Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1626229 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-04-19 16:50 +0200 |
| Last post | 2017-04-20 01:30 +0200 |
| Articles | 20 on this page of 47 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 4.9 00/69] 4.9.24-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 48/69] crypto: algif_aead - Fix bogus request dereference in completion function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 53/69] ext4: fix inode checksum calculation problem if i_extra_size is small Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 58/69] ASoC: Intel: select DW_DMAC_CORE since its mandatory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 36/69] libnvdimm: fix blk free space accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 64/69] [media] dvb-usb: dont use stack for firmware load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 13/69] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 16:50 +0200
[PATCH 4.9 52/69] [media] dvb-usb-v2: avoid use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 29/69] scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 50/69] parisc: Fix get_user() for 64-bit value on 32-bit kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 46/69] zram: do not use copy_page with non-page aligned address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 56/69] nbd: use loff_t for blocksize and nbd_set_size args Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 43/69] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 41/69] irqchip/irq-imx-gpcv2: Fix spinlock initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 03/69] tcmu: Fix wrongly calculating of the base_command_size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 47/69] ftrace: Fix function pid filter on instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 57/69] nbd: fix 64-bit division Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 37/69] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 44/69] Revert "MIPS: Lantiq: Fix cascaded IRQ setup" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 55/69] drm/nouveau/disp/mcp7x: disable dptmds workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 49/69] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 45/69] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 54/69] mm: memcontrol: use special workqueue for creating per-memcg caches Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 05/69] thp: fix MADV_DONTNEED vs. MADV_FREE race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 30/69] scsi: qla2xxx: Add fix to read correct register value for ISP82xx. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:00 +0200
[PATCH 4.9 39/69] pwm: rockchip: State of PWM clock should synchronize with PWM enabled state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 24/69] efi/libstub: Skip GOP with PIXEL_BLT_ONLY format Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 04/69] tcmu: Skip Data-Out blocks before gathering Data-In buffer for BIDI case Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 08/69] orangefs: free superblock when mount fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 16/69] x86/efi: Dont try to reserve runtime regions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 10/69] drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 21/69] acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 15/69] perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 17/69] x86/signals: Fix lower/upper bound reporting in compat siginfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 19/69] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 26/69] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 20/69] x86/vdso: Plug race between mapping and ELF header setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 22/69] ACPI / scan: Set the visited flag for all enumerated devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 07/69] zsmalloc: expand class bit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 06/69] thp: fix MADV_DONTNEED vs clear soft dirty race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 28/69] scsi: sr: Sanity check returned mode data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 09/69] drm/nouveau/mpeg: mthd returns true on success now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 38/69] can: ifi: use correct register to read rx status Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 12/69] CIFS: reconnect thread reschedule itself Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
[PATCH 4.9 25/69] efi/fb: Avoid reconfiguration of BAR that covers the framebuffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-19 17:20 +0200
Re: [PATCH 4.9 00/69] 4.9.24-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-04-19 22:40 +0200
Re: [PATCH 4.9 00/69] 4.9.24-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-20 01:30 +0200
Page 1 of 3 [1] 2 3 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 00/69] 4.9.24-stable review |
| Message-ID | <txZ5D-4CC-3@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.9.24 release.
There are 69 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Apr 21 14:16:02 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.24-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.9.24-rc1
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
sctp: deny peeloff operation on asocs with threads sleeping on it
Mantas M <grawity@gmail.com>
net: ipv6: check route protocol when deleting routes
Omar Sandoval <osandov@fb.com>
virtio-console: avoid DMA from stack
Stefan Brüns <stefan.bruens@rwth-aachen.de>
cxusb: Use a dma capable buffer also for reading
Stefan Brüns <stefan.bruens@rwth-aachen.de>
dvb-usb-firmware: don't do DMA on stack
Mauro Carvalho Chehab <mchehab@kernel.org>
dvb-usb: don't use stack for firmware load
Kees Cook <keescook@chromium.org>
mm: Tighten x86 /dev/mem with zeroing reads
Thierry Reding <treding@nvidia.com>
rtc: tegra: Implement clock handling
Lv Zheng <lv.zheng@intel.com>
ACPI / EC: Use busy polling mode when GPE is not enabled
Mohit Gambhir <mohit.gambhir@oracle.com>
x86/xen: Fix APIC id mismatch warning on Intel
Lee, Chun-Yi <joeyli.kernel@gmail.com>
platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
ASoC: Intel: select DW_DMAC_CORE since it's mandatory
Jens Axboe <axboe@fb.com>
nbd: fix 64-bit division
Josef Bacik <jbacik@fb.com>
nbd: use loff_t for blocksize and nbd_set_size args
Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/disp/mcp7x: disable dptmds workaround
Vladimir Davydov <vdavydov.dev@gmail.com>
mm: memcontrol: use special workqueue for creating per-memcg caches
Daeho Jeong <daeho.jeong@samsung.com>
ext4: fix inode checksum calculation problem if i_extra_size is small
Arnd Bergmann <arnd@arndb.de>
dvb-usb-v2: avoid use-after-free
Miaoqing Pan <miaoqing@codeaurora.org>
ath9k: fix NULL pointer dereference
Helge Deller <deller@gmx.de>
parisc: Fix get_user() for 64-bit value on 32-bit kernel
Herbert Xu <herbert@gondor.apana.org.au>
crypto: ahash - Fix EINPROGRESS notification callback
Herbert Xu <herbert@gondor.apana.org.au>
crypto: algif_aead - Fix bogus request dereference in completion function
Namhyung Kim <namhyung@kernel.org>
ftrace: Fix function pid filter on instances
Minchan Kim <minchan@kernel.org>
zram: do not use copy_page with non-page aligned address
Paolo Bonzini <pbonzini@redhat.com>
kvm: fix page struct leak in handle_vmon
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "MIPS: Lantiq: Fix cascaded IRQ setup"
Max Bires <jbires@google.com>
char: lack of bool string made CONFIG_DEVPORT always on
Steven Rostedt (VMware) <rostedt@goodmis.org>
ftrace: Fix removing of second function probe
Tyler Baker <tyler.baker@linaro.org>
irqchip/irq-imx-gpcv2: Fix spinlock initialization
Chen Yu <yu.c.chen@intel.com>
cpufreq: Bring CPUs up even if cpufreq_online() failed
David Wu <david.wu@rock-chips.com>
pwm: rockchip: State of PWM clock should synchronize with PWM enabled state
Markus Marb <markus@marb.org>
can: ifi: use correct register to read rx status
Dan Williams <dan.j.williams@intel.com>
libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat
Dan Williams <dan.j.williams@intel.com>
libnvdimm: fix blk free space accounting
Al Viro <viro@zeniv.linux.org.uk>
make skb_copy_datagram_msg() et.al. preserve ->msg_iter on error
Al Viro <viro@zeniv.linux.org.uk>
new privimitive: iov_iter_revert()
Juergen Gross <jgross@suse.com>
xen, fbfront: fix connecting to backend
Nicholas Bellinger <nab@linux-iscsi.org>
target: Avoid mappedlun symlink creation during lun shutdown
Martin K. Petersen <martin.petersen@oracle.com>
scsi: sd: Fix capacity calculation with 32-bit sector_t
Sawan Chandak <sawan.chandak@cavium.com>
scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
Fam Zheng <famz@redhat.com>
scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
Martin K. Petersen <martin.petersen@oracle.com>
scsi: sr: Sanity check returned mode data
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Drop work-around for legacy GlobalSAN initiator
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix TMR reference leak during session shutdown
Ard Biesheuvel <ard.biesheuvel@linaro.org>
efi/fb: Avoid reconfiguration of BAR that covers the framebuffer
Cohen, Eugene <eugene@hp.com>
efi/libstub: Skip GOP with PIXEL_BLT_ONLY format
Mikulas Patocka <mpatocka@redhat.com>
parisc: fix bugs in pa_memcpy
Rafael J. Wysocki <rafael.j.wysocki@intel.com>
ACPI / scan: Set the visited flag for all enumerated devices
Dan Williams <dan.j.williams@intel.com>
acpi, nfit, libnvdimm: fix interleave set cookie calculation (64-bit comparison)
Thomas Gleixner <tglx@linutronix.de>
x86/vdso: Plug race between mapping and ELF header setup
Mathias Krause <minipli@googlemail.com>
x86/vdso: Ensure vdso32_enabled gets set to valid values only
Dan Williams <dan.j.williams@intel.com>
x86, pmem: fix broken __copy_user_nocache cache-bypass assumptions
Joerg Roedel <jroedel@suse.de>
x86/signals: Fix lower/upper bound reporting in compat siginfo
Omar Sandoval <osandov@fb.com>
x86/efi: Don't try to reserve runtime regions
Peter Zijlstra <peterz@infradead.org>
perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
Cameron Gutman <aicommander@gmail.com>
Input: xpad - add support for Razer Wildcat gamepad
Germano Percossi <germano.percossi@citrix.com>
CIFS: store results of cifs_reopen_file to avoid infinite wait
Germano Percossi <germano.percossi@citrix.com>
CIFS: reconnect thread reschedule itself
Wei Yongjun <weiyongjun1@huawei.com>
drm/etnaviv: fix missing unlock on error in etnaviv_gpu_submit()
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one
Ilia Mirkin <imirkin@alum.mit.edu>
drm/nouveau/mpeg: mthd returns true on success now
Martin Brandenburg <martin@omnibond.com>
orangefs: free superblock when mount fails
Minchan Kim <minchan@kernel.org>
zsmalloc: expand class bit
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
thp: fix MADV_DONTNEED vs clear soft dirty race
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
thp: fix MADV_DONTNEED vs. MADV_FREE race
Xiubo Li <lixiubo@cmss.chinamobile.com>
tcmu: Skip Data-Out blocks before gathering Data-In buffer for BIDI case
Xiubo Li <lixiubo@cmss.chinamobile.com>
tcmu: Fix wrongly calculating of the base_command_size
Xiubo Li <lixiubo@cmss.chinamobile.com>
tcmu: Fix possible overwrite of t_data_sg's last iov[]
Tejun Heo <tj@kernel.org>
cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
-------------
Diffstat:
Makefile | 4 +-
arch/mips/lantiq/irq.c | 38 +++++-----
arch/parisc/include/asm/uaccess.h | 86 +++++++++++++--------
arch/parisc/lib/lusercopy.S | 27 +++----
arch/x86/entry/vdso/vdso32-setup.c | 11 ++-
arch/x86/events/intel/lbr.c | 3 +
arch/x86/include/asm/elf.h | 2 +-
arch/x86/include/asm/pmem.h | 42 ++++++++---
arch/x86/kernel/signal_compat.c | 4 +-
arch/x86/kvm/vmx.c | 10 ++-
arch/x86/mm/init.c | 41 +++++++---
arch/x86/platform/efi/quirks.c | 4 +
arch/x86/xen/apic.c | 2 +-
crypto/ahash.c | 79 ++++++++++++-------
crypto/algif_aead.c | 12 +--
drivers/acpi/ec.c | 62 ++++++++-------
drivers/acpi/internal.h | 4 +-
drivers/acpi/nfit/core.c | 6 +-
drivers/acpi/scan.c | 19 +++--
drivers/block/nbd.c | 10 +--
drivers/block/zram/zram_drv.c | 6 +-
drivers/char/Kconfig | 5 +-
drivers/char/mem.c | 82 ++++++++++++--------
drivers/char/virtio_console.c | 12 ++-
drivers/cpufreq/cpufreq.c | 18 ++++-
drivers/firmware/efi/libstub/gop.c | 6 +-
drivers/gpu/drm/etnaviv/etnaviv_gpu.c | 3 +-
drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 2 -
drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c | 2 +-
drivers/input/joystick/xpad.c | 2 +
drivers/irqchip/irq-imx-gpcv2.c | 2 +
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 9 ++-
drivers/media/usb/dvb-usb/cxusb.c | 15 ++--
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 33 +++++---
drivers/net/can/ifi_canfd/ifi_canfd.c | 2 +-
drivers/net/wireless/ath/ath9k/common-spectral.c | 8 +-
drivers/nvdimm/bus.c | 6 ++
drivers/nvdimm/dimm_devs.c | 77 +++----------------
drivers/platform/x86/acer-wmi.c | 22 +++++-
drivers/pwm/pwm-rockchip.c | 40 ++++++++--
drivers/rtc/rtc-tegra.c | 28 ++++++-
drivers/scsi/qla2xxx/qla_os.c | 7 +-
drivers/scsi/sd.c | 23 +++++-
drivers/scsi/sr.c | 6 +-
drivers/target/iscsi/iscsi_target_parameters.c | 16 ----
drivers/target/iscsi/iscsi_target_util.c | 12 +--
drivers/target/target_core_fabric_configfs.c | 5 ++
drivers/target/target_core_tpg.c | 4 +
drivers/target/target_core_user.c | 92 ++++++++++++++++-------
drivers/video/fbdev/efifb.c | 66 +++++++++++++++-
drivers/video/fbdev/xen-fbfront.c | 4 +-
fs/cifs/file.c | 6 +-
fs/cifs/smb2pdu.c | 10 ++-
fs/ext4/inode.c | 5 +-
fs/orangefs/devorangefs-req.c | 9 ++-
fs/orangefs/orangefs-kernel.h | 1 +
fs/orangefs/super.c | 23 ++++--
fs/proc/task_mmu.c | 9 ++-
include/crypto/internal/hash.h | 10 +++
include/linux/cgroup.h | 21 ++++++
include/linux/sched.h | 4 +
include/linux/uio.h | 6 +-
include/target/target_core_base.h | 1 +
kernel/cgroup.c | 9 ++-
kernel/kthread.c | 3 +
kernel/trace/ftrace.c | 29 ++++++-
kernel/trace/trace.c | 1 +
kernel/trace/trace.h | 2 +
lib/iov_iter.c | 63 ++++++++++++++++
mm/huge_memory.c | 3 +-
mm/memcontrol.c | 15 +++-
mm/zsmalloc.c | 2 +-
net/core/datagram.c | 23 +++---
net/ipv6/route.c | 2 +
net/sctp/socket.c | 8 +-
sound/soc/intel/Kconfig | 31 ++++----
78 files changed, 939 insertions(+), 442 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 48/69] crypto: algif_aead - Fix bogus request dereference in completion function |
| Message-ID | <txZ5G-4CC-85@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit e6534aebb26e32fbab14df9c713c65e8507d17e4 upstream.
The algif_aead completion function tries to deduce the aead_request
from the crypto_async_request argument. This is broken because
the API does not guarantee that the same request will be pased to
the completion function. Only the value of req->data can be used
in the completion function.
This patch fixes it by storing a pointer to sk in areq and using
that instead of passing in sk through req->data.
Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/algif_aead.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -39,6 +39,7 @@ struct aead_async_req {
struct aead_async_rsgl first_rsgl;
struct list_head list;
struct kiocb *iocb;
+ struct sock *sk;
unsigned int tsgls;
char iv[];
};
@@ -379,12 +380,10 @@ unlock:
static void aead_async_cb(struct crypto_async_request *_req, int err)
{
- struct sock *sk = _req->data;
- struct alg_sock *ask = alg_sk(sk);
- struct aead_ctx *ctx = ask->private;
- struct crypto_aead *tfm = crypto_aead_reqtfm(&ctx->aead_req);
- struct aead_request *req = aead_request_cast(_req);
+ struct aead_request *req = _req->data;
+ struct crypto_aead *tfm = crypto_aead_reqtfm(req);
struct aead_async_req *areq = GET_ASYM_REQ(req, tfm);
+ struct sock *sk = areq->sk;
struct scatterlist *sg = areq->tsgl;
struct aead_async_rsgl *rsgl;
struct kiocb *iocb = areq->iocb;
@@ -447,11 +446,12 @@ static int aead_recvmsg_async(struct soc
memset(&areq->first_rsgl, '\0', sizeof(areq->first_rsgl));
INIT_LIST_HEAD(&areq->list);
areq->iocb = msg->msg_iocb;
+ areq->sk = sk;
memcpy(areq->iv, ctx->iv, crypto_aead_ivsize(tfm));
aead_request_set_tfm(req, tfm);
aead_request_set_ad(req, ctx->aead_assoclen);
aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
- aead_async_cb, sk);
+ aead_async_cb, req);
used -= ctx->aead_assoclen;
/* take over all tx sgls from ctx */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 53/69] ext4: fix inode checksum calculation problem if i_extra_size is small |
| Message-ID | <txZ5G-4CC-81@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daeho.jeong@samsung.com>
commit 05ac5aa18abd7db341e54df4ae2b4c98ea0e43b7 upstream.
We've fixed the race condition problem in calculating ext4 checksum
value in commit b47820edd163 ("ext4: avoid modifying checksum fields
directly during checksum veficationon"). However, by this change,
when calculating the checksum value of inode whose i_extra_size is
less than 4, we couldn't calculate the checksum value in a proper way.
This problem was found and reported by Nix, Thank you.
Reported-by: Nix <nix@esperi.org.uk>
Signed-off-by: Daeho Jeong <daeho.jeong@samsung.com>
Signed-off-by: Youngjin Gil <youngjin.gil@samsung.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -71,10 +71,9 @@ static __u32 ext4_inode_csum(struct inod
csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum,
csum_size);
offset += csum_size;
- csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
- EXT4_INODE_SIZE(inode->i_sb) -
- offset);
}
+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset,
+ EXT4_INODE_SIZE(inode->i_sb) - offset);
}
return csum;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 58/69] ASoC: Intel: select DW_DMAC_CORE since its mandatory |
| Message-ID | <txZ5H-4CC-99@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andy Shevchenko <andriy.shevchenko@linux.intel.com> commit ebf79091bf85d9b2270ab29191de9cd3aaf888c5 upstream. Select DW_DMAC_CORE like the rest of glue drivers do, e.g. drivers/dma/dw/Kconfig. While here group selectors under SND_SOC_INTEL_HASWELL and SND_SOC_INTEL_BAYTRAIL. Make platforms, which are using a common SST firmware driver, to be dependent on DMADEVICES. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Acked-by: Liam Girdwood <liam.r.girdwood@linux.intel.com> Signed-off-by: Mark Brown <broonie@kernel.org> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- sound/soc/intel/Kconfig | 31 +++++++++++++------------------ 1 file changed, 13 insertions(+), 18 deletions(-) --- a/sound/soc/intel/Kconfig +++ b/sound/soc/intel/Kconfig @@ -33,11 +33,9 @@ config SND_SOC_INTEL_SST select SND_SOC_INTEL_SST_MATCH if ACPI depends on (X86 || COMPILE_TEST) -# firmware stuff depends DW_DMAC_CORE; since there is no depends-on from -# the reverse selection, each machine driver needs to select -# SND_SOC_INTEL_SST_FIRMWARE carefully depending on DW_DMAC_CORE config SND_SOC_INTEL_SST_FIRMWARE tristate + select DW_DMAC_CORE config SND_SOC_INTEL_SST_ACPI tristate @@ -47,16 +45,18 @@ config SND_SOC_INTEL_SST_MATCH config SND_SOC_INTEL_HASWELL tristate + select SND_SOC_INTEL_SST select SND_SOC_INTEL_SST_FIRMWARE config SND_SOC_INTEL_BAYTRAIL tristate + select SND_SOC_INTEL_SST + select SND_SOC_INTEL_SST_FIRMWARE config SND_SOC_INTEL_HASWELL_MACH tristate "ASoC Audio DSP support for Intel Haswell Lynxpoint" depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM - depends on DW_DMAC_CORE - select SND_SOC_INTEL_SST + depends on DMADEVICES select SND_SOC_INTEL_HASWELL select SND_SOC_RT5640 help @@ -99,9 +99,8 @@ config SND_SOC_INTEL_BXT_RT298_MACH config SND_SOC_INTEL_BYT_RT5640_MACH tristate "ASoC Audio driver for Intel Baytrail with RT5640 codec" depends on X86_INTEL_LPSS && I2C - depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n) - select SND_SOC_INTEL_SST - select SND_SOC_INTEL_SST_FIRMWARE + depends on DMADEVICES + depends on SND_SST_IPC_ACPI = n select SND_SOC_INTEL_BAYTRAIL select SND_SOC_RT5640 help @@ -112,9 +111,8 @@ config SND_SOC_INTEL_BYT_RT5640_MACH config SND_SOC_INTEL_BYT_MAX98090_MACH tristate "ASoC Audio driver for Intel Baytrail with MAX98090 codec" depends on X86_INTEL_LPSS && I2C - depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n) - select SND_SOC_INTEL_SST - select SND_SOC_INTEL_SST_FIRMWARE + depends on DMADEVICES + depends on SND_SST_IPC_ACPI = n select SND_SOC_INTEL_BAYTRAIL select SND_SOC_MAX98090 help @@ -123,9 +121,8 @@ config SND_SOC_INTEL_BYT_MAX98090_MACH config SND_SOC_INTEL_BDW_RT5677_MACH tristate "ASoC Audio driver for Intel Broadwell with RT5677 codec" - depends on X86_INTEL_LPSS && GPIOLIB && I2C && DW_DMAC - depends on DW_DMAC_CORE=y - select SND_SOC_INTEL_SST + depends on X86_INTEL_LPSS && GPIOLIB && I2C + depends on DMADEVICES select SND_SOC_INTEL_HASWELL select SND_SOC_RT5677 help @@ -134,10 +131,8 @@ config SND_SOC_INTEL_BDW_RT5677_MACH config SND_SOC_INTEL_BROADWELL_MACH tristate "ASoC Audio DSP support for Intel Broadwell Wildcatpoint" - depends on X86_INTEL_LPSS && I2C && DW_DMAC && \ - I2C_DESIGNWARE_PLATFORM - depends on DW_DMAC_CORE - select SND_SOC_INTEL_SST + depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM + depends on DMADEVICES select SND_SOC_INTEL_HASWELL select SND_SOC_RT286 help
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 36/69] libnvdimm: fix blk free space accounting |
| Message-ID | <txZ5H-4CC-101@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit fe514739d8538783749d3ce72f78e5a999ea5668 upstream.
Commit a1f3e4d6a0c3 "libnvdimm, region: update nd_region_available_dpa()
for multi-pmem support" reworked blk dpa (DIMM Physical Address)
accounting to comprehend multiple pmem namespace allocations aliasing
with a given blk-dpa range.
The following call trace is a result of failing to account for allocated
blk capacity.
WARNING: CPU: 1 PID: 2433 at tools/testing/nvdimm/../../../drivers/nvdimm/names
4 size_store+0x6f3/0x930 [libnvdimm]
nd_region region5: allocation underrun: 0x0 of 0x1000000 bytes
[..]
Call Trace:
dump_stack+0x86/0xc3
__warn+0xcb/0xf0
warn_slowpath_fmt+0x5f/0x80
size_store+0x6f3/0x930 [libnvdimm]
dev_attr_store+0x18/0x30
If a given blk-dpa allocation does not alias with any pmem ranges then
the full allocation should be accounted as busy space, not the size of
the current pmem contribution to the region.
The thinkos that led to this confusion was not realizing that the struct
resource management is already guaranteeing no collisions between pmem
allocations and blk allocations on the same dimm. Also, we do not try to
support blk allocations in aliased pmem holes.
This patch also fixes a case where the available blk goes negative.
Fixes: a1f3e4d6a0c3 ("libnvdimm, region: update nd_region_available_dpa() for multi-pmem support").
Reported-by: Dariusz Dokupil <dariusz.dokupil@intel.com>
Reported-by: Dave Jiang <dave.jiang@intel.com>
Reported-by: Vishal Verma <vishal.l.verma@intel.com>
Tested-by: Dave Jiang <dave.jiang@intel.com>
Tested-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/dimm_devs.c | 77 ++++++---------------------------------------
1 file changed, 11 insertions(+), 66 deletions(-)
--- a/drivers/nvdimm/dimm_devs.c
+++ b/drivers/nvdimm/dimm_devs.c
@@ -388,7 +388,7 @@ EXPORT_SYMBOL_GPL(nvdimm_create);
int alias_dpa_busy(struct device *dev, void *data)
{
- resource_size_t map_end, blk_start, new, busy;
+ resource_size_t map_end, blk_start, new;
struct blk_alloc_info *info = data;
struct nd_mapping *nd_mapping;
struct nd_region *nd_region;
@@ -429,29 +429,19 @@ int alias_dpa_busy(struct device *dev, v
retry:
/*
* Find the free dpa from the end of the last pmem allocation to
- * the end of the interleave-set mapping that is not already
- * covered by a blk allocation.
+ * the end of the interleave-set mapping.
*/
- busy = 0;
for_each_dpa_resource(ndd, res) {
+ if (strncmp(res->name, "pmem", 4) != 0)
+ continue;
if ((res->start >= blk_start && res->start < map_end)
|| (res->end >= blk_start
&& res->end <= map_end)) {
- if (strncmp(res->name, "pmem", 4) == 0) {
- new = max(blk_start, min(map_end + 1,
- res->end + 1));
- if (new != blk_start) {
- blk_start = new;
- goto retry;
- }
- } else
- busy += min(map_end, res->end)
- - max(nd_mapping->start, res->start) + 1;
- } else if (nd_mapping->start > res->start
- && map_end < res->end) {
- /* total eclipse of the PMEM region mapping */
- busy += nd_mapping->size;
- break;
+ new = max(blk_start, min(map_end + 1, res->end + 1));
+ if (new != blk_start) {
+ blk_start = new;
+ goto retry;
+ }
}
}
@@ -463,52 +453,11 @@ int alias_dpa_busy(struct device *dev, v
return 1;
}
- info->available -= blk_start - nd_mapping->start + busy;
+ info->available -= blk_start - nd_mapping->start;
return 0;
}
-static int blk_dpa_busy(struct device *dev, void *data)
-{
- struct blk_alloc_info *info = data;
- struct nd_mapping *nd_mapping;
- struct nd_region *nd_region;
- resource_size_t map_end;
- int i;
-
- if (!is_nd_pmem(dev))
- return 0;
-
- nd_region = to_nd_region(dev);
- for (i = 0; i < nd_region->ndr_mappings; i++) {
- nd_mapping = &nd_region->mapping[i];
- if (nd_mapping->nvdimm == info->nd_mapping->nvdimm)
- break;
- }
-
- if (i >= nd_region->ndr_mappings)
- return 0;
-
- map_end = nd_mapping->start + nd_mapping->size - 1;
- if (info->res->start >= nd_mapping->start
- && info->res->start < map_end) {
- if (info->res->end <= map_end) {
- info->busy = 0;
- return 1;
- } else {
- info->busy -= info->res->end - map_end;
- return 0;
- }
- } else if (info->res->end >= nd_mapping->start
- && info->res->end <= map_end) {
- info->busy -= nd_mapping->start - info->res->start;
- return 0;
- } else {
- info->busy -= nd_mapping->size;
- return 0;
- }
-}
-
/**
* nd_blk_available_dpa - account the unused dpa of BLK region
* @nd_mapping: container of dpa-resource-root + labels
@@ -538,11 +487,7 @@ resource_size_t nd_blk_available_dpa(str
for_each_dpa_resource(ndd, res) {
if (strncmp(res->name, "blk", 3) != 0)
continue;
-
- info.res = res;
- info.busy = resource_size(res);
- device_for_each_child(&nvdimm_bus->dev, &info, blk_dpa_busy);
- info.available -= info.busy;
+ info.available -= resource_size(res);
}
return info.available;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 64/69] [media] dvb-usb: dont use stack for firmware load |
| Message-ID | <txZ5H-4CC-95@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
commit 43fab9793c1f44e665b4f98035a14942edf03ddc upstream.
As reported by Marc Duponcheel <marc@offline.be>, firmware load on
dvb-usb is using the stack, with is not allowed anymore on default
Kernel configurations:
[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware
[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 1025.958855] dvb-usb: could not stop the USB controller CPU.
[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3)
[ 1025.958856] dvb-usb: firmware download failed at 8 with -22
[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u
[ 2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw'
[ 2.789905] ------------[ cut here ]------------
[ 2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[ 2.789912] transfer buffer not dma capable
[ 2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod
[ 2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1
[ 2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013
[ 2.789938] ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000
[ 2.789939] ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000
[ 2.789941] 0000000000000000 0000000000000000 0000000000000001 ffff880116c08000
[ 2.789942] Call Trace:
[ 2.789945] [<ffffffff812bd397>] dump_stack+0x4d/0x66
[ 2.789947] [<ffffffff81055c86>] __warn+0xc6/0xe0
[ 2.789948] [<ffffffff81055cea>] warn_slowpath_fmt+0x4a/0x50
[ 2.789952] [<ffffffffa006d460>] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore]
[ 2.789954] [<ffffffff814ed5a8>] ? io_schedule_timeout+0xd8/0x110
[ 2.789956] [<ffffffffa006e09c>] usb_hcd_submit_urb+0x9c/0x980 [usbcore]
[ 2.789958] [<ffffffff812d0ebf>] ? copy_page_to_iter+0x14f/0x2b0
[ 2.789960] [<ffffffff81126818>] ? pagecache_get_page+0x28/0x240
[ 2.789962] [<ffffffff8118c2a0>] ? touch_atime+0x20/0xa0
[ 2.789964] [<ffffffffa006f7c4>] usb_submit_urb+0x2c4/0x520 [usbcore]
[ 2.789967] [<ffffffffa006feca>] usb_start_wait_urb+0x5a/0xe0 [usbcore]
[ 2.789969] [<ffffffffa007000c>] usb_control_msg+0xbc/0xf0 [usbcore]
[ 2.789970] [<ffffffffa067903d>] usb_cypress_writemem+0x3d/0x40 [dvb_usb]
[ 2.789972] [<ffffffffa06791cf>] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb]
[ 2.789973] [<ffffffff8109dbbe>] ? console_unlock+0x2fe/0x5d0
[ 2.789974] [<ffffffff8109e10c>] ? vprintk_emit+0x27c/0x410
[ 2.789975] [<ffffffff8109e40a>] ? vprintk_default+0x1a/0x20
[ 2.789976] [<ffffffff81124d76>] ? printk+0x43/0x4b
[ 2.789977] [<ffffffffa0679310>] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb]
[ 2.789979] [<ffffffffa0679898>] dvb_usb_device_init+0x3d8/0x610 [dvb_usb]
[ 2.789981] [<ffffffffa069e302>] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u]
[ 2.789984] [<ffffffffa007420c>] usb_probe_interface+0xfc/0x270 [usbcore]
[ 2.789985] [<ffffffff8138bf95>] driver_probe_device+0x215/0x2d0
[ 2.789986] [<ffffffff8138c0e6>] __driver_attach+0x96/0xa0
[ 2.789987] [<ffffffff8138c050>] ? driver_probe_device+0x2d0/0x2d0
[ 2.789988] [<ffffffff81389ffb>] bus_for_each_dev+0x5b/0x90
[ 2.789989] [<ffffffff8138b7b9>] driver_attach+0x19/0x20
[ 2.789990] [<ffffffff8138b33c>] bus_add_driver+0x11c/0x220
[ 2.789991] [<ffffffff8138c91b>] driver_register+0x5b/0xd0
[ 2.789994] [<ffffffffa0072f6c>] usb_register_driver+0x7c/0x130 [usbcore]
[ 2.789994] [<ffffffffa06a5000>] ? 0xffffffffa06a5000
[ 2.789996] [<ffffffffa06a501e>] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u]
[ 2.789997] [<ffffffff81000408>] do_one_initcall+0x38/0x140
[ 2.789998] [<ffffffff8116001c>] ? __vunmap+0x7c/0xc0
[ 2.789999] [<ffffffff81124fb0>] ? do_init_module+0x22/0x1d2
[ 2.790000] [<ffffffff81124fe8>] do_init_module+0x5a/0x1d2
[ 2.790002] [<ffffffff810c96b1>] load_module+0x1e11/0x2580
[ 2.790003] [<ffffffff810c68b0>] ? show_taint+0x30/0x30
[ 2.790004] [<ffffffff81177250>] ? kernel_read_file+0x100/0x190
[ 2.790005] [<ffffffff810c9ffa>] SyS_finit_module+0xba/0xc0
[ 2.790007] [<ffffffff814f13e0>] entry_SYSCALL_64_fastpath+0x13/0x94
[ 2.790008] ---[ end trace c78a74e78baec6fc ]---
So, allocate the structure dynamically.
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -35,29 +35,34 @@ static int usb_cypress_writemem(struct u
int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
{
- struct hexline hx;
+ struct hexline *hx;
u8 reset;
int ret,pos=0;
+ hx = kmalloc(sizeof(*hx), GFP_KERNEL);
+ if (!hx)
+ return -ENOMEM;
+
/* stop the CPU */
reset = 1;
if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
err("could not stop the USB controller CPU.");
- while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
- deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
- ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
+ while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
+ deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n", hx->addr, hx->len, hx->chk);
+ ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len);
- if (ret != hx.len) {
+ if (ret != hx->len) {
err("error while transferring firmware "
"(transferred size: %d, block size: %d)",
- ret,hx.len);
+ ret, hx->len);
ret = -EINVAL;
break;
}
}
if (ret < 0) {
err("firmware download failed at %d with %d",pos,ret);
+ kfree(hx);
return ret;
}
@@ -71,6 +76,8 @@ int usb_cypress_load_firmware(struct usb
} else
ret = -EIO;
+ kfree(hx);
+
return ret;
}
EXPORT_SYMBOL(usb_cypress_load_firmware);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 16:50 +0200 |
| Subject | [PATCH 4.9 13/69] CIFS: store results of cifs_reopen_file to avoid infinite wait |
| Message-ID | <txZ5H-4CC-97@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Germano Percossi <germano.percossi@citrix.com>
commit 1fa839b4986d648b907d117275869a0e46c324b9 upstream.
This fixes Continuous Availability when errors during
file reopen are encountered.
cifs_user_readv and cifs_user_writev would wait for ever if
results of cifs_reopen_file are not stored and for later inspection.
In fact, results are checked and, in case of errors, a chain
of function calls leading to reads and writes to be scheduled in
a separate thread is skipped.
These threads will wake up the corresponding waiters once reads
and writes are done.
However, given the return value is not stored, when rc is checked
for errors a previous one (always zero) is inspected instead.
This leads to pending reads/writes added to the list, making
cifs_user_readv and cifs_user_writev wait for ever.
Signed-off-by: Germano Percossi <germano.percossi@citrix.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/file.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2597,7 +2597,7 @@ cifs_write_from_iter(loff_t offset, size
wdata->credits = credits;
if (!wdata->cfile->invalidHandle ||
- !cifs_reopen_file(wdata->cfile, false))
+ !(rc = cifs_reopen_file(wdata->cfile, false)))
rc = server->ops->async_writev(wdata,
cifs_uncached_writedata_release);
if (rc) {
@@ -3002,7 +3002,7 @@ cifs_send_async_read(loff_t offset, size
rdata->credits = credits;
if (!rdata->cfile->invalidHandle ||
- !cifs_reopen_file(rdata->cfile, true))
+ !(rc = cifs_reopen_file(rdata->cfile, true)))
rc = server->ops->async_readv(rdata);
error:
if (rc) {
@@ -3577,7 +3577,7 @@ static int cifs_readpages(struct file *f
}
if (!rdata->cfile->invalidHandle ||
- !cifs_reopen_file(rdata->cfile, true))
+ !(rc = cifs_reopen_file(rdata->cfile, true)))
rc = server->ops->async_readv(rdata);
if (rc) {
add_credits_and_wake_if(server, rdata->credits, 0);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 52/69] [media] dvb-usb-v2: avoid use-after-free |
| Message-ID | <txZfj-4Gn-1@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 005145378c9ad7575a01b6ce1ba118fb427f583a upstream.
I ran into a stack frame size warning because of the on-stack copy of
the USB device structure:
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c: In function 'dvb_usbv2_disconnect':
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c:1029:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
Copying a device structure like this is wrong for a number of other reasons
too aside from the possible stack overflow. One of them is that the
dev_info() call will print the name of the device later, but AFAICT
we have only copied a pointer to the name earlier and the actual name
has been freed by the time it gets printed.
This removes the on-stack copy of the device and instead copies the
device name using kstrdup(). I'm ignoring the possible failure here
as both printk() and kfree() are able to deal with NULL pointers.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb-v2/dvb_usb_core.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c
@@ -1013,8 +1013,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe);
void dvb_usbv2_disconnect(struct usb_interface *intf)
{
struct dvb_usb_device *d = usb_get_intfdata(intf);
- const char *name = d->name;
- struct device dev = d->udev->dev;
+ const char *devname = kstrdup(dev_name(&d->udev->dev), GFP_KERNEL);
+ const char *drvname = d->name;
dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__,
intf->cur_altsetting->desc.bInterfaceNumber);
@@ -1024,8 +1024,9 @@ void dvb_usbv2_disconnect(struct usb_int
dvb_usbv2_exit(d);
- dev_info(&dev, "%s: '%s' successfully deinitialized and disconnected\n",
- KBUILD_MODNAME, name);
+ pr_info("%s: '%s:%s' successfully deinitialized and disconnected\n",
+ KBUILD_MODNAME, drvname, devname);
+ kfree(devname);
}
EXPORT_SYMBOL(dvb_usbv2_disconnect);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 29/69] scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable |
| Message-ID | <txZfk-4Gn-9@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fam Zheng <famz@redhat.com>
commit 6780414519f91c2a84da9baa963a940ac916f803 upstream.
If device reports a small max_xfer_blocks and a zero opt_xfer_blocks, we
end up using BLK_DEF_MAX_SECTORS, which is wrong and r/w of that size
may get error.
[mkp: tweaked to avoid setting rw_max twice and added typecast]
Fixes: ca369d51b3e ("block/sd: Fix device-imposed transfer length limits")
Signed-off-by: Fam Zheng <famz@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2877,7 +2877,8 @@ static int sd_revalidate_disk(struct gen
q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks);
rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks);
} else
- rw_max = BLK_DEF_MAX_SECTORS;
+ rw_max = min_not_zero(logical_to_sectors(sdp, dev_max),
+ (sector_t)BLK_DEF_MAX_SECTORS);
/* Combine with controller limits */
q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 50/69] parisc: Fix get_user() for 64-bit value on 32-bit kernel |
| Message-ID | <txZfk-4Gn-11@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 3f795cef0ecdf9bc980dd058d49bdab4b19af1d3 upstream.
This fixes a bug in which the upper 32-bits of a 64-bit value which is
read by get_user() was lost on a 32-bit kernel.
While touching this code, split out pre-loading of %sr2 space register
and clean up code indent.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/include/asm/uaccess.h | 86 ++++++++++++++++++++++++--------------
1 file changed, 55 insertions(+), 31 deletions(-)
--- a/arch/parisc/include/asm/uaccess.h
+++ b/arch/parisc/include/asm/uaccess.h
@@ -42,10 +42,10 @@ static inline long access_ok(int type, c
#define get_user __get_user
#if !defined(CONFIG_64BIT)
-#define LDD_USER(ptr) __get_user_asm64(ptr)
+#define LDD_USER(val, ptr) __get_user_asm64(val, ptr)
#define STD_USER(x, ptr) __put_user_asm64(x, ptr)
#else
-#define LDD_USER(ptr) __get_user_asm("ldd", ptr)
+#define LDD_USER(val, ptr) __get_user_asm(val, "ldd", ptr)
#define STD_USER(x, ptr) __put_user_asm("std", x, ptr)
#endif
@@ -100,63 +100,87 @@ struct exception_data {
" mtsp %0,%%sr2\n\t" \
: : "r"(get_fs()) : )
-#define __get_user(x, ptr) \
-({ \
- register long __gu_err __asm__ ("r8") = 0; \
- register long __gu_val; \
- \
- load_sr2(); \
- switch (sizeof(*(ptr))) { \
- case 1: __get_user_asm("ldb", ptr); break; \
- case 2: __get_user_asm("ldh", ptr); break; \
- case 4: __get_user_asm("ldw", ptr); break; \
- case 8: LDD_USER(ptr); break; \
- default: BUILD_BUG(); break; \
- } \
- \
- (x) = (__force __typeof__(*(ptr))) __gu_val; \
- __gu_err; \
+#define __get_user_internal(val, ptr) \
+({ \
+ register long __gu_err __asm__ ("r8") = 0; \
+ \
+ switch (sizeof(*(ptr))) { \
+ case 1: __get_user_asm(val, "ldb", ptr); break; \
+ case 2: __get_user_asm(val, "ldh", ptr); break; \
+ case 4: __get_user_asm(val, "ldw", ptr); break; \
+ case 8: LDD_USER(val, ptr); break; \
+ default: BUILD_BUG(); \
+ } \
+ \
+ __gu_err; \
})
-#define __get_user_asm(ldx, ptr) \
+#define __get_user(val, ptr) \
+({ \
+ load_sr2(); \
+ __get_user_internal(val, ptr); \
+})
+
+#define __get_user_asm(val, ldx, ptr) \
+{ \
+ register long __gu_val; \
+ \
__asm__("1: " ldx " 0(%%sr2,%2),%0\n" \
"9:\n" \
ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
: "=r"(__gu_val), "=r"(__gu_err) \
- : "r"(ptr), "1"(__gu_err));
+ : "r"(ptr), "1"(__gu_err)); \
+ \
+ (val) = (__force __typeof__(*(ptr))) __gu_val; \
+}
#if !defined(CONFIG_64BIT)
-#define __get_user_asm64(ptr) \
+#define __get_user_asm64(val, ptr) \
+{ \
+ union { \
+ unsigned long long l; \
+ __typeof__(*(ptr)) t; \
+ } __gu_tmp; \
+ \
__asm__(" copy %%r0,%R0\n" \
"1: ldw 0(%%sr2,%2),%0\n" \
"2: ldw 4(%%sr2,%2),%R0\n" \
"9:\n" \
ASM_EXCEPTIONTABLE_ENTRY_EFAULT(1b, 9b) \
ASM_EXCEPTIONTABLE_ENTRY_EFAULT(2b, 9b) \
- : "=r"(__gu_val), "=r"(__gu_err) \
- : "r"(ptr), "1"(__gu_err));
+ : "=&r"(__gu_tmp.l), "=r"(__gu_err) \
+ : "r"(ptr), "1"(__gu_err)); \
+ \
+ (val) = __gu_tmp.t; \
+}
#endif /* !defined(CONFIG_64BIT) */
-#define __put_user(x, ptr) \
+#define __put_user_internal(x, ptr) \
({ \
register long __pu_err __asm__ ("r8") = 0; \
__typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x); \
\
- load_sr2(); \
switch (sizeof(*(ptr))) { \
- case 1: __put_user_asm("stb", __x, ptr); break; \
- case 2: __put_user_asm("sth", __x, ptr); break; \
- case 4: __put_user_asm("stw", __x, ptr); break; \
- case 8: STD_USER(__x, ptr); break; \
- default: BUILD_BUG(); break; \
- } \
+ case 1: __put_user_asm("stb", __x, ptr); break; \
+ case 2: __put_user_asm("sth", __x, ptr); break; \
+ case 4: __put_user_asm("stw", __x, ptr); break; \
+ case 8: STD_USER(__x, ptr); break; \
+ default: BUILD_BUG(); \
+ } \
\
__pu_err; \
})
+#define __put_user(x, ptr) \
+({ \
+ load_sr2(); \
+ __put_user_internal(x, ptr); \
+})
+
+
/*
* The "__put_user/kernel_asm()" macros tell gcc they read from memory
* instead of writing. This is because they do not write to any memory
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 46/69] zram: do not use copy_page with non-page aligned address |
| Message-ID | <txZfk-4Gn-17@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minchan Kim <minchan@kernel.org>
commit d72e9a7a93e4f8e9e52491921d99e0c8aa89eb4e upstream.
The copy_page is optimized memcpy for page-alinged address. If it is
used with non-page aligned address, it can corrupt memory which means
system corruption. With zram, it can happen with
1. 64K architecture
2. partial IO
3. slub debug
Partial IO need to allocate a page and zram allocates it via kmalloc.
With slub debug, kmalloc(PAGE_SIZE) doesn't return page-size aligned
address. And finally, copy_page(mem, cmem) corrupts memory.
So, this patch changes it to memcpy.
Actuaully, we don't need to change zram_bvec_write part because zsmalloc
returns page-aligned address in case of PAGE_SIZE class but it's not
good to rely on the internal of zsmalloc.
Note:
When this patch is merged to stable, clear_page should be fixed, too.
Unfortunately, recent zram removes it by "same page merge" feature so
it's hard to backport this patch to -stable tree.
I will handle it when I receive the mail from stable tree maintainer to
merge this patch to backport.
Fixes: 42e99bd ("zram: optimize memory operations with clear_page()/copy_page()")
Link: http://lkml.kernel.org/r/1492042622-12074-2-git-send-email-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -582,13 +582,13 @@ static int zram_decompress_page(struct z
if (!handle || zram_test_flag(meta, index, ZRAM_ZERO)) {
bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value);
- clear_page(mem);
+ memset(mem, 0, PAGE_SIZE);
return 0;
}
cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
if (size == PAGE_SIZE) {
- copy_page(mem, cmem);
+ memcpy(mem, cmem, PAGE_SIZE);
} else {
struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp);
@@ -780,7 +780,7 @@ compress_again:
if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
src = kmap_atomic(page);
- copy_page(cmem, src);
+ memcpy(cmem, src, PAGE_SIZE);
kunmap_atomic(src);
} else {
memcpy(cmem, src, clen);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 56/69] nbd: use loff_t for blocksize and nbd_set_size args |
| Message-ID | <txZfk-4Gn-27@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <jbacik@fb.com>
commit ef77b515243b3499d62cf446eda6ca7e0a0b079c upstream.
If we have large devices (say like the 40t drive I was trying to test with) we
will end up overflowing the int arguments to nbd_set_size and not get the right
size for our device. Fix this by using loff_t everywhere so I don't have to
think about this again. Thanks,
Signed-off-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nbd.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -54,7 +54,7 @@ struct nbd_device {
struct mutex tx_lock;
struct gendisk *disk;
- int blksize;
+ loff_t blksize;
loff_t bytesize;
/* protects initialization and shutdown of the socket */
@@ -126,7 +126,7 @@ static void nbd_size_update(struct nbd_d
}
static int nbd_size_set(struct nbd_device *nbd, struct block_device *bdev,
- int blocksize, int nr_blocks)
+ loff_t blocksize, loff_t nr_blocks)
{
int ret;
@@ -135,7 +135,7 @@ static int nbd_size_set(struct nbd_devic
return ret;
nbd->blksize = blocksize;
- nbd->bytesize = (loff_t)blocksize * (loff_t)nr_blocks;
+ nbd->bytesize = blocksize * nr_blocks;
nbd_size_update(nbd, bdev);
@@ -817,7 +817,7 @@ static int nbd_dev_dbg_init(struct nbd_d
debugfs_create_file("tasks", 0444, dir, nbd, &nbd_dbg_tasks_ops);
debugfs_create_u64("size_bytes", 0444, dir, &nbd->bytesize);
debugfs_create_u32("timeout", 0444, dir, &nbd->tag_set.timeout);
- debugfs_create_u32("blocksize", 0444, dir, &nbd->blksize);
+ debugfs_create_u64("blocksize", 0444, dir, &nbd->blksize);
debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_ops);
return 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 43/69] char: lack of bool string made CONFIG_DEVPORT always on |
| Message-ID | <txZfk-4Gn-19@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Max Bires <jbires@google.com> commit f2cfa58b136e4b06a9b9db7af5ef62fbb5992f62 upstream. Without a bool string present, using "# CONFIG_DEVPORT is not set" in defconfig files would not actually unset devport. This esnured that /dev/port was always on, but there are reasons a user may wish to disable it (smaller kernel, attack surface reduction) if it's not being used. Adding a message here in order to make this user visible. Signed-off-by: Max Bires <jbires@google.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/char/Kconfig | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/char/Kconfig +++ b/drivers/char/Kconfig @@ -571,9 +571,12 @@ config TELCLOCK controlling the behavior of this hardware. config DEVPORT - bool + bool "/dev/port character device" depends on ISA || PCI default y + help + Say Y here if you want to support the /dev/port device. The /dev/port + device is similar to /dev/mem, but for I/O ports. source "drivers/s390/char/Kconfig"
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 41/69] irqchip/irq-imx-gpcv2: Fix spinlock initialization |
| Message-ID | <txZfk-4Gn-15@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Baker <tyler.baker@linaro.org>
commit 75eb5e1e7b4edbc8e8f930de59004d21cb46961f upstream.
The raw_spinlock in the IMX GPCV2 interupt chip is not initialized before
usage. That results in a lockdep splat:
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
Add the missing raw_spin_lock_init() to the setup code.
Fixes: e324c4dc4a59 ("irqchip/imx-gpcv2: IMX GPCv2 driver for wakeup sources")
Signed-off-by: Tyler Baker <tyler.baker@linaro.org>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Cc: jason@lakedaemon.net
Cc: marc.zyngier@arm.com
Cc: shawnguo@kernel.org
Cc: andrew.smirnov@gmail.com
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/20170413222731.5917-1-tyler.baker@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-imx-gpcv2.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/irqchip/irq-imx-gpcv2.c
+++ b/drivers/irqchip/irq-imx-gpcv2.c
@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init
return -ENOMEM;
}
+ raw_spin_lock_init(&cd->rlock);
+
cd->gpc_base = of_iomap(node, 0);
if (!cd->gpc_base) {
pr_err("fsl-gpcv2: unable to map gpc registers\n");
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 03/69] tcmu: Fix wrongly calculating of the base_command_size |
| Message-ID | <txZfl-4Gn-33@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <lixiubo@cmss.chinamobile.com>
commit abe342a5b4b5aa579f6bf40ba73447c699e6b579 upstream.
The t_data_nents and t_bidi_data_nents are the numbers of the
segments, but it couldn't be sure the block size equals to size
of the segment.
For the worst case, all the blocks are discontiguous and there
will need the same number of iovecs, that's to say: blocks == iovs.
So here just set the number of iovs to block count needed by tcmu
cmd.
Tested-by: Ilias Tsitsimpis <iliastsi@arrikto.com>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/target_core_user.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -403,6 +403,13 @@ static inline size_t tcmu_cmd_get_data_l
return data_length;
}
+static inline uint32_t tcmu_cmd_get_block_cnt(struct tcmu_cmd *tcmu_cmd)
+{
+ size_t data_length = tcmu_cmd_get_data_length(tcmu_cmd);
+
+ return data_length / DATA_BLOCK_SIZE;
+}
+
static sense_reason_t
tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd)
{
@@ -430,8 +437,7 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcm
* expensive to tell how many regions are freed in the bitmap
*/
base_command_size = max(offsetof(struct tcmu_cmd_entry,
- req.iov[se_cmd->t_bidi_data_nents +
- se_cmd->t_data_nents]),
+ req.iov[tcmu_cmd_get_block_cnt(tcmu_cmd)]),
sizeof(struct tcmu_cmd_entry));
command_size = base_command_size
+ round_up(scsi_command_size(se_cmd->t_task_cdb), TCMU_OP_ALIGN_SIZE);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 47/69] ftrace: Fix function pid filter on instances |
| Message-ID | <txZfl-4Gn-41@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
commit d879d0b8c183aabeb9a65eba91f3f9e3c7e7b905 upstream.
When function tracer has a pid filter, it adds a probe to sched_switch
to track if current task can be ignored. The probe checks the
ftrace_ignore_pid from current tr to filter tasks. But it misses to
delete the probe when removing an instance so that it can cause a crash
due to the invalid tr pointer (use-after-free).
This is easily reproducible with the following:
# cd /sys/kernel/debug/tracing
# mkdir instances/buggy
# echo $$ > instances/buggy/set_ftrace_pid
# rmdir instances/buggy
============================================================================
BUG: KASAN: use-after-free in ftrace_filter_pid_sched_switch_probe+0x3d/0x90
Read of size 8 by task kworker/0:1/17
CPU: 0 PID: 17 Comm: kworker/0:1 Tainted: G B 4.11.0-rc3 #198
Call Trace:
dump_stack+0x68/0x9f
kasan_object_err+0x21/0x70
kasan_report.part.1+0x22b/0x500
? ftrace_filter_pid_sched_switch_probe+0x3d/0x90
kasan_report+0x25/0x30
__asan_load8+0x5e/0x70
ftrace_filter_pid_sched_switch_probe+0x3d/0x90
? fpid_start+0x130/0x130
__schedule+0x571/0xce0
...
To fix it, use ftrace_clear_pids() to unregister the probe. As
instance_rmdir() already updated ftrace codes, it can just free the
filter safely.
Link: http://lkml.kernel.org/r/20170417024430.21194-2-namhyung@kernel.org
Fixes: 0c8916c34203 ("tracing: Add rmdir to remove multibuffer instances")
Cc: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 9 +++++++++
kernel/trace/trace.c | 1 +
kernel/trace/trace.h | 2 ++
3 files changed, 12 insertions(+)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5401,6 +5401,15 @@ static void clear_ftrace_pids(struct tra
trace_free_pid_list(pid_list);
}
+void ftrace_clear_pids(struct trace_array *tr)
+{
+ mutex_lock(&ftrace_lock);
+
+ clear_ftrace_pids(tr);
+
+ mutex_unlock(&ftrace_lock);
+}
+
static void ftrace_pid_reset(struct trace_array *tr)
{
mutex_lock(&ftrace_lock);
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7150,6 +7150,7 @@ static int instance_rmdir(const char *na
tracing_set_nop(tr);
event_trace_del_tracer(tr);
+ ftrace_clear_pids(tr);
ftrace_destroy_function_files(tr);
tracefs_remove_recursive(tr->dir);
free_trace_buffers(tr);
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -870,6 +870,7 @@ int using_ftrace_ops_list_func(void);
void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d_tracer);
void ftrace_init_tracefs_toplevel(struct trace_array *tr,
struct dentry *d_tracer);
+void ftrace_clear_pids(struct trace_array *tr);
#else
static inline int ftrace_trace_task(struct trace_array *tr)
{
@@ -888,6 +889,7 @@ ftrace_init_global_array_ops(struct trac
static inline void ftrace_reset_array_ops(struct trace_array *tr) { }
static inline void ftrace_init_tracefs(struct trace_array *tr, struct dentry *d) { }
static inline void ftrace_init_tracefs_toplevel(struct trace_array *tr, struct dentry *d) { }
+static inline void ftrace_clear_pids(struct trace_array *tr) { }
/* ftace_func_t type is not defined, use macro instead of static inline */
#define ftrace_init_array_ops(tr, func) do { } while (0)
#endif /* CONFIG_FUNCTION_TRACER */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 57/69] nbd: fix 64-bit division |
| Message-ID | <txZfm-4Gn-57@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@fb.com>
commit e88f72cb9f54f6d244e55f629fe5e2f34ca6f9ed upstream.
We have this:
ERROR: "__aeabi_ldivmod" [drivers/block/nbd.ko] undefined!
ERROR: "__divdi3" [drivers/block/nbd.ko] undefined!
nbd.c:(.text+0x247c72): undefined reference to `__divdi3'
due to a recent commit, that did 64-bit division. Use the proper
divider function so that 32-bit compiles don't break.
Fixes: ef77b515243b ("nbd: use loff_t for blocksize and nbd_set_size args")
Signed-off-by: Jens Axboe <axboe@fb.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/nbd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -648,7 +648,7 @@ static int __nbd_ioctl(struct block_devi
case NBD_SET_SIZE:
return nbd_size_set(nbd, bdev, nbd->blksize,
- arg / nbd->blksize);
+ div_s64(arg, nbd->blksize));
case NBD_SET_SIZE_BLOCKS:
return nbd_size_set(nbd, bdev, nbd->blksize, arg);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 37/69] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep splat |
| Message-ID | <txZfm-4Gn-61@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit 0beb2012a1722633515c8aaa263c73449636c893 upstream.
Holding the reconfig_mutex over a potential userspace fault sets up a
lockdep dependency chain between filesystem-DAX and the libnvdimm ioctl
path. Move the user access outside of the lock.
[ INFO: possible circular locking dependency detected ]
4.11.0-rc3+ #13 Tainted: G W O
-------------------------------------------------------
fallocate/16656 is trying to acquire lock:
(&nvdimm_bus->reconfig_mutex){+.+.+.}, at: [<ffffffffa00080b1>] nvdimm_bus_lock+0x21/0x30 [libnvdimm]
but task is already holding lock:
(jbd2_handle){++++..}, at: [<ffffffff813b4944>] start_this_handle+0x104/0x460
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (jbd2_handle){++++..}:
lock_acquire+0xbd/0x200
start_this_handle+0x16a/0x460
jbd2__journal_start+0xe9/0x2d0
__ext4_journal_start_sb+0x89/0x1c0
ext4_dirty_inode+0x32/0x70
__mark_inode_dirty+0x235/0x670
generic_update_time+0x87/0xd0
touch_atime+0xa9/0xd0
ext4_file_mmap+0x90/0xb0
mmap_region+0x370/0x5b0
do_mmap+0x415/0x4f0
vm_mmap_pgoff+0xd7/0x120
SyS_mmap_pgoff+0x1c5/0x290
SyS_mmap+0x22/0x30
entry_SYSCALL_64_fastpath+0x1f/0xc2
-> #1 (&mm->mmap_sem){++++++}:
lock_acquire+0xbd/0x200
__might_fault+0x70/0xa0
__nd_ioctl+0x683/0x720 [libnvdimm]
nvdimm_ioctl+0x8b/0xe0 [libnvdimm]
do_vfs_ioctl+0xa8/0x740
SyS_ioctl+0x79/0x90
do_syscall_64+0x6c/0x200
return_from_SYSCALL_64+0x0/0x7a
-> #0 (&nvdimm_bus->reconfig_mutex){+.+.+.}:
__lock_acquire+0x16b6/0x1730
lock_acquire+0xbd/0x200
__mutex_lock+0x88/0x9b0
mutex_lock_nested+0x1b/0x20
nvdimm_bus_lock+0x21/0x30 [libnvdimm]
nvdimm_forget_poison+0x25/0x50 [libnvdimm]
nvdimm_clear_poison+0x106/0x140 [libnvdimm]
pmem_do_bvec+0x1c2/0x2b0 [nd_pmem]
pmem_make_request+0xf9/0x270 [nd_pmem]
generic_make_request+0x118/0x3b0
submit_bio+0x75/0x150
Fixes: 62232e45f4a2 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices")
Cc: Dave Jiang <dave.jiang@intel.com>
Reported-by: Vishal Verma <vishal.l.verma@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvdimm/bus.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -934,8 +934,14 @@ static int __nd_ioctl(struct nvdimm_bus
rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, NULL);
if (rc < 0)
goto out_unlock;
+ nvdimm_bus_unlock(&nvdimm_bus->dev);
+
if (copy_to_user(p, buf, buf_len))
rc = -EFAULT;
+
+ vfree(buf);
+ return rc;
+
out_unlock:
nvdimm_bus_unlock(&nvdimm_bus->dev);
out:
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 44/69] Revert "MIPS: Lantiq: Fix cascaded IRQ setup" |
| Message-ID | <txZfm-4Gn-59@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 362721c4957dcda7b1fbd45380e7a6617a1d077c which is
commit 6c356eda225e3ee134ed4176b9ae3a76f793f4dd upstream.
It shouldn't have been included in a stable release.
Reported-by: Amit Pundir <amit.pundir@linaro.org>
Cc: Felix Fietkau <nbd@nbd.name>
Cc: John Crispin <john@phrozen.org>
Cc: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/lantiq/irq.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/mips/lantiq/irq.c
+++ b/arch/mips/lantiq/irq.c
@@ -269,11 +269,6 @@ static void ltq_hw5_irqdispatch(void)
DEFINE_HWx_IRQDISPATCH(5)
#endif
-static void ltq_hw_irq_handler(struct irq_desc *desc)
-{
- ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2);
-}
-
#ifdef CONFIG_MIPS_MT_SMP
void __init arch_init_ipiirq(int irq, struct irqaction *action)
{
@@ -318,19 +313,23 @@ static struct irqaction irq_call = {
asmlinkage void plat_irq_dispatch(void)
{
unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM;
- int irq;
+ unsigned int i;
- if (!pending) {
- spurious_interrupt();
- return;
+ if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) {
+ do_IRQ(MIPS_CPU_TIMER_IRQ);
+ goto out;
+ } else {
+ for (i = 0; i < MAX_IM; i++) {
+ if (pending & (CAUSEF_IP2 << i)) {
+ ltq_hw_irqdispatch(i);
+ goto out;
+ }
+ }
}
+ pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status());
- pending >>= CAUSEB_IP;
- while (pending) {
- irq = fls(pending) - 1;
- do_IRQ(MIPS_CPU_IRQ_BASE + irq);
- pending &= ~BIT(irq);
- }
+out:
+ return;
}
static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw)
@@ -355,6 +354,11 @@ static const struct irq_domain_ops irq_d
.map = icu_map,
};
+static struct irqaction cascade = {
+ .handler = no_action,
+ .name = "cascade",
+};
+
int __init icu_of_init(struct device_node *node, struct device_node *parent)
{
struct device_node *eiu_node;
@@ -386,7 +390,7 @@ int __init icu_of_init(struct device_nod
mips_cpu_irq_init();
for (i = 0; i < MAX_IM; i++)
- irq_set_chained_handler(i + 2, ltq_hw_irq_handler);
+ setup_irq(i + 2, &cascade);
if (cpu_has_vint) {
pr_info("Setting up vectored interrupts\n");
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-04-19 17:00 +0200 |
| Subject | [PATCH 4.9 55/69] drm/nouveau/disp/mcp7x: disable dptmds workaround |
| Message-ID | <txZfm-4Gn-65@gated-at.bofh.it> |
| In reply to | #1626229 |
4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Skeggs <bskeggs@redhat.com> commit 7dfee6827780d4228148263545af936d0cae8930 upstream. The workaround appears to cause regressions on these boards, and from inspection of RM traces, NVIDIA don't appear to do it on them either. Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Tested-by: Roy Spliet <nouveau@spliet.org> Cc: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 2 -- 1 file changed, 2 deletions(-) --- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c +++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c @@ -433,8 +433,6 @@ nv50_disp_dptmds_war(struct nvkm_device case 0x94: case 0x96: case 0x98: - case 0xaa: - case 0xac: return true; default: break;
[toc] | [prev] | [next] | [standalone]
Page 1 of 3 [1] 2 3 Next page →
Back to top | Article view | linux.kernel
csiph-web