Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1703513 > unrolled thread

[PATCH 4.12 00/31] 4.12.5-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.12 00/31] 4.12.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 13/31] crypto: brcm - Fix SHA3-512 algorithm failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 15/31] crypto: authencesn - Fix digest_null crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 14/31] crypto: brcm - remove BCM_PDC_MBOX dependency in Kconfig Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 05/31] parisc: Prevent TLB speculation on flushed pages on CPUs that only support equivalent aliases Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 26/31] drm/nouveau/bar/gf100: fix access to upper half of BAR2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 08/31] powerpc/pseries: Fix of_node_put() underflow during reconfig remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 19/31] dm integrity: test for corrupted disk format during table load Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 28/31] isdn/i4l: fix buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 01/31] jfs: Dont clear SGID when inheriting ACLs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 04/31] ALSA: hda - Add mute led support for HP ProBook 440 G4 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 18/31] dm integrity: fix inefficient allocation of journal space Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 24/31] drm/vmwgfx: Limit max desktop dimensions to 8Kx8K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 07/31] parisc: Suspend lockup detectors before system halt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 22/31] md/raid5: add thread_group worker async_tx_issue_pending_all Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 17/31] KVM: PPC: Book3S HV: Fix host crash on changing HPT size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 23/31] drm/vmwgfx: Fix gcc-7.1.1 warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 06/31] parisc: Extend disabled preemption in copy_user_page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    [PATCH 4.12 11/31] NFSv4.1: Fix a race where CB_NOTIFY_LOCK fails to wake a waiter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 01:30 +0200
    Re: [PATCH 4.12 00/31] 4.12.5-stable review Guenter Roeck <linux@roeck-us.net> - 2017-08-04 07:00 +0200
      Re: [PATCH 4.12 00/31] 4.12.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 18:30 +0200
    Re: [PATCH 4.12 00/31] 4.12.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-08-04 23:00 +0200
      Re: [PATCH 4.12 00/31] 4.12.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-08-04 23:50 +0200

Page 1 of 2  [1] 2  Next page →

#1703513 — [PATCH 4.12 00/31] 4.12.5-stable review

This is the start of the stable review cycle for the 4.12.5 release.
There are 31 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Aug  5 23:17:23 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.12.5-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.12.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.12.5-rc1

Chris Brandt <chris.brandt@renesas.com>
    mmc: tmio-mmc: fix bad pointer math

Al Viro <viro@zeniv.linux.org.uk>
    dentry name snapshots

Valentin Vidic <Valentin.Vidic@CARNet.hr>
    ipmi/watchdog: fix watchdog timeout set on reboot

Annie Cherkaev <annie.cherk@gmail.com>
    isdn/i4l: fix buffer overflow

Imre Deak <imre.deak@intel.com>
    drm/i915: Fix scaler init during CRTC HW state readout

Ben Skeggs <bskeggs@redhat.com>
    drm/nouveau/bar/gf100: fix access to upper half of BAR2

Ilia Mirkin <imirkin@alum.mit.edu>
    drm/nouveau/disp/nv50-: bump max chans to 21

Sinclair Yeh <syeh@vmware.com>
    drm/vmwgfx: Limit max desktop dimensions to 8Kx8K

Sinclair Yeh <syeh@vmware.com>
    drm/vmwgfx: Fix gcc-7.1.1 warning

Ofer Heifetz <oferh@marvell.com>
    md/raid5: add thread_group worker async_tx_issue_pending_all

Shaohua Li <shli@fb.com>
    md/raid1: fix writebehind bio clone

Ming Lei <ming.lei@redhat.com>
    md: remove 'idx' from 'struct resync_pages'

Mikulas Patocka <mpatocka@redhat.com>
    dm integrity: test for corrupted disk format during table load

Mikulas Patocka <mpatocka@redhat.com>
    dm integrity: fix inefficient allocation of journal space

Paul Mackerras <paulus@ozlabs.org>
    KVM: PPC: Book3S HV: Fix host crash on changing HPT size

Paul Mackerras <paulus@ozlabs.org>
    KVM: PPC: Book3S HV: Enable TM before accessing TM registers

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: authencesn - Fix digest_null crash

raveendra padasalagi <raveendra.padasalagi@broadcom.com>
    crypto: brcm - remove BCM_PDC_MBOX dependency in Kconfig

raveendra padasalagi <raveendra.padasalagi@broadcom.com>
    crypto: brcm - Fix SHA3-512 algorithm failure

Frank Rowand <frank.rowand@sony.com>
    scripts/dtc: dtx_diff - update include dts paths to match build

Benjamin Coddington <bcodding@redhat.com>
    NFSv4.1: Fix a race where CB_NOTIFY_LOCK fails to wake a waiter

NeilBrown <neilb@suse.com>
    NFS: invalidate file size when taking a lock.

Chen-Yu Tsai <wens@csie.org>
    mmc: sunxi: Keep default timing phase settings for new timing mode

Laurent Vivier <lvivier@redhat.com>
    powerpc/pseries: Fix of_node_put() underflow during reconfig remove

Helge Deller <deller@gmx.de>
    parisc: Suspend lockup detectors before system halt

John David Anglin <dave.anglin@bell.net>
    parisc: Extend disabled preemption in copy_user_page

John David Anglin <dave.anglin@bell.net>
    parisc: Prevent TLB speculation on flushed pages on CPUs that only support equivalent aliases

Kai-Heng Feng <kai.heng.feng@canonical.com>
    ALSA: hda - Add mute led support for HP ProBook 440 G4

Daniel Dadap <ddadap@nvidia.com>
    ALSA: hda - Add missing NVIDIA GPU codec IDs to patch table

Andy Shevchenko <andriy.shevchenko@linux.intel.com>
    ALSA: fm801: Initialize chip after IRQ handler is registered

Jan Kara <jack@suse.cz>
    jfs: Don't clear SGID when inheriting ACLs


-------------

Diffstat:

 Makefile                                        |  4 +--
 arch/parisc/kernel/cache.c                      | 36 ++++++++++------------
 arch/parisc/kernel/process.c                    |  2 ++
 arch/powerpc/kvm/book3s_64_mmu_hv.c             |  4 ++-
 arch/powerpc/kvm/book3s_hv.c                    |  2 ++
 arch/powerpc/platforms/pseries/reconfig.c       |  1 -
 crypto/authencesn.c                             |  5 ++++
 drivers/char/ipmi/ipmi_watchdog.c               |  7 +++--
 drivers/crypto/Kconfig                          |  2 +-
 drivers/crypto/bcm/spu2.c                       |  1 +
 drivers/gpu/drm/i915/intel_display.c            | 14 ++++-----
 drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.h |  2 +-
 drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c         |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c            |  4 +--
 drivers/isdn/i4l/isdn_common.c                  |  1 +
 drivers/isdn/i4l/isdn_net.c                     |  5 ++--
 drivers/md/dm-integrity.c                       | 15 +++++++---
 drivers/md/md.h                                 |  1 -
 drivers/md/raid1.c                              | 40 ++++++++++---------------
 drivers/md/raid10.c                             |  6 ++--
 drivers/md/raid5.c                              |  2 ++
 drivers/mmc/host/sunxi-mmc.c                    |  8 +++--
 drivers/mmc/host/tmio_mmc_pio.c                 | 19 ++++++------
 fs/dcache.c                                     | 27 +++++++++++++++++
 fs/debugfs/inode.c                              | 10 +++----
 fs/jfs/acl.c                                    | 15 +++++-----
 fs/namei.c                                      |  8 ++---
 fs/nfs/file.c                                   |  2 +-
 fs/nfs/nfs4proc.c                               |  2 +-
 fs/notify/fsnotify.c                            |  8 +++--
 include/linux/dcache.h                          |  6 ++++
 include/linux/fsnotify.h                        | 31 -------------------
 scripts/dtc/dtx_diff                            |  2 +-
 sound/pci/fm801.c                               |  4 +--
 sound/pci/hda/patch_conexant.c                  |  1 +
 sound/pci/hda/patch_hdmi.c                      | 27 +++++++++++++++++
 37 files changed, 186 insertions(+), 142 deletions(-)

[toc] | [next] | [standalone]

#1703514 — [PATCH 4.12 13/31] crypto: brcm - Fix SHA3-512 algorithm failure

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: raveendra padasalagi <raveendra.padasalagi@broadcom.com>

commit a7e6e5d8b221e57fed9fda6ec81153fda773c073 upstream.

In Broadcom SPU driver, due to missing break statement
in spu2_hash_xlate() while mapping SPU2 equivalent
SHA3-512 value, -EINVAL is chosen and hence leading to
failure of SHA3-512 algorithm. This patch fixes the same.

Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/bcm/spu2.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/crypto/bcm/spu2.c
+++ b/drivers/crypto/bcm/spu2.c
@@ -302,6 +302,7 @@ spu2_hash_xlate(enum hash_alg hash_alg,
 		break;
 	case HASH_ALG_SHA3_512:
 		*spu2_type = SPU2_HASH_TYPE_SHA3_512;
+		break;
 	case HASH_ALG_LAST:
 	default:
 		err = -EINVAL;

[toc] | [prev] | [next] | [standalone]

#1703515 — [PATCH 4.12 15/31] crypto: authencesn - Fix digest_null crash

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 41cdf7a45389e01991ee31e3301ed83cb3e3f7dc upstream.

When authencesn is used together with digest_null a crash will
occur on the decrypt path.  This is because normally we perform
a special setup to preserve the ESN, but this is skipped if there
is no authentication.  However, on the post-authentication path
it always expects the preservation to be in place, thus causing
a crash when digest_null is used.

This patch fixes this by also skipping the post-processing when
there is no authentication.

Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD...")
Reported-by: Jan Tluka <jtluka@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/authencesn.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/crypto/authencesn.c
+++ b/crypto/authencesn.c
@@ -248,6 +248,9 @@ static int crypto_authenc_esn_decrypt_ta
 	u8 *ihash = ohash + crypto_ahash_digestsize(auth);
 	u32 tmp[2];
 
+	if (!authsize)
+		goto decrypt;
+
 	/* Move high-order bits of sequence number back. */
 	scatterwalk_map_and_copy(tmp, dst, 4, 4, 0);
 	scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0);
@@ -256,6 +259,8 @@ static int crypto_authenc_esn_decrypt_ta
 	if (crypto_memneq(ihash, ohash, authsize))
 		return -EBADMSG;
 
+decrypt:
+
 	sg_init_table(areq_ctx->dst, 2);
 	dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen);
 

[toc] | [prev] | [next] | [standalone]

#1703516 — [PATCH 4.12 14/31] crypto: brcm - remove BCM_PDC_MBOX dependency in Kconfig

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: raveendra padasalagi <raveendra.padasalagi@broadcom.com>

commit efc856edfd66acc5da34fec92d7feca6fd0f9add upstream.

SPU driver is dependent on generic MAILBOX API's to
communicate with underlying DMA engine driver.

So this patch removes BCM_PDC_MBOX "depends on" for SPU driver
in Kconfig and adds MAILBOX as dependent module.

Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver")
Signed-off-by: Raveendra Padasalagi <raveendra.padasalagi@broadcom.com>
Reviewed-by: Ray Jui <ray.jui@broadcom.com>
Reviewed-by: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/Kconfig |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/crypto/Kconfig
+++ b/drivers/crypto/Kconfig
@@ -629,7 +629,7 @@ source "drivers/crypto/virtio/Kconfig"
 config CRYPTO_DEV_BCM_SPU
 	tristate "Broadcom symmetric crypto/hash acceleration support"
 	depends on ARCH_BCM_IPROC
-	depends on BCM_PDC_MBOX
+	depends on MAILBOX
 	default m
 	select CRYPTO_DES
 	select CRYPTO_MD5

[toc] | [prev] | [next] | [standalone]

#1703518 — [PATCH 4.12 05/31] parisc: Prevent TLB speculation on flushed pages on CPUs that only support equivalent aliases

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John David Anglin <dave.anglin@bell.net>

commit ae7a609c34b6fb12328c553b5f9aab26ae74a28e upstream.

Helge noticed that we flush the TLB page in flush_cache_page but not in
flush_cache_range or flush_cache_mm.

For a long time, we have had random segmentation faults building
packages on machines with PA8800/8900 processors.  These machines only
support equivalent aliases.  We don't see these faults on machines that
don't require strict coherency.  So, it appears TLB speculation
sometimes leads to cache corruption on machines that require coherency.

This patch adds TLB flushes to flush_cache_range and flush_cache_mm when
coherency is required.  We only flush the TLB in flush_cache_page when
coherency is required.

The patch also optimizes flush_cache_range.  It turns out we always have
the right context to use flush_user_dcache_range_asm and
flush_user_icache_range_asm.

The patch has been tested for some time on rp3440, rp3410 and A500-44.
It's been boot tested on c8000.  No random segmentation faults were
observed during testing.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/kernel/cache.c |   34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -539,6 +539,10 @@ void flush_cache_mm(struct mm_struct *mm
 	struct vm_area_struct *vma;
 	pgd_t *pgd;
 
+	/* Flush the TLB to avoid speculation if coherency is required. */
+	if (parisc_requires_coherency())
+		flush_tlb_all();
+
 	/* Flushing the whole cache on each cpu takes forever on
 	   rp3440, etc.  So, avoid it if the mm isn't too big.  */
 	if (mm_total_size(mm) >= parisc_cache_flush_threshold) {
@@ -577,33 +581,22 @@ void flush_cache_mm(struct mm_struct *mm
 void flush_cache_range(struct vm_area_struct *vma,
 		unsigned long start, unsigned long end)
 {
-	unsigned long addr;
-	pgd_t *pgd;
-
 	BUG_ON(!vma->vm_mm->context);
 
+	/* Flush the TLB to avoid speculation if coherency is required. */
+	if (parisc_requires_coherency())
+		flush_tlb_range(vma, start, end);
+
 	if ((end - start) >= parisc_cache_flush_threshold) {
 		flush_cache_all();
 		return;
 	}
 
-	if (vma->vm_mm->context == mfsp(3)) {
-		flush_user_dcache_range_asm(start, end);
-		if (vma->vm_flags & VM_EXEC)
-			flush_user_icache_range_asm(start, end);
-		return;
-	}
+	BUG_ON(vma->vm_mm->context != mfsp(3));
 
-	pgd = vma->vm_mm->pgd;
-	for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
-		unsigned long pfn;
-		pte_t *ptep = get_ptep(pgd, addr);
-		if (!ptep)
-			continue;
-		pfn = pte_pfn(*ptep);
-		if (pfn_valid(pfn))
-			__flush_cache_page(vma, addr, PFN_PHYS(pfn));
-	}
+	flush_user_dcache_range_asm(start, end);
+	if (vma->vm_flags & VM_EXEC)
+		flush_user_icache_range_asm(start, end);
 }
 
 void
@@ -612,7 +605,8 @@ flush_cache_page(struct vm_area_struct *
 	BUG_ON(!vma->vm_mm->context);
 
 	if (pfn_valid(pfn)) {
-		flush_tlb_page(vma, vmaddr);
+		if (parisc_requires_coherency())
+			flush_tlb_page(vma, vmaddr);
 		__flush_cache_page(vma, vmaddr, PFN_PHYS(pfn));
 	}
 }

[toc] | [prev] | [next] | [standalone]

#1703519 — [PATCH 4.12 26/31] drm/nouveau/bar/gf100: fix access to upper half of BAR2

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

commit 38bcb208f60924a031b9f809f7cd252ea4a94e5f upstream.

Bit 30 being set causes the upper half of BAR2 to stay in physical mode,
mapped over the end of VRAM, even when the rest of the BAR has been set
to virtual mode.

We inherited our initial value from RM, but I'm not aware of any reason
we need to keep it that way.

This fixes severe GPU hang/lockup issues revealed by Wayland on F26.

Shout-out to NVIDIA for the quick response with the potential cause!

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c
@@ -129,7 +129,7 @@ gf100_bar_init(struct nvkm_bar *base)
 
 	if (bar->bar[0].mem) {
 		addr = nvkm_memory_addr(bar->bar[0].mem) >> 12;
-		nvkm_wr32(device, 0x001714, 0xc0000000 | addr);
+		nvkm_wr32(device, 0x001714, 0x80000000 | addr);
 	}
 
 	return 0;

[toc] | [prev] | [next] | [standalone]

#1703520 — [PATCH 4.12 08/31] powerpc/pseries: Fix of_node_put() underflow during reconfig remove

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Laurent Vivier <lvivier@redhat.com>

commit 4fd1bd443e80b12f0a01a45fb9a793206b41cb72 upstream.

As for commit 68baf692c435 ("powerpc/pseries: Fix of_node_put()
underflow during DLPAR remove"), the call to of_node_put() must be
removed from pSeries_reconfig_remove_node().

dlpar_detach_node() and pSeries_reconfig_remove_node() both call
of_detach_node(), and thus the node should not be released in both
cases.

Fixes: 0829f6d1f69e ("of: device_node kobject lifecycle fixes")
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/pseries/reconfig.c |    1 -
 1 file changed, 1 deletion(-)

--- a/arch/powerpc/platforms/pseries/reconfig.c
+++ b/arch/powerpc/platforms/pseries/reconfig.c
@@ -82,7 +82,6 @@ static int pSeries_reconfig_remove_node(
 
 	of_detach_node(np);
 	of_node_put(parent);
-	of_node_put(np); /* Must decrement the refcount */
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1703521 — [PATCH 4.12 19/31] dm integrity: test for corrupted disk format during table load

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit bc86a41e96c5b6f07453c405e036d95acc673389 upstream.

If the dm-integrity superblock was corrupted in such a way that the
journal_sections field was zero, the integrity target would deadlock
because it would wait forever for free space in the journal.

Detect this situation and refuse to activate the device.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 7eada909bfd7 ("dm: add integrity target")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-integrity.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -3021,6 +3021,11 @@ static int dm_integrity_ctr(struct dm_ta
 		ti->error = "Block size doesn't match the information in superblock";
 		goto bad;
 	}
+	if (!le32_to_cpu(ic->sb->journal_sections)) {
+		r = -EINVAL;
+		ti->error = "Corrupted superblock, journal_sections is 0";
+		goto bad;
+	}
 	/* make sure that ti->max_io_len doesn't overflow */
 	if (ic->sb->log2_interleave_sectors < MIN_LOG2_INTERLEAVE_SECTORS ||
 	    ic->sb->log2_interleave_sectors > MAX_LOG2_INTERLEAVE_SECTORS) {

[toc] | [prev] | [next] | [standalone]

#1703522 — [PATCH 4.12 28/31] isdn/i4l: fix buffer overflow

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Annie Cherkaev <annie.cherk@gmail.com>

commit 9f5af546e6acc30f075828cb58c7f09665033967 upstream.

This fixes a potential buffer overflow in isdn_net.c caused by an
unbounded strcpy.

[ ISDN seems to be effectively unmaintained, and the I4L driver in
  particular is long deprecated, but in case somebody uses this..
    - Linus ]

Signed-off-by: Jiten Thakkar <jitenmt@gmail.com>
Signed-off-by: Annie Cherkaev <annie.cherk@gmail.com>
Cc: Karsten Keil <isdn@linux-pingi.de>
Cc: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/isdn/i4l/isdn_common.c |    1 +
 drivers/isdn/i4l/isdn_net.c    |    5 ++---
 2 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1379,6 +1379,7 @@ isdn_ioctl(struct file *file, uint cmd,
 			if (arg) {
 				if (copy_from_user(bname, argp, sizeof(bname) - 1))
 					return -EFAULT;
+				bname[sizeof(bname)-1] = 0;
 			} else
 				return -EINVAL;
 			ret = mutex_lock_interruptible(&dev->mtx);
--- a/drivers/isdn/i4l/isdn_net.c
+++ b/drivers/isdn/i4l/isdn_net.c
@@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm)
 	char newname[10];
 
 	if (p) {
-		/* Slave-Name MUST not be empty */
-		if (!strlen(p + 1))
+		/* Slave-Name MUST not be empty or overflow 'newname' */
+		if (strscpy(newname, p + 1, sizeof(newname)) <= 0)
 			return NULL;
-		strcpy(newname, p + 1);
 		*p = 0;
 		/* Master must already exist */
 		if (!(n = isdn_net_findif(parm)))

[toc] | [prev] | [next] | [standalone]

#1703524 — [PATCH 4.12 01/31] jfs: Dont clear SGID when inheriting ACLs

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <jack@suse.cz>

commit 9bcf66c72d726322441ec82962994e69157613e4 upstream.

When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit
set, DIR1 is expected to have SGID bit set (and owning group equal to
the owning group of 'DIR0'). However when 'DIR0' also has some default
ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on
'DIR1' to get cleared if user is not member of the owning group.

Fix the problem by moving posix_acl_update_mode() out of
__jfs_set_acl() into jfs_set_acl(). That way the function will not be
called when inheriting ACLs which is what we want as it prevents SGID
bit clearing and the mode has been properly set by posix_acl_create()
anyway.

Fixes: 073931017b49d9458aa351605b43a7e34598caef
CC: jfs-discussion@lists.sourceforge.net
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/jfs/acl.c |   15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

--- a/fs/jfs/acl.c
+++ b/fs/jfs/acl.c
@@ -77,13 +77,6 @@ static int __jfs_set_acl(tid_t tid, stru
 	switch (type) {
 	case ACL_TYPE_ACCESS:
 		ea_name = XATTR_NAME_POSIX_ACL_ACCESS;
-		if (acl) {
-			rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-			if (rc)
-				return rc;
-			inode->i_ctime = current_time(inode);
-			mark_inode_dirty(inode);
-		}
 		break;
 	case ACL_TYPE_DEFAULT:
 		ea_name = XATTR_NAME_POSIX_ACL_DEFAULT;
@@ -118,9 +111,17 @@ int jfs_set_acl(struct inode *inode, str
 
 	tid = txBegin(inode->i_sb, 0);
 	mutex_lock(&JFS_IP(inode)->commit_mutex);
+	if (type == ACL_TYPE_ACCESS && acl) {
+		rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+		if (rc)
+			goto end_tx;
+		inode->i_ctime = current_time(inode);
+		mark_inode_dirty(inode);
+	}
 	rc = __jfs_set_acl(tid, inode, type, acl);
 	if (!rc)
 		rc = txCommit(tid, 1, &inode, 0);
+end_tx:
 	txEnd(tid);
 	mutex_unlock(&JFS_IP(inode)->commit_mutex);
 	return rc;

[toc] | [prev] | [next] | [standalone]

#1703525 — [PATCH 4.12 04/31] ALSA: hda - Add mute led support for HP ProBook 440 G4

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kai-Heng Feng <kai.heng.feng@canonical.com>

commit ba92b1142879731f80377770f4710e5f0a953aad upstream.

Mic mute led does not work on HP ProBook 440 G4.
We can use CXT_FIXUP_MUTE_LED_GPIO fixup to support it.

BugLink: https://bugs.launchpad.net/bugs/1705586
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_conexant.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -933,6 +933,7 @@ static const struct snd_pci_quirk cxt506
 	SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
 	SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC),
 	SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO),
+	SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO),
 	SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
 	SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),

[toc] | [prev] | [next] | [standalone]

#1703526 — [PATCH 4.12 18/31] dm integrity: fix inefficient allocation of journal space

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit 9dd59727dbc21d33a9add4c5b308a5775cd5a6ef upstream.

When using a block size greater than 512 bytes, the dm-integrity target
allocates journal space inefficiently.  It allocates one journal entry
for each 512-byte chunk of data, fills an entry for each block of data
and leaves the remaining entries unused.

This issue doesn't cause data corruption, but all the unused journal
entries degrade performance severely.

For example, with 4k blocks and an 8k bio, it would allocate 16 journal
entries but only use 2 entries.  The remaining 14 entries were left
unused.

Fix this by adding the missing 'log2_sectors_per_block' shifts that are
required to have each journal entry map to a full block.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 7eada909bfd7 ("dm: add integrity target")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-integrity.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1587,16 +1587,18 @@ retry:
 	if (likely(ic->mode == 'J')) {
 		if (dio->write) {
 			unsigned next_entry, i, pos;
-			unsigned ws, we;
+			unsigned ws, we, range_sectors;
 
-			dio->range.n_sectors = min(dio->range.n_sectors, ic->free_sectors);
+			dio->range.n_sectors = min(dio->range.n_sectors,
+						   ic->free_sectors << ic->sb->log2_sectors_per_block);
 			if (unlikely(!dio->range.n_sectors))
 				goto sleep;
-			ic->free_sectors -= dio->range.n_sectors;
+			range_sectors = dio->range.n_sectors >> ic->sb->log2_sectors_per_block;
+			ic->free_sectors -= range_sectors;
 			journal_section = ic->free_section;
 			journal_entry = ic->free_section_entry;
 
-			next_entry = ic->free_section_entry + dio->range.n_sectors;
+			next_entry = ic->free_section_entry + range_sectors;
 			ic->free_section_entry = next_entry % ic->journal_section_entries;
 			ic->free_section += next_entry / ic->journal_section_entries;
 			ic->n_uncommitted_sections += next_entry / ic->journal_section_entries;

[toc] | [prev] | [next] | [standalone]

#1703529 — [PATCH 4.12 24/31] drm/vmwgfx: Limit max desktop dimensions to 8Kx8K

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sinclair Yeh <syeh@vmware.com>

commit 7b009e76797c82178d7a03ae0eaad5951d975277 upstream.

This was originally chosen to be an arbitrarily large number.  However,
some user mode may actually try to set a 16Kx16K mode and run into other
issues.

Since 8Kx8K is the current texture limit for Mesa LLVM driver, we will
just use this limit for now.

Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c
@@ -1640,8 +1640,8 @@ int vmw_kms_stdu_init_display(struct vmw
 		 * something arbitrarily large and we will reject any layout
 		 * that doesn't fit prim_bb_mem later
 		 */
-		dev->mode_config.max_width = 16384;
-		dev->mode_config.max_height = 16384;
+		dev->mode_config.max_width = 8192;
+		dev->mode_config.max_height = 8192;
 	}
 
 	vmw_kms_create_implicit_placement_property(dev_priv, false);

[toc] | [prev] | [next] | [standalone]

#1703531 — [PATCH 4.12 07/31] parisc: Suspend lockup detectors before system halt

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Helge Deller <deller@gmx.de>

commit 56188832a50f09998cb570ba3771a1d25c193c0e upstream.

Some machines can't power off the machine, so disable the lockup detectors to
avoid this watchdog BUG to show up every few seconds:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [systemd-shutdow:1]

Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/kernel/process.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/parisc/kernel/process.c
+++ b/arch/parisc/kernel/process.c
@@ -53,6 +53,7 @@
 #include <linux/uaccess.h>
 #include <linux/rcupdate.h>
 #include <linux/random.h>
+#include <linux/nmi.h>
 
 #include <asm/io.h>
 #include <asm/asm-offsets.h>
@@ -145,6 +146,7 @@ void machine_power_off(void)
 
 	/* prevent soft lockup/stalled CPU messages for endless loop. */
 	rcu_sysrq_start();
+	lockup_detector_suspend();
 	for (;;);
 }
 

[toc] | [prev] | [next] | [standalone]

#1703532 — [PATCH 4.12 22/31] md/raid5: add thread_group worker async_tx_issue_pending_all

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ofer Heifetz <oferh@marvell.com>

commit 7e96d559634b73a8158ee99a7abece2eacec2668 upstream.

Since thread_group worker and raid5d kthread are not in sync, if
worker writes stripe before raid5d then requests will be waiting
for issue_pendig.

Issue observed when building raid5 with ext4, in some build runs
jbd2 would get hung and requests were waiting in the HW engine
waiting to be issued.

Fix this by adding a call to async_tx_issue_pending_all in the
raid5_do_work.

Signed-off-by: Ofer Heifetz <oferh@marvell.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/raid5.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -6237,6 +6237,8 @@ static void raid5_do_work(struct work_st
 	pr_debug("%d stripes handled\n", handled);
 
 	spin_unlock_irq(&conf->device_lock);
+
+	async_tx_issue_pending_all();
 	blk_finish_plug(&plug);
 
 	pr_debug("--- raid5worker inactive\n");

[toc] | [prev] | [next] | [standalone]

#1703533 — [PATCH 4.12 17/31] KVM: PPC: Book3S HV: Fix host crash on changing HPT size

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paul Mackerras <paulus@ozlabs.org>

commit ef42719814db06fdfa26cd7566de0b64de173320 upstream.

Commit f98a8bf9ee20 ("KVM: PPC: Book3S HV: Allow KVM_PPC_ALLOCATE_HTAB
ioctl() to change HPT size", 2016-12-20) changed the behaviour of
the KVM_PPC_ALLOCATE_HTAB ioctl so that it now allocates a new HPT
and new revmap array if there was a previously-allocated HPT of a
different size from the size being requested.  In this case, we need
to reset the rmap arrays of the memslots, because the rmap arrays
will contain references to HPTEs which are no longer valid.  Worse,
these references are also references to slots in the new revmap
array (which parallels the HPT), and the new revmap array contains
random contents, since it doesn't get zeroed on allocation.

The effect of having these stale references to slots in the revmap
array that contain random contents is that subsequent calls to
functions such as kvmppc_add_revmap_chain will crash because they
will interpret the non-zero contents of the revmap array as HPTE
indexes and thus index outside of the revmap array.  This leads to
host crashes such as the following.

[ 7072.862122] Unable to handle kernel paging request for data at address 0xd000000c250c00f8
[ 7072.862218] Faulting instruction address: 0xc0000000000e1c78
[ 7072.862233] Oops: Kernel access of bad area, sig: 11 [#1]
[ 7072.862286] SMP NR_CPUS=1024
[ 7072.862286] NUMA
[ 7072.862325] PowerNV
[ 7072.862378] Modules linked in: kvm_hv vhost_net vhost tap xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables rpcrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm iw_cxgb3 mlx5_ib ib_core ses enclosure scsi_transport_sas ipmi_powernv ipmi_devintf ipmi_msghandler powernv_op_panel i2c_opal nfsd auth_rpcgss oid_registry
[ 7072.863085]  nfs_acl lockd grace sunrpc kvm_pr kvm xfs libcrc32c scsi_dh_alua dm_service_time radeon lpfc nvme_fc nvme_fabrics nvme_core scsi_transport_fc i2c_algo_bit tg3 drm_kms_helper ptp pps_core syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm dm_multipath i2c_core cxgb3 mlx5_core mdio [last unloaded: kvm_hv]
[ 7072.863381] CPU: 72 PID: 56929 Comm: qemu-system-ppc Not tainted 4.12.0-kvm+ #59
[ 7072.863457] task: c000000fe29e7600 task.stack: c000001e3ffec000
[ 7072.863520] NIP: c0000000000e1c78 LR: c0000000000e2e3c CTR: c0000000000e25f0
[ 7072.863596] REGS: c000001e3ffef560 TRAP: 0300   Not tainted  (4.12.0-kvm+)
[ 7072.863658] MSR: 9000000100009033 <SF,HV,EE,ME,IR,DR,RI,LE,TM[E]>
[ 7072.863667]   CR: 44082882  XER: 20000000
[ 7072.863767] CFAR: c0000000000e2e38 DAR: d000000c250c00f8 DSISR: 42000000 SOFTE: 1
GPR00: c0000000000e2e3c c000001e3ffef7e0 c000000001407d00 d000000c250c00f0
GPR04: d00000006509fb70 d00000000b3d2048 0000000003ffdfb7 0000000000000000
GPR08: 00000001007fdfb7 00000000c000000f d0000000250c0000 000000000070f7bf
GPR12: 0000000000000008 c00000000fdad000 0000000010879478 00000000105a0d78
GPR16: 00007ffaf4080000 0000000000001190 0000000000000000 0000000000010000
GPR20: 4001ffffff000415 d00000006509fb70 0000000004091190 0000000ee1881190
GPR24: 0000000003ffdfb7 0000000003ffdfb7 00000000007fdfb7 c000000f5c958000
GPR28: d00000002d09fb70 0000000003ffdfb7 d00000006509fb70 d00000000b3d2048
[ 7072.864439] NIP [c0000000000e1c78] kvmppc_add_revmap_chain+0x88/0x130
[ 7072.864503] LR [c0000000000e2e3c] kvmppc_do_h_enter+0x84c/0x9e0
[ 7072.864566] Call Trace:
[ 7072.864594] [c000001e3ffef7e0] [c000001e3ffef830] 0xc000001e3ffef830 (unreliable)
[ 7072.864671] [c000001e3ffef830] [c0000000000e2e3c] kvmppc_do_h_enter+0x84c/0x9e0
[ 7072.864751] [c000001e3ffef920] [d00000000b38d878] kvmppc_map_vrma+0x168/0x200 [kvm_hv]
[ 7072.864831] [c000001e3ffef9e0] [d00000000b38a684] kvmppc_vcpu_run_hv+0x1284/0x1300 [kvm_hv]
[ 7072.864914] [c000001e3ffefb30] [d00000000f465664] kvmppc_vcpu_run+0x44/0x60 [kvm]
[ 7072.865008] [c000001e3ffefb60] [d00000000f461864] kvm_arch_vcpu_ioctl_run+0x114/0x290 [kvm]
[ 7072.865152] [c000001e3ffefbe0] [d00000000f453c98] kvm_vcpu_ioctl+0x598/0x7a0 [kvm]
[ 7072.865292] [c000001e3ffefd40] [c000000000389328] do_vfs_ioctl+0xd8/0x8c0
[ 7072.865410] [c000001e3ffefde0] [c000000000389be4] SyS_ioctl+0xd4/0x130
[ 7072.865526] [c000001e3ffefe30] [c00000000000b760] system_call+0x58/0x6c
[ 7072.865644] Instruction dump:
[ 7072.865715] e95b2110 793a0020 7b4926e4 7f8a4a14 409e0098 807c000c 786326e4 7c6a1a14
[ 7072.865857] 935e0008 7bbd0020 813c000c 913e000c <93a30008> 93bc000c 48000038 60000000
[ 7072.866001] ---[ end trace 627b6e4bf8080edc ]---

Note that to trigger this, it is necessary to use a recent upstream
QEMU (or other userspace that resizes the HPT at CAS time), specify
a maximum memory size substantially larger than the current memory
size, and boot a guest kernel that does not support HPT resizing.

This fixes the problem by resetting the rmap arrays when the old HPT
is freed.

Fixes: f98a8bf9ee20 ("KVM: PPC: Book3S HV: Allow KVM_PPC_ALLOCATE_HTAB ioctl() to change HPT size")
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kvm/book3s_64_mmu_hv.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c
+++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c
@@ -164,8 +164,10 @@ long kvmppc_alloc_reset_hpt(struct kvm *
 		goto out;
 	}
 
-	if (kvm->arch.hpt.virt)
+	if (kvm->arch.hpt.virt) {
 		kvmppc_free_hpt(&kvm->arch.hpt);
+		kvmppc_rmap_reset(kvm);
+	}
 
 	err = kvmppc_allocate_hpt(&info, order);
 	if (err < 0)

[toc] | [prev] | [next] | [standalone]

#1703535 — [PATCH 4.12 23/31] drm/vmwgfx: Fix gcc-7.1.1 warning

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sinclair Yeh <syeh@vmware.com>

commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.

The current code does not look correct, and the reason for it is
probably lost.  Since this now generates a compiler warning,
fix it to what makes sense.

Reported-by: Arnd Bergmann <arnd@arndb.de>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -519,7 +519,7 @@ static int vmw_cmd_invalid(struct vmw_pr
 			   struct vmw_sw_context *sw_context,
 			   SVGA3dCmdHeader *header)
 {
-	return capable(CAP_SYS_ADMIN) ? : -EINVAL;
+	return -EINVAL;
 }
 
 static int vmw_cmd_ok(struct vmw_private *dev_priv,

[toc] | [prev] | [next] | [standalone]

#1703536 — [PATCH 4.12 06/31] parisc: Extend disabled preemption in copy_user_page

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: John David Anglin <dave.anglin@bell.net>

commit 56008c04ebc099940021b714da2d7779117cf6a7 upstream.

It's always bothered me that we only disable preemption in
copy_user_page around the call to flush_dcache_page_asm.
This patch extends this to after the copy.

Signed-off-by: John David Anglin <dave.anglin@bell.net>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/parisc/kernel/cache.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -453,8 +453,8 @@ void copy_user_page(void *vto, void *vfr
 	  before it can be accessed through the kernel mapping. */
 	preempt_disable();
 	flush_dcache_page_asm(__pa(vfrom), vaddr);
-	preempt_enable();
 	copy_page_asm(vto, vfrom);
+	preempt_enable();
 }
 EXPORT_SYMBOL(copy_user_page);
 

[toc] | [prev] | [next] | [standalone]

#1703537 — [PATCH 4.12 11/31] NFSv4.1: Fix a race where CB_NOTIFY_LOCK fails to wake a waiter

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Coddington <bcodding@redhat.com>

commit b7dbcc0e433f0f61acb89ed9861ec996be4f2b38 upstream.

nfs4_retry_setlk() sets the task's state to TASK_INTERRUPTIBLE within the
same region protected by the wait_queue's lock after checking for a
notification from CB_NOTIFY_LOCK callback.  However, after releasing that
lock, a wakeup for that task may race in before the call to
freezable_schedule_timeout_interruptible() and set TASK_WAKING, then
freezable_schedule_timeout_interruptible() will set the state back to
TASK_INTERRUPTIBLE before the task will sleep.  The result is that the task
will sleep for the entire duration of the timeout.

Since we've already set TASK_INTERRUPTIBLE in the locked section, just use
freezable_schedule_timout() instead.

Fixes: a1d617d8f134 ("nfs: allow blocking locks to be awoken by lock callbacks")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs4proc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -6441,7 +6441,7 @@ nfs4_retry_setlk(struct nfs4_state *stat
 		set_current_state(TASK_INTERRUPTIBLE);
 		spin_unlock_irqrestore(&q->lock, flags);
 
-		freezable_schedule_timeout_interruptible(NFS4_LOCK_MAXTIMEOUT);
+		freezable_schedule_timeout(NFS4_LOCK_MAXTIMEOUT);
 	}
 
 	finish_wait(q, &wait);

[toc] | [prev] | [next] | [standalone]

#1703655

On 08/03/2017 04:17 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.12.5 release.
> There are 31 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Sat Aug  5 23:17:23 UTC 2017.
> Anything received after that time might be too late.
> 

Build results:
	total: 145 pass: 145 fail: 0
Qemu test results:
	total: 122 pass: 122 fail: 0

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.kernel

csiph-web