diff options
author | Ben Hutchings <ben@decadent.org.uk> | 2020-02-05 00:55:09 +0000 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2020-02-05 00:55:09 +0000 |
commit | ed77d206a6a7ea56c2bf5ab213d6ee1c1884d1de (patch) | |
tree | a629766f6351ef375e136145d2a24932c8b1d78b | |
parent | 59863712f4e608039b68314929aab80865cd96d1 (diff) | |
download | linux-stable-queue-ed77d206a6a7ea56c2bf5ab213d6ee1c1884d1de.tar.gz |
Add commits cc'd to stable, up to 5.5-rc1
...plus their obvious dependencies, and some follow-up fixes.
137 files changed, 8971 insertions, 1 deletions
diff --git a/queue-3.16/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch b/queue-3.16/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch new file mode 100644 index 00000000..574e5213 --- /dev/null +++ b/queue-3.16/acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch @@ -0,0 +1,54 @@ +From: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com> +Date: Thu, 28 Nov 2019 15:58:29 +0530 +Subject: ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() + +commit 627ead724eff33673597216f5020b72118827de4 upstream. + +kmemleak reported backtrace: + [<bbee0454>] kmem_cache_alloc_trace+0x128/0x260 + [<6677f215>] i2c_acpi_install_space_handler+0x4b/0xe0 + [<1180f4fc>] i2c_register_adapter+0x186/0x400 + [<6083baf7>] i2c_add_adapter+0x4e/0x70 + [<a3ddf966>] intel_gmbus_setup+0x1a2/0x2c0 [i915] + [<84cb69ae>] i915_driver_probe+0x8d8/0x13a0 [i915] + [<81911d4b>] i915_pci_probe+0x48/0x160 [i915] + [<4b159af1>] pci_device_probe+0xdc/0x160 + [<b3c64704>] really_probe+0x1ee/0x450 + [<bc029f5a>] driver_probe_device+0x142/0x1b0 + [<d8829d20>] device_driver_attach+0x49/0x50 + [<de71f045>] __driver_attach+0xc9/0x150 + [<df33ac83>] bus_for_each_dev+0x56/0xa0 + [<80089bba>] driver_attach+0x19/0x20 + [<cc73f583>] bus_add_driver+0x177/0x220 + [<7b29d8c7>] driver_register+0x56/0xf0 + +In i2c_acpi_remove_space_handler(), a leak occurs whenever the +"data" parameter is initialized to 0 before being passed to +acpi_bus_get_private_data(). + +This is because the NULL pointer check in acpi_bus_get_private_data() +(condition->if(!*data)) returns EINVAL and, in consequence, memory is +never freed in i2c_acpi_remove_space_handler(). + +Fix the NULL pointer check in acpi_bus_get_private_data() to follow +the analogous check in acpi_get_data_full(). + +Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@gmail.com> +[ rjw: Subject & changelog ] +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/acpi/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -154,7 +154,7 @@ int acpi_bus_get_private_data(acpi_handl + { + acpi_status status; + +- if (!*data) ++ if (!data) + return -EINVAL; + + status = acpi_get_data(handle, acpi_bus_private_data_handler, data); diff --git a/queue-3.16/acpi-osl-only-free-map-once-in-osl.c.patch b/queue-3.16/acpi-osl-only-free-map-once-in-osl.c.patch new file mode 100644 index 00000000..75f06f9a --- /dev/null +++ b/queue-3.16/acpi-osl-only-free-map-once-in-osl.c.patch @@ -0,0 +1,104 @@ +From: Francesco Ruggeri <fruggeri@arista.com> +Date: Tue, 19 Nov 2019 21:47:27 -0800 +Subject: ACPI: OSL: only free map once in osl.c + +commit 833a426cc471b6088011b3d67f1dc4e147614647 upstream. + +acpi_os_map_cleanup checks map->refcount outside of acpi_ioremap_lock +before freeing the map. This creates a race condition the can result +in the map being freed more than once. +A panic can be caused by running + +for ((i=0; i<10; i++)) +do + for ((j=0; j<100000; j++)) + do + cat /sys/firmware/acpi/tables/data/BERT >/dev/null + done & +done + +This patch makes sure that only the process that drops the reference +to 0 does the freeing. + +Fixes: b7c1fadd6c2e ("ACPI: Do not use krefs under a mutex in osl.c") +Signed-off-by: Francesco Ruggeri <fruggeri@arista.com> +Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/acpi/osl.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -416,24 +416,27 @@ acpi_os_map_memory(acpi_physical_address + } + EXPORT_SYMBOL_GPL(acpi_os_map_memory); + +-static void acpi_os_drop_map_ref(struct acpi_ioremap *map) ++/* Must be called with mutex_lock(&acpi_ioremap_lock) */ ++static unsigned long acpi_os_drop_map_ref(struct acpi_ioremap *map) + { +- if (!--map->refcount) ++ unsigned long refcount = --map->refcount; ++ ++ if (!refcount) + list_del_rcu(&map->list); ++ return refcount; + } + + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { +- if (!map->refcount) { +- synchronize_rcu_expedited(); +- acpi_unmap(map->phys, map->virt); +- kfree(map); +- } ++ synchronize_rcu_expedited(); ++ acpi_unmap(map->phys, map->virt); ++ kfree(map); + } + + void __ref acpi_os_unmap_iomem(void __iomem *virt, acpi_size size) + { + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (!acpi_gbl_permanent_mmap) { + __acpi_unmap_table(virt, size); +@@ -447,10 +450,11 @@ void __ref acpi_os_unmap_iomem(void __io + WARN(true, PREFIX "%s: bad address %p\n", __func__, virt); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL_GPL(acpi_os_unmap_iomem); + +@@ -491,6 +495,7 @@ void acpi_os_unmap_generic_address(struc + { + u64 addr; + struct acpi_ioremap *map; ++ unsigned long refcount; + + if (gas->space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) + return; +@@ -506,10 +511,11 @@ void acpi_os_unmap_generic_address(struc + mutex_unlock(&acpi_ioremap_lock); + return; + } +- acpi_os_drop_map_ref(map); ++ refcount = acpi_os_drop_map_ref(map); + mutex_unlock(&acpi_ioremap_lock); + +- acpi_os_map_cleanup(map); ++ if (!refcount) ++ acpi_os_map_cleanup(map); + } + EXPORT_SYMBOL(acpi_os_unmap_generic_address); + diff --git a/queue-3.16/acpi-osl-speedup-grace-period-in-acpi_os_map_cleanup.patch b/queue-3.16/acpi-osl-speedup-grace-period-in-acpi_os_map_cleanup.patch new file mode 100644 index 00000000..3089213e --- /dev/null +++ b/queue-3.16/acpi-osl-speedup-grace-period-in-acpi_os_map_cleanup.patch @@ -0,0 +1,45 @@ +From: Konstantin Khlebnikov <koct9i@gmail.com> +Date: Sun, 9 Nov 2014 13:53:37 +0400 +Subject: ACPI / osl: speedup grace period in acpi_os_map_cleanup + +commit 74b51ee152b6d99e61ba329799a039453fb9438f upstream. + +ACPI maintains cache of ioremap regions to speed up operations and +access to them from irq context where ioremap() calls aren't allowed. +This code abuses synchronize_rcu() on unmap path for synchronization +with fast-path in acpi_os_read/write_memory which uses this cache. + +Since v3.10 CPUs are allowed to enter idle state even if they have RCU +callbacks queued, see commit c0f4dfd4f90f1667d234d21f15153ea09a2eaa66 +("rcu: Make RCU_FAST_NO_HZ take advantage of numbered callbacks"). +That change caused problems with nvidia proprietary driver which calls +acpi_os_map/unmap_generic_address several times during initialization. +Each unmap calls synchronize_rcu and adds significant delay. Totally +initialization is slowed for a couple of seconds and that is enough to +trigger timeout in hardware, gpu decides to "fell off the bus". Widely +spread workaround is reducing "rcu_idle_gp_delay" from 4 to 1 jiffy. + +This patch replaces synchronize_rcu() with synchronize_rcu_expedited() +which is much faster. + +Link: https://devtalk.nvidia.com/default/topic/567297/linux/linux-3-10-driver-crash/ +Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> +Reported-and-tested-by: Alexander Monakov <amonakov@gmail.com> +Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/acpi/osl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -425,7 +425,7 @@ static void acpi_os_drop_map_ref(struct + static void acpi_os_map_cleanup(struct acpi_ioremap *map) + { + if (!map->refcount) { +- synchronize_rcu(); ++ synchronize_rcu_expedited(); + acpi_unmap(map->phys, map->virt); + kfree(map); + } diff --git a/queue-3.16/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch b/queue-3.16/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch new file mode 100644 index 00000000..72630871 --- /dev/null +++ b/queue-3.16/alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch @@ -0,0 +1,33 @@ +From: Colin Ian King <colin.king@canonical.com> +Date: Fri, 22 Nov 2019 13:13:54 +0000 +Subject: ALSA: cs4236: fix error return comparison of an unsigned integer + +commit d60229d84846a8399257006af9c5444599f64361 upstream. + +The return from pnp_irq is an unsigned integer type resource_size_t +and hence the error check for a positive non-error code is always +going to be true. A check for a non-failure return from pnp_irq +should in fact be for (resource_size_t)-1 rather than >= 0. + +Addresses-Coverity: ("Unsigned compared against 0") +Fixes: a9824c868a2c ("[ALSA] Add CS4232 PnP BIOS support") +Signed-off-by: Colin Ian King <colin.king@canonical.com> +Link: https://lore.kernel.org/r/20191122131354.58042-1-colin.king@canonical.com +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + sound/isa/cs423x/cs4236.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -293,7 +293,8 @@ static int snd_cs423x_pnp_init_mpu(int d + } else { + mpu_port[dev] = pnp_port_start(pdev, 0); + if (mpu_irq[dev] >= 0 && +- pnp_irq_valid(pdev, 0) && pnp_irq(pdev, 0) >= 0) { ++ pnp_irq_valid(pdev, 0) && ++ pnp_irq(pdev, 0) != (resource_size_t)-1) { + mpu_irq[dev] = pnp_irq(pdev, 0); + } else { + mpu_irq[dev] = -1; /* disable interrupt */ diff --git a/queue-3.16/alsa-pcm-oss-avoid-potential-buffer-overflows.patch b/queue-3.16/alsa-pcm-oss-avoid-potential-buffer-overflows.patch new file mode 100644 index 00000000..129133fc --- /dev/null +++ b/queue-3.16/alsa-pcm-oss-avoid-potential-buffer-overflows.patch @@ -0,0 +1,59 @@ +From: Takashi Iwai <tiwai@suse.de> +Date: Wed, 4 Dec 2019 15:48:24 +0100 +Subject: ALSA: pcm: oss: Avoid potential buffer overflows + +commit 4cc8d6505ab82db3357613d36e6c58a297f57f7c upstream. + +syzkaller reported an invalid access in PCM OSS read, and this seems +to be an overflow of the internal buffer allocated for a plugin. +Since the rate plugin adjusts its transfer size dynamically, the +calculation for the chained plugin might be bigger than the given +buffer size in some extreme cases, which lead to such an buffer +overflow as caught by KASAN. + +Fix it by limiting the max transfer size properly by checking against +the destination size in each plugin transfer callback. + +Reported-by: syzbot+f153bde47a62e0b05f83@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20191204144824.17801-1-tiwai@suse.de +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + sound/core/oss/linear.c | 2 ++ + sound/core/oss/mulaw.c | 2 ++ + sound/core/oss/route.c | 2 ++ + 3 files changed, 6 insertions(+) + +--- a/sound/core/oss/linear.c ++++ b/sound/core/oss/linear.c +@@ -107,6 +107,8 @@ static snd_pcm_sframes_t linear_transfer + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + convert(plugin, src_channels, dst_channels, frames); + return frames; + } +--- a/sound/core/oss/mulaw.c ++++ b/sound/core/oss/mulaw.c +@@ -269,6 +269,8 @@ static snd_pcm_sframes_t mulaw_transfer( + } + } + #endif ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + data = (struct mulaw_priv *)plugin->extra_data; + data->func(plugin, src_channels, dst_channels, frames); + return frames; +--- a/sound/core/oss/route.c ++++ b/sound/core/oss/route.c +@@ -57,6 +57,8 @@ static snd_pcm_sframes_t route_transfer( + return -ENXIO; + if (frames == 0) + return 0; ++ if (frames > dst_channels[0].frames) ++ frames = dst_channels[0].frames; + + nsrcs = plugin->src_format.channels; + ndsts = plugin->dst_format.channels; diff --git a/queue-3.16/appledisplay-fix-error-handling-in-the-scheduled-work.patch b/queue-3.16/appledisplay-fix-error-handling-in-the-scheduled-work.patch new file mode 100644 index 00000000..b0a86454 --- /dev/null +++ b/queue-3.16/appledisplay-fix-error-handling-in-the-scheduled-work.patch @@ -0,0 +1,47 @@ +From: Oliver Neukum <oneukum@suse.com> +Date: Wed, 6 Nov 2019 13:49:01 +0100 +Subject: appledisplay: fix error handling in the scheduled work + +commit 91feb01596e5efc0cc922cc73f5583114dccf4d2 upstream. + +The work item can operate on + +1. stale memory left over from the last transfer +the actual length of the data transfered needs to be checked +2. memory already freed +the error handling in appledisplay_probe() needs +to cancel the work in that case + +Reported-and-tested-by: syzbot+495dab1f175edc9c2f13@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum <oneukum@suse.com> +Link: https://lore.kernel.org/r/20191106124902.7765-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/misc/appledisplay.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -180,7 +180,12 @@ static int appledisplay_bl_get_brightnes + 0, + pdata->msgdata, 2, + ACD_USB_TIMEOUT); +- brightness = pdata->msgdata[1]; ++ if (retval < 2) { ++ if (retval >= 0) ++ retval = -EMSGSIZE; ++ } else { ++ brightness = pdata->msgdata[1]; ++ } + mutex_unlock(&pdata->sysfslock); + + if (retval < 0) +@@ -326,6 +331,7 @@ error: + if (pdata) { + if (pdata->urb) { + usb_kill_urb(pdata->urb); ++ cancel_delayed_work_sync(&pdata->work); + if (pdata->urbdata) + usb_free_coherent(pdata->udev, ACD_URB_BUFFER_LEN, + pdata->urbdata, pdata->urb->transfer_dma); diff --git a/queue-3.16/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch b/queue-3.16/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch new file mode 100644 index 00000000..d337e4e2 --- /dev/null +++ b/queue-3.16/ar5523-check-null-before-memcpy-in-ar5523_cmd.patch @@ -0,0 +1,35 @@ +From: Denis Efremov <efremov@linux.com> +Date: Mon, 30 Sep 2019 23:31:47 +0300 +Subject: ar5523: check NULL before memcpy() in ar5523_cmd() + +commit 315cee426f87658a6799815845788fde965ddaad upstream. + +memcpy() call with "idata == NULL && ilen == 0" results in undefined +behavior in ar5523_cmd(). For example, NULL is passed in callchain +"ar5523_stat_work() -> ar5523_cmd_write() -> ar5523_cmd()". This patch +adds ilen check before memcpy() call in ar5523_cmd() to prevent an +undefined behavior. + +Cc: Pontus Fuchs <pontus.fuchs@gmail.com> +Cc: Kalle Valo <kvalo@codeaurora.org> +Cc: "David S. Miller" <davem@davemloft.net> +Cc: David Laight <David.Laight@ACULAB.COM> +Signed-off-by: Denis Efremov <efremov@linux.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/wireless/ath/ar5523/ar5523.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ar5523/ar5523.c ++++ b/drivers/net/wireless/ath/ar5523/ar5523.c +@@ -255,7 +255,8 @@ static int ar5523_cmd(struct ar5523 *ar, + + if (flags & AR5523_CMD_FLAG_MAGIC) + hdr->magic = cpu_to_be32(1 << 24); +- memcpy(hdr + 1, idata, ilen); ++ if (ilen) ++ memcpy(hdr + 1, idata, ilen); + + cmd->odata = odata; + cmd->olen = olen; diff --git a/queue-3.16/arm-dts-s3c64xx-fix-init-order-of-clock-providers.patch b/queue-3.16/arm-dts-s3c64xx-fix-init-order-of-clock-providers.patch new file mode 100644 index 00000000..18415961 --- /dev/null +++ b/queue-3.16/arm-dts-s3c64xx-fix-init-order-of-clock-providers.patch @@ -0,0 +1,54 @@ +From: Lihua Yao <ylhuajnu@outlook.com> +Date: Tue, 10 Sep 2019 13:22:28 +0000 +Subject: ARM: dts: s3c64xx: Fix init order of clock providers + +commit d60d0cff4ab01255b25375425745c3cff69558ad upstream. + +fin_pll is the parent of clock-controller@7e00f000, specify +the dependency to ensure proper initialization order of clock +providers. + +without this patch: +[ 0.000000] S3C6410 clocks: apll = 0, mpll = 0 +[ 0.000000] epll = 0, arm_clk = 0 + +with this patch: +[ 0.000000] S3C6410 clocks: apll = 532000000, mpll = 532000000 +[ 0.000000] epll = 24000000, arm_clk = 532000000 + +Fixes: 3f6d439f2022 ("clk: reverse default clk provider initialization order in of_clk_init()") +Signed-off-by: Lihua Yao <ylhuajnu@outlook.com> +Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com> +Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/arm/boot/dts/s3c6410-mini6410.dts | 4 ++++ + arch/arm/boot/dts/s3c6410-smdk6410.dts | 4 ++++ + 2 files changed, 8 insertions(+) + +--- a/arch/arm/boot/dts/s3c6410-mini6410.dts ++++ b/arch/arm/boot/dts/s3c6410-mini6410.dts +@@ -167,6 +167,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; +--- a/arch/arm/boot/dts/s3c6410-smdk6410.dts ++++ b/arch/arm/boot/dts/s3c6410-smdk6410.dts +@@ -71,6 +71,10 @@ + }; + }; + ++&clocks { ++ clocks = <&fin_pll>; ++}; ++ + &sdhci0 { + pinctrl-names = "default"; + pinctrl-0 = <&sd0_clk>, <&sd0_cmd>, <&sd0_cd>, <&sd0_bus4>; diff --git a/queue-3.16/arm-tegra-fix-flow_ctlr_halt-register-clobbering-by-tegra_resume.patch b/queue-3.16/arm-tegra-fix-flow_ctlr_halt-register-clobbering-by-tegra_resume.patch new file mode 100644 index 00000000..2b529b58 --- /dev/null +++ b/queue-3.16/arm-tegra-fix-flow_ctlr_halt-register-clobbering-by-tegra_resume.patch @@ -0,0 +1,39 @@ +From: Dmitry Osipenko <digetx@gmail.com> +Date: Tue, 30 Jul 2019 20:23:39 +0300 +Subject: ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume() + +commit d70f7d31a9e2088e8a507194354d41ea10062994 upstream. + +There is an unfortunate typo in the code that results in writing to +FLOW_CTLR_HALT instead of FLOW_CTLR_CSR. + +Acked-by: Peter De Schrijver <pdeschrijver@nvidia.com> +Signed-off-by: Dmitry Osipenko <digetx@gmail.com> +Signed-off-by: Thierry Reding <treding@nvidia.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/arm/mach-tegra/reset-handler.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm/mach-tegra/reset-handler.S ++++ b/arch/arm/mach-tegra/reset-handler.S +@@ -55,16 +55,16 @@ ENTRY(tegra_resume) + cmp r6, #TEGRA20 + beq 1f @ Yes + /* Clear the flow controller flags for this CPU. */ +- cpu_to_csr_reg r1, r0 ++ cpu_to_csr_reg r3, r0 + mov32 r2, TEGRA_FLOW_CTRL_BASE +- ldr r1, [r2, r1] ++ ldr r1, [r2, r3] + /* Clear event & intr flag */ + orr r1, r1, \ + #FLOW_CTRL_CSR_INTR_FLAG | FLOW_CTRL_CSR_EVENT_FLAG + movw r0, #0x3FFD @ enable, cluster_switch, immed, bitmaps + @ & ext flags for CPU power mgnt + bic r1, r1, r0 +- str r1, [r2] ++ str r1, [r2, r3] + 1: + + mov32 r9, 0xc09 diff --git a/queue-3.16/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch b/queue-3.16/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch new file mode 100644 index 00000000..876fa8f0 --- /dev/null +++ b/queue-3.16/asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch @@ -0,0 +1,32 @@ +From: Pawel Harlozinski <pawel.harlozinski@linux.intel.com> +Date: Tue, 12 Nov 2019 14:02:36 +0100 +Subject: ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report + +commit 8f157d4ff039e03e2ed4cb602eeed2fd4687a58f upstream. + +Check for existance of jack before tracing. +NULL pointer dereference has been reported by KASAN while unloading +machine driver (snd_soc_cnl_rt274). + +Signed-off-by: Pawel Harlozinski <pawel.harlozinski@linux.intel.com> +Link: https://lore.kernel.org/r/20191112130237.10141-1-pawel.harlozinski@linux.intel.com +Signed-off-by: Mark Brown <broonie@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + sound/soc/soc-jack.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/soc-jack.c ++++ b/sound/soc/soc-jack.c +@@ -69,10 +69,9 @@ void snd_soc_jack_report(struct snd_soc_ + unsigned int sync = 0; + int enable; + +- trace_snd_soc_jack_report(jack, mask, status); +- + if (!jack) + return; ++ trace_snd_soc_jack_report(jack, mask, status); + + codec = jack->codec; + dapm = &codec->dapm; diff --git a/queue-3.16/ath9k_hw-fix-uninitialized-variable-data.patch b/queue-3.16/ath9k_hw-fix-uninitialized-variable-data.patch new file mode 100644 index 00000000..7f221ed1 --- /dev/null +++ b/queue-3.16/ath9k_hw-fix-uninitialized-variable-data.patch @@ -0,0 +1,34 @@ +From: Denis Efremov <efremov@linux.com> +Date: Fri, 27 Sep 2019 01:56:04 +0300 +Subject: ath9k_hw: fix uninitialized variable data + +commit 80e84f36412e0c5172447b6947068dca0d04ee82 upstream. + +Currently, data variable in ar9003_hw_thermo_cal_apply() could be +uninitialized if ar9300_otp_read_word() will fail to read the value. +Initialize data variable with 0 to prevent an undefined behavior. This +will be enough to handle error case when ar9300_otp_read_word() fails. + +Fixes: 80fe43f2bbd5 ("ath9k_hw: Read and configure thermocal for AR9462") +Cc: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> +Cc: John W. Linville <linville@tuxdriver.com> +Cc: Kalle Valo <kvalo@codeaurora.org> +Cc: "David S. Miller" <davem@davemloft.net> +Signed-off-by: Denis Efremov <efremov@linux.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c +@@ -4107,7 +4107,7 @@ static void ar9003_hw_thermometer_apply( + + static void ar9003_hw_thermo_cal_apply(struct ath_hw *ah) + { +- u32 data, ko, kg; ++ u32 data = 0, ko, kg; + + if (!AR_SREV_9462_20_OR_LATER(ah)) + return; diff --git a/queue-3.16/binder-handle-start-null-in-binder_update_page_range.patch b/queue-3.16/binder-handle-start-null-in-binder_update_page_range.patch new file mode 100644 index 00000000..8418bf6f --- /dev/null +++ b/queue-3.16/binder-handle-start-null-in-binder_update_page_range.patch @@ -0,0 +1,51 @@ +From: Jann Horn <jannh@google.com> +Date: Fri, 18 Oct 2019 22:56:31 +0200 +Subject: binder: Handle start==NULL in binder_update_page_range() + +commit 2a9edd056ed4fbf9d2e797c3fc06335af35bccc4 upstream. + +The old loop wouldn't stop when reaching `start` if `start==NULL`, instead +continuing backwards to index -1 and crashing. + +Luckily you need to be highly privileged to map things at NULL, so it's not +a big problem. + +Fix it by adjusting the loop so that the loop variable is always in bounds. + +This patch is deliberately minimal to simplify backporting, but IMO this +function could use a refactor. The jump labels in the second loop body are +horrible (the error gotos should be jumping to free_range instead), and +both loops would look nicer if they just iterated upwards through indices. +And the up_read()+mmput() shouldn't be duplicated like that. + +Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") +Signed-off-by: Jann Horn <jannh@google.com> +Acked-by: Christian Brauner <christian.brauner@ubuntu.com> +Link: https://lore.kernel.org/r/20191018205631.248274-3-jannh@google.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: There is no continue statement in the loop, + so we only need to check the exit condition at the bottom] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -624,8 +624,7 @@ static int binder_update_page_range(stru + return 0; + + free_range: +- for (page_addr = end - PAGE_SIZE; page_addr >= start; +- page_addr -= PAGE_SIZE) { ++ for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) { + page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; + if (vma) + zap_page_range(vma, (uintptr_t)page_addr + +@@ -636,7 +635,8 @@ err_map_kernel_failed: + __free_page(*page); + *page = NULL; + err_alloc_page_failed: +- ; ++ if (page_addr == start) ++ break; + } + err_no_vma: + if (mm) { diff --git a/queue-3.16/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch b/queue-3.16/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch new file mode 100644 index 00000000..ce72bfdf --- /dev/null +++ b/queue-3.16/blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch @@ -0,0 +1,56 @@ +From: Ming Lei <ming.lei@redhat.com> +Date: Sat, 2 Nov 2019 16:02:15 +0800 +Subject: blk-mq: avoid sysfs buffer overflow with too many CPU cores + +commit 8962842ca5abdcf98e22ab3b2b45a103f0408b95 upstream. + +It is reported that sysfs buffer overflow can be triggered if the system +has too many CPU cores(>841 on 4K PAGE_SIZE) when showing CPUs of +hctx via /sys/block/$DEV/mq/$N/cpu_list. + +Use snprintf to avoid the potential buffer overflow. + +This version doesn't change the attribute format, and simply stops +showing CPU numbers if the buffer is going to overflow. + +Fixes: 676141e48af7("blk-mq: don't dump CPU -> hw queue map on driver load") +Signed-off-by: Ming Lei <ming.lei@redhat.com> +Signed-off-by: Jens Axboe <axboe@kernel.dk> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + block/blk-mq-sysfs.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -226,20 +226,25 @@ static ssize_t blk_mq_hw_sysfs_active_sh + + static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page) + { ++ const size_t size = PAGE_SIZE - 1; + unsigned int i, first = 1; +- ssize_t ret = 0; ++ int ret = 0, pos = 0; + + for_each_cpu(i, hctx->cpumask) { + if (first) +- ret += sprintf(ret + page, "%u", i); ++ ret = snprintf(pos + page, size - pos, "%u", i); + else +- ret += sprintf(ret + page, ", %u", i); ++ ret = snprintf(pos + page, size - pos, ", %u", i); ++ ++ if (ret >= size - pos) ++ break; + + first = 0; ++ pos += ret; + } + +- ret += sprintf(ret + page, "\n"); +- return ret; ++ ret = snprintf(pos + page, size - pos, "\n"); ++ return pos + ret; + } + + static struct blk_mq_ctx_sysfs_entry blk_mq_sysfs_dispatched = { diff --git a/queue-3.16/blk-mq-fix-deadlock-when-reading-cpu_list.patch b/queue-3.16/blk-mq-fix-deadlock-when-reading-cpu_list.patch new file mode 100644 index 00000000..ab8a5516 --- /dev/null +++ b/queue-3.16/blk-mq-fix-deadlock-when-reading-cpu_list.patch @@ -0,0 +1,81 @@ +From: Akinobu Mita <akinobu.mita@gmail.com> +Date: Sun, 27 Sep 2015 02:09:25 +0900 +Subject: blk-mq: fix deadlock when reading cpu_list + +commit 60de074ba1e8f327db19bc33d8530131ac01695d upstream. + +CPU hotplug handling for blk-mq (blk_mq_queue_reinit) acquires +all_q_mutex in blk_mq_queue_reinit_notify() and then removes sysfs +entries by blk_mq_sysfs_unregister(). Removing sysfs entry needs to +be blocked until the active reference of the kernfs_node to be zero. + +On the other hand, reading blk_mq_hw_sysfs_cpu sysfs entry (e.g. +/sys/block/nullb0/mq/0/cpu_list) acquires all_q_mutex in +blk_mq_hw_sysfs_cpus_show(). + +If these happen at the same time, a deadlock can happen. Because one +can wait for the active reference to be zero with holding all_q_mutex, +and the other tries to acquire all_q_mutex with holding the active +reference. + +The reason that all_q_mutex is acquired in blk_mq_hw_sysfs_cpus_show() +is to avoid reading an imcomplete hctx->cpumask. Since reading sysfs +entry for blk-mq needs to acquire q->sysfs_lock, we can avoid deadlock +and reading an imcomplete hctx->cpumask by protecting q->sysfs_lock +while hctx->cpumask is being updated. + +Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> +Reviewed-by: Ming Lei <tom.leiming@gmail.com> +Cc: Ming Lei <tom.leiming@gmail.com> +Cc: Wanpeng Li <wanpeng.li@hotmail.com> +Reviewed-by: Christoph Hellwig <hch@lst.de> +Signed-off-by: Jens Axboe <axboe@fb.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + block/blk-mq-sysfs.c | 4 ---- + block/blk-mq.c | 7 +++++++ + 2 files changed, 7 insertions(+), 4 deletions(-) + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -229,8 +229,6 @@ static ssize_t blk_mq_hw_sysfs_cpus_show + unsigned int i, first = 1; + ssize_t ret = 0; + +- blk_mq_disable_hotplug(); +- + for_each_cpu(i, hctx->cpumask) { + if (first) + ret += sprintf(ret + page, "%u", i); +@@ -240,8 +238,6 @@ static ssize_t blk_mq_hw_sysfs_cpus_show + first = 0; + } + +- blk_mq_enable_hotplug(); +- + ret += sprintf(ret + page, "\n"); + return ret; + } +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1645,6 +1645,11 @@ static void blk_mq_map_swqueue(struct re + struct blk_mq_ctx *ctx; + struct blk_mq_tag_set *set = q->tag_set; + ++ /* ++ * Avoid others reading imcomplete hctx->cpumask through sysfs ++ */ ++ mutex_lock(&q->sysfs_lock); ++ + queue_for_each_hw_ctx(q, hctx, i) { + cpumask_clear(hctx->cpumask); + hctx->nr_ctx = 0; +@@ -1664,6 +1669,8 @@ static void blk_mq_map_swqueue(struct re + hctx->ctxs[hctx->nr_ctx++] = ctx; + } + ++ mutex_unlock(&q->sysfs_lock); ++ + queue_for_each_hw_ctx(q, hctx, i) { + /* + * If not software queues are mapped to this hardware queue, diff --git a/queue-3.16/blk-mq-make-sure-that-line-break-can-be-printed.patch b/queue-3.16/blk-mq-make-sure-that-line-break-can-be-printed.patch new file mode 100644 index 00000000..45a69b59 --- /dev/null +++ b/queue-3.16/blk-mq-make-sure-that-line-break-can-be-printed.patch @@ -0,0 +1,30 @@ +From: Ming Lei <ming.lei@redhat.com> +Date: Mon, 4 Nov 2019 16:26:53 +0800 +Subject: blk-mq: make sure that line break can be printed + +commit d2c9be89f8ebe7ebcc97676ac40f8dec1cf9b43a upstream. + +8962842ca5ab ("blk-mq: avoid sysfs buffer overflow with too many CPU cores") +avoids sysfs buffer overflow, and reserves one character for line break. +However, the last snprintf() doesn't get correct 'size' parameter passed +in, so fixed it. + +Fixes: 8962842ca5ab ("blk-mq: avoid sysfs buffer overflow with too many CPU cores") +Signed-off-by: Ming Lei <ming.lei@redhat.com> +Signed-off-by: Jens Axboe <axboe@kernel.dk> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + block/blk-mq-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -243,7 +243,7 @@ static ssize_t blk_mq_hw_sysfs_cpus_show + pos += ret; + } + +- ret = snprintf(pos + page, size - pos, "\n"); ++ ret = snprintf(pos + page, size + 1 - pos, "\n"); + return pos + ret; + } + diff --git a/queue-3.16/bluetooth-delete-a-stray-unlock.patch b/queue-3.16/bluetooth-delete-a-stray-unlock.patch new file mode 100644 index 00000000..3d0f5d4f --- /dev/null +++ b/queue-3.16/bluetooth-delete-a-stray-unlock.patch @@ -0,0 +1,32 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Tue, 19 Nov 2019 09:17:05 +0300 +Subject: Bluetooth: delete a stray unlock + +commit df66499a1fab340c167250a5743931dc50d5f0fa upstream. + +We used to take a lock in amp_physical_cfm() but then we moved it to +the caller function. Unfortunately the unlock on this error path was +overlooked so it leads to a double unlock. + +Fixes: a514b17fab51 ("Bluetooth: Refactor locking in amp_physical_cfm") +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Marcel Holtmann <marcel@holtmann.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/bluetooth/l2cap_core.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -4902,10 +4902,8 @@ void __l2cap_physical_cfm(struct l2cap_c + BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", + chan, result, local_amp_id, remote_amp_id); + +- if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) { +- l2cap_chan_unlock(chan); ++ if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) + return; +- } + + if (chan->state != BT_CONNECTED) { + l2cap_do_create(chan, result, local_amp_id, remote_amp_id); diff --git a/queue-3.16/bluetooth-hci_core-fix-init-for-hci_user_channel.patch b/queue-3.16/bluetooth-hci_core-fix-init-for-hci_user_channel.patch new file mode 100644 index 00000000..d035505b --- /dev/null +++ b/queue-3.16/bluetooth-hci_core-fix-init-for-hci_user_channel.patch @@ -0,0 +1,45 @@ +From: Mattijs Korpershoek <mkorpershoek@baylibre.com> +Date: Wed, 16 Oct 2019 20:20:39 -0700 +Subject: Bluetooth: hci_core: fix init for HCI_USER_CHANNEL + +commit eb8c101e28496888a0dcfe16ab86a1bee369e820 upstream. + +During the setup() stage, HCI device drivers expect the chip to +acknowledge its setup() completion via vendor specific frames. + +If userspace opens() such HCI device in HCI_USER_CHANNEL [1] mode, +the vendor specific frames are never tranmitted to the driver, as +they are filtered in hci_rx_work(). + +Allow HCI devices which operate in HCI_USER_CHANNEL mode to receive +frames if the HCI device is is HCI_INIT state. + +[1] https://www.spinics.net/lists/linux-bluetooth/msg37345.html + +Fixes: 23500189d7e0 ("Bluetooth: Introduce new HCI socket channel for user operation") +Signed-off-by: Mattijs Korpershoek <mkorpershoek@baylibre.com> +Signed-off-by: Marcel Holtmann <marcel@holtmann.org> +[bwh: Backported to 3.16: Keep checking both HCI_RAW and HCI_USER_CHANNEL + bits here] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -5226,8 +5226,15 @@ static void hci_rx_work(struct work_stru + hci_send_to_sock(hdev, skb); + } + +- if (test_bit(HCI_RAW, &hdev->flags) || +- test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) { ++ /* If the device has been opened in HCI_USER_CHANNEL, ++ * the userspace has exclusive access to device. ++ * When device is HCI_INIT, we still need to process ++ * the data packets to the driver in order ++ * to complete its setup(). ++ */ ++ if ((test_bit(HCI_RAW, &hdev->flags) || ++ test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) && ++ !test_bit(HCI_INIT, &hdev->flags)) { + kfree_skb(skb); + continue; + } diff --git a/queue-3.16/bnx2x-enable-multi-cos-feature.patch b/queue-3.16/bnx2x-enable-multi-cos-feature.patch new file mode 100644 index 00000000..b546ae71 --- /dev/null +++ b/queue-3.16/bnx2x-enable-multi-cos-feature.patch @@ -0,0 +1,31 @@ +From: Sudarsana Reddy Kalluru <skalluru@marvell.com> +Date: Mon, 4 Nov 2019 21:51:10 -0800 +Subject: bnx2x: Enable Multi-Cos feature. + +commit 069e47823fff2c634b2d46a328b5096fdc8c2a0c upstream. + +FW version 7.13.15 addresses the issue in Multi-cos implementation. +This patch re-enables the Multi-Cos support in the driver. + +Fixes: d1f0b5dce8fd ("bnx2x: Disable multi-cos feature.") +Signed-off-by: Sudarsana Reddy Kalluru <skalluru@marvell.com> +Signed-off-by: Ariel Elior <aelior@marvell.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +[bwh: Backported to 3.16: Keep calling fallback()] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1914,7 +1914,8 @@ u16 bnx2x_select_queue(struct net_device + } + + /* select a non-FCoE queue */ +- return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp)); ++ return fallback(dev, skb) % ++ (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos); + } + + void bnx2x_set_num_queues(struct bnx2x *bp) diff --git a/queue-3.16/btrfs-check-page-mapping-when-loading-free-space-cache.patch b/queue-3.16/btrfs-check-page-mapping-when-loading-free-space-cache.patch new file mode 100644 index 00000000..826b24e3 --- /dev/null +++ b/queue-3.16/btrfs-check-page-mapping-when-loading-free-space-cache.patch @@ -0,0 +1,71 @@ +From: Josef Bacik <josef@toxicpanda.com> +Date: Tue, 24 Sep 2019 16:50:43 -0400 +Subject: btrfs: check page->mapping when loading free space cache + +commit 3797136b626ad4b6582223660c041efdea8f26b2 upstream. + +While testing 5.2 we ran into the following panic + +[52238.017028] BUG: kernel NULL pointer dereference, address: 0000000000000001 +[52238.105608] RIP: 0010:drop_buffers+0x3d/0x150 +[52238.304051] Call Trace: +[52238.308958] try_to_free_buffers+0x15b/0x1b0 +[52238.317503] shrink_page_list+0x1164/0x1780 +[52238.325877] shrink_inactive_list+0x18f/0x3b0 +[52238.334596] shrink_node_memcg+0x23e/0x7d0 +[52238.342790] ? do_shrink_slab+0x4f/0x290 +[52238.350648] shrink_node+0xce/0x4a0 +[52238.357628] balance_pgdat+0x2c7/0x510 +[52238.365135] kswapd+0x216/0x3e0 +[52238.371425] ? wait_woken+0x80/0x80 +[52238.378412] ? balance_pgdat+0x510/0x510 +[52238.386265] kthread+0x111/0x130 +[52238.392727] ? kthread_create_on_node+0x60/0x60 +[52238.401782] ret_from_fork+0x1f/0x30 + +The page we were trying to drop had a page->private, but had no +page->mapping and so called drop_buffers, assuming that we had a +buffer_head on the page, and then panic'ed trying to deref 1, which is +our page->private for data pages. + +This is happening because we're truncating the free space cache while +we're trying to load the free space cache. This isn't supposed to +happen, and I'll fix that in a followup patch. However we still +shouldn't allow those sort of mistakes to result in messing with pages +that do not belong to us. So add the page->mapping check to verify that +we still own this page after dropping and re-acquiring the page lock. + +This page being unlocked as: +btrfs_readpage + extent_read_full_page + __extent_read_full_page + __do_readpage + if (!nr) + unlock_page <-- nr can be 0 only if submit_extent_page + returns an error + +Reviewed-by: Filipe Manana <fdmanana@suse.com> +Reviewed-by: Nikolay Borisov <nborisov@suse.com> +Signed-off-by: Josef Bacik <josef@toxicpanda.com> +[ add callchain ] +Signed-off-by: David Sterba <dsterba@suse.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/btrfs/free-space-cache.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -360,6 +360,12 @@ static int io_ctl_prepare_pages(struct i + if (uptodate && !PageUptodate(page)) { + btrfs_readpage(NULL, page); + lock_page(page); ++ if (page->mapping != inode->i_mapping) { ++ btrfs_err(BTRFS_I(inode)->root->fs_info, ++ "free space cache page truncated"); ++ io_ctl_drop_pages(io_ctl); ++ return -EIO; ++ } + if (!PageUptodate(page)) { + btrfs_err(BTRFS_I(inode)->root->fs_info, + "error reading free space cache"); diff --git a/queue-3.16/btrfs-fix-negative-subv_writers-counter-and-data-space-leak-after.patch b/queue-3.16/btrfs-fix-negative-subv_writers-counter-and-data-space-leak-after.patch new file mode 100644 index 00000000..cf93efb1 --- /dev/null +++ b/queue-3.16/btrfs-fix-negative-subv_writers-counter-and-data-space-leak-after.patch @@ -0,0 +1,83 @@ +From: Filipe Manana <fdmanana@suse.com> +Date: Fri, 11 Oct 2019 16:41:20 +0100 +Subject: Btrfs: fix negative subv_writers counter and data space leak after + buffered write + +commit a0e248bb502d5165b3314ac3819e888fdcdf7d9f upstream. + +When doing a buffered write it's possible to leave the subv_writers +counter of the root, used for synchronization between buffered nocow +writers and snapshotting. This happens in an exceptional case like the +following: + +1) We fail to allocate data space for the write, since there's not + enough available data space nor enough unallocated space for allocating + a new data block group; + +2) Because of that failure, we try to go to NOCOW mode, which succeeds + and therefore we set the local variable 'only_release_metadata' to true + and set the root's sub_writers counter to 1 through the call to + btrfs_start_write_no_snapshotting() made by check_can_nocow(); + +3) The call to btrfs_copy_from_user() returns zero, which is very unlikely + to happen but not impossible; + +4) No pages are copied because btrfs_copy_from_user() returned zero; + +5) We call btrfs_end_write_no_snapshotting() which decrements the root's + subv_writers counter to 0; + +6) We don't set 'only_release_metadata' back to 'false' because we do + it only if 'copied', the value returned by btrfs_copy_from_user(), is + greater than zero; + +7) On the next iteration of the while loop, which processes the same + page range, we are now able to allocate data space for the write (we + got enough data space released in the meanwhile); + +8) After this if we fail at btrfs_delalloc_reserve_metadata(), because + now there isn't enough free metadata space, or in some other place + further below (prepare_pages(), lock_and_cleanup_extent_if_need(), + btrfs_dirty_pages()), we break out of the while loop with + 'only_release_metadata' having a value of 'true'; + +9) Because 'only_release_metadata' is 'true' we end up decrementing the + root's subv_writers counter to -1 (through a call to + btrfs_end_write_no_snapshotting()), and we also end up not releasing the + data space previously reserved through btrfs_check_data_free_space(). + As a consequence the mechanism for synchronizing NOCOW buffered writes + with snapshotting gets broken. + +Fix this by always setting 'only_release_metadata' to false at the start +of each iteration. + +Fixes: 8257b2dc3c1a ("Btrfs: introduce btrfs_{start, end}_nocow_write() for each subvolume") +Fixes: 7ee9e4405f26 ("Btrfs: check if we can nocow if we don't have data space") +Reviewed-by: Josef Bacik <josef@toxicpanda.com> +Signed-off-by: Filipe Manana <fdmanana@suse.com> +Reviewed-by: David Sterba <dsterba@suse.com> +Signed-off-by: David Sterba <dsterba@suse.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/btrfs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1540,6 +1540,7 @@ static noinline ssize_t __btrfs_buffered + break; + } + ++ only_release_metadata = false; + reserve_bytes = num_pages << PAGE_CACHE_SHIFT; + ret = btrfs_check_data_free_space(inode, reserve_bytes); + if (ret == -ENOSPC && +@@ -1671,7 +1672,6 @@ again: + set_extent_bit(&BTRFS_I(inode)->io_tree, lockstart, + lockend, EXTENT_NORESERVE, NULL, + NULL, GFP_NOFS); +- only_release_metadata = false; + } + + btrfs_drop_pages(pages, num_pages); diff --git a/queue-3.16/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconnect-occurs.patch b/queue-3.16/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconnect-occurs.patch new file mode 100644 index 00000000..f0c1928c --- /dev/null +++ b/queue-3.16/cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconnect-occurs.patch @@ -0,0 +1,166 @@ +From: Dave Wysochanski <dwysocha@redhat.com> +Date: Wed, 23 Oct 2019 05:02:33 -0400 +Subject: cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs + +commit d46b0da7a33dd8c99d969834f682267a45444ab3 upstream. + +There's a deadlock that is possible and can easily be seen with +a test where multiple readers open/read/close of the same file +and a disruption occurs causing reconnect. The deadlock is due +a reader thread inside cifs_strict_readv calling down_read and +obtaining lock_sem, and then after reconnect inside +cifs_reopen_file calling down_read a second time. If in +between the two down_read calls, a down_write comes from +another process, deadlock occurs. + + CPU0 CPU1 + ---- ---- +cifs_strict_readv() + down_read(&cifsi->lock_sem); + _cifsFileInfo_put + OR + cifs_new_fileinfo + down_write(&cifsi->lock_sem); +cifs_reopen_file() + down_read(&cifsi->lock_sem); + +Fix the above by changing all down_write(lock_sem) calls to +down_write_trylock(lock_sem)/msleep() loop, which in turn +makes the second down_read call benign since it will never +block behind the writer while holding lock_sem. + +Signed-off-by: Dave Wysochanski <dwysocha@redhat.com> +Suggested-by: Ronnie Sahlberg <lsahlber@redhat.com> +Reviewed--by: Ronnie Sahlberg <lsahlber@redhat.com> +Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/cifs/cifsglob.h | 5 +++++ + fs/cifs/cifsproto.h | 1 + + fs/cifs/file.c | 23 +++++++++++++++-------- + fs/cifs/smb2file.c | 2 +- + 4 files changed, 22 insertions(+), 9 deletions(-) + +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1113,6 +1113,11 @@ void cifsFileInfo_put(struct cifsFileInf + struct cifsInodeInfo { + bool can_cache_brlcks; + struct list_head llist; /* locks helb by this inode */ ++ /* ++ * NOTE: Some code paths call down_read(lock_sem) twice, so ++ * we must always use use cifs_down_write() instead of down_write() ++ * for this semaphore to avoid deadlocks. ++ */ + struct rw_semaphore lock_sem; /* protect the fields above */ + /* BB add in lists for dirty pages i.e. write caching info for oplock */ + struct list_head openFileList; +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -137,6 +137,7 @@ extern int cifs_unlock_range(struct cifs + struct file_lock *flock, const unsigned int xid); + extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile); + ++extern void cifs_down_write(struct rw_semaphore *sem); + extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, + struct file *file, + struct tcon_link *tlink, +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -281,6 +281,13 @@ cifs_has_mand_locks(struct cifsInodeInfo + return has_locks; + } + ++void ++cifs_down_write(struct rw_semaphore *sem) ++{ ++ while (!down_write_trylock(sem)) ++ msleep(10); ++} ++ + struct cifsFileInfo * + cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, + struct tcon_link *tlink, __u32 oplock) +@@ -306,7 +313,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_add(&fdlocks->llist, &cinode->llist); + up_write(&cinode->lock_sem); + +@@ -462,7 +469,7 @@ void _cifsFileInfo_put(struct cifsFileIn + * Delete any outstanding lock records. We'll lose them when the file + * is closed anyway. + */ +- down_write(&cifsi->lock_sem); ++ cifs_down_write(&cifsi->lock_sem); + list_for_each_entry_safe(li, tmp, &cifs_file->llist->locks, llist) { + list_del(&li->llist); + cifs_del_lock_waiters(li); +@@ -970,7 +977,7 @@ static void + cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock) + { + struct cifsInodeInfo *cinode = CIFS_I(cfile->dentry->d_inode); +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_add_tail(&lock->llist, &cfile->llist->locks); + up_write(&cinode->lock_sem); + } +@@ -992,7 +999,7 @@ cifs_lock_add_if(struct cifsFileInfo *cf + + try_again: + exist = false; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + + exist = cifs_find_lock_conflict(cfile, lock->offset, lock->length, + lock->type, &conf_lock, CIFS_LOCK_OP); +@@ -1014,7 +1021,7 @@ try_again: + (lock->blist.next == &lock->blist)); + if (!rc) + goto try_again; +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_del_init(&lock->blist); + } + +@@ -1067,7 +1074,7 @@ cifs_posix_lock_set(struct file *file, s + return rc; + + try_again: +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + if (!cinode->can_cache_brlcks) { + up_write(&cinode->lock_sem); + return rc; +@@ -1267,7 +1274,7 @@ cifs_push_locks(struct cifsFileInfo *cfi + int rc = 0; + + /* we are going to update can_cache_brlcks here - need a write access */ +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + if (!cinode->can_cache_brlcks) { + up_write(&cinode->lock_sem); + return rc; +@@ -1451,7 +1458,7 @@ cifs_unlock_range(struct cifsFileInfo *c + if (!buf) + return -ENOMEM; + +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + for (i = 0; i < 2; i++) { + cur = buf; + num = 0; +--- a/fs/cifs/smb2file.c ++++ b/fs/cifs/smb2file.c +@@ -114,7 +114,7 @@ smb2_unlock_range(struct cifsFileInfo *c + + cur = buf; + +- down_write(&cinode->lock_sem); ++ cifs_down_write(&cinode->lock_sem); + list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) { + if (flock->fl_start > li->offset || + (flock->fl_start + length) < diff --git a/queue-3.16/cifs-fix-null-pointer-dereference-in-smb2_push_mandatory_locks.patch b/queue-3.16/cifs-fix-null-pointer-dereference-in-smb2_push_mandatory_locks.patch new file mode 100644 index 00000000..eb3097b2 --- /dev/null +++ b/queue-3.16/cifs-fix-null-pointer-dereference-in-smb2_push_mandatory_locks.patch @@ -0,0 +1,67 @@ +From: Pavel Shilovsky <pshilov@microsoft.com> +Date: Wed, 27 Nov 2019 16:18:39 -0800 +Subject: CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks + +commit 6f582b273ec23332074d970a7fb25bef835df71f upstream. + +Currently when the client creates a cifsFileInfo structure for +a newly opened file, it allocates a list of byte-range locks +with a pointer to the new cfile and attaches this list to the +inode's lock list. The latter happens before initializing all +other fields, e.g. cfile->tlink. Thus a partially initialized +cifsFileInfo structure becomes available to other threads that +walk through the inode's lock list. One example of such a thread +may be an oplock break worker thread that tries to push all +cached byte-range locks. This causes NULL-pointer dereference +in smb2_push_mandatory_locks() when accessing cfile->tlink: + +[598428.945633] BUG: kernel NULL pointer dereference, address: 0000000000000038 +... +[598428.945749] Workqueue: cifsoplockd cifs_oplock_break [cifs] +[598428.945793] RIP: 0010:smb2_push_mandatory_locks+0xd6/0x5a0 [cifs] +... +[598428.945834] Call Trace: +[598428.945870] ? cifs_revalidate_mapping+0x45/0x90 [cifs] +[598428.945901] cifs_oplock_break+0x13d/0x450 [cifs] +[598428.945909] process_one_work+0x1db/0x380 +[598428.945914] worker_thread+0x4d/0x400 +[598428.945921] kthread+0x104/0x140 +[598428.945925] ? process_one_work+0x380/0x380 +[598428.945931] ? kthread_park+0x80/0x80 +[598428.945937] ret_from_fork+0x35/0x40 + +Fix this by reordering initialization steps of the cifsFileInfo +structure: initialize all the fields first and then add the new +byte-range lock list to the inode's lock list. + +Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> +Reviewed-by: Aurelien Aptel <aaptel@suse.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/cifs/file.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -313,9 +313,6 @@ cifs_new_fileinfo(struct cifs_fid *fid, + INIT_LIST_HEAD(&fdlocks->locks); + fdlocks->cfile = cfile; + cfile->llist = fdlocks; +- cifs_down_write(&cinode->lock_sem); +- list_add(&fdlocks->llist, &cinode->llist); +- up_write(&cinode->lock_sem); + + cfile->count = 1; + cfile->pid = current->tgid; +@@ -339,6 +336,10 @@ cifs_new_fileinfo(struct cifs_fid *fid, + oplock = 0; + } + ++ cifs_down_write(&cinode->lock_sem); ++ list_add(&fdlocks->llist, &cinode->llist); ++ up_write(&cinode->lock_sem); ++ + spin_lock(&tcon->open_file_lock); + if (fid->pending_open->oplock != CIFS_OPLOCK_NO_CHANGE && oplock) + oplock = fid->pending_open->oplock; diff --git a/queue-3.16/cifs-fix-smb2-oplock-break-processing.patch b/queue-3.16/cifs-fix-smb2-oplock-break-processing.patch new file mode 100644 index 00000000..c5337279 --- /dev/null +++ b/queue-3.16/cifs-fix-smb2-oplock-break-processing.patch @@ -0,0 +1,63 @@ +From: Pavel Shilovsky <pshilov@microsoft.com> +Date: Thu, 31 Oct 2019 14:18:57 -0700 +Subject: CIFS: Fix SMB2 oplock break processing + +commit fa9c2362497fbd64788063288dc4e74daf977ebb upstream. + +Even when mounting modern protocol version the server may be +configured without supporting SMB2.1 leases and the client +uses SMB2 oplock to optimize IO performance through local caching. + +However there is a problem in oplock break handling that leads +to missing a break notification on the client who has a file +opened. It latter causes big latencies to other clients that +are trying to open the same file. + +The problem reproduces when there are multiple shares from the +same server mounted on the client. The processing code tries to +match persistent and volatile file ids from the break notification +with an open file but it skips all share besides the first one. +Fix this by looking up in all shares belonging to the server that +issued the oplock break. + +Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/cifs/smb2misc.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -563,10 +563,10 @@ smb2_is_valid_oplock_break(char *buffer, + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp, &server->smb_ses_list) { + ses = list_entry(tmp, struct cifs_ses, smb_ses_list); ++ + list_for_each(tmp1, &ses->tcon_list) { + tcon = list_entry(tmp1, struct cifs_tcon, tcon_list); + +- cifs_stats_inc(&tcon->stats.cifs_stats.num_oplock_brks); + spin_lock(&tcon->open_file_lock); + list_for_each(tmp2, &tcon->openFileList) { + cfile = list_entry(tmp2, struct cifsFileInfo, +@@ -578,6 +578,8 @@ smb2_is_valid_oplock_break(char *buffer, + continue; + + cifs_dbg(FYI, "file id match, oplock break\n"); ++ cifs_stats_inc( ++ &tcon->stats.cifs_stats.num_oplock_brks); + cinode = CIFS_I(cfile->dentry->d_inode); + spin_lock(&cfile->file_info_lock); + if (!CIFS_CACHE_WRITE(cinode) && +@@ -610,9 +612,6 @@ smb2_is_valid_oplock_break(char *buffer, + return true; + } + spin_unlock(&tcon->open_file_lock); +- spin_unlock(&cifs_tcp_ses_lock); +- cifs_dbg(FYI, "No matching file for oplock break\n"); +- return true; + } + } + spin_unlock(&cifs_tcp_ses_lock); diff --git a/queue-3.16/cifs-respect-o_sync-and-o_direct-flags-during-reconnect.patch b/queue-3.16/cifs-respect-o_sync-and-o_direct-flags-during-reconnect.patch new file mode 100644 index 00000000..60ddda73 --- /dev/null +++ b/queue-3.16/cifs-respect-o_sync-and-o_direct-flags-during-reconnect.patch @@ -0,0 +1,41 @@ +From: Pavel Shilovsky <pshilov@microsoft.com> +Date: Tue, 12 Nov 2019 17:16:35 -0800 +Subject: CIFS: Respect O_SYNC and O_DIRECT flags during reconnect + +commit 44805b0e62f15e90d233485420e1847133716bdc upstream. + +Currently the client translates O_SYNC and O_DIRECT flags +into corresponding SMB create options when openning a file. +The problem is that on reconnect when the file is being +re-opened the client doesn't set those flags and it causes +a server to reject re-open requests because create options +don't match. The latter means that any subsequent system +call against that open file fail until a share is re-mounted. + +Fix this by properly setting SMB create options when +re-openning files after reconnects. + +Fixes: 1013e760d10e6: ("SMB3: Don't ignore O_SYNC/O_DSYNC and O_DIRECT flags") +Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/cifs/file.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -711,6 +711,13 @@ cifs_reopen_file(struct cifsFileInfo *cf + if (backup_cred(cifs_sb)) + create_options |= CREATE_OPEN_BACKUP_INTENT; + ++ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ ++ if (cfile->f_flags & O_SYNC) ++ create_options |= CREATE_WRITE_THROUGH; ++ ++ if (cfile->f_flags & O_DIRECT) ++ create_options |= CREATE_NO_BUFFER; ++ + if (server->ops->get_lease_key) + server->ops->get_lease_key(inode, &cfile->fid); + diff --git a/queue-3.16/clk-samsung-exynos5420-preserve-cpu-clocks-configuration-during.patch b/queue-3.16/clk-samsung-exynos5420-preserve-cpu-clocks-configuration-during.patch new file mode 100644 index 00000000..020f05d8 --- /dev/null +++ b/queue-3.16/clk-samsung-exynos5420-preserve-cpu-clocks-configuration-during.patch @@ -0,0 +1,31 @@ +From: Marian Mihailescu <mihailescu2m@gmail.com> +Date: Tue, 29 Oct 2019 11:20:25 +1030 +Subject: clk: samsung: exynos5420: Preserve CPU clocks configuration during + suspend/resume + +commit e21be0d1d7bd7f78a77613f6bcb6965e72b22fc1 upstream. + +Save and restore top PLL related configuration registers for big (APLL) +and LITTLE (KPLL) cores during suspend/resume cycle. So far, CPU clocks +were reset to default values after suspend/resume cycle and performance +after system resume was affected when performance governor has been selected. + +Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list") +Signed-off-by: Marian Mihailescu <mihailescu2m@gmail.com> +Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/clk/samsung/clk-exynos5420.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -162,6 +162,8 @@ static unsigned long exynos5x_clk_regs[] + GATE_BUS_CPU, + GATE_SCLK_CPU, + CLKOUT_CMU_CPU, ++ APLL_CON0, ++ KPLL_CON0, + CPLL_CON0, + DPLL_CON0, + EPLL_CON0, diff --git a/queue-3.16/compat_ioctl-handle-siocoutqnsd.patch b/queue-3.16/compat_ioctl-handle-siocoutqnsd.patch new file mode 100644 index 00000000..e1a89c36 --- /dev/null +++ b/queue-3.16/compat_ioctl-handle-siocoutqnsd.patch @@ -0,0 +1,30 @@ +From: Arnd Bergmann <arnd@arndb.de> +Date: Mon, 3 Jun 2019 23:06:00 +0200 +Subject: compat_ioctl: handle SIOCOUTQNSD + +commit 9d7bf41fafa5b5ddd4c13eb39446b0045f0a8167 upstream. + +Unlike the normal SIOCOUTQ, SIOCOUTQNSD was never handled in compat +mode. Add it to the common socket compat handler along with similar +ones. + +Fixes: 2f4e1b397097 ("tcp: ioctl type SIOCOUTQNSD returns amount of data not sent") +Cc: Eric Dumazet <edumazet@google.com> +Cc: netdev@vger.kernel.org +Cc: "David S. Miller" <davem@davemloft.net> +Signed-off-by: Arnd Bergmann <arnd@arndb.de> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/socket.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/socket.c ++++ b/net/socket.c +@@ -3311,6 +3311,7 @@ static int compat_sock_ioctl_trans(struc + case SIOCSARP: + case SIOCGARP: + case SIOCDARP: ++ case SIOCOUTQNSD: + case SIOCATMARK: + return sock_do_ioctl(net, sock, cmd, arg); + } diff --git a/queue-3.16/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch b/queue-3.16/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch new file mode 100644 index 00000000..a40c2afd --- /dev/null +++ b/queue-3.16/cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch @@ -0,0 +1,53 @@ +From: Zhenzhong Duan <zhenzhong.duan@oracle.com> +Date: Wed, 23 Oct 2019 09:57:14 +0800 +Subject: cpuidle: Do not unset the driver if it is there already + +commit 918c1fe9fbbe46fcf56837ff21f0ef96424e8b29 upstream. + +Fix __cpuidle_set_driver() to check if any of the CPUs in the mask has +a driver different from drv already and, if so, return -EBUSY before +updating any cpuidle_drivers per-CPU pointers. + +Fixes: 82467a5a885d ("cpuidle: simplify multiple driver support") +Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com> +[ rjw: Subject & changelog ] +Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/cpuidle/driver.c | 15 +++++++-------- + 1 file changed, 7 insertions(+), 8 deletions(-) + +--- a/drivers/cpuidle/driver.c ++++ b/drivers/cpuidle/driver.c +@@ -60,24 +60,23 @@ static inline void __cpuidle_unset_drive + * __cpuidle_set_driver - set per CPU driver variables for the given driver. + * @drv: a valid pointer to a struct cpuidle_driver + * +- * For each CPU in the driver's cpumask, unset the registered driver per CPU +- * to @drv. +- * +- * Returns 0 on success, -EBUSY if the CPUs have driver(s) already. ++ * Returns 0 on success, -EBUSY if any CPU in the cpumask have a driver ++ * different from drv already. + */ + static inline int __cpuidle_set_driver(struct cpuidle_driver *drv) + { + int cpu; + + for_each_cpu(cpu, drv->cpumask) { ++ struct cpuidle_driver *old_drv; + +- if (__cpuidle_get_cpu_driver(cpu)) { +- __cpuidle_unset_driver(drv); ++ old_drv = __cpuidle_get_cpu_driver(cpu); ++ if (old_drv && old_drv != drv) + return -EBUSY; +- } ++ } + ++ for_each_cpu(cpu, drv->cpumask) + per_cpu(cpuidle_drivers, cpu) = drv; +- } + + return 0; + } diff --git a/queue-3.16/cw1200-fix-a-signedness-bug-in-cw1200_load_firmware.patch b/queue-3.16/cw1200-fix-a-signedness-bug-in-cw1200_load_firmware.patch new file mode 100644 index 00000000..a3409103 --- /dev/null +++ b/queue-3.16/cw1200-fix-a-signedness-bug-in-cw1200_load_firmware.patch @@ -0,0 +1,36 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Tue, 1 Oct 2019 14:45:01 +0300 +Subject: cw1200: Fix a signedness bug in cw1200_load_firmware() + +commit 4a50d454502f1401171ff061a5424583f91266db upstream. + +The "priv->hw_type" is an enum and in this context GCC will treat it +as an unsigned int so the error handling will never trigger. + +Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +[bwh: Backported to 3.16: adjust filename] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/wireless/cw1200/fwio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/cw1200/fwio.c ++++ b/drivers/net/wireless/cw1200/fwio.c +@@ -316,12 +316,12 @@ int cw1200_load_firmware(struct cw1200_c + goto out; + } + +- priv->hw_type = cw1200_get_hw_type(val32, &major_revision); +- if (priv->hw_type < 0) { ++ ret = cw1200_get_hw_type(val32, &major_revision); ++ if (ret < 0) { + pr_err("Can't deduce hardware type.\n"); +- ret = -ENOTSUPP; + goto out; + } ++ priv->hw_type = ret; + + /* Set DPLL Reg value, and read back to confirm writes work */ + ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID, diff --git a/queue-3.16/drm-i810-prevent-underflow-in-ioctl.patch b/queue-3.16/drm-i810-prevent-underflow-in-ioctl.patch new file mode 100644 index 00000000..ba3a7d9c --- /dev/null +++ b/queue-3.16/drm-i810-prevent-underflow-in-ioctl.patch @@ -0,0 +1,38 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Fri, 4 Oct 2019 13:22:51 +0300 +Subject: drm/i810: Prevent underflow in ioctl + +commit 4f69851fbaa26b155330be35ce8ac393e93e7442 upstream. + +The "used" variables here come from the user in the ioctl and it can be +negative. It could result in an out of bounds write. + +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Link: https://patchwork.freedesktop.org/patch/msgid/20191004102251.GC823@mwanda +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/gpu/drm/i810/i810_dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i810/i810_dma.c ++++ b/drivers/gpu/drm/i810/i810_dma.c +@@ -724,7 +724,7 @@ static void i810_dma_dispatch_vertex(str + if (nbox > I810_NR_SAREA_CLIPRECTS) + nbox = I810_NR_SAREA_CLIPRECTS; + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + if (sarea_priv->dirty) +@@ -1044,7 +1044,7 @@ static void i810_dma_dispatch_mc(struct + if (u != I810_BUF_CLIENT) + DRM_DEBUG("MC found buffer that isn't mine!\n"); + +- if (used > 4 * 1024) ++ if (used < 0 || used > 4 * 1024) + used = 0; + + sarea_priv->dirty = 0x7f; diff --git a/queue-3.16/drm-i915-userptr-try-to-acquire-the-page-lock-around.patch b/queue-3.16/drm-i915-userptr-try-to-acquire-the-page-lock-around.patch new file mode 100644 index 00000000..c87f4aa4 --- /dev/null +++ b/queue-3.16/drm-i915-userptr-try-to-acquire-the-page-lock-around.patch @@ -0,0 +1,78 @@ +From: Chris Wilson <chris@chris-wilson.co.uk> +Date: Mon, 11 Nov 2019 13:32:03 +0000 +Subject: drm/i915/userptr: Try to acquire the page lock around + set_page_dirty() + +commit cee7fb437edcdb2f9f8affa959e274997f5dca4d upstream. + +set_page_dirty says: + + For pages with a mapping this should be done under the page lock + for the benefit of asynchronous memory errors who prefer a + consistent dirty state. This rule can be broken in some special + cases, but should be better not to. + +Under those rules, it is only safe for us to use the plain set_page_dirty +calls for shmemfs/anonymous memory. Userptr may be used with real +mappings and so needs to use the locked version (set_page_dirty_lock). + +However, following a try_to_unmap() we may want to remove the userptr and +so call put_pages(). However, try_to_unmap() acquires the page lock and +so we must avoid recursively locking the pages ourselves -- which means +that we cannot safely acquire the lock around set_page_dirty(). Since we +can't be sure of the lock, we have to risk skip dirtying the page, or +else risk calling set_page_dirty() without a lock and so risk fs +corruption. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203317 +Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=112012 +Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl") +References: cb6d7c7dc7ff ("drm/i915/userptr: Acquire the page lock around set_page_dirty()") +References: 505a8ec7e11a ("Revert "drm/i915/userptr: Acquire the page lock around set_page_dirty()"") +References: 6dcc693bc57f ("ext4: warn when page is dirtied without buffers") +Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> +Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> +Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> +Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20191111133205.11590-1-chris@chris-wilson.co.uk +(cherry picked from commit 0d4bbe3d407f79438dc4f87943db21f7134cfc65) +Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> +[bwh: Backported to 3.16: adjust filename, context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/gpu/drm/i915/i915_gem_userptr.c | 22 ++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_gem_userptr.c ++++ b/drivers/gpu/drm/i915/i915_gem_userptr.c +@@ -569,8 +569,28 @@ i915_gem_userptr_put_pages(struct drm_i9 + for_each_sg_page(obj->pages->sgl, &sg_iter, obj->pages->nents, 0) { + struct page *page = sg_page_iter_page(&sg_iter); + +- if (obj->dirty) ++ if (obj->dirty && trylock_page(page)) { ++ /* ++ * As this may not be anonymous memory (e.g. shmem) ++ * but exist on a real mapping, we have to lock ++ * the page in order to dirty it -- holding ++ * the page reference is not sufficient to ++ * prevent the inode from being truncated. ++ * Play safe and take the lock. ++ * ++ * However...! ++ * ++ * The mmu-notifier can be invalidated for a ++ * migrate_page, that is alreadying holding the lock ++ * on the page. Such a try_to_unmap() will result ++ * in us calling put_pages() and so recursively try ++ * to lock the page. We avoid that deadlock with ++ * a trylock_page() and in exchange we risk missing ++ * some page dirtying. ++ */ + set_page_dirty(page); ++ unlock_page(page); ++ } + + mark_page_accessed(page); + page_cache_release(page); diff --git a/queue-3.16/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch b/queue-3.16/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch new file mode 100644 index 00000000..017a2e83 --- /dev/null +++ b/queue-3.16/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch @@ -0,0 +1,65 @@ +From: Sam Bobroff <sbobroff@linux.ibm.com> +Date: Mon, 18 Nov 2019 10:53:53 +1100 +Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2 + +commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 upstream. + +The INTERRUPT_CNTL2 register expects a valid DMA address, but is +currently set with a GPU MC address. This can cause problems on +systems that detect the resulting DMA read from an invalid address +(found on a Power8 guest). + +Instead, use the DMA address of the dummy page because it will always +be safe. + +Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)") +Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI") +Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)") +Signed-off-by: Sam Bobroff <sbobroff@linux.ibm.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/gpu/drm/radeon/cik.c | 4 ++-- + drivers/gpu/drm/radeon/r600.c | 4 ++-- + drivers/gpu/drm/radeon/si.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -6875,8 +6875,8 @@ static int cik_irq_init(struct radeon_de + } + + /* setup interrupt control */ +- /* XXX this should actually be a bus address, not an MC address. same on older asics */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3427,8 +3427,8 @@ int r600_irq_init(struct radeon_device * + } + + /* setup interrupt control */ +- /* set dummy read address to ring address */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -5749,8 +5749,8 @@ static int si_irq_init(struct radeon_dev + } + + /* setup interrupt control */ +- /* set dummy read address to ring address */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN diff --git a/queue-3.16/drm-radeon-fix-r1xx-r2xx-register-checker-for-pot-textures.patch b/queue-3.16/drm-radeon-fix-r1xx-r2xx-register-checker-for-pot-textures.patch new file mode 100644 index 00000000..ebe09df0 --- /dev/null +++ b/queue-3.16/drm-radeon-fix-r1xx-r2xx-register-checker-for-pot-textures.patch @@ -0,0 +1,46 @@ +From: Alex Deucher <alexander.deucher@amd.com> +Date: Tue, 26 Nov 2019 09:41:46 -0500 +Subject: drm/radeon: fix r1xx/r2xx register checker for POT textures +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 008037d4d972c9c47b273e40e52ae34f9d9e33e7 upstream. + +Shift and mask were reversed. Noticed by chance. + +Tested-by: Meelis Roos <mroos@linux.ee> +Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> +Signed-off-by: Alex Deucher <alexander.deucher@amd.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/gpu/drm/radeon/r100.c | 4 ++-- + drivers/gpu/drm/radeon/r200.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -1810,8 +1810,8 @@ static int r100_packet0_check(struct rad + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & RADEON_TXFORMAT_CUBIC_MAP_ENABLE) + track->textures[i].tex_coord_type = 2; +--- a/drivers/gpu/drm/radeon/r200.c ++++ b/drivers/gpu/drm/radeon/r200.c +@@ -473,8 +473,8 @@ int r200_packet0_check(struct radeon_cs_ + track->textures[i].use_pitch = 1; + } else { + track->textures[i].use_pitch = 0; +- track->textures[i].width = 1 << ((idx_value >> RADEON_TXFORMAT_WIDTH_SHIFT) & RADEON_TXFORMAT_WIDTH_MASK); +- track->textures[i].height = 1 << ((idx_value >> RADEON_TXFORMAT_HEIGHT_SHIFT) & RADEON_TXFORMAT_HEIGHT_MASK); ++ track->textures[i].width = 1 << ((idx_value & RADEON_TXFORMAT_WIDTH_MASK) >> RADEON_TXFORMAT_WIDTH_SHIFT); ++ track->textures[i].height = 1 << ((idx_value & RADEON_TXFORMAT_HEIGHT_MASK) >> RADEON_TXFORMAT_HEIGHT_SHIFT); + } + if (idx_value & R200_TXFORMAT_LOOKUP_DISABLE) + track->textures[i].lookup_disable = true; diff --git a/queue-3.16/ext2-check-err-when-partial-null.patch b/queue-3.16/ext2-check-err-when-partial-null.patch new file mode 100644 index 00000000..cd708d11 --- /dev/null +++ b/queue-3.16/ext2-check-err-when-partial-null.patch @@ -0,0 +1,38 @@ +From: Chengguang Xu <cgxu519@mykernel.net> +Date: Tue, 5 Nov 2019 12:51:00 +0800 +Subject: ext2: check err when partial != NULL + +commit e705f4b8aa27a59f8933e8f384e9752f052c469c upstream. + +Check err when partial == NULL is meaningless because +partial == NULL means getting branch successfully without +error. + +Link: https://lore.kernel.org/r/20191105045100.7104-1-cgxu519@mykernel.net +Signed-off-by: Chengguang Xu <cgxu519@mykernel.net> +Signed-off-by: Jan Kara <jack@suse.cz> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/ext2/inode.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/ext2/inode.c ++++ b/fs/ext2/inode.c +@@ -696,11 +696,14 @@ static int ext2_get_blocks(struct inode + if (!partial) { + count++; + mutex_unlock(&ei->truncate_mutex); +- if (err) +- goto cleanup; + clear_buffer_new(bh_result); + goto got_it; + } ++ ++ if (err) { ++ mutex_unlock(&ei->truncate_mutex); ++ goto cleanup; ++ } + } + + /* diff --git a/queue-3.16/ext4-work-around-deleting-a-file-with-i_nlink-0-safely.patch b/queue-3.16/ext4-work-around-deleting-a-file-with-i_nlink-0-safely.patch new file mode 100644 index 00000000..8d3b2a6d --- /dev/null +++ b/queue-3.16/ext4-work-around-deleting-a-file-with-i_nlink-0-safely.patch @@ -0,0 +1,56 @@ +From: Theodore Ts'o <tytso@mit.edu> +Date: Mon, 11 Nov 2019 22:18:13 -0500 +Subject: ext4: work around deleting a file with i_nlink == 0 safely + +commit c7df4a1ecb8579838ec8c56b2bb6a6716e974f37 upstream. + +If the file system is corrupted such that a file's i_links_count is +too small, then it's possible that when unlinking that file, i_nlink +will already be zero. Previously we were working around this kind of +corruption by forcing i_nlink to one; but we were doing this before +trying to delete the directory entry --- and if the file system is +corrupted enough that ext4_delete_entry() fails, then we exit with +i_nlink elevated, and this causes the orphan inode list handling to be +FUBAR'ed, such that when we unmount the file system, the orphan inode +list can get corrupted. + +A better way to fix this is to simply skip trying to call drop_nlink() +if i_nlink is already zero, thus moving the check to the place where +it makes the most sense. + +https://bugzilla.kernel.org/show_bug.cgi?id=205433 + +Link: https://lore.kernel.org/r/20191112032903.8828-1-tytso@mit.edu +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +Reviewed-by: Andreas Dilger <adilger@dilger.ca> +[bwh: Backported to 3.16: Log message and function are different] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2830,19 +2830,18 @@ static int ext4_unlink(struct inode *dir + if (IS_DIRSYNC(dir)) + ext4_handle_sync(handle); + +- if (!inode->i_nlink) { +- ext4_warning(inode->i_sb, +- "Deleting nonexistent file (%lu), %d", +- inode->i_ino, inode->i_nlink); +- set_nlink(inode, 1); +- } + retval = ext4_delete_entry(handle, dir, de, bh); + if (retval) + goto end_unlink; + dir->i_ctime = dir->i_mtime = ext4_current_time(dir); + ext4_update_dx_flag(dir); + ext4_mark_inode_dirty(handle, dir); +- drop_nlink(inode); ++ if (inode->i_nlink == 0) ++ ext4_warning(inode->i_sb, ++ "Deleting nonexistent file (%lu), %d", ++ inode->i_ino, inode->i_nlink); ++ else ++ drop_nlink(inode); + if (!inode->i_nlink) + ext4_orphan_add(handle, inode); + inode->i_ctime = ext4_current_time(inode); diff --git a/queue-3.16/fuse-verify-attributes.patch b/queue-3.16/fuse-verify-attributes.patch new file mode 100644 index 00000000..a7be0f7e --- /dev/null +++ b/queue-3.16/fuse-verify-attributes.patch @@ -0,0 +1,118 @@ +From: Miklos Szeredi <mszeredi@redhat.com> +Date: Tue, 12 Nov 2019 11:49:04 +0100 +Subject: fuse: verify attributes + +commit eb59bd17d2fa6e5e84fba61a5ebdea984222e6d5 upstream. + +If a filesystem returns negative inode sizes, future reads on the file were +causing the cpu to spin on truncate_pagecache. + +Create a helper to validate the attributes. This now does two things: + + - check the file mode + - check if the file size fits in i_size without overflowing + +Reported-by: Arijit Banerjee <arijit@rubrik.com> +Fixes: d8a5ba45457e ("[PATCH] FUSE - core") +Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/fuse/dir.c | 24 +++++++++++++++++------- + fs/fuse/fuse_i.h | 2 ++ + 2 files changed, 19 insertions(+), 7 deletions(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -250,7 +250,8 @@ static int fuse_dentry_revalidate(struct + spin_unlock(&fc->lock); + } + kfree(forget); +- if (err || (outarg.attr.mode ^ inode->i_mode) & S_IFMT) ++ if (err || fuse_invalid_attr(&outarg.attr) || ++ (outarg.attr.mode ^ inode->i_mode) & S_IFMT) + goto invalid; + + fuse_change_attributes(inode, &outarg.attr, +@@ -295,6 +296,12 @@ int fuse_valid_type(int m) + S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m); + } + ++bool fuse_invalid_attr(struct fuse_attr *attr) ++{ ++ return !fuse_valid_type(attr->mode) || ++ attr->size > LLONG_MAX; ++} ++ + int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name, + struct fuse_entry_out *outarg, struct inode **inode) + { +@@ -334,7 +341,7 @@ int fuse_lookup_name(struct super_block + err = -EIO; + if (!outarg->nodeid) + goto out_put_forget; +- if (!fuse_valid_type(outarg->attr.mode)) ++ if (fuse_invalid_attr(&outarg->attr)) + goto out_put_forget; + + *inode = fuse_iget(sb, outarg->nodeid, outarg->generation, +@@ -464,7 +471,8 @@ static int fuse_create_open(struct inode + goto out_free_ff; + + err = -EIO; +- if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid)) ++ if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) || ++ fuse_invalid_attr(&outentry.attr)) + goto out_free_ff; + + fuse_put_request(fc, req); +@@ -580,7 +588,7 @@ static int create_new_entry(struct fuse_ + goto out_put_forget_req; + + err = -EIO; +- if (invalid_nodeid(outarg.nodeid)) ++ if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr)) + goto out_put_forget_req; + + if ((outarg.attr.mode ^ mode) & S_IFMT) +@@ -971,7 +979,8 @@ static int fuse_do_getattr(struct inode + err = req->out.h.error; + fuse_put_request(fc, req); + if (!err) { +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + } else { +@@ -1282,7 +1291,7 @@ static int fuse_direntplus_link(struct f + + if (invalid_nodeid(o->nodeid)) + return -EIO; +- if (!fuse_valid_type(o->attr.mode)) ++ if (fuse_invalid_attr(&o->attr)) + return -EIO; + + fc = get_fuse_conn(dir); +@@ -1794,7 +1803,8 @@ int fuse_do_setattr(struct dentry *dentr + goto error; + } + +- if ((inode->i_mode ^ outarg.attr.mode) & S_IFMT) { ++ if (fuse_invalid_attr(&outarg.attr) || ++ (inode->i_mode ^ outarg.attr.mode) & S_IFMT) { + make_bad_inode(inode); + err = -EIO; + goto error; +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -828,6 +828,8 @@ void fuse_ctl_remove_conn(struct fuse_co + */ + int fuse_valid_type(int m); + ++bool fuse_invalid_attr(struct fuse_attr *attr); ++ + /** + * Is current process allowed to perform filesystem operation? + */ diff --git a/queue-3.16/fuse-verify-nlink.patch b/queue-3.16/fuse-verify-nlink.patch new file mode 100644 index 00000000..a30689b7 --- /dev/null +++ b/queue-3.16/fuse-verify-nlink.patch @@ -0,0 +1,28 @@ +From: Miklos Szeredi <mszeredi@redhat.com> +Date: Tue, 12 Nov 2019 11:49:04 +0100 +Subject: fuse: verify nlink + +commit c634da718db9b2fac201df2ae1b1b095344ce5eb upstream. + +When adding a new hard link, make sure that i_nlink doesn't overflow. + +Fixes: ac45d61357e8 ("fuse: fix nlink after unlink") +Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/fuse/dir.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -890,7 +890,8 @@ static int fuse_link(struct dentry *entr + + spin_lock(&fc->lock); + fi->attr_version = ++fc->attr_version; +- inc_nlink(inode); ++ if (likely(inode->i_nlink < UINT_MAX)) ++ inc_nlink(inode); + spin_unlock(&fc->lock); + fuse_invalidate_attr(inode); + fuse_update_ctime(inode); diff --git a/queue-3.16/futex-prevent-robust-futex-exit-race.patch b/queue-3.16/futex-prevent-robust-futex-exit-race.patch new file mode 100644 index 00000000..2bf8c6dc --- /dev/null +++ b/queue-3.16/futex-prevent-robust-futex-exit-race.patch @@ -0,0 +1,266 @@ +From: Yang Tao <yang.tao172@zte.com.cn> +Date: Wed, 6 Nov 2019 22:55:35 +0100 +Subject: futex: Prevent robust futex exit race + +commit ca16d5bee59807bf04deaab0a8eccecd5061528c upstream. + +Robust futexes utilize the robust_list mechanism to allow the kernel to +release futexes which are held when a task exits. The exit can be voluntary +or caused by a signal or fault. This prevents that waiters block forever. + +The futex operations in user space store a pointer to the futex they are +either locking or unlocking in the op_pending member of the per task robust +list. + +After a lock operation has succeeded the futex is queued in the robust list +linked list and the op_pending pointer is cleared. + +After an unlock operation has succeeded the futex is removed from the +robust list linked list and the op_pending pointer is cleared. + +The robust list exit code checks for the pending operation and any futex +which is queued in the linked list. It carefully checks whether the futex +value is the TID of the exiting task. If so, it sets the OWNER_DIED bit and +tries to wake up a potential waiter. + +This is race free for the lock operation but unlock has two race scenarios +where waiters might not be woken up. These issues can be observed with +regular robust pthread mutexes. PI aware pthread mutexes are not affected. + +(1) Unlocking task is killed after unlocking the futex value in user space + before being able to wake a waiter. + + pthread_mutex_unlock() + | + V + atomic_exchange_rel (&mutex->__data.__lock, 0) + <------------------------killed + lll_futex_wake () | + | + |(__lock = 0) + |(enter kernel) + | + V + do_exit() + exit_mm() + mm_release() + exit_robust_list() + handle_futex_death() + | + |(__lock = 0) + |(uval = 0) + | + V + if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) + return 0; + + The sanity check which ensures that the user space futex is owned by + the exiting task prevents the wakeup of waiters which in consequence + block infinitely. + +(2) Waiting task is killed after a wakeup and before it can acquire the + futex in user space. + + OWNER WAITER + futex_wait() + pthread_mutex_unlock() | + | | + |(__lock = 0) | + | | + V | + futex_wake() ------------> wakeup() + | + |(return to userspace) + |(__lock = 0) + | + V + oldval = mutex->__data.__lock + <-----------------killed + atomic_compare_and_exchange_val_acq (&mutex->__data.__lock, | + id | assume_other_futex_waiters, 0) | + | + | + (enter kernel)| + | + V + do_exit() + | + | + V + handle_futex_death() + | + |(__lock = 0) + |(uval = 0) + | + V + if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr)) + return 0; + + The sanity check which ensures that the user space futex is owned + by the exiting task prevents the wakeup of waiters, which seems to + be correct as the exiting task does not own the futex value, but + the consequence is that other waiters wont be woken up and block + infinitely. + +In both scenarios the following conditions are true: + + - task->robust_list->list_op_pending != NULL + - user space futex value == 0 + - Regular futex (not PI) + +If these conditions are met then it is reasonably safe to wake up a +potential waiter in order to prevent the above problems. + +As this might be a false positive it can cause spurious wakeups, but the +waiter side has to handle other types of unrelated wakeups, e.g. signals +gracefully anyway. So such a spurious wakeup will not affect the +correctness of these operations. + +This workaround must not touch the user space futex value and cannot set +the OWNER_DIED bit because the lock value is 0, i.e. uncontended. Setting +OWNER_DIED in this case would result in inconsistent state and subsequently +in malfunction of the owner died handling in user space. + +The rest of the user space state is still consistent as no other task can +observe the list_op_pending entry in the exiting tasks robust list. + +The eventually woken up waiter will observe the uncontended lock value and +take it over. + +[ tglx: Massaged changelog and comment. Made the return explicit and not + depend on the subsequent check and added constants to hand into + handle_futex_death() instead of plain numbers. Fixed a few coding + style issues. ] + +Fixes: 0771dfefc9e5 ("[PATCH] lightweight robust futexes: core") +Signed-off-by: Yang Tao <yang.tao172@zte.com.cn> +Signed-off-by: Yi Wang <wang.yi59@zte.com.cn> +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Reviewed-by: Ingo Molnar <mingo@kernel.org> +Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> +Link: https://lkml.kernel.org/r/1573010582-35297-1-git-send-email-wang.yi59@zte.com.cn +Link: https://lkml.kernel.org/r/20191106224555.943191378@linutronix.de +[bwh: Backported to 3.16: Implementation is split between futex.c and + futex_compat.c, with common definitions in <linux/futex.h>] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2905,7 +2905,8 @@ err_unlock: + * Process a futex-list entry, check whether it's owned by the + * dying task, and do notification if so: + */ +-int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi) ++int handle_futex_death(u32 __user *uaddr, struct task_struct *curr, ++ bool pi, bool pending_op) + { + u32 uval, uninitialized_var(nval), mval; + +@@ -2917,6 +2918,42 @@ retry: + if (get_user(uval, uaddr)) + return -1; + ++ /* ++ * Special case for regular (non PI) futexes. The unlock path in ++ * user space has two race scenarios: ++ * ++ * 1. The unlock path releases the user space futex value and ++ * before it can execute the futex() syscall to wake up ++ * waiters it is killed. ++ * ++ * 2. A woken up waiter is killed before it can acquire the ++ * futex in user space. ++ * ++ * In both cases the TID validation below prevents a wakeup of ++ * potential waiters which can cause these waiters to block ++ * forever. ++ * ++ * In both cases the following conditions are met: ++ * ++ * 1) task->robust_list->list_op_pending != NULL ++ * @pending_op == true ++ * 2) User space futex value == 0 ++ * 3) Regular futex: @pi == false ++ * ++ * If these conditions are met, it is safe to attempt waking up a ++ * potential waiter without touching the user space futex value and ++ * trying to set the OWNER_DIED bit. The user space futex value is ++ * uncontended and the rest of the user space mutex state is ++ * consistent, so a woken waiter will just take over the ++ * uncontended futex. Setting the OWNER_DIED bit would create ++ * inconsistent state and malfunction of the user space owner died ++ * handling. ++ */ ++ if (pending_op && !pi && !uval) { ++ futex_wake(uaddr, 1, 1, FUTEX_BITSET_MATCH_ANY); ++ return 0; ++ } ++ + if ((uval & FUTEX_TID_MASK) == task_pid_vnr(curr)) { + /* + * Ok, this dying thread is truly holding a futex +@@ -3021,10 +3058,11 @@ void exit_robust_list(struct task_struct + * A pending lock might already be on the list, so + * don't process it twice: + */ +- if (entry != pending) ++ if (entry != pending) { + if (handle_futex_death((void __user *)entry + futex_offset, +- curr, pi)) ++ curr, pi, HANDLE_DEATH_LIST)) + return; ++ } + if (rc) + return; + entry = next_entry; +@@ -3038,9 +3076,10 @@ void exit_robust_list(struct task_struct + cond_resched(); + } + +- if (pending) ++ if (pending) { + handle_futex_death((void __user *)pending + futex_offset, +- curr, pip); ++ curr, pip, HANDLE_DEATH_PENDING); ++ } + } + + long do_futex(u32 __user *uaddr, int op, u32 val, ktime_t *timeout, +--- a/kernel/futex_compat.c ++++ b/kernel/futex_compat.c +@@ -94,7 +94,8 @@ void compat_exit_robust_list(struct task + if (entry != pending) { + void __user *uaddr = futex_uaddr(entry, futex_offset); + +- if (handle_futex_death(uaddr, curr, pi)) ++ if (handle_futex_death(uaddr, curr, pi, ++ HANDLE_DEATH_LIST)) + return; + } + if (rc) +@@ -113,7 +114,7 @@ void compat_exit_robust_list(struct task + if (pending) { + void __user *uaddr = futex_uaddr(pending, futex_offset); + +- handle_futex_death(uaddr, curr, pip); ++ handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING); + } + } + +--- a/include/linux/futex.h ++++ b/include/linux/futex.h +@@ -11,8 +11,13 @@ union ktime; + long do_futex(u32 __user *uaddr, int op, u32 val, union ktime *timeout, + u32 __user *uaddr2, u32 val2, u32 val3); + ++/* Constants for the pending_op argument of handle_futex_death */ ++#define HANDLE_DEATH_PENDING true ++#define HANDLE_DEATH_LIST false ++ + extern int +-handle_futex_death(u32 __user *uaddr, struct task_struct *curr, int pi); ++handle_futex_death(u32 __user *uaddr, struct task_struct *curr, ++ bool pi, bool pending_op); + + /* + * Futexes are matched on equal values of this key. diff --git a/queue-3.16/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-only-if-not.patch b/queue-3.16/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-only-if-not.patch new file mode 100644 index 00000000..c295ac05 --- /dev/null +++ b/queue-3.16/hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-only-if-not.patch @@ -0,0 +1,42 @@ +From: Tony Lindgren <tony@atomide.com> +Date: Sat, 14 Sep 2019 14:02:56 -0700 +Subject: hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not + idled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit eaecce12f5f0d2c35d278e41e1bc4522393861ab upstream. + +When unloading omap3-rom-rng, we'll get the following: + +WARNING: CPU: 0 PID: 100 at drivers/clk/clk.c:948 clk_core_disable + +This is because the clock may be already disabled by omap3_rom_rng_idle(). +Let's fix the issue by checking for rng_idle on exit. + +Cc: Aaro Koskinen <aaro.koskinen@iki.fi> +Cc: Adam Ford <aford173@gmail.com> +Cc: Pali Rohár <pali.rohar@gmail.com> +Cc: Sebastian Reichel <sre@kernel.org> +Cc: Tero Kristo <t-kristo@ti.com> +Fixes: 1c6b7c2108bd ("hwrng: OMAP3 ROM Random Number Generator support") +Signed-off-by: Tony Lindgren <tony@atomide.com> +Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/char/hw_random/omap3-rom-rng.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/hw_random/omap3-rom-rng.c ++++ b/drivers/char/hw_random/omap3-rom-rng.c +@@ -119,7 +119,8 @@ static int omap3_rom_rng_probe(struct pl + static int omap3_rom_rng_remove(struct platform_device *pdev) + { + hwrng_unregister(&omap3_rom_rng_ops); +- clk_disable_unprepare(rng_clk); ++ if (!rng_idle) ++ clk_disable_unprepare(rng_clk); + return 0; + } + diff --git a/queue-3.16/iio-adis16480-add-debugfs_reg_access-entry.patch b/queue-3.16/iio-adis16480-add-debugfs_reg_access-entry.patch new file mode 100644 index 00000000..30f8094d --- /dev/null +++ b/queue-3.16/iio-adis16480-add-debugfs_reg_access-entry.patch @@ -0,0 +1,33 @@ +From: =?UTF-8?q?Nuno=20S=C3=A1?= <nuno.sa@analog.com> +Date: Mon, 28 Oct 2019 17:33:49 +0100 +Subject: iio: adis16480: Add debugfs_reg_access entry +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 4c35b7a51e2f291471f7221d112c6a45c63e83bc upstream. + +The driver is defining debugfs entries by calling +`adis16480_debugfs_init()`. However, those entries are attached to the +iio_dev debugfs entry which won't exist if no debugfs_reg_access +callback is provided. + +Fixes: 2f3abe6cbb6c ("iio:imu: Add support for the ADIS16480 and similar IMUs") +Signed-off-by: Nuno Sá <nuno.sa@analog.com> +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/iio/imu/adis16480.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -760,6 +760,7 @@ static const struct iio_info adis16480_i + .read_raw = &adis16480_read_raw, + .write_raw = &adis16480_write_raw, + .update_scan_mode = adis_update_scan_mode, ++ .debugfs_reg_access = adis_debugfs_reg_access, + .driver_module = THIS_MODULE, + }; + diff --git a/queue-3.16/iio-imu-adis16480-assign-bias-value-only-if-operation-succeeded.patch b/queue-3.16/iio-imu-adis16480-assign-bias-value-only-if-operation-succeeded.patch new file mode 100644 index 00000000..48dd61bd --- /dev/null +++ b/queue-3.16/iio-imu-adis16480-assign-bias-value-only-if-operation-succeeded.patch @@ -0,0 +1,41 @@ +From: Alexandru Ardelean <alexandru.ardelean@analog.com> +Date: Fri, 1 Nov 2019 11:35:03 +0200 +Subject: iio: imu: adis16480: assign bias value only if operation succeeded + +commit 9b742763d9d4195e823ae6ece760c9ed0500c1dc upstream. + +This was found only after the whole thing with the inline functions, but +the compiler actually found something. The value of the `bias` (in +adis16480_get_calibbias()) should only be set if the read operation was +successful. + +No actual known problem occurs as users of this function all +ultimately check the return value. Hence probably not stable material. + +Fixes: 2f3abe6cbb6c9 ("iio:imu: Add support for the ADIS16480 and similar IMUs") +Signed-off-by: Alexandru Ardelean <alexandru.ardelean@analog.com> +Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/iio/imu/adis16480.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -405,12 +405,14 @@ static int adis16480_get_calibbias(struc + case IIO_MAGN: + case IIO_PRESSURE: + ret = adis_read_reg_16(&st->adis, reg, &val16); +- *bias = sign_extend32(val16, 15); ++ if (ret == 0) ++ *bias = sign_extend32(val16, 15); + break; + case IIO_ANGL_VEL: + case IIO_ACCEL: + ret = adis_read_reg_32(&st->adis, reg, &val32); +- *bias = sign_extend32(val32, 31); ++ if (ret == 0) ++ *bias = sign_extend32(val32, 31); + break; + default: + ret = -EINVAL; diff --git a/queue-3.16/inet-protect-against-too-small-mtu-values.patch b/queue-3.16/inet-protect-against-too-small-mtu-values.patch new file mode 100644 index 00000000..d6f5033f --- /dev/null +++ b/queue-3.16/inet-protect-against-too-small-mtu-values.patch @@ -0,0 +1,178 @@ +From: Eric Dumazet <edumazet@google.com> +Date: Thu, 5 Dec 2019 20:43:46 -0800 +Subject: inet: protect against too small mtu values. + +commit 501a90c945103e8627406763dac418f20f3837b2 upstream. + +syzbot was once again able to crash a host by setting a very small mtu +on loopback device. + +Let's make inetdev_valid_mtu() available in include/net/ip.h, +and use it in ip_setup_cork(), so that we protect both ip_append_page() +and __ip_append_data() + +Also add a READ_ONCE() when the device mtu is read. + +Pairs this lockless read with one WRITE_ONCE() in __dev_set_mtu(), +even if other code paths might write over this field. + +Add a big comment in include/linux/netdevice.h about dev->mtu +needing READ_ONCE()/WRITE_ONCE() annotations. + +Hopefully we will add the missing ones in followup patches. + +[1] + +refcount_t: saturated; leaking memory. +WARNING: CPU: 0 PID: 9464 at lib/refcount.c:22 refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 +Kernel panic - not syncing: panic_on_warn set ... +CPU: 0 PID: 9464 Comm: syz-executor850 Not tainted 5.4.0-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x197/0x210 lib/dump_stack.c:118 + panic+0x2e3/0x75c kernel/panic.c:221 + __warn.cold+0x2f/0x3e kernel/panic.c:582 + report_bug+0x289/0x300 lib/bug.c:195 + fixup_bug arch/x86/kernel/traps.c:174 [inline] + fixup_bug arch/x86/kernel/traps.c:169 [inline] + do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:267 + do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:286 + invalid_op+0x23/0x30 arch/x86/entry/entry_64.S:1027 +RIP: 0010:refcount_warn_saturate+0x138/0x1f0 lib/refcount.c:22 +Code: 06 31 ff 89 de e8 c8 f5 e6 fd 84 db 0f 85 6f ff ff ff e8 7b f4 e6 fd 48 c7 c7 e0 71 4f 88 c6 05 56 a6 a4 06 01 e8 c7 a8 b7 fd <0f> 0b e9 50 ff ff ff e8 5c f4 e6 fd 0f b6 1d 3d a6 a4 06 31 ff 89 +RSP: 0018:ffff88809689f550 EFLAGS: 00010286 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffffffff815e4336 RDI: ffffed1012d13e9c +RBP: ffff88809689f560 R08: ffff88809c50a3c0 R09: fffffbfff15d31b1 +R10: fffffbfff15d31b0 R11: ffffffff8ae98d87 R12: 0000000000000001 +R13: 0000000000040100 R14: ffff888099041104 R15: ffff888218d96e40 + refcount_add include/linux/refcount.h:193 [inline] + skb_set_owner_w+0x2b6/0x410 net/core/sock.c:1999 + sock_wmalloc+0xf1/0x120 net/core/sock.c:2096 + ip_append_page+0x7ef/0x1190 net/ipv4/ip_output.c:1383 + udp_sendpage+0x1c7/0x480 net/ipv4/udp.c:1276 + inet_sendpage+0xdb/0x150 net/ipv4/af_inet.c:821 + kernel_sendpage+0x92/0xf0 net/socket.c:3794 + sock_sendpage+0x8b/0xc0 net/socket.c:936 + pipe_to_sendpage+0x2da/0x3c0 fs/splice.c:458 + splice_from_pipe_feed fs/splice.c:512 [inline] + __splice_from_pipe+0x3ee/0x7c0 fs/splice.c:636 + splice_from_pipe+0x108/0x170 fs/splice.c:671 + generic_splice_sendpage+0x3c/0x50 fs/splice.c:842 + do_splice_from fs/splice.c:861 [inline] + direct_splice_actor+0x123/0x190 fs/splice.c:1035 + splice_direct_to_actor+0x3b4/0xa30 fs/splice.c:990 + do_splice_direct+0x1da/0x2a0 fs/splice.c:1078 + do_sendfile+0x597/0xd00 fs/read_write.c:1464 + __do_sys_sendfile64 fs/read_write.c:1525 [inline] + __se_sys_sendfile64 fs/read_write.c:1511 [inline] + __x64_sys_sendfile64+0x1dd/0x220 fs/read_write.c:1511 + do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x441409 +Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007fffb64c4f78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441409 +RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005 +RBP: 0000000000073b8a R08: 0000000000000010 R09: 0000000000000010 +R10: 0000000000010001 R11: 0000000000000246 R12: 0000000000402180 +R13: 0000000000402210 R14: 0000000000000000 R15: 0000000000000000 +Kernel Offset: disabled +Rebooting in 86400 seconds.. + +Fixes: 1470ddf7f8ce ("inet: Remove explicit write references to sk/inet in ip_append_data") +Signed-off-by: Eric Dumazet <edumazet@google.com> +Reported-by: syzbot <syzkaller@googlegroups.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: + - Use ACCESS_ONCE() instead of {READ,WRITE}_ONCE() + - Keep using literal 68 instead of IPV4_MIN_MTU + - Adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/linux/netdevice.h | 5 +++++ + include/net/ip.h | 5 +++++ + net/core/dev.c | 3 ++- + net/ipv4/devinet.c | 5 ----- + net/ipv4/ip_output.c | 14 +++++++++----- + 5 files changed, 21 insertions(+), 11 deletions(-) + +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -1345,6 +1345,11 @@ struct net_device { + unsigned char if_port; /* Selectable AUI, TP,..*/ + unsigned char dma; /* DMA channel */ + ++ /* Note : dev->mtu is often read without holding a lock. ++ * Writers usually hold RTNL. ++ * It is recommended to use ACCESS_ONCE() to annotate the reads ++ * and writes. ++ */ + unsigned int mtu; /* interface MTU value */ + unsigned short type; /* interface hardware type */ + unsigned short hard_header_len; /* hardware hdr length */ +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -522,4 +522,9 @@ void ip_local_error(struct sock *sk, int + int ip_misc_proc_init(void); + #endif + ++static inline bool inetdev_valid_mtu(unsigned int mtu) ++{ ++ return likely(mtu >= 68); ++} ++ + #endif /* _IP_H */ +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5680,7 +5680,8 @@ static int __dev_set_mtu(struct net_devi + if (ops->ndo_change_mtu) + return ops->ndo_change_mtu(dev, new_mtu); + +- dev->mtu = new_mtu; ++ /* Pairs with all the lockless reads of dev->mtu in the stack */ ++ ACCESS_ONCE(dev->mtu) = new_mtu; + return 0; + } + +--- a/net/ipv4/devinet.c ++++ b/net/ipv4/devinet.c +@@ -1318,11 +1318,6 @@ skip: + } + } + +-static bool inetdev_valid_mtu(unsigned int mtu) +-{ +- return mtu >= 68; +-} +- + static void inetdev_send_gratuitous_arp(struct net_device *dev, + struct in_device *in_dev) + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1106,13 +1106,17 @@ static int ip_setup_cork(struct sock *sk + rt = *rtp; + if (unlikely(!rt)) + return -EFAULT; +- /* +- * We steal reference to this route, caller should not release it +- */ +- *rtp = NULL; ++ + cork->fragsize = ip_sk_use_pmtu(sk) ? +- dst_mtu(&rt->dst) : rt->dst.dev->mtu; ++ dst_mtu(&rt->dst) : ACCESS_ONCE(rt->dst.dev->mtu); ++ ++ if (!inetdev_valid_mtu(cork->fragsize)) ++ return -ENETUNREACH; ++ + cork->dst = &rt->dst; ++ /* We stole this route, caller should not release it. */ ++ *rtp = NULL; ++ + cork->length = 0; + cork->ttl = ipc->ttl; + cork->tos = ipc->tos; diff --git a/queue-3.16/inetpeer-fix-data-race-in-inet_putpeer-inet_putpeer.patch b/queue-3.16/inetpeer-fix-data-race-in-inet_putpeer-inet_putpeer.patch new file mode 100644 index 00000000..4e3a4d7c --- /dev/null +++ b/queue-3.16/inetpeer-fix-data-race-in-inet_putpeer-inet_putpeer.patch @@ -0,0 +1,92 @@ +From: Eric Dumazet <edumazet@google.com> +Date: Thu, 7 Nov 2019 10:30:42 -0800 +Subject: inetpeer: fix data-race in inet_putpeer / inet_putpeer + +commit 71685eb4ce80ae9c49eff82ca4dd15acab215de9 upstream. + +We need to explicitely forbid read/store tearing in inet_peer_gc() +and inet_putpeer(). + +The following syzbot report reminds us about inet_putpeer() +running without a lock held. + +BUG: KCSAN: data-race in inet_putpeer / inet_putpeer + +write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 0: + inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240 + ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102 + inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228 + __rcu_reclaim kernel/rcu/rcu.h:222 [inline] + rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157 + rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377 + rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386 + __do_softirq+0x115/0x33f kernel/softirq.c:292 + invoke_softirq kernel/softirq.c:373 [inline] + irq_exit+0xbb/0xe0 kernel/softirq.c:413 + exiting_irq arch/x86/include/asm/apic.h:536 [inline] + smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137 + apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 + native_safe_halt+0xe/0x10 arch/x86/kernel/paravirt.c:71 + arch_cpu_idle+0x1f/0x30 arch/x86/kernel/process.c:571 + default_idle_call+0x1e/0x40 kernel/sched/idle.c:94 + cpuidle_idle_call kernel/sched/idle.c:154 [inline] + do_idle+0x1af/0x280 kernel/sched/idle.c:263 + +write to 0xffff888121fb2ed0 of 4 bytes by interrupt on cpu 1: + inet_putpeer+0x37/0xa0 net/ipv4/inetpeer.c:240 + ip4_frag_free+0x3d/0x50 net/ipv4/ip_fragment.c:102 + inet_frag_destroy_rcu+0x58/0x80 net/ipv4/inet_fragment.c:228 + __rcu_reclaim kernel/rcu/rcu.h:222 [inline] + rcu_do_batch+0x256/0x5b0 kernel/rcu/tree.c:2157 + rcu_core+0x369/0x4d0 kernel/rcu/tree.c:2377 + rcu_core_si+0x12/0x20 kernel/rcu/tree.c:2386 + __do_softirq+0x115/0x33f kernel/softirq.c:292 + run_ksoftirqd+0x46/0x60 kernel/softirq.c:603 + smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165 + kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc3+ #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 4b9d9be839fd ("inetpeer: remove unused list") +Signed-off-by: Eric Dumazet <edumazet@google.com> +Reported-by: syzbot <syzkaller@googlegroups.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +[bwh: Backported to 3.16: + - Use ACCESS_ONCE() instead of {READ,WRITE}_ONCE() + - Adjust context, indentation] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/ipv4/inetpeer.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -419,7 +419,12 @@ static int inet_peer_gc(struct inet_peer + p = rcu_deref_locked(**stackptr, base); + if (atomic_read(&p->refcnt) == 0) { + smp_rmb(); +- delta = (__u32)jiffies - p->dtime; ++ ++ /* The ACCESS_ONCE() pairs with the ACCESS_ONCE() ++ * in inet_putpeer() ++ */ ++ delta = (__u32)jiffies - ACCESS_ONCE(p->dtime); ++ + if (delta >= ttl && + atomic_cmpxchg(&p->refcnt, 0, -1) == 0) { + p->gc_next = gchead; +@@ -504,7 +509,10 @@ EXPORT_SYMBOL_GPL(inet_getpeer); + + void inet_putpeer(struct inet_peer *p) + { +- p->dtime = (__u32)jiffies; ++ /* The ACCESS_ONCE() pairs with itself (we run lockless) ++ * and the ACCESS_ONCE() in inet_peer_gc() ++ */ ++ ACCESS_ONCE(p->dtime) = (__u32)jiffies; + smp_mb__before_atomic(); + atomic_dec(&p->refcnt); + } diff --git a/queue-3.16/iwlwifi-check-kasprintf-return-value.patch b/queue-3.16/iwlwifi-check-kasprintf-return-value.patch new file mode 100644 index 00000000..345355bb --- /dev/null +++ b/queue-3.16/iwlwifi-check-kasprintf-return-value.patch @@ -0,0 +1,43 @@ +From: Johannes Berg <johannes.berg@intel.com> +Date: Tue, 5 Nov 2019 14:50:32 +0100 +Subject: iwlwifi: check kasprintf() return value + +commit 5974fbb5e10b018fdbe3c3b81cb4cc54e1105ab9 upstream. + +kasprintf() can fail, we should check the return value. + +Fixes: 5ed540aecc2a ("iwlwifi: use mac80211 throughput trigger") +Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Luca Coelho <luciano.coelho@intel.com> +[bwh: Backported to 3.16: adjust filenames] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/wireless/iwlwifi/dvm/led.c | 3 +++ + drivers/net/wireless/iwlwifi/mvm/led.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/drivers/net/wireless/iwlwifi/dvm/led.c ++++ b/drivers/net/wireless/iwlwifi/dvm/led.c +@@ -184,6 +184,9 @@ void iwl_leds_init(struct iwl_priv *priv + + priv->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(priv->hw->wiphy)); ++ if (!priv->led.name) ++ return; ++ + priv->led.brightness_set = iwl_led_brightness_set; + priv->led.blink_set = iwl_led_blink_set; + priv->led.max_brightness = 1; +--- a/drivers/net/wireless/iwlwifi/mvm/led.c ++++ b/drivers/net/wireless/iwlwifi/mvm/led.c +@@ -109,6 +109,9 @@ int iwl_mvm_leds_init(struct iwl_mvm *mv + + mvm->led.name = kasprintf(GFP_KERNEL, "%s-led", + wiphy_name(mvm->hw->wiphy)); ++ if (!mvm->led.name) ++ return -ENOMEM; ++ + mvm->led.brightness_set = iwl_led_brightness_set; + mvm->led.max_brightness = 1; + diff --git a/queue-3.16/jbd2-fix-possible-overflow-in-jbd2_log_space_left.patch b/queue-3.16/jbd2-fix-possible-overflow-in-jbd2_log_space_left.patch new file mode 100644 index 00000000..9825969c --- /dev/null +++ b/queue-3.16/jbd2-fix-possible-overflow-in-jbd2_log_space_left.patch @@ -0,0 +1,44 @@ +From: Jan Kara <jack@suse.cz> +Date: Tue, 5 Nov 2019 17:44:07 +0100 +Subject: jbd2: Fix possible overflow in jbd2_log_space_left() + +commit add3efdd78b8a0478ce423bb9d4df6bd95e8b335 upstream. + +When number of free space in the journal is very low, the arithmetic in +jbd2_log_space_left() could underflow resulting in very high number of +free blocks and thus triggering assertion failure in transaction commit +code complaining there's not enough space in the journal: + +J_ASSERT(journal->j_free > 1); + +Properly check for the low number of free blocks. + +Reviewed-by: Theodore Ts'o <tytso@mit.edu> +Signed-off-by: Jan Kara <jack@suse.cz> +Link: https://lore.kernel.org/r/20191105164437.32602-1-jack@suse.cz +Signed-off-by: Theodore Ts'o <tytso@mit.edu> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/linux/jbd2.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/jbd2.h ++++ b/include/linux/jbd2.h +@@ -1340,7 +1340,7 @@ static inline int jbd2_space_needed(jour + static inline unsigned long jbd2_log_space_left(journal_t *journal) + { + /* Allow for rounding errors */ +- unsigned long free = journal->j_free - 32; ++ long free = journal->j_free - 32; + + if (journal->j_committing_transaction) { + unsigned long committing = atomic_read(&journal-> +@@ -1349,7 +1349,7 @@ static inline unsigned long jbd2_log_spa + /* Transaction + control blocks */ + free -= committing + (committing >> JBD2_CONTROL_BLOCKS_SHIFT); + } +- return free; ++ return max_t(long, free, 0); + } + + /* diff --git a/queue-3.16/kvm-x86-do-not-modify-masked-bits-of-shared-msrs.patch b/queue-3.16/kvm-x86-do-not-modify-masked-bits-of-shared-msrs.patch new file mode 100644 index 00000000..e5496ab1 --- /dev/null +++ b/queue-3.16/kvm-x86-do-not-modify-masked-bits-of-shared-msrs.patch @@ -0,0 +1,46 @@ +From: Paolo Bonzini <pbonzini@redhat.com> +Date: Mon, 18 Nov 2019 12:23:00 -0500 +Subject: KVM: x86: do not modify masked bits of shared MSRs + +commit de1fca5d6e0105c9d33924e1247e2f386efc3ece upstream. + +"Shared MSRs" are guest MSRs that are written to the host MSRs but +keep their value until the next return to userspace. They support +a mask, so that some bits keep the host value, but this mask is +only used to skip an unnecessary MSR write and the value written +to the MSR is always the guest MSR. + +Fix this and, while at it, do not update smsr->values[slot].curr if +for whatever reason the wrmsr fails. This should only happen due to +reserved bits, so the value written to smsr->values[slot].curr +will not match when the user-return notifier and the host value will +always be restored. However, it is untidy and in rare cases this +can actually avoid spurious WRMSRs on return to userspace. + +Reviewed-by: Jim Mattson <jmattson@google.com> +Tested-by: Jim Mattson <jmattson@google.com> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/x86/kvm/x86.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -242,13 +242,14 @@ int kvm_set_shared_msr(unsigned slot, u6 + struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu); + int err; + +- if (((value ^ smsr->values[slot].curr) & mask) == 0) ++ value = (value & mask) | (smsr->values[slot].host & ~mask); ++ if (value == smsr->values[slot].curr) + return 0; +- smsr->values[slot].curr = value; + err = wrmsrl_safe(shared_msrs_global.msrs[slot], value); + if (err) + return 1; + ++ smsr->values[slot].curr = value; + if (!smsr->registered) { + smsr->urn.on_user_return = kvm_on_user_return; + user_return_notifier_register(&smsr->urn); diff --git a/queue-3.16/kvm-x86-fix-presentation-of-tsx-feature-in-arch_capabilities.patch b/queue-3.16/kvm-x86-fix-presentation-of-tsx-feature-in-arch_capabilities.patch new file mode 100644 index 00000000..eac5240a --- /dev/null +++ b/queue-3.16/kvm-x86-fix-presentation-of-tsx-feature-in-arch_capabilities.patch @@ -0,0 +1,37 @@ +From: Paolo Bonzini <pbonzini@redhat.com> +Date: Mon, 18 Nov 2019 18:58:26 +0100 +Subject: KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES + +commit cbbaa2727aa3ae9e0a844803da7cef7fd3b94f2b upstream. + +KVM does not implement MSR_IA32_TSX_CTRL, so it must not be presented +to the guests. It is also confusing to have !ARCH_CAP_TSX_CTRL_MSR && +!RTM && ARCH_CAP_TAA_NO: lack of MSR_IA32_TSX_CTRL suggests TSX was not +hidden (it actually was), yet the value says that TSX is not vulnerable +to microarchitectural data sampling. Fix both. + +Tested-by: Jim Mattson <jmattson@google.com> +Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -945,10 +945,15 @@ u64 kvm_get_arch_capabilities(void) + * If TSX is disabled on the system, guests are also mitigated against + * TAA and clear CPU buffer mitigation is not required for guests. + */ +- if (boot_cpu_has_bug(X86_BUG_TAA) && boot_cpu_has(X86_FEATURE_RTM) && +- (data & ARCH_CAP_TSX_CTRL_MSR)) ++ if (!boot_cpu_has(X86_FEATURE_RTM)) ++ data &= ~ARCH_CAP_TAA_NO; ++ else if (!boot_cpu_has_bug(X86_BUG_TAA)) ++ data |= ARCH_CAP_TAA_NO; ++ else if (data & ARCH_CAP_TSX_CTRL_MSR) + data &= ~ARCH_CAP_MDS_NO; + ++ /* KVM does not emulate MSR_IA32_TSX_CTRL. */ ++ data &= ~ARCH_CAP_TSX_CTRL_MSR; + return data; + } + diff --git a/queue-3.16/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch b/queue-3.16/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch new file mode 100644 index 00000000..c85b7d26 --- /dev/null +++ b/queue-3.16/libtraceevent-fix-memory-leakage-in-copy_filter_type.patch @@ -0,0 +1,47 @@ +From: Hewenliang <hewenliang4@huawei.com> +Date: Mon, 18 Nov 2019 20:44:15 -0500 +Subject: libtraceevent: Fix memory leakage in copy_filter_type + +commit 10992af6bf46a2048ad964985a5b77464e5563b1 upstream. + +It is necessary to free the memory that we have allocated when error occurs. + +Fixes: ef3072cd1d5c ("tools lib traceevent: Get rid of die in add_filter_type()") +Signed-off-by: Hewenliang <hewenliang4@huawei.com> +Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org> +Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com> +Link: http://lore.kernel.org/lkml/20191119014415.57210-1-hewenliang4@huawei.com +Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/lib/traceevent/parse-filter.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1482,8 +1482,10 @@ static int copy_filter_type(struct event + if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) { + /* Add trivial event */ + arg = allocate_arg(); +- if (arg == NULL) ++ if (arg == NULL) { ++ free(str); + return -1; ++ } + + arg->type = FILTER_ARG_BOOLEAN; + if (strcmp(str, "TRUE") == 0) +@@ -1492,8 +1494,11 @@ static int copy_filter_type(struct event + arg->boolean.value = 0; + + filter_type = add_filter_type(filter, event->id); +- if (filter_type == NULL) ++ if (filter_type == NULL) { ++ free(str); ++ free_arg(arg); + return -1; ++ } + + filter_type->filter = arg; + diff --git a/queue-3.16/macvlan-schedule-bc_work-even-if-error.patch b/queue-3.16/macvlan-schedule-bc_work-even-if-error.patch new file mode 100644 index 00000000..fa950364 --- /dev/null +++ b/queue-3.16/macvlan-schedule-bc_work-even-if-error.patch @@ -0,0 +1,49 @@ +From: Menglong Dong <dong.menglong@zte.com.cn> +Date: Mon, 25 Nov 2019 16:58:09 +0800 +Subject: macvlan: schedule bc_work even if error + +commit 1d7ea55668878bb350979c377fc72509dd6f5b21 upstream. + +While enqueueing a broadcast skb to port->bc_queue, schedule_work() +is called to add port->bc_work, which processes the skbs in +bc_queue, to "events" work queue. If port->bc_queue is full, the +skb will be discarded and schedule_work(&port->bc_work) won't be +called. However, if port->bc_queue is full and port->bc_work is not +running or pending, port->bc_queue will keep full and schedule_work() +won't be called any more, and all broadcast skbs to macvlan will be +discarded. This case can happen: + +macvlan_process_broadcast() is the pending function of port->bc_work, +it moves all the skbs in port->bc_queue to the queue "list", and +processes the skbs in "list". During this, new skbs will keep being +added to port->bc_queue in macvlan_broadcast_enqueue(), and +port->bc_queue may already full when macvlan_process_broadcast() +return. This may happen, especially when there are a lot of real-time +threads and the process is preempted. + +Fix this by calling schedule_work(&port->bc_work) even if +port->bc_work is full in macvlan_broadcast_enqueue(). + +Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") +Signed-off-by: Menglong Dong <dong.menglong@zte.com.cn> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/net/macvlan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -262,10 +262,11 @@ static void macvlan_broadcast_enqueue(st + } + spin_unlock(&port->bc_queue.lock); + ++ schedule_work(&port->bc_work); ++ + if (err) + goto free_nskb; + +- schedule_work(&port->bc_work); + return; + + free_nskb: diff --git a/queue-3.16/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch b/queue-3.16/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch new file mode 100644 index 00000000..a5ed7712 --- /dev/null +++ b/queue-3.16/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch @@ -0,0 +1,32 @@ +From: Seung-Woo Kim <sw0312.kim@samsung.com> +Date: Fri, 18 Oct 2019 07:20:52 -0300 +Subject: media: exynos4-is: Fix recursive locking in isp_video_release() + +commit 704c6c80fb471d1bb0ef0d61a94617d1d55743cd upstream. + +>From isp_video_release(), &isp->video_lock is held and subsequent +vb2_fop_release() tries to lock vdev->lock which is same with the +previous one. Replace vb2_fop_release() with _vb2_fop_release() to +fix the recursive locking. + +Fixes: 1380f5754cb0 ("[media] videobuf2: Add missing lock held on vb2_fop_release") +Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com> +Reviewed-by: Sylwester Nawrocki <s.nawrocki@samsung.com> +Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> +Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/platform/exynos4-is/fimc-isp-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -322,7 +322,7 @@ static int isp_video_release(struct file + ivc->streaming = 0; + } + +- vb2_fop_release(file); ++ _vb2_fop_release(file, NULL); + + if (v4l2_fh_is_singular_file(file)) { + fimc_pipeline_call(&ivc->ve, close); diff --git a/queue-3.16/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch b/queue-3.16/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch new file mode 100644 index 00000000..8b7b90cb --- /dev/null +++ b/queue-3.16/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch @@ -0,0 +1,90 @@ +From: Janusz Krzysztofik <jmkrzyszt@gmail.com> +Date: Tue, 3 Sep 2019 17:11:39 -0300 +Subject: media: ov6650: Fix incorrect use of JPEG colorspace + +commit 12500731895ef09afc5b66b86b76c0884fb9c7bf upstream. + +Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG +for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8. According +to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies +exclusively to V4L2_PIX_FMT_JPEG. Since the sensor does not support +JPEG format, fix it to always select V4L2_COLORSPACE_SRGB. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com> +Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +[bwh: Backported to 3.16: adjust filename, context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/i2c/soc_camera/ov6650.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +--- a/drivers/media/i2c/soc_camera/ov6650.c ++++ b/drivers/media/i2c/soc_camera/ov6650.c +@@ -203,7 +203,6 @@ struct ov6650 { + unsigned long pclk_max; /* from resolution and format */ + struct v4l2_fract tpf; /* as requested with s_parm */ + enum v4l2_mbus_pixelcode code; +- enum v4l2_colorspace colorspace; + }; + + +@@ -508,7 +507,7 @@ static int ov6650_g_fmt(struct v4l2_subd + mf->width = priv->rect.width >> priv->half_scale; + mf->height = priv->rect.height >> priv->half_scale; + mf->code = priv->code; +- mf->colorspace = priv->colorspace; ++ mf->colorspace = V4L2_COLORSPACE_SRGB; + mf->field = V4L2_FIELD_NONE; + + return 0; +@@ -619,11 +618,6 @@ static int ov6650_s_fmt(struct v4l2_subd + priv->pclk_max = 8000000; + } + +- if (code == V4L2_MBUS_FMT_SBGGR8_1X8) +- priv->colorspace = V4L2_COLORSPACE_SRGB; +- else if (code != 0) +- priv->colorspace = V4L2_COLORSPACE_JPEG; +- + if (half_scale) { + dev_dbg(&client->dev, "max resolution: QCIF\n"); + coma_set |= COMA_QCIF; +@@ -676,7 +670,6 @@ static int ov6650_s_fmt(struct v4l2_subd + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); + + if (!ret) { +- mf->colorspace = priv->colorspace; + mf->width = priv->rect.width >> half_scale; + mf->height = priv->rect.height >> half_scale; + } +@@ -695,6 +688,7 @@ static int ov6650_try_fmt(struct v4l2_su + &mf->height, 2, H_CIF, 1, 0); + + mf->field = V4L2_FIELD_NONE; ++ mf->colorspace = V4L2_COLORSPACE_SRGB; + + switch (mf->code) { + case V4L2_MBUS_FMT_Y10_1X10: +@@ -704,12 +698,10 @@ static int ov6650_try_fmt(struct v4l2_su + case V4L2_MBUS_FMT_YUYV8_2X8: + case V4L2_MBUS_FMT_VYUY8_2X8: + case V4L2_MBUS_FMT_UYVY8_2X8: +- mf->colorspace = V4L2_COLORSPACE_JPEG; + break; + default: + mf->code = V4L2_MBUS_FMT_SBGGR8_1X8; + case V4L2_MBUS_FMT_SBGGR8_1X8: +- mf->colorspace = V4L2_COLORSPACE_SRGB; + break; + } + +@@ -1016,7 +1008,6 @@ static int ov6650_probe(struct i2c_clien + priv->rect.height = H_CIF; + priv->half_scale = false; + priv->code = V4L2_MBUS_FMT_YUYV8_2X8; +- priv->colorspace = V4L2_COLORSPACE_JPEG; + + priv->clk = v4l2_clk_get(&client->dev, "mclk"); + if (IS_ERR(priv->clk)) { diff --git a/queue-3.16/media-ov6650-fix-stored-frame-format-not-in-sync-with-hardware.patch b/queue-3.16/media-ov6650-fix-stored-frame-format-not-in-sync-with-hardware.patch new file mode 100644 index 00000000..84a44404 --- /dev/null +++ b/queue-3.16/media-ov6650-fix-stored-frame-format-not-in-sync-with-hardware.patch @@ -0,0 +1,62 @@ +From: Janusz Krzysztofik <jmkrzyszt@gmail.com> +Date: Tue, 3 Sep 2019 17:11:43 -0300 +Subject: media: ov6650: Fix stored frame format not in sync with hardware + +commit 3143b459de4cdcce67b36827476c966e93c1cf01 upstream. + +The driver stores frame format settings supposed to be in line with +hardware state in a device private structure. Since the driver initial +submission, those settings are updated before they are actually applied +on hardware. If an error occurs on device update, the stored settings +my not reflect hardware state anymore and consecutive calls to +.get_fmt() may return incorrect information. That in turn may affect +ability of a bridge device to use correct DMA transfer settings if such +incorrect informmation on active frame format returned by .get_fmt() is +used. + +Assuming a failed device update means its state hasn't changed, update +frame format related settings stored in the device private structure +only after they are successfully applied so the stored values always +reflect hardware state as closely as possible. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik <jmkrzyszt@gmail.com> +Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +[bwh: Backported to 3.16: adjust filename] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/media/i2c/soc_camera/ov6650.c ++++ b/drivers/media/i2c/soc_camera/ov6650.c +@@ -605,7 +605,6 @@ static int ov6650_s_fmt(struct v4l2_subd + dev_err(&client->dev, "Pixel format not handled: 0x%x\n", code); + return -EINVAL; + } +- priv->code = code; + + if (code == V4L2_MBUS_FMT_Y8_1X8 || + code == V4L2_MBUS_FMT_SBGGR8_1X8) { +@@ -626,7 +625,6 @@ static int ov6650_s_fmt(struct v4l2_subd + dev_dbg(&client->dev, "max resolution: CIF\n"); + coma_mask |= COMA_QCIF; + } +- priv->half_scale = half_scale; + + if (sense) { + if (sense->master_clock == 8000000) { +@@ -666,10 +664,14 @@ static int ov6650_s_fmt(struct v4l2_subd + ret = ov6650_reg_rmw(client, REG_COMA, coma_set, coma_mask); + if (!ret) + ret = ov6650_reg_write(client, REG_CLKRC, clkrc); +- if (!ret) ++ if (!ret) { ++ priv->half_scale = half_scale; ++ + ret = ov6650_reg_rmw(client, REG_COML, coml_set, coml_mask); ++ } + + if (!ret) { ++ priv->code = code; + mf->width = priv->rect.width >> half_scale; + mf->height = priv->rect.height >> half_scale; + } diff --git a/queue-3.16/media-radio-wl1273-fix-interrupt-masking-on-release.patch b/queue-3.16/media-radio-wl1273-fix-interrupt-masking-on-release.patch new file mode 100644 index 00000000..af41c205 --- /dev/null +++ b/queue-3.16/media-radio-wl1273-fix-interrupt-masking-on-release.patch @@ -0,0 +1,35 @@ +From: Johan Hovold <johan@kernel.org> +Date: Thu, 10 Oct 2019 10:13:32 -0300 +Subject: media: radio: wl1273: fix interrupt masking on release + +commit 1091eb830627625dcf79958d99353c2391f41708 upstream. + +If a process is interrupted while accessing the radio device and the +core lock is contended, release() could return early and fail to update +the interrupt mask. + +Note that the return value of the v4l2 release file operation is +ignored. + +Fixes: 87d1a50ce451 ("[media] V4L2: WL1273 FM Radio: TI WL1273 FM radio driver") +Cc: Matti Aaltonen <matti.j.aaltonen@nokia.com> +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> +Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/radio/radio-wl1273.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/media/radio/radio-wl1273.c ++++ b/drivers/media/radio/radio-wl1273.c +@@ -1142,8 +1142,7 @@ static int wl1273_fm_fops_release(struct + if (radio->rds_users > 0) { + radio->rds_users--; + if (radio->rds_users == 0) { +- if (mutex_lock_interruptible(&core->lock)) +- return -EINTR; ++ mutex_lock(&core->lock); + + radio->irq_flags &= ~WL1273_RDS_EVENT; + diff --git a/queue-3.16/media-usbvision-fix-invalid-accesses-after-device-disconnect.patch b/queue-3.16/media-usbvision-fix-invalid-accesses-after-device-disconnect.patch new file mode 100644 index 00000000..8af454f7 --- /dev/null +++ b/queue-3.16/media-usbvision-fix-invalid-accesses-after-device-disconnect.patch @@ -0,0 +1,58 @@ +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 7 Oct 2019 12:09:04 -0300 +Subject: media: usbvision: Fix invalid accesses after device disconnect + +commit c7a191464078262bf799136317c95824e26a222b upstream. + +The syzbot fuzzer found two invalid-access bugs in the usbvision +driver. These bugs occur when userspace keeps the device file open +after the device has been disconnected and usbvision_disconnect() has +set usbvision->dev to NULL: + + When the device file is closed, usbvision_radio_close() tries + to issue a usb_set_interface() call, passing the NULL pointer + as its first argument. + + If userspace performs a querycap ioctl call, vidioc_querycap() + calls usb_make_path() with the same NULL pointer. + +This patch fixes the problems by making the appropriate tests +beforehand. Note that vidioc_querycap() is protected by +usbvision->v4l2_lock, acquired in a higher layer of the V4L2 +subsystem. + +Reported-and-tested-by: syzbot+7fa38a608b1075dfd634@syzkaller.appspotmail.com + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/usb/usbvision/usbvision-video.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -482,6 +482,9 @@ static int vidioc_querycap(struct file * + { + struct usb_usbvision *usbvision = video_drvdata(file); + ++ if (!usbvision->dev) ++ return -ENODEV; ++ + strlcpy(vc->driver, "USBVision", sizeof(vc->driver)); + strlcpy(vc->card, + usbvision_device_data[usbvision->dev_model].model_string, +@@ -1169,8 +1172,9 @@ static int usbvision_radio_close(struct + mutex_lock(&usbvision->v4l2_lock); + /* Set packet size to 0 */ + usbvision->iface_alt = 0; +- err_code = usb_set_interface(usbvision->dev, usbvision->iface, +- usbvision->iface_alt); ++ if (usbvision->dev) ++ err_code = usb_set_interface(usbvision->dev, usbvision->iface, ++ usbvision->iface_alt); + + usbvision_audio_off(usbvision); + usbvision->radio = 0; diff --git a/queue-3.16/media-usbvision-fix-races-among-open-close-and-disconnect.patch b/queue-3.16/media-usbvision-fix-races-among-open-close-and-disconnect.patch new file mode 100644 index 00000000..45cdc840 --- /dev/null +++ b/queue-3.16/media-usbvision-fix-races-among-open-close-and-disconnect.patch @@ -0,0 +1,134 @@ +From: Alan Stern <stern@rowland.harvard.edu> +Date: Mon, 7 Oct 2019 12:09:53 -0300 +Subject: media: usbvision: Fix races among open, close, and disconnect + +commit 9e08117c9d4efc1e1bc6fce83dab856d9fd284b6 upstream. + +Visual inspection of the usbvision driver shows that it suffers from +three races between its open, close, and disconnect handlers. In +particular, the driver is careful to update its usbvision->user and +usbvision->remove_pending flags while holding the private mutex, but: + + usbvision_v4l2_close() and usbvision_radio_close() don't hold + the mutex while they check the value of + usbvision->remove_pending; + + usbvision_disconnect() doesn't hold the mutex while checking + the value of usbvision->user; and + + also, usbvision_v4l2_open() and usbvision_radio_open() don't + check whether the device has been unplugged before allowing + the user to open the device files. + +Each of these can potentially lead to usbvision_release() being called +twice and use-after-free errors. + +This patch fixes the races by reading the flags while the mutex is +still held and checking for pending removes before allowing an open to +succeed. + +Signed-off-by: Alan Stern <stern@rowland.harvard.edu> +Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> +Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> +[bwh: Backported to 3.16: + - Add unlock label in usbvision_v4l2_open() + - Adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -348,6 +348,10 @@ static int usbvision_v4l2_open(struct fi + if (mutex_lock_interruptible(&usbvision->v4l2_lock)) + return -ERESTARTSYS; + ++ if (usbvision->remove_pending) { ++ err_code = -ENODEV; ++ goto unlock; ++ } + if (usbvision->user) { + err_code = -EBUSY; + } else { +@@ -389,6 +393,7 @@ static int usbvision_v4l2_open(struct fi + } + } + ++unlock: + mutex_unlock(&usbvision->v4l2_lock); + + PDEBUG(DBG_IO, "success"); +@@ -406,6 +411,7 @@ static int usbvision_v4l2_open(struct fi + static int usbvision_v4l2_close(struct file *file) + { + struct usb_usbvision *usbvision = video_drvdata(file); ++ int r; + + PDEBUG(DBG_IO, "close"); + +@@ -420,9 +426,10 @@ static int usbvision_v4l2_close(struct f + usbvision_scratch_free(usbvision); + + usbvision->user--; ++ r = usbvision->remove_pending; + mutex_unlock(&usbvision->v4l2_lock); + +- if (usbvision->remove_pending) { ++ if (r) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); + return 0; +@@ -1136,6 +1143,11 @@ static int usbvision_radio_open(struct f + + if (mutex_lock_interruptible(&usbvision->v4l2_lock)) + return -ERESTARTSYS; ++ ++ if (usbvision->remove_pending) { ++ err_code = -ENODEV; ++ goto out; ++ } + if (usbvision->user) { + dev_err(&usbvision->rdev->dev, + "%s: Someone tried to open an already opened USBVision Radio!\n", +@@ -1166,6 +1178,7 @@ static int usbvision_radio_close(struct + { + struct usb_usbvision *usbvision = video_drvdata(file); + int err_code = 0; ++ int r; + + PDEBUG(DBG_IO, ""); + +@@ -1179,9 +1192,10 @@ static int usbvision_radio_close(struct + usbvision_audio_off(usbvision); + usbvision->radio = 0; + usbvision->user--; ++ r = usbvision->remove_pending; + mutex_unlock(&usbvision->v4l2_lock); + +- if (usbvision->remove_pending) { ++ if (r) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); + return err_code; +@@ -1614,6 +1628,7 @@ err_usb: + static void usbvision_disconnect(struct usb_interface *intf) + { + struct usb_usbvision *usbvision = to_usbvision(usb_get_intfdata(intf)); ++ int u; + + PDEBUG(DBG_PROBE, ""); + +@@ -1630,13 +1645,14 @@ static void usbvision_disconnect(struct + v4l2_device_disconnect(&usbvision->v4l2_dev); + usbvision_i2c_unregister(usbvision); + usbvision->remove_pending = 1; /* Now all ISO data will be ignored */ ++ u = usbvision->user; + + usb_put_dev(usbvision->dev); + usbvision->dev = NULL; /* USB device is no more */ + + mutex_unlock(&usbvision->v4l2_lock); + +- if (usbvision->user) { ++ if (u) { + printk(KERN_INFO "%s: In use, disconnect pending\n", + __func__); + wake_up_interruptible(&usbvision->wait_frame); diff --git a/queue-3.16/mtd-spear_smi-fix-write-burst-mode.patch b/queue-3.16/mtd-spear_smi-fix-write-burst-mode.patch new file mode 100644 index 00000000..39564221 --- /dev/null +++ b/queue-3.16/mtd-spear_smi-fix-write-burst-mode.patch @@ -0,0 +1,102 @@ +From: Miquel Raynal <miquel.raynal@bootlin.com> +Date: Tue, 22 Oct 2019 16:58:59 +0200 +Subject: mtd: spear_smi: Fix Write Burst mode + +commit 69c7f4618c16b4678f8a4949b6bb5ace259c0033 upstream. + +Any write with either dd or flashcp to a device driven by the +spear_smi.c driver will pass through the spear_smi_cpy_toio() +function. This function will get called for chunks of up to 256 bytes. +If the amount of data is smaller, we may have a problem if the data +length is not 4-byte aligned. In this situation, the kernel panics +during the memcpy: + + # dd if=/dev/urandom bs=1001 count=1 of=/dev/mtd6 + spear_smi_cpy_toio [620] dest c9070000, src c7be8800, len 256 + spear_smi_cpy_toio [620] dest c9070100, src c7be8900, len 256 + spear_smi_cpy_toio [620] dest c9070200, src c7be8a00, len 256 + spear_smi_cpy_toio [620] dest c9070300, src c7be8b00, len 233 + Unhandled fault: external abort on non-linefetch (0x808) at 0xc90703e8 + [...] + PC is at memcpy+0xcc/0x330 + +The above error occurs because the implementation of memcpy_toio() +tries to optimize the number of I/O by writing 4 bytes at a time as +much as possible, until there are less than 4 bytes left and then +switches to word or byte writes. + +Unfortunately, the specification states about the Write Burst mode: + + "the next AHB Write request should point to the next + incremented address and should have the same size (byte, + half-word or word)" + +This means ARM architecture implementation of memcpy_toio() cannot +reliably be used blindly here. Workaround this situation by update the +write path to stick to byte access when the burst length is not +multiple of 4. + +Fixes: f18dbbb1bfe0 ("mtd: ST SPEAr: Add SMI driver for serial NOR flash") +Cc: Russell King <linux@armlinux.org.uk> +Cc: Boris Brezillon <boris.brezillon@collabora.com> +Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> +Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/mtd/devices/spear_smi.c | 38 ++++++++++++++++++++++++++++++++- + 1 file changed, 37 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/devices/spear_smi.c ++++ b/drivers/mtd/devices/spear_smi.c +@@ -595,6 +595,26 @@ static int spear_mtd_read(struct mtd_inf + return 0; + } + ++/* ++ * The purpose of this function is to ensure a memcpy_toio() with byte writes ++ * only. Its structure is inspired from the ARM implementation of _memcpy_toio() ++ * which also does single byte writes but cannot be used here as this is just an ++ * implementation detail and not part of the API. Not mentioning the comment ++ * stating that _memcpy_toio() should be optimized. ++ */ ++static void spear_smi_memcpy_toio_b(volatile void __iomem *dest, ++ const void *src, size_t len) ++{ ++ const unsigned char *from = src; ++ ++ while (len) { ++ len--; ++ writeb(*from, dest); ++ from++; ++ dest++; ++ } ++} ++ + static inline int spear_smi_cpy_toio(struct spear_smi *dev, u32 bank, + void __iomem *dest, const void *src, size_t len) + { +@@ -617,7 +637,23 @@ static inline int spear_smi_cpy_toio(str + ctrlreg1 = readl(dev->io_base + SMI_CR1); + writel((ctrlreg1 | WB_MODE) & ~SW_MODE, dev->io_base + SMI_CR1); + +- memcpy_toio(dest, src, len); ++ /* ++ * In Write Burst mode (WB_MODE), the specs states that writes must be: ++ * - incremental ++ * - of the same size ++ * The ARM implementation of memcpy_toio() will optimize the number of ++ * I/O by using as much 4-byte writes as possible, surrounded by ++ * 2-byte/1-byte access if: ++ * - the destination is not 4-byte aligned ++ * - the length is not a multiple of 4-byte. ++ * Avoid this alternance of write access size by using our own 'byte ++ * access' helper if at least one of the two conditions above is true. ++ */ ++ if (IS_ALIGNED(len, sizeof(u32)) && ++ IS_ALIGNED((uintptr_t)dest, sizeof(u32))) ++ memcpy_toio(dest, src, len); ++ else ++ spear_smi_memcpy_toio_b(dest, src, len); + + writel(ctrlreg1, dev->io_base + SMI_CR1); + diff --git a/queue-3.16/net-bridge-deny-dev_set_mac_address-when-unregistering.patch b/queue-3.16/net-bridge-deny-dev_set_mac_address-when-unregistering.patch new file mode 100644 index 00000000..394117aa --- /dev/null +++ b/queue-3.16/net-bridge-deny-dev_set_mac_address-when-unregistering.patch @@ -0,0 +1,73 @@ +From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> +Date: Tue, 3 Dec 2019 16:48:06 +0200 +Subject: net: bridge: deny dev_set_mac_address() when unregistering + +commit c4b4c421857dc7b1cf0dccbd738472360ff2cd70 upstream. + +We have an interesting memory leak in the bridge when it is being +unregistered and is a slave to a master device which would change the +mac of its slaves on unregister (e.g. bond, team). This is a very +unusual setup but we do end up leaking 1 fdb entry because +dev_set_mac_address() would cause the bridge to insert the new mac address +into its table after all fdbs are flushed, i.e. after dellink() on the +bridge has finished and we call NETDEV_UNREGISTER the bond/team would +release it and will call dev_set_mac_address() to restore its original +address and that in turn will add an fdb in the bridge. +One fix is to check for the bridge dev's reg_state in its +ndo_set_mac_address callback and return an error if the bridge is not in +NETREG_REGISTERED. + +Easy steps to reproduce: + 1. add bond in mode != A/B + 2. add any slave to the bond + 3. add bridge dev as a slave to the bond + 4. destroy the bridge device + +Trace: + unreferenced object 0xffff888035c4d080 (size 128): + comm "ip", pid 4068, jiffies 4296209429 (age 1413.753s) + hex dump (first 32 bytes): + 41 1d c9 36 80 88 ff ff 00 00 00 00 00 00 00 00 A..6............ + d2 19 c9 5e 3f d7 00 00 00 00 00 00 00 00 00 00 ...^?........... + backtrace: + [<00000000ddb525dc>] kmem_cache_alloc+0x155/0x26f + [<00000000633ff1e0>] fdb_create+0x21/0x486 [bridge] + [<0000000092b17e9c>] fdb_insert+0x91/0xdc [bridge] + [<00000000f2a0f0ff>] br_fdb_change_mac_address+0xb3/0x175 [bridge] + [<000000001de02dbd>] br_stp_change_bridge_id+0xf/0xff [bridge] + [<00000000ac0e32b1>] br_set_mac_address+0x76/0x99 [bridge] + [<000000006846a77f>] dev_set_mac_address+0x63/0x9b + [<00000000d30738fc>] __bond_release_one+0x3f6/0x455 [bonding] + [<00000000fc7ec01d>] bond_netdev_event+0x2f2/0x400 [bonding] + [<00000000305d7795>] notifier_call_chain+0x38/0x56 + [<0000000028885d4a>] call_netdevice_notifiers+0x1e/0x23 + [<000000008279477b>] rollback_registered_many+0x353/0x6a4 + [<0000000018ef753a>] unregister_netdevice_many+0x17/0x6f + [<00000000ba854b7a>] rtnl_delete_link+0x3c/0x43 + [<00000000adf8618d>] rtnl_dellink+0x1dc/0x20a + [<000000009b6395fd>] rtnetlink_rcv_msg+0x23d/0x268 + +Fixes: 43598813386f ("bridge: add local MAC address to forwarding table (v2)") +Reported-by: syzbot+2add91c08eb181fea1bf@syzkaller.appspotmail.com +Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/bridge/br_device.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/bridge/br_device.c ++++ b/net/bridge/br_device.c +@@ -193,6 +193,12 @@ static int br_set_mac_address(struct net + if (!is_valid_ether_addr(addr->sa_data)) + return -EADDRNOTAVAIL; + ++ /* dev_set_mac_addr() can be called by a master device on bridge's ++ * NETDEV_UNREGISTER, but since it's being destroyed do nothing ++ */ ++ if (dev->reg_state != NETREG_REGISTERED) ++ return -EBUSY; ++ + spin_lock_bh(&br->lock); + if (!ether_addr_equal(dev->dev_addr, addr->sa_data)) { + /* Mac address will be changed in br_stp_change_bridge_id(). */ diff --git a/queue-3.16/openvswitch-drop-unneeded-bug_on-in-ovs_flow_cmd_build_info.patch b/queue-3.16/openvswitch-drop-unneeded-bug_on-in-ovs_flow_cmd_build_info.patch new file mode 100644 index 00000000..0395d323 --- /dev/null +++ b/queue-3.16/openvswitch-drop-unneeded-bug_on-in-ovs_flow_cmd_build_info.patch @@ -0,0 +1,38 @@ +From: Paolo Abeni <pabeni@redhat.com> +Date: Sun, 1 Dec 2019 18:41:24 +0100 +Subject: openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info() + +commit 8ffeb03fbba3b599690b361467bfd2373e8c450f upstream. + +All the callers of ovs_flow_cmd_build_info() already deal with +error return code correctly, so we can handle the error condition +in a more gracefull way. Still dump a warning to preserve +debuggability. + +v1 -> v2: + - clarify the commit message + - clean the skb and report the error (DaveM) + +Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/openvswitch/datapath.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -788,7 +788,10 @@ static struct sk_buff *ovs_flow_cmd_buil + retval = ovs_flow_cmd_fill_info(flow, dp_ifindex, skb, + info->snd_portid, info->snd_seq, 0, + cmd); +- BUG_ON(retval < 0); ++ if (WARN_ON_ONCE(retval < 0)) { ++ kfree_skb(skb); ++ skb = ERR_PTR(retval); ++ } + return skb; + } + diff --git a/queue-3.16/openvswitch-remove-another-bug_on.patch b/queue-3.16/openvswitch-remove-another-bug_on.patch new file mode 100644 index 00000000..aeb3d78c --- /dev/null +++ b/queue-3.16/openvswitch-remove-another-bug_on.patch @@ -0,0 +1,46 @@ +From: Paolo Abeni <pabeni@redhat.com> +Date: Sun, 1 Dec 2019 18:41:25 +0100 +Subject: openvswitch: remove another BUG_ON() + +commit 8a574f86652a4540a2433946ba826ccb87f398cc upstream. + +If we can't build the flow del notification, we can simply delete +the flow, no need to crash the kernel. Still keep a WARN_ON to +preserve debuggability. + +Note: the BUG_ON() predates the Fixes tag, but this change +can be applied only after the mentioned commit. + +v1 -> v2: + - do not leak an skb on error + +Fixes: aed067783e50 ("openvswitch: Minimize ovs_flow_cmd_del critical section.") +Signed-off-by: Paolo Abeni <pabeni@redhat.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/openvswitch/datapath.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/openvswitch/datapath.c ++++ b/net/openvswitch/datapath.c +@@ -1136,7 +1136,10 @@ static int ovs_flow_cmd_del(struct sk_bu + info->snd_seq, 0, + OVS_FLOW_CMD_DEL); + rcu_read_unlock(); +- BUG_ON(err < 0); ++ if (WARN_ON_ONCE(err < 0)) { ++ kfree_skb(reply); ++ goto out_free; ++ } + + ovs_notify(&dp_flow_genl_family, reply, info); + } else { +@@ -1144,6 +1147,7 @@ static int ovs_flow_cmd_del(struct sk_bu + } + } + ++out_free: + ovs_flow_free(flow, true); + return 0; + unlock: diff --git a/queue-3.16/pci-fix-intel-acs-quirk-updcr-register-address.patch b/queue-3.16/pci-fix-intel-acs-quirk-updcr-register-address.patch new file mode 100644 index 00000000..41d4d09d --- /dev/null +++ b/queue-3.16/pci-fix-intel-acs-quirk-updcr-register-address.patch @@ -0,0 +1,41 @@ +From: Steffen Liebergeld <steffen.liebergeld@kernkonzept.com> +Date: Wed, 18 Sep 2019 15:16:52 +0200 +Subject: PCI: Fix Intel ACS quirk UPDCR register address + +commit d8558ac8c93d429d65d7490b512a3a67e559d0d4 upstream. + +According to documentation [0] the correct offset for the Upstream Peer +Decode Configuration Register (UPDCR) is 0x1014. It was previously defined +as 0x1114. + +d99321b63b1f ("PCI: Enable quirks for PCIe ACS on Intel PCH root ports") +intended to enforce isolation between PCI devices allowing them to be put +into separate IOMMU groups. Due to the wrong register offset the intended +isolation was not fully enforced. This is fixed with this patch. + +Please note that I did not test this patch because I have no hardware that +implements this register. + +[0] https://www.intel.com/content/dam/www/public/us/en/documents/datasheets/4th-gen-core-family-mobile-i-o-datasheet.pdf (page 325) +Fixes: d99321b63b1f ("PCI: Enable quirks for PCIe ACS on Intel PCH root ports") +Link: https://lore.kernel.org/r/7a3505df-79ba-8a28-464c-88b83eefffa6@kernkonzept.com +Signed-off-by: Steffen Liebergeld <steffen.liebergeld@kernkonzept.com> +Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> +Reviewed-by: Andrew Murray <andrew.murray@arm.com> +Acked-by: Ashok Raj <ashok.raj@intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/pci/quirks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3787,7 +3787,7 @@ int pci_dev_specific_acs_enabled(struct + #define INTEL_BSPR_REG_BPPD (1 << 9) + + /* Upstream Peer Decode Configuration Register */ +-#define INTEL_UPDCR_REG 0x1114 ++#define INTEL_UPDCR_REG 0x1014 + /* 5:0 Peer Decode Enable bits */ + #define INTEL_UPDCR_REG_MASK 0x3f + diff --git a/queue-3.16/pci-msi-fix-incorrect-msi-x-masking-on-resume.patch b/queue-3.16/pci-msi-fix-incorrect-msi-x-masking-on-resume.patch new file mode 100644 index 00000000..afa89aa4 --- /dev/null +++ b/queue-3.16/pci-msi-fix-incorrect-msi-x-masking-on-resume.patch @@ -0,0 +1,61 @@ +From: Jian-Hong Pan <jian-hong@endlessm.com> +Date: Tue, 8 Oct 2019 11:42:39 +0800 +Subject: PCI/MSI: Fix incorrect MSI-X masking on resume + +commit e045fa29e89383c717e308609edd19d2fd29e1be upstream. + +When a driver enables MSI-X, msix_program_entries() reads the MSI-X Vector +Control register for each vector and saves it in desc->masked. Each +register is 32 bits and bit 0 is the actual Mask bit. + +When we restored these registers during resume, we previously set the Mask +bit if *any* bit in desc->masked was set instead of when the Mask bit +itself was set: + + pci_restore_state + pci_restore_msi_state + __pci_restore_msix_state + for_each_pci_msi_entry + msix_mask_irq(entry, entry->masked) <-- entire u32 word + __pci_msix_desc_mask_irq(desc, flag) + mask_bits = desc->masked & ~PCI_MSIX_ENTRY_CTRL_MASKBIT + if (flag) <-- testing entire u32, not just bit 0 + mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT + writel(mask_bits, desc_addr + PCI_MSIX_ENTRY_VECTOR_CTRL) + +This means that after resume, MSI-X vectors were masked when they shouldn't +be, which leads to timeouts like this: + + nvme nvme0: I/O 978 QID 3 timeout, completion polled + +On resume, set the Mask bit only when the saved Mask bit from suspend was +set. + +This should remove the need for 19ea025e1d28 ("nvme: Add quirk for Kingston +NVME SSD running FW E8FK11.T"). + +[bhelgaas: commit log, move fix to __pci_msix_desc_mask_irq()] +Link: https://bugzilla.kernel.org/show_bug.cgi?id=204887 +Link: https://lore.kernel.org/r/20191008034238.2503-1-jian-hong@endlessm.com +Fixes: f2440d9acbe8 ("PCI MSI: Refactor interrupt masking code") +Signed-off-by: Jian-Hong Pan <jian-hong@endlessm.com> +Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/pci/msi.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -220,8 +220,9 @@ u32 default_msix_mask_irq(struct msi_des + u32 mask_bits = desc->masked; + unsigned offset = desc->msi_attrib.entry_nr * PCI_MSIX_ENTRY_SIZE + + PCI_MSIX_ENTRY_VECTOR_CTRL; ++ + mask_bits &= ~PCI_MSIX_ENTRY_CTRL_MASKBIT; +- if (flag) ++ if (flag & PCI_MSIX_ENTRY_CTRL_MASKBIT) + mask_bits |= PCI_MSIX_ENTRY_CTRL_MASKBIT; + writel(mask_bits, desc->mask_base + offset); + diff --git a/queue-3.16/perf-probe-filter-out-instances-except-for-inlined-subroutine-and.patch b/queue-3.16/perf-probe-filter-out-instances-except-for-inlined-subroutine-and.patch new file mode 100644 index 00000000..4f4e8b1b --- /dev/null +++ b/queue-3.16/perf-probe-filter-out-instances-except-for-inlined-subroutine-and.patch @@ -0,0 +1,114 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Wed, 30 Oct 2019 16:09:30 +0900 +Subject: perf probe: Filter out instances except for inlined subroutine and + subprogram + +commit da6cb952a89efe24bb76c4971370d485737a2d85 upstream. + +Filter out instances except for inlined_subroutine and subprogram DIE in +die_walk_instances() and die_is_func_instance(). + +This fixes an issue that perf probe sets some probes on calling address +instead of a target function itself. + +When perf probe walks on instances of an abstruct origin (a kind of +function prototype of inlined function), die_walk_instances() can also +pass a GNU_call_site (a GNU extension for call site) to callback. Since +it is not an inlined instance of target function, we have to filter out +when searching a probe point. + +Without this patch, perf probe sets probes on call site address too.This +can happen on some function which is marked "inlined", but has actual +symbol. (I'm not sure why GCC mark it "inlined"): + + # perf probe -D vfs_read + p:probe/vfs_read _text+2500017 + p:probe/vfs_read_1 _text+2499468 + p:probe/vfs_read_2 _text+2499563 + p:probe/vfs_read_3 _text+2498876 + p:probe/vfs_read_4 _text+2498512 + p:probe/vfs_read_5 _text+2498627 + +With this patch: + +Slightly different results, similar tho: + + # perf probe -D vfs_read + p:probe/vfs_read _text+2498512 + +Committer testing: + + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + +Before: + + # perf probe -D vfs_read + p:probe/vfs_read _text+3131557 + p:probe/vfs_read_1 _text+3130975 + p:probe/vfs_read_2 _text+3131047 + p:probe/vfs_read_3 _text+3130380 + p:probe/vfs_read_4 _text+3130000 + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + # + +After: + + # perf probe -D vfs_read + p:probe/vfs_read _text+3130000 + # + +Fixes: db0d2c6420ee ("perf probe: Search concrete out-of-line instances") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157241937063.32002.11024544873990816590.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -304,18 +304,22 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf + * @dw_die: a DIE + * + * Ensure that this DIE is an instance (which has an entry address). +- * This returns true if @dw_die is a function instance. If not, you need to +- * call die_walk_instances() to find actual instances. ++ * This returns true if @dw_die is a function instance. If not, the @dw_die ++ * must be a prototype. You can use die_walk_instances() to find actual ++ * instances. + **/ + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; + Dwarf_Attribute attr_mem; ++ int tag = dwarf_tag(dw_die); + +- /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && +- (dwarf_entrypc(dw_die, &tmp) == 0 || +- dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL); ++ if (tag != DW_TAG_subprogram && ++ tag != DW_TAG_inlined_subroutine) ++ return false; ++ ++ return dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL; + } + + /** +@@ -557,6 +561,9 @@ static int __die_walk_instances_cb(Dwarf + Dwarf_Die *origin; + int tmp; + ++ if (!die_is_func_instance(inst)) ++ return DIE_FIND_CB_CONTINUE; ++ + attr = dwarf_attr(inst, DW_AT_abstract_origin, &attr_mem); + if (attr == NULL) + return DIE_FIND_CB_CONTINUE; diff --git a/queue-3.16/perf-probe-fix-to-add-missed-brace-around-if-block.patch b/queue-3.16/perf-probe-fix-to-add-missed-brace-around-if-block.patch new file mode 100644 index 00000000..66949123 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-add-missed-brace-around-if-block.patch @@ -0,0 +1,41 @@ +From: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Date: Thu, 13 Aug 2015 06:55:41 +0900 +Subject: perf probe: Fix to add missed brace around if block + +commit 86a76027457633488b0a83d5e2bb944159885605 upstream. + +The commit 75186a9b09e4 (perf probe: Fix to show lines of sys_ functions +correctly) introduced a bug by a missed brace around if block. This +fixes to add it. + +Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Cc: David Ahern <dsahern@gmail.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Fixes: 75186a9b09e4 ("perf probe: Fix to show lines of sys_ functions correctly") +Link: http://lkml.kernel.org/r/20150812215541.9088.62425.stgit@localhost.localdomain +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -717,7 +717,7 @@ int die_walk_lines(Dwarf_Die *rt_die, li + continue; + } + /* Filter lines based on address */ +- if (rt_die != cu_die) ++ if (rt_die != cu_die) { + /* + * Address filtering + * The line is included in given function, and +@@ -731,6 +731,7 @@ int die_walk_lines(Dwarf_Die *rt_die, li + decf != dwarf_decl_file(&die_mem)) + continue; + } ++ } + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + diff --git a/queue-3.16/perf-probe-fix-to-find-range-only-function-instance.patch b/queue-3.16/perf-probe-fix-to-find-range-only-function-instance.patch new file mode 100644 index 00000000..fa30ec00 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-find-range-only-function-instance.patch @@ -0,0 +1,42 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Thu, 24 Oct 2019 18:12:36 +0900 +Subject: perf probe: Fix to find range-only function instance + +commit b77afa1f810f37bd8a36cb1318178dfe2d7af6b6 upstream. + +Fix die_is_func_instance() to find range-only function instance. + +In some case, a function instance can be made without any low PC or +entry PC, but only with address ranges by optimization. (e.g. cold text +partially in "text.unlikely" section) To find such function instance, we +have to check the range attribute too. + +Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157190835669.1859.8368628035930950596.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -288,10 +288,14 @@ bool die_is_func_def(Dwarf_Die *dw_die) + bool die_is_func_instance(Dwarf_Die *dw_die) + { + Dwarf_Addr tmp; ++ Dwarf_Attribute attr_mem; + + /* Actually gcc optimizes non-inline as like as inlined */ +- return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++ return !dwarf_func_inline(dw_die) && ++ (dwarf_entrypc(dw_die, &tmp) == 0 || ++ dwarf_attr(dw_die, DW_AT_ranges, &attr_mem) != NULL); + } ++ + /** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure diff --git a/queue-3.16/perf-probe-fix-to-handle-optimized-not-inlined-functions.patch b/queue-3.16/perf-probe-fix-to-handle-optimized-not-inlined-functions.patch new file mode 100644 index 00000000..6d475ddf --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-handle-optimized-not-inlined-functions.patch @@ -0,0 +1,124 @@ +From: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Date: Fri, 30 Jan 2015 18:37:44 +0900 +Subject: perf probe: Fix to handle optimized not-inlined functions + +commit e1ecbbc3fa834cc6b4b344edb1968e734d57189b upstream. + +Fix to handle optimized no-inline functions which have only function +definition but no actual instance at that point. + +To fix this problem, we need to find actual instance of the function. + +Without this patch: + ---- + # perf probe -a __up + Failed to get entry address of __up. + Error: Failed to add events. + # perf probe -L __up + Specified source line is not found. + Error: Failed to show lines. + ---- + +With this patch: + ---- + # perf probe -a __up + Added new event: + probe:__up (on __up) + + You can now use it in all perf tools, such as: + + perf record -e probe:__up -aR sleep 1 + + # perf probe -L __up + <__up@/home/fedora/ksrc/linux-3/kernel/locking/semaphore.c:0> + 0 static noinline void __sched __up(struct semaphore *sem) + { + struct semaphore_waiter *waiter = list_first_entry(&sem->wait_ + struct semaphore_waite + 4 list_del(&waiter->list); + 5 waiter->up = true; + 6 wake_up_process(waiter->task); + 7 } + ---- + +Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Link: http://lkml.kernel.org/r/20150130093744.30575.43290.stgit@localhost.localdomain +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 15 +++++++++++++++ + tools/perf/util/dwarf-aux.h | 3 +++ + tools/perf/util/probe-finder.c | 12 ++++-------- + 3 files changed, 22 insertions(+), 8 deletions(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -278,6 +278,21 @@ bool die_is_func_def(Dwarf_Die *dw_die) + } + + /** ++ * die_is_func_instance - Ensure that this DIE is an instance of a subprogram ++ * @dw_die: a DIE ++ * ++ * Ensure that this DIE is an instance (which has an entry address). ++ * This returns true if @dw_die is a function instance. If not, you need to ++ * call die_walk_instances() to find actual instances. ++ **/ ++bool die_is_func_instance(Dwarf_Die *dw_die) ++{ ++ Dwarf_Addr tmp; ++ ++ /* Actually gcc optimizes non-inline as like as inlined */ ++ return !dwarf_func_inline(dw_die) && dwarf_entrypc(dw_die, &tmp) == 0; ++} ++/** + * die_get_data_member_location - Get the data-member offset + * @mb_die: a DIE of a member of a data structure + * @offs: The offset of the member in the data structure +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -41,6 +41,9 @@ extern int cu_walk_functions_at(Dwarf_Di + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + extern bool die_is_func_def(Dwarf_Die *dw_die); + ++/* Ensure that this DIE is an instance of a subprogram */ ++extern bool die_is_func_instance(Dwarf_Die *dw_die); ++ + /* Compare diename and tname */ + extern bool die_compare_name(Dwarf_Die *dw_die, const char *tname); + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -909,17 +909,13 @@ static int probe_point_search_cb(Dwarf_D + dwarf_decl_line(sp_die, &pf->lno); + pf->lno += pp->line; + param->retval = find_probe_point_by_line(pf); +- } else if (!dwarf_func_inline(sp_die)) { ++ } else if (die_is_func_instance(sp_die)) { ++ /* Instances always have the entry address */ ++ dwarf_entrypc(sp_die, &pf->addr); + /* Real function */ + if (pp->lazy_line) + param->retval = find_probe_point_lazy(sp_die, pf); + else { +- if (dwarf_entrypc(sp_die, &pf->addr) != 0) { +- pr_warning("Failed to get entry address of " +- "%s.\n", dwarf_diename(sp_die)); +- param->retval = -ENOENT; +- return DWARF_CB_ABORT; +- } + pf->addr += pp->offset; + /* TODO: Check the address in this function */ + param->retval = call_probe_finder(sp_die, pf); +@@ -1514,7 +1510,7 @@ static int line_range_search_cb(Dwarf_Di + pr_debug("New line range: %d to %d\n", lf->lno_s, lf->lno_e); + lr->start = lf->lno_s; + lr->end = lf->lno_e; +- if (dwarf_func_inline(sp_die)) ++ if (!die_is_func_instance(sp_die)) + param->retval = die_walk_instances(sp_die, + line_range_inline_cb, lf); + else diff --git a/queue-3.16/perf-probe-fix-to-list-probe-event-with-correct-line-number.patch b/queue-3.16/perf-probe-fix-to-list-probe-event-with-correct-line-number.patch new file mode 100644 index 00000000..92cb9ed4 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-list-probe-event-with-correct-line-number.patch @@ -0,0 +1,70 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Fri, 25 Oct 2019 17:46:52 +0900 +Subject: perf probe: Fix to list probe event with correct line number + +commit 3895534dd78f0fd4d3f9e05ee52b9cdd444a743e upstream. + +Since debuginfo__find_probe_point() uses dwarf_entrypc() for finding the +entry address of the function on which a probe is, it will fail when the +function DIE has only ranges attribute. + +To fix this issue, use die_entrypc() instead of dwarf_entrypc(). + +Without this fix, perf probe -l shows incorrect offset: + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579263632@work/linux/linux/kernel/cpu.c) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask+18446744071579263752@work/linux/linux/kernel/cpu.c) + +With this: + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@work/linux/linux/kernel/cpu.c) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:21@work/linux/linux/kernel/cpu.c) + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask+18446744071579765152@kernel/cpu.c) + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + [root@quaco ~]# + +Fixes: 1d46ea2a6a40 ("perf probe: Fix listing incorrect line number with inline function") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157199321227.8075.14655572419136993015.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/probe-finder.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1345,7 +1345,7 @@ int debuginfo__find_probe_point(struct d + /* Get function entry information */ + func = basefunc = dwarf_diename(&spdie); + if (!func || +- dwarf_entrypc(&spdie, &baseaddr) != 0 || ++ die_entrypc(&spdie, &baseaddr) != 0 || + dwarf_decl_line(&spdie, &baseline) != 0) { + lineno = 0; + goto post; +@@ -1362,7 +1362,7 @@ int debuginfo__find_probe_point(struct d + while (die_find_top_inlinefunc(&spdie, (Dwarf_Addr)addr, + &indie)) { + /* There is an inline function */ +- if (dwarf_entrypc(&indie, &_addr) == 0 && ++ if (die_entrypc(&indie, &_addr) == 0 && + _addr == addr) { + /* + * addr is at an inline function entry. diff --git a/queue-3.16/perf-probe-fix-to-probe-a-function-which-has-no-entry-pc.patch b/queue-3.16/perf-probe-fix-to-probe-a-function-which-has-no-entry-pc.patch new file mode 100644 index 00000000..169873c4 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-probe-a-function-which-has-no-entry-pc.patch @@ -0,0 +1,88 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Fri, 25 Oct 2019 17:46:34 +0900 +Subject: perf probe: Fix to probe a function which has no entry pc + +commit 5d16dbcc311d91267ddb45c6da4f187be320ecee upstream. + +Fix 'perf probe' to probe a function which has no entry pc or low pc but +only has ranges attribute. + +probe_point_search_cb() uses dwarf_entrypc() to get the probe address, +but that doesn't work for the function DIE which has only ranges +attribute. Use die_entrypc() instead. + +Without this fix: + + # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0 + Probe point 'clear_tasks_mm_cpumask' not found. + Error: Failed to add events. + +With this: + + # perf probe -k ../build-x86_64/vmlinux -D clear_tasks_mm_cpumask:0 + p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0 + +Committer testing: + +Before: + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0 + Probe point 'clear_tasks_mm_cpumask' not found. + Error: Failed to add events. + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0 + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + [root@quaco ~]# + +Using it with 'perf trace': + + [root@quaco ~]# perf trace -e probe:clear_tasks_mm_cpumask + +Doesn't seem to be used in x86_64: + + $ find . -name "*.c" | xargs grep clear_tasks_mm_cpumask + ./kernel/cpu.c: * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU + ./kernel/cpu.c:void clear_tasks_mm_cpumask(int cpu) + ./arch/xtensa/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/csky/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/sh/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/arm/kernel/smp.c: clear_tasks_mm_cpumask(cpu); + ./arch/powerpc/mm/nohash/mmu_context.c: clear_tasks_mm_cpumask(cpu); + $ find . -name "*.h" | xargs grep clear_tasks_mm_cpumask + ./include/linux/cpu.h:void clear_tasks_mm_cpumask(int cpu); + $ find . -name "*.S" | xargs grep clear_tasks_mm_cpumask + $ + +Fixes: e1ecbbc3fa83 ("perf probe: Fix to handle optimized not-inlined functions") +Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157199319438.8075.4695576954550638618.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/probe-finder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -908,7 +908,7 @@ static int probe_point_search_cb(Dwarf_D + param->retval = find_probe_point_by_line(pf); + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ +- dwarf_entrypc(sp_die, &pf->addr); ++ die_entrypc(sp_die, &pf->addr); + /* But in some case the entry address is 0 */ + if (pf->addr == 0) { + pr_debug("%s has no entry PC. Skipped\n", diff --git a/queue-3.16/perf-probe-fix-to-probe-an-inline-function-which-has-no-entry-pc.patch b/queue-3.16/perf-probe-fix-to-probe-an-inline-function-which-has-no-entry-pc.patch new file mode 100644 index 00000000..193038d6 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-probe-an-inline-function-which-has-no-entry-pc.patch @@ -0,0 +1,64 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Fri, 25 Oct 2019 17:46:43 +0900 +Subject: perf probe: Fix to probe an inline function which has no entry pc + +commit eb6933b29d20bf2c3053883d409a53f462c1a3ac upstream. + +Fix perf probe to probe an inlne function which has no entry pc +or low pc but only has ranges attribute. + +This seems very rare case, but I could find a few examples, as +same as probe_point_search_cb(), use die_entrypc() to get the +entry address in probe_point_inline_cb() too. + +Without this patch: + + # perf probe -D __amd_put_nb_event_constraints + Failed to get entry address of __amd_put_nb_event_constraints. + Probe point '__amd_put_nb_event_constraints' not found. + Error: Failed to add events. + +With this patch: + + # perf probe -D __amd_put_nb_event_constraints + p:probe/__amd_put_nb_event_constraints amd_put_event_constraints+43 + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints + Failed to get entry address of __amd_put_nb_event_constraints. + Probe point '__amd_put_nb_event_constraints' not found. + Error: Failed to add events. + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -D __amd_put_nb_event_constraints + p:probe/__amd_put_nb_event_constraints _text+33789 + [root@quaco ~]# + +Fixes: 4ea42b181434 ("perf: Add perf probe subcommand, a kprobe-event setup helper") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157199320336.8075.16189530425277588587.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/probe-finder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -858,7 +858,7 @@ static int probe_point_inline_cb(Dwarf_D + ret = find_probe_point_lazy(in_die, pf); + else { + /* Get probe address */ +- if (dwarf_entrypc(in_die, &addr) != 0) { ++ if (die_entrypc(in_die, &addr) != 0) { + pr_warning("Failed to get entry address of %s.\n", + dwarf_diename(in_die)); + return -ENOENT; diff --git a/queue-3.16/perf-probe-fix-to-show-calling-lines-of-inlined-functions.patch b/queue-3.16/perf-probe-fix-to-show-calling-lines-of-inlined-functions.patch new file mode 100644 index 00000000..57986ff5 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-show-calling-lines-of-inlined-functions.patch @@ -0,0 +1,114 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Wed, 30 Oct 2019 16:09:40 +0900 +Subject: perf probe: Fix to show calling lines of inlined functions + +commit 86c0bf8539e7f46d91bd105e55eda96e0064caef upstream. + +Fix to show calling lines of inlined functions (where an inline function +is called). + +die_walk_lines() filtered out the lines inside inlined functions based +on the address. However this also filtered out the lines which call +those inlined functions from the target function. + +To solve this issue, check the call_file and call_line attributes and do +not filter out if it matches to the line information. + +Without this fix, perf probe -L doesn't show some lines correctly. +(don't see the lines after 17) + + # perf probe -L vfs_read + <vfs_read@/home/mhiramat/ksrc/linux/fs/read_write.c:0> + 0 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) + 1 { + 2 ssize_t ret; + + 4 if (!(file->f_mode & FMODE_READ)) + return -EBADF; + 6 if (!(file->f_mode & FMODE_CAN_READ)) + return -EINVAL; + 8 if (unlikely(!access_ok(buf, count))) + return -EFAULT; + + 11 ret = rw_verify_area(READ, file, pos, count); + 12 if (!ret) { + 13 if (count > MAX_RW_COUNT) + count = MAX_RW_COUNT; + 15 ret = __vfs_read(file, buf, count, pos); + 16 if (ret > 0) { + fsnotify_access(file); + add_rchar(current, ret); + } + +With this fix: + + # perf probe -L vfs_read + <vfs_read@/home/mhiramat/ksrc/linux/fs/read_write.c:0> + 0 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) + 1 { + 2 ssize_t ret; + + 4 if (!(file->f_mode & FMODE_READ)) + return -EBADF; + 6 if (!(file->f_mode & FMODE_CAN_READ)) + return -EINVAL; + 8 if (unlikely(!access_ok(buf, count))) + return -EFAULT; + + 11 ret = rw_verify_area(READ, file, pos, count); + 12 if (!ret) { + 13 if (count > MAX_RW_COUNT) + count = MAX_RW_COUNT; + 15 ret = __vfs_read(file, buf, count, pos); + 16 if (ret > 0) { + 17 fsnotify_access(file); + 18 add_rchar(current, ret); + } + 20 inc_syscr(current); + } + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157241937995.32002.17899884017011512577.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -714,7 +714,7 @@ int die_walk_lines(Dwarf_Die *rt_die, li + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname, *decf = NULL; ++ const char *fname, *decf = NULL, *inf = NULL; + int lineno, ret = 0; + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; +@@ -765,13 +765,21 @@ int die_walk_lines(Dwarf_Die *rt_die, li + */ + if (!dwarf_haspc(rt_die, addr)) + continue; ++ + if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ /* Call-site check */ ++ inf = die_get_call_file(&die_mem); ++ if ((inf && !strcmp(inf, decf)) && ++ die_get_call_lineno(&die_mem) == lineno) ++ goto found; ++ + dwarf_decl_line(&die_mem, &inl); + if (inl != decl || + decf != dwarf_decl_file(&die_mem)) + continue; + } + } ++found: + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + diff --git a/queue-3.16/perf-probe-fix-to-show-function-entry-line-as-probe-able.patch b/queue-3.16/perf-probe-fix-to-show-function-entry-line-as-probe-able.patch new file mode 100644 index 00000000..5ab6bc4c --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-show-function-entry-line-as-probe-able.patch @@ -0,0 +1,80 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Thu, 24 Oct 2019 18:12:54 +0900 +Subject: perf probe: Fix to show function entry line as probe-able + +commit 91e2f539eeda26ab00bd03fae8dc434c128c85ed upstream. + +Fix die_walk_lines() to list the function entry line correctly. Since +the dwarf_entrypc() does not return the entry pc if the DIE has only +range attribute, __die_walk_funclines() fails to list the declaration +line (entry line) in that case. + +To solve this issue, this introduces die_entrypc() which correctly +returns the entry PC (the first address range) even if the DIE has only +range attribute. With this fix die_walk_lines() shows the function entry +line is able to probe correctly. + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157190837419.1859.4619125803596816752.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 24 +++++++++++++++++++++++- + tools/perf/util/dwarf-aux.h | 3 +++ + 2 files changed, 26 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -278,6 +278,28 @@ bool die_is_func_def(Dwarf_Die *dw_die) + } + + /** ++ * die_entrypc - Returns entry PC (the lowest address) of a DIE ++ * @dw_die: a DIE ++ * @addr: where to store entry PC ++ * ++ * Since dwarf_entrypc() does not return entry PC if the DIE has only address ++ * range, we have to use this to retrieve the lowest address from the address ++ * range attribute. ++ */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr) ++{ ++ Dwarf_Addr base, end; ++ ++ if (!addr) ++ return -EINVAL; ++ ++ if (dwarf_entrypc(dw_die, addr) == 0) ++ return 0; ++ ++ return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0; ++} ++ ++/** + * die_is_func_instance - Ensure that this DIE is an instance of a subprogram + * @dw_die: a DIE + * +@@ -647,7 +669,7 @@ static int __die_walk_funclines(Dwarf_Di + /* Handle function declaration line */ + fname = dwarf_decl_file(sp_die); + if (fname && dwarf_decl_line(sp_die, &lineno) == 0 && +- dwarf_entrypc(sp_die, &addr) == 0) { ++ die_entrypc(sp_die, &addr) == 0) { + lw.retval = callback(fname, lineno, addr, data); + if (lw.retval != 0) + goto done; +--- a/tools/perf/util/dwarf-aux.h ++++ b/tools/perf/util/dwarf-aux.h +@@ -38,6 +38,9 @@ extern int cu_find_lineinfo(Dwarf_Die *c + extern int cu_walk_functions_at(Dwarf_Die *cu_die, Dwarf_Addr addr, + int (*callback)(Dwarf_Die *, void *), void *data); + ++/* Get the lowest PC in DIE (including range list) */ ++int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr); ++ + /* Ensure that this DIE is a subprogram and definition (not declaration) */ + extern bool die_is_func_def(Dwarf_Die *dw_die); + diff --git a/queue-3.16/perf-probe-fix-to-show-inlined-function-callsite-without-entry_pc.patch b/queue-3.16/perf-probe-fix-to-show-inlined-function-callsite-without-entry_pc.patch new file mode 100644 index 00000000..f45c5ef3 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-show-inlined-function-callsite-without-entry_pc.patch @@ -0,0 +1,104 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Fri, 25 Oct 2019 17:47:01 +0900 +Subject: perf probe: Fix to show inlined function callsite without entry_pc + +commit 18e21eb671dc87a4f0546ba505a89ea93598a634 upstream. + +Fix 'perf probe --line' option to show inlined function callsite lines +even if the function DIE has only ranges. + +Without this: + + # perf probe -L amd_put_event_constraints + ... + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + __amd_put_nb_event_constraints(cpuc, event); + 5 } + +With this patch: + + # perf probe -L amd_put_event_constraints + ... + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + 4 __amd_put_nb_event_constraints(cpuc, event); + 5 } + +Committer testing: + +Before: + + [root@quaco ~]# perf probe -L amd_put_event_constraints + <amd_put_event_constraints@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/arch/x86/events/amd/core.c:0> + 0 static void amd_put_event_constraints(struct cpu_hw_events *cpuc, + struct perf_event *event) + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + __amd_put_nb_event_constraints(cpuc, event); + 5 } + + PMU_FORMAT_ATTR(event, "config:0-7,32-35"); + PMU_FORMAT_ATTR(umask, "config:8-15" ); + + [root@quaco ~]# + +After: + + [root@quaco ~]# perf probe -L amd_put_event_constraints + <amd_put_event_constraints@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/arch/x86/events/amd/core.c:0> + 0 static void amd_put_event_constraints(struct cpu_hw_events *cpuc, + struct perf_event *event) + 2 { + 3 if (amd_has_nb(cpuc) && amd_is_nb_event(&event->hw)) + 4 __amd_put_nb_event_constraints(cpuc, event); + 5 } + + PMU_FORMAT_ATTR(event, "config:0-7,32-35"); + PMU_FORMAT_ATTR(umask, "config:8-15" ); + + [root@quaco ~]# perf probe amd_put_event_constraints:4 + Added new event: + probe:amd_put_event_constraints (on amd_put_event_constraints:4) + + You can now use it in all perf tools, such as: + + perf record -e probe:amd_put_event_constraints -aR sleep 1 + + [root@quaco ~]# + + [root@quaco ~]# perf probe -l + probe:amd_put_event_constraints (on amd_put_event_constraints:4@arch/x86/events/amd/core.c) + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + [root@quaco ~]# + +Using it: + + [root@quaco ~]# perf trace -e probe:* + ^C[root@quaco ~]# + +Ok, Intel system here... :-) + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157199322107.8075.12659099000567865708.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -628,7 +628,7 @@ static int __die_walk_funclines_cb(Dwarf + if (dwarf_tag(in_die) == DW_TAG_inlined_subroutine) { + fname = die_get_call_file(in_die); + lineno = die_get_call_lineno(in_die); +- if (fname && lineno > 0 && dwarf_entrypc(in_die, &addr) == 0) { ++ if (fname && lineno > 0 && die_entrypc(in_die, &addr) == 0) { + lw->retval = lw->callback(fname, lineno, addr, lw->data); + if (lw->retval != 0) + return DIE_FIND_CB_END; diff --git a/queue-3.16/perf-probe-fix-to-show-lines-of-sys_-functions-correctly.patch b/queue-3.16/perf-probe-fix-to-show-lines-of-sys_-functions-correctly.patch new file mode 100644 index 00000000..16c40954 --- /dev/null +++ b/queue-3.16/perf-probe-fix-to-show-lines-of-sys_-functions-correctly.patch @@ -0,0 +1,92 @@ +From: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Date: Wed, 12 Aug 2015 10:24:07 +0900 +Subject: perf probe: Fix to show lines of sys_ functions correctly + +commit 75186a9b09e47072f442f43e292cd47180b67b5c upstream. + +"perf probe --lines sys_poll" shows only the first line of sys_poll, +because the SYSCALL_DEFINE macro: + + ---- + SYSCALL_DEFINE*(foo,...) + { + body; + } + ---- + + is expanded as below (on debuginfo) + + ---- + + static inline int SYSC_foo(...) + { + body; + } + int SyS_foo(...) <- is an alias of sys_foo. + { + return SYSC_foo(...); + } + ---- + +So, "perf probe --lines sys_foo" decodes SyS_foo function and it also skips +inlined functions(SYSC_foo) inside the target function because those functions +are usually defined somewhere else. + +To fix this issue, this fix checks whether the inlined function is defined at +the same point of the target function, and if so, it doesn't skip the inline +function. + +Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org> +Signed-off-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: David Ahern <dsahern@gmail.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lkml.kernel.org/r/20150812012406.11811.94691.stgit@localhost.localdomain +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -681,15 +681,18 @@ int die_walk_lines(Dwarf_Die *rt_die, li + Dwarf_Lines *lines; + Dwarf_Line *line; + Dwarf_Addr addr; +- const char *fname; ++ const char *fname, *decf = NULL; + int lineno, ret = 0; ++ int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; + + /* Get the CU die */ +- if (dwarf_tag(rt_die) != DW_TAG_compile_unit) ++ if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { + cu_die = dwarf_diecu(rt_die, &die_mem, NULL, NULL); +- else ++ dwarf_decl_line(rt_die, &decl); ++ decf = dwarf_decl_file(rt_die); ++ } else + cu_die = rt_die; + if (!cu_die) { + pr_debug2("Failed to get CU from given DIE.\n"); +@@ -720,9 +723,14 @@ int die_walk_lines(Dwarf_Die *rt_die, li + * The line is included in given function, and + * no inline block includes it. + */ +- if (!dwarf_haspc(rt_die, addr) || +- die_find_inlinefunc(rt_die, addr, &die_mem)) ++ if (!dwarf_haspc(rt_die, addr)) + continue; ++ if (die_find_inlinefunc(rt_die, addr, &die_mem)) { ++ dwarf_decl_line(&die_mem, &inl); ++ if (inl != decl || ++ decf != dwarf_decl_file(&die_mem)) ++ continue; ++ } + /* Get source line */ + fname = dwarf_linesrc(line, NULL, NULL); + diff --git a/queue-3.16/perf-probe-fix-wrong-address-verification.patch b/queue-3.16/perf-probe-fix-wrong-address-verification.patch new file mode 100644 index 00000000..d86de998 --- /dev/null +++ b/queue-3.16/perf-probe-fix-wrong-address-verification.patch @@ -0,0 +1,112 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Fri, 25 Oct 2019 17:46:25 +0900 +Subject: perf probe: Fix wrong address verification + +commit 07d369857808b7e8e471bbbbb0074a6718f89b31 upstream. + +Since there are some DIE which has only ranges instead of the +combination of entrypc/highpc, address verification must use +dwarf_haspc() instead of dwarf_entrypc/dwarf_highpc. + +Also, the ranges only DIE will have a partial code in different section +(e.g. unlikely code will be in text.unlikely as "FUNC.cold" symbol). In +that case, we can not use dwarf_entrypc() or die_entrypc(), because the +offset from original DIE can be a minus value. + +Instead, this simply gets the symbol and offset from symtab. + +Without this patch; + + # perf probe -D clear_tasks_mm_cpumask:1 + Failed to get entry address of clear_tasks_mm_cpumask + Error: Failed to add events. + +And with this patch: + + # perf probe -D clear_tasks_mm_cpumask:1 + p:probe/clear_tasks_mm_cpumask clear_tasks_mm_cpumask+0 + p:probe/clear_tasks_mm_cpumask_1 clear_tasks_mm_cpumask+5 + p:probe/clear_tasks_mm_cpumask_2 clear_tasks_mm_cpumask+8 + p:probe/clear_tasks_mm_cpumask_3 clear_tasks_mm_cpumask+16 + p:probe/clear_tasks_mm_cpumask_4 clear_tasks_mm_cpumask+82 + +Committer testing: + +I managed to reproduce the above: + + [root@quaco ~]# perf probe -D clear_tasks_mm_cpumask:1 + p:probe/clear_tasks_mm_cpumask _text+919968 + p:probe/clear_tasks_mm_cpumask_1 _text+919973 + p:probe/clear_tasks_mm_cpumask_2 _text+919976 + [root@quaco ~]# + +But then when trying to actually put the probe in place, it fails if I +use :0 as the offset: + + [root@quaco ~]# perf probe -L clear_tasks_mm_cpumask | head -5 + <clear_tasks_mm_cpumask@/usr/src/debug/kernel-5.2.fc30/linux-5.2.18-200.fc30.x86_64/kernel/cpu.c:0> + 0 void clear_tasks_mm_cpumask(int cpu) + 1 { + 2 struct task_struct *p; + + [root@quaco ~]# perf probe clear_tasks_mm_cpumask:0 + Probe point 'clear_tasks_mm_cpumask' not found. + Error: Failed to add events. + [root@quaco + +The next patch is needed to fix this case. + +Fixes: 576b523721b7 ("perf probe: Fix probing symbols with optimization suffix") +Reported-by: Arnaldo Carvalho de Melo <acme@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157199318513.8075.10463906803299647907.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -588,34 +588,26 @@ static int convert_to_trace_point(Dwarf_ + Dwarf_Addr paddr, bool retprobe, + struct probe_trace_point *tp) + { +- Dwarf_Addr eaddr, highaddr; ++ Dwarf_Addr eaddr; + GElf_Sym sym; + const char *symbol; + + /* Verify the address is correct */ +- if (dwarf_entrypc(sp_die, &eaddr) != 0) { +- pr_warning("Failed to get entry address of %s\n", +- dwarf_diename(sp_die)); +- return -ENOENT; +- } +- if (dwarf_highpc(sp_die, &highaddr) != 0) { +- pr_warning("Failed to get end address of %s\n", +- dwarf_diename(sp_die)); +- return -ENOENT; +- } +- if (paddr > highaddr) { +- pr_warning("Offset specified is greater than size of %s\n", ++ if (!dwarf_haspc(sp_die, paddr)) { ++ pr_warning("Specified offset is out of %s\n", + dwarf_diename(sp_die)); + return -EINVAL; + } + +- /* Get an appropriate symbol from symtab */ ++ /* Try to get actual symbol name from symtab */ + symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL); + if (!symbol) { + pr_warning("Failed to find symbol at 0x%lx\n", + (unsigned long)paddr); + return -ENOENT; + } ++ eaddr = sym.st_value; ++ + tp->offset = (unsigned long)(paddr - sym.st_value); + tp->address = (unsigned long)paddr; + tp->symbol = strdup(symbol); diff --git a/queue-3.16/perf-probe-skip-end-of-sequence-and-non-statement-lines.patch b/queue-3.16/perf-probe-skip-end-of-sequence-and-non-statement-lines.patch new file mode 100644 index 00000000..7abe7f7f --- /dev/null +++ b/queue-3.16/perf-probe-skip-end-of-sequence-and-non-statement-lines.patch @@ -0,0 +1,137 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Wed, 30 Oct 2019 16:09:21 +0900 +Subject: perf probe: Skip end-of-sequence and non statement lines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit f4d99bdfd124823a81878b44b5e8750b97f73902 upstream. + +Skip end-of-sequence and non-statement lines while walking through lines +list. + +The "end-of-sequence" line information means: + + "the current address is that of the first byte after the + end of a sequence of target machine instructions." + (DWARF version 4 spec 6.2.2) + +This actually means out of scope and we can not probe on it. + +On the other hand, the statement lines (is_stmt) means: + + "the current instruction is a recommended breakpoint location. + A recommended breakpoint location is intended to “represent” + a line, a statement and/or a semantically distinct subpart + of a statement." + + (DWARF version 4 spec 6.2.2) + +So, non-statement line info also should be skipped. + +These can reduce unneeded probe points and also avoid an error. + +E.g. without this patch: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new events: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_3 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_4 (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask_4 -aR sleep 1 + + # + +This puts 5 probes on one line, but acutally it's not inlined function. +This is because there are many non statement instructions at the +function prologue. + +With this patch: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + # + +Now perf-probe skips unneeded addresses. + +Committer testing: + +Slightly different results, but similar: + +Before: + + # uname -a + Linux quaco 5.3.8-200.fc30.x86_64 #1 SMP Tue Oct 29 14:46:22 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux + # + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new events: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_1 (on clear_tasks_mm_cpumask:1) + probe:clear_tasks_mm_cpumask_2 (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask_2 -aR sleep 1 + + # + +After: + + # perf probe -a "clear_tasks_mm_cpumask:1" + Added new event: + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask:1) + + You can now use it in all perf tools, such as: + + perf record -e probe:clear_tasks_mm_cpumask -aR sleep 1 + + # perf probe -l + probe:clear_tasks_mm_cpumask (on clear_tasks_mm_cpumask@kernel/cpu.c) + # + +Fixes: 4cc9cec636e7 ("perf probe: Introduce lines walker interface") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157241936090.32002.12156347518596111660.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/dwarf-aux.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/tools/perf/util/dwarf-aux.c ++++ b/tools/perf/util/dwarf-aux.c +@@ -712,6 +712,7 @@ int die_walk_lines(Dwarf_Die *rt_die, li + int decl = 0, inl; + Dwarf_Die die_mem, *cu_die; + size_t nlines, i; ++ bool flag; + + /* Get the CU die */ + if (dwarf_tag(rt_die) != DW_TAG_compile_unit) { +@@ -742,6 +743,12 @@ int die_walk_lines(Dwarf_Die *rt_die, li + "Possible error in debuginfo.\n"); + continue; + } ++ /* Skip end-of-sequence */ ++ if (dwarf_lineendsequence(line, &flag) != 0 || flag) ++ continue; ++ /* Skip Non statement line-info */ ++ if (dwarf_linebeginstatement(line, &flag) != 0 || !flag) ++ continue; + /* Filter lines based on address */ + if (rt_die != cu_die) { + /* diff --git a/queue-3.16/perf-probe-skip-if-the-function-address-is-0.patch b/queue-3.16/perf-probe-skip-if-the-function-address-is-0.patch new file mode 100644 index 00000000..a078265e --- /dev/null +++ b/queue-3.16/perf-probe-skip-if-the-function-address-is-0.patch @@ -0,0 +1,101 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Sat, 24 Sep 2016 00:35:07 +0900 +Subject: perf probe: Skip if the function address is 0 + +commit 0ad45b33c58dca60dec7e1fb44766753bc4a7a38 upstream. + +Skip probes if the entry address of the target function is 0. This can +happen when we're handling C++ debuginfo files. + +E.g. without this fix, below case still fail. + ---- + $ ./perf probe -x /usr/lib64/libstdc++.so.6 -vD is_open + probe-definition(0): is_open + symbol:is_open file:(null) line:0 offset:0 return:0 lazy:(null) + 0 arguments + symbol:catch file:(null) line:0 offset:0 return:0 lazy:(null) + symbol:throw file:(null) line:0 offset:0 return:0 lazy:(null) + symbol:rethrow file:(null) line:0 offset:0 return:0 lazy:(null) + Open Debuginfo file: /usr/lib/debug/usr/lib64/libstdc++.so.6.0.22.debug + Try to find probe point from debuginfo. + Matched function: is_open [295df] + found inline addr: 0x8ca80 + Probe point found: is_open+0 + found inline addr: 0x8ca70 + Probe point found: is_open+0 + found inline addr: 0x8ca60 + Probe point found: is_open+0 + Matched function: is_open [6527f] + Matched function: is_open [9fe8a] + Probe point found: is_open+0 + Matched function: is_open [19710b] + found inline addr: 0xecca9 + Probe point found: stdio_filebuf+57 + found inline addr: 0x0 + Probe point found: swap+0 + Matched function: is_open [19fc9d] + Probe point found: is_open+0 + Found 7 probe_trace_events. + p:probe_libstdc++/is_open /usr/lib64/libstdc++.so.6.0.22:0x8ca80 + p:probe_libstdc++/is_open_1 /usr/lib64/libstdc++.so.6.0.22:0x8ca70 + p:probe_libstdc++/is_open_2 /usr/lib64/libstdc++.so.6.0.22:0x8ca60 + p:probe_libstdc++/is_open_3 /usr/lib64/libstdc++.so.6.0.22:0xb0ad0 + p:probe_libstdc++/is_open_4 /usr/lib64/libstdc++.so.6.0.22:0xecca9 + Failed to synthesize probe trace event. + Error: Failed to add events. Reason: Invalid argument (Code: -22) + ---- +This is because some instances have entry_pc == 0 (see 19710b and +19fc9d). With this fix, those are skipped. + + ---- + $ ./perf probe -x /usr/lib64/libstdc++.so.6 -D is_open + p:probe_libstdc++/is_open /usr/lib64/libstdc++.so.6.0.22:0x8ca80 + p:probe_libstdc++/is_open_1 /usr/lib64/libstdc++.so.6.0.22:0x8ca70 + p:probe_libstdc++/is_open_2 /usr/lib64/libstdc++.so.6.0.22:0x8ca60 + p:probe_libstdc++/is_open_3 /usr/lib64/libstdc++.so.6.0.22:0xb0ad0 + p:probe_libstdc++/is_open_4 /usr/lib64/libstdc++.so.6.0.22:0xecca9 + ---- + +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Tested-by: Jiri Olsa <jolsa@kernel.org> +Cc: David Ahern <dsahern@gmail.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Thomas Gleixner <tglx@linutronix.de> +Link: http://lkml.kernel.org/r/147464490707.29804.14277897643725143867.stgit@devbox +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/probe-finder.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -871,6 +871,11 @@ static int probe_point_inline_cb(Dwarf_D + dwarf_diename(in_die)); + return -ENOENT; + } ++ if (addr == 0) { ++ pr_debug("%s has no valid entry address. skipped.\n", ++ dwarf_diename(in_die)); ++ return -ENOENT; ++ } + pf->addr = addr; + pf->addr += pp->offset; + pr_debug("found inline addr: 0x%jx\n", +@@ -912,8 +917,13 @@ static int probe_point_search_cb(Dwarf_D + } else if (die_is_func_instance(sp_die)) { + /* Instances always have the entry address */ + dwarf_entrypc(sp_die, &pf->addr); ++ /* But in some case the entry address is 0 */ ++ if (pf->addr == 0) { ++ pr_debug("%s has no entry PC. Skipped\n", ++ dwarf_diename(sp_die)); ++ param->retval = 0; + /* Real function */ +- if (pp->lazy_line) ++ } else if (pp->lazy_line) + param->retval = find_probe_point_lazy(sp_die, pf); + else { + pf->addr += pp->offset; diff --git a/queue-3.16/perf-probe-skip-overlapped-location-on-searching-variables.patch b/queue-3.16/perf-probe-skip-overlapped-location-on-searching-variables.patch new file mode 100644 index 00000000..0454cf50 --- /dev/null +++ b/queue-3.16/perf-probe-skip-overlapped-location-on-searching-variables.patch @@ -0,0 +1,96 @@ +From: Masami Hiramatsu <mhiramat@kernel.org> +Date: Wed, 30 Oct 2019 16:09:49 +0900 +Subject: perf probe: Skip overlapped location on searching variables + +commit dee36a2abb67c175265d49b9a8c7dfa564463d9a upstream. + +Since debuginfo__find_probes() callback function can be called with the +location which already passed, the callback function must filter out +such overlapped locations. + +add_probe_trace_event() has already done it by commit 1a375ae7659a +("perf probe: Skip same probe address for a given line"), but +add_available_vars() doesn't. Thus perf probe -v shows same address +repeatedly as below: + + # perf probe -V vfs_read:18 + Available variables at vfs_read:18 + @<vfs_read+217> + char* buf + loff_t* pos + ssize_t ret + struct file* file + @<vfs_read+217> + char* buf + loff_t* pos + ssize_t ret + struct file* file + @<vfs_read+226> + char* buf + loff_t* pos + ssize_t ret + struct file* file + +With this fix, perf probe -V shows it correctly: + + # perf probe -V vfs_read:18 + Available variables at vfs_read:18 + @<vfs_read+217> + char* buf + loff_t* pos + ssize_t ret + struct file* file + @<vfs_read+226> + char* buf + loff_t* pos + ssize_t ret + struct file* file + +Fixes: cf6eb489e5c0 ("perf probe: Show accessible local variables") +Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> +Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Cc: Jiri Olsa <jolsa@redhat.com> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: http://lore.kernel.org/lkml/157241938927.32002.4026859017790562751.stgit@devnote2 +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/probe-finder.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1230,6 +1230,18 @@ static int collect_variables_cb(Dwarf_Di + return DIE_FIND_CB_SIBLING; + } + ++static bool available_var_finder_overlap(struct available_var_finder *af) ++{ ++ int i; ++ ++ for (i = 0; i < af->nvls; i++) { ++ if (af->pf.addr == af->vls[i].point.address) ++ return true; ++ } ++ return false; ++ ++} ++ + /* Add a found vars into available variables list */ + static int add_available_vars(Dwarf_Die *sc_die, struct probe_finder *pf) + { +@@ -1239,6 +1251,14 @@ static int add_available_vars(Dwarf_Die + Dwarf_Die die_mem; + int ret; + ++ /* ++ * For some reason (e.g. different column assigned to same address), ++ * this callback can be called with the address which already passed. ++ * Ignore it first. ++ */ ++ if (available_var_finder_overlap(af)) ++ return 0; ++ + /* Check number of tevs */ + if (af->nvls == af->max_vls) { + pr_warning("Too many( > %d) probe point found.\n", af->max_vls); diff --git a/queue-3.16/perf-regs-make-perf_reg_name-return-unknown-instead-of-null.patch b/queue-3.16/perf-regs-make-perf_reg_name-return-unknown-instead-of-null.patch new file mode 100644 index 00000000..6ea864e4 --- /dev/null +++ b/queue-3.16/perf-regs-make-perf_reg_name-return-unknown-instead-of-null.patch @@ -0,0 +1,78 @@ +From: Arnaldo Carvalho de Melo <acme@redhat.com> +Date: Wed, 27 Nov 2019 10:13:34 -0300 +Subject: perf regs: Make perf_reg_name() return "unknown" instead of NULL + +commit 5b596e0ff0e1852197d4c82d3314db5e43126bf7 upstream. + +To avoid breaking the build on arches where this is not wired up, at +least all the other features should be made available and when using +this specific routine, the "unknown" should point the user/developer to +the need to wire this up on this particular hardware architecture. + +Detected in a container mipsel debian cross build environment, where it +shows up as: + + In file included from /usr/mipsel-linux-gnu/include/stdio.h:867, + from /git/linux/tools/perf/lib/include/perf/cpumap.h:6, + from util/session.c:13: + In function 'printf', + inlined from 'regs_dump__printf' at util/session.c:1103:3, + inlined from 'regs__printf' at util/session.c:1131:2: + /usr/mipsel-linux-gnu/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] + 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +cross compiler details: + + mipsel-linux-gnu-gcc (Debian 9.2.1-8) 9.2.1 20190909 + +Also on mips64: + + In file included from /usr/mips64-linux-gnuabi64/include/stdio.h:867, + from /git/linux/tools/perf/lib/include/perf/cpumap.h:6, + from util/session.c:13: + In function 'printf', + inlined from 'regs_dump__printf' at util/session.c:1103:3, + inlined from 'regs__printf' at util/session.c:1131:2, + inlined from 'regs_user__printf' at util/session.c:1139:3, + inlined from 'dump_sample' at util/session.c:1246:3, + inlined from 'machines__deliver_event' at util/session.c:1421:3: + /usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] + 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + In function 'printf', + inlined from 'regs_dump__printf' at util/session.c:1103:3, + inlined from 'regs__printf' at util/session.c:1131:2, + inlined from 'regs_intr__printf' at util/session.c:1147:3, + inlined from 'dump_sample' at util/session.c:1249:3, + inlined from 'machines__deliver_event' at util/session.c:1421:3: + /usr/mips64-linux-gnuabi64/include/bits/stdio2.h:107:10: error: '%-5s' directive argument is null [-Werror=format-overflow=] + 107 | return __printf_chk (__USE_FORTIFY_LEVEL - 1, __fmt, __va_arg_pack ()); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +cross compiler details: + + mips64-linux-gnuabi64-gcc (Debian 9.2.1-8) 9.2.1 20190909 + +Fixes: 2bcd355b71da ("perf tools: Add interface to arch registers sets") +Cc: Adrian Hunter <adrian.hunter@intel.com> +Cc: Jiri Olsa <jolsa@kernel.org> +Cc: Namhyung Kim <namhyung@kernel.org> +Link: https://lkml.kernel.org/n/tip-95wjyv4o65nuaeweq31t7l1s@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/perf/util/perf_regs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/perf_regs.h ++++ b/tools/perf/util/perf_regs.h +@@ -16,7 +16,7 @@ int perf_reg_value(u64 *valp, struct reg + + static inline const char *perf_reg_name(int id __maybe_unused) + { +- return NULL; ++ return "unknown"; + } + + static inline int perf_reg_value(u64 *valp __maybe_unused, diff --git a/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup.patch b/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup.patch new file mode 100644 index 00000000..8c3891d9 --- /dev/null +++ b/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup.patch @@ -0,0 +1,50 @@ +From: Krzysztof Kozlowski <krzk@kernel.org> +Date: Mon, 5 Aug 2019 18:27:08 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup + controller init + +commit 6fbbcb050802d6ea109f387e961b1dbcc3a80c96 upstream. + +In s3c24xx_eint_init() the for_each_child_of_node() loop is used with a +break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Fixes: af99a7507469 ("pinctrl: Add pinctrl-s3c24xx driver") +Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> +[bwh: Backported to 3.16: adjust filename, context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/pinctrl/pinctrl-s3c24xx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-s3c24xx.c ++++ b/drivers/pinctrl/pinctrl-s3c24xx.c +@@ -497,8 +497,10 @@ static int s3c24xx_eint_init(struct sams + return -ENODEV; + + eint_data = devm_kzalloc(dev, sizeof(*eint_data), GFP_KERNEL); +- if (!eint_data) ++ if (!eint_data) { ++ of_node_put(eint_np); + return -ENOMEM; ++ } + + eint_data->drvdata = d; + +@@ -510,6 +512,7 @@ static int s3c24xx_eint_init(struct sams + irq = irq_of_parse_and_map(eint_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint_np); + return -ENXIO; + } + +@@ -517,6 +520,7 @@ static int s3c24xx_eint_init(struct sams + irq_set_chained_handler(irq, handlers[i]); + irq_set_handler_data(irq, eint_data); + } ++ of_node_put(eint_np); + + bank = d->ctrl->pin_banks; + for (i = 0; i < d->ctrl->nr_banks; ++i, ++bank) { diff --git a/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup.patch b/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup.patch new file mode 100644 index 00000000..863603ef --- /dev/null +++ b/queue-3.16/pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup.patch @@ -0,0 +1,42 @@ +From: Krzysztof Kozlowski <krzk@kernel.org> +Date: Mon, 5 Aug 2019 18:27:09 +0200 +Subject: pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup + controller init + +commit 7f028caadf6c37580d0f59c6c094ed09afc04062 upstream. + +In s3c64xx_eint_eint0_init() the for_each_child_of_node() loop is used +with a break to find a matching child node. Although each iteration of +for_each_child_of_node puts the previous node, but early exit from loop +misses it. This leads to leak of device node. + +Fixes: 61dd72613177 ("pinctrl: Add pinctrl-s3c64xx driver") +Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> +[bwh: Backported to 3.16: adjust filename, context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/pinctrl/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/pinctrl-s3c64xx.c +@@ -718,6 +718,7 @@ static int s3c64xx_eint_eint0_init(struc + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) { + dev_err(dev, "could not allocate memory for wkup eint data\n"); ++ of_node_put(eint0_np); + return -ENOMEM; + } + data->drvdata = d; +@@ -728,12 +729,14 @@ static int s3c64xx_eint_eint0_init(struc + irq = irq_of_parse_and_map(eint0_np, i); + if (!irq) { + dev_err(dev, "failed to get wakeup EINT IRQ %d\n", i); ++ of_node_put(eint0_np); + return -ENXIO; + } + + irq_set_chained_handler(irq, s3c64xx_eint0_handlers[i]); + irq_set_handler_data(irq, data); + } ++ of_node_put(eint0_np); + + bank = d->ctrl->pin_banks; + for (i = 0; i < d->ctrl->nr_banks; ++i, ++bank) { diff --git a/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input.patch b/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input.patch new file mode 100644 index 00000000..502513ec --- /dev/null +++ b/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input.patch @@ -0,0 +1,60 @@ +From: Hans de Goede <hdegoede@redhat.com> +Date: Fri, 22 Nov 2019 19:56:41 +0100 +Subject: platform/x86: hp-wmi: Fix ACPI errors caused by passing 0 as input + size + +commit f3e4f3fc8ee9729c4b1b27a478c68b713df53c0c upstream. + +The AML code implementing the WMI methods creates a variable length +field to hold the input data we pass like this: + + CreateDWordField (Arg1, 0x0C, DSZI) + Local5 = DSZI /* \HWMC.DSZI */ + CreateField (Arg1, 0x80, (Local5 * 0x08), DAIN) + +If we pass 0 as bios_args.datasize argument then (Local5 * 0x08) +is 0 which results in these errors: + +[ 71.973305] ACPI BIOS Error (bug): Attempt to CreateField of length zero (20190816/dsopcode-133) +[ 71.973332] ACPI Error: Aborting method \HWMC due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) +[ 71.973413] ACPI Error: Aborting method \_SB.WMID.WMAA due to previous error (AE_AML_OPERAND_VALUE) (20190816/psparse-529) + +And in our HPWMI_WIRELESS2_QUERY calls always failing. for read commands +like HPWMI_WIRELESS2_QUERY the DSZI value is not used / checked, except for +read commands where extra input is needed to specify exactly what to read. + +So for HPWMI_WIRELESS2_QUERY we can safely pass the size of the expected +output as insize to hp_wmi_perform_query(), as we are already doing for all +other HPWMI_READ commands we send. Doing so fixes these errors. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/platform/x86/hp-wmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -400,7 +400,7 @@ static int hp_wmi_rfkill2_refresh(void) + struct bios_rfkill2_state state; + + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, 0, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err; + +@@ -825,7 +825,7 @@ static int __init hp_wmi_rfkill2_setup(s + int err, i; + struct bios_rfkill2_state state; + err = hp_wmi_perform_query(HPWMI_WIRELESS2_QUERY, 0, &state, +- 0, sizeof(state)); ++ sizeof(state), sizeof(state)); + if (err) + return err; + diff --git a/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch b/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch new file mode 100644 index 00000000..547c2f93 --- /dev/null +++ b/queue-3.16/platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch @@ -0,0 +1,65 @@ +From: Hans de Goede <hdegoede@redhat.com> +Date: Fri, 22 Nov 2019 19:56:40 +0100 +Subject: platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer + +commit 16245db1489cd9aa579506f64afeeeb13d825a93 upstream. + +The HP WMI calls may take up to 128 bytes of data as input, and +the AML methods implementing the WMI calls, declare a couple of fields for +accessing input in different sizes, specifycally the HWMC method contains: + + CreateField (Arg1, 0x80, 0x0400, D128) + +Even though we do not use any of the WMI command-types which need a buffer +of this size, the APCI interpreter still tries to create it as it is +declared in generoc code at the top of the HWMC method which runs before +the code looks at which command-type is requested. + +This results in many of these errors on many different HP laptop models: + +[ 14.459261] ACPI Error: Field [D128] at 1152 exceeds Buffer [NULL] size 160 (bits) (20170303/dsopcode-236) +[ 14.459268] ACPI Error: Method parse/execution failed [\HWMC] (Node ffff8edcc61507f8), AE_AML_BUFFER_LIMIT (20170303/psparse-543) +[ 14.459279] ACPI Error: Method parse/execution failed [\_SB.WMID.WMAA] (Node ffff8edcc61523c0), AE_AML_BUFFER_LIMIT (20170303/psparse-543) + +This commit increases the size of the data element of the bios_args struct +to 128 bytes fixing these errors. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197007 +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=201981 +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1520703 +Signed-off-by: Hans de Goede <hdegoede@redhat.com> +Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/platform/x86/hp-wmi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/hp-wmi.c ++++ b/drivers/platform/x86/hp-wmi.c +@@ -90,7 +90,7 @@ struct bios_args { + u32 command; + u32 commandtype; + u32 datasize; +- u32 data; ++ u8 data[128]; + }; + + struct bios_return { +@@ -199,7 +199,7 @@ static int hp_wmi_perform_query(int quer + .command = write ? 0x2 : 0x1, + .commandtype = query, + .datasize = insize, +- .data = 0, ++ .data = { 0 }, + }; + struct acpi_buffer input = { sizeof(struct bios_args), &args }; + struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL }; +@@ -207,7 +207,7 @@ static int hp_wmi_perform_query(int quer + + if (WARN_ON(insize > sizeof(args.data))) + return -EINVAL; +- memcpy(&args.data, buffer, insize); ++ memcpy(&args.data[0], buffer, insize); + + wmi_evaluate_method(HPWMI_BIOS_GUID, 0, 0x3, &input, &output); + diff --git a/queue-3.16/pm-devfreq-lock-devfreq-in-trans_stat_show.patch b/queue-3.16/pm-devfreq-lock-devfreq-in-trans_stat_show.patch new file mode 100644 index 00000000..3b9b7615 --- /dev/null +++ b/queue-3.16/pm-devfreq-lock-devfreq-in-trans_stat_show.patch @@ -0,0 +1,46 @@ +From: Leonard Crestez <leonard.crestez@nxp.com> +Date: Tue, 24 Sep 2019 10:52:23 +0300 +Subject: PM / devfreq: Lock devfreq in trans_stat_show + +commit 2abb0d5268ae7b5ddf82099b1f8d5aa8414637d4 upstream. + +There is no locking in this sysfs show function so stats printing can +race with a devfreq_update_status called as part of freq switching or +with initialization. + +Also add an assert in devfreq_update_status to make it clear that lock +must be held by caller. + +Fixes: 39688ce6facd ("PM / devfreq: account suspend/resume for stats") +Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com> +Reviewed-by: Matthias Kaehlcke <mka@chromium.org> +Reviewed-by: Chanwoo Choi <cw00.choi@samsung.com> +Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -95,6 +95,7 @@ static int devfreq_update_status(struct + int lev, prev_lev, ret = 0; + unsigned long cur_time; + ++ lockdep_assert_held(&devfreq->lock); + cur_time = jiffies; + + prev_lev = devfreq_get_freq_level(devfreq, devfreq->previous_freq); +@@ -1054,9 +1055,13 @@ static ssize_t trans_stat_show(struct de + int i, j; + unsigned int max_state = devfreq->profile->max_state; + ++ mutex_lock(&devfreq->lock); + if (!devfreq->stop_polling && +- devfreq_update_status(devfreq, devfreq->previous_freq)) ++ devfreq_update_status(devfreq, devfreq->previous_freq)) { ++ mutex_unlock(&devfreq->lock); + return 0; ++ } ++ mutex_unlock(&devfreq->lock); + + len = sprintf(buf, " From : To\n"); + len += sprintf(buf + len, " :"); diff --git a/queue-3.16/powerpc-allow-64bit-vdso-__kernel_sync_dicache-to-work-across-ranges.patch b/queue-3.16/powerpc-allow-64bit-vdso-__kernel_sync_dicache-to-work-across-ranges.patch new file mode 100644 index 00000000..4f6408f8 --- /dev/null +++ b/queue-3.16/powerpc-allow-64bit-vdso-__kernel_sync_dicache-to-work-across-ranges.patch @@ -0,0 +1,42 @@ +From: Alastair D'Silva <alastair@d-silva.org> +Date: Mon, 4 Nov 2019 13:32:54 +1100 +Subject: powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges + >4GB + +commit f9ec11165301982585e5e5f606739b5bae5331f3 upstream. + +When calling __kernel_sync_dicache with a size >4GB, we were masking +off the upper 32 bits, so we would incorrectly flush a range smaller +than intended. + +This patch replaces the 32 bit shifts with 64 bit ones, so that +the full size is accounted for. + +Signed-off-by: Alastair D'Silva <alastair@d-silva.org> +Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> +Link: https://lore.kernel.org/r/20191104023305.9581-3-alastair@au1.ibm.com +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/powerpc/kernel/vdso64/cacheflush.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kernel/vdso64/cacheflush.S ++++ b/arch/powerpc/kernel/vdso64/cacheflush.S +@@ -39,7 +39,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,CFG_DCACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 +@@ -56,7 +56,7 @@ V_FUNCTION_BEGIN(__kernel_sync_dicache) + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,CFG_ICACHE_LOGBLOCKSZ(r10) +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + crclr cr0*4+so + beqlr /* nothing to do? */ + mtctr r8 diff --git a/queue-3.16/powerpc-allow-flush_icache_range-to-work-across-ranges-4gb.patch b/queue-3.16/powerpc-allow-flush_icache_range-to-work-across-ranges-4gb.patch new file mode 100644 index 00000000..bbf0c6b4 --- /dev/null +++ b/queue-3.16/powerpc-allow-flush_icache_range-to-work-across-ranges-4gb.patch @@ -0,0 +1,42 @@ +From: Alastair D'Silva <alastair@d-silva.org> +Date: Mon, 4 Nov 2019 13:32:53 +1100 +Subject: powerpc: Allow flush_icache_range to work across ranges >4GB + +commit 29430fae82073d39b1b881a3cd507416a56a363f upstream. + +When calling flush_icache_range with a size >4GB, we were masking +off the upper 32 bits, so we would incorrectly flush a range smaller +than intended. + +This patch replaces the 32 bit shifts with 64 bit ones, so that +the full size is accounted for. + +Signed-off-by: Alastair D'Silva <alastair@d-silva.org> +Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> +Link: https://lore.kernel.org/r/20191104023305.9581-2-alastair@au1.ibm.com +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/powerpc/kernel/misc_64.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kernel/misc_64.S ++++ b/arch/powerpc/kernel/misc_64.S +@@ -84,7 +84,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_I + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 /* ensure we get enough */ + lwz r9,DCACHEL1LOGLINESIZE(r10) /* Get log-2 of cache line size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 1: dcbst 0,r6 +@@ -100,7 +100,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_I + subf r8,r6,r4 /* compute length */ + add r8,r8,r5 + lwz r9,ICACHEL1LOGLINESIZE(r10) /* Get log-2 of Icache line size */ +- srw. r8,r8,r9 /* compute line count */ ++ srd. r8,r8,r9 /* compute line count */ + beqlr /* nothing to do? */ + mtctr r8 + 2: icbi 0,r6 diff --git a/queue-3.16/powerpc-fix-vdso-clock_getres.patch b/queue-3.16/powerpc-fix-vdso-clock_getres.patch new file mode 100644 index 00000000..c42e6d30 --- /dev/null +++ b/queue-3.16/powerpc-fix-vdso-clock_getres.patch @@ -0,0 +1,124 @@ +From: Vincenzo Frascino <vincenzo.frascino@arm.com> +Date: Mon, 2 Dec 2019 07:57:29 +0000 +Subject: powerpc: Fix vDSO clock_getres() + +commit 552263456215ada7ee8700ce022d12b0cffe4802 upstream. + +clock_getres in the vDSO library has to preserve the same behaviour +of posix_get_hrtimer_res(). + +In particular, posix_get_hrtimer_res() does: + sec = 0; + ns = hrtimer_resolution; +and hrtimer_resolution depends on the enablement of the high +resolution timers that can happen either at compile or at run time. + +Fix the powerpc vdso implementation of clock_getres keeping a copy of +hrtimer_resolution in vdso data and using that directly. + +Fixes: a7f290dad32e ("[PATCH] powerpc: Merge vdso's and add vdso support to 32 bits kernel") +Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> +Reviewed-by: Christophe Leroy <christophe.leroy@c-s.fr> +Acked-by: Shuah Khan <skhan@linuxfoundation.org> +[chleroy: changed CLOCK_REALTIME_RES to CLOCK_HRTIMER_RES] +Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr> +Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> +Link: https://lore.kernel.org/r/a55eca3a5e85233838c2349783bcb5164dae1d09.1575273217.git.christophe.leroy@c-s.fr +[bwh: Backported to 3.16: + - In asm-offsets.c, use DEFINE() instead of OFFSET() + - Adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/powerpc/include/asm/vdso_datapage.h | 2 ++ + arch/powerpc/kernel/asm-offsets.c | 2 +- + arch/powerpc/kernel/time.c | 1 + + arch/powerpc/kernel/vdso32/gettimeofday.S | 7 +++++-- + arch/powerpc/kernel/vdso64/gettimeofday.S | 7 +++++-- + 5 files changed, 14 insertions(+), 5 deletions(-) + +--- a/arch/powerpc/include/asm/vdso_datapage.h ++++ b/arch/powerpc/include/asm/vdso_datapage.h +@@ -86,6 +86,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; /* Wall to monotonic clock nsec */ + __s64 wtom_clock_sec; /* Wall to monotonic clock sec */ + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_64[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + }; +@@ -107,6 +108,7 @@ struct vdso_data { + __s32 wtom_clock_nsec; + struct timespec stamp_xtime; /* xtime as at tb_orig_stamp */ + __u32 stamp_sec_fraction; /* fractional seconds of stamp_xtime */ ++ __u32 hrtimer_res; /* hrtimer resolution */ + __u32 syscall_map_32[SYSCALL_MAP_SIZE]; /* map of syscalls */ + __u32 dcache_block_size; /* L1 d-cache block size */ + __u32 icache_block_size; /* L1 i-cache block size */ +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -397,6 +397,7 @@ int main(void) + DEFINE(WTOM_CLOCK_NSEC, offsetof(struct vdso_data, wtom_clock_nsec)); + DEFINE(STAMP_XTIME, offsetof(struct vdso_data, stamp_xtime)); + DEFINE(STAMP_SEC_FRAC, offsetof(struct vdso_data, stamp_sec_fraction)); ++ DEFINE(CLOCK_HRTIMER_RES, offsetof(struct vdso_data, hrtimer_res)); + DEFINE(CFG_ICACHE_BLOCKSZ, offsetof(struct vdso_data, icache_block_size)); + DEFINE(CFG_DCACHE_BLOCKSZ, offsetof(struct vdso_data, dcache_block_size)); + DEFINE(CFG_ICACHE_LOGBLOCKSZ, offsetof(struct vdso_data, icache_log_block_size)); +@@ -425,7 +426,6 @@ int main(void) + DEFINE(CLOCK_REALTIME, CLOCK_REALTIME); + DEFINE(CLOCK_MONOTONIC, CLOCK_MONOTONIC); + DEFINE(NSEC_PER_SEC, NSEC_PER_SEC); +- DEFINE(CLOCK_REALTIME_RES, MONOTONIC_RES_NSEC); + + #ifdef CONFIG_BUG + DEFINE(BUG_ENTRY_SIZE, sizeof(struct bug_entry)); +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -781,6 +781,7 @@ void update_vsyscall_old(struct timespec + vdso_data->wtom_clock_nsec = wtm->tv_nsec; + vdso_data->stamp_xtime = *wall_time; + vdso_data->stamp_sec_fraction = frac_sec; ++ vdso_data->hrtimer_res = hrtimer_resolution; + smp_wmb(); + ++(vdso_data->tb_update_count); + } +--- a/arch/powerpc/kernel/vdso32/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso32/gettimeofday.S +@@ -159,12 +159,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl __get_datapage@local /* get data page */ ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpli cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + stw r3,TSPC32_TV_SEC(r4) + stw r5,TSPC32_TV_NSEC(r4) + blr +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -144,12 +144,15 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + cror cr0*4+eq,cr0*4+eq,cr1*4+eq + bne cr0,99f + ++ mflr r12 ++ .cfi_register lr,r12 ++ bl V_LOCAL_FUNC(__get_datapage) ++ lwz r5, CLOCK_HRTIMER_RES(r3) ++ mtlr r12 + li r3,0 + cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr +- lis r5,CLOCK_REALTIME_RES@h +- ori r5,r5,CLOCK_REALTIME_RES@l + std r3,TSPC64_TV_SEC(r4) + std r5,TSPC64_TV_NSEC(r4) + blr diff --git a/queue-3.16/quota-check-that-quota-is-not-dirty-before-release.patch b/queue-3.16/quota-check-that-quota-is-not-dirty-before-release.patch new file mode 100644 index 00000000..c0d970cb --- /dev/null +++ b/queue-3.16/quota-check-that-quota-is-not-dirty-before-release.patch @@ -0,0 +1,80 @@ +From: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> +Date: Thu, 31 Oct 2019 10:39:20 +0000 +Subject: quota: Check that quota is not dirty before release + +commit df4bb5d128e2c44848aeb36b7ceceba3ac85080d upstream. + +There is a race window where quota was redirted once we drop dq_list_lock inside dqput(), +but before we grab dquot->dq_lock inside dquot_release() + +TASK1 TASK2 (chowner) +->dqput() + we_slept: + spin_lock(&dq_list_lock) + if (dquot_dirty(dquot)) { + spin_unlock(&dq_list_lock); + dquot->dq_sb->dq_op->write_dquot(dquot); + goto we_slept + if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { + spin_unlock(&dq_list_lock); + dquot->dq_sb->dq_op->release_dquot(dquot); + dqget() + mark_dquot_dirty() + dqput() + goto we_slept; + } +So dquot dirty quota will be released by TASK1, but on next we_sleept loop +we detect this and call ->write_dquot() for it. +XFSTEST: https://github.com/dmonakhov/xfstests/commit/440a80d4cbb39e9234df4d7240aee1d551c36107 + +Link: https://lore.kernel.org/r/20191031103920.3919-2-dmonakhov@openvz.org +Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/ocfs2/quota_global.c | 2 +- + fs/quota/dquot.c | 2 +- + include/linux/quotaops.h | 10 ++++++++++ + 3 files changed, 12 insertions(+), 2 deletions(-) + +--- a/fs/ocfs2/quota_global.c ++++ b/fs/ocfs2/quota_global.c +@@ -714,7 +714,7 @@ static int ocfs2_release_dquot(struct dq + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out; + /* Running from downconvert thread? Postpone quota processing to wq */ + if (current == osb->dc_task) { +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -475,7 +475,7 @@ int dquot_release(struct dquot *dquot) + + mutex_lock(&dquot->dq_lock); + /* Check whether we are not racing with some other dqget() */ +- if (atomic_read(&dquot->dq_count) > 1) ++ if (dquot_is_busy(dquot)) + goto out_dqlock; + mutex_lock(&dqopt->dqio_mutex); + if (dqopt->ops[dquot->dq_id.type]->release_dqblk) { +--- a/include/linux/quotaops.h ++++ b/include/linux/quotaops.h +@@ -54,6 +54,16 @@ static inline struct dquot *dqgrab(struc + atomic_inc(&dquot->dq_count); + return dquot; + } ++ ++static inline bool dquot_is_busy(struct dquot *dquot) ++{ ++ if (test_bit(DQ_MOD_B, &dquot->dq_flags)) ++ return true; ++ if (atomic_read(&dquot->dq_count) > 1) ++ return true; ++ return false; ++} ++ + void dqput(struct dquot *dquot); + int dquot_scan_active(struct super_block *sb, + int (*fn)(struct dquot *dquot, unsigned long priv), diff --git a/queue-3.16/quota-fix-livelock-in-dquot_writeback_dquots.patch b/queue-3.16/quota-fix-livelock-in-dquot_writeback_dquots.patch new file mode 100644 index 00000000..4725d68f --- /dev/null +++ b/queue-3.16/quota-fix-livelock-in-dquot_writeback_dquots.patch @@ -0,0 +1,44 @@ +From: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> +Date: Thu, 31 Oct 2019 10:39:19 +0000 +Subject: quota: fix livelock in dquot_writeback_dquots + +commit 6ff33d99fc5c96797103b48b7b0902c296f09c05 upstream. + +Write only quotas which are dirty at entry. + +XFSTEST: https://github.com/dmonakhov/xfstests/commit/b10ad23566a5bf75832a6f500e1236084083cddc + +Link: https://lore.kernel.org/r/20191031103920.3919-1-dmonakhov@openvz.org +Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> +Signed-off-by: Dmitry Monakhov <dmtrmonakhov@yandex-team.ru> +Signed-off-by: Jan Kara <jack@suse.cz> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/quota/dquot.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -607,7 +607,7 @@ EXPORT_SYMBOL(dquot_scan_active); + /* Write all dquot structures to quota files */ + int dquot_writeback_dquots(struct super_block *sb, int type) + { +- struct list_head *dirty; ++ struct list_head dirty; + struct dquot *dquot; + struct quota_info *dqopt = sb_dqopt(sb); + int cnt; +@@ -620,9 +620,10 @@ int dquot_writeback_dquots(struct super_ + if (!sb_has_quota_active(sb, cnt)) + continue; + spin_lock(&dq_list_lock); +- dirty = &dqopt->info[cnt].dqi_dirty_list; +- while (!list_empty(dirty)) { +- dquot = list_first_entry(dirty, struct dquot, ++ /* Move list away to avoid livelock. */ ++ list_replace_init(&dqopt->info[cnt].dqi_dirty_list, &dirty); ++ while (!list_empty(&dirty)) { ++ dquot = list_first_entry(&dirty, struct dquot, + dq_dirty); + /* Dirty and inactive can be only bad dquot... */ + if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) { diff --git a/queue-3.16/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch b/queue-3.16/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch new file mode 100644 index 00000000..feba960a --- /dev/null +++ b/queue-3.16/rdma-srpt-report-the-scsi-residual-to-the-initiator.patch @@ -0,0 +1,66 @@ +From: Bart Van Assche <bvanassche@acm.org> +Date: Tue, 5 Nov 2019 13:46:32 -0800 +Subject: RDMA/srpt: Report the SCSI residual to the initiator + +commit e88982ad1bb12db699de96fbc07096359ef6176c upstream. + +The code added by this patch is similar to the code that already exists in +ibmvscsis_determine_resid(). This patch has been tested by running the +following command: + +strace sg_raw -r 1k /dev/sdb 12 00 00 00 60 00 -o inquiry.bin |& + grep resid= + +Link: https://lore.kernel.org/r/20191105214632.183302-1-bvanassche@acm.org +Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1") +Signed-off-by: Bart Van Assche <bvanassche@acm.org> +Acked-by: Honggang Li <honli@redhat.com> +Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/infiniband/ulp/srpt/ib_srpt.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1519,9 +1519,11 @@ static int srpt_build_cmd_rsp(struct srp + struct srpt_send_ioctx *ioctx, u64 tag, + int status) + { ++ struct se_cmd *cmd = &ioctx->cmd; + struct srp_rsp *srp_rsp; + const u8 *sense_data; + int sense_data_len, max_sense_len; ++ u32 resid = cmd->residual_count; + + /* + * The lowest bit of all SAM-3 status codes is zero (see also +@@ -1543,6 +1545,28 @@ static int srpt_build_cmd_rsp(struct srp + srp_rsp->tag = tag; + srp_rsp->status = status; + ++ if (cmd->se_cmd_flags & SCF_UNDERFLOW_BIT) { ++ if (cmd->data_direction == DMA_TO_DEVICE) { ++ /* residual data from an underflow write */ ++ srp_rsp->flags = SRP_RSP_FLAG_DOUNDER; ++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid); ++ } else if (cmd->data_direction == DMA_FROM_DEVICE) { ++ /* residual data from an underflow read */ ++ srp_rsp->flags = SRP_RSP_FLAG_DIUNDER; ++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid); ++ } ++ } else if (cmd->se_cmd_flags & SCF_OVERFLOW_BIT) { ++ if (cmd->data_direction == DMA_TO_DEVICE) { ++ /* residual data from an overflow write */ ++ srp_rsp->flags = SRP_RSP_FLAG_DOOVER; ++ srp_rsp->data_out_res_cnt = cpu_to_be32(resid); ++ } else if (cmd->data_direction == DMA_FROM_DEVICE) { ++ /* residual data from an overflow read */ ++ srp_rsp->flags = SRP_RSP_FLAG_DIOVER; ++ srp_rsp->data_in_res_cnt = cpu_to_be32(resid); ++ } ++ } ++ + if (sense_data_len) { + BUILD_BUG_ON(MIN_MAX_RSP_SIZE <= sizeof(*srp_rsp)); + max_sense_len = ch->max_ti_iu_len - sizeof(*srp_rsp); diff --git a/queue-3.16/regulator-ab8500-remove-ab8505-usb-regulator.patch b/queue-3.16/regulator-ab8500-remove-ab8505-usb-regulator.patch new file mode 100644 index 00000000..b938cb20 --- /dev/null +++ b/queue-3.16/regulator-ab8500-remove-ab8505-usb-regulator.patch @@ -0,0 +1,71 @@ +From: Stephan Gerhold <stephan@gerhold.net> +Date: Wed, 6 Nov 2019 18:31:24 +0100 +Subject: regulator: ab8500: Remove AB8505 USB regulator + +commit 99c4f70df3a6446c56ca817c2d0f9c12d85d4e7c upstream. + +The USB regulator was removed for AB8500 in +commit 41a06aa738ad ("regulator: ab8500: Remove USB regulator"). +It was then added for AB8505 in +commit 547f384f33db ("regulator: ab8500: add support for ab8505"). + +However, there was never an entry added for it in +ab8505_regulator_match. This causes all regulators after it +to be initialized with the wrong device tree data, eventually +leading to an out-of-bounds array read. + +Given that it is not used anywhere in the kernel, it seems +likely that similar arguments against supporting it exist for +AB8505 (it is controlled by hardware). + +Therefore, simply remove it like for AB8500 instead of adding +an entry in ab8505_regulator_match. + +Fixes: 547f384f33db ("regulator: ab8500: add support for ab8505") +Cc: Linus Walleij <linus.walleij@linaro.org> +Signed-off-by: Stephan Gerhold <stephan@gerhold.net> +Reviewed-by: Linus Walleij <linus.walleij@linaro.org> +Link: https://lore.kernel.org/r/20191106173125.14496-1-stephan@gerhold.net +Signed-off-by: Mark Brown <broonie@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/regulator/ab8500.c | 17 ----------------- + include/linux/regulator/ab8500.h | 1 - + 2 files changed, 18 deletions(-) + +--- a/drivers/regulator/ab8500.c ++++ b/drivers/regulator/ab8500.c +@@ -1099,23 +1099,6 @@ static struct ab8500_regulator_info + .update_val_idle = 0x82, + .update_val_normal = 0x02, + }, +- [AB8505_LDO_USB] = { +- .desc = { +- .name = "LDO-USB", +- .ops = &ab8500_regulator_mode_ops, +- .type = REGULATOR_VOLTAGE, +- .id = AB8505_LDO_USB, +- .owner = THIS_MODULE, +- .n_voltages = 1, +- .volt_table = fixed_3300000_voltage, +- }, +- .update_bank = 0x03, +- .update_reg = 0x82, +- .update_mask = 0x03, +- .update_val = 0x01, +- .update_val_idle = 0x03, +- .update_val_normal = 0x01, +- }, + [AB8505_LDO_AUDIO] = { + .desc = { + .name = "LDO-AUDIO", +--- a/include/linux/regulator/ab8500.h ++++ b/include/linux/regulator/ab8500.h +@@ -38,7 +38,6 @@ enum ab8505_regulator_id { + AB8505_LDO_AUX6, + AB8505_LDO_INTCORE, + AB8505_LDO_ADC, +- AB8505_LDO_USB, + AB8505_LDO_AUDIO, + AB8505_LDO_ANAMIC1, + AB8505_LDO_ANAMIC2, diff --git a/queue-3.16/regulator-ab8500-remove-sysclkreq-from-enum-ab8505_regulator_id.patch b/queue-3.16/regulator-ab8500-remove-sysclkreq-from-enum-ab8505_regulator_id.patch new file mode 100644 index 00000000..0c528d6b --- /dev/null +++ b/queue-3.16/regulator-ab8500-remove-sysclkreq-from-enum-ab8505_regulator_id.patch @@ -0,0 +1,35 @@ +From: Stephan Gerhold <stephan@gerhold.net> +Date: Wed, 6 Nov 2019 18:31:25 +0100 +Subject: regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id + +commit 458ea3ad033fc86e291712ce50cbe60c3428cf30 upstream. + +Those regulators are not actually supported by the AB8500 regulator +driver. There is no ab8500_regulator_info for them and no entry in +ab8505_regulator_match. + +As such, they cannot be registered successfully, and looking them +up in ab8505_regulator_match causes an out-of-bounds array read. + +Fixes: 547f384f33db ("regulator: ab8500: add support for ab8505") +Cc: Linus Walleij <linus.walleij@linaro.org> +Signed-off-by: Stephan Gerhold <stephan@gerhold.net> +Reviewed-by: Linus Walleij <linus.walleij@linaro.org> +Link: https://lore.kernel.org/r/20191106173125.14496-2-stephan@gerhold.net +Signed-off-by: Mark Brown <broonie@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/linux/regulator/ab8500.h | 2 -- + 1 file changed, 2 deletions(-) + +--- a/include/linux/regulator/ab8500.h ++++ b/include/linux/regulator/ab8500.h +@@ -43,8 +43,6 @@ enum ab8505_regulator_id { + AB8505_LDO_ANAMIC2, + AB8505_LDO_AUX8, + AB8505_LDO_ANA, +- AB8505_SYSCLKREQ_2, +- AB8505_SYSCLKREQ_4, + AB8505_NUM_REGULATORS, + }; + diff --git a/queue-3.16/rtc-msm6242-fix-reading-of-10-hour-digit.patch b/queue-3.16/rtc-msm6242-fix-reading-of-10-hour-digit.patch new file mode 100644 index 00000000..2f9e253b --- /dev/null +++ b/queue-3.16/rtc-msm6242-fix-reading-of-10-hour-digit.patch @@ -0,0 +1,36 @@ +From: Kars de Jong <jongk@linux-m68k.org> +Date: Sat, 16 Nov 2019 12:05:48 +0100 +Subject: rtc: msm6242: Fix reading of 10-hour digit + +commit e34494c8df0cd96fc432efae121db3212c46ae48 upstream. + +The driver was reading the wrong register as the 10-hour digit due to +a misplaced ')'. It was in fact reading the 1-second digit register due +to this bug. + +Also remove the use of a magic number for the hour mask and use the define +for it which was already present. + +Fixes: 4f9b9bba1dd1 ("rtc: Add an RTC driver for the Oki MSM6242") +Tested-by: Kars de Jong <jongk@linux-m68k.org> +Signed-off-by: Kars de Jong <jongk@linux-m68k.org> +Link: https://lore.kernel.org/r/20191116110548.8562-1-jongk@linux-m68k.org +Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> +Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/rtc/rtc-msm6242.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-msm6242.c ++++ b/drivers/rtc/rtc-msm6242.c +@@ -130,7 +130,8 @@ static int msm6242_read_time(struct devi + msm6242_read(priv, MSM6242_SECOND1); + tm->tm_min = msm6242_read(priv, MSM6242_MINUTE10) * 10 + + msm6242_read(priv, MSM6242_MINUTE1); +- tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10 & 3)) * 10 + ++ tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10) & ++ MSM6242_HOUR10_HR_MASK) * 10 + + msm6242_read(priv, MSM6242_HOUR1); + tm->tm_mday = msm6242_read(priv, MSM6242_DAY10) * 10 + + msm6242_read(priv, MSM6242_DAY1); diff --git a/queue-3.16/scsi-bnx2i-fix-potential-use-after-free.patch b/queue-3.16/scsi-bnx2i-fix-potential-use-after-free.patch new file mode 100644 index 00000000..c2ac4dec --- /dev/null +++ b/queue-3.16/scsi-bnx2i-fix-potential-use-after-free.patch @@ -0,0 +1,35 @@ +From: Pan Bian <bianpan2016@163.com> +Date: Wed, 6 Nov 2019 20:32:21 +0800 +Subject: scsi: bnx2i: fix potential use after free + +commit 29d28f2b8d3736ac61c28ef7e20fda63795b74d9 upstream. + +The member hba->pcidev may be used after its reference is dropped. Move the +put function to where it is never used to avoid potential use after free +issues. + +Fixes: a77171806515 ("[SCSI] bnx2i: Removed the reference to the netdev->base_addr") +Link: https://lore.kernel.org/r/1573043541-19126-1-git-send-email-bianpan2016@163.com +Signed-off-by: Pan Bian <bianpan2016@163.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -913,12 +913,12 @@ void bnx2i_free_hba(struct bnx2i_hba *hb + INIT_LIST_HEAD(&hba->ep_ofld_list); + INIT_LIST_HEAD(&hba->ep_active_list); + INIT_LIST_HEAD(&hba->ep_destroy_list); +- pci_dev_put(hba->pcidev); + + if (hba->regview) { + pci_iounmap(hba->pcidev, hba->regview); + hba->regview = NULL; + } ++ pci_dev_put(hba->pcidev); + bnx2i_free_mp_bdt(hba); + bnx2i_release_free_cid_que(hba); + iscsi_host_free(shost); diff --git a/queue-3.16/scsi-core-scsi_trace-use-get_unaligned_be.patch b/queue-3.16/scsi-core-scsi_trace-use-get_unaligned_be.patch new file mode 100644 index 00000000..4bfff4f3 --- /dev/null +++ b/queue-3.16/scsi-core-scsi_trace-use-get_unaligned_be.patch @@ -0,0 +1,208 @@ +From: Bart Van Assche <bvanassche@acm.org> +Date: Fri, 1 Nov 2019 14:14:47 -0700 +Subject: scsi: core: scsi_trace: Use get_unaligned_be*() + +commit b1335f5b0486f61fb66b123b40f8e7a98e49605d upstream. + +This patch fixes an unintended sign extension on left shifts. From Colin +King: "Shifting a u8 left will cause the value to be promoted to an +integer. If the top bit of the u8 is set then the following conversion to +an u64 will sign extend the value causing the upper 32 bits to be set in +the result." + +Fix this by using get_unaligned_be*() instead. + +Fixes: bf8162354233 ("[SCSI] add scsi trace core functions and put trace points") +Cc: Christoph Hellwig <hch@lst.de> +Cc: Hannes Reinecke <hare@suse.com> +Cc: Douglas Gilbert <dgilbert@interlog.com> +Link: https://lore.kernel.org/r/20191101211447.187151-1-bvanassche@acm.org +Reported-by: Colin Ian King <colin.king@canonical.com> +Signed-off-by: Bart Van Assche <bvanassche@acm.org> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/scsi_trace.c | 114 ++++++++++++-------------------------- + 1 file changed, 34 insertions(+), 80 deletions(-) + +--- a/drivers/scsi/scsi_trace.c ++++ b/drivers/scsi/scsi_trace.c +@@ -17,10 +17,11 @@ + */ + #include <linux/kernel.h> + #include <linux/trace_seq.h> ++#include <asm/unaligned.h> + #include <trace/events/scsi.h> + + #define SERVICE_ACTION16(cdb) (cdb[1] & 0x1f) +-#define SERVICE_ACTION32(cdb) ((cdb[8] << 8) | cdb[9]) ++#define SERVICE_ACTION32(cdb) (get_unaligned_be16(&cdb[8])) + + static const char * + scsi_trace_misc(struct trace_seq *, unsigned char *, int); +@@ -47,17 +48,12 @@ static const char * + scsi_trace_rw10(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len; +- sector_t lba = 0, txlen = 0; ++ u32 lba, txlen; + +- lba |= (cdb[2] << 24); +- lba |= (cdb[3] << 16); +- lba |= (cdb[4] << 8); +- lba |= cdb[5]; +- txlen |= (cdb[7] << 8); +- txlen |= cdb[8]; ++ lba = get_unaligned_be32(&cdb[2]); ++ txlen = get_unaligned_be16(&cdb[7]); + +- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u", +- (unsigned long long)lba, (unsigned long long)txlen, ++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen, + cdb[1] >> 5); + + if (cdb[0] == WRITE_SAME) +@@ -72,19 +68,12 @@ static const char * + scsi_trace_rw12(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len; +- sector_t lba = 0, txlen = 0; ++ u32 lba, txlen; + +- lba |= (cdb[2] << 24); +- lba |= (cdb[3] << 16); +- lba |= (cdb[4] << 8); +- lba |= cdb[5]; +- txlen |= (cdb[6] << 24); +- txlen |= (cdb[7] << 16); +- txlen |= (cdb[8] << 8); +- txlen |= cdb[9]; ++ lba = get_unaligned_be32(&cdb[2]); ++ txlen = get_unaligned_be32(&cdb[6]); + +- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u", +- (unsigned long long)lba, (unsigned long long)txlen, ++ trace_seq_printf(p, "lba=%u txlen=%u protect=%u", lba, txlen, + cdb[1] >> 5); + trace_seq_putc(p, 0); + +@@ -95,23 +84,13 @@ static const char * + scsi_trace_rw16(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len; +- sector_t lba = 0, txlen = 0; ++ u64 lba; ++ u32 txlen; + +- lba |= ((u64)cdb[2] << 56); +- lba |= ((u64)cdb[3] << 48); +- lba |= ((u64)cdb[4] << 40); +- lba |= ((u64)cdb[5] << 32); +- lba |= (cdb[6] << 24); +- lba |= (cdb[7] << 16); +- lba |= (cdb[8] << 8); +- lba |= cdb[9]; +- txlen |= (cdb[10] << 24); +- txlen |= (cdb[11] << 16); +- txlen |= (cdb[12] << 8); +- txlen |= cdb[13]; ++ lba = get_unaligned_be64(&cdb[2]); ++ txlen = get_unaligned_be32(&cdb[10]); + +- trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u", +- (unsigned long long)lba, (unsigned long long)txlen, ++ trace_seq_printf(p, "lba=%llu txlen=%u protect=%u", lba, txlen, + cdb[1] >> 5); + + if (cdb[0] == WRITE_SAME_16) +@@ -126,8 +105,8 @@ static const char * + scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len, *cmd; +- sector_t lba = 0, txlen = 0; +- u32 ei_lbrt = 0; ++ u64 lba; ++ u32 ei_lbrt, txlen; + + switch (SERVICE_ACTION32(cdb)) { + case READ_32: +@@ -147,26 +126,12 @@ scsi_trace_rw32(struct trace_seq *p, uns + goto out; + } + +- lba |= ((u64)cdb[12] << 56); +- lba |= ((u64)cdb[13] << 48); +- lba |= ((u64)cdb[14] << 40); +- lba |= ((u64)cdb[15] << 32); +- lba |= (cdb[16] << 24); +- lba |= (cdb[17] << 16); +- lba |= (cdb[18] << 8); +- lba |= cdb[19]; +- ei_lbrt |= (cdb[20] << 24); +- ei_lbrt |= (cdb[21] << 16); +- ei_lbrt |= (cdb[22] << 8); +- ei_lbrt |= cdb[23]; +- txlen |= (cdb[28] << 24); +- txlen |= (cdb[29] << 16); +- txlen |= (cdb[30] << 8); +- txlen |= cdb[31]; +- +- trace_seq_printf(p, "%s_32 lba=%llu txlen=%llu protect=%u ei_lbrt=%u", +- cmd, (unsigned long long)lba, +- (unsigned long long)txlen, cdb[10] >> 5, ei_lbrt); ++ lba = get_unaligned_be64(&cdb[12]); ++ ei_lbrt = get_unaligned_be32(&cdb[20]); ++ txlen = get_unaligned_be32(&cdb[28]); ++ ++ trace_seq_printf(p, "%s_32 lba=%llu txlen=%u protect=%u ei_lbrt=%u", ++ cmd, lba, txlen, cdb[10] >> 5, ei_lbrt); + + if (SERVICE_ACTION32(cdb) == WRITE_SAME_32) + trace_seq_printf(p, " unmap=%u", cdb[10] >> 3 & 1); +@@ -181,7 +146,7 @@ static const char * + scsi_trace_unmap(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len; +- unsigned int regions = cdb[7] << 8 | cdb[8]; ++ unsigned int regions = get_unaligned_be16(&cdb[7]); + + trace_seq_printf(p, "regions=%u", (regions - 8) / 16); + trace_seq_putc(p, 0); +@@ -193,8 +158,8 @@ static const char * + scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len, *cmd; +- sector_t lba = 0; +- u32 alloc_len = 0; ++ u64 lba; ++ u32 alloc_len; + + switch (SERVICE_ACTION16(cdb)) { + case SAI_READ_CAPACITY_16: +@@ -208,21 +173,10 @@ scsi_trace_service_action_in(struct trac + goto out; + } + +- lba |= ((u64)cdb[2] << 56); +- lba |= ((u64)cdb[3] << 48); +- lba |= ((u64)cdb[4] << 40); +- lba |= ((u64)cdb[5] << 32); +- lba |= (cdb[6] << 24); +- lba |= (cdb[7] << 16); +- lba |= (cdb[8] << 8); +- lba |= cdb[9]; +- alloc_len |= (cdb[10] << 24); +- alloc_len |= (cdb[11] << 16); +- alloc_len |= (cdb[12] << 8); +- alloc_len |= cdb[13]; ++ lba = get_unaligned_be64(&cdb[2]); ++ alloc_len = get_unaligned_be32(&cdb[10]); + +- trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd, +- (unsigned long long)lba, alloc_len); ++ trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd, lba, alloc_len); + + out: + trace_seq_putc(p, 0); diff --git a/queue-3.16/scsi-csiostor-don-t-enable-irqs-too-early.patch b/queue-3.16/scsi-csiostor-don-t-enable-irqs-too-early.patch new file mode 100644 index 00000000..c5f86e1d --- /dev/null +++ b/queue-3.16/scsi-csiostor-don-t-enable-irqs-too-early.patch @@ -0,0 +1,92 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Sat, 19 Oct 2019 11:59:13 +0300 +Subject: scsi: csiostor: Don't enable IRQs too early + +commit d6c9b31ac3064fbedf8961f120a4c117daa59932 upstream. + +These are called with IRQs disabled from csio_mgmt_tmo_handler() so we +can't call spin_unlock_irq() or it will enable IRQs prematurely. + +Fixes: a3667aaed569 ("[SCSI] csiostor: Chelsio FCoE offload driver") +Link: https://lore.kernel.org/r/20191019085913.GA14245@mwanda +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/csiostor/csio_lnode.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -292,6 +292,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *h + struct fc_fdmi_port_name *port_name; + uint8_t buf[64]; + uint8_t *fc4_type; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi rhba cmd\n", +@@ -369,13 +370,13 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *h + len = (uint32_t)(pld - (uint8_t *)cmd); + + /* Submit FDMI RPA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_done, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rpa req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -396,6 +397,7 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *h + struct fc_fdmi_rpl *reg_pl; + struct fs_fdmi_attrs *attrib_blk; + uint8_t buf[64]; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dprt cmd\n", +@@ -476,13 +478,13 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *h + attrib_blk->numattrs = htonl(numattrs); + + /* Submit FDMI RHBA request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_rhba_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi rhba req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /* +@@ -497,6 +499,7 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *h + void *cmd; + struct fc_fdmi_port_name *port_name; + uint32_t len; ++ unsigned long flags; + + if (fdmi_req->wr_status != FW_SUCCESS) { + csio_ln_dbg(ln, "WR error:%x in processing fdmi dhba cmd\n", +@@ -527,13 +530,13 @@ csio_ln_fdmi_dhba_cbfn(struct csio_hw *h + len += sizeof(*port_name); + + /* Submit FDMI request */ +- spin_lock_irq(&hw->lock); ++ spin_lock_irqsave(&hw->lock, flags); + if (csio_ln_mgmt_submit_req(fdmi_req, csio_ln_fdmi_dprt_cbfn, + FCOE_CT, &fdmi_req->dma_buf, len)) { + CSIO_INC_STATS(ln, n_fdmi_err); + csio_ln_dbg(ln, "Failed to issue fdmi dprt req\n"); + } +- spin_unlock_irq(&hw->lock); ++ spin_unlock_irqrestore(&hw->lock, flags); + } + + /** diff --git a/queue-3.16/scsi-esas2r-unlock-on-error-in-esas2r_nvram_read_direct.patch b/queue-3.16/scsi-esas2r-unlock-on-error-in-esas2r_nvram_read_direct.patch new file mode 100644 index 00000000..5158bbb3 --- /dev/null +++ b/queue-3.16/scsi-esas2r-unlock-on-error-in-esas2r_nvram_read_direct.patch @@ -0,0 +1,27 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Tue, 22 Oct 2019 13:23:24 +0300 +Subject: scsi: esas2r: unlock on error in esas2r_nvram_read_direct() + +commit 906ca6353ac09696c1bf0892513c8edffff5e0a6 upstream. + +This error path is missing an unlock. + +Fixes: 26780d9e12ed ("[SCSI] esas2r: ATTO Technology ExpressSAS 6G SAS/SATA RAID Adapter Driver") +Link: https://lore.kernel.org/r/20191022102324.GA27540@mwanda +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/esas2r/esas2r_flash.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/esas2r/esas2r_flash.c ++++ b/drivers/scsi/esas2r/esas2r_flash.c +@@ -1197,6 +1197,7 @@ bool esas2r_nvram_read_direct(struct esa + if (!esas2r_read_flash_block(a, a->nvram, FLS_OFFSET_NVR, + sizeof(struct esas2r_sas_nvram))) { + esas2r_hdebug("NVRAM read failed, using defaults"); ++ up(&a->nvram_semaphore); + return false; + } + diff --git a/queue-3.16/scsi-lpfc-fix-coverity-lpfc_cmpl_els_rsp-null-pointer.patch b/queue-3.16/scsi-lpfc-fix-coverity-lpfc_cmpl_els_rsp-null-pointer.patch new file mode 100644 index 00000000..75d548c8 --- /dev/null +++ b/queue-3.16/scsi-lpfc-fix-coverity-lpfc_cmpl_els_rsp-null-pointer.patch @@ -0,0 +1,59 @@ +From: James Smart <jsmart2021@gmail.com> +Date: Mon, 11 Nov 2019 15:03:57 -0800 +Subject: scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer + dereferences + +commit 6c6d59e0fe5b86cf273d6d744a6a9768c4ecc756 upstream. + +Coverity reported the following: + +*** CID 101747: Null pointer dereferences (FORWARD_NULL) +/drivers/scsi/lpfc/lpfc_els.c: 4439 in lpfc_cmpl_els_rsp() +4433 kfree(mp); +4434 } +4435 mempool_free(mbox, phba->mbox_mem_pool); +4436 } +4437 out: +4438 if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { +vvv CID 101747: Null pointer dereferences (FORWARD_NULL) +vvv Dereferencing null pointer "shost". +4439 spin_lock_irq(shost->host_lock); +4440 ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); +4441 spin_unlock_irq(shost->host_lock); +4442 +4443 /* If the node is not being used by another discovery thread, +4444 * and we are sending a reject, we are done with it. + +Fix by adding a check for non-null shost in line 4438. +The scenario when shost is set to null is when ndlp is null. +As such, the ndlp check present was sufficient. But better safe +than sorry so add the shost check. + +Reported-by: coverity-bot <keescook+coverity-bot@chromium.org> +Addresses-Coverity-ID: 101747 ("Null pointer dereferences") +Fixes: 2e0fef85e098 ("[SCSI] lpfc: NPIV: split ports") + +CC: James Bottomley <James.Bottomley@SteelEye.com> +CC: "Gustavo A. R. Silva" <gustavo@embeddedor.com> +CC: linux-next@vger.kernel.org +Link: https://lore.kernel.org/r/20191111230401.12958-3-jsmart2021@gmail.com +Reviewed-by: Ewan D. Milne <emilne@redhat.com> +Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com> +Signed-off-by: James Smart <jsmart2021@gmail.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/lpfc/lpfc_els.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3861,7 +3861,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, + mempool_free(mbox, phba->mbox_mem_pool); + } + out: +- if (ndlp && NLP_CHK_NODE_ACT(ndlp)) { ++ if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); + spin_unlock_irq(shost->host_lock); diff --git a/queue-3.16/scsi-qla4xxx-fix-double-free-bug.patch b/queue-3.16/scsi-qla4xxx-fix-double-free-bug.patch new file mode 100644 index 00000000..d168f036 --- /dev/null +++ b/queue-3.16/scsi-qla4xxx-fix-double-free-bug.patch @@ -0,0 +1,32 @@ +From: Pan Bian <bianpan2016@163.com> +Date: Tue, 5 Nov 2019 17:25:27 +0800 +Subject: scsi: qla4xxx: fix double free bug + +commit 3fe3d2428b62822b7b030577cd612790bdd8c941 upstream. + +The variable init_fw_cb is released twice, resulting in a double free +bug. The call to the function dma_free_coherent() before goto is removed to +get rid of potential double free. + +Fixes: 2a49a78ed3c8 ("[SCSI] qla4xxx: added IPv6 support.") +Link: https://lore.kernel.org/r/1572945927-27796-1-git-send-email-bianpan2016@163.com +Signed-off-by: Pan Bian <bianpan2016@163.com> +Acked-by: Manish Rangankar <mrangankar@marvell.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/qla4xxx/ql4_mbx.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/scsi/qla4xxx/ql4_mbx.c ++++ b/drivers/scsi/qla4xxx/ql4_mbx.c +@@ -641,9 +641,6 @@ int qla4xxx_initialize_fw_cb(struct scsi + + if (qla4xxx_get_ifcb(ha, &mbox_cmd[0], &mbox_sts[0], init_fw_cb_dma) != + QLA_SUCCESS) { +- dma_free_coherent(&ha->pdev->dev, +- sizeof(struct addr_ctrl_blk), +- init_fw_cb, init_fw_cb_dma); + goto exit_init_fw_cb; + } + diff --git a/queue-3.16/scsi-tracing-fix-handling-of-transfer-length-0-for-read-6-and.patch b/queue-3.16/scsi-tracing-fix-handling-of-transfer-length-0-for-read-6-and.patch new file mode 100644 index 00000000..c40dc79d --- /dev/null +++ b/queue-3.16/scsi-tracing-fix-handling-of-transfer-length-0-for-read-6-and.patch @@ -0,0 +1,48 @@ +From: Bart Van Assche <bvanassche@acm.org> +Date: Tue, 5 Nov 2019 13:55:53 -0800 +Subject: scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and + WRITE(6) + +commit f6b8540f40201bff91062dd64db8e29e4ddaaa9d upstream. + +According to SBC-2 a TRANSFER LENGTH field of zero means that 256 logical +blocks must be transferred. Make the SCSI tracing code follow SBC-2. + +Fixes: bf8162354233 ("[SCSI] add scsi trace core functions and put trace points") +Cc: Christoph Hellwig <hch@lst.de> +Cc: Hannes Reinecke <hare@suse.com> +Cc: Douglas Gilbert <dgilbert@interlog.com> +Link: https://lore.kernel.org/r/20191105215553.185018-1-bvanassche@acm.org +Signed-off-by: Bart Van Assche <bvanassche@acm.org> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/scsi/scsi_trace.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/scsi/scsi_trace.c ++++ b/drivers/scsi/scsi_trace.c +@@ -30,15 +30,18 @@ static const char * + scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len) + { + const char *ret = p->buffer + p->len; +- sector_t lba = 0, txlen = 0; ++ u32 lba = 0, txlen; + + lba |= ((cdb[1] & 0x1F) << 16); + lba |= (cdb[2] << 8); + lba |= cdb[3]; +- txlen = cdb[4]; ++ /* ++ * From SBC-2: a TRANSFER LENGTH field set to zero specifies that 256 ++ * logical blocks shall be read (READ(6)) or written (WRITE(6)). ++ */ ++ txlen = cdb[4] ? cdb[4] : 256; + +- trace_seq_printf(p, "lba=%llu txlen=%llu", +- (unsigned long long)lba, (unsigned long long)txlen); ++ trace_seq_printf(p, "lba=%u txlen=%u", lba, txlen); + trace_seq_putc(p, 0); + + return ret; diff --git a/queue-3.16/scsi-zfcp-trace-channel-log-even-for-fcp-command-responses.patch b/queue-3.16/scsi-zfcp-trace-channel-log-even-for-fcp-command-responses.patch new file mode 100644 index 00000000..d50de82a --- /dev/null +++ b/queue-3.16/scsi-zfcp-trace-channel-log-even-for-fcp-command-responses.patch @@ -0,0 +1,42 @@ +From: Steffen Maier <maier@linux.ibm.com> +Date: Fri, 25 Oct 2019 18:12:53 +0200 +Subject: scsi: zfcp: trace channel log even for FCP command responses + +commit 100843f176109af94600e500da0428e21030ca7f upstream. + +While v2.6.26 commit b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug +trace") is right that we don't want to flood the (payload) trace ring +buffer, we don't trace successful FCP command responses by default. So we +can include the channel log for problem determination with failed responses +of any FSF request type. + +Fixes: b75db73159cc ("[SCSI] zfcp: Add qtcb dump to hba debug trace") +Fixes: a54ca0f62f95 ("[SCSI] zfcp: Redesign of the debug tracing for HBA records.") +Link: https://lore.kernel.org/r/e37597b5c4ae123aaa85fd86c23a9f71e994e4a9.1572018132.git.bblock@linux.ibm.com +Reviewed-by: Benjamin Block <bblock@linux.ibm.com> +Signed-off-by: Steffen Maier <maier@linux.ibm.com> +Signed-off-by: Benjamin Block <bblock@linux.ibm.com> +Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> +[bwh: Backported to 3.16: Deleted condition is slightly different] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/s390/scsi/zfcp_dbf.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -93,11 +93,9 @@ void zfcp_dbf_hba_fsf_res(char *tag, int + memcpy(rec->u.res.fsf_status_qual, &q_head->fsf_status_qual, + FSF_STATUS_QUALIFIER_SIZE); + +- if (req->fsf_command != FSF_QTCB_FCP_CMND) { +- rec->pl_len = q_head->log_length; +- zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, +- rec->pl_len, "fsf_res", req->req_id); +- } ++ rec->pl_len = q_head->log_length; ++ zfcp_dbf_pl_write(dbf, (char *)q_pref + q_head->log_start, ++ rec->pl_len, "fsf_res", req->req_id); + + debug_event(dbf->hba, level, rec, sizeof(*rec)); + spin_unlock_irqrestore(&dbf->hba_lock, flags); diff --git a/queue-3.16/serial-ifx6x60-add-missed-pm_runtime_disable.patch b/queue-3.16/serial-ifx6x60-add-missed-pm_runtime_disable.patch new file mode 100644 index 00000000..0e8b38cd --- /dev/null +++ b/queue-3.16/serial-ifx6x60-add-missed-pm_runtime_disable.patch @@ -0,0 +1,29 @@ +From: Chuhong Yuan <hslester96@gmail.com> +Date: Mon, 18 Nov 2019 10:48:33 +0800 +Subject: serial: ifx6x60: add missed pm_runtime_disable + +commit 50b2b571c5f3df721fc81bf9a12c521dfbe019ba upstream. + +The driver forgets to call pm_runtime_disable in remove. +Add the missed calls to fix it. + +Signed-off-by: Chuhong Yuan <hslester96@gmail.com> +Link: https://lore.kernel.org/r/20191118024833.21587-1-hslester96@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/ifx6x60.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/serial/ifx6x60.c ++++ b/drivers/tty/serial/ifx6x60.c +@@ -1242,6 +1242,9 @@ static int ifx_spi_spi_remove(struct spi + struct ifx_spi_device *ifx_dev = spi_get_drvdata(spi); + /* stop activity */ + tasklet_kill(&ifx_dev->io_work_tasklet); ++ ++ pm_runtime_disable(&spi->dev); ++ + /* free irq */ + free_irq(gpio_to_irq(ifx_dev->gpio.reset_out), (void *)ifx_dev); + free_irq(gpio_to_irq(ifx_dev->gpio.srdy), (void *)ifx_dev); diff --git a/queue-3.16/serial-pl011-fix-dma-flush_buffer.patch b/queue-3.16/serial-pl011-fix-dma-flush_buffer.patch new file mode 100644 index 00000000..5c4051b6 --- /dev/null +++ b/queue-3.16/serial-pl011-fix-dma-flush_buffer.patch @@ -0,0 +1,69 @@ +From: Vincent Whitchurch <vincent.whitchurch@axis.com> +Date: Mon, 18 Nov 2019 10:25:47 +0100 +Subject: serial: pl011: Fix DMA ->flush_buffer() + +commit f6a196477184b99a31d16366a8e826558aa11f6d upstream. + +PL011's ->flush_buffer() implementation releases and reacquires the port +lock. Due to a race condition here, data can end up being added to the +circular buffer but neither being discarded nor being sent out. This +leads to, for example, tcdrain(2) waiting indefinitely. + +Process A Process B + +uart_flush_buffer() + - acquire lock + - circ_clear + - pl011_flush_buffer() + -- release lock + -- dmaengine_terminate_all() + + uart_write() + - acquire lock + - add chars to circ buffer + - start_tx() + -- start DMA + - release lock + + -- acquire lock + -- turn off DMA + -- release lock + + // Data in circ buffer but DMA is off + +According to the comment in the code, the releasing of the lock around +dmaengine_terminate_all() is to avoid a deadlock with the DMA engine +callback. However, since the time this code was written, the DMA engine +API documentation seems to have been clarified to say that +dmaengine_terminate_all() (in the identically implemented but +differently named dmaengine_terminate_async() variant) does not wait for +any running complete callback to be completed and can even be called +from a complete callback. So there is no possibility of deadlock if the +DMA engine driver implements this API correctly. + +So we should be able to just remove this release and reacquire of the +lock to prevent the aforementioned race condition. + +Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com> +Link: https://lore.kernel.org/r/20191118092547.32135-1-vincent.whitchurch@axis.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/amba-pl011.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -683,10 +683,8 @@ __acquires(&uap->port.lock) + if (!uap->using_tx_dma) + return; + +- /* Avoid deadlock with the DMA engine callback */ +- spin_unlock(&uap->port.lock); +- dmaengine_terminate_all(uap->dmatx.chan); +- spin_lock(&uap->port.lock); ++ dmaengine_terminate_async(uap->dmatx.chan); ++ + if (uap->dmatx.queued) { + dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, + DMA_TO_DEVICE); diff --git a/queue-3.16/serial-serial_core-perform-null-checks-for-break_ctl-ops.patch b/queue-3.16/serial-serial_core-perform-null-checks-for-break_ctl-ops.patch new file mode 100644 index 00000000..6a8f1f8c --- /dev/null +++ b/queue-3.16/serial-serial_core-perform-null-checks-for-break_ctl-ops.patch @@ -0,0 +1,122 @@ +From: Jiangfeng Xiao <xiaojiangfeng@huawei.com> +Date: Wed, 20 Nov 2019 23:18:53 +0800 +Subject: serial: serial_core: Perform NULL checks for break_ctl ops + +commit 7d73170e1c282576419f8b50a771f1fcd2b81a94 upstream. + +Doing fuzz test on sbsa uart device, causes a kernel crash +due to NULL pointer dereference: + +------------[ cut here ]------------ +Unable to handle kernel paging request at virtual address fffffffffffffffc +pgd = ffffffe331723000 +[fffffffffffffffc] *pgd=0000002333595003, *pud=0000002333595003, *pmd=00000 +Internal error: Oops: 96000005 [#1] PREEMPT SMP +Modules linked in: ping(O) jffs2 rtos_snapshot(O) pramdisk(O) hisi_sfc(O) +Drv_Nandc_K(O) Drv_SysCtl_K(O) Drv_SysClk_K(O) bsp_reg(O) hns3(O) +hns3_uio_enet(O) hclgevf(O) hclge(O) hnae3(O) mdio_factory(O) +mdio_registry(O) mdio_dev(O) mdio(O) hns3_info(O) rtos_kbox_panic(O) +uart_suspend(O) rsm(O) stp llc tunnel4 xt_tcpudp ipt_REJECT nf_reject_ipv4 +iptable_filter ip_tables x_tables sd_mod xhci_plat_hcd xhci_pci xhci_hcd +usbmon usbhid usb_storage ohci_platform ohci_pci ohci_hcd hid_generic hid +ehci_platform ehci_pci ehci_hcd vfat fat usbcore usb_common scsi_mod +yaffs2multi(O) ext4 jbd2 ext2 mbcache ofpart i2c_dev i2c_core uio ubi nand +nand_ecc nand_ids cfi_cmdset_0002 cfi_cmdset_0001 cfi_probe gen_probe +cmdlinepart chipreg mtdblock mtd_blkdevs mtd nfsd auth_rpcgss oid_registry +nfsv3 nfs nfs_acl lockd sunrpc grace autofs4 +CPU: 2 PID: 2385 Comm: tty_fuzz_test Tainted: G O 4.4.193 #1 +task: ffffffe32b23f110 task.stack: ffffffe32bda4000 +PC is at uart_break_ctl+0x44/0x84 +LR is at uart_break_ctl+0x34/0x84 +pc : [<ffffff8393196098>] lr : [<ffffff8393196088>] pstate: 80000005 +sp : ffffffe32bda7cc0 +x29: ffffffe32bda7cc0 x28: ffffffe32b23f110 +x27: ffffff8393402000 x26: 0000000000000000 +x25: ffffffe32b233f40 x24: ffffffc07a8ec680 +x23: 0000000000005425 x22: 00000000ffffffff +x21: ffffffe33ed73c98 x20: 0000000000000000 +x19: ffffffe33ed94168 x18: 0000000000000004 +x17: 0000007f92ae9d30 x16: ffffff8392fa6064 +x15: 0000000000000010 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000020 x10: 0000007ffdac1708 +x9 : 0000000000000078 x8 : 000000000000001d +x7 : 0000000052a64887 x6 : ffffffe32bda7e08 +x5 : ffffffe32b23c000 x4 : 0000005fbc5b0000 +x3 : ffffff83938d5018 x2 : 0000000000000080 +x1 : ffffffe32b23c040 x0 : ffffff83934428f8 +virtual start addr offset is 38ac00000 +module base offset is 2cd4cf1000 +linear region base offset is : 0 +Process tty_fuzz_test (pid: 2385, stack limit = 0xffffffe32bda4000) +Stack: (0xffffffe32bda7cc0 to 0xffffffe32bda8000) +7cc0: ffffffe32bda7cf0 ffffff8393177718 ffffffc07a8ec680 ffffff8393196054 +7ce0: 000000001739f2e0 0000007ffdac1978 ffffffe32bda7d20 ffffff8393179a1c +7d00: 0000000000000000 ffffff8393c0a000 ffffffc07a8ec680 cb88537fdc8ba600 +7d20: ffffffe32bda7df0 ffffff8392fa5a40 ffffff8393c0a000 0000000000005425 +7d40: 0000007ffdac1978 ffffffe32b233f40 ffffff8393178dcc 0000000000000003 +7d60: 000000000000011d 000000000000001d ffffffe32b23f110 000000000000029e +7d80: ffffffe34fe8d5d0 0000000000000000 ffffffe32bda7e14 cb88537fdc8ba600 +7da0: ffffffe32bda7e30 ffffff8393042cfc ffffff8393c41720 ffffff8393c46410 +7dc0: ffffff839304fa68 ffffffe32b233f40 0000000000005425 0000007ffdac1978 +7de0: 000000000000011d cb88537fdc8ba600 ffffffe32bda7e70 ffffff8392fa60cc +7e00: 0000000000000000 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 +7e20: 0000000000005425 0000007ffdac1978 ffffffe32bda7e70 ffffff8392fa60b0 +7e40: 0000000000000280 ffffffe32b233f40 ffffffe32b233f40 0000000000000003 +7e60: 0000000000005425 cb88537fdc8ba600 0000000000000000 ffffff8392e02e78 +7e80: 0000000000000280 0000005fbc5b0000 ffffffffffffffff 0000007f92ae9d3c +7ea0: 0000000060000000 0000000000000015 0000000000000003 0000000000005425 +7ec0: 0000007ffdac1978 0000000000000000 00000000a54c910e 0000007f92b95014 +7ee0: 0000007f92b95090 0000000052a64887 000000000000001d 0000000000000078 +7f00: 0000007ffdac1708 0000000000000020 0000000000000000 0000000000000000 +7f20: 0000000000000000 0000000000000010 000000556acf0090 0000007f92ae9d30 +7f40: 0000000000000004 000000556acdef10 0000000000000000 000000556acdebd0 +7f60: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +7f80: 0000000000000000 0000000000000000 0000000000000000 0000007ffdac1840 +7fa0: 000000556acdedcc 0000007ffdac1840 0000007f92ae9d3c 0000000060000000 +7fc0: 0000000000000000 0000000000000000 0000000000000003 000000000000001d +7fe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +Call trace: +Exception stack(0xffffffe32bda7ab0 to 0xffffffe32bda7bf0) +7aa0: 0000000000001000 0000007fffffffff +7ac0: ffffffe32bda7cc0 ffffff8393196098 0000000080000005 0000000000000025 +7ae0: ffffffe32b233f40 ffffff83930d777c ffffffe32bda7b30 ffffff83930d777c +7b00: ffffffe32bda7be0 ffffff83938d5000 ffffffe32bda7be0 ffffffe32bda7c20 +7b20: ffffffe32bda7b60 ffffff83930d777c ffffffe32bda7c10 ffffff83938d5000 +7b40: ffffffe32bda7c10 ffffffe32bda7c50 ffffff8393c0a000 ffffffe32b23f110 +7b60: ffffffe32bda7b70 ffffff8392e09df4 ffffffe32bda7bb0 cb88537fdc8ba600 +7b80: ffffff83934428f8 ffffffe32b23c040 0000000000000080 ffffff83938d5018 +7ba0: 0000005fbc5b0000 ffffffe32b23c000 ffffffe32bda7e08 0000000052a64887 +7bc0: 000000000000001d 0000000000000078 0000007ffdac1708 0000000000000020 +7be0: 0000000000000000 0000000000000000 +[<ffffff8393196098>] uart_break_ctl+0x44/0x84 +[<ffffff8393177718>] send_break+0xa0/0x114 +[<ffffff8393179a1c>] tty_ioctl+0xc50/0xe84 +[<ffffff8392fa5a40>] do_vfs_ioctl+0xc4/0x6e8 +[<ffffff8392fa60cc>] SyS_ioctl+0x68/0x9c +[<ffffff8392e02e78>] __sys_trace_return+0x0/0x4 +Code: b9410ea0 34000160 f9408aa0 f9402814 (b85fc280) +---[ end trace 8606094f1960c5e0 ]--- +Kernel panic - not syncing: Fatal exception + +Fix this problem by adding NULL checks prior to calling break_ctl ops. + +Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@huawei.com> +Link: https://lore.kernel.org/r/1574263133-28259-1-git-send-email-xiaojiangfeng@huawei.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/serial_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1013,7 +1013,7 @@ static int uart_break_ctl(struct tty_str + + mutex_lock(&port->mutex); + +- if (uport->type != PORT_UNKNOWN) ++ if (uport->type != PORT_UNKNOWN && uport->ops->break_ctl) + uport->ops->break_ctl(uport, break_state); + + mutex_unlock(&port->mutex); diff --git a/queue-3.16/series b/queue-3.16/series index c1eae8f1..7b8e6e40 100644 --- a/queue-3.16/series +++ b/queue-3.16/series @@ -6,3 +6,138 @@ net-davinci_cpdma-use-dma_addr_t-for-dma-address.patch stmmac-fix-oversized-frame-reception.patch net-stmmac-use-correct-dma-buffer-size-in-the-rx-descriptor.patch net-stmmac-don-t-stop-napi-processing-when-dropping-a-packet.patch +workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch +ath9k_hw-fix-uninitialized-variable-data.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c24xx-wakeup.patch +pinctrl-samsung-fix-device-node-refcount-leaks-in-s3c64xx-wakeup.patch +media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch +media-ov6650-fix-stored-frame-format-not-in-sync-with-hardware.patch +tools-power-cpupower-fix-initializer-override-in-hsw_ext_cstates.patch +cw1200-fix-a-signedness-bug-in-cw1200_load_firmware.patch +ar5523-check-null-before-memcpy-in-ar5523_cmd.patch +hwrng-omap3-rom-call-clk_disable_unprepare-on-exit-only-if-not.patch +drm-i810-prevent-underflow-in-ioctl.patch +arm-dts-s3c64xx-fix-init-order-of-clock-providers.patch +usbvision-remove-power_on_at_open-and-timed-power-off.patch +usbvision-video-two-use-after-frees.patch +usbvision-fix-locking-error.patch +usbvision-fix-locking-error-2.patch +media-usbvision-fix-invalid-accesses-after-device-disconnect.patch +media-usbvision-fix-races-among-open-close-and-disconnect.patch +sunrpc-fix-crash-when-cache_head-become-valid-before-update.patch +pci-fix-intel-acs-quirk-updcr-register-address.patch +bluetooth-hci_core-fix-init-for-hci_user_channel.patch +spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch +usb-gadget-u_serial-add-missing-port-entry-locking.patch +compat_ioctl-handle-siocoutqnsd.patch +x86-ioapic-prevent-inconsistent-state-when-moving-an-interrupt.patch +xfs-sanity-check-flags-of-q_xquotarm-call.patch +cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch +scsi-csiostor-don-t-enable-irqs-too-early.patch +scsi-esas2r-unlock-on-error-in-esas2r_nvram_read_direct.patch +scsi-zfcp-trace-channel-log-even-for-fcp-command-responses.patch +clk-samsung-exynos5420-preserve-cpu-clocks-configuration-during.patch +mtd-spear_smi-fix-write-burst-mode.patch +arm-tegra-fix-flow_ctlr_halt-register-clobbering-by-tegra_resume.patch +quota-fix-livelock-in-dquot_writeback_dquots.patch +quota-check-that-quota-is-not-dirty-before-release.patch +scsi-core-scsi_trace-use-get_unaligned_be.patch +blk-mq-fix-deadlock-when-reading-cpu_list.patch +blk-mq-avoid-sysfs-buffer-overflow-with-too-many-cpu-cores.patch +iio-imu-adis16480-assign-bias-value-only-if-operation-succeeded.patch +blk-mq-make-sure-that-line-break-can-be-printed.patch +tty-serial-msm_serial-fix-flow-control.patch +ext2-check-err-when-partial-null.patch +media-radio-wl1273-fix-interrupt-masking-on-release.patch +media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch +staging-rtl8192e-fix-potential-use-after-free.patch +jbd2-fix-possible-overflow-in-jbd2_log_space_left.patch +bnx2x-enable-multi-cos-feature.patch +pm-devfreq-lock-devfreq-in-trans_stat_show.patch +scsi-tracing-fix-handling-of-transfer-length-0-for-read-6-and.patch +usb-serial-mos7840-add-usb-id-to-support-moxa-uport-2210.patch +perf-probe-fix-to-handle-optimized-not-inlined-functions.patch +perf-probe-fix-to-show-lines-of-sys_-functions-correctly.patch +perf-probe-fix-to-add-missed-brace-around-if-block.patch +perf-probe-skip-if-the-function-address-is-0.patch +perf-probe-fix-to-find-range-only-function-instance.patch +perf-probe-fix-to-show-function-entry-line-as-probe-able.patch +perf-probe-fix-wrong-address-verification.patch +perf-probe-fix-to-probe-a-function-which-has-no-entry-pc.patch +perf-probe-fix-to-probe-an-inline-function-which-has-no-entry-pc.patch +perf-probe-fix-to-list-probe-event-with-correct-line-number.patch +perf-probe-fix-to-show-inlined-function-callsite-without-entry_pc.patch +usb-gadget-pch_udc-fix-use-after-free.patch +usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch +appledisplay-fix-error-handling-in-the-scheduled-work.patch +perf-probe-skip-end-of-sequence-and-non-statement-lines.patch +perf-probe-filter-out-instances-except-for-inlined-subroutine-and.patch +perf-probe-fix-to-show-calling-lines-of-inlined-functions.patch +perf-probe-skip-overlapped-location-on-searching-variables.patch +powerpc-allow-flush_icache_range-to-work-across-ranges-4gb.patch +powerpc-allow-64bit-vdso-__kernel_sync_dicache-to-work-across-ranges.patch +regulator-ab8500-remove-ab8505-usb-regulator.patch +regulator-ab8500-remove-sysclkreq-from-enum-ab8505_regulator_id.patch +inetpeer-fix-data-race-in-inet_putpeer-inet_putpeer.patch +iio-adis16480-add-debugfs_reg_access-entry.patch +drm-i915-userptr-try-to-acquire-the-page-lock-around.patch +usb-serial-mos7720-fix-remote-wakeup.patch +usb-serial-mos7840-fix-remote-wakeup.patch +fuse-verify-attributes.patch +fuse-verify-nlink.patch +asoc-jack-fix-null-pointer-dereference-in-snd_soc_jack_report.patch +scsi-lpfc-fix-coverity-lpfc_cmpl_els_rsp-null-pointer.patch +tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch +tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch +rdma-srpt-report-the-scsi-residual-to-the-initiator.patch +binder-handle-start-null-in-binder_update_page_range.patch +usb-serial-ftdi_sio-add-device-ids-for-u-blox-c099-f9p.patch +futex-prevent-robust-futex-exit-race.patch +x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch +usb-serial-cp201x-support-mark-10-digital-force-gauge.patch +usb-uas-honor-flag-to-avoid-capacity16.patch +usb-uas-heed-capacity_heuristics.patch +usb-documentation-flags-on-usb-storage-versus-uas.patch +btrfs-fix-negative-subv_writers-counter-and-data-space-leak-after.patch +btrfs-check-page-mapping-when-loading-free-space-cache.patch +serial-pl011-fix-dma-flush_buffer.patch +serial-ifx6x60-add-missed-pm_runtime_disable.patch +rtc-msm6242-fix-reading-of-10-hour-digit.patch +bluetooth-delete-a-stray-unlock.patch +ext4-work-around-deleting-a-file-with-i_nlink-0-safely.patch +scsi-qla4xxx-fix-double-free-bug.patch +scsi-bnx2i-fix-potential-use-after-free.patch +iwlwifi-check-kasprintf-return-value.patch +serial-serial_core-perform-null-checks-for-break_ctl-ops.patch +kvm-x86-fix-presentation-of-tsx-feature-in-arch_capabilities.patch +kvm-x86-do-not-modify-masked-bits-of-shared-msrs.patch +x86-pci-avoid-amd-fch-xhci-usb-pme-from-d0-defect.patch +alsa-cs4236-fix-error-return-comparison-of-an-unsigned-integer.patch +libtraceevent-fix-memory-leakage-in-copy_filter_type.patch +drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch +tty-vt-keyboard-reject-invalid-keycodes.patch +cifs-respect-o_sync-and-o_direct-flags-during-reconnect.patch +cifs-fix-smb2-oplock-break-processing.patch +platform-x86-hp-wmi-fix-acpi-errors-caused-by-too-small-buffer.patch +platform-x86-hp-wmi-fix-acpi-errors-caused-by-passing-0-as-input.patch +macvlan-schedule-bc_work-even-if-error.patch +pci-msi-fix-incorrect-msi-x-masking-on-resume.patch +xtensa-fix-tlb-sanity-checker.patch +perf-regs-make-perf_reg_name-return-unknown-instead-of-null.patch +acpi-osl-speedup-grace-period-in-acpi_os_map_cleanup.patch +acpi-osl-only-free-map-once-in-osl.c.patch +acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch +openvswitch-drop-unneeded-bug_on-in-ovs_flow_cmd_build_info.patch +openvswitch-remove-another-bug_on.patch +cifs-fix-cifsinodeinfo-lock_sem-deadlock-when-reconnect-occurs.patch +cifs-fix-null-pointer-dereference-in-smb2_push_mandatory_locks.patch +net-bridge-deny-dev_set_mac_address-when-unregistering.patch +drm-radeon-fix-r1xx-r2xx-register-checker-for-pot-textures.patch +xen-blkback-avoid-unmapping-unmapped-grant-pages.patch +powerpc-fix-vdso-clock_getres.patch +alsa-pcm-oss-avoid-potential-buffer-overflows.patch +tcp-md5-fix-potential-overestimation-of-tcp-option-space.patch +tcp-syncookies-extend-validity-range.patch +tcp-fix-rejected-syncookies-due-to-stale-timestamps.patch +tcp-protect-accesses-to-.ts_recent_stamp-with-read-write-_once.patch +inet-protect-against-too-small-mtu-values.patch diff --git a/queue-3.16/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch b/queue-3.16/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch new file mode 100644 index 00000000..207c2da6 --- /dev/null +++ b/queue-3.16/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch @@ -0,0 +1,60 @@ +From: Mans Rullgard <mans@mansr.com> +Date: Fri, 18 Oct 2019 17:35:04 +0200 +Subject: spi: atmel: fix handling of cs_change set on non-last xfer + +commit fed8d8c7a6dc2a76d7764842853d81c770b0788e upstream. + +The driver does the wrong thing when cs_change is set on a non-last +xfer in a message. When cs_change is set, the driver deactivates the +CS and leaves it off until a later xfer again has cs_change set whereas +it should be briefly toggling CS off and on again. + +This patch brings the behaviour of the driver back in line with the +documentation and common sense. The delay of 10 us is the same as is +used by the default spi_transfer_one_message() function in spi.c. +[gregory: rebased on for-5.5 from spi tree] +Fixes: 8090d6d1a415 ("spi: atmel: Refactor spi-atmel to use SPI framework queue") +Signed-off-by: Mans Rullgard <mans@mansr.com> +Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com> +Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com> +Link: https://lore.kernel.org/r/20191018153504.4249-1-gregory.clement@bootlin.com +Signed-off-by: Mark Brown <broonie@kernel.org> +[bwhh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/spi/spi-atmel.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -242,7 +242,6 @@ struct atmel_spi { + struct atmel_spi_dma dma; + + bool keep_cs; +- bool cs_active; + }; + + /* Controller-specific per-slave state */ +@@ -1190,11 +1189,9 @@ static int atmel_spi_one_transfer(struct + &msg->transfers)) { + as->keep_cs = true; + } else { +- as->cs_active = !as->cs_active; +- if (as->cs_active) +- cs_activate(as, msg->spi); +- else +- cs_deactivate(as, msg->spi); ++ cs_deactivate(as, msg->spi); ++ udelay(10); ++ cs_activate(as, msg->spi); + } + } + +@@ -1217,7 +1214,6 @@ static int atmel_spi_transfer_one_messag + atmel_spi_lock(as); + cs_activate(as, spi); + +- as->cs_active = true; + as->keep_cs = false; + + msg->status = 0; diff --git a/queue-3.16/staging-rtl8192e-fix-potential-use-after-free.patch b/queue-3.16/staging-rtl8192e-fix-potential-use-after-free.patch new file mode 100644 index 00000000..899b9c55 --- /dev/null +++ b/queue-3.16/staging-rtl8192e-fix-potential-use-after-free.patch @@ -0,0 +1,43 @@ +From: Pan Bian <bianpan2016@163.com> +Date: Tue, 5 Nov 2019 22:49:11 +0800 +Subject: staging: rtl8192e: fix potential use after free + +commit b7aa39a2ed0112d07fc277ebd24a08a7b2368ab9 upstream. + +The variable skb is released via kfree_skb() when the return value of +_rtl92e_tx is not zero. However, after that, skb is accessed again to +read its length, which may result in a use after free bug. This patch +fixes the bug by moving the release operation to where skb is never +used later. + +Signed-off-by: Pan Bian <bianpan2016@163.com> +Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> +Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c ++++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c +@@ -1884,8 +1884,6 @@ void rtl8192_hard_data_xmit(struct sk_bu + memcpy((unsigned char *)(skb->cb), &dev, sizeof(dev)); + skb_push(skb, priv->rtllib->tx_headroom); + ret = rtl8192_tx(dev, skb); +- if (ret != 0) +- kfree_skb(skb); + + if (queue_index != MGNT_QUEUE) { + priv->rtllib->stats.tx_bytes += (skb->len - +@@ -1893,6 +1891,9 @@ void rtl8192_hard_data_xmit(struct sk_bu + priv->rtllib->stats.tx_packets++; + } + ++ if (ret != 0) ++ kfree_skb(skb); ++ + return; + } + diff --git a/queue-3.16/sunrpc-fix-crash-when-cache_head-become-valid-before-update.patch b/queue-3.16/sunrpc-fix-crash-when-cache_head-become-valid-before-update.patch new file mode 100644 index 00000000..61ca33e8 --- /dev/null +++ b/queue-3.16/sunrpc-fix-crash-when-cache_head-become-valid-before-update.patch @@ -0,0 +1,119 @@ +From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> +Date: Tue, 1 Oct 2019 11:03:59 +0300 +Subject: sunrpc: fix crash when cache_head become valid before update + +commit 5fcaf6982d1167f1cd9b264704f6d1ef4c505d54 upstream. + +I was investigating a crash in our Virtuozzo7 kernel which happened in +in svcauth_unix_set_client. I found out that we access m_client field +in ip_map structure, which was received from sunrpc_cache_lookup (we +have a bit older kernel, now the code is in sunrpc_cache_add_entry), and +these field looks uninitialized (m_client == 0x74 don't look like a +pointer) but in the cache_head in flags we see 0x1 which is CACHE_VALID. + +It looks like the problem appeared from our previous fix to sunrpc (1): +commit 4ecd55ea0742 ("sunrpc: fix cache_head leak due to queued +request") + +And we've also found a patch already fixing our patch (2): +commit d58431eacb22 ("sunrpc: don't mark uninitialised items as VALID.") + +Though the crash is eliminated, I think the core of the problem is not +completely fixed: + +Neil in the patch (2) makes cache_head CACHE_NEGATIVE, before +cache_fresh_locked which was added in (1) to fix crash. These way +cache_is_valid won't say the cache is valid anymore and in +svcauth_unix_set_client the function cache_check will return error +instead of 0, and we don't count entry as initialized. + +But it looks like we need to remove cache_fresh_locked completely in +sunrpc_cache_lookup: + +In (1) we've only wanted to make cache_fresh_unlocked->cache_dequeue so +that cache_requests with no readers also release corresponding +cache_head, to fix their leak. We with Vasily were not sure if +cache_fresh_locked and cache_fresh_unlocked should be used in pair or +not, so we've guessed to use them in pair. + +Now we see that we don't want the CACHE_VALID bit set here by +cache_fresh_locked, as "valid" means "initialized" and there is no +initialization in sunrpc_cache_add_entry. Both expiry_time and +last_refresh are not used in cache_fresh_unlocked code-path and also not +required for the initial fix. + +So to conclude cache_fresh_locked was called by mistake, and we can just +safely remove it instead of crutching it with CACHE_NEGATIVE. It looks +ideologically better for me. Hope I don't miss something here. + +Here is our crash backtrace: +[13108726.326291] BUG: unable to handle kernel NULL pointer dereference at 0000000000000074 +[13108726.326365] IP: [<ffffffffc01f79eb>] svcauth_unix_set_client+0x2ab/0x520 [sunrpc] +[13108726.326448] PGD 0 +[13108726.326468] Oops: 0002 [#1] SMP +[13108726.326497] Modules linked in: nbd isofs xfs loop kpatch_cumulative_81_0_r1(O) xt_physdev nfnetlink_queue bluetooth rfkill ip6table_nat nf_nat_ipv6 ip_vs_wrr ip_vs_wlc ip_vs_sh nf_conntrack_netlink ip_vs_sed ip_vs_pe_sip nf_conntrack_sip ip_vs_nq ip_vs_lc ip_vs_lblcr ip_vs_lblc ip_vs_ftp ip_vs_dh nf_nat_ftp nf_conntrack_ftp iptable_raw xt_recent nf_log_ipv6 xt_hl ip6t_rt nf_log_ipv4 nf_log_common xt_LOG xt_limit xt_TCPMSS xt_tcpmss vxlan ip6_udp_tunnel udp_tunnel xt_statistic xt_NFLOG nfnetlink_log dummy xt_mark xt_REDIRECT nf_nat_redirect raw_diag udp_diag tcp_diag inet_diag netlink_diag af_packet_diag unix_diag rpcsec_gss_krb5 xt_addrtype ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 ebtable_nat ebtable_broute nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_mangle ip6table_raw nfsv4 +[13108726.327173] dns_resolver cls_u32 binfmt_misc arptable_filter arp_tables ip6table_filter ip6_tables devlink fuse_kio_pcs ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_nat iptable_nat nf_nat_ipv4 xt_comment nf_conntrack_ipv4 nf_defrag_ipv4 xt_wdog_tmo xt_multiport bonding xt_set xt_conntrack iptable_filter iptable_mangle kpatch(O) ebtable_filter ebt_among ebtables ip_set_hash_ip ip_set nfnetlink vfat fat skx_edac intel_powerclamp coretemp intel_rapl iosf_mbi kvm_intel kvm irqbypass fuse pcspkr ses enclosure joydev sg mei_me hpwdt hpilo lpc_ich mei ipmi_si shpchp ipmi_devintf ipmi_msghandler xt_ipvs acpi_power_meter ip_vs_rr nfsv3 nfsd auth_rpcgss nfs_acl nfs lockd grace fscache nf_nat cls_fw sch_htb sch_cbq sch_sfq ip_vs em_u32 nf_conntrack tun br_netfilter veth overlay ip6_vzprivnet ip6_vznetstat ip_vznetstat +[13108726.327817] ip_vzprivnet vziolimit vzevent vzlist vzstat vznetstat vznetdev vzmon vzdev bridge pio_kaio pio_nfs pio_direct pfmt_raw pfmt_ploop1 ploop ip_tables ext4 mbcache jbd2 sd_mod crc_t10dif crct10dif_generic mgag200 i2c_algo_bit drm_kms_helper scsi_transport_iscsi 8021q syscopyarea sysfillrect garp sysimgblt fb_sys_fops mrp stp ttm llc bnx2x crct10dif_pclmul crct10dif_common crc32_pclmul crc32c_intel drm dm_multipath ghash_clmulni_intel uas aesni_intel lrw gf128mul glue_helper ablk_helper cryptd tg3 smartpqi scsi_transport_sas mdio libcrc32c i2c_core usb_storage ptp pps_core wmi sunrpc dm_mirror dm_region_hash dm_log dm_mod [last unloaded: kpatch_cumulative_82_0_r1] +[13108726.328403] CPU: 35 PID: 63742 Comm: nfsd ve: 51332 Kdump: loaded Tainted: G W O ------------ 3.10.0-862.20.2.vz7.73.29 #1 73.29 +[13108726.328491] Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 10/02/2018 +[13108726.328554] task: ffffa0a6a41b1160 ti: ffffa0c2a74bc000 task.ti: ffffa0c2a74bc000 +[13108726.328610] RIP: 0010:[<ffffffffc01f79eb>] [<ffffffffc01f79eb>] svcauth_unix_set_client+0x2ab/0x520 [sunrpc] +[13108726.328706] RSP: 0018:ffffa0c2a74bfd80 EFLAGS: 00010246 +[13108726.328750] RAX: 0000000000000001 RBX: ffffa0a6183ae000 RCX: 0000000000000000 +[13108726.328811] RDX: 0000000000000074 RSI: 0000000000000286 RDI: ffffa0c2a74bfcf0 +[13108726.328864] RBP: ffffa0c2a74bfe00 R08: ffffa0bab8c22960 R09: 0000000000000001 +[13108726.328916] R10: 0000000000000001 R11: 0000000000000001 R12: ffffa0a32aa7f000 +[13108726.328969] R13: ffffa0a6183afac0 R14: ffffa0c233d88d00 R15: ffffa0c2a74bfdb4 +[13108726.329022] FS: 0000000000000000(0000) GS:ffffa0e17f9c0000(0000) knlGS:0000000000000000 +[13108726.329081] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[13108726.332311] CR2: 0000000000000074 CR3: 00000026a1b28000 CR4: 00000000007607e0 +[13108726.334606] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[13108726.336754] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[13108726.338908] PKRU: 00000000 +[13108726.341047] Call Trace: +[13108726.343074] [<ffffffff8a2c78b4>] ? groups_alloc+0x34/0x110 +[13108726.344837] [<ffffffffc01f5eb4>] svc_set_client+0x24/0x30 [sunrpc] +[13108726.346631] [<ffffffffc01f2ac1>] svc_process_common+0x241/0x710 [sunrpc] +[13108726.348332] [<ffffffffc01f3093>] svc_process+0x103/0x190 [sunrpc] +[13108726.350016] [<ffffffffc07d605f>] nfsd+0xdf/0x150 [nfsd] +[13108726.351735] [<ffffffffc07d5f80>] ? nfsd_destroy+0x80/0x80 [nfsd] +[13108726.353459] [<ffffffff8a2bf741>] kthread+0xd1/0xe0 +[13108726.355195] [<ffffffff8a2bf670>] ? create_kthread+0x60/0x60 +[13108726.356896] [<ffffffff8a9556dd>] ret_from_fork_nospec_begin+0x7/0x21 +[13108726.358577] [<ffffffff8a2bf670>] ? create_kthread+0x60/0x60 +[13108726.360240] Code: 4c 8b 45 98 0f 8e 2e 01 00 00 83 f8 fe 0f 84 76 fe ff ff 85 c0 0f 85 2b 01 00 00 49 8b 50 40 b8 01 00 00 00 48 89 93 d0 1a 00 00 <f0> 0f c1 02 83 c0 01 83 f8 01 0f 8e 53 02 00 00 49 8b 44 24 38 +[13108726.363769] RIP [<ffffffffc01f79eb>] svcauth_unix_set_client+0x2ab/0x520 [sunrpc] +[13108726.365530] RSP <ffffa0c2a74bfd80> +[13108726.367179] CR2: 0000000000000074 + +Fixes: d58431eacb22 ("sunrpc: don't mark uninitialised items as VALID.") +Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com> +Acked-by: NeilBrown <neilb@suse.de> +Signed-off-by: J. Bruce Fields <bfields@redhat.com> +[bwh: Backported to 3.16: cache_fresh_locked() had only 2 parameters here] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/sunrpc/cache.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -50,8 +50,6 @@ static void cache_init(struct cache_head + h->last_refresh = now; + } + +-static inline int cache_is_valid(struct cache_head *h); +-static void cache_fresh_locked(struct cache_head *head, time_t expiry); + static void cache_fresh_unlocked(struct cache_head *head, + struct cache_detail *detail); + +@@ -99,9 +97,6 @@ struct cache_head *sunrpc_cache_lookup(s + *hp = tmp->next; + tmp->next = NULL; + detail->entries --; +- if (cache_is_valid(tmp) == -EAGAIN) +- set_bit(CACHE_NEGATIVE, &tmp->flags); +- cache_fresh_locked(tmp, 0); + freeme = tmp; + break; + } diff --git a/queue-3.16/tcp-fix-rejected-syncookies-due-to-stale-timestamps.patch b/queue-3.16/tcp-fix-rejected-syncookies-due-to-stale-timestamps.patch new file mode 100644 index 00000000..e1de9607 --- /dev/null +++ b/queue-3.16/tcp-fix-rejected-syncookies-due-to-stale-timestamps.patch @@ -0,0 +1,105 @@ +From: Guillaume Nault <gnault@redhat.com> +Date: Fri, 6 Dec 2019 12:38:36 +0100 +Subject: tcp: fix rejected syncookies due to stale timestamps + +commit 04d26e7b159a396372646a480f4caa166d1b6720 upstream. + +If no synflood happens for a long enough period of time, then the +synflood timestamp isn't refreshed and jiffies can advance so much +that time_after32() can't accurately compare them any more. + +Therefore, we can end up in a situation where time_after32(now, +last_overflow + HZ) returns false, just because these two values are +too far apart. In that case, the synflood timestamp isn't updated as +it should be, which can trick tcp_synq_no_recent_overflow() into +rejecting valid syncookies. + +For example, let's consider the following scenario on a system +with HZ=1000: + + * The synflood timestamp is 0, either because that's the timestamp + of the last synflood or, more commonly, because we're working with + a freshly created socket. + + * We receive a new SYN, which triggers synflood protection. Let's say + that this happens when jiffies == 2147484649 (that is, + 'synflood timestamp' + HZ + 2^31 + 1). + + * Then tcp_synq_overflow() doesn't update the synflood timestamp, + because time_after32(2147484649, 1000) returns false. + With: + - 2147484649: the value of jiffies, aka. 'now'. + - 1000: the value of 'last_overflow' + HZ. + + * A bit later, we receive the ACK completing the 3WHS. But + cookie_v[46]_check() rejects it because tcp_synq_no_recent_overflow() + says that we're not under synflood. That's because + time_after32(2147484649, 120000) returns false. + With: + - 2147484649: the value of jiffies, aka. 'now'. + - 120000: the value of 'last_overflow' + TCP_SYNCOOKIE_VALID. + + Of course, in reality jiffies would have increased a bit, but this + condition will last for the next 119 seconds, which is far enough + to accommodate for jiffie's growth. + +Fix this by updating the overflow timestamp whenever jiffies isn't +within the [last_overflow, last_overflow + HZ] range. That shouldn't +have any performance impact since the update still happens at most once +per second. + +Now we're guaranteed to have fresh timestamps while under synflood, so +tcp_synq_no_recent_overflow() can safely use it with time_after32() in +such situations. + +Stale timestamps can still make tcp_synq_no_recent_overflow() return +the wrong verdict when not under synflood. This will be handled in the +next patch. + +For 64 bits architectures, the problem was introduced with the +conversion of ->tw_ts_recent_stamp to 32 bits integer by commit +cca9bab1b72c ("tcp: use monotonic timestamps for PAWS"). +The problem has always been there on 32 bits architectures. + +Fixes: cca9bab1b72c ("tcp: use monotonic timestamps for PAWS") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Guillaume Nault <gnault@redhat.com> +Signed-off-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/linux/time.h | 12 ++++++++++++ + include/net/tcp.h | 2 +- + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/include/linux/time.h ++++ b/include/linux/time.h +@@ -280,4 +280,16 @@ static __always_inline void timespec_add + a->tv_nsec = ns; + } + ++/** ++ * time_between32 - check if a 32-bit timestamp is within a given time range ++ * @t: the time which may be within [l,h] ++ * @l: the lower bound of the range ++ * @h: the higher bound of the range ++ * ++ * time_before32(t, l, h) returns true if @l <= @t <= @h. All operands are ++ * treated as 32-bit integers. ++ * ++ * Equivalent to !(time_before32(@t, @l) || time_after32(@t, @h)). ++ */ ++#define time_between32(t, l, h) ((u32)(h) - (u32)(l) >= (u32)(t) - (u32)(l)) + #endif +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -485,7 +485,7 @@ static inline void tcp_synq_overflow(str + unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; + unsigned long now = jiffies; + +- if (time_after(now, last_overflow + HZ)) ++ if (!time_between32(now, last_overflow, last_overflow + HZ)) + tcp_sk(sk)->rx_opt.ts_recent_stamp = now; + } + diff --git a/queue-3.16/tcp-md5-fix-potential-overestimation-of-tcp-option-space.patch b/queue-3.16/tcp-md5-fix-potential-overestimation-of-tcp-option-space.patch new file mode 100644 index 00000000..8b89cd42 --- /dev/null +++ b/queue-3.16/tcp-md5-fix-potential-overestimation-of-tcp-option-space.patch @@ -0,0 +1,43 @@ +From: Eric Dumazet <edumazet@google.com> +Date: Thu, 5 Dec 2019 10:10:15 -0800 +Subject: tcp: md5: fix potential overestimation of TCP option space + +commit 9424e2e7ad93ffffa88f882c9bc5023570904b55 upstream. + +Back in 2008, Adam Langley fixed the corner case of packets for flows +having all of the following options : MD5 TS SACK + +Since MD5 needs 20 bytes, and TS needs 12 bytes, no sack block +can be cooked from the remaining 8 bytes. + +tcp_established_options() correctly sets opts->num_sack_blocks +to zero, but returns 36 instead of 32. + +This means TCP cooks packets with 4 extra bytes at the end +of options, containing unitialized bytes. + +Fixes: 33ad798c924b ("tcp: options clean up") +Signed-off-by: Eric Dumazet <edumazet@google.com> +Reported-by: syzbot <syzkaller@googlegroups.com> +Acked-by: Neal Cardwell <ncardwell@google.com> +Acked-by: Soheil Hassas Yeganeh <soheil@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + net/ipv4/tcp_output.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -680,8 +680,9 @@ static unsigned int tcp_established_opti + min_t(unsigned int, eff_sacks, + (remaining - TCPOLEN_SACK_BASE_ALIGNED) / + TCPOLEN_SACK_PERBLOCK); +- size += TCPOLEN_SACK_BASE_ALIGNED + +- opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; ++ if (likely(opts->num_sack_blocks)) ++ size += TCPOLEN_SACK_BASE_ALIGNED + ++ opts->num_sack_blocks * TCPOLEN_SACK_PERBLOCK; + } + + return size; diff --git a/queue-3.16/tcp-protect-accesses-to-.ts_recent_stamp-with-read-write-_once.patch b/queue-3.16/tcp-protect-accesses-to-.ts_recent_stamp-with-read-write-_once.patch new file mode 100644 index 00000000..54d00b14 --- /dev/null +++ b/queue-3.16/tcp-protect-accesses-to-.ts_recent_stamp-with-read-write-_once.patch @@ -0,0 +1,49 @@ +From: Guillaume Nault <gnault@redhat.com> +Date: Fri, 6 Dec 2019 12:38:49 +0100 +Subject: tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE() + +commit 721c8dafad26ccfa90ff659ee19755e3377b829d upstream. + +Syncookies borrow the ->rx_opt.ts_recent_stamp field to store the +timestamp of the last synflood. Protect them with READ_ONCE() and +WRITE_ONCE() since reads and writes aren't serialised. + +Use of .rx_opt.ts_recent_stamp for storing the synflood timestamp was +introduced by a0f82f64e269 ("syncookies: remove last_synq_overflow from +struct tcp_sock"). But unprotected accesses were already there when +timestamp was stored in .last_synq_overflow. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Guillaume Nault <gnault@redhat.com> +Signed-off-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: Use ACCESS_ONCE() instead of {READ,WRITE}_ONCE()] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/net/tcp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -482,17 +482,17 @@ struct sock *cookie_v4_check(struct sock + */ + static inline void tcp_synq_overflow(struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = ACCESS_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + unsigned long now = jiffies; + + if (!time_between32(now, last_overflow, last_overflow + HZ)) +- tcp_sk(sk)->rx_opt.ts_recent_stamp = now; ++ ACCESS_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp) = now; + } + + /* syncookies: no recent synqueue overflow on this listening socket? */ + static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) + { +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long last_overflow = ACCESS_ONCE(tcp_sk(sk)->rx_opt.ts_recent_stamp); + + return time_after(jiffies, last_overflow + TCP_SYNCOOKIE_VALID); + } diff --git a/queue-3.16/tcp-syncookies-extend-validity-range.patch b/queue-3.16/tcp-syncookies-extend-validity-range.patch new file mode 100644 index 00000000..eac74a71 --- /dev/null +++ b/queue-3.16/tcp-syncookies-extend-validity-range.patch @@ -0,0 +1,91 @@ +From: Eric Dumazet <edumazet@google.com> +Date: Thu, 14 May 2015 14:26:56 -0700 +Subject: tcp: syncookies: extend validity range + +commit 264ea103a7473f51aced838e68ed384ea2c759f5 upstream. + +Now we allow storing more request socks per listener, we might +hit syncookie mode less often and hit following bug in our stack : + +When we send a burst of syncookies, then exit this mode, +tcp_synq_no_recent_overflow() can return false if the ACK packets coming +from clients are coming three seconds after the end of syncookie +episode. + +This is a way too strong requirement and conflicts with rest of +syncookie code which allows ACK to be aged up to 2 minutes. + +Perfectly valid ACK packets are dropped just because clients might be +in a crowded wifi environment or on another planet. + +So let's fix this, and also change tcp_synq_overflow() to not +dirty a cache line for every syncookie we send, as we are under attack. + +Signed-off-by: Eric Dumazet <edumazet@google.com> +Acked-by: Florian Westphal <fw@strlen.de> +Acked-by: Yuchung Cheng <ycheng@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + include/net/tcp.h | 38 ++++++++++++++++++++++++-------------- + 1 file changed, 24 insertions(+), 14 deletions(-) + +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -326,18 +326,6 @@ static inline bool tcp_too_many_orphans( + + bool tcp_check_oom(struct sock *sk, int shift); + +-/* syncookies: remember time of last synqueue overflow */ +-static inline void tcp_synq_overflow(struct sock *sk) +-{ +- tcp_sk(sk)->rx_opt.ts_recent_stamp = jiffies; +-} +- +-/* syncookies: no recent synqueue overflow on this listening socket? */ +-static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) +-{ +- unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; +- return time_after(jiffies, last_overflow + TCP_TIMEOUT_FALLBACK); +-} + + extern struct proto tcp_prot; + +@@ -485,13 +473,35 @@ struct sock *cookie_v4_check(struct sock + * i.e. a sent cookie is valid only at most for 2*60 seconds (or less if + * the counter advances immediately after a cookie is generated). + */ +-#define MAX_SYNCOOKIE_AGE 2 ++#define MAX_SYNCOOKIE_AGE 2 ++#define TCP_SYNCOOKIE_PERIOD (60 * HZ) ++#define TCP_SYNCOOKIE_VALID (MAX_SYNCOOKIE_AGE * TCP_SYNCOOKIE_PERIOD) ++ ++/* syncookies: remember time of last synqueue overflow ++ * But do not dirty this field too often (once per second is enough) ++ */ ++static inline void tcp_synq_overflow(struct sock *sk) ++{ ++ unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ unsigned long now = jiffies; ++ ++ if (time_after(now, last_overflow + HZ)) ++ tcp_sk(sk)->rx_opt.ts_recent_stamp = now; ++} ++ ++/* syncookies: no recent synqueue overflow on this listening socket? */ ++static inline bool tcp_synq_no_recent_overflow(const struct sock *sk) ++{ ++ unsigned long last_overflow = tcp_sk(sk)->rx_opt.ts_recent_stamp; ++ ++ return time_after(jiffies, last_overflow + TCP_SYNCOOKIE_VALID); ++} + + static inline u32 tcp_cookie_time(void) + { + u64 val = get_jiffies_64(); + +- do_div(val, 60 * HZ); ++ do_div(val, TCP_SYNCOOKIE_PERIOD); + return val; + } + diff --git a/queue-3.16/tools-power-cpupower-fix-initializer-override-in-hsw_ext_cstates.patch b/queue-3.16/tools-power-cpupower-fix-initializer-override-in-hsw_ext_cstates.patch new file mode 100644 index 00000000..a471d5a6 --- /dev/null +++ b/queue-3.16/tools-power-cpupower-fix-initializer-override-in-hsw_ext_cstates.patch @@ -0,0 +1,55 @@ +From: Nathan Chancellor <natechancellor@gmail.com> +Date: Fri, 27 Sep 2019 09:26:42 -0700 +Subject: tools/power/cpupower: Fix initializer override in hsw_ext_cstates + +commit 7e5705c635ecfccde559ebbbe1eaf05b5cc60529 upstream. + +When building cpupower with clang, the following warning appears: + + utils/idle_monitor/hsw_ext_idle.c:42:16: warning: initializer overrides + prior initialization of this subobject [-Winitializer-overrides] + .desc = N_("Processor Package C2"), + ^~~~~~~~~~~~~~~~~~~~~~ + ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_' + #define N_(String) gettext_noop(String) + ^~~~~~ + ./utils/helpers/helpers.h:23:30: note: expanded from macro + 'gettext_noop' + #define gettext_noop(String) String + ^~~~~~ + utils/idle_monitor/hsw_ext_idle.c:41:16: note: previous initialization + is here + .desc = N_("Processor Package C9"), + ^~~~~~~~~~~~~~~~~~~~~~ + ./utils/helpers/helpers.h:25:33: note: expanded from macro 'N_' + #define N_(String) gettext_noop(String) + ^~~~~~ + ./utils/helpers/helpers.h:23:30: note: expanded from macro + 'gettext_noop' + #define gettext_noop(String) String + ^~~~~~ + 1 warning generated. + +This appears to be a copy and paste or merge mistake because the name +and id fields both have PC9 in them, not PC2. Remove the second +assignment to fix the warning. + +Fixes: 7ee767b69b68 ("cpupower: Add Haswell family 0x45 specific idle monitor to show PC8,9,10 states") +Link: https://github.com/ClangBuiltLinux/linux/issues/718 +Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> +Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c ++++ b/tools/power/cpupower/utils/idle_monitor/hsw_ext_idle.c +@@ -40,7 +40,6 @@ static cstate_t hsw_ext_cstates[HSW_EXT_ + { + .name = "PC9", + .desc = N_("Processor Package C9"), +- .desc = N_("Processor Package C2"), + .id = PC9, + .range = RANGE_PACKAGE, + .get_count_percent = hsw_ext_get_count_percent, diff --git a/queue-3.16/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch b/queue-3.16/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch new file mode 100644 index 00000000..fe465c94 --- /dev/null +++ b/queue-3.16/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch @@ -0,0 +1,30 @@ +From: Peng Fan <peng.fan@nxp.com> +Date: Thu, 7 Nov 2019 06:42:53 +0000 +Subject: tty: serial: imx: use the sg count from dma_map_sg + +commit 596fd8dffb745afcebc0ec6968e17fe29f02044c upstream. + +The dmaengine_prep_slave_sg needs to use sg count returned +by dma_map_sg, not use sport->dma_tx_nents, because the return +value of dma_map_sg is not always same with "nents". + +Fixes: b4cdc8f61beb ("serial: imx: add DMA support for imx6q") +Signed-off-by: Peng Fan <peng.fan@nxp.com> +Link: https://lore.kernel.org/r/1573108875-26530-1-git-send-email-peng.fan@nxp.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -541,7 +541,7 @@ static void imx_dma_tx(struct imx_port * + dev_err(dev, "DMA mapping error for TX.\n"); + return; + } +- desc = dmaengine_prep_slave_sg(chan, sgl, sport->dma_tx_nents, ++ desc = dmaengine_prep_slave_sg(chan, sgl, ret, + DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT); + if (!desc) { + dev_err(dev, "We cannot prepare for the TX slave dma!\n"); diff --git a/queue-3.16/tty-serial-msm_serial-fix-flow-control.patch b/queue-3.16/tty-serial-msm_serial-fix-flow-control.patch new file mode 100644 index 00000000..90247a50 --- /dev/null +++ b/queue-3.16/tty-serial-msm_serial-fix-flow-control.patch @@ -0,0 +1,65 @@ +From: Jeffrey Hugo <jeffrey.l.hugo@gmail.com> +Date: Mon, 21 Oct 2019 08:46:16 -0700 +Subject: tty: serial: msm_serial: Fix flow control + +commit b027ce258369cbfa88401a691c23dad01deb9f9b upstream. + +hci_qca interfaces to the wcn3990 via a uart_dm on the msm8998 mtp and +Lenovo Miix 630 laptop. As part of initializing the wcn3990, hci_qca +disables flow, configures the uart baudrate, and then reenables flow - at +which point an event is expected to be received over the uart from the +wcn3990. It is observed that this event comes after the baudrate change +but before hci_qca re-enables flow. This is unexpected, and is a result of +msm_reset() being broken. + +According to the uart_dm hardware documentation, it is recommended that +automatic hardware flow control be enabled by setting RX_RDY_CTL. Auto +hw flow control will manage RFR based on the configured watermark. When +there is space to receive data, the hw will assert RFR. When the watermark +is hit, the hw will de-assert RFR. + +The hardware documentation indicates that RFR can me manually managed via +CR when RX_RDY_CTL is not set. SET_RFR asserts RFR, and RESET_RFR +de-asserts RFR. + +msm_reset() is broken because after resetting the hardware, it +unconditionally asserts RFR via SET_RFR. This enables flow regardless of +the current configuration, and would undo a previous flow disable +operation. It should instead de-assert RFR via RESET_RFR to block flow +until the hardware is reconfigured. msm_serial should rely on the client +to specify that flow should be enabled, either via mctrl() or the termios +structure, and only assert RFR in response to those triggers. + +Fixes: 04896a77a97b ("msm_serial: serial driver for MSM7K onboard serial peripheral.") +Signed-off-by: Jeffrey Hugo <jeffrey.l.hugo@gmail.com> +Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> +Reviewed-by: Andy Gross <agross@kernel.org> +Link: https://lore.kernel.org/r/20191021154616.25457-1-jeffrey.l.hugo@gmail.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/msm_serial.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -316,6 +316,7 @@ static unsigned int msm_get_mctrl(struct + static void msm_reset(struct uart_port *port) + { + struct msm_port *msm_port = UART_TO_MSM(port); ++ unsigned int mr; + + /* reset everything */ + msm_write(port, UART_CR_CMD_RESET_RX, UART_CR); +@@ -323,7 +324,10 @@ static void msm_reset(struct uart_port * + msm_write(port, UART_CR_CMD_RESET_ERR, UART_CR); + msm_write(port, UART_CR_CMD_RESET_BREAK_INT, UART_CR); + msm_write(port, UART_CR_CMD_RESET_CTS, UART_CR); +- msm_write(port, UART_CR_CMD_SET_RFR, UART_CR); ++ msm_write(port, UART_CR_CMD_RESET_RFR, UART_CR); ++ mr = msm_read(port, UART_MR1); ++ mr &= ~UART_MR1_RX_RDY_CTL; ++ msm_write(port, mr, UART_MR1); + + /* Disable DM modes */ + if (msm_port->is_uartdm) diff --git a/queue-3.16/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch b/queue-3.16/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch new file mode 100644 index 00000000..b1317a80 --- /dev/null +++ b/queue-3.16/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch @@ -0,0 +1,62 @@ +From: Peng Fan <peng.fan@nxp.com> +Date: Wed, 13 Nov 2019 05:37:42 +0000 +Subject: tty: serial: pch_uart: correct usage of dma_unmap_sg + +commit 74887542fdcc92ad06a48c0cca17cdf09fc8aa00 upstream. + +Per Documentation/DMA-API-HOWTO.txt, +To unmap a scatterlist, just call: + dma_unmap_sg(dev, sglist, nents, direction); + +.. note:: + + The 'nents' argument to the dma_unmap_sg call must be + the _same_ one you passed into the dma_map_sg call, + it should _NOT_ be the 'count' value _returned_ from the + dma_map_sg call. + +However in the driver, priv->nent is directly assigned with value +returned from dma_map_sg, and dma_unmap_sg use priv->nent for unmap, +this breaks the API usage. + +So introduce a new entry orig_nent to remember 'nents'. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Signed-off-by: Peng Fan <peng.fan@nxp.com> +Link: https://lore.kernel.org/r/1573623259-6339-1-git-send-email-peng.fan@nxp.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/serial/pch_uart.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -251,6 +251,7 @@ struct eg20t_port { + struct dma_chan *chan_rx; + struct scatterlist *sg_tx_p; + int nent; ++ int orig_nent; + struct scatterlist sg_rx; + int tx_dma_use; + void *rx_buf_virt; +@@ -803,9 +804,10 @@ static void pch_dma_tx_complete(void *ar + } + xmit->tail &= UART_XMIT_SIZE - 1; + async_tx_ack(priv->desc_tx); +- dma_unmap_sg(port->dev, sg, priv->nent, DMA_TO_DEVICE); ++ dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE); + priv->tx_dma_use = 0; + priv->nent = 0; ++ priv->orig_nent = 0; + kfree(priv->sg_tx_p); + pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_TX_INT); + } +@@ -1030,6 +1032,7 @@ static unsigned int dma_handle_tx(struct + dev_err(priv->port.dev, "%s:dma_map_sg Failed\n", __func__); + return 0; + } ++ priv->orig_nent = num; + priv->nent = nent; + + for (i = 0; i < nent; i++, sg++) { diff --git a/queue-3.16/tty-vt-keyboard-reject-invalid-keycodes.patch b/queue-3.16/tty-vt-keyboard-reject-invalid-keycodes.patch new file mode 100644 index 00000000..fcef3946 --- /dev/null +++ b/queue-3.16/tty-vt-keyboard-reject-invalid-keycodes.patch @@ -0,0 +1,48 @@ +From: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Date: Fri, 22 Nov 2019 12:42:20 -0800 +Subject: tty: vt: keyboard: reject invalid keycodes + +commit b2b2dd71e0859436d4e05b2f61f86140250ed3f8 upstream. + +Do not try to handle keycodes that are too big, otherwise we risk doing +out-of-bounds writes: + +BUG: KASAN: global-out-of-bounds in clear_bit include/asm-generic/bitops-instrumented.h:56 [inline] +BUG: KASAN: global-out-of-bounds in kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] +BUG: KASAN: global-out-of-bounds in kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 +Write of size 8 at addr ffffffff89a1b2d8 by task syz-executor108/1722 +... + kbd_keycode drivers/tty/vt/keyboard.c:1411 [inline] + kbd_event+0xe6b/0x3790 drivers/tty/vt/keyboard.c:1495 + input_to_handler+0x3b6/0x4c0 drivers/input/input.c:118 + input_pass_values.part.0+0x2e3/0x720 drivers/input/input.c:145 + input_pass_values drivers/input/input.c:949 [inline] + input_set_keycode+0x290/0x320 drivers/input/input.c:954 + evdev_handle_set_keycode_v2+0xc4/0x120 drivers/input/evdev.c:882 + evdev_do_ioctl drivers/input/evdev.c:1150 [inline] + +In this case we were dealing with a fuzzed HID device that declared over +12K buttons, and while HID layer should not be reporting to us such big +keycodes, we should also be defensive and reject invalid data ourselves as +well. + +Reported-by: syzbot+19340dff067c2d3835c0@syzkaller.appspotmail.com +Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> +Link: https://lore.kernel.org/r/20191122204220.GA129459@dtor-ws +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/tty/vt/keyboard.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/vt/keyboard.c ++++ b/drivers/tty/vt/keyboard.c +@@ -1358,7 +1358,7 @@ static void kbd_event(struct input_handl + + if (event_type == EV_MSC && event_code == MSC_RAW && HW_RAW(handle->dev)) + kbd_rawcode(value); +- if (event_type == EV_KEY) ++ if (event_type == EV_KEY && event_code <= KEY_MAX) + kbd_keycode(event_code, value, HW_RAW(handle->dev)); + + spin_unlock(&kbd_event_lock); diff --git a/queue-3.16/usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch b/queue-3.16/usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch new file mode 100644 index 00000000..5795504a --- /dev/null +++ b/queue-3.16/usb-allow-usb-device-to-be-warm-reset-in-suspended-state.patch @@ -0,0 +1,100 @@ +From: Kai-Heng Feng <kai.heng.feng@canonical.com> +Date: Wed, 6 Nov 2019 14:27:10 +0800 +Subject: usb: Allow USB device to be warm reset in suspended state + +commit e76b3bf7654c3c94554c24ba15a3d105f4006c80 upstream. + +On Dell WD15 dock, sometimes USB ethernet cannot be detected after plugging +cable to the ethernet port, the hub and roothub get runtime resumed and +runtime suspended immediately: +... +[ 433.315169] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_resume: 0 +[ 433.315204] usb usb4: usb auto-resume +[ 433.315226] hub 4-0:1.0: hub_resume +[ 433.315239] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10202e2, return 0x10343 +[ 433.315264] usb usb4-port1: status 0343 change 0001 +[ 433.315279] xhci_hcd 0000:3a:00.0: clear port1 connect change, portsc: 0x10002e2 +[ 433.315293] xhci_hcd 0000:3a:00.0: Get port status 4-2 read: 0x2a0, return 0x2a0 +[ 433.317012] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. +[ 433.422282] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10002e2, return 0x343 +[ 433.422307] usb usb4-port1: do warm reset +[ 433.422311] usb 4-1: device reset not allowed in state 8 +[ 433.422339] hub 4-0:1.0: state 7 ports 2 chg 0002 evt 0000 +[ 433.422346] xhci_hcd 0000:3a:00.0: Get port status 4-1 read: 0x10002e2, return 0x343 +[ 433.422356] usb usb4-port1: do warm reset +[ 433.422358] usb 4-1: device reset not allowed in state 8 +[ 433.422428] xhci_hcd 0000:3a:00.0: set port remote wake mask, actual port 0 status = 0xf0002e2 +[ 433.422455] xhci_hcd 0000:3a:00.0: set port remote wake mask, actual port 1 status = 0xe0002a0 +[ 433.422465] hub 4-0:1.0: hub_suspend +[ 433.422475] usb usb4: bus auto-suspend, wakeup 1 +[ 433.426161] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. +[ 433.466209] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.510204] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.554051] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.598235] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.642154] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.686204] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.730205] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.774203] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.818207] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.862040] xhci_hcd 0000:3a:00.0: port 0 polling in bus suspend, waiting +[ 433.862053] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. +[ 433.862077] xhci_hcd 0000:3a:00.0: xhci_suspend: stopping port polling. +[ 433.862096] xhci_hcd 0000:3a:00.0: // Setting command ring address to 0x8578fc001 +[ 433.862312] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_suspend: 0 +[ 433.862445] xhci_hcd 0000:3a:00.0: PME# enabled +[ 433.902376] xhci_hcd 0000:3a:00.0: restoring config space at offset 0xc (was 0x0, writing 0x20) +[ 433.902395] xhci_hcd 0000:3a:00.0: restoring config space at offset 0x4 (was 0x100000, writing 0x100403) +[ 433.902490] xhci_hcd 0000:3a:00.0: PME# disabled +[ 433.902504] xhci_hcd 0000:3a:00.0: enabling bus mastering +[ 433.902547] xhci_hcd 0000:3a:00.0: // Setting command ring address to 0x8578fc001 +[ 433.902649] pcieport 0000:00:1b.0: PME: Spurious native interrupt! +[ 433.902839] xhci_hcd 0000:3a:00.0: Port change event, 4-1, id 3, portsc: 0xb0202e2 +[ 433.902842] xhci_hcd 0000:3a:00.0: resume root hub +[ 433.902845] xhci_hcd 0000:3a:00.0: handle_port_status: starting port polling. +[ 433.902877] xhci_hcd 0000:3a:00.0: xhci_resume: starting port polling. +[ 433.902889] xhci_hcd 0000:3a:00.0: xhci_hub_status_data: stopping port polling. +[ 433.902891] xhci_hcd 0000:3a:00.0: hcd_pci_runtime_resume: 0 +[ 433.902919] usb usb4: usb wakeup-resume +[ 433.902942] usb usb4: usb auto-resume +[ 433.902966] hub 4-0:1.0: hub_resume +... + +As Mathias pointed out, the hub enters Cold Attach Status state and +requires a warm reset. However usb_reset_device() bails out early when +the device is in suspended state, as its callers port_event() and +hub_event() don't always resume the device. + +Since there's nothing wrong to reset a suspended device, allow +usb_reset_device() to do so to solve the issue. + +Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> +Acked-by: Alan Stern <stern@rowland.harvard.edu> +Link: https://lore.kernel.org/r/20191106062710.29880-1-kai.heng.feng@canonical.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/core/hub.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5535,7 +5535,7 @@ re_enumerate_no_bos: + + /** + * usb_reset_device - warn interface drivers and perform a USB port reset +- * @udev: device to reset (not in SUSPENDED or NOTATTACHED state) ++ * @udev: device to reset (not in NOTATTACHED state) + * + * Warns all drivers bound to registered interfaces (using their pre_reset + * method), performs the port reset, and then lets the drivers know that +@@ -5563,8 +5563,7 @@ int usb_reset_device(struct usb_device * + struct usb_host_config *config = udev->actconfig; + struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); + +- if (udev->state == USB_STATE_NOTATTACHED || +- udev->state == USB_STATE_SUSPENDED) { ++ if (udev->state == USB_STATE_NOTATTACHED) { + dev_dbg(&udev->dev, "device reset not allowed in state %d\n", + udev->state); + return -EINVAL; diff --git a/queue-3.16/usb-documentation-flags-on-usb-storage-versus-uas.patch b/queue-3.16/usb-documentation-flags-on-usb-storage-versus-uas.patch new file mode 100644 index 00000000..4f5b7824 --- /dev/null +++ b/queue-3.16/usb-documentation-flags-on-usb-storage-versus-uas.patch @@ -0,0 +1,61 @@ +From: Oliver Neukum <oneukum@suse.com> +Date: Thu, 14 Nov 2019 12:27:58 +0100 +Subject: USB: documentation: flags on usb-storage versus UAS + +commit 65cc8bf99349f651a0a2cee69333525fe581f306 upstream. + +Document which flags work storage, UAS or both + +Signed-off-by: Oliver Neukum <oneukum@suse.com> +Link: https://lore.kernel.org/r/20191114112758.32747-4-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: Drop change relating to ALWAYS_SYNC] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + .../kernel-parameters.txt | 22 ++++++++++--------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -3730,13 +3730,13 @@ bytes respectively. Such letter suffixes + Flags is a set of characters, each corresponding + to a common usb-storage quirk flag as follows: + a = SANE_SENSE (collect more than 18 bytes +- of sense data); ++ of sense data, not on uas); + b = BAD_SENSE (don't collect more than 18 +- bytes of sense data); ++ bytes of sense data, not on uas); + c = FIX_CAPACITY (decrease the reported + device capacity by one sector); + d = NO_READ_DISC_INFO (don't use +- READ_DISC_INFO command); ++ READ_DISC_INFO command, not on uas); + e = NO_READ_CAPACITY_16 (don't use + READ_CAPACITY_16 command); + f = NO_REPORT_OPCODES (don't use report opcodes +@@ -3751,17 +3751,18 @@ bytes respectively. Such letter suffixes + j = NO_REPORT_LUNS (don't use report luns + command, uas only); + l = NOT_LOCKABLE (don't try to lock and +- unlock ejectable media); ++ unlock ejectable media, not on uas); + m = MAX_SECTORS_64 (don't transfer more +- than 64 sectors = 32 KB at a time); ++ than 64 sectors = 32 KB at a time, ++ not on uas); + n = INITIAL_READ10 (force a retry of the +- initial READ(10) command); ++ initial READ(10) command, not on uas); + o = CAPACITY_OK (accept the capacity +- reported by the device); ++ reported by the device, not on uas); + p = WRITE_CACHE (the device cache is ON +- by default); ++ by default, not on uas); + r = IGNORE_RESIDUE (the device reports +- bogus residue values); ++ bogus residue values, not on uas); + s = SINGLE_LUN (the device has only one + Logical Unit); + t = NO_ATA_1X (don't allow ATA(12) and ATA(16) diff --git a/queue-3.16/usb-gadget-pch_udc-fix-use-after-free.patch b/queue-3.16/usb-gadget-pch_udc-fix-use-after-free.patch new file mode 100644 index 00000000..81aec48f --- /dev/null +++ b/queue-3.16/usb-gadget-pch_udc-fix-use-after-free.patch @@ -0,0 +1,32 @@ +From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> +Date: Wed, 6 Nov 2019 14:28:21 -0600 +Subject: usb: gadget: pch_udc: fix use after free + +commit 66d1b0c0580b7f1b1850ee4423f32ac42afa2e92 upstream. + +Remove pointer dereference after free. + +pci_pool_free doesn't care about contents of td. +It's just a void* for it + +Addresses-Coverity-ID: 1091173 ("Use after free") +Acked-by: Michal Nazarewicz <mina86@mina86.com> +Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> +Link: https://lore.kernel.org/r/20191106202821.GA20347@embeddedor +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +[bwh: Backported to 3.16: adjust filename, context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/gadget/pch_udc.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/gadget/pch_udc.c ++++ b/drivers/usb/gadget/pch_udc.c +@@ -1533,7 +1533,6 @@ static void pch_udc_free_dma_chain(struc + td = phys_to_virt(addr); + addr2 = (dma_addr_t)td->next; + pci_pool_free(dev->data_requests, td, addr); +- td->next = 0x00; + addr = addr2; + } + req->chain_len = 1; diff --git a/queue-3.16/usb-gadget-u_serial-add-missing-port-entry-locking.patch b/queue-3.16/usb-gadget-u_serial-add-missing-port-entry-locking.patch new file mode 100644 index 00000000..65204951 --- /dev/null +++ b/queue-3.16/usb-gadget-u_serial-add-missing-port-entry-locking.patch @@ -0,0 +1,35 @@ +From: =?UTF-8?q?Micha=C5=82=20Miros=C5=82aw?= <mirq-linux@rere.qmqm.pl> +Date: Sat, 10 Aug 2019 10:42:48 +0200 +Subject: usb: gadget: u_serial: add missing port entry locking +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit daf82bd24e308c5a83758047aff1bd81edda4f11 upstream. + +gserial_alloc_line() misses locking (for a release barrier) while +resetting port entry on TTY allocation failure. Fix this. + +Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> +Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Tested-by: Ladislav Michl <ladis@linux-mips.org> +Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> +[bwh: Backported to 3.16: adjust filename] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/gadget/u_serial.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/u_serial.c ++++ b/drivers/usb/gadget/u_serial.c +@@ -1140,8 +1140,10 @@ int gserial_alloc_line(unsigned char *li + __func__, port_num, PTR_ERR(tty_dev)); + + ret = PTR_ERR(tty_dev); ++ mutex_lock(&ports[port_num].lock); + port = ports[port_num].port; + ports[port_num].port = NULL; ++ mutex_unlock(&ports[port_num].lock); + gserial_free_port(port); + goto err; + } diff --git a/queue-3.16/usb-serial-cp201x-support-mark-10-digital-force-gauge.patch b/queue-3.16/usb-serial-cp201x-support-mark-10-digital-force-gauge.patch new file mode 100644 index 00000000..d8a08658 --- /dev/null +++ b/queue-3.16/usb-serial-cp201x-support-mark-10-digital-force-gauge.patch @@ -0,0 +1,30 @@ +From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Date: Mon, 18 Nov 2019 10:21:19 +0100 +Subject: usb-serial: cp201x: support Mark-10 digital force gauge + +commit 347bc8cb26388791c5881a3775cb14a3f765a674 upstream. + +Add support for the Mark-10 digital force gauge device to the cp201x +driver. + +Based on a report and a larger patch from Joel Jennings + +Reported-by: Joel Jennings <joel.jennings@makeitlabs.com> +Acked-by: Johan Hovold <johan@kernel.org> +Link: https://lore.kernel.org/r/20191118092119.GA153852@kroah.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/serial/cp210x.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -121,6 +121,7 @@ static const struct usb_device_id id_tab + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ + { USB_DEVICE(0x10C4, 0x8382) }, /* Cygnal Integrated Products, Inc. */ + { USB_DEVICE(0x10C4, 0x83A8) }, /* Amber Wireless AMB2560 */ ++ { USB_DEVICE(0x10C4, 0x83AA) }, /* Mark-10 Digital Force Gauge */ + { USB_DEVICE(0x10C4, 0x83D8) }, /* DekTec DTA Plus VHF/UHF Booster/Attenuator */ + { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */ + { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 GSM/GPRS Modem */ diff --git a/queue-3.16/usb-serial-ftdi_sio-add-device-ids-for-u-blox-c099-f9p.patch b/queue-3.16/usb-serial-ftdi_sio-add-device-ids-for-u-blox-c099-f9p.patch new file mode 100644 index 00000000..9c6611e1 --- /dev/null +++ b/queue-3.16/usb-serial-ftdi_sio-add-device-ids-for-u-blox-c099-f9p.patch @@ -0,0 +1,51 @@ +From: Fabio D'Urso <fabiodurso@hotmail.it> +Date: Thu, 14 Nov 2019 01:30:53 +0000 +Subject: USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P + +commit c1a1f273d0825774c80896b8deb1c9ea1d0b91e3 upstream. + +This device presents itself as a USB hub with three attached devices: + - An ACM serial port connected to the GPS module (not affected by this + commit) + - An FTDI serial port connected to the GPS module (1546:0502) + - Another FTDI serial port connected to the ODIN-W2 radio module + (1546:0503) + +This commit registers U-Blox's VID and the PIDs of the second and third +devices. + +Datasheet: https://www.u-blox.com/sites/default/files/C099-F9P-AppBoard-Mbed-OS3-FW_UserGuide_%28UBX-18063024%29.pdf + +Signed-off-by: Fabio D'Urso <fabiodurso@hotmail.it> +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/serial/ftdi_sio.c | 3 +++ + drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++ + 2 files changed, 10 insertions(+) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1041,6 +1041,9 @@ static const struct usb_device_id id_tab + /* Sienna devices */ + { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, + { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, ++ /* U-Blox devices */ ++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, ++ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) }, + { } /* Terminating entry */ + }; + +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -1557,3 +1557,10 @@ + */ + #define UNJO_VID 0x22B7 + #define UNJO_ISODEBUG_V1_PID 0x150D ++ ++/* ++ * U-Blox products (http://www.u-blox.com). ++ */ ++#define UBLOX_VID 0x1546 ++#define UBLOX_C099F9P_ZED_PID 0x0502 ++#define UBLOX_C099F9P_ODIN_PID 0x0503 diff --git a/queue-3.16/usb-serial-mos7720-fix-remote-wakeup.patch b/queue-3.16/usb-serial-mos7720-fix-remote-wakeup.patch new file mode 100644 index 00000000..331ed384 --- /dev/null +++ b/queue-3.16/usb-serial-mos7720-fix-remote-wakeup.patch @@ -0,0 +1,36 @@ +From: Johan Hovold <johan@kernel.org> +Date: Thu, 7 Nov 2019 14:21:18 +0100 +Subject: USB: serial: mos7720: fix remote wakeup + +commit ea422312a462696093b5db59d294439796cba4ad upstream. + +The driver was setting the device remote-wakeup feature during probe in +violation of the USB specification (which says it should only be set +just prior to suspending the device). This could potentially waste +power during suspend as well as lead to spurious wakeups. + +Note that USB core would clear the remote-wakeup feature at first +resume. + +Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver") +Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Johan Hovold <johan@kernel.org> +[bwh: Backported to 3.16: adjust context] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/serial/mos7720.c | 4 ---- + 1 file changed, 4 deletions(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1917,10 +1917,6 @@ static int mos7720_startup(struct usb_se + } + } + +- /* setting configuration feature to one */ +- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5000); +- + #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT + if (product == MOSCHIP_DEVICE_ID_7715) { + ret_val = mos7715_parport_init(serial); diff --git a/queue-3.16/usb-serial-mos7840-add-usb-id-to-support-moxa-uport-2210.patch b/queue-3.16/usb-serial-mos7840-add-usb-id-to-support-moxa-uport-2210.patch new file mode 100644 index 00000000..a96b4831 --- /dev/null +++ b/queue-3.16/usb-serial-mos7840-add-usb-id-to-support-moxa-uport-2210.patch @@ -0,0 +1,67 @@ +From: =?UTF-8?q?Pavel=20L=C3=B6bl?= <pavel@loebl.cz> +Date: Fri, 1 Nov 2019 08:01:50 +0100 +Subject: USB: serial: mos7840: add USB ID to support Moxa UPort 2210 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit e696d00e65e81d46e911f24b12e441037bf11b38 upstream. + +Add USB ID for MOXA UPort 2210. This device contains mos7820 but +it passes GPIO0 check implemented by driver and it's detected as +mos7840. Hence product id check is added to force mos7820 mode. + +Signed-off-by: Pavel Löbl <pavel@loebl.cz> +[ johan: rename id defines and add vendor-id check ] +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/serial/mos7840.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -131,11 +131,15 @@ + /* This driver also supports + * ATEN UC2324 device using Moschip MCS7840 + * ATEN UC2322 device using Moschip MCS7820 ++ * MOXA UPort 2210 device using Moschip MCS7820 + */ + #define USB_VENDOR_ID_ATENINTL 0x0557 + #define ATENINTL_DEVICE_ID_UC2324 0x2011 + #define ATENINTL_DEVICE_ID_UC2322 0x7820 + ++#define USB_VENDOR_ID_MOXA 0x110a ++#define MOXA_DEVICE_ID_2210 0x2210 ++ + /* Interrupt Routine Defines */ + + #define SERIAL_IIR_RLS 0x06 +@@ -206,6 +210,7 @@ static const struct usb_device_id id_tab + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)}, ++ {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)}, + {} /* terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, id_table); +@@ -2139,6 +2144,7 @@ static int mos7840_probe(struct usb_seri + const struct usb_device_id *id) + { + u16 product = le16_to_cpu(serial->dev->descriptor.idProduct); ++ u16 vid = le16_to_cpu(serial->dev->descriptor.idVendor); + u8 *buf; + int device_type; + +@@ -2148,6 +2154,11 @@ static int mos7840_probe(struct usb_seri + goto out; + } + ++ if (vid == USB_VENDOR_ID_MOXA && product == MOXA_DEVICE_ID_2210) { ++ device_type = MOSCHIP_DEVICE_ID_7820; ++ goto out; ++ } ++ + buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL); + if (!buf) + return -ENOMEM; diff --git a/queue-3.16/usb-serial-mos7840-fix-remote-wakeup.patch b/queue-3.16/usb-serial-mos7840-fix-remote-wakeup.patch new file mode 100644 index 00000000..59ae0e3a --- /dev/null +++ b/queue-3.16/usb-serial-mos7840-fix-remote-wakeup.patch @@ -0,0 +1,36 @@ +From: Johan Hovold <johan@kernel.org> +Date: Thu, 7 Nov 2019 14:21:19 +0100 +Subject: USB: serial: mos7840: fix remote wakeup + +commit 92fe35fb9c70a00d8fbbf5bd6172c921dd9c7815 upstream. + +The driver was setting the device remote-wakeup feature during probe in +violation of the USB specification (which says it should only be set +just prior to suspending the device). This could potentially waste +power during suspend as well as lead to spurious wakeups. + +Note that USB core would clear the remote-wakeup feature at first +resume. + +Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver") +Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Johan Hovold <johan@kernel.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/serial/mos7840.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -2414,11 +2414,6 @@ out: + goto error; + } else + dev_dbg(&port->dev, "ZLP_REG5 Writing success status%d\n", status); +- +- /* setting configuration feature to one */ +- usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), +- 0x03, 0x00, 0x01, 0x00, NULL, 0x00, +- MOS_WDR_TIMEOUT); + } + return 0; + error: diff --git a/queue-3.16/usb-uas-heed-capacity_heuristics.patch b/queue-3.16/usb-uas-heed-capacity_heuristics.patch new file mode 100644 index 00000000..638989f8 --- /dev/null +++ b/queue-3.16/usb-uas-heed-capacity_heuristics.patch @@ -0,0 +1,33 @@ +From: Oliver Neukum <oneukum@suse.com> +Date: Thu, 14 Nov 2019 12:27:57 +0100 +Subject: USB: uas: heed CAPACITY_HEURISTICS + +commit 335cbbd5762d5e5c67a8ddd6e6362c2aa42a328f upstream. + +There is no need to ignore this flag. We should be as close +to storage in that regard as makes sense, so honor flags whose +cost is tiny. + +Signed-off-by: Oliver Neukum <oneukum@suse.com> +Link: https://lore.kernel.org/r/20191114112758.32747-3-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/storage/uas.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1004,6 +1004,12 @@ static int uas_slave_configure(struct sc + sdev->fix_capacity = 1; + + /* ++ * in some cases we have to guess ++ */ ++ if (devinfo->flags & US_FL_CAPACITY_HEURISTICS) ++ sdev->guess_capacity = 1; ++ ++ /* + * Some devices don't like MODE SENSE with page=0x3f, + * which is the command used for checking if a device + * is write-protected. Now that we tell the sd driver diff --git a/queue-3.16/usb-uas-honor-flag-to-avoid-capacity16.patch b/queue-3.16/usb-uas-honor-flag-to-avoid-capacity16.patch new file mode 100644 index 00000000..87fb688e --- /dev/null +++ b/queue-3.16/usb-uas-honor-flag-to-avoid-capacity16.patch @@ -0,0 +1,29 @@ +From: Oliver Neukum <oneukum@suse.com> +Date: Thu, 14 Nov 2019 12:27:56 +0100 +Subject: USB: uas: honor flag to avoid CAPACITY16 + +commit bff000cae1eec750d62e265c4ba2db9af57b17e1 upstream. + +Copy the support over from usb-storage to get feature parity + +Signed-off-by: Oliver Neukum <oneukum@suse.com> +Link: https://lore.kernel.org/r/20191114112758.32747-2-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/usb/storage/uas.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -991,6 +991,10 @@ static int uas_slave_configure(struct sc + if (devinfo->flags & US_FL_BROKEN_FUA) + sdev->broken_fua = 1; + ++ /* Some disks cannot handle READ_CAPACITY_16 */ ++ if (devinfo->flags & US_FL_NO_READ_CAPACITY_16) ++ sdev->no_read_capacity_16 = 1; ++ + /* + * Some disks return the total number of blocks in response + * to READ CAPACITY rather than the highest block number. diff --git a/queue-3.16/usbvision-fix-locking-error-2.patch b/queue-3.16/usbvision-fix-locking-error-2.patch new file mode 100644 index 00000000..49b71972 --- /dev/null +++ b/queue-3.16/usbvision-fix-locking-error-2.patch @@ -0,0 +1,33 @@ +From: Insu Yun <wuninsu@gmail.com> +Date: Mon, 1 Feb 2016 13:59:30 -0200 +Subject: [media] usbvision: fix locking error + +commit 5ce625a42d6206d5a18222c6475f6b866ef68569 upstream. + +When remove_pending is non-zero, v4l2_lock is never unlocked. + +Signed-off-by: Insu Yun <wuninsu@gmail.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/usb/usbvision/usbvision-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1175,6 +1175,7 @@ static int usbvision_radio_close(struct + usbvision_audio_off(usbvision); + usbvision->radio = 0; + usbvision->user--; ++ mutex_unlock(&usbvision->v4l2_lock); + + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); +@@ -1182,7 +1183,6 @@ static int usbvision_radio_close(struct + return err_code; + } + +- mutex_unlock(&usbvision->v4l2_lock); + PDEBUG(DBG_IO, "success"); + return err_code; + } diff --git a/queue-3.16/usbvision-fix-locking-error.patch b/queue-3.16/usbvision-fix-locking-error.patch new file mode 100644 index 00000000..adef3a20 --- /dev/null +++ b/queue-3.16/usbvision-fix-locking-error.patch @@ -0,0 +1,32 @@ +From: Hans Verkuil <hans.verkuil@cisco.com> +Date: Mon, 20 Jul 2015 09:59:35 -0300 +Subject: [media] usbvision: fix locking error + +commit e2c84ccb0fbe5e524d15bb09c042a6ca634adaed upstream. + +If remove_pending is non-zero, then the v4l2_lock is never unlocked. + +Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/usb/usbvision/usbvision-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -420,13 +420,13 @@ static int usbvision_v4l2_close(struct f + usbvision_scratch_free(usbvision); + + usbvision->user--; ++ mutex_unlock(&usbvision->v4l2_lock); + + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); + return 0; + } +- mutex_unlock(&usbvision->v4l2_lock); + + PDEBUG(DBG_IO, "success"); + return 0; diff --git a/queue-3.16/usbvision-remove-power_on_at_open-and-timed-power-off.patch b/queue-3.16/usbvision-remove-power_on_at_open-and-timed-power-off.patch new file mode 100644 index 00000000..c4adc821 --- /dev/null +++ b/queue-3.16/usbvision-remove-power_on_at_open-and-timed-power-off.patch @@ -0,0 +1,282 @@ +From: Hans Verkuil <hans.verkuil@cisco.com> +Date: Mon, 20 Jul 2015 09:59:28 -0300 +Subject: [media] usbvision: remove power_on_at_open and timed power off + +commit 62e259493d779b0e2c1a675ab733136511310821 upstream. + +This causes lots of problems and is *very* slow as well. + +One of the main problems is that this prohibits the use of the control +framework since subdevs will be unloaded on power off which is not allowed +as long as they are used by a usb device. + +Apparently the reason for doing this is to turn off a noisy tuner. My hardware +has no problem with that, and I wonder whether the hardware with that noisy +tuner wasn't just functioning improperly as I have never heard of noisy tuners. + +Contact me if you have one of those devices and I can take a look whether the +tuner can't be powered off if necessary by letting the tuner subdevice go +into standby mode. Unloading the tuner module is just evil and is not the +right approach. + +Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> +[bwh: Backported to 3.16 as dependency of locking fixes. Our version of + usbvision_init_power_off_timer() was slightly different.] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/drivers/media/usb/usbvision/usbvision-core.c ++++ b/drivers/media/usb/usbvision/usbvision-core.c +@@ -2167,56 +2167,6 @@ int usbvision_power_on(struct usb_usbvis + + + /* +- * usbvision timer stuff +- */ +- +-/* to call usbvision_power_off from task queue */ +-static void call_usbvision_power_off(struct work_struct *work) +-{ +- struct usb_usbvision *usbvision = container_of(work, struct usb_usbvision, power_off_work); +- +- PDEBUG(DBG_FUNC, ""); +- if (mutex_lock_interruptible(&usbvision->v4l2_lock)) +- return; +- +- if (usbvision->user == 0) { +- usbvision_i2c_unregister(usbvision); +- +- usbvision_power_off(usbvision); +- usbvision->initialized = 0; +- } +- mutex_unlock(&usbvision->v4l2_lock); +-} +- +-static void usbvision_power_off_timer(unsigned long data) +-{ +- struct usb_usbvision *usbvision = (void *)data; +- +- PDEBUG(DBG_FUNC, ""); +- del_timer(&usbvision->power_off_timer); +- INIT_WORK(&usbvision->power_off_work, call_usbvision_power_off); +- (void) schedule_work(&usbvision->power_off_work); +-} +- +-void usbvision_init_power_off_timer(struct usb_usbvision *usbvision) +-{ +- init_timer(&usbvision->power_off_timer); +- usbvision->power_off_timer.data = (long)usbvision; +- usbvision->power_off_timer.function = usbvision_power_off_timer; +-} +- +-void usbvision_set_power_off_timer(struct usb_usbvision *usbvision) +-{ +- mod_timer(&usbvision->power_off_timer, jiffies + USBVISION_POWEROFF_TIME); +-} +- +-void usbvision_reset_power_off_timer(struct usb_usbvision *usbvision) +-{ +- if (timer_pending(&usbvision->power_off_timer)) +- del_timer(&usbvision->power_off_timer); +-} +- +-/* + * usbvision_begin_streaming() + * Sure you have to put bit 7 to 0, if not incoming frames are droped, but no + * idea about the rest +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -122,8 +122,6 @@ static void usbvision_release(struct usb + static int isoc_mode = ISOC_MODE_COMPRESS; + /* Set the default Debug Mode of the device driver */ + static int video_debug; +-/* Set the default device to power on at startup */ +-static int power_on_at_open = 1; + /* Sequential Number of Video Device */ + static int video_nr = -1; + /* Sequential Number of Radio Device */ +@@ -134,13 +132,11 @@ static int radio_nr = -1; + /* Showing parameters under SYSFS */ + module_param(isoc_mode, int, 0444); + module_param(video_debug, int, 0444); +-module_param(power_on_at_open, int, 0444); + module_param(video_nr, int, 0444); + module_param(radio_nr, int, 0444); + + MODULE_PARM_DESC(isoc_mode, " Set the default format for ISOC endpoint. Default: 0x60 (Compression On)"); + MODULE_PARM_DESC(video_debug, " Set the default Debug Mode of the device driver. Default: 0 (Off)"); +-MODULE_PARM_DESC(power_on_at_open, " Set the default device to power on when device is opened. Default: 1 (On)"); + MODULE_PARM_DESC(video_nr, "Set video device number (/dev/videoX). Default: -1 (autodetect)"); + MODULE_PARM_DESC(radio_nr, "Set radio device number (/dev/radioX). Default: -1 (autodetect)"); + +@@ -351,11 +347,10 @@ static int usbvision_v4l2_open(struct fi + + if (mutex_lock_interruptible(&usbvision->v4l2_lock)) + return -ERESTARTSYS; +- usbvision_reset_power_off_timer(usbvision); + +- if (usbvision->user) ++ if (usbvision->user) { + err_code = -EBUSY; +- else { ++ } else { + /* Allocate memory for the scratch ring buffer */ + err_code = usbvision_scratch_alloc(usbvision); + if (isoc_mode == ISOC_MODE_COMPRESS) { +@@ -372,11 +367,6 @@ static int usbvision_v4l2_open(struct fi + + /* If so far no errors then we shall start the camera */ + if (!err_code) { +- if (usbvision->power == 0) { +- usbvision_power_on(usbvision); +- usbvision_i2c_register(usbvision); +- } +- + /* Send init sequence only once, it's large! */ + if (!usbvision->initialized) { + int setup_ok = 0; +@@ -392,18 +382,13 @@ static int usbvision_v4l2_open(struct fi + err_code = usbvision_init_isoc(usbvision); + /* device must be initialized before isoc transfer */ + usbvision_muxsel(usbvision, 0); ++ ++ /* prepare queues */ ++ usbvision_empty_framequeues(usbvision); + usbvision->user++; +- } else { +- if (power_on_at_open) { +- usbvision_i2c_unregister(usbvision); +- usbvision_power_off(usbvision); +- usbvision->initialized = 0; +- } + } + } + +- /* prepare queues */ +- usbvision_empty_framequeues(usbvision); + mutex_unlock(&usbvision->v4l2_lock); + + PDEBUG(DBG_IO, "success"); +@@ -436,13 +421,6 @@ static int usbvision_v4l2_close(struct f + + usbvision->user--; + +- if (power_on_at_open) { +- /* power off in a little while +- to avoid off/on every close/open short sequences */ +- usbvision_set_power_off_timer(usbvision); +- usbvision->initialized = 0; +- } +- + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); +@@ -1160,14 +1138,6 @@ static int usbvision_radio_open(struct f + __func__); + err_code = -EBUSY; + } else { +- if (power_on_at_open) { +- usbvision_reset_power_off_timer(usbvision); +- if (usbvision->power == 0) { +- usbvision_power_on(usbvision); +- usbvision_i2c_register(usbvision); +- } +- } +- + /* Alternate interface 1 is is the biggest frame size */ + err_code = usbvision_set_alternate(usbvision); + if (err_code < 0) { +@@ -1182,14 +1152,6 @@ static int usbvision_radio_open(struct f + usbvision_set_audio(usbvision, USBVISION_AUDIO_RADIO); + usbvision->user++; + } +- +- if (err_code) { +- if (power_on_at_open) { +- usbvision_i2c_unregister(usbvision); +- usbvision_power_off(usbvision); +- usbvision->initialized = 0; +- } +- } + out: + mutex_unlock(&usbvision->v4l2_lock); + return err_code; +@@ -1213,11 +1175,6 @@ static int usbvision_radio_close(struct + usbvision->radio = 0; + usbvision->user--; + +- if (power_on_at_open) { +- usbvision_set_power_off_timer(usbvision); +- usbvision->initialized = 0; +- } +- + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); +@@ -1432,8 +1389,6 @@ static struct usb_usbvision *usbvision_a + goto err_unreg; + init_waitqueue_head(&usbvision->ctrl_urb_wq); + +- usbvision_init_power_off_timer(usbvision); +- + return usbvision; + + err_unreg: +@@ -1454,8 +1409,6 @@ static void usbvision_release(struct usb + { + PDEBUG(DBG_PROBE, ""); + +- usbvision_reset_power_off_timer(usbvision); +- + usbvision->initialized = 0; + + usbvision_remove_sysfs(usbvision->vdev); +@@ -1499,11 +1452,9 @@ static void usbvision_configure_video(st + /* first switch off audio */ + if (usbvision_device_data[model].audio_channels > 0) + usbvision_audio_off(usbvision); +- if (!power_on_at_open) { +- /* and then power up the noisy tuner */ +- usbvision_power_on(usbvision); +- usbvision_i2c_register(usbvision); +- } ++ /* and then power up the tuner */ ++ usbvision_power_on(usbvision); ++ usbvision_i2c_register(usbvision); + } + + /* +@@ -1671,11 +1622,7 @@ static void usbvision_disconnect(struct + usbvision_stop_isoc(usbvision); + + v4l2_device_disconnect(&usbvision->v4l2_dev); +- +- if (usbvision->power) { +- usbvision_i2c_unregister(usbvision); +- usbvision_power_off(usbvision); +- } ++ usbvision_i2c_unregister(usbvision); + usbvision->remove_pending = 1; /* Now all ISO data will be ignored */ + + usb_put_dev(usbvision->dev); +--- a/drivers/media/usb/usbvision/usbvision.h ++++ b/drivers/media/usb/usbvision/usbvision.h +@@ -391,8 +391,6 @@ struct usb_usbvision { + unsigned char iface_alt; /* Alt settings */ + unsigned char vin_reg2_preset; + struct mutex v4l2_lock; +- struct timer_list power_off_timer; +- struct work_struct power_off_work; + int power; /* is the device powered on? */ + int user; /* user count for exclusive use */ + int initialized; /* Had we already sent init sequence? */ +@@ -510,9 +508,6 @@ int usbvision_muxsel(struct usb_usbvisio + int usbvision_set_input(struct usb_usbvision *usbvision); + int usbvision_set_output(struct usb_usbvision *usbvision, int width, int height); + +-void usbvision_init_power_off_timer(struct usb_usbvision *usbvision); +-void usbvision_set_power_off_timer(struct usb_usbvision *usbvision); +-void usbvision_reset_power_off_timer(struct usb_usbvision *usbvision); + int usbvision_power_off(struct usb_usbvision *usbvision); + int usbvision_power_on(struct usb_usbvision *usbvision); + diff --git a/queue-3.16/usbvision-video-two-use-after-frees.patch b/queue-3.16/usbvision-video-two-use-after-frees.patch new file mode 100644 index 00000000..335a8939 --- /dev/null +++ b/queue-3.16/usbvision-video-two-use-after-frees.patch @@ -0,0 +1,35 @@ +From: Dan Carpenter <dan.carpenter@oracle.com> +Date: Thu, 16 Oct 2014 04:57:21 -0300 +Subject: [media] usbvision-video: two use after frees + +commit 470a9147899500eb4898f77816520c4b4aa1a698 upstream. + +The lock has been freed in usbvision_release() so there is no need to +call mutex_unlock() here. + +Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> +Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> +Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/media/usb/usbvision/usbvision-video.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -424,6 +424,7 @@ static int usbvision_v4l2_close(struct f + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); ++ return 0; + } + mutex_unlock(&usbvision->v4l2_lock); + +@@ -1178,6 +1179,7 @@ static int usbvision_radio_close(struct + if (usbvision->remove_pending) { + printk(KERN_INFO "%s: Final disconnect\n", __func__); + usbvision_release(usbvision); ++ return err_code; + } + + mutex_unlock(&usbvision->v4l2_lock); diff --git a/queue-3.16/workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch b/queue-3.16/workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch new file mode 100644 index 00000000..1e422463 --- /dev/null +++ b/queue-3.16/workqueue-fix-spurious-sanity-check-failures-in-destroy_workqueue.patch @@ -0,0 +1,80 @@ +From: Tejun Heo <tj@kernel.org> +Date: Wed, 18 Sep 2019 18:43:40 -0700 +Subject: workqueue: Fix spurious sanity check failures in destroy_workqueue() + +commit def98c84b6cdf2eeea19ec5736e90e316df5206b upstream. + +Before actually destrying a workqueue, destroy_workqueue() checks +whether it's actually idle. If it isn't, it prints out a bunch of +warning messages and leaves the workqueue dangling. It unfortunately +has a couple issues. + +* Mayday list queueing increments pwq's refcnts which gets detected as + busy and fails the sanity checks. However, because mayday list + queueing is asynchronous, this condition can happen without any + actual work items left in the workqueue. + +* Sanity check failure leaves the sysfs interface behind too which can + lead to init failure of newer instances of the workqueue. + +This patch fixes the above two by + +* If a workqueue has a rescuer, disable and kill the rescuer before + sanity checks. Disabling and killing is guaranteed to flush the + existing mayday list. + +* Remove sysfs interface before sanity checks. + +Signed-off-by: Tejun Heo <tj@kernel.org> +Reported-by: Marcin Pawlowski <mpawlowski@fb.com> +Reported-by: "Williams, Gerald S" <gerald.s.williams@intel.com> +[bwh: Backported to 3.16: destroy_workqueue() also freed wq->rescuer itself] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4266,9 +4266,29 @@ void destroy_workqueue(struct workqueue_ + struct pool_workqueue *pwq; + int node; + ++ /* ++ * Remove it from sysfs first so that sanity check failure doesn't ++ * lead to sysfs name conflicts. ++ */ ++ workqueue_sysfs_unregister(wq); ++ + /* drain it before proceeding with destruction */ + drain_workqueue(wq); + ++ /* kill rescuer, if sanity checks fail, leave it w/o rescuer */ ++ if (wq->rescuer) { ++ struct worker *rescuer = wq->rescuer; ++ ++ /* this prevents new queueing */ ++ spin_lock_irq(&wq_mayday_lock); ++ wq->rescuer = NULL; ++ spin_unlock_irq(&wq_mayday_lock); ++ ++ /* rescuer will empty maydays list before exiting */ ++ kthread_stop(rescuer->task); ++ kfree(rescuer); ++ } ++ + /* sanity checks */ + mutex_lock(&wq->mutex); + for_each_pwq(pwq, wq) { +@@ -4298,14 +4318,6 @@ void destroy_workqueue(struct workqueue_ + list_del_init(&wq->list); + mutex_unlock(&wq_pool_mutex); + +- workqueue_sysfs_unregister(wq); +- +- if (wq->rescuer) { +- kthread_stop(wq->rescuer->task); +- kfree(wq->rescuer); +- wq->rescuer = NULL; +- } +- + if (!(wq->flags & WQ_UNBOUND)) { + /* + * The base ref is never dropped on per-cpu pwqs. Directly diff --git a/queue-3.16/x86-ioapic-prevent-inconsistent-state-when-moving-an-interrupt.patch b/queue-3.16/x86-ioapic-prevent-inconsistent-state-when-moving-an-interrupt.patch new file mode 100644 index 00000000..81e954b2 --- /dev/null +++ b/queue-3.16/x86-ioapic-prevent-inconsistent-state-when-moving-an-interrupt.patch @@ -0,0 +1,74 @@ +From: Thomas Gleixner <tglx@linutronix.de> +Date: Thu, 17 Oct 2019 12:19:01 +0200 +Subject: x86/ioapic: Prevent inconsistent state when moving an interrupt + +commit df4393424af3fbdcd5c404077176082a8ce459c4 upstream. + +There is an issue with threaded interrupts which are marked ONESHOT +and using the fasteoi handler: + + if (IS_ONESHOT()) + mask_irq(); + .... + cond_unmask_eoi_irq() + chip->irq_eoi(); + if (setaffinity_pending) { + mask_ioapic(); + ... + move_affinity(); + unmask_ioapic(); + } + +So if setaffinity is pending the interrupt will be moved and then +unconditionally unmasked at the ioapic level, which is wrong in two +aspects: + + 1) It should be kept masked up to the point where the threaded handler + finished. + + 2) The physical chip state and the software masked state are inconsistent + +Guard both the mask and the unmask with a check for the software masked +state. If the line is marked masked then the ioapic line is also masked, so +both mask_ioapic() and unmask_ioapic() can be skipped safely. + +Signed-off-by: Thomas Gleixner <tglx@linutronix.de> +Cc: Andy Shevchenko <andy.shevchenko@gmail.com> +Cc: Linus Torvalds <torvalds@linux-foundation.org> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Sebastian Siewior <bigeasy@linutronix.de> +Fixes: 3aa551c9b4c4 ("genirq: add threaded interrupt handler support") +Link: https://lkml.kernel.org/r/20191017101938.321393687@linutronix.de +Signed-off-by: Ingo Molnar <mingo@kernel.org> +[bwh: Backported to 3.16: Keep using {,un}mask_iopaic_irq()] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/x86/kernel/apic/io_apic.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -2377,9 +2377,10 @@ static bool io_apic_level_ack_pending(st + + static inline bool ioapic_irqd_mask(struct irq_data *data, struct irq_cfg *cfg) + { +- /* If we are moving the irq we need to mask it */ ++ /* If we are moving the IRQ we need to mask it */ + if (unlikely(irqd_is_setaffinity_pending(data))) { +- mask_ioapic(cfg); ++ if (!irqd_irq_masked(data)) ++ mask_ioapic(cfg); + return true; + } + return false; +@@ -2417,7 +2418,9 @@ static inline void ioapic_irqd_unmask(st + */ + if (!io_apic_level_ack_pending(cfg)) + irq_move_masked_irq(data); +- unmask_ioapic(cfg); ++ /* If the IRQ is masked in the core, leave it: */ ++ if (!irqd_irq_masked(data)) ++ unmask_ioapic(cfg); + } + } + #else diff --git a/queue-3.16/x86-pci-avoid-amd-fch-xhci-usb-pme-from-d0-defect.patch b/queue-3.16/x86-pci-avoid-amd-fch-xhci-usb-pme-from-d0-defect.patch new file mode 100644 index 00000000..73c60ba3 --- /dev/null +++ b/queue-3.16/x86-pci-avoid-amd-fch-xhci-usb-pme-from-d0-defect.patch @@ -0,0 +1,48 @@ +From: Kai-Heng Feng <kai.heng.feng@canonical.com> +Date: Mon, 2 Sep 2019 22:52:52 +0800 +Subject: x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect + +commit 7e8ce0e2b036dbc6617184317983aea4f2c52099 upstream. + +The AMD FCH USB XHCI Controller advertises support for generating PME# +while in D0. When in D0, it does signal PME# for USB 3.0 connect events, +but not for USB 2.0 or USB 1.1 connect events, which means the controller +doesn't wake correctly for those events. + + 00:10.0 USB controller [0c03]: Advanced Micro Devices, Inc. [AMD] FCH USB XHCI Controller [1022:7914] (rev 20) (prog-if 30 [XHCI]) + Subsystem: Dell FCH USB XHCI Controller [1028:087e] + Capabilities: [50] Power Management version 3 + Flags: PMEClk- DSI- D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+) + +Clear PCI_PM_CAP_PME_D0 in dev->pme_support to indicate the device will not +assert PME# from D0 so we don't rely on it. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203673 +Link: https://lore.kernel.org/r/20190902145252.32111-1-kai.heng.feng@canonical.com +Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com> +Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/x86/pci/fixup.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -575,6 +575,17 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_IN + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_invalid_bar); + + /* ++ * Device [1022:7914] ++ * When in D0, PME# doesn't get asserted when plugging USB 2.0 device. ++ */ ++static void pci_fixup_amd_fch_xhci_pme(struct pci_dev *dev) ++{ ++ dev_info(&dev->dev, "PME# does not work under D0, disabling it\n"); ++ dev->pme_support &= ~(PCI_PM_CAP_PME_D0 >> PCI_PM_CAP_PME_SHIFT); ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, 0x7914, pci_fixup_amd_fch_xhci_pme); ++ ++/* + * Apple MacBook Pro: Avoid [mem 0x7fa00000-0x7fbfffff] + * + * Using the [mem 0x7fa00000-0x7fbfffff] region, e.g., by assigning it to diff --git a/queue-3.16/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch b/queue-3.16/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch new file mode 100644 index 00000000..7f96a7ea --- /dev/null +++ b/queue-3.16/x86-speculation-fix-incorrect-mds-taa-mitigation-status.patch @@ -0,0 +1,150 @@ +From: Waiman Long <longman@redhat.com> +Date: Fri, 15 Nov 2019 11:14:44 -0500 +Subject: x86/speculation: Fix incorrect MDS/TAA mitigation status + +commit 64870ed1b12e235cfca3f6c6da75b542c973ff78 upstream. + +For MDS vulnerable processors with TSX support, enabling either MDS or +TAA mitigations will enable the use of VERW to flush internal processor +buffers at the right code path. IOW, they are either both mitigated +or both not. However, if the command line options are inconsistent, +the vulnerabilites sysfs files may not report the mitigation status +correctly. + +For example, with only the "mds=off" option: + + vulnerabilities/mds:Vulnerable; SMT vulnerable + vulnerabilities/tsx_async_abort:Mitigation: Clear CPU buffers; SMT vulnerable + +The mds vulnerabilities file has wrong status in this case. Similarly, +the taa vulnerability file will be wrong with mds mitigation on, but +taa off. + +Change taa_select_mitigation() to sync up the two mitigation status +and have them turned off if both "mds=off" and "tsx_async_abort=off" +are present. + +Update documentation to emphasize the fact that both "mds=off" and +"tsx_async_abort=off" have to be specified together for processors that +are affected by both TAA and MDS to be effective. + + [ bp: Massage and add kernel-parameters.txt change too. ] + +Fixes: 1b42f017415b ("x86/speculation/taa: Add mitigation for TSX Async Abort") +Signed-off-by: Waiman Long <longman@redhat.com> +Signed-off-by: Borislav Petkov <bp@suse.de> +Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Cc: "H. Peter Anvin" <hpa@zytor.com> +Cc: Ingo Molnar <mingo@redhat.com> +Cc: Jiri Kosina <jkosina@suse.cz> +Cc: Jonathan Corbet <corbet@lwn.net> +Cc: Josh Poimboeuf <jpoimboe@redhat.com> +Cc: linux-doc@vger.kernel.org +Cc: Mark Gross <mgross@linux.intel.com> +Cc: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> +Cc: Peter Zijlstra <peterz@infradead.org> +Cc: Thomas Gleixner <tglx@linutronix.de> +Cc: Tim Chen <tim.c.chen@linux.intel.com> +Cc: Tony Luck <tony.luck@intel.com> +Cc: Tyler Hicks <tyhicks@canonical.com> +Cc: x86-ml <x86@kernel.org> +Link: https://lkml.kernel.org/r/20191115161445.30809-2-longman@redhat.com +[bwh: Backported to 3.16: adjust filenames] +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + Documentation/hw-vuln/mds.rst | 7 +++++-- + Documentation/hw-vuln/tsx_async_abort.rst | 5 ++++- + Documentation/kernel-parameters.txt | 11 +++++++++++ + arch/x86/kernel/cpu/bugs.c | 17 +++++++++++++++-- + 4 files changed, 35 insertions(+), 5 deletions(-) + +--- a/Documentation/hw-vuln/mds.rst ++++ b/Documentation/hw-vuln/mds.rst +@@ -262,8 +262,11 @@ time with the option "mds=". The valid a + + ============ ============================================================= + +-Not specifying this option is equivalent to "mds=full". +- ++Not specifying this option is equivalent to "mds=full". For processors ++that are affected by both TAA (TSX Asynchronous Abort) and MDS, ++specifying just "mds=off" without an accompanying "tsx_async_abort=off" ++will have no effect as the same mitigation is used for both ++vulnerabilities. + + Mitigation selection guide + -------------------------- +--- a/Documentation/hw-vuln/tsx_async_abort.rst ++++ b/Documentation/hw-vuln/tsx_async_abort.rst +@@ -169,7 +169,10 @@ the option "tsx_async_abort=". The valid + systems will have no effect. + ============ ============================================================= + +-Not specifying this option is equivalent to "tsx_async_abort=full". ++Not specifying this option is equivalent to "tsx_async_abort=full". For ++processors that are affected by both TAA and MDS, specifying just ++"tsx_async_abort=off" without an accompanying "mds=off" will have no ++effect as the same mitigation is used for both vulnerabilities. + + The kernel command line also allows to control the TSX feature using the + parameter "tsx=" on CPUs which support TSX control. MSR_IA32_TSX_CTRL is used +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -1793,6 +1793,12 @@ bytes respectively. Such letter suffixes + full - Enable MDS mitigation on vulnerable CPUs + off - Unconditionally disable MDS mitigation + ++ On TAA-affected machines, mds=off can be prevented by ++ an active TAA mitigation as both vulnerabilities are ++ mitigated with the same mechanism so in order to disable ++ this mitigation, you need to specify tsx_async_abort=off ++ too. ++ + Not specifying this option is equivalent to + mds=full. + +@@ -3634,6 +3640,11 @@ bytes respectively. Such letter suffixes + + off - Unconditionally disable TAA mitigation + ++ On MDS-affected machines, tsx_async_abort=off can be ++ prevented by an active MDS mitigation as both vulnerabilities ++ are mitigated with the same mechanism so in order to disable ++ this mitigation, you need to specify mds=off too. ++ + Not specifying this option is equivalent to + tsx_async_abort=full. On CPUs which are MDS affected + and deploy MDS mitigation, TAA mitigation is not +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -349,8 +349,12 @@ static void __init taa_select_mitigation + return; + } + +- /* TAA mitigation is turned off on the cmdline (tsx_async_abort=off) */ +- if (taa_mitigation == TAA_MITIGATION_OFF) ++ /* ++ * TAA mitigation via VERW is turned off if both ++ * tsx_async_abort=off and mds=off are specified. ++ */ ++ if (taa_mitigation == TAA_MITIGATION_OFF && ++ mds_mitigation == MDS_MITIGATION_OFF) + goto out; + + if (boot_cpu_has(X86_FEATURE_MD_CLEAR)) +@@ -381,6 +385,15 @@ static void __init taa_select_mitigation + */ + static_branch_enable(&mds_user_clear); + ++ /* ++ * Update MDS mitigation, if necessary, as the mds_user_clear is ++ * now enabled for TAA mitigation. ++ */ ++ if (mds_mitigation == MDS_MITIGATION_OFF && ++ boot_cpu_has_bug(X86_BUG_MDS)) { ++ mds_mitigation = MDS_MITIGATION_FULL; ++ mds_select_mitigation(); ++ } + out: + pr_info("%s\n", taa_strings[taa_mitigation]); + } diff --git a/queue-3.16/xen-blkback-avoid-unmapping-unmapped-grant-pages.patch b/queue-3.16/xen-blkback-avoid-unmapping-unmapped-grant-pages.patch new file mode 100644 index 00000000..c79111af --- /dev/null +++ b/queue-3.16/xen-blkback-avoid-unmapping-unmapped-grant-pages.patch @@ -0,0 +1,64 @@ +From: SeongJae Park <sjpark@amazon.de> +Date: Tue, 26 Nov 2019 16:36:05 +0100 +Subject: xen/blkback: Avoid unmapping unmapped grant pages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit f9bd84a8a845d82f9b5a081a7ae68c98a11d2e84 upstream. + +For each I/O request, blkback first maps the foreign pages for the +request to its local pages. If an allocation of a local page for the +mapping fails, it should unmap every mapping already made for the +request. + +However, blkback's handling mechanism for the allocation failure does +not mark the remaining foreign pages as unmapped. Therefore, the unmap +function merely tries to unmap every valid grant page for the request, +including the pages not mapped due to the allocation failure. On a +system that fails the allocation frequently, this problem leads to +following kernel crash. + + [ 372.012538] BUG: unable to handle kernel NULL pointer dereference at 0000000000000001 + [ 372.012546] IP: [<ffffffff814071ac>] gnttab_unmap_refs.part.7+0x1c/0x40 + [ 372.012557] PGD 16f3e9067 PUD 16426e067 PMD 0 + [ 372.012562] Oops: 0002 [#1] SMP + [ 372.012566] Modules linked in: act_police sch_ingress cls_u32 + ... + [ 372.012746] Call Trace: + [ 372.012752] [<ffffffff81407204>] gnttab_unmap_refs+0x34/0x40 + [ 372.012759] [<ffffffffa0335ae3>] xen_blkbk_unmap+0x83/0x150 [xen_blkback] + ... + [ 372.012802] [<ffffffffa0336c50>] dispatch_rw_block_io+0x970/0x980 [xen_blkback] + ... + Decompressing Linux... Parsing ELF... done. + Booting the kernel. + [ 0.000000] Initializing cgroup subsys cpuset + +This commit fixes this problem by marking the grant pages of the given +request that didn't mapped due to the allocation failure as invalid. + +Fixes: c6cc142dac52 ("xen-blkback: use balloon pages for all mappings") + +Reviewed-by: David Woodhouse <dwmw@amazon.de> +Reviewed-by: Maximilian Heyne <mheyne@amazon.de> +Reviewed-by: Paul Durrant <pdurrant@amazon.co.uk> +Reviewed-by: Roger Pau Monné <roger.pau@citrix.com> +Signed-off-by: SeongJae Park <sjpark@amazon.de> +Signed-off-by: Jens Axboe <axboe@kernel.dk> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + drivers/block/xen-blkback/blkback.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -825,6 +825,8 @@ next: + out_of_memory: + pr_alert(DRV_PFX "%s: out of memory\n", __func__); + put_free_pages(blkif, pages_to_gnt, segs_to_map); ++ for (i = last_map; i < num; i++) ++ pages[i]->handle = BLKBACK_INVALID_HANDLE; + return -ENOMEM; + } + diff --git a/queue-3.16/xfs-sanity-check-flags-of-q_xquotarm-call.patch b/queue-3.16/xfs-sanity-check-flags-of-q_xquotarm-call.patch new file mode 100644 index 00000000..429b381b --- /dev/null +++ b/queue-3.16/xfs-sanity-check-flags-of-q_xquotarm-call.patch @@ -0,0 +1,32 @@ +From: Jan Kara <jack@suse.cz> +Date: Wed, 23 Oct 2019 17:00:45 -0700 +Subject: xfs: Sanity check flags of Q_XQUOTARM call + +commit 3dd4d40b420846dd35869ccc8f8627feef2cff32 upstream. + +Flags passed to Q_XQUOTARM were not sanity checked for invalid values. +Fix that. + +Fixes: 9da93f9b7cdf ("xfs: fix Q_XQUOTARM ioctl") +Reported-by: Yang Xu <xuyang2018.jy@cn.fujitsu.com> +Signed-off-by: Jan Kara <jack@suse.cz> +Reviewed-by: Eric Sandeen <sandeen@redhat.com> +Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com> +Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + fs/xfs/xfs_quotaops.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/xfs/xfs_quotaops.c ++++ b/fs/xfs/xfs_quotaops.c +@@ -119,6 +119,9 @@ xfs_fs_rm_xquota( + if (XFS_IS_QUOTA_ON(mp)) + return -EINVAL; + ++ if (uflags & ~(FS_USER_QUOTA | FS_GROUP_QUOTA | FS_PROJ_QUOTA)) ++ return -EINVAL; ++ + if (uflags & FS_USER_QUOTA) + flags |= XFS_DQ_USER; + if (uflags & FS_GROUP_QUOTA) diff --git a/queue-3.16/xtensa-fix-tlb-sanity-checker.patch b/queue-3.16/xtensa-fix-tlb-sanity-checker.patch new file mode 100644 index 00000000..80c76542 --- /dev/null +++ b/queue-3.16/xtensa-fix-tlb-sanity-checker.patch @@ -0,0 +1,42 @@ +From: Max Filippov <jcmvbkbc@gmail.com> +Date: Wed, 13 Nov 2019 13:18:31 -0800 +Subject: xtensa: fix TLB sanity checker + +commit 36de10c4788efc6efe6ff9aa10d38cb7eea4c818 upstream. + +Virtual and translated addresses retrieved by the xtensa TLB sanity +checker must be consistent, i.e. correspond to the same state of the +checked TLB entry. KASAN shadow memory is mapped dynamically using +auto-refill TLB entries and thus may change TLB state between the +virtual and translated address retrieval, resulting in false TLB +insanity report. +Move read_xtlb_translation close to read_xtlb_virtual to make sure that +read values are consistent. + +Fixes: a99e07ee5e88 ("xtensa: check TLB sanity on return to userspace") +Signed-off-by: Max Filippov <jcmvbkbc@gmail.com> +Signed-off-by: Ben Hutchings <ben@decadent.org.uk> +--- + arch/xtensa/mm/tlb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/xtensa/mm/tlb.c ++++ b/arch/xtensa/mm/tlb.c +@@ -218,6 +218,8 @@ static int check_tlb_entry(unsigned w, u + unsigned tlbidx = w | (e << PAGE_SHIFT); + unsigned r0 = dtlb ? + read_dtlb_virtual(tlbidx) : read_itlb_virtual(tlbidx); ++ unsigned r1 = dtlb ? ++ read_dtlb_translation(tlbidx) : read_itlb_translation(tlbidx); + unsigned vpn = (r0 & PAGE_MASK) | (e << PAGE_SHIFT); + unsigned pte = get_pte_for_vaddr(vpn); + unsigned mm_asid = (get_rasid_register() >> 8) & ASID_MASK; +@@ -233,8 +235,6 @@ static int check_tlb_entry(unsigned w, u + } + + if (tlb_asid == mm_asid) { +- unsigned r1 = dtlb ? read_dtlb_translation(tlbidx) : +- read_itlb_translation(tlbidx); + if ((pte ^ r1) & PAGE_MASK) { + pr_err("%cTLB: way: %u, entry: %u, mapping: %08x->%08x, PTE: %08x\n", + dtlb ? 'D' : 'I', w, e, r0, r1, pte); diff --git a/upstream-head b/upstream-head index a1954b0f..65a384fe 100644 --- a/upstream-head +++ b/upstream-head @@ -1 +1 @@ -219d54332a09e8d8741c1e1982f5eae56099de85 +e42617b825f8073569da76dc4510bfa019b1c35a |