Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1696349 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2017-07-25 22:40 +0200 |
| Last post | 2017-07-26 16:30 +0200 |
| Articles | 20 on this page of 56 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 4.9 000/125] 4.9.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 068/125] ipmi: use rcu lock around call to intf->handlers->sender() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 046/125] PCI: rockchip: Use normal register bank for config accessors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 042/125] powerpc/asm: Mark cr0 as clobbered in mftb() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 035/125] scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 044/125] af_key: Fix sadb_x_ipsecrequest parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 037/125] xen/scsiback: Fix a TMR related use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 053/125] usb: storage: return on error to avoid a null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 030/125] ASoC: compress: Derive substream from stream based on direction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 008/125] ath9k: fix tx99 bus error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 027/125] wlcore: fix 64K page support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 056/125] usb: renesas_usbhs: gadget: disable all eps when the driver stops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 047/125] PCI/PM: Restore the status of PCI devices across hibernation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 049/125] xhci: fix 20000ms port resume timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 028/125] btrfs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 033/125] PM / Domains: Fix unsafe iteration over modified list of domains Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 052/125] [media] mxl111sf: Fix driver to use heap allocate buffers for USB messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 009/125] ath9k: fix an invalid pointer dereference in ath9k_rng_stop() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 041/125] powerpc: Fix emulation of mfocrf in emulate_step() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 043/125] powerpc/mm/radix: Properly clear process table entry Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 039/125] powerpc/64: Fix atomic64_inc_not_zero() to return an int Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 034/125] scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 029/125] igb: Explicitly select page 0 at initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 032/125] PM / Domains: Fix unsafe iteration over modified list of domain providers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 036/125] iscsi-target: Add login_keys_workaround attribute for non RFC initiators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 054/125] USB: cdc-acm: add device-id for quirky printer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 071/125] f2fs: sanity check size of nat and sit cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 050/125] xhci: Fix NULL pointer dereference when cleaning up streams for removed host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 069/125] ipmi:ssif: Add missing unlock in error branch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 026/125] Bluetooth: use constant time memory comparison for secret values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 031/125] PM / Domains: Fix unsafe iteration over modified list of device links Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 040/125] powerpc: Fix emulation of mcrf in emulate_step() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:40 +0200
[PATCH 4.9 023/125] perf intel-pt: Ensure never to set last_ip when packet count is zero Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 003/125] dm mpath: cleanup -Wbool-operation warning in choose_pgpath() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 017/125] NFC: Add sockaddr length checks before accessing sa_family in bind handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 018/125] perf intel-pt: Move decoder error setting into one condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 005/125] thermal: max77620: fix device-node reference imbalance Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 006/125] thermal: cpu_cooling: Avoid accessing potentially freed structures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 004/125] [media] s5p-jpeg: dont return a random width/height Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 001/125] disable new gcc-7.1.1 warnings for now Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 015/125] nfc: Ensure presence of required attributes in the activate_target handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 020/125] perf intel-pt: Fix missing stack clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 002/125] [media] ir-core: fix gcc-7 warning on bool arithmetic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 012/125] NFC: nfcmrvl: do not use device-managed resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 007/125] ath9k: fix tx99 use after free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 021/125] perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 011/125] NFC: nfcmrvl_uart: add missing tty-device sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 014/125] NFC: nfcmrvl: fix firmware-management initialisation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 016/125] nfc: Fix the sockaddr length sanitization in llcp_sock_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 019/125] perf intel-pt: Improve sample timestamp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 010/125] NFC: fix broken device allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
[PATCH 4.9 013/125] NFC: nfcmrvl: use nfc-device for firmware download Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-25 22:50 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Guenter Roeck <linux@roeck-us.net> - 2017-07-26 05:00 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Sumit Semwal <sumit.semwal@linaro.org> - 2017-07-26 16:20 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-07-26 22:00 +0200
Re: [PATCH 4.9 000/125] 4.9.40-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-07-26 16:30 +0200
Page 1 of 3 [1] 2 3 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 000/125] 4.9.40-stable review |
| Message-ID | <u7dGN-6Sz-9@gated-at.bofh.it> |
This is the start of the stable review cycle for the 4.9.40 release.
There are 125 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Jul 27 19:19:43 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.40-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 4.9.40-rc1
Greg Hackmann <ghackmann@google.com>
alarmtimer: don't rate limit one-shot timers
Chunyu Hu <chuhu@redhat.com>
tracing: Fix kmemleak in instance_rmdir
Sudeep Holla <Sudeep.Holla@arm.com>
PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
Jan Kara <jack@suse.cz>
reiserfs: Don't clear SGID when inheriting ACLs
Bjorn Andersson <bjorn.andersson@linaro.org>
spmi: Include OF based modalias in device uevent
Stephen Boyd <stephen.boyd@linaro.org>
of: device: Export of_device_{get_modalias, uvent_modalias} to modules
Prarit Bhargava <prarit@redhat.com>
acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
Amir Goldstein <amir73il@gmail.com>
ovl: fix random return value on mount
Jan Kara <jack@suse.cz>
hfsplus: Don't clear SGID when inheriting ACLs
Bart Van Assche <bart.vanassche@sandisk.com>
mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
Imre Deak <imre.deak@intel.com>
drm/mst: Avoid processing partially received up/down message transactions
Imre Deak <imre.deak@intel.com>
drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
Imre Deak <imre.deak@intel.com>
drm/mst: Fix error handling during MST sideband message reception
Ismail, Mustafa <mustafa.ismail@intel.com>
RDMA/core: Initialize port_num in qp_attr
Yan, Zheng <zyan@redhat.com>
ceph: fix race in concurrent readdir
Arnd Bergmann <arnd@arndb.de>
staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
Teddy Wang <teddy.wang@siliconmotion.com>
staging: sm750fb: avoid conflicting vesafb
Ian Abbott <abbotti@mev.co.uk>
staging: comedi: ni_mio_common: fix AO timer off-by-one regression
Michael Gugino <michael.gugino.2@gmail.com>
staging: rtl8188eu: add TL-WN722N v2 support
Ingo Molnar <mingo@kernel.org>
Revert "perf/core: Drop kernel samples even though :u is specified"
Jin Yao <yao.jin@linux.intel.com>
perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
Nicholas Bellinger <nab@linux-iscsi.org>
iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
Jiang Yi <jiangyilism@gmail.com>
target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
Jan Kara <jack@suse.cz>
udf: Fix deadlock between writeback and udf_setsize()
NeilBrown <neilb@suse.com>
NFS: only invalidate dentrys that are clearly invalid.
Jason A. Donenfeld <Jason@zx2c4.com>
sunrpc: use constant time memory comparison for mac
Moni Shoua <monis@mellanox.com>
IB/core: Namespace is mandatory input for address resolution
Vladimir Neyelov <vladimirn@mellanox.com>
IB/iser: Fix connection teardown race condition
Chen Hong <chenhong3@huawei.com>
Input: i8042 - fix crash at boot time
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
Maciej W. Rozycki <macro@imgtec.com>
MIPS: math-emu: Prevent wrong ISA mode instruction emulation
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Fix unaligned PC interpretation in `compute_return_epc'
Maciej W. Rozycki <macro@imgtec.com>
MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
James Hogan <james.hogan@imgtec.com>
MIPS: Save static registers before sysmips
Maciej W. Rozycki <macro@linux-mips.org>
MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
Seunghun Han <kkamagui@gmail.com>
x86/ioapic: Pass the correct data to unmask_ioapic_irq()
Seunghun Han <kkamagui@gmail.com>
x86/acpi: Prevent out of bound access caused by broken ACPI tables
Lv Zheng <lv.zheng@intel.com>
Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
Lv Zheng <lv.zheng@intel.com>
ACPI / EC: Drop EC noirq hooks to fix a regression
Richard Weinberger <richard@nod.at>
ubifs: Don't leak kernel memory to the MTD
James Hogan <james.hogan@imgtec.com>
MIPS: Negate error syscall return in trace
James Hogan <james.hogan@imgtec.com>
MIPS: Fix mips_atomic_set() with EVA
James Hogan <james.hogan@imgtec.com>
MIPS: Fix mips_atomic_set() retry condition
Dan Carpenter <dan.carpenter@oracle.com>
ftrace: Fix uninitialized variable in match_records()
Marta Rybczynska <mrybczyn@kalray.eu>
nvme-rdma: remove race conditions from IB signalling
Alex Williamson <alex.williamson@redhat.com>
vfio: New external user group/file match
Alex Williamson <alex.williamson@redhat.com>
vfio: Fix group release deadlock
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
John Brooks <john@fastquake.com>
drm/ttm: Fix use-after-free in ttm_bo_clean_mm
Jaegeuk Kim <jaegeuk@kernel.org>
f2fs: Don't clear SGID when inheriting ACLs
Jin Qian <jinqian@android.com>
f2fs: sanity check size of nat and sit cache
Jan Kara <jack@suse.cz>
xfs: Don't clear SGID when inheriting ACLs
Corey Minyard <cminyard@mvista.com>
ipmi:ssif: Add missing unlock in error branch
Tony Camuso <tcamuso@redhat.com>
ipmi: use rcu lock around call to intf->handlers->sender()
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/radeon: Fix eDP for single-display iMac10,1 (v2)
Alex Deucher <alexander.deucher@amd.com>
drm/radeon/ci: disable mclk switching for high refresh rates (v2)
Tom St Denis <tom.stdenis@amd.com>
drm/amd/amdgpu: Return error if initiating read out of range on vram
Jiri Olsa <jolsa@kernel.org>
s390/syscalls: Fix out of bounds arguments access
Xiao Ni <xni@redhat.com>
Raid5 should update rdev->sectors after reshape
Jan Kara <jack@suse.cz>
ext2: Don't clear SGID when inheriting ACLs
Toshi Kani <toshi.kani@hpe.com>
libnvdimm: fix badblock range handling of ARS range
Vishal Verma <vishal.l.verma@intel.com>
libnvdimm, btt: fix btt_rw_page not returning errors
Devin Heitmueller <dheitmueller@kernellabs.com>
cx88: Fix regression in initial video standard setting
Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
x86/xen: allow userspace access during hypercalls
Mikulas Patocka <mpatocka@redhat.com>
md: don't use flush_signals in userspace processes
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
usb: renesas_usbhs: gadget: disable all eps when the driver stops
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
Johan Hovold <johan@kernel.org>
USB: cdc-acm: add device-id for quirky printer
Colin Ian King <colin.king@canonical.com>
usb: storage: return on error to avoid a null pointer dereference
Devin Heitmueller <dheitmueller@kernellabs.com>
mxl111sf: Fix driver to use heap allocate buffers for USB messages
Jiahau Chang <jiahau@gmail.com>
xhci: Bad Ethernet performance plugged in ASM1042A host
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Fix NULL pointer dereference when cleaning up streams for removed host
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: fix 20000ms port resume timeout
Julian Anastasov <ja@ssi.bg>
ipvs: SNAT packet replies only for NATed connections
Chen Yu <yu.c.chen@intel.com>
PCI/PM: Restore the status of PCI devices across hibernation
Shawn Lin <shawn.lin@rock-chips.com>
PCI: rockchip: Use normal register bank for config accessors
Bjorn Helgaas <bhelgaas@google.com>
PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
Herbert Xu <herbert@gondor.apana.org.au>
af_key: Fix sadb_x_ipsecrequest parsing
Benjamin Herrenschmidt <benh@kernel.crashing.org>
powerpc/mm/radix: Properly clear process table entry
Oliver O'Halloran <oohall@gmail.com>
powerpc/asm: Mark cr0 as clobbered in mftb()
Anton Blanchard <anton@samba.org>
powerpc: Fix emulation of mfocrf in emulate_step()
Anton Blanchard <anton@samba.org>
powerpc: Fix emulation of mcrf in emulate_step()
Michael Ellerman <mpe@ellerman.id.au>
powerpc/64: Fix atomic64_inc_not_zero() to return an int
Balbir Singh <bsingharora@gmail.com>
powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
Bart Van Assche <bart.vanassche@sandisk.com>
xen/scsiback: Fix a TMR related use-after-free
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Add login_keys_workaround attribute for non RFC initiators
Ewan D. Milne <emilne@redhat.com>
scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
Maurizio Lombardi <mlombard@redhat.com>
scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
Krzysztof Kozlowski <krzk@kernel.org>
PM / Domains: Fix unsafe iteration over modified list of domains
Krzysztof Kozlowski <krzk@kernel.org>
PM / Domains: Fix unsafe iteration over modified list of domain providers
Krzysztof Kozlowski <krzk@kernel.org>
PM / Domains: Fix unsafe iteration over modified list of device links
Satish Babu Patakokila <sbpata@codeaurora.org>
ASoC: compress: Derive substream from stream based on direction
Matwey V Kornilov <matwey@sai.msu.ru>
igb: Explicitly select page 0 at initialization
Jan Kara <jack@suse.cz>
btrfs: Don't clear SGID when inheriting ACLs
Arnd Bergmann <arnd@arndb.de>
wlcore: fix 64K page support
Jason A. Donenfeld <Jason@zx2c4.com>
Bluetooth: use constant time memory comparison for secret values
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Clear FUP flag on error
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Use FUP always when scanning for an IP
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Fix last_ip usage
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Fix missing stack clear
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Improve sample timestamp
Adrian Hunter <adrian.hunter@intel.com>
perf intel-pt: Move decoder error setting into one condition
Mateusz Jurczyk <mjurczyk@google.com>
NFC: Add sockaddr length checks before accessing sa_family in bind handlers
Mateusz Jurczyk <mjurczyk@google.com>
nfc: Fix the sockaddr length sanitization in llcp_sock_connect
Mateusz Jurczyk <mjurczyk@google.com>
nfc: Ensure presence of required attributes in the activate_target handler
Johan Hovold <johan@kernel.org>
NFC: nfcmrvl: fix firmware-management initialisation
Johan Hovold <johan@kernel.org>
NFC: nfcmrvl: use nfc-device for firmware download
Johan Hovold <johan@kernel.org>
NFC: nfcmrvl: do not use device-managed resources
Johan Hovold <johan@kernel.org>
NFC: nfcmrvl_uart: add missing tty-device sanity check
Johan Hovold <johan@kernel.org>
NFC: fix broken device allocation
Miaoqing Pan <miaoqing@codeaurora.org>
ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
Miaoqing Pan <miaoqing@codeaurora.org>
ath9k: fix tx99 bus error
Miaoqing Pan <miaoqing@codeaurora.org>
ath9k: fix tx99 use after free
Viresh Kumar <viresh.kumar@linaro.org>
thermal: cpu_cooling: Avoid accessing potentially freed structures
Johan Hovold <johan@kernel.org>
thermal: max77620: fix device-node reference imbalance
Mauro Carvalho Chehab <mchehab@kernel.org>
s5p-jpeg: don't return a random width/height
Mike Snitzer <snitzer@redhat.com>
dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
Arnd Bergmann <arnd@arndb.de>
ir-core: fix gcc-7 warning on bool arithmetic
Linus Torvalds <torvalds@linux-foundation.org>
disable new gcc-7.1.1 warnings for now
-------------
Diffstat:
Makefile | 7 +-
arch/mips/include/asm/branch.h | 5 +-
arch/mips/kernel/branch.c | 71 +++++++++-----------
arch/mips/kernel/proc.c | 2 +-
arch/mips/kernel/ptrace.c | 2 +-
arch/mips/kernel/scall32-o32.S | 2 +-
arch/mips/kernel/scall64-64.S | 2 +-
arch/mips/kernel/scall64-n32.S | 2 +-
arch/mips/kernel/scall64-o32.S | 2 +-
arch/mips/kernel/syscall.c | 15 ++++-
arch/mips/math-emu/cp1emu.c | 38 +++++++++++
arch/powerpc/include/asm/atomic.h | 4 +-
arch/powerpc/include/asm/reg.h | 2 +-
arch/powerpc/lib/sstep.c | 19 +++++-
arch/powerpc/mm/mmu_context_book3s64.c | 12 +++-
arch/powerpc/platforms/pseries/lpar.c | 11 ++-
arch/s390/include/asm/syscall.h | 6 ++
arch/x86/include/asm/xen/hypercall.h | 3 +
arch/x86/kernel/acpi/boot.c | 8 +++
arch/x86/kernel/apic/io_apic.c | 2 +-
arch/x86/pci/fixup.c | 32 +++++++++
drivers/acpi/ec.c | 21 +-----
drivers/acpi/nfit/core.c | 10 ++-
drivers/base/power/domain.c | 20 +++---
drivers/char/ipmi/ipmi_msghandler.c | 5 ++
drivers/char/ipmi/ipmi_ssif.c | 5 ++
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +
drivers/gpu/drm/drm_dp_mst_topology.c | 41 +++++++++---
drivers/gpu/drm/radeon/atombios_encoders.c | 13 +++-
drivers/gpu/drm/radeon/ci_dpm.c | 6 ++
drivers/gpu/drm/ttm/ttm_bo.c | 4 +-
drivers/infiniband/core/addr.c | 6 +-
drivers/infiniband/core/cma.c | 2 +
drivers/infiniband/hw/mlx5/mr.c | 2 +-
drivers/infiniband/ulp/iser/iscsi_iser.c | 11 +++
drivers/infiniband/ulp/isert/ib_isert.c | 2 +-
drivers/input/serio/i8042.c | 12 +++-
drivers/md/dm-mpath.c | 4 +-
drivers/md/raid1.c | 5 +-
drivers/md/raid5.c | 9 +--
drivers/media/pci/cx88/cx88-cards.c | 9 ++-
drivers/media/pci/cx88/cx88-video.c | 2 +-
drivers/media/platform/s5p-jpeg/jpeg-core.c | 8 +--
drivers/media/rc/imon.c | 2 +-
drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c | 4 +-
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 32 +++++----
drivers/media/usb/dvb-usb-v2/mxl111sf.h | 8 ++-
drivers/misc/enclosure.c | 14 ++--
drivers/net/ethernet/intel/igb/e1000_82575.c | 1 +
drivers/net/wireless/ath/ath9k/ar9003_phy.c | 2 -
drivers/net/wireless/ath/ath9k/rng.c | 4 +-
drivers/net/wireless/ath/ath9k/tx99.c | 13 ++--
drivers/net/wireless/ti/wlcore/spi.c | 6 +-
drivers/nfc/nfcmrvl/fw_dnld.c | 7 +-
drivers/nfc/nfcmrvl/main.c | 35 +++++-----
drivers/nfc/nfcmrvl/uart.c | 8 +--
drivers/nvdimm/btt.c | 9 ++-
drivers/nvdimm/core.c | 7 +-
drivers/nvme/host/rdma.c | 20 +++---
drivers/of/device.c | 2 +
drivers/pci/host/pcie-rockchip.c | 13 ++--
drivers/pci/pci-driver.c | 1 +
drivers/scsi/scsi_scan.c | 5 +-
drivers/scsi/scsi_sysfs.c | 8 ++-
drivers/spmi/spmi.c | 12 ++++
drivers/staging/comedi/drivers/ni_mio_common.c | 3 +-
.../staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 19 ++++--
drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 +
drivers/staging/sm750fb/sm750.c | 24 +++++++
drivers/target/iscsi/iscsi_target_configfs.c | 2 +
drivers/target/iscsi/iscsi_target_nego.c | 6 +-
drivers/target/iscsi/iscsi_target_parameters.c | 41 ++++++++----
drivers/target/iscsi/iscsi_target_parameters.h | 2 +-
drivers/target/iscsi/iscsi_target_tpg.c | 19 ++++++
drivers/target/iscsi/iscsi_target_tpg.h | 1 +
drivers/target/target_core_transport.c | 9 +++
drivers/thermal/cpu_cooling.c | 4 +-
drivers/thermal/max77620_thermal.c | 10 ++-
drivers/usb/class/cdc-acm.c | 3 +
drivers/usb/host/pci-quirks.c | 54 +++++++++++++++
drivers/usb/host/pci-quirks.h | 2 +
drivers/usb/host/xhci-hub.c | 3 +
drivers/usb/host/xhci-pci.c | 6 ++
drivers/usb/host/xhci-ring.c | 11 +--
drivers/usb/host/xhci.c | 6 ++
drivers/usb/host/xhci.h | 1 +
drivers/usb/renesas_usbhs/common.c | 4 +-
drivers/usb/renesas_usbhs/mod_gadget.c | 31 +++++++--
drivers/usb/storage/isd200.c | 5 +-
drivers/vfio/vfio.c | 46 ++++++++++++-
drivers/xen/xen-scsiback.c | 33 +++------
fs/btrfs/acl.c | 13 ++--
fs/ceph/dir.c | 5 ++
fs/ext2/acl.c | 36 ++++++----
fs/f2fs/acl.c | 2 +-
fs/f2fs/segment.c | 7 ++
fs/hfsplus/posix_acl.c | 30 +++++----
fs/nfs/dir.c | 12 ++--
fs/nfs/inode.c | 4 +-
fs/overlayfs/super.c | 9 ++-
fs/reiserfs/xattr_acl.c | 12 ++--
fs/ubifs/journal.c | 10 +--
fs/udf/inode.c | 4 +-
fs/xfs/xfs_acl.c | 6 +-
fs/xfs/xfs_acl.h | 1 +
fs/xfs/xfs_iops.c | 4 +-
include/linux/vfio.h | 2 +
include/scsi/scsi_device.h | 1 +
include/target/iscsi/iscsi_target_core.h | 9 +++
kernel/events/core.c | 21 ------
kernel/time/alarmtimer.c | 3 +-
kernel/trace/ftrace.c | 2 +-
kernel/trace/trace.c | 1 +
net/bluetooth/smp.c | 35 +++++-----
net/key/af_key.c | 47 +++++++------
net/netfilter/ipvs/ip_vs_core.c | 19 ++++--
net/nfc/core.c | 31 +++++----
net/nfc/llcp_sock.c | 9 +--
net/nfc/nci/core.c | 3 +-
net/nfc/netlink.c | 4 +-
net/sunrpc/auth_gss/gss_krb5_crypto.c | 3 +-
sound/soc/soc-compress.c | 6 +-
tools/perf/ui/browser.c | 2 +-
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 78 +++++++++++++++++-----
virt/kvm/vfio.c | 27 +++++---
125 files changed, 1026 insertions(+), 438 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 068/125] ipmi: use rcu lock around call to intf->handlers->sender() |
| Message-ID | <u7eMy-7zW-19@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Camuso <tcamuso@redhat.com>
commit cdea46566bb21ce309725a024208322a409055cc upstream.
A vendor with a system having more than 128 CPUs occasionally encounters
the following crash during shutdown. This is not an easily reproduceable
event, but the vendor was able to provide the following analysis of the
crash, which exhibits the same footprint each time.
crash> bt
PID: 0 TASK: ffff88017c70ce70 CPU: 5 COMMAND: "swapper/5"
#0 [ffff88085c143ac8] machine_kexec at ffffffff81059c8b
#1 [ffff88085c143b28] __crash_kexec at ffffffff811052e2
#2 [ffff88085c143bf8] crash_kexec at ffffffff811053d0
#3 [ffff88085c143c10] oops_end at ffffffff8168ef88
#4 [ffff88085c143c38] no_context at ffffffff8167ebb3
#5 [ffff88085c143c88] __bad_area_nosemaphore at ffffffff8167ec49
#6 [ffff88085c143cd0] bad_area_nosemaphore at ffffffff8167edb3
#7 [ffff88085c143ce0] __do_page_fault at ffffffff81691d1e
#8 [ffff88085c143d40] do_page_fault at ffffffff81691ec5
#9 [ffff88085c143d70] page_fault at ffffffff8168e188
[exception RIP: unknown or invalid address]
RIP: ffffffffa053c800 RSP: ffff88085c143e28 RFLAGS: 00010206
RAX: ffff88017c72bfd8 RBX: ffff88017a8dc000 RCX: ffff8810588b5ac8
RDX: ffff8810588b5a00 RSI: ffffffffa053c800 RDI: ffff8810588b5a00
RBP: ffff88085c143e58 R8: ffff88017c70d408 R9: ffff88017a8dc000
R10: 0000000000000002 R11: ffff88085c143da0 R12: ffff8810588b5ac8
R13: 0000000000000100 R14: ffffffffa053c800 R15: ffff8810588b5a00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
<IRQ stack>
[exception RIP: cpuidle_enter_state+82]
RIP: ffffffff81514192 RSP: ffff88017c72be50 RFLAGS: 00000202
RAX: 0000001e4c3c6f16 RBX: 000000000000f8a0 RCX: 0000000000000018
RDX: 0000000225c17d03 RSI: ffff88017c72bfd8 RDI: 0000001e4c3c6f16
RBP: ffff88017c72be78 R8: 000000000000237e R9: 0000000000000018
R10: 0000000000002494 R11: 0000000000000001 R12: ffff88017c72be20
R13: ffff88085c14f8e0 R14: 0000000000000082 R15: 0000001e4c3bb400
ORIG_RAX: ffffffffffffff10 CS: 0010 SS: 0018
This is the corresponding stack trace
It has crashed because the area pointed with RIP extracted from timer
element is already removed during a shutdown process.
The function is smi_timeout().
And we think ffff8810588b5a00 in RDX is a parameter struct smi_info
crash> rd ffff8810588b5a00 20
ffff8810588b5a00: ffff8810588b6000 0000000000000000 .`.X............
ffff8810588b5a10: ffff880853264400 ffffffffa05417e0 .D&S......T.....
ffff8810588b5a20: 24a024a000000000 0000000000000000 .....$.$........
ffff8810588b5a30: 0000000000000000 0000000000000000 ................
ffff8810588b5a30: 0000000000000000 0000000000000000 ................
ffff8810588b5a40: ffffffffa053a040 ffffffffa053a060 @.S.....`.S.....
ffff8810588b5a50: 0000000000000000 0000000100000001 ................
ffff8810588b5a60: 0000000000000000 0000000000000e00 ................
ffff8810588b5a70: ffffffffa053a580 ffffffffa053a6e0 ..S.......S.....
ffff8810588b5a80: ffffffffa053a4a0 ffffffffa053a250 ..S.....P.S.....
ffff8810588b5a90: 0000000500000002 0000000000000000 ................
Unfortunately the top of this area is already detroyed by someone.
But because of two reasonns we think this is struct smi_info
1) The address included in between ffff8810588b5a70 and ffff8810588b5a80:
are inside of ipmi_si_intf.c see crash> module ffff88085779d2c0
2) We've found the area which point this.
It is offset 0x68 of ffff880859df4000
crash> rd ffff880859df4000 100
ffff880859df4000: 0000000000000000 0000000000000001 ................
ffff880859df4010: ffffffffa0535290 dead000000000200 .RS.............
ffff880859df4020: ffff880859df4020 ffff880859df4020 @.Y.... @.Y....
ffff880859df4030: 0000000000000002 0000000000100010 ................
ffff880859df4040: ffff880859df4040 ffff880859df4040 @@.Y....@@.Y....
ffff880859df4050: 0000000000000000 0000000000000000 ................
ffff880859df4060: 0000000000000000 ffff8810588b5a00 .........Z.X....
ffff880859df4070: 0000000000000001 ffff880859df4078 ........x@.Y....
If we regards it as struct ipmi_smi in shutdown process
it looks consistent.
The remedy for this apparent race is affixed below.
Signed-off-by: Tony Camuso <tcamuso@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This was first introduced in 7ea0ed2b5be817 ipmi: Make the
message handler easier to use for SMI interfaces
where some code was moved outside of the rcu_read_lock()
and the lock was not added.
Signed-off-by: Corey Minyard <cminyard@mvista.com>
---
drivers/char/ipmi/ipmi_msghandler.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -3877,6 +3877,9 @@ static void smi_recv_tasklet(unsigned lo
* because the lower layer is allowed to hold locks while calling
* message delivery.
*/
+
+ rcu_read_lock();
+
if (!run_to_completion)
spin_lock_irqsave(&intf->xmit_msgs_lock, flags);
if (intf->curr_msg == NULL && !intf->in_shutdown) {
@@ -3899,6 +3902,8 @@ static void smi_recv_tasklet(unsigned lo
if (newmsg)
intf->handlers->sender(intf->send_info, newmsg);
+ rcu_read_unlock();
+
handle_new_recv_msgs(intf);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 046/125] PCI: rockchip: Use normal register bank for config accessors |
| Message-ID | <u7eMy-7zW-23@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shawn Lin <shawn.lin@rock-chips.com>
commit dc8cca5ef25ac4cb0dfc37467521a759767ff361 upstream.
Rockchip's RC has two banks of registers for the root port: a normal bank
that is strictly compatible with the PCIe spec, and a privileged bank that
can be used to change RO bits of root port registers.
When probing the RC driver, we use the privileged bank to do some basic
setup work as some RO bits are hw-inited to wrong value. But we didn't
change to the normal bank after probing the driver.
This leads to a serious problem when the PME code tries to clear the PME
status by writing PCI_EXP_RTSTA_PME to the register of PCI_EXP_RTSTA. Per
PCIe 3.0 spec, section 7.8.14, the PME status bit is RW1C. So the PME code
is doing the right thing to clear the PME status but we find the RC doesn't
clear it but actually setting it to one. So finally the system trap in
pcie_pme_work_fn() as PCI_EXP_RTSTA_PME is true now forever. This issue
can be reproduced by booting kernel with pci=nomsi.
Use the normal register bank for the PCI config accessors. The privileged
bank is used only internally by this driver.
Fixes: e77f847d ("PCI: rockchip: Add Rockchip PCIe controller support")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: Jeffy Chen <jeffy.chen@rock-chips.com>
Cc: Brian Norris <briannorris@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/host/pcie-rockchip.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
--- a/drivers/pci/host/pcie-rockchip.c
+++ b/drivers/pci/host/pcie-rockchip.c
@@ -131,6 +131,7 @@
PCIE_CORE_INT_CT | PCIE_CORE_INT_UTC | \
PCIE_CORE_INT_MMVC)
+#define PCIE_RC_CONFIG_NORMAL_BASE 0x800000
#define PCIE_RC_CONFIG_BASE 0xa00000
#define PCIE_RC_CONFIG_VENDOR (PCIE_RC_CONFIG_BASE + 0x00)
#define PCIE_RC_CONFIG_RID_CCR (PCIE_RC_CONFIG_BASE + 0x08)
@@ -267,7 +268,9 @@ static int rockchip_pcie_valid_device(st
static int rockchip_pcie_rd_own_conf(struct rockchip_pcie *rockchip,
int where, int size, u32 *val)
{
- void __iomem *addr = rockchip->apb_base + PCIE_RC_CONFIG_BASE + where;
+ void __iomem *addr;
+
+ addr = rockchip->apb_base + PCIE_RC_CONFIG_NORMAL_BASE + where;
if (!IS_ALIGNED((uintptr_t)addr, size)) {
*val = 0;
@@ -291,11 +294,13 @@ static int rockchip_pcie_wr_own_conf(str
int where, int size, u32 val)
{
u32 mask, tmp, offset;
+ void __iomem *addr;
offset = where & ~0x3;
+ addr = rockchip->apb_base + PCIE_RC_CONFIG_NORMAL_BASE + offset;
if (size == 4) {
- writel(val, rockchip->apb_base + PCIE_RC_CONFIG_BASE + offset);
+ writel(val, addr);
return PCIBIOS_SUCCESSFUL;
}
@@ -306,9 +311,9 @@ static int rockchip_pcie_wr_own_conf(str
* corrupt RW1C bits in adjacent registers. But the hardware
* doesn't support smaller writes.
*/
- tmp = readl(rockchip->apb_base + PCIE_RC_CONFIG_BASE + offset) & mask;
+ tmp = readl(addr) & mask;
tmp |= val << ((where & 0x3) * 8);
- writel(tmp, rockchip->apb_base + PCIE_RC_CONFIG_BASE + offset);
+ writel(tmp, addr);
return PCIBIOS_SUCCESSFUL;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 042/125] powerpc/asm: Mark cr0 as clobbered in mftb() |
| Message-ID | <u7eMy-7zW-21@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver O'Halloran <oohall@gmail.com>
commit 2400fd822f467cb4c886c879d8ad99feac9cf319 upstream.
The workaround for the CELL timebase bug does not correctly mark cr0 as
being clobbered. This means GCC doesn't know that the asm block changes cr0 and
might leave the result of an unrelated comparison in cr0 across the block, which
we then trash, leading to basically random behaviour.
Fixes: 859deea949c3 ("[POWERPC] Cell timebase bug workaround")
Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
[mpe: Tweak change log and flag for stable]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/include/asm/reg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -1283,7 +1283,7 @@ static inline void msr_check_and_clear(u
" .llong 0\n" \
".previous" \
: "=r" (rval) \
- : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \
+ : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \
rval;})
#else
#define mftb() ({unsigned long rval; \
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 035/125] scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state |
| Message-ID | <u7eMy-7zW-27@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <emilne@redhat.com>
commit f9279c968c257ee39b0d7bd2571a4d231a67bcc1 upstream.
The addition of the STARGET_REMOVE state had the side effect of
introducing a race condition that can cause a crash.
scsi_target_reap_ref_release() checks the starget->state to
see if it still in STARGET_CREATED, and if so, skips calling
transport_remove_device() and device_del(), because the starget->state
is only set to STARGET_RUNNING after scsi_target_add() has called
device_add() and transport_add_device().
However, if an rport loss occurs while a target is being scanned,
it can happen that scsi_remove_target() will be called while the
starget is still in the STARGET_CREATED state. In this case, the
starget->state will be set to STARGET_REMOVE, and as a result,
scsi_target_reap_ref_release() will take the wrong path. The end
result is a panic:
[ 1255.356653] Oops: 0000 [#1] SMP
[ 1255.360154] Modules linked in: x86_pkg_temp_thermal kvm_intel kvm irqbypass crc32c_intel ghash_clmulni_i
[ 1255.393234] CPU: 5 PID: 149 Comm: kworker/u96:4 Tainted: G W 4.11.0+ #8
[ 1255.401879] Hardware name: Dell Inc. PowerEdge R320/08VT7V, BIOS 2.0.22 11/19/2013
[ 1255.410327] Workqueue: scsi_wq_6 fc_scsi_scan_rport [scsi_transport_fc]
[ 1255.417720] task: ffff88060ca8c8c0 task.stack: ffffc900048a8000
[ 1255.424331] RIP: 0010:kernfs_find_ns+0x13/0xc0
[ 1255.429287] RSP: 0018:ffffc900048abbf0 EFLAGS: 00010246
[ 1255.435123] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 1255.443083] RDX: 0000000000000000 RSI: ffffffff8188d659 RDI: 0000000000000000
[ 1255.451043] RBP: ffffc900048abc10 R08: 0000000000000000 R09: 0000012433fe0025
[ 1255.459005] R10: 0000000025e5a4b5 R11: 0000000025e5a4b5 R12: ffffffff8188d659
[ 1255.466972] R13: 0000000000000000 R14: ffff8805f55e5088 R15: 0000000000000000
[ 1255.474931] FS: 0000000000000000(0000) GS:ffff880616b40000(0000) knlGS:0000000000000000
[ 1255.483959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1255.490370] CR2: 0000000000000068 CR3: 0000000001c09000 CR4: 00000000000406e0
[ 1255.498332] Call Trace:
[ 1255.501058] kernfs_find_and_get_ns+0x31/0x60
[ 1255.505916] sysfs_unmerge_group+0x1d/0x60
[ 1255.510498] dpm_sysfs_remove+0x22/0x60
[ 1255.514783] device_del+0xf4/0x2e0
[ 1255.518577] ? device_remove_file+0x19/0x20
[ 1255.523241] attribute_container_class_device_del+0x1a/0x20
[ 1255.529457] transport_remove_classdev+0x4e/0x60
[ 1255.534607] ? transport_add_class_device+0x40/0x40
[ 1255.540046] attribute_container_device_trigger+0xb0/0xc0
[ 1255.546069] transport_remove_device+0x15/0x20
[ 1255.551025] scsi_target_reap_ref_release+0x25/0x40
[ 1255.556467] scsi_target_reap+0x2e/0x40
[ 1255.560744] __scsi_scan_target+0xaa/0x5b0
[ 1255.565312] scsi_scan_target+0xec/0x100
[ 1255.569689] fc_scsi_scan_rport+0xb1/0xc0 [scsi_transport_fc]
[ 1255.576099] process_one_work+0x14b/0x390
[ 1255.580569] worker_thread+0x4b/0x390
[ 1255.584651] kthread+0x109/0x140
[ 1255.588251] ? rescuer_thread+0x330/0x330
[ 1255.592730] ? kthread_park+0x60/0x60
[ 1255.596815] ret_from_fork+0x29/0x40
[ 1255.600801] Code: 24 08 48 83 42 40 01 5b 41 5c 5d c3 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90
[ 1255.621876] RIP: kernfs_find_ns+0x13/0xc0 RSP: ffffc900048abbf0
[ 1255.628479] CR2: 0000000000000068
[ 1255.632756] ---[ end trace 34a69ba0477d036f ]---
Fix this by adding another scsi_target state STARGET_CREATED_REMOVE
to distinguish this case.
Fixes: f05795d3d771 ("scsi: Add intermediate STARGET_REMOVE state to scsi_target_state")
Reported-by: David Jeffery <djeffery@redhat.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_scan.c | 5 +++--
drivers/scsi/scsi_sysfs.c | 8 ++++++--
include/scsi/scsi_device.h | 1 +
3 files changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -384,11 +384,12 @@ static void scsi_target_reap_ref_release
= container_of(kref, struct scsi_target, reap_ref);
/*
- * if we get here and the target is still in the CREATED state that
+ * if we get here and the target is still in a CREATED state that
* means it was allocated but never made visible (because a scan
* turned up no LUNs), so don't call device_del() on it.
*/
- if (starget->state != STARGET_CREATED) {
+ if ((starget->state != STARGET_CREATED) &&
+ (starget->state != STARGET_CREATED_REMOVE)) {
transport_remove_device(&starget->dev);
device_del(&starget->dev);
}
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1370,11 +1370,15 @@ restart:
spin_lock_irqsave(shost->host_lock, flags);
list_for_each_entry(starget, &shost->__targets, siblings) {
if (starget->state == STARGET_DEL ||
- starget->state == STARGET_REMOVE)
+ starget->state == STARGET_REMOVE ||
+ starget->state == STARGET_CREATED_REMOVE)
continue;
if (starget->dev.parent == dev || &starget->dev == dev) {
kref_get(&starget->reap_ref);
- starget->state = STARGET_REMOVE;
+ if (starget->state == STARGET_CREATED)
+ starget->state = STARGET_CREATED_REMOVE;
+ else
+ starget->state = STARGET_REMOVE;
spin_unlock_irqrestore(shost->host_lock, flags);
__scsi_remove_target(starget);
scsi_target_reap(starget);
--- a/include/scsi/scsi_device.h
+++ b/include/scsi/scsi_device.h
@@ -248,6 +248,7 @@ enum scsi_target_state {
STARGET_CREATED = 1,
STARGET_RUNNING,
STARGET_REMOVE,
+ STARGET_CREATED_REMOVE,
STARGET_DEL,
};
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 044/125] af_key: Fix sadb_x_ipsecrequest parsing |
| Message-ID | <u7eMz-7zW-33@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
commit 096f41d3a8fcbb8dde7f71379b1ca85fe213eded upstream.
The parsing of sadb_x_ipsecrequest is broken in a number of ways.
First of all we're not verifying sadb_x_ipsecrequest_len. This
is needed when the structure carries addresses at the end. Worse
we don't even look at the length when we parse those optional
addresses.
The migration code had similar parsing code that's better but
it also has some deficiencies. The length is overcounted first
of all as it includes the header itself. It also fails to check
the length before dereferencing the sa_family field.
This patch fixes those problems in parse_sockaddr_pair and then
uses it in parse_ipsecrequest.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/key/af_key.c | 47 ++++++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 21 deletions(-)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -65,6 +65,10 @@ struct pfkey_sock {
} dump;
};
+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
+ xfrm_address_t *saddr, xfrm_address_t *daddr,
+ u16 *family);
+
static inline struct pfkey_sock *pfkey_sk(struct sock *sk)
{
return (struct pfkey_sock *)sk;
@@ -1922,19 +1926,14 @@ parse_ipsecrequest(struct xfrm_policy *x
/* addresses present only in tunnel mode */
if (t->mode == XFRM_MODE_TUNNEL) {
- u8 *sa = (u8 *) (rq + 1);
- int family, socklen;
+ int err;
- family = pfkey_sockaddr_extract((struct sockaddr *)sa,
- &t->saddr);
- if (!family)
- return -EINVAL;
-
- socklen = pfkey_sockaddr_len(family);
- if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen),
- &t->id.daddr) != family)
- return -EINVAL;
- t->encap_family = family;
+ err = parse_sockaddr_pair(
+ (struct sockaddr *)(rq + 1),
+ rq->sadb_x_ipsecrequest_len - sizeof(*rq),
+ &t->saddr, &t->id.daddr, &t->encap_family);
+ if (err)
+ return err;
} else
t->encap_family = xp->family;
@@ -1954,7 +1953,11 @@ parse_ipsecrequests(struct xfrm_policy *
if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy))
return -EINVAL;
- while (len >= sizeof(struct sadb_x_ipsecrequest)) {
+ while (len >= sizeof(*rq)) {
+ if (len < rq->sadb_x_ipsecrequest_len ||
+ rq->sadb_x_ipsecrequest_len < sizeof(*rq))
+ return -EINVAL;
+
if ((err = parse_ipsecrequest(xp, rq)) < 0)
return err;
len -= rq->sadb_x_ipsecrequest_len;
@@ -2417,7 +2420,6 @@ out:
return err;
}
-#ifdef CONFIG_NET_KEY_MIGRATE
static int pfkey_sockaddr_pair_size(sa_family_t family)
{
return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2);
@@ -2429,7 +2431,7 @@ static int parse_sockaddr_pair(struct so
{
int af, socklen;
- if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
+ if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family))
return -EINVAL;
af = pfkey_sockaddr_extract(sa, saddr);
@@ -2445,6 +2447,7 @@ static int parse_sockaddr_pair(struct so
return 0;
}
+#ifdef CONFIG_NET_KEY_MIGRATE
static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len,
struct xfrm_migrate *m)
{
@@ -2452,13 +2455,14 @@ static int ipsecrequests_to_migrate(stru
struct sadb_x_ipsecrequest *rq2;
int mode;
- if (len <= sizeof(struct sadb_x_ipsecrequest) ||
- len < rq1->sadb_x_ipsecrequest_len)
+ if (len < sizeof(*rq1) ||
+ len < rq1->sadb_x_ipsecrequest_len ||
+ rq1->sadb_x_ipsecrequest_len < sizeof(*rq1))
return -EINVAL;
/* old endoints */
err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1),
- rq1->sadb_x_ipsecrequest_len,
+ rq1->sadb_x_ipsecrequest_len - sizeof(*rq1),
&m->old_saddr, &m->old_daddr,
&m->old_family);
if (err)
@@ -2467,13 +2471,14 @@ static int ipsecrequests_to_migrate(stru
rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len);
len -= rq1->sadb_x_ipsecrequest_len;
- if (len <= sizeof(struct sadb_x_ipsecrequest) ||
- len < rq2->sadb_x_ipsecrequest_len)
+ if (len <= sizeof(*rq2) ||
+ len < rq2->sadb_x_ipsecrequest_len ||
+ rq2->sadb_x_ipsecrequest_len < sizeof(*rq2))
return -EINVAL;
/* new endpoints */
err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1),
- rq2->sadb_x_ipsecrequest_len,
+ rq2->sadb_x_ipsecrequest_len - sizeof(*rq2),
&m->new_saddr, &m->new_daddr,
&m->new_family);
if (err)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 037/125] xen/scsiback: Fix a TMR related use-after-free |
| Message-ID | <u7eMz-7zW-31@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@sandisk.com>
commit 9f4ab18ac51dc87345a9cbd2527e6acf7a0a9335 upstream.
scsiback_release_cmd() must not dereference se_cmd->se_tmr_req
because that memory is freed by target_free_cmd_mem() before
scsiback_release_cmd() is called. Fix this use-after-free by
inlining struct scsiback_tmr into struct vscsibk_pend.
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.com>
Cc: David Disseldorp <ddiss@suse.de>
Cc: xen-devel@lists.xenproject.org
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-scsiback.c | 33 +++++++++------------------------
1 file changed, 9 insertions(+), 24 deletions(-)
--- a/drivers/xen/xen-scsiback.c
+++ b/drivers/xen/xen-scsiback.c
@@ -134,9 +134,7 @@ struct vscsibk_pend {
struct page *pages[VSCSI_MAX_GRANTS];
struct se_cmd se_cmd;
-};
-struct scsiback_tmr {
atomic_t tmr_complete;
wait_queue_head_t tmr_wait;
};
@@ -599,26 +597,20 @@ static void scsiback_device_action(struc
struct scsiback_tpg *tpg = pending_req->v2p->tpg;
struct scsiback_nexus *nexus = tpg->tpg_nexus;
struct se_cmd *se_cmd = &pending_req->se_cmd;
- struct scsiback_tmr *tmr;
u64 unpacked_lun = pending_req->v2p->lun;
int rc, err = FAILED;
- tmr = kzalloc(sizeof(struct scsiback_tmr), GFP_KERNEL);
- if (!tmr) {
- target_put_sess_cmd(se_cmd);
- goto err;
- }
-
- init_waitqueue_head(&tmr->tmr_wait);
+ init_waitqueue_head(&pending_req->tmr_wait);
rc = target_submit_tmr(&pending_req->se_cmd, nexus->tvn_se_sess,
&pending_req->sense_buffer[0],
- unpacked_lun, tmr, act, GFP_KERNEL,
+ unpacked_lun, NULL, act, GFP_KERNEL,
tag, TARGET_SCF_ACK_KREF);
if (rc)
goto err;
- wait_event(tmr->tmr_wait, atomic_read(&tmr->tmr_complete));
+ wait_event(pending_req->tmr_wait,
+ atomic_read(&pending_req->tmr_complete));
err = (se_cmd->se_tmr_req->response == TMR_FUNCTION_COMPLETE) ?
SUCCESS : FAILED;
@@ -626,9 +618,8 @@ static void scsiback_device_action(struc
scsiback_do_resp_with_sense(NULL, err, 0, pending_req);
transport_generic_free_cmd(&pending_req->se_cmd, 1);
return;
+
err:
- if (tmr)
- kfree(tmr);
scsiback_do_resp_with_sense(NULL, err, 0, pending_req);
}
@@ -1389,12 +1380,6 @@ static int scsiback_check_stop_free(stru
static void scsiback_release_cmd(struct se_cmd *se_cmd)
{
struct se_session *se_sess = se_cmd->se_sess;
- struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
-
- if (se_tmr && se_cmd->se_cmd_flags & SCF_SCSI_TMR_CDB) {
- struct scsiback_tmr *tmr = se_tmr->fabric_tmr_ptr;
- kfree(tmr);
- }
percpu_ida_free(&se_sess->sess_tag_pool, se_cmd->map_tag);
}
@@ -1455,11 +1440,11 @@ static int scsiback_queue_status(struct
static void scsiback_queue_tm_rsp(struct se_cmd *se_cmd)
{
- struct se_tmr_req *se_tmr = se_cmd->se_tmr_req;
- struct scsiback_tmr *tmr = se_tmr->fabric_tmr_ptr;
+ struct vscsibk_pend *pending_req = container_of(se_cmd,
+ struct vscsibk_pend, se_cmd);
- atomic_set(&tmr->tmr_complete, 1);
- wake_up(&tmr->tmr_wait);
+ atomic_set(&pending_req->tmr_complete, 1);
+ wake_up(&pending_req->tmr_wait);
}
static void scsiback_aborted_task(struct se_cmd *se_cmd)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 053/125] usb: storage: return on error to avoid a null pointer dereference |
| Message-ID | <u7eMy-7zW-25@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 446230f52a5bef593554510302465eabab45a372 upstream.
When us->extra is null the driver is not initialized, however, a
later call to osd200_scsi_to_ata is made that dereferences
us->extra, causing a null pointer dereference. The code
currently detects and reports that the driver is not initialized;
add a return to avoid the subsequent dereference issue in this
check.
Thanks to Alan Stern for pointing out that srb->result needs setting
to DID_ERROR << 16
Detected by CoverityScan, CID#100308 ("Dereference after null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/isd200.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1529,8 +1529,11 @@ static void isd200_ata_command(struct sc
/* Make sure driver was initialized */
- if (us->extra == NULL)
+ if (us->extra == NULL) {
usb_stor_dbg(us, "ERROR Driver not initialized\n");
+ srb->result = DID_ERROR << 16;
+ return;
+ }
scsi_set_resid(srb, 0);
/* scsi_bufflen might change in protocol translation to ata */
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 030/125] ASoC: compress: Derive substream from stream based on direction |
| Message-ID | <u7eMy-7zW-29@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satish Babu Patakokila <sbpata@codeaurora.org>
commit 01b8cedfd0422326caae308641dcadaa85e0ca72 upstream.
Currently compress driver hardcodes direction as playback to get
substream from the stream. This results in getting the incorrect
substream for compressed capture usecase.
To fix this, remove the hardcoding and derive substream based on
the stream direction.
Signed-off-by: Satish Babu Patakokila <sbpata@codeaurora.org>
Signed-off-by: Banajit Goswami <bgoswami@codeaurora.org>
Acked-By: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/soc-compress.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/sound/soc/soc-compress.c
+++ b/sound/soc/soc-compress.c
@@ -68,7 +68,8 @@ out:
static int soc_compr_open_fe(struct snd_compr_stream *cstream)
{
struct snd_soc_pcm_runtime *fe = cstream->private_data;
- struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+ struct snd_pcm_substream *fe_substream =
+ fe->pcm->streams[cstream->direction].substream;
struct snd_soc_platform *platform = fe->platform;
struct snd_soc_dpcm *dpcm;
struct snd_soc_dapm_widget_list *list;
@@ -414,7 +415,8 @@ static int soc_compr_set_params_fe(struc
struct snd_compr_params *params)
{
struct snd_soc_pcm_runtime *fe = cstream->private_data;
- struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream;
+ struct snd_pcm_substream *fe_substream =
+ fe->pcm->streams[cstream->direction].substream;
struct snd_soc_platform *platform = fe->platform;
int ret = 0, stream;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 008/125] ath9k: fix tx99 bus error |
| Message-ID | <u7eMz-7zW-35@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <miaoqing@codeaurora.org>
commit bde717ab473668377fc65872398a102d40cb2d58 upstream.
The hard coded register 0x9864 and 0x9924 are invalid
for ar9300 chips.
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/ar9003_phy.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -1821,8 +1821,6 @@ static void ar9003_hw_spectral_scan_wait
static void ar9003_hw_tx99_start(struct ath_hw *ah, u32 qnum)
{
REG_SET_BIT(ah, AR_PHY_TEST, PHY_AGC_CLR);
- REG_SET_BIT(ah, 0x9864, 0x7f000);
- REG_SET_BIT(ah, 0x9924, 0x7f00fe);
REG_CLR_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_DIS);
REG_WRITE(ah, AR_CR, AR_CR_RXD);
REG_WRITE(ah, AR_DLCL_IFS(qnum), 0);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 027/125] wlcore: fix 64K page support |
| Message-ID | <u7eMz-7zW-37@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnd Bergmann <arnd@arndb.de> commit 4a4274bf2dbbd1c7a45be0c89a1687c9d2eef4a0 upstream. In the stable linux-3.16 branch, I ran into a warning in the wlcore driver: drivers/net/wireless/ti/wlcore/spi.c: In function 'wl12xx_spi_raw_write': drivers/net/wireless/ti/wlcore/spi.c:315:1: error: the frame size of 12848 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Newer kernels no longer show the warning, but the bug is still there, as the allocation is based on the CPU page size rather than the actual capabilities of the hardware. This replaces the PAGE_SIZE macro with the SZ_4K macro, i.e. 4096 bytes per buffer. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/net/wireless/ti/wlcore/spi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/ti/wlcore/spi.c +++ b/drivers/net/wireless/ti/wlcore/spi.c @@ -70,10 +70,10 @@ #define WSPI_MAX_CHUNK_SIZE 4092 /* - * wl18xx driver aggregation buffer size is (13 * PAGE_SIZE) compared to - * (4 * PAGE_SIZE) for wl12xx, so use the larger buffer needed for wl18xx + * wl18xx driver aggregation buffer size is (13 * 4K) compared to + * (4 * 4K) for wl12xx, so use the larger buffer needed for wl18xx */ -#define SPI_AGGR_BUFFER_SIZE (13 * PAGE_SIZE) +#define SPI_AGGR_BUFFER_SIZE (13 * SZ_4K) /* Maximum number of SPI write chunks */ #define WSPI_MAX_NUM_OF_CHUNKS \
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 056/125] usb: renesas_usbhs: gadget: disable all eps when the driver stops |
| Message-ID | <u7eMz-7zW-39@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit b8b9c974afee685789fcbb191b52d1790be3608c upstream.
A gadget driver will not disable eps immediately when ->disconnect()
is called. But, since this driver assumes all eps stop after
the ->disconnect(), unexpected behavior happens (especially in system
suspend).
So, this patch disables all eps in usbhsg_try_stop(). After disabling
eps by renesas_usbhs driver, since some functions will be called by
both a gadget and renesas_usbhs driver, renesas_usbhs driver should
protect uep->pipe. To protect uep->pipe easily, this patch adds a new
lock in struct usbhsg_uep.
Fixes: 2f98382dc ("usb: renesas_usbhs: Add Renesas USBHS Gadget")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/mod_gadget.c | 31 ++++++++++++++++++++++++-------
1 file changed, 24 insertions(+), 7 deletions(-)
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -37,6 +37,7 @@ struct usbhsg_gpriv;
struct usbhsg_uep {
struct usb_ep ep;
struct usbhs_pipe *pipe;
+ spinlock_t lock; /* protect the pipe */
char ep_name[EP_NAME_SIZE];
@@ -636,10 +637,16 @@ usbhsg_ep_enable_end:
static int usbhsg_ep_disable(struct usb_ep *ep)
{
struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
- struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+ struct usbhs_pipe *pipe;
+ unsigned long flags;
+ int ret = 0;
- if (!pipe)
- return -EINVAL;
+ spin_lock_irqsave(&uep->lock, flags);
+ pipe = usbhsg_uep_to_pipe(uep);
+ if (!pipe) {
+ ret = -EINVAL;
+ goto out;
+ }
usbhsg_pipe_disable(uep);
usbhs_pipe_free(pipe);
@@ -647,6 +654,9 @@ static int usbhsg_ep_disable(struct usb_
uep->pipe->mod_private = NULL;
uep->pipe = NULL;
+out:
+ spin_unlock_irqrestore(&uep->lock, flags);
+
return 0;
}
@@ -696,8 +706,11 @@ static int usbhsg_ep_dequeue(struct usb_
{
struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
struct usbhsg_request *ureq = usbhsg_req_to_ureq(req);
- struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep);
+ struct usbhs_pipe *pipe;
+ unsigned long flags;
+ spin_lock_irqsave(&uep->lock, flags);
+ pipe = usbhsg_uep_to_pipe(uep);
if (pipe)
usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq));
@@ -706,6 +719,7 @@ static int usbhsg_ep_dequeue(struct usb_
* even if the pipe is NULL.
*/
usbhsg_queue_pop(uep, ureq, -ECONNRESET);
+ spin_unlock_irqrestore(&uep->lock, flags);
return 0;
}
@@ -852,10 +866,10 @@ static int usbhsg_try_stop(struct usbhs_
{
struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv);
struct usbhs_mod *mod = usbhs_mod_get_current(priv);
- struct usbhsg_uep *dcp = usbhsg_gpriv_to_dcp(gpriv);
+ struct usbhsg_uep *uep;
struct device *dev = usbhs_priv_to_dev(priv);
unsigned long flags;
- int ret = 0;
+ int ret = 0, i;
/******************** spin lock ********************/
usbhs_lock(priv, flags);
@@ -887,7 +901,9 @@ static int usbhsg_try_stop(struct usbhs_
usbhs_sys_set_test_mode(priv, 0);
usbhs_sys_function_ctrl(priv, 0);
- usbhsg_ep_disable(&dcp->ep);
+ /* disable all eps */
+ usbhsg_for_each_uep_with_dcp(uep, gpriv, i)
+ usbhsg_ep_disable(&uep->ep);
dev_dbg(dev, "stop gadget\n");
@@ -1069,6 +1085,7 @@ int usbhs_mod_gadget_probe(struct usbhs_
ret = -ENOMEM;
goto usbhs_mod_gadget_probe_err_gpriv;
}
+ spin_lock_init(&uep->lock);
gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED);
dev_info(dev, "%stransceiver found\n",
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 047/125] PCI/PM: Restore the status of PCI devices across hibernation |
| Message-ID | <u7eMz-7zW-41@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <yu.c.chen@intel.com>
commit e60514bd4485c0c7c5a7cf779b200ce0b95c70d6 upstream.
Currently we saw a lot of "No irq handler" errors during hibernation, which
caused the system hang finally:
ata4.00: qc timeout (cmd 0xec)
ata4.00: failed to IDENTIFY (I/O error, err_mask=0x4)
ata4.00: revalidation failed (errno=-5)
ata4: SATA link up 6.0 Gbps (SStatus 133 SControl 300)
do_IRQ: 31.151 No irq handler for vector
According to above logs, there is an interrupt triggered and it is
dispatched to CPU31 with a vector number 151, but there is no handler for
it, thus this IRQ will not get acked and will cause an IRQ flood which
kills the system. To be more specific, the 31.151 is an interrupt from the
AHCI host controller.
After some investigation, the reason why this issue is triggered is because
the thaw_noirq() function does not restore the MSI/MSI-X settings across
hibernation.
The scenario is illustrated below:
1. Before hibernation, IRQ 34 is the handler for the AHCI device, which
is bound to CPU31.
2. Hibernation starts, the AHCI device is put into low power state.
3. All the nonboot CPUs are put offline, so IRQ 34 has to be migrated to
the last alive one - CPU0.
4. After the snapshot has been created, all the nonboot CPUs are brought
up again; IRQ 34 remains bound to CPU0.
5. AHCI devices are put into D0.
6. The snapshot is written to the disk.
The issue is triggered in step 6. The AHCI interrupt should be delivered
to CPU0, however it is delivered to the original CPU31 instead, which
causes the "No irq handler" issue.
Ying Huang has provided a clue that, in step 3 it is possible that writing
to the register might not take effect as the PCI devices have been
suspended.
In step 3, the IRQ 34 affinity should be modified from CPU31 to CPU0, but
in fact it is not. In __pci_write_msi_msg(), if the device is already in
low power state, the low level MSI message entry will not be updated but
cached. During the device restore process after a normal suspend/resume,
pci_restore_msi_state() writes the cached MSI back to the hardware.
But this is not the case for hibernation. pci_restore_msi_state() is not
currently called in pci_pm_thaw_noirq(), although pci_save_state() has
saved the necessary PCI cached information in pci_pm_freeze_noirq().
Restore the PCI status for the device during hibernation. Otherwise the
status might be lost across hibernation (for example, settings for MSI,
MSI-X, ATS, ACS, IOV, etc.), which might cause problems during hibernation.
Suggested-by: Ying Huang <ying.huang@intel.com>
Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
[bhelgaas: changelog]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Rui Zhang <rui.zhang@intel.com>
Cc: Ying Huang <ying.huang@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/pci-driver.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -954,6 +954,7 @@ static int pci_pm_thaw_noirq(struct devi
return pci_legacy_resume_early(dev);
pci_update_current_state(pci_dev, PCI_D0);
+ pci_restore_state(pci_dev);
if (drv && drv->pm && drv->pm->thaw_noirq)
error = drv->pm->thaw_noirq(dev);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 049/125] xhci: fix 20000ms port resume timeout |
| Message-ID | <u7eMz-7zW-47@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mathias Nyman <mathias.nyman@linux.intel.com> commit a54408d0a004757789863d74e29c2297edae0b4d upstream. A uncleared PLC (port link change) bit will prevent furuther port event interrupts for that port. Leaving it uncleared caused get_port_status() to timeout after 20000ms while waiting to get the final port event interrupt for resume -> U0 state change. This is a targeted fix for a specific case where we get a port resume event racing with xhci resume. The port event interrupt handler notices xHC is not yet running and bails out early, leaving PLC uncleared. The whole xhci port resuming needs more attention, but while working on it it anyways makes sense to always ensure PLC is cleared in get_port_status before setting a new link state and waiting for its completion. Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/usb/host/xhci-hub.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -783,6 +783,9 @@ static u32 xhci_get_port_status(struct u clear_bit(wIndex, &bus_state->resuming_ports); set_bit(wIndex, &bus_state->rexit_ports); + + xhci_test_and_clear_bit(xhci, port_array, wIndex, + PORT_PLC); xhci_set_link_state(xhci, port_array, wIndex, XDEV_U0);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 028/125] btrfs: Dont clear SGID when inheriting ACLs |
| Message-ID | <u7eMz-7zW-49@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit b7f8a09f8097db776b8d160862540e4fc1f51296 upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit
set, DIR1 is expected to have SGID bit set (and owning group equal to
the owning group of 'DIR0'). However when 'DIR0' also has some default
ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on
'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by moving posix_acl_update_mode() out of
__btrfs_set_acl() into btrfs_set_acl(). That way the function will not be
called when inheriting ACLs which is what we want as it prevents SGID
bit clearing and the mode has been properly set by posix_acl_create()
anyway.
Fixes: 073931017b49d9458aa351605b43a7e34598caef
CC: linux-btrfs@vger.kernel.org
CC: David Sterba <dsterba@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/acl.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
--- a/fs/btrfs/acl.c
+++ b/fs/btrfs/acl.c
@@ -78,12 +78,6 @@ static int __btrfs_set_acl(struct btrfs_
switch (type) {
case ACL_TYPE_ACCESS:
name = XATTR_NAME_POSIX_ACL_ACCESS;
- if (acl) {
- ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
- if (ret)
- return ret;
- }
- ret = 0;
break;
case ACL_TYPE_DEFAULT:
if (!S_ISDIR(inode->i_mode))
@@ -119,6 +113,13 @@ out:
int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
{
+ int ret;
+
+ if (type == ACL_TYPE_ACCESS && acl) {
+ ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+ if (ret)
+ return ret;
+ }
return __btrfs_set_acl(NULL, inode, acl, type);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 033/125] PM / Domains: Fix unsafe iteration over modified list of domains |
| Message-ID | <u7eMz-7zW-51@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzk@kernel.org>
commit a7e2d1bce4c1db471f1cbc0c4666a3112bbf0994 upstream.
of_genpd_remove_last() iterates over list of domains and removes
matching element thus it has to use safe version of list iteration.
Fixes: 17926551c98a (PM / Domains: Add support for removing nested PM domains by provider)
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Acked-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/domain.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -1752,14 +1752,14 @@ EXPORT_SYMBOL_GPL(of_genpd_add_subdomain
*/
struct generic_pm_domain *of_genpd_remove_last(struct device_node *np)
{
- struct generic_pm_domain *gpd, *genpd = ERR_PTR(-ENOENT);
+ struct generic_pm_domain *gpd, *tmp, *genpd = ERR_PTR(-ENOENT);
int ret;
if (IS_ERR_OR_NULL(np))
return ERR_PTR(-EINVAL);
mutex_lock(&gpd_list_lock);
- list_for_each_entry(gpd, &gpd_list, gpd_list_node) {
+ list_for_each_entry_safe(gpd, tmp, &gpd_list, gpd_list_node) {
if (gpd->provider == &np->fwnode) {
ret = genpd_remove(gpd);
genpd = ret ? ERR_PTR(ret) : gpd;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 052/125] [media] mxl111sf: Fix driver to use heap allocate buffers for USB messages |
| Message-ID | <u7eMA-7zW-59@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devin Heitmueller <dheitmueller@kernellabs.com>
commit d90b336f3f652ff0441e631a06236f785581c8f7 upstream.
The recent changes in 4.9 to mandate USB buffers be heap allocated
broke this driver, which was allocating the buffers on the stack.
This resulted in the device failing at initialization.
Introduce dedicated send/receive buffers as part of the state
structure, and add a mutex to protect access to them.
Note: we also had to tweak the API to mxl111sf_ctrl_msg to pass
the pointer to the state struct rather than the device, since
we need it inside the function to access the buffers and the
mutex. This patch adjusts the callers to match the API change.
Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
Reported-by: Doug Lung <dlung0@gmail.com>
Cc: Michael Ira Krufky <mkrufky@linuxtv.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c | 4 +--
drivers/media/usb/dvb-usb-v2/mxl111sf.c | 32 ++++++++++++++++------------
drivers/media/usb/dvb-usb-v2/mxl111sf.h | 8 ++++++-
3 files changed, 28 insertions(+), 16 deletions(-)
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf-i2c.c
@@ -320,7 +320,7 @@ fail:
static int mxl111sf_i2c_send_data(struct mxl111sf_state *state,
u8 index, u8 *wdata)
{
- int ret = mxl111sf_ctrl_msg(state->d, wdata[0],
+ int ret = mxl111sf_ctrl_msg(state, wdata[0],
&wdata[1], 25, NULL, 0);
mxl_fail(ret);
@@ -330,7 +330,7 @@ static int mxl111sf_i2c_send_data(struct
static int mxl111sf_i2c_get_data(struct mxl111sf_state *state,
u8 index, u8 *wdata, u8 *rdata)
{
- int ret = mxl111sf_ctrl_msg(state->d, wdata[0],
+ int ret = mxl111sf_ctrl_msg(state, wdata[0],
&wdata[1], 25, rdata, 24);
mxl_fail(ret);
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.c
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.c
@@ -24,9 +24,6 @@
#include "lgdt3305.h"
#include "lg2160.h"
-/* Max transfer size done by I2C transfer functions */
-#define MAX_XFER_SIZE 64
-
int dvb_usb_mxl111sf_debug;
module_param_named(debug, dvb_usb_mxl111sf_debug, int, 0644);
MODULE_PARM_DESC(debug, "set debugging level "
@@ -56,27 +53,34 @@ MODULE_PARM_DESC(rfswitch, "force rf swi
DVB_DEFINE_MOD_OPT_ADAPTER_NR(adapter_nr);
-int mxl111sf_ctrl_msg(struct dvb_usb_device *d,
+int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen)
{
+ struct dvb_usb_device *d = state->d;
int wo = (rbuf == NULL || rlen == 0); /* write-only */
int ret;
- u8 sndbuf[MAX_XFER_SIZE];
- if (1 + wlen > sizeof(sndbuf)) {
+ if (1 + wlen > MXL_MAX_XFER_SIZE) {
pr_warn("%s: len=%d is too big!\n", __func__, wlen);
return -EOPNOTSUPP;
}
pr_debug("%s(wlen = %d, rlen = %d)\n", __func__, wlen, rlen);
- memset(sndbuf, 0, 1+wlen);
+ mutex_lock(&state->msg_lock);
+ memset(state->sndbuf, 0, 1+wlen);
+ memset(state->rcvbuf, 0, rlen);
+
+ state->sndbuf[0] = cmd;
+ memcpy(&state->sndbuf[1], wbuf, wlen);
+
+ ret = (wo) ? dvb_usbv2_generic_write(d, state->sndbuf, 1+wlen) :
+ dvb_usbv2_generic_rw(d, state->sndbuf, 1+wlen, state->rcvbuf,
+ rlen);
- sndbuf[0] = cmd;
- memcpy(&sndbuf[1], wbuf, wlen);
+ memcpy(rbuf, state->rcvbuf, rlen);
+ mutex_unlock(&state->msg_lock);
- ret = (wo) ? dvb_usbv2_generic_write(d, sndbuf, 1+wlen) :
- dvb_usbv2_generic_rw(d, sndbuf, 1+wlen, rbuf, rlen);
mxl_fail(ret);
return ret;
@@ -92,7 +96,7 @@ int mxl111sf_read_reg(struct mxl111sf_st
u8 buf[2];
int ret;
- ret = mxl111sf_ctrl_msg(state->d, MXL_CMD_REG_READ, &addr, 1, buf, 2);
+ ret = mxl111sf_ctrl_msg(state, MXL_CMD_REG_READ, &addr, 1, buf, 2);
if (mxl_fail(ret)) {
mxl_debug("error reading reg: 0x%02x", addr);
goto fail;
@@ -118,7 +122,7 @@ int mxl111sf_write_reg(struct mxl111sf_s
pr_debug("W: (0x%02x, 0x%02x)\n", addr, data);
- ret = mxl111sf_ctrl_msg(state->d, MXL_CMD_REG_WRITE, buf, 2, NULL, 0);
+ ret = mxl111sf_ctrl_msg(state, MXL_CMD_REG_WRITE, buf, 2, NULL, 0);
if (mxl_fail(ret))
pr_err("error writing reg: 0x%02x, val: 0x%02x", addr, data);
return ret;
@@ -922,6 +926,8 @@ static int mxl111sf_init(struct dvb_usb_
static u8 eeprom[256];
struct i2c_client c;
+ mutex_init(&state->msg_lock);
+
ret = get_chip_info(state);
if (mxl_fail(ret))
pr_err("failed to get chip info during probe");
--- a/drivers/media/usb/dvb-usb-v2/mxl111sf.h
+++ b/drivers/media/usb/dvb-usb-v2/mxl111sf.h
@@ -19,6 +19,9 @@
#include <media/tveeprom.h>
#include <media/media-entity.h>
+/* Max transfer size done by I2C transfer functions */
+#define MXL_MAX_XFER_SIZE 64
+
#define MXL_EP1_REG_READ 1
#define MXL_EP2_REG_WRITE 2
#define MXL_EP3_INTERRUPT 3
@@ -86,6 +89,9 @@ struct mxl111sf_state {
struct mutex fe_lock;
u8 num_frontends;
struct mxl111sf_adap_state adap_state[3];
+ u8 sndbuf[MXL_MAX_XFER_SIZE];
+ u8 rcvbuf[MXL_MAX_XFER_SIZE];
+ struct mutex msg_lock;
#ifdef CONFIG_MEDIA_CONTROLLER_DVB
struct media_entity tuner;
struct media_pad tuner_pads[2];
@@ -108,7 +114,7 @@ int mxl111sf_ctrl_program_regs(struct mx
/* needed for hardware i2c functions in mxl111sf-i2c.c:
* mxl111sf_i2c_send_data / mxl111sf_i2c_get_data */
-int mxl111sf_ctrl_msg(struct dvb_usb_device *d,
+int mxl111sf_ctrl_msg(struct mxl111sf_state *state,
u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen);
#define mxl_printk(kern, fmt, arg...) \
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 009/125] ath9k: fix an invalid pointer dereference in ath9k_rng_stop() |
| Message-ID | <u7eMz-7zW-55@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqing Pan <miaoqing@codeaurora.org>
commit 07246c115801c27652700e3679bb58661ef7ed65 upstream.
The bug was triggered when do suspend/resuming continuously
on Dell XPS L322X/0PJHXN version 9333 (2013) with kernel
4.12.0-041200rc4-generic. But can't reproduce on DELL
E5440 + AR9300 PCIE chips.
The warning is caused by accessing invalid pointer sc->rng_task.
sc->rng_task is not be cleared after kthread_stop(sc->rng_task)
be called in ath9k_rng_stop(). Because the kthread is stopped
before ath9k_rng_kthread() be scheduled.
So set sc->rng_task to null after kthread_stop(sc->rng_task) to
resolve this issue.
WARNING: CPU: 0 PID: 984 at linux/kernel/kthread.c:71 kthread_stop+0xf1/0x100
CPU: 0 PID: 984 Comm: NetworkManager Not tainted 4.12.0-041200rc4-generic #201706042031
Hardware name: Dell Inc. Dell System XPS L322X/0PJHXN, BIOS A09 05/15/2013
task: ffff950170fdda00 task.stack: ffffa22c01538000
RIP: 0010:kthread_stop+0xf1/0x100
RSP: 0018:ffffa22c0153b5b0 EFLAGS: 00010246
RAX: ffffffffa6257800 RBX: ffff950171b79560 RCX: 0000000000000000
RDX: 0000000080000000 RSI: 000000007fffffff RDI: ffff9500ac9a9680
RBP: ffffa22c0153b5c8 R08: 0000000000000000 R09: 0000000000000000
R10: ffffa22c0153b648 R11: ffff9501768004b8 R12: ffff9500ac9a9680
R13: ffff950171b79f70 R14: ffff950171b78780 R15: ffff9501749dc018
FS: 00007f0d6bfd5540(0000) GS:ffff95017f200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc190161a08 CR3: 0000000232906000 CR4: 00000000001406f0
Call Trace:
ath9k_rng_stop+0x1a/0x20 [ath9k]
ath9k_stop+0x3b/0x1d0 [ath9k]
drv_stop+0x33/0xf0 [mac80211]
ieee80211_stop_device+0x43/0x50 [mac80211]
ieee80211_do_stop+0x4f2/0x810 [mac80211]
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196043
Reported-by: Giulio Genovese <giulio.genovese@gmail.com>
Tested-by: Giulio Genovese <giulio.genovese@gmail.com>
Signed-off-by: Miaoqing Pan <miaoqing@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/rng.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/ath/ath9k/rng.c
+++ b/drivers/net/wireless/ath/ath9k/rng.c
@@ -120,6 +120,8 @@ void ath9k_rng_start(struct ath_softc *s
void ath9k_rng_stop(struct ath_softc *sc)
{
- if (sc->rng_task)
+ if (sc->rng_task) {
kthread_stop(sc->rng_task);
+ sc->rng_task = NULL;
+ }
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 041/125] powerpc: Fix emulation of mfocrf in emulate_step() |
| Message-ID | <u7eMA-7zW-57@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <anton@samba.org>
commit 64e756c55aa46fc18fd53e8f3598b73b528d8637 upstream.
>From POWER4 onwards, mfocrf() only places the specified CR field into
the destination GPR, and the rest of it is set to 0. The PowerPC AS
from version 3.0 now requires this behaviour.
The emulation code currently puts the entire CR into the destination GPR.
Fix it.
Fixes: 6888199f7fe5 ("[POWERPC] Emulate more instructions in software")
Signed-off-by: Anton Blanchard <anton@samba.org>
Acked-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/lib/sstep.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -970,6 +970,19 @@ int __kprobes analyse_instr(struct instr
#endif
case 19: /* mfcr */
+ if ((instr >> 20) & 1) {
+ imm = 0xf0000000UL;
+ for (sh = 0; sh < 8; ++sh) {
+ if (instr & (0x80000 >> sh)) {
+ regs->gpr[rd] = regs->ccr & imm;
+ break;
+ }
+ imm >>= 4;
+ }
+
+ goto instr_done;
+ }
+
regs->gpr[rd] = regs->ccr;
regs->gpr[rd] &= 0xffffffffUL;
goto instr_done;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2017-07-25 22:40 +0200 |
| Subject | [PATCH 4.9 043/125] powerpc/mm/radix: Properly clear process table entry |
| Message-ID | <u7eMA-7zW-61@gated-at.bofh.it> |
| In reply to | #1696349 |
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit c6bb0b8d426a8cf865ca9c8a532cc3a2927cfceb upstream.
On radix, the process table entry we want to clear when destroying a
context is entry 0, not entry 1. This has no *immediate* consequence
on Power9, but it can cause other bugs to become worse.
Fixes: 7e381c0ff618 ("powerpc/mm/radix: Add mmu context handling callback for radix")
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/mm/mmu_context_book3s64.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/arch/powerpc/mm/mmu_context_book3s64.c
+++ b/arch/powerpc/mm/mmu_context_book3s64.c
@@ -167,9 +167,15 @@ void destroy_context(struct mm_struct *m
mm->context.cop_lockp = NULL;
#endif /* CONFIG_PPC_ICSWX */
- if (radix_enabled())
- process_tb[mm->context.id].prtb1 = 0;
- else
+ if (radix_enabled()) {
+ /*
+ * Radix doesn't have a valid bit in the process table
+ * entries. However we know that at least P9 implementation
+ * will avoid caching an entry with an invalid RTS field,
+ * and 0 is invalid. So this will do.
+ */
+ process_tb[mm->context.id].prtb0 = 0;
+ } else
subpage_prot_free(mm);
destroy_pagetable_page(mm);
__destroy_context(mm->context.id);
[toc] | [prev] | [next] | [standalone]
Page 1 of 3 [1] 2 3 Next page →
Back to top | Article view | linux.kernel
csiph-web