,sun8i-a33-tcon
  - reg: base address and size of memory-mapped region
  - interrupts: interrupt associated to this IP
@@ -50,7 +52,7 @@ Required properties:
   second the block connected to the TCON channel 1 (usually the TV
   encoder)
 
-On the A13, there is one more clock required:
+On SoCs other than the A33, there is one more clock required:
    - 'tcon-ch1': The clock driving the TCON channel 1
 
 DRC
--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
+++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
@@ -208,6 +208,8 @@ static bool sun4i_drv_node_is_frontend(s
 static bool sun4i_drv_node_is_tcon(struct device_node *node)
 {
 	return of_device_is_compatible(node, "allwinner,sun5i-a13-tcon") ||
+		of_device_is_compatible(node, "allwinner,sun6i-a31-tcon") ||
+		of_device_is_compatible(node, "allwinner,sun6i-a31s-tcon") ||
 		of_device_is_compatible(node, "allwinner,sun8i-a33-tcon");
 }
 
--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c
+++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c
@@ -587,12 +587,22 @@ static const struct sun4i_tcon_quirks su
 	.has_channel_1	= true,
 };
 
+static const struct sun4i_tcon_quirks sun6i_a31_quirks = {
+	.has_channel_1	= true,
+};
+
+static const struct sun4i_tcon_quirks sun6i_a31s_quirks = {
+	.has_channel_1	= true,
+};
+
 static const struct sun4i_tcon_quirks sun8i_a33_quirks = {
 	/* nothing is supported */
 };
 
 static const struct of_device_id sun4i_tcon_of_table[] = {
 	{ .compatible = "allwinner,sun5i-a13-tcon", .data = &sun5i_a13_quirks },
+	{ .compatible = "allwinner,sun6i-a31-tcon", .data = &sun6i_a31_quirks },
+	{ .compatible = "allwinner,sun6i-a31s-tcon", .data = &sun6i_a31s_quirks },
 	{ .compatible = "allwinner,sun8i-a33-tcon", .data = &sun8i_a33_quirks },
 	{ }
 };

[toc] | [prev] | [next] | [standalone]

#1620524 — [PATCH 4.9 043/152] xtensa: make __pa work with uncached KSEG addresses

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Max Filippov <jcmvbkbc@gmail.com>

commit 2b83878dd74a7c73bedcb6600663c1c46836e8af upstream.

When __pa is applied to virtual address in uncached KSEG region the
result is incorrect. Fix it by checking if the original address is in
the uncached KSEG and adjusting the result. It looks better than masking
off bits because pfn_valid would correctly work with new __pa results
and it may be made working in noMMU case, once we get definition for
uncached memory view.

This is required for the dma_common_mmap and DMA debug code to work
correctly: they both indirectly use __pa with coherent DMA addresses.
In case of DMA debug the visible effect is false reports that an address
mapped for DMA is accessed by CPU.

Tested-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/xtensa/include/asm/page.h |   13 +++++++++++++
 1 file changed, 13 insertions(+)

--- a/arch/xtensa/include/asm/page.h
+++ b/arch/xtensa/include/asm/page.h
@@ -164,8 +164,21 @@ void copy_user_highpage(struct page *to,
 
 #define ARCH_PFN_OFFSET		(PHYS_OFFSET >> PAGE_SHIFT)
 
+#ifdef CONFIG_MMU
+static inline unsigned long ___pa(unsigned long va)
+{
+	unsigned long off = va - PAGE_OFFSET;
+
+	if (off >= XCHAL_KSEG_SIZE)
+		off -= XCHAL_KSEG_SIZE;
+
+	return off + PHYS_OFFSET;
+}
+#define __pa(x)	___pa((unsigned long)(x))
+#else
 #define __pa(x)	\
 	((unsigned long) (x) - PAGE_OFFSET + PHYS_OFFSET)
+#endif
 #define __va(x)	\
 	((void *)((unsigned long) (x) - PHYS_OFFSET + PAGE_OFFSET))
 #define pfn_valid(pfn) \

[toc] | [prev] | [next] | [standalone]

#1620525 — [PATCH 4.9 053/152] MIPS: c-r4k: Fix Loongson-3s vcache/scache waysize calculation

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huacai Chen <chenhc@lemote.com>

commit 0be032c190abcdcfa948082b6a1e0d461184ba4d upstream.

If scache.waysize is 0, r4k___flush_cache_all() will do nothing and
then cause bugs. BTW, though vcache.waysize isn't being used by now,
we also fix its calculation.

Signed-off-by: Huacai Chen <chenhc@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J . Hill <Steven.Hill@caviumnetworks.com>
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15756/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/mm/c-r4k.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -1558,6 +1558,7 @@ static void probe_vcache(void)
 	vcache_size = c->vcache.sets * c->vcache.ways * c->vcache.linesz;
 
 	c->vcache.waybit = 0;
+	c->vcache.waysize = vcache_size / c->vcache.ways;
 
 	pr_info("Unified victim cache %ldkB %s, linesize %d bytes.\n",
 		vcache_size >> 10, way_string[c->vcache.ways], c->vcache.linesz);
@@ -1660,6 +1661,7 @@ static void __init loongson3_sc_init(voi
 	/* Loongson-3 has 4 cores, 1MB scache for each. scaches are shared */
 	scache_size *= 4;
 	c->scache.waybit = 0;
+	c->scache.waysize = scache_size / c->scache.ways;
 	pr_info("Unified secondary cache %ldkB %s, linesize %d bytes.\n",
 	       scache_size >> 10, way_string[c->scache.ways], c->scache.linesz);
 	if (scache_size)

[toc] | [prev] | [next] | [standalone]

#1620526 — [PATCH 4.9 025/152] xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Calvin Owens <calvinowens@fb.com>

commit 3dd09d5a8589c640abb49cfcf92b4ed669eafad1 upstream.

When punching past EOF on XFS, fallocate(mode=PUNCH_HOLE|KEEP_SIZE) will
round the file size up to the nearest multiple of PAGE_SIZE:

  calvinow@vm-disks/generic-xfs-1 ~$ dd if=/dev/urandom of=test bs=2048 count=1
  calvinow@vm-disks/generic-xfs-1 ~$ stat test
    Size: 2048            Blocks: 8          IO Block: 4096   regular file
  calvinow@vm-disks/generic-xfs-1 ~$ fallocate -n -l 2048 -o 2048 -p test
  calvinow@vm-disks/generic-xfs-1 ~$ stat test
    Size: 4096            Blocks: 8          IO Block: 4096   regular file

Commit 3c2bdc912a1cc050 ("xfs: kill xfs_zero_remaining_bytes") replaced
xfs_zero_remaining_bytes() with calls to iomap helpers. The new helpers
don't enforce that [pos,offset) lies strictly on [0,i_size) when being
called from xfs_free_file_space(), so by "leaking" these ranges into
xfs_zero_range() we get this buggy behavior.

Fix this by reintroducing the checks xfs_zero_remaining_bytes() did
against i_size at the bottom of xfs_free_file_space().

Reported-by: Aaron Gao <gzh@fb.com>
Fixes: 3c2bdc912a1cc050 ("xfs: kill xfs_zero_remaining_bytes")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Brian Foster <bfoster@redhat.com>
Signed-off-by: Calvin Owens <calvinowens@fb.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_bmap_util.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1318,8 +1318,16 @@ xfs_free_file_space(
 	/*
 	 * Now that we've unmap all full blocks we'll have to zero out any
 	 * partial block at the beginning and/or end.  xfs_zero_range is
-	 * smart enough to skip any holes, including those we just created.
+	 * smart enough to skip any holes, including those we just created,
+	 * but we must take care not to zero beyond EOF and enlarge i_size.
 	 */
+
+	if (offset >= XFS_ISIZE(ip))
+		return 0;
+
+	if (offset + len > XFS_ISIZE(ip))
+		len = XFS_ISIZE(ip) - offset;
+
 	return xfs_zero_range(ip, offset, len, NULL);
 }
 

[toc] | [prev] | [next] | [standalone]

#1620528 — [PATCH 4.9 056/152] random: use chacha20 for get_random_int/long

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason A. Donenfeld <Jason@zx2c4.com>

commit f5b98461cb8167ba362ad9f74c41d126b7becea7 upstream.

Now that our crng uses chacha20, we can rely on its speedy
characteristics for replacing MD5, while simultaneously achieving a
higher security guarantee. Before the idea was to use these functions if
you wanted random integers that aren't stupidly insecure but aren't
necessarily secure either, a vague gray zone, that hopefully was "good
enough" for its users. With chacha20, we can strengthen this claim,
since either we're using an rdrand-like instruction, or we're using the
same crng as /dev/urandom. And it's faster than what was before.

We could have chosen to replace this with a SipHash-derived function,
which might be slightly faster, but at the cost of having yet another
RNG construction in the kernel. By moving to chacha20, we have a single
RNG to analyze and verify, and we also already get good performance
improvements on all platforms.

Implementation-wise, rather than use a generic buffer for both
get_random_int/long and memcpy based on the size needs, we use a
specific buffer for 32-bit reads and for 64-bit reads. This way, we're
guaranteed to always have aligned accesses on all platforms. While
slightly more verbose in C, the assembly this generates is a lot
simpler than otherwise.

Finally, on 32-bit platforms where longs and ints are the same size,
we simply alias get_random_int to get_random_long.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Suggested-by: Theodore Ts'o <tytso@mit.edu>
Cc: Theodore Ts'o <tytso@mit.edu>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/random.c  |   84 +++++++++++++++++++++++++------------------------
 include/linux/random.h |    1 
 init/main.c            |    1 
 3 files changed, 43 insertions(+), 43 deletions(-)

--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -2042,63 +2042,65 @@ struct ctl_table random_table[] = {
 };
 #endif 	/* CONFIG_SYSCTL */
 
-static u32 random_int_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
-
-int random_int_secret_init(void)
-{
-	get_random_bytes(random_int_secret, sizeof(random_int_secret));
-	return 0;
-}
-
-static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash)
-		__aligned(sizeof(unsigned long));
+struct batched_entropy {
+	union {
+		unsigned long entropy_long[CHACHA20_BLOCK_SIZE / sizeof(unsigned long)];
+		unsigned int entropy_int[CHACHA20_BLOCK_SIZE / sizeof(unsigned int)];
+	};
+	unsigned int position;
+};
 
 /*
- * Get a random word for internal kernel use only. Similar to urandom but
- * with the goal of minimal entropy pool depletion. As a result, the random
- * value is not cryptographically secure but for several uses the cost of
- * depleting entropy is too high
+ * Get a random word for internal kernel use only. The quality of the random
+ * number is either as good as RDRAND or as good as /dev/urandom, with the
+ * goal of being quite fast and not depleting entropy.
  */
-unsigned int get_random_int(void)
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_long);
+unsigned long get_random_long(void)
 {
-	__u32 *hash;
-	unsigned int ret;
+	unsigned long ret;
+	struct batched_entropy *batch;
 
-	if (arch_get_random_int(&ret))
+	if (arch_get_random_long(&ret))
 		return ret;
 
-	hash = get_cpu_var(get_random_int_hash);
-
-	hash[0] += current->pid + jiffies + random_get_entropy();
-	md5_transform(hash, random_int_secret);
-	ret = hash[0];
-	put_cpu_var(get_random_int_hash);
-
+	batch = &get_cpu_var(batched_entropy_long);
+	if (batch->position % ARRAY_SIZE(batch->entropy_long) == 0) {
+		extract_crng((u8 *)batch->entropy_long);
+		batch->position = 0;
+	}
+	ret = batch->entropy_long[batch->position++];
+	put_cpu_var(batched_entropy_long);
 	return ret;
 }
-EXPORT_SYMBOL(get_random_int);
+EXPORT_SYMBOL(get_random_long);
 
-/*
- * Same as get_random_int(), but returns unsigned long.
- */
-unsigned long get_random_long(void)
+#if BITS_PER_LONG == 32
+unsigned int get_random_int(void)
 {
-	__u32 *hash;
-	unsigned long ret;
+	return get_random_long();
+}
+#else
+static DEFINE_PER_CPU(struct batched_entropy, batched_entropy_int);
+unsigned int get_random_int(void)
+{
+	unsigned int ret;
+	struct batched_entropy *batch;
 
-	if (arch_get_random_long(&ret))
+	if (arch_get_random_int(&ret))
 		return ret;
 
-	hash = get_cpu_var(get_random_int_hash);
-
-	hash[0] += current->pid + jiffies + random_get_entropy();
-	md5_transform(hash, random_int_secret);
-	ret = *(unsigned long *)hash;
-	put_cpu_var(get_random_int_hash);
-
+	batch = &get_cpu_var(batched_entropy_int);
+	if (batch->position % ARRAY_SIZE(batch->entropy_int) == 0) {
+		extract_crng((u8 *)batch->entropy_int);
+		batch->position = 0;
+	}
+	ret = batch->entropy_int[batch->position++];
+	put_cpu_var(batched_entropy_int);
 	return ret;
 }
-EXPORT_SYMBOL(get_random_long);
+#endif
+EXPORT_SYMBOL(get_random_int);
 
 /**
  * randomize_page - Generate a random, page aligned address
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -37,7 +37,6 @@ extern void get_random_bytes(void *buf,
 extern int add_random_ready_callback(struct random_ready_callback *rdy);
 extern void del_random_ready_callback(struct random_ready_callback *rdy);
 extern void get_random_bytes_arch(void *buf, int nbytes);
-extern int random_int_secret_init(void);
 
 #ifndef MODULE
 extern const struct file_operations random_fops, urandom_fops;
--- a/init/main.c
+++ b/init/main.c
@@ -868,7 +868,6 @@ static void __init do_basic_setup(void)
 	do_ctors();
 	usermodehelper_enable();
 	do_initcalls();
-	random_int_secret_init();
 }
 
 static void __init do_pre_smp_initcalls(void)

[toc] | [prev] | [next] | [standalone]

#1620530 — [PATCH 4.9 032/152] metag/usercopy: Zero rest of buffer from copy_from_user

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hogan <james.hogan@imgtec.com>

commit 563ddc1076109f2b3f88e6d355eab7b6fd4662cb upstream.

Currently we try to zero the destination for a failed read from userland
in fixup code in the usercopy.c macros. The rest of the destination
buffer is then zeroed from __copy_user_zeroing(), which is used for both
copy_from_user() and __copy_from_user().

Unfortunately we fail to zero in the fixup code as D1Ar1 is set to 0
before the fixup code entry labels, and __copy_from_user() shouldn't even
be zeroing the rest of the buffer.

Move the zeroing out into copy_from_user() and rename
__copy_user_zeroing() to raw_copy_from_user() since it no longer does
any zeroing. This also conveniently matches the name needed for
RAW_COPY_USER support in a later patch.

Fixes: 373cd784d0fc ("metag: Memory handling")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/include/asm/uaccess.h |   15 +++++-----
 arch/metag/lib/usercopy.c        |   57 ++++++++++++---------------------------
 2 files changed, 26 insertions(+), 46 deletions(-)

--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -197,20 +197,21 @@ extern long __must_check strnlen_user(co
 
 #define strlen_user(str) strnlen_user(str, 32767)
 
-extern unsigned long __must_check __copy_user_zeroing(void *to,
-						      const void __user *from,
-						      unsigned long n);
+extern unsigned long raw_copy_from_user(void *to, const void __user *from,
+					unsigned long n);
 
 static inline unsigned long
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	unsigned long res = n;
 	if (likely(access_ok(VERIFY_READ, from, n)))
-		return __copy_user_zeroing(to, from, n);
-	memset(to, 0, n);
-	return n;
+		res = raw_copy_from_user(to, from, n);
+	if (unlikely(res))
+		memset(to + (n - res), 0, res);
+	return res;
 }
 
-#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n)
+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n)
 #define __copy_from_user_inatomic __copy_from_user
 
 extern unsigned long __must_check __copy_user(void __user *to,
--- a/arch/metag/lib/usercopy.c
+++ b/arch/metag/lib/usercopy.c
@@ -29,7 +29,6 @@
 		COPY						 \
 		"1:\n"						 \
 		"	.section .fixup,\"ax\"\n"		 \
-		"	MOV D1Ar1,#0\n"				 \
 		FIXUP						 \
 		"	MOVT    D1Ar1,#HI(1b)\n"		 \
 		"	JUMP    D1Ar1,#LO(1b)\n"		 \
@@ -637,16 +636,14 @@ EXPORT_SYMBOL(__copy_user);
 	__asm_copy_user_cont(to, from, ret,	\
 		"	GETB D1Ar1,[%1++]\n"	\
 		"2:	SETB [%0++],D1Ar1\n",	\
-		"3:	ADD  %2,%2,#1\n"	\
-		"	SETB [%0++],D1Ar1\n",	\
+		"3:	ADD  %2,%2,#1\n",	\
 		"	.long 2b,3b\n")
 
 #define __asm_copy_from_user_2x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
 	__asm_copy_user_cont(to, from, ret,		\
 		"	GETW D1Ar1,[%1++]\n"		\
 		"2:	SETW [%0++],D1Ar1\n" COPY,	\
-		"3:	ADD  %2,%2,#2\n"		\
-		"	SETW [%0++],D1Ar1\n" FIXUP,	\
+		"3:	ADD  %2,%2,#2\n" FIXUP,		\
 		"	.long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_2(to, from, ret) \
@@ -656,32 +653,26 @@ EXPORT_SYMBOL(__copy_user);
 	__asm_copy_from_user_2x_cont(to, from, ret,	\
 		"	GETB D1Ar1,[%1++]\n"		\
 		"4:	SETB [%0++],D1Ar1\n",		\
-		"5:	ADD  %2,%2,#1\n"		\
-		"	SETB [%0++],D1Ar1\n",		\
+		"5:	ADD  %2,%2,#1\n",		\
 		"	.long 4b,5b\n")
 
 #define __asm_copy_from_user_4x_cont(to, from, ret, COPY, FIXUP, TENTRY) \
 	__asm_copy_user_cont(to, from, ret,		\
 		"	GETD D1Ar1,[%1++]\n"		\
 		"2:	SETD [%0++],D1Ar1\n" COPY,	\
-		"3:	ADD  %2,%2,#4\n"		\
-		"	SETD [%0++],D1Ar1\n" FIXUP,	\
+		"3:	ADD  %2,%2,#4\n" FIXUP,		\
 		"	.long 2b,3b\n" TENTRY)
 
 #define __asm_copy_from_user_4(to, from, ret) \
 	__asm_copy_from_user_4x_cont(to, from, ret, "", "", "")
 
-
 #define __asm_copy_from_user_8x64(to, from, ret) \
 	asm volatile (				\
 		"	GETL D0Ar2,D1Ar1,[%1++]\n"	\
 		"2:	SETL [%0++],D0Ar2,D1Ar1\n"	\
 		"1:\n"					\
 		"	.section .fixup,\"ax\"\n"	\
-		"	MOV D1Ar1,#0\n"			\
-		"	MOV D0Ar2,#0\n"			\
 		"3:	ADD  %2,%2,#8\n"		\
-		"	SETL [%0++],D0Ar2,D1Ar1\n"	\
 		"	MOVT    D0Ar2,#HI(1b)\n"	\
 		"	JUMP    D0Ar2,#LO(1b)\n"	\
 		"	.previous\n"			\
@@ -721,11 +712,12 @@ EXPORT_SYMBOL(__copy_user);
 		"SUB	%1, %1, #4\n")
 
 
-/* Copy from user to kernel, zeroing the bytes that were inaccessible in
-   userland.  The return-value is the number of bytes that were
-   inaccessible.  */
-unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc,
-				  unsigned long n)
+/*
+ * Copy from user to kernel. The return-value is the number of bytes that were
+ * inaccessible.
+ */
+unsigned long raw_copy_from_user(void *pdst, const void __user *psrc,
+				 unsigned long n)
 {
 	register char *dst asm ("A0.2") = pdst;
 	register const char __user *src asm ("A1.2") = psrc;
@@ -738,7 +730,7 @@ unsigned long __copy_user_zeroing(void *
 		__asm_copy_from_user_1(dst, src, retn);
 		n--;
 		if (retn)
-			goto copy_exception_bytes;
+			return retn + n;
 	}
 	if ((unsigned long) dst & 1) {
 		/* Worst case - byte copy */
@@ -746,14 +738,14 @@ unsigned long __copy_user_zeroing(void *
 			__asm_copy_from_user_1(dst, src, retn);
 			n--;
 			if (retn)
-				goto copy_exception_bytes;
+				return retn + n;
 		}
 	}
 	if (((unsigned long) src & 2) && n >= 2) {
 		__asm_copy_from_user_2(dst, src, retn);
 		n -= 2;
 		if (retn)
-			goto copy_exception_bytes;
+			return retn + n;
 	}
 	if ((unsigned long) dst & 2) {
 		/* Second worst case - word copy */
@@ -761,7 +753,7 @@ unsigned long __copy_user_zeroing(void *
 			__asm_copy_from_user_2(dst, src, retn);
 			n -= 2;
 			if (retn)
-				goto copy_exception_bytes;
+				return retn + n;
 		}
 	}
 
@@ -777,7 +769,7 @@ unsigned long __copy_user_zeroing(void *
 			__asm_copy_from_user_8x64(dst, src, retn);
 			n -= 8;
 			if (retn)
-				goto copy_exception_bytes;
+				return retn + n;
 		}
 	}
 
@@ -793,7 +785,7 @@ unsigned long __copy_user_zeroing(void *
 			__asm_copy_from_user_8x64(dst, src, retn);
 			n -= 8;
 			if (retn)
-				goto copy_exception_bytes;
+				return retn + n;
 		}
 	}
 #endif
@@ -803,7 +795,7 @@ unsigned long __copy_user_zeroing(void *
 		n -= 4;
 
 		if (retn)
-			goto copy_exception_bytes;
+			return retn + n;
 	}
 
 	/* If we get here, there were no memory read faults.  */
@@ -829,21 +821,8 @@ unsigned long __copy_user_zeroing(void *
 	/* If we get here, retn correctly reflects the number of failing
 	   bytes.  */
 	return retn;
-
- copy_exception_bytes:
-	/* We already have "retn" bytes cleared, and need to clear the
-	   remaining "n" bytes.  A non-optimized simple byte-for-byte in-line
-	   memset is preferred here, since this isn't speed-critical code and
-	   we'd rather have this a leaf-function than calling memset.  */
-	{
-		char *endp;
-		for (endp = dst + n; dst < endp; dst++)
-			*dst = 0;
-	}
-
-	return retn + n;
 }
-EXPORT_SYMBOL(__copy_user_zeroing);
+EXPORT_SYMBOL(raw_copy_from_user);
 
 #define __asm_clear_8x64(to, ret) \
 	asm volatile (					\

[toc] | [prev] | [next] | [standalone]

#1620532 — [PATCH 4.9 042/152] nios2: reserve boot memory for device tree

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tobias Klauser <tklauser@distanz.ch>

commit 921d701e6f31e1ffaca3560416af1aa04edb4c4f upstream.

Make sure to reserve the boot memory for the flattened device tree.
Otherwise it might get overwritten, e.g. when initial_boot_params is
copied, leading to a corrupted FDT and a boot hang/crash:

  bootconsole [early0] enabled
  Early console on uart16650 initialized at 0xf8001600
  OF: fdt: Error -11 processing FDT
  Kernel panic - not syncing: setup_cpuinfo: No CPU found in devicetree!

  ---[ end Kernel panic - not syncing: setup_cpuinfo: No CPU found in devicetree!

Guenter Roeck says:

> I think I found the problem. In unflatten_and_copy_device_tree(), with added
> debug information:
>
> OF: fdt: initial_boot_params=c861e400, dt=c861f000 size=28874 (0x70ca)
>
> ... and then initial_boot_params is copied to dt, which results in corrupted
> fdt since the memory overlaps. Looks like the initial_boot_params memory
> is not reserved and (re-)allocated by early_init_dt_alloc_memory_arch().

Reported-by: Guenter Roeck <linux@roeck-us.net>
Reference: http://lkml.kernel.org/r/20170226210338.GA19476@roeck-us.net
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Acked-by: Ley Foon Tan <ley.foon.tan@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/nios2/kernel/prom.c  |    7 +++++++
 arch/nios2/kernel/setup.c |    3 +++
 2 files changed, 10 insertions(+)

--- a/arch/nios2/kernel/prom.c
+++ b/arch/nios2/kernel/prom.c
@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory
 	return alloc_bootmem_align(size, align);
 }
 
+int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size,
+					     bool nomap)
+{
+	reserve_bootmem(base, size, BOOTMEM_DEFAULT);
+	return 0;
+}
+
 void __init early_init_devtree(void *params)
 {
 	__be32 *dtb = (u32 *)__dtb_start;
--- a/arch/nios2/kernel/setup.c
+++ b/arch/nios2/kernel/setup.c
@@ -195,6 +195,9 @@ void __init setup_arch(char **cmdline_p)
 	}
 #endif /* CONFIG_BLK_DEV_INITRD */
 
+	early_init_fdt_reserve_self();
+	early_init_fdt_scan_reserved_mem();
+
 	unflatten_and_copy_device_tree();
 
 	setup_cpuinfo();

[toc] | [prev] | [next] | [standalone]

#1620534 — [PATCH 4.9 008/152] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li Qiang <liq3ea@gmail.com>

commit e7e11f99564222d82f0ce84bd521e57d78a6b678 upstream.

In vmw_surface_define_ioctl(), the 'num_sizes' is the sum of the
'req->mip_levels' array. This array can be assigned any value from
the user space. As both the 'num_sizes' and the array is uint32_t,
it is easy to make 'num_sizes' overflow. The later 'mip_levels' is
used as the loop count. This can lead an oob write. Add the check of
'req->mip_levels' to avoid this.

Signed-off-by: Li Qiang <liqiang6-s@360.cn>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -713,8 +713,11 @@ int vmw_surface_define_ioctl(struct drm_
 			128;
 
 	num_sizes = 0;
-	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
+	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) {
+		if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS)
+			return -EINVAL;
 		num_sizes += req->mip_levels[i];
+	}
 
 	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
 	    num_sizes == 0)

[toc] | [prev] | [next] | [standalone]

#1620536 — [PATCH 4.9 015/152] arm64: mm: unaligned access by user-land should be received as SIGBUS

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Victor Kamensky <kamensky@cisco.com>

commit 09a6adf53d42ca3088fa3fb41f40b768efc711ed upstream.

After 52d7523 (arm64: mm: allow the kernel to handle alignment faults on
user accesses) commit user-land accesses that produce unaligned exceptions
like in case of aarch32 ldm/stm/ldrd/strd instructions operating on
unaligned memory received by user-land as SIGSEGV. It is wrong, it should
be reported as SIGBUS as it was before 52d7523 commit.

Changed do_bad_area function to take signal and code parameters out of esr
value using fault_info table, so in case of do_alignment_fault fault
user-land will receive SIGBUS. Wrapped access to fault_info table into
esr_to_fault_info function.

Fixes: 52d7523 (arm64: mm: allow the kernel to handle alignment faults on user accesses)
Signed-off-by: Victor Kamensky <kamensky@cisco.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/mm/fault.c |   42 ++++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 18 deletions(-)

--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -41,7 +41,20 @@
 #include <asm/pgtable.h>
 #include <asm/tlbflush.h>
 
-static const char *fault_name(unsigned int esr);
+struct fault_info {
+	int	(*fn)(unsigned long addr, unsigned int esr,
+		      struct pt_regs *regs);
+	int	sig;
+	int	code;
+	const char *name;
+};
+
+static const struct fault_info fault_info[];
+
+static inline const struct fault_info *esr_to_fault_info(unsigned int esr)
+{
+	return fault_info + (esr & 63);
+}
 
 #ifdef CONFIG_KPROBES
 static inline int notify_page_fault(struct pt_regs *regs, unsigned int esr)
@@ -196,10 +209,12 @@ static void __do_user_fault(struct task_
 			    struct pt_regs *regs)
 {
 	struct siginfo si;
+	const struct fault_info *inf;
 
 	if (unhandled_signal(tsk, sig) && show_unhandled_signals_ratelimited()) {
+		inf = esr_to_fault_info(esr);
 		pr_info("%s[%d]: unhandled %s (%d) at 0x%08lx, esr 0x%03x\n",
-			tsk->comm, task_pid_nr(tsk), fault_name(esr), sig,
+			tsk->comm, task_pid_nr(tsk), inf->name, sig,
 			addr, esr);
 		show_pte(tsk->mm, addr);
 		show_regs(regs);
@@ -218,14 +233,16 @@ static void do_bad_area(unsigned long ad
 {
 	struct task_struct *tsk = current;
 	struct mm_struct *mm = tsk->active_mm;
+	const struct fault_info *inf;
 
 	/*
 	 * If we are in kernel mode at this point, we have no context to
 	 * handle this fault with.
 	 */
-	if (user_mode(regs))
-		__do_user_fault(tsk, addr, esr, SIGSEGV, SEGV_MAPERR, regs);
-	else
+	if (user_mode(regs)) {
+		inf = esr_to_fault_info(esr);
+		__do_user_fault(tsk, addr, esr, inf->sig, inf->code, regs);
+	} else
 		__do_kernel_fault(mm, addr, esr, regs);
 }
 
@@ -481,12 +498,7 @@ static int do_bad(unsigned long addr, un
 	return 1;
 }
 
-static const struct fault_info {
-	int	(*fn)(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-	int	sig;
-	int	code;
-	const char *name;
-} fault_info[] = {
+static const struct fault_info fault_info[] = {
 	{ do_bad,		SIGBUS,  0,		"ttbr address size fault"	},
 	{ do_bad,		SIGBUS,  0,		"level 1 address size fault"	},
 	{ do_bad,		SIGBUS,  0,		"level 2 address size fault"	},
@@ -553,19 +565,13 @@ static const struct fault_info {
 	{ do_bad,		SIGBUS,  0,		"unknown 63"			},
 };
 
-static const char *fault_name(unsigned int esr)
-{
-	const struct fault_info *inf = fault_info + (esr & 63);
-	return inf->name;
-}
-
 /*
  * Dispatch a data abort to the relevant handler.
  */
 asmlinkage void __exception do_mem_abort(unsigned long addr, unsigned int esr,
 					 struct pt_regs *regs)
 {
-	const struct fault_info *inf = fault_info + (esr & 63);
+	const struct fault_info *inf = esr_to_fault_info(esr);
 	struct siginfo info;
 
 	if (!inf->fn(addr, esr, regs))

[toc] | [prev] | [next] | [standalone]

#1620538 — [PATCH 4.9 012/152] arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 72f310481a08db821b614e7b5d00febcc9064b36 upstream.

We don't hold the mmap_sem while searching for VMAs (via find_vma), in
kvm_arch_prepare_memory_region, which can end up in expected failures.

Fixes: commit 8eef91239e57 ("arm/arm64: KVM: map MMIO regions at creation time")
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Eric Auger <eric.auger@rehat.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
[ Handle dirty page logging failure case ]
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kvm/mmu.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1806,6 +1806,7 @@ int kvm_arch_prepare_memory_region(struc
 	    (KVM_PHYS_SIZE >> PAGE_SHIFT))
 		return -EFAULT;
 
+	down_read(&current->mm->mmap_sem);
 	/*
 	 * A memory region could potentially cover multiple VMAs, and any holes
 	 * between them, so iterate over all of them to find out if we can map
@@ -1849,8 +1850,10 @@ int kvm_arch_prepare_memory_region(struc
 			pa += vm_start - vma->vm_start;
 
 			/* IO region dirty page logging not allowed */
-			if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES)
-				return -EINVAL;
+			if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) {
+				ret = -EINVAL;
+				goto out;
+			}
 
 			ret = kvm_phys_addr_ioremap(kvm, gpa, pa,
 						    vm_end - vm_start,
@@ -1862,7 +1865,7 @@ int kvm_arch_prepare_memory_region(struc
 	} while (hva < reg_end);
 
 	if (change == KVM_MR_FLAGS_ONLY)
-		return ret;
+		goto out;
 
 	spin_lock(&kvm->mmu_lock);
 	if (ret)
@@ -1870,6 +1873,8 @@ int kvm_arch_prepare_memory_region(struc
 	else
 		stage2_flush_memslot(kvm, memslot);
 	spin_unlock(&kvm->mmu_lock);
+out:
+	up_read(&current->mm->mmap_sem);
 	return ret;
 }
 

[toc] | [prev] | [next] | [standalone]

#1620539 — [PATCH 4.9 005/152] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Murray McAllister <murray.mcallister@insomniasec.com>

commit 63774069d9527a1aeaa4aa20e929ef5e8e9ecc38 upstream.

In vmw_get_cap_3d_ioctl(), a user can supply 0 for a size that is
used in vzalloc(). This eventually calls dump_stack() (in warn_alloc()),
which can leak useful addresses to dmesg.

Add check to avoid a size of 0.

Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -186,7 +186,7 @@ int vmw_get_cap_3d_ioctl(struct drm_devi
 	bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS);
 	struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv);
 
-	if (unlikely(arg->pad64 != 0)) {
+	if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) {
 		DRM_ERROR("Illegal GET_3D_CAP argument.\n");
 		return -EINVAL;
 	}

[toc] | [prev] | [next] | [standalone]

#1620541 — [PATCH 4.9 014/152] iio: bmg160: reset chip when probing

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Quentin Schulz <quentin.schulz@free-electrons.com>

commit 4bdc9029685ac03be50b320b29691766d2326c2b upstream.

The gyroscope chip might need to be reset to be used.

Without the chip being reset, the driver stopped at the first
regmap_read (to get the CHIP_ID) and failed to probe.

The datasheet of the gyroscope says that a minimum wait of 30ms after
the reset has to be done.

This patch has been checked on a BMX055 and the datasheet of the BMG160
and the BMI055 give the same reset register and bits.

Signed-off-by: Quentin Schulz <quentin.schulz@free-electrons.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iio/gyro/bmg160_core.c |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/drivers/iio/gyro/bmg160_core.c
+++ b/drivers/iio/gyro/bmg160_core.c
@@ -27,6 +27,7 @@
 #include <linux/iio/trigger_consumer.h>
 #include <linux/iio/triggered_buffer.h>
 #include <linux/regmap.h>
+#include <linux/delay.h>
 #include "bmg160.h"
 
 #define BMG160_IRQ_NAME		"bmg160_event"
@@ -52,6 +53,9 @@
 #define BMG160_DEF_BW			100
 #define BMG160_REG_PMU_BW_RES		BIT(7)
 
+#define BMG160_GYRO_REG_RESET		0x14
+#define BMG160_GYRO_RESET_VAL		0xb6
+
 #define BMG160_REG_INT_MAP_0		0x17
 #define BMG160_INT_MAP_0_BIT_ANY	BIT(1)
 
@@ -236,6 +240,14 @@ static int bmg160_chip_init(struct bmg16
 	int ret;
 	unsigned int val;
 
+	/*
+	 * Reset chip to get it in a known good state. A delay of 30ms after
+	 * reset is required according to the datasheet.
+	 */
+	regmap_write(data->regmap, BMG160_GYRO_REG_RESET,
+		     BMG160_GYRO_RESET_VAL);
+	usleep_range(30000, 30700);
+
 	ret = regmap_read(data->regmap, BMG160_REG_CHIP_ID, &val);
 	if (ret < 0) {
 		dev_err(dev, "Error reading reg_chip_id\n");

[toc] | [prev] | [next] | [standalone]

#1620542 — [PATCH 4.9 021/152] dm verity fec: fix bufio leaks

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sami Tolvanen <samitolvanen@google.com>

commit 86e3e83b443669dd2bcc5c8a83b23e3aa0694c0d upstream.

Buffers read through dm_bufio_read() were not released in all code paths.

Fixes: a739ff3f543a ("dm verity: add support for forward error correction")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-verity-fec.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -146,8 +146,6 @@ static int fec_decode_bufs(struct dm_ver
 		block = fec_buffer_rs_block(v, fio, n, i);
 		res = fec_decode_rs8(v, fio, block, &par[offset], neras);
 		if (res < 0) {
-			dm_bufio_release(buf);
-
 			r = res;
 			goto error;
 		}
@@ -172,6 +170,8 @@ static int fec_decode_bufs(struct dm_ver
 done:
 	r = corrected;
 error:
+	dm_bufio_release(buf);
+
 	if (r < 0 && neras)
 		DMERR_LIMIT("%s: FEC %llu: failed to correct: %d",
 			    v->data_dev->name, (unsigned long long)rsb, r);
@@ -269,7 +269,7 @@ static int fec_read_bufs(struct dm_verit
 					  &is_zero) == 0) {
 			/* skip known zero blocks entirely */
 			if (is_zero)
-				continue;
+				goto done;
 
 			/*
 			 * skip if we have already found the theoretical

[toc] | [prev] | [next] | [standalone]

#1620545 — [PATCH 4.9 010/152] staging: android: ashmem: lseek failed due to no FMODE_LSEEK.

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shuxiao Zhang <zhangshuxiao@xiaomi.com>

commit 97fbfef6bd597888485b653175fb846c6998b60c upstream.

vfs_llseek will check whether the file mode has
FMODE_LSEEK, no return failure. But ashmem can be
lseek, so add FMODE_LSEEK to ashmem file.

Comment From Greg Hackmann:
	ashmem_llseek() passes the llseek() call through to the backing
	shmem file.  91360b02ab48 ("ashmem: use vfs_llseek()") changed
	this from directly calling the file's llseek() op into a VFS
	layer call.  This also adds a check for the FMODE_LSEEK bit, so
	without that bit ashmem_llseek() now always fails with -ESPIPE.

Fixes: 91360b02ab48 ("ashmem: use vfs_llseek()")
Signed-off-by: Shuxiao Zhang <zhangshuxiao@xiaomi.com>
Tested-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/android/ashmem.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -405,6 +405,7 @@ static int ashmem_mmap(struct file *file
 			ret = PTR_ERR(vmfile);
 			goto out;
 		}
+		vmfile->f_mode |= FMODE_LSEEK;
 		asma->file = vmfile;
 	}
 	get_file(asma->file);

[toc] | [prev] | [next] | [standalone]

#1620547 — [PATCH 4.9 013/152] kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 8b3405e345b5a098101b0c31b264c812bba045d9 upstream.

In kvm_free_stage2_pgd() we don't hold the kvm->mmu_lock while calling
unmap_stage2_range() on the entire memory range for the guest. This could
cause problems with other callers (e.g, munmap on a memslot) trying to
unmap a range. And since we have to unmap the entire Guest memory range
holding a spinlock, make sure we yield the lock if necessary, after we
unmap each PUD range.

Fixes: commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup")
Cc: Paolo Bonzini <pbonzin@redhat.com>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Christoffer Dall <christoffer.dall@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
[ Avoid vCPU starvation and lockup detector warnings ]
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kvm/mmu.c |   10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -292,11 +292,18 @@ static void unmap_stage2_range(struct kv
 	phys_addr_t addr = start, end = start + size;
 	phys_addr_t next;
 
+	assert_spin_locked(&kvm->mmu_lock);
 	pgd = kvm->arch.pgd + stage2_pgd_index(addr);
 	do {
 		next = stage2_pgd_addr_end(addr, end);
 		if (!stage2_pgd_none(*pgd))
 			unmap_stage2_puds(kvm, pgd, addr, next);
+		/*
+		 * If the range is too large, release the kvm->mmu_lock
+		 * to prevent starvation and lockup detector warnings.
+		 */
+		if (next != end)
+			cond_resched_lock(&kvm->mmu_lock);
 	} while (pgd++, addr = next, addr != end);
 }
 
@@ -831,7 +838,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm
 	if (kvm->arch.pgd == NULL)
 		return;
 
+	spin_lock(&kvm->mmu_lock);
 	unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
+	spin_unlock(&kvm->mmu_lock);
+
 	/* Free the HW pgd, one page at a time */
 	free_pages_exact(kvm->arch.pgd, S2_PGD_SIZE);
 	kvm->arch.pgd = NULL;

[toc] | [prev] | [next] | [standalone]

#1620548 — [PATCH 4.9 009/152] sysfs: be careful of error returns from ops->show()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.com>

commit c8a139d001a1aab1ea8734db14b22dac9dd143b6 upstream.

ops->show() can return a negative error code.
Commit 65da3484d9be ("sysfs: correctly handle short reads on PREALLOC attrs.")
(in v4.4) caused this to be stored in an unsigned 'size_t' variable, so errors
would look like large numbers.
As a result, if an error is returned, sysfs_kf_read() will return the
value of 'count', typically 4096.

Commit 17d0774f8068 ("sysfs: correctly handle read offset on PREALLOC attrs")
(in v4.8) extended this error to use the unsigned large 'len' as a size for
memmove().
Consequently, if ->show returns an error, then the first read() on the
sysfs file will return 4096 and could return uninitialized memory to
user-space.
If the application performs a subsequent read, this will trigger a memmove()
with extremely large count, and is likely to crash the machine is bizarre ways.

This bug can currently only be triggered by reading from an md
sysfs attribute declared with __ATTR_PREALLOC() during the
brief period between when mddev_put() deletes an mddev from
the ->all_mddevs list, and when mddev_delayed_delete() - which is
scheduled on a workqueue - completes.
Before this, an error won't be returned by the ->show()
After this, the ->show() won't be called.

I can reproduce it reliably only by putting delay like
	usleep_range(500000,700000);
early in mddev_delayed_delete(). Then after creating an
md device md0 run
  echo clear > /sys/block/md0/md/array_state; cat /sys/block/md0/md/array_state

The bug can be triggered without the usleep.

Fixes: 65da3484d9be ("sysfs: correctly handle short reads on PREALLOC attrs.")
Fixes: 17d0774f8068 ("sysfs: correctly handle read offset on PREALLOC attrs")
Signed-off-by: NeilBrown <neilb@suse.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Miroslav Benes <mbenes@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/sysfs/file.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -108,7 +108,7 @@ static ssize_t sysfs_kf_read(struct kern
 {
 	const struct sysfs_ops *ops = sysfs_file_ops(of->kn);
 	struct kobject *kobj = of->kn->parent->priv;
-	size_t len;
+	ssize_t len;
 
 	/*
 	 * If buf != of->prealloc_buf, we don't know how
@@ -117,13 +117,15 @@ static ssize_t sysfs_kf_read(struct kern
 	if (WARN_ON_ONCE(buf != of->prealloc_buf))
 		return 0;
 	len = ops->show(kobj, of->kn->priv, buf);
+	if (len < 0)
+		return len;
 	if (pos) {
 		if (len <= pos)
 			return 0;
 		len -= pos;
 		memmove(buf, buf + pos, len);
 	}
-	return min(count, len);
+	return min_t(ssize_t, count, len);
 }
 
 /* kernfs write callback for regular sysfs files */

[toc] | [prev] | [next] | [standalone]

#1620550 — [PATCH 4.9 011/152] arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 90f6e150e44a0dc3883110eeb3ab35d1be42b6bb upstream.

We don't hold the mmap_sem while searching for the VMAs when
we try to unmap each memslot for a VM. Fix this properly to
avoid unexpected results.

Fixes: commit 957db105c997 ("arm/arm64: KVM: Introduce stage2_unmap_vm")
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kvm/mmu.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -803,6 +803,7 @@ void stage2_unmap_vm(struct kvm *kvm)
 	int idx;
 
 	idx = srcu_read_lock(&kvm->srcu);
+	down_read(&current->mm->mmap_sem);
 	spin_lock(&kvm->mmu_lock);
 
 	slots = kvm_memslots(kvm);
@@ -810,6 +811,7 @@ void stage2_unmap_vm(struct kvm *kvm)
 		stage2_unmap_memslot(kvm, memslot);
 
 	spin_unlock(&kvm->mmu_lock);
+	up_read(&current->mm->mmap_sem);
 	srcu_read_unlock(&kvm->srcu, idx);
 }
 

[toc] | [prev] | [next] | [standalone]

#1620553 — [PATCH 4.9 004/152] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Murray McAllister <murray.mcallister@insomniasec.com>

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream.

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -716,8 +716,8 @@ int vmw_surface_define_ioctl(struct drm_
 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 		num_sizes += req->mip_levels[i];
 
-	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
-	    DRM_VMW_MAX_MIP_LEVELS)
+	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
+	    num_sizes == 0)
 		return -EINVAL;
 
 	size = vmw_user_surface_size + 128 +

[toc] | [prev] | [next] | [standalone]

#1620554 — [PATCH 4.9 016/152] cfg80211: check rdev resume callback only for registered wiphy

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arend Van Spriel <arend.vanspriel@broadcom.com>

commit b3ef5520c1eabb56064474043c7c55a1a65b8708 upstream.

We got the following use-after-free KASAN report:

 BUG: KASAN: use-after-free in wiphy_resume+0x591/0x5a0 [cfg80211]
	 at addr ffff8803fc244090
 Read of size 8 by task kworker/u16:24/2587
 CPU: 6 PID: 2587 Comm: kworker/u16:24 Tainted: G    B 4.9.13-debug+
 Hardware name: Dell Inc. XPS 15 9550/0N7TVV, BIOS 1.2.19 12/22/2016
 Workqueue: events_unbound async_run_entry_fn
  ffff880425d4f9d8 ffffffffaeedb541 ffff88042b80ef00 ffff8803fc244088
  ffff880425d4fa00 ffffffffae84d7a1 ffff880425d4fa98 ffff8803fc244080
  ffff88042b80ef00 ffff880425d4fa88 ffffffffae84da3a ffffffffc141f7d9
 Call Trace:
  [<ffffffffaeedb541>] dump_stack+0x85/0xc4
  [<ffffffffae84d7a1>] kasan_object_err+0x21/0x70
  [<ffffffffae84da3a>] kasan_report_error+0x1fa/0x500
  [<ffffffffc141f7d9>] ? cfg80211_bss_age+0x39/0xc0 [cfg80211]
  [<ffffffffc141f83a>] ? cfg80211_bss_age+0x9a/0xc0 [cfg80211]
  [<ffffffffae48d46d>] ? trace_hardirqs_on+0xd/0x10
  [<ffffffffc13fb1c0>] ? wiphy_suspend+0xc70/0xc70 [cfg80211]
  [<ffffffffae84def1>] __asan_report_load8_noabort+0x61/0x70
  [<ffffffffc13fb100>] ? wiphy_suspend+0xbb0/0xc70 [cfg80211]
  [<ffffffffc13fb751>] ? wiphy_resume+0x591/0x5a0 [cfg80211]
  [<ffffffffc13fb751>] wiphy_resume+0x591/0x5a0 [cfg80211]
  [<ffffffffc13fb1c0>] ? wiphy_suspend+0xc70/0xc70 [cfg80211]
  [<ffffffffaf3b206e>] dpm_run_callback+0x6e/0x4f0
  [<ffffffffaf3b31b2>] device_resume+0x1c2/0x670
  [<ffffffffaf3b367d>] async_resume+0x1d/0x50
  [<ffffffffae3ee84e>] async_run_entry_fn+0xfe/0x610
  [<ffffffffae3d0666>] process_one_work+0x716/0x1a50
  [<ffffffffae3d05c9>] ? process_one_work+0x679/0x1a50
  [<ffffffffafdd7b6d>] ? _raw_spin_unlock_irq+0x3d/0x60
  [<ffffffffae3cff50>] ? pwq_dec_nr_in_flight+0x2b0/0x2b0
  [<ffffffffae3d1a80>] worker_thread+0xe0/0x1460
  [<ffffffffae3d19a0>] ? process_one_work+0x1a50/0x1a50
  [<ffffffffae3e54c2>] kthread+0x222/0x2e0
  [<ffffffffae3e52a0>] ? kthread_park+0x80/0x80
  [<ffffffffae3e52a0>] ? kthread_park+0x80/0x80
  [<ffffffffae3e52a0>] ? kthread_park+0x80/0x80
  [<ffffffffafdd86aa>] ret_from_fork+0x2a/0x40
 Object at ffff8803fc244088, in cache kmalloc-1024 size: 1024
 Allocated:
 PID = 71
  save_stack_trace+0x1b/0x20
  save_stack+0x46/0xd0
  kasan_kmalloc+0xad/0xe0
  kasan_slab_alloc+0x12/0x20
  __kmalloc_track_caller+0x134/0x360
  kmemdup+0x20/0x50
  brcmf_cfg80211_attach+0x10b/0x3a90 [brcmfmac]
  brcmf_bus_start+0x19a/0x9a0 [brcmfmac]
  brcmf_pcie_setup+0x1f1a/0x3680 [brcmfmac]
  brcmf_fw_request_nvram_done+0x44c/0x11b0 [brcmfmac]
  request_firmware_work_func+0x135/0x280
  process_one_work+0x716/0x1a50
  worker_thread+0xe0/0x1460
  kthread+0x222/0x2e0
  ret_from_fork+0x2a/0x40
 Freed:
 PID = 2568
  save_stack_trace+0x1b/0x20
  save_stack+0x46/0xd0
  kasan_slab_free+0x71/0xb0
  kfree+0xe8/0x2e0
  brcmf_cfg80211_detach+0x62/0xf0 [brcmfmac]
  brcmf_detach+0x14a/0x2b0 [brcmfmac]
  brcmf_pcie_remove+0x140/0x5d0 [brcmfmac]
  brcmf_pcie_pm_leave_D3+0x198/0x2e0 [brcmfmac]
  pci_pm_resume+0x186/0x220
  dpm_run_callback+0x6e/0x4f0
  device_resume+0x1c2/0x670
  async_resume+0x1d/0x50
  async_run_entry_fn+0xfe/0x610
  process_one_work+0x716/0x1a50
  worker_thread+0xe0/0x1460
  kthread+0x222/0x2e0
  ret_from_fork+0x2a/0x40
 Memory state around the buggy address:
  ffff8803fc243f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
  ffff8803fc244000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 >ffff8803fc244080: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                          ^
  ffff8803fc244100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8803fc244180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

What is happening is that brcmf_pcie_resume() detects a device that
is no longer responsive and it decides to unbind resulting in a
wiphy_unregister() and wiphy_free() call. Now the wiphy instance
remains allocated, because PM needs to call wiphy_resume() for it.
However, brcmfmac already does a kfree() for the struct
cfg80211_registered_device::ops field. Change the checks in
wiphy_resume() to only access the struct cfg80211_registered_device::ops
if the wiphy instance is still registered at this time.

Reported-by: Daniel J Blueman <daniel@quora.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/wireless/sysfs.c |   10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -130,12 +130,10 @@ static int wiphy_resume(struct device *d
 	/* Age scan results with time spent in suspend */
 	cfg80211_bss_age(rdev, get_seconds() - rdev->suspend_at);
 
-	if (rdev->ops->resume) {
-		rtnl_lock();
-		if (rdev->wiphy.registered)
-			ret = rdev_resume(rdev);
-		rtnl_unlock();
-	}
+	rtnl_lock();
+	if (rdev->wiphy.registered && rdev->ops->resume)
+		ret = rdev_resume(rdev);
+	rtnl_unlock();
 
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]

#1620559 — [PATCH 4.9 017/152] Reset TreeId to zero on SMB2 TREE_CONNECT

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan-Marek Glogowski <glogow@fbihome.de>

commit 806a28efe9b78ffae5e2757e1ee924b8e50c08ab upstream.

Currently the cifs module breaks the CIFS specs on reconnect as
described in http://msdn.microsoft.com/en-us/library/cc246529.aspx:

"TreeId (4 bytes): Uniquely identifies the tree connect for the
command. This MUST be 0 for the SMB2 TREE_CONNECT Request."

Signed-off-by: Jan-Marek Glogowski <glogow@fbihome.de>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Tested-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/smb2pdu.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1104,6 +1104,10 @@ SMB2_tcon(const unsigned int xid, struct
 		return -EINVAL;
 	}
 
+	/* SMB2 TREE_CONNECT request must be called with TreeId == 0 */
+	if (tcon)
+		tcon->tid = 0;
+
 	rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req);
 	if (rc) {
 		kfree(unc_path);

[toc] | [prev] | [next] | [standalone]

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

Back to top | Article view | linux.kernel

csiph-web