From: Ben Hutchings <hidden> Date: 2013-03-25 01:14:58
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <rientjes@google.com>
commit 6c4d3bc99b3341067775efd4d9d13cc8e655fd7c upstream.
Commit 1d9d8639c063 ("perf,x86: fix kernel crash with PEBS/BTS after
suspend/resume") introduces a link failure since
perf_restore_debug_store() is only defined for CONFIG_CPU_SUP_INTEL:
arch/x86/power/built-in.o: In function `restore_processor_state':
(.text+0x45c): undefined reference to `perf_restore_debug_store'
Fix it by defining the dummy function appropriately.
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/perf_event.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:06
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
[ Upstream commit aab2b4bf224ef8358d262f95b568b8ad0cecf0a0 ]
We should not update ts_recent and call tcp_rcv_rtt_measure_ts() both
before and after going to step5. That wastes CPU and double-counts the
receiver-side RTT sample.
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Eric Dumazet <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/ipv4/tcp_input.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
@@ -5494,6 +5494,9 @@ int tcp_rcv_established(struct sock *sk,if(tcp_checksum_complete_user(sk,skb))gotocsum_error;+if((int)skb->truesize>sk->sk_forward_alloc)+gotostep5;+/* Predicted packet is in window by definition.*seq==rcv_nxtandrcv_wup<=rcv_nxt.*Hence,checkseq<=rcv_wupreducesto:
@@ -5505,9 +5508,6 @@ int tcp_rcv_established(struct sock *sk,tcp_rcv_rtt_measure_ts(sk,skb);-if((int)skb->truesize>sk->sk_forward_alloc)-gotostep5;-NET_INC_STATS_BH(sock_net(sk),LINUX_MIB_TCPHPHITS);/* Bulk data transfer: receiver */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:08
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Frederic Sowa <redacted>
[ Upstream commit ddf64354af4a702ee0b85d0a285ba74c7278a460 ]
v2:
a) used struct ipv6_addr_props
v3:
a) reverted changes for ipv6_addr_props
v4:
a) do not use __ipv6_addr_needs_scope_id
Cc: YOSHIFUJI Hideaki <redacted>
Signed-off-by: Hannes Frederic Sowa <redacted>
Acked-by: YOSHIFUJI Hideaki <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/ipv6/ip6_input.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:11
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
This reverts commit 923415295307845e614589c1cce62abedd4d1731
'perf: Fix parsing of __print_flags() in TP_printk()'. The same
change was already included in 3.2 as commit
d06c27b22aa66e48e32f03f9387328a9af9b0625 but in 3.2.1 this change
was wrongly applied to similar code in a different function.
Thanks to Jiri for pointing this out in 3.0.y.
Signed-off-by: Ben Hutchings <redacted>
Cc: Jiri Slaby <redacted>
Cc: Andrew Vagin <redacted>
Cc: Steven Rostedt <rostedt@goodmis.org>
---
tools/perf/util/trace-event-parse.c | 2 --
1 file changed, 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:18
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
In 3.2, unlike mainline, efi_pstore_erase() calls efi_pstore_write()
with a size of 0, as the underlying EFI interface treats a size of 0
as meaning deletion.
This was not taken into account in my backport of commit d80a361d779a
'efi_pstore: Check remaining space with QueryVariableInfo() before
writing data'. The size check should be omitted when erasing.
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:24
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit fc98ab873aa3dbe783ce56a2ffdbbe7c7609521a upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/ti_usb_3410_5052.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:29
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit 7b2459690584f239650a365f3411ba2ec1c6d1e0 upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/io_ti.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
@@ -98,9 +98,6 @@ struct edgeport_port {intclose_pending;intlsr_event;structasync_icounticount;-wait_queue_head_tdelta_msr_wait;/* for handling sleeping while-waitingformsrchangeto-happen*/structedgeport_serial*edge_serial;structusb_serial_port*port;__u8bUartMode;/* Port type, 0: RS232, etc. */
@@ -1557,7 +1554,7 @@ static void handle_new_msr(struct edgepoicount->dcd++;if(msr&EDGEPORT_MSR_DELTA_RI)icount->rng++;-wake_up_interruptible(&edge_port->delta_msr_wait);+wake_up_interruptible(&edge_port->port->delta_msr_wait);}/* Save the new modem status */
@@ -1876,7 +1873,6 @@ static int edge_open(struct tty_struct *dev=port->serial->dev;memset(&(edge_port->icount),0x00,sizeof(edge_port->icount));-init_waitqueue_head(&edge_port->delta_msr_wait);/* turn off loopback */status=ti_do_config(edge_port,UMPC_SET_CLR_LOOPBACK,0);
@@ -2574,10 +2570,14 @@ static int edge_ioctl(struct tty_structdbg("%s - (%d) TIOCMIWAIT",__func__,port->number);cprev=edge_port->icount;while(1){-interruptible_sleep_on(&edge_port->delta_msr_wait);+interruptible_sleep_on(&port->delta_msr_wait);/* see if a signal did it */if(signal_pending(current))return-ERESTARTSYS;++if(port->serial->disconnected)+return-EIO;+cnow=edge_port->icount;if(cnow.rng==cprev.rng&&cnow.dsr==cprev.dsr&&cnow.dcd==cprev.dcd&&cnow.cts==cprev.cts)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:31
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit cf1d24443677a0758cfa88ca40f24858b89261c0 upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/mct_u232.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
@@ -896,13 +893,17 @@ static int mct_u232_ioctl(struct tty_stcprev=mct_u232_port->icount;spin_unlock_irqrestore(&mct_u232_port->lock,flags);for(;;){-prepare_to_wait(&mct_u232_port->msr_wait,+prepare_to_wait(&port->delta_msr_wait,&wait,TASK_INTERRUPTIBLE);schedule();-finish_wait(&mct_u232_port->msr_wait,&wait);+finish_wait(&port->delta_msr_wait,&wait);/* see if a signal did it */if(signal_pending(current))return-ERESTARTSYS;++if(port->serial->disconnected)+return-EIO;+spin_lock_irqsave(&mct_u232_port->lock,flags);cnow=mct_u232_port->icount;spin_unlock_irqrestore(&mct_u232_port->lock,flags);
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:33
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit 5018860321dc7a9e50a75d5f319bc981298fb5b7 upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/ark3116.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
@@ -68,7 +68,6 @@ static int is_irda(struct usb_serial *se}structark3116_private{-wait_queue_head_tdelta_msr_wait;structasync_icounticount;intirda;/* 1 for irda device */
@@ -148,7 +147,6 @@ static int ark3116_attach(struct usb_serif(!priv)return-ENOMEM;-init_waitqueue_head(&priv->delta_msr_wait);mutex_init(&priv->hw_lock);spin_lock_init(&priv->status_lock);
@@ -460,10 +458,14 @@ static int ark3116_ioctl(struct tty_strucaseTIOCMIWAIT:for(;;){structasync_icountprev=priv->icount;-interruptible_sleep_on(&priv->delta_msr_wait);+interruptible_sleep_on(&port->delta_msr_wait);/* see if a signal did it */if(signal_pending(current))return-ERESTARTSYS;++if(port->serial->disconnected)+return-EIO;+if((prev.rng==priv->icount.rng)&&(prev.dsr==priv->icount.dsr)&&(prev.dcd==priv->icount.dcd)&&
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:36
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laxman Dewangan <ldewangan@nvidia.com>
commit 132c803f7b70b17322579f6f4f3f65cf68e55135 upstream.
NVIDIA's Tegra SoC allows read/write of controller register only
if controller clock is enabled. System hangs if read/write happens
to registers without enabling clock.
clk_prepare_enable() can be fail due to unknown reason and hence
adding check for return value of this function. If this function
success then only access register otherwise return to caller with
error.
Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-by: Stephen Warren <redacted>
Signed-off-by: Wolfram Sang <redacted>
[bwh: Backported to 3.2:
- Adjust context
- Keep calling clk_enable() directly]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/i2c/busses/i2c-tegra.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:38
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit 71ccb9b01981fabae27d3c98260ea4613207618e upstream.
Use the port wait queue and make sure to check the serial disconnected
flag before accessing private port data after waking up.
This is is needed as the private port data (including the wait queue
itself) can be gone when waking up after a disconnect.
When switching to tty ports, some lifetime assumptions were changed.
Specifically, close can now be called before the final tty reference is
dropped as part of hangup at device disconnect. Even with the ftdi
private-data refcounting this means that the port private data can be
freed while a process is sleeping on modem-status changes and thus
cannot be relied on to detect disconnects when woken up.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/ftdi_sio.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
@@ -74,9 +74,7 @@ struct ftdi_private {intflags;/* some ASYNC_xxxx flags are supported */unsignedlonglast_dtr_rts;/* saved modem control outputs */structasync_icounticount;-wait_queue_head_tdelta_msr_wait;/* Used for TIOCMIWAIT */charprev_status;/* Used for TIOCMIWAIT */-booldev_gone;/* Used to abort TIOCMIWAIT */chartransmit_empty;/* If transmitter is empty or not */structusb_serial_port*port;__u16interface;/* FT2232C, FT2232H or FT4232H port interface
@@ -1707,10 +1705,8 @@ static int ftdi_sio_port_probe(struct uskref_init(&priv->kref);mutex_init(&priv->cfg_lock);memset(&priv->icount,0x00,sizeof(priv->icount));-init_waitqueue_head(&priv->delta_msr_wait);priv->flags=ASYNC_LOW_LATENCY;-priv->dev_gone=false;if(quirk&&quirk->port_probe)quirk->port_probe(priv);
@@ -1868,8 +1864,7 @@ static int ftdi_sio_port_remove(struct udbg("%s",__func__);-priv->dev_gone=true;-wake_up_interruptible_all(&priv->delta_msr_wait);+wake_up_interruptible(&port->delta_msr_wait);remove_sysfs_attrs(port);
@@ -2024,7 +2019,7 @@ static int ftdi_process_packet(struct ttif(diff_status&FTDI_RS0_RLSD)priv->icount.dcd++;-wake_up_interruptible_all(&priv->delta_msr_wait);+wake_up_interruptible(&port->delta_msr_wait);priv->prev_status=status;}
@@ -2423,11 +2418,15 @@ static int ftdi_ioctl(struct tty_struct*/caseTIOCMIWAIT:cprev=priv->icount;-while(!priv->dev_gone){-interruptible_sleep_on(&priv->delta_msr_wait);+for(;;){+interruptible_sleep_on(&port->delta_msr_wait);/* see if a signal did it */if(signal_pending(current))return-ERESTARTSYS;++if(port->serial->disconnected)+return-EIO;+cnow=priv->icount;if(((arg&TIOCM_RNG)&&(cnow.rng!=cprev.rng))||((arg&TIOCM_DSR)&&(cnow.dsr!=cprev.dsr))||
@@ -2437,8 +2436,6 @@ static int ftdi_ioctl(struct tty_struct}cprev=cnow;}-return-EIO;-break;caseTIOCSERGETLSR:returnget_lsr_info(port,(structserial_struct__user*)arg);break;
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:41
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit e5b33dc9d16053c2ae4c2c669cf008829530364b upstream.
Add modem-status-change wait queue to struct usb_serial_port that
subdrivers can use to implement TIOCMIWAIT.
Currently subdrivers use a private wait queue which may have been
released when waking up after device disconnected.
Note that we're adding a new wait queue rather than reusing the tty-port
one as we do not want to get woken up at hangup (yet).
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/usb/serial.h | 2 ++
1 file changed, 2 insertions(+)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:46
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Thornber <redacted>
commit f046f89a99ccfd9408b94c653374ff3065c7edb3 upstream.
Fix a bug in dm_btree_remove that could leave leaf values with incorrect
reference counts. The effect of this was that removal of a shared block
could result in the space maps thinking the block was no longer used.
More concretely, if you have a thin device and a snapshot of it, sending
a discard to a shared region of the thin could corrupt the snapshot.
Thinp uses a 2-level nested btree to store it's mappings. This first
level is indexed by thin device, and the second level by logical
block.
Often when we're removing an entry in this mapping tree we need to
rebalance nodes, which can involve shadowing them, possibly creating a
copy if the block is shared. If we do create a copy then children of
that node need to have their reference counts incremented. In this
way reference counts percolate down the tree as shared trees diverge.
The rebalance functions were incrementing the children at the
appropriate time, but they were always assuming the children were
internal nodes. This meant the leaf values (in our case packed
block/flags entries) were not being incremented.
Signed-off-by: Joe Thornber <redacted>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
[bwh: Backported to 3.2: bump target version numbers from 1.0.1 to 1.0.2]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/md/dm-thin.c | 4 +--
drivers/md/persistent-data/dm-btree-remove.c | 46 ++++++++++++++------------
2 files changed, 26 insertions(+), 24 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:56
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
commit ca0ba26fbbd2d81c43085df49ce0abfe34535a90 upstream.
The 'CONFIG_' prefix is not implicit in IS_ENABLED().
Signed-off-by: Ben Hutchings <redacted>
Cc: Seth Forshee <redacted>
Signed-off-by: Matt Fleming <redacted>
---
drivers/firmware/efivars.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:15:58
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seiji Aguchi <redacted>
commit a93bc0c6e07ed9bac44700280e65e2945d864fd4 upstream.
[Problem]
efi_pstore creates sysfs entries, which enable users to access to NVRAM,
in a write callback. If a kernel panic happens in an interrupt context,
it may fail because it could sleep due to dynamic memory allocations during
creating sysfs entries.
[Patch Description]
This patch removes sysfs operations from a write callback by introducing
a workqueue updating sysfs entries which is scheduled after the write
callback is called.
Also, the workqueue is kicked in a just oops case.
A system will go down in other cases such as panic, clean shutdown and emergency
restart. And we don't need to create sysfs entries because there is no chance for
users to access to them.
efi_pstore will be robust against a kernel panic in an interrupt context with this patch.
Signed-off-by: Seiji Aguchi <redacted>
Acked-by: Matt Fleming <redacted>
Signed-off-by: Tony Luck <tony.luck@intel.com>
[bwh: Backported to 3.2:
- Adjust contest
- Don't check reason in efi_pstore_write(), as it is not given as a
parameter
- Move up declaration of __efivars]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -151,6 +153,13 @@ efivar_create_sysfs_entry(struct efivarsefi_char16_t*variable_name,efi_guid_t*vendor_guid);+/*+*Prototypeforworkqueuefunctionsupdatingsysfsentry+*/++staticvoidefivar_update_sysfs_entries(structwork_struct*);+staticDECLARE_WORK(efivar_work,efivar_update_sysfs_entries);+/* Return the number of unicode characters in data */staticunsignedlongutf16_strnlen(efi_char16_t*s,size_tmaxlength)
@@ -833,11 +842,7 @@ static int efi_pstore_write(enum pstore_if(found)efivar_unregister(found);-if(size)-ret=efivar_create_sysfs_entry(efivars,-utf16_strsize(efi_name,-DUMP_NAME_LEN*2),-efi_name,&vendor);+schedule_work(&efivar_work);*id=part;returnret;
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:00
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <redacted>
commit ed9dc8ce7a1c8115dba9483a9b51df8b63a2e0ef upstream.
Add a new option, CONFIG_EFI_VARS_PSTORE, which can be set to N to
avoid using efivars as a backend to pstore, as some users may want to
compile out the code completely.
Set the default to Y to maintain backwards compatability, since this
feature has always been enabled until now.
Signed-off-by: Seth Forshee <redacted>
Cc: Josh Boyer <redacted>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Seiji Aguchi <redacted>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Matt Fleming <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:06
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit fa8d387dc3f62062a6b4afbbb2a3438094fd8584 upstream.
Fixes a segfault on asics without a blit callback.
Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=62239
Reviewed-by: Michel Dänzer <redacted>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[bwh: Backported to 3.2: s/copy\.blit/copy_blit/]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/gpu/drm/radeon/radeon_benchmark.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:08
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <redacted>
commit a86b1a2cd2f81f74e815e07f756edd7bc5b6f034 upstream.
The argument passed to snd_hda_attach_beep_device() is a widget NID
while spec->beep_amp holds the composed value for amp controls.
Signed-off-by: Takashi Iwai <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
sound/pci/hda/patch_conexant.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:10
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <redacted>
commit ec50bd32f1672d38ddce10fb1841cbfda89cfe9a upstream.
It's not wise to assume VariableNameSize represents the length of
VariableName, as not all firmware updates VariableNameSize in the same
way (some don't update it at all if EFI_SUCCESS is returned). There
are even implementations out there that update VariableNameSize with
values that are both larger than the string returned in VariableName
and smaller than the buffer passed to GetNextVariableName(), which
resulted in the following bug report from Michael Schroeder,
> On HP z220 system (firmware version 1.54), some EFI variables are
> incorrectly named :
>
> ls -d /sys/firmware/efi/vars/*8be4d* | grep -v -- -8be returns
> /sys/firmware/efi/vars/dbxDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c
> /sys/firmware/efi/vars/KEKDefault-pport8be4df61-93ca-11d2-aa0d-00e098032b8c
> /sys/firmware/efi/vars/SecureBoot-pport8be4df61-93ca-11d2-aa0d-00e098032b8c
> /sys/firmware/efi/vars/SetupMode-Information8be4df61-93ca-11d2-aa0d-00e098032b8c
The issue here is that because we blindly use VariableNameSize without
verifying its value, we can potentially read garbage values from the
buffer containing VariableName if VariableNameSize is larger than the
length of VariableName.
Since VariableName is a string, we can calculate its size by searching
for the terminating NULL character.
Reported-by: Frederic Crozat <redacted>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Josh Boyer <redacted>
Cc: Michael Schroeder <redacted>
Cc: Lee, Chun-Yi <jlee@suse.com>
Cc: Lingzhu Xiang <redacted>
Cc: Seiji Aguchi <redacted>
Signed-off-by: Matt Fleming <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/firmware/efivars.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:11
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 80902822658aab18330569587cdb69ac1dfdcea8 upstream.
Changing the overwrite mode for the ring buffer via the trace
option only sets the normal buffer. But the snapshot buffer could
swap with it, and then the snapshot would be in non overwrite mode
and the normal buffer would be in overwrite mode, even though the
option flag states otherwise.
Keep the two buffers overwrite modes in sync.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
kernel/trace/trace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:13
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 740466bc89ad8bd5afcc8de220f715f62b21e365 upstream.
Because function tracing is very invasive, and can even trace
calls to rcu_read_lock(), RCU access in function tracing is done
with preempt_disable_notrace(). This requires a synchronize_sched()
for updates and not a synchronize_rcu().
Function probes (traceon, traceoff, etc) must be freed after
a synchronize_sched() after its entry has been removed from the
hash. But call_rcu() is used. Fix this by using call_rcu_sched().
Also fix the usage to use hlist_del_rcu() instead of hlist_del().
Cc: Paul McKenney <redacted>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ben Hutchings <redacted>
---
kernel/trace/ftrace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:15
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit 29c69a4882641285a854d6d03ca5adbba68c0034 ]
We must only ever stop TX queues when they are full or the net device
is not 'ready' so far as the net core, and specifically the watchdog,
is concerned. Otherwise, the watchdog may fire *immediately* if no
packets have been added to the queue in the last 5 seconds.
The device is ready if all the following are true:
(a) It has a qdisc
(b) It is marked present
(c) It is running
(d) The link is reported up
(a) and (c) are normally true, and must not be changed by a driver.
(d) is under our control, but fake link changes may disturb userland.
This leaves (b). We already mark the device absent during reset
and self-test, but we need to do the same during MTU changes and ring
reallocation. We don't need to do this when the device is brought
down because then (c) is already false.
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/efx.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
@@ -1530,8 +1532,12 @@ static void efx_stop_all(struct efx_nic *efx)/* Flush efx_mac_work(), refill_workqueue, monitor_work */efx_flush_all(efx);-/* Stop the kernel transmit interface late, so the watchdog-*timerisn'ttickingovertheflush*/+/* Stop the kernel transmit interface. This is only valid if+*thedeviceisstoppedordetached;otherwisethewatchdog+*mayfireimmediately.+*/+WARN_ON(netif_running(efx->net_dev)&&+netif_device_present(efx->net_dev));if(efx_dev_registered(efx)){netif_tx_stop_all_queues(efx->net_dev);netif_tx_lock_bh(efx->net_dev);
@@ -1832,10 +1838,11 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)if(new_mtu>EFX_MAX_MTU)return-EINVAL;-efx_stop_all(efx);-netif_dbg(efx,drv,efx->net_dev,"changing MTU to %d\n",new_mtu);+efx_device_detach_sync(efx);+efx_stop_all(efx);+efx_fini_channels(efx);mutex_lock(&efx->mac_lock);
@@ -1848,6 +1855,7 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)efx_init_channels(efx);efx_start_all(efx);+netif_device_attach(efx->net_dev);returnrc;}
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:16
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit 3a68f19d7afb80f548d016effbc6ed52643a8085 ]
We may currently allocate two RX DMA buffers to a page, and only unmap
the page when the second is completed. We do not sync the first RX
buffer to be completed; this can result in packet loss or corruption
if the last RX buffer completed in a NAPI poll is the first in a page
and is not DMA-coherent. (In the middle of a NAPI poll, we will
handle the following RX completion and unmap the page *before* looking
at the content of the first buffer.)
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/rx.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
@@ -550,10 +555,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,gotoout;}-/* Release card resources - assumes all RX buffers consumed in-order-*perRXqueue+/* Release and/or sync DMA mapping - assumes all RX buffers+*consumedin-orderperRXqueue*/-efx_unmap_rx_buffer(efx,rx_buf);+efx_unmap_rx_buffer(efx,rx_buf,len);/* Prefetch nice and early so data will (hopefully) be in cache by*thetimewelookatit.
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:30
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit bfeed902946a31692e7a24ed355b6d13ac37d014 ]
On big-endian systems the MTD partition names currently have mangled
subtype numbers and are not recognised by the firmware update tool
(sfupdate).
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: use old macros for length of firmware subtype array]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/mcdi.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:32
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit ebf98e797b4e26ad52ace1511a0b503ee60a6cd4 ]
efx_mcdi_poll() uses get_seconds() to read the current time and to
implement a polling timeout. The use of this function was chosen
partly because it could easily be replaced in a co-sim environment
with a macro that read the simulated time.
Unfortunately the real get_seconds() returns the system time (real
time) which is subject to adjustment by e.g. ntpd. If the system time
is adjusted forward during a polled MCDI operation, the effective
timeout can be shorter than the intended 10 seconds, resulting in a
spurious failure. It is also possible for a backward adjustment to
delay detection of a areal failure.
Use jiffies instead, and change MCDI_RPC_TIMEOUT to be denominated in
jiffies. Also correct rounding of the timeout: check time > finish
(or rather time_after(time, finish)) and not time >= finish.
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/mcdi.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
@@ -136,7 +136,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)*andpollonceajiffy(approximately)*/spins=TICK_USEC;-finish=get_seconds()+MCDI_RPC_TIMEOUT;+finish=jiffies+MCDI_RPC_TIMEOUT;while(1){if(spins!=0){
@@ -146,7 +146,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)schedule_timeout_uninterruptible(1);}-time=get_seconds();+time=jiffies;rmb();efx_readd(efx,®,pdu);
@@ -158,7 +158,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)EFX_DWORD_FIELD(reg,MCDI_HEADER_RESPONSE))break;-if(time>=finish)+if(time_after(time,finish))return-ETIMEDOUT;}
@@ -250,7 +250,7 @@ static int efx_mcdi_await_completion(struct efx_nic *efx)if(wait_event_timeout(mcdi->wq,atomic_read(&mcdi->state)==MCDI_STATE_COMPLETED,-msecs_to_jiffies(MCDI_RPC_TIMEOUT*1000))==0)+MCDI_RPC_TIMEOUT)==0)return-ETIMEDOUT;/* Check if efx_mcdi_set_mode() switched us back to polled completions.
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:34
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Pieczko <redacted>
[ Upstream commit c2f3b8e3a44b6fe9e36704e30157ebe1a88c08b1 ]
The assertion of netif_device_present() at the top of
efx_hard_start_xmit() may fail if we don't do this.
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/efx.c | 4 ++--
drivers/net/ethernet/sfc/efx.h | 13 +++++++++++++
drivers/net/ethernet/sfc/selftest.c | 2 +-
3 files changed, 16 insertions(+), 3 deletions(-)
@@ -149,4 +149,17 @@ extern void efx_link_status_changed(struct efx_nic *efx);externvoidefx_link_set_advertising(structefx_nic*efx,u32);externvoidefx_link_set_wanted_fc(structefx_nic*efx,u8);+staticinlinevoidefx_device_detach_sync(structefx_nic*efx)+{+structnet_device*dev=efx->net_dev;++/* Lock/freeze all TX queues so that we can be sure the+*TXschedulerisstoppedwhenwe'redoneandbefore+*netif_device_present()becomesfalse.+*/+netif_tx_lock(dev);+netif_device_detach(dev);+netif_tx_unlock(dev);+}+#endif /* EFX_EFX_H */
@@ -698,7 +698,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,/* Detach the device so the kernel doesn't transmit during the*loopbacktestandthewatchdogtimeoutdoesn'tfire.*/-netif_device_detach(efx->net_dev);+efx_device_detach_sync(efx);mutex_lock(&efx->mac_lock);if(efx->loopback_modes){
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:37
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veaceslav Falico <redacted>
[ Upstream commit 876254ae2758d50dcb08c7bd00caf6a806571178 ]
bond_update_speed_duplex() might sleep while calling underlying slave's
routines. Move it out of atomic context in bond_enslave() and remove it
from bond_miimon_commit() - it was introduced by commit 546add79, however
when the slave interfaces go up/change state it's their responsibility to
fire NETDEV_UP/NETDEV_CHANGE events so that bonding can properly update
their speed.
I've tested it on all combinations of ifup/ifdown, autoneg/speed/duplex
changes, remote-controlled and local, on (not) MII-based cards. All changes
are visible.
Signed-off-by: Veaceslav Falico <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/bonding/bond_main.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
@@ -1758,8 +1760,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)new_slave->link=BOND_LINK_DOWN;}-bond_update_speed_duplex(new_slave);-if(USES_PRIMARY(bond->params.mode)&&bond->params.primary[0]){/* if there is a primary slave, remember it */if(strcmp(bond->params.primary,new_slave->dev->name)==0){
@@ -2437,8 +2437,6 @@ static void bond_miimon_commit(struct bonding *bond)bond_set_backup_slave(slave);}-bond_update_speed_duplex(slave);-pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",bond->dev->name,slave->dev->name,slave->speed,slave->duplex?"full":"half");
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:39
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <redacted>
commit fe685aabf7c8c9f138e5ea900954d295bf229175 upstream.
For type 1 the parent_offset member in struct isofs_fid gets copied
uninitialized to userland. Fix this by initializing it to 0.
Signed-off-by: Mathias Krause <redacted>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ben Hutchings <redacted>
---
fs/isofs/export.c | 1 +
1 file changed, 1 insertion(+)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:41
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <redacted>
commit 0143fc5e9f6f5aad4764801015bc8d4b4a278200 upstream.
For type 0x51 the udf.parent_partref member in struct fid gets copied
uninitialized to userland. Fix this by initializing it to 0.
Signed-off-by: Mathias Krause <redacted>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ben Hutchings <redacted>
---
fs/udf/namei.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/udf/namei.c+++ b/fs/udf/namei.c
@@ -1293,6 +1293,7 @@ static int udf_encode_fh(struct dentry **lenp=3;fid->udf.block=location.logicalBlockNum;fid->udf.partref=location.partitionReferenceNum;+fid->udf.parent_partref=0;fid->udf.generation=inode->i_generation;if(connectable&&!S_ISDIR(inode->i_mode)){
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:43
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomas Hozza <redacted>
commit 95a69adab9acfc3981c504737a2b6578e4d846ef upstream.
The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink packet which has been sent from an untrusted local user.
Now Netlink messages with a non-zero nl_pid source address are ignored
and a warning is printed into the syslog.
Signed-off-by: Tomas Hozza <redacted>
Acked-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
tools/hv/hv_kvp_daemon.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
@@ -1062,10 +1062,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwadhoc_join->bss_descriptor.bssid,adhoc_join->bss_descriptor.ssid);-for(i=0;bss_desc->supported_rates[i]&&-i<MWIFIEX_SUPPORTED_RATES;-i++)-;+for(i=0;i<MWIFIEX_SUPPORTED_RATES&&+bss_desc->supported_rates[i];i++)+;rates_size=i;/* Copy Data Rates from the Rates recorded in scan response */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:16:48
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Denis V. Lunev" <redacted>
[ Upstream commit 5b9e12dbf92b441b37136ea71dac59f05f2673a9 ]
a long time ago by the commit
commit 93456b6d7753def8760b423ac6b986eb9d5a4a95
Author: Denis V. Lunev [off-list ref]
Date: Thu Jan 10 03:23:38 2008 -0800
[IPV4]: Unify access to the routing tables.
the defenition of FIB_HASH_TABLE size has obtained wrong dependency:
it should depend upon CONFIG_IP_MULTIPLE_TABLES (as was in the original
code) but it was depended from CONFIG_IP_ROUTE_MULTIPATH
This patch returns the situation to the original state.
The problem was spotted by Tingwei Liu.
Signed-off-by: Denis V. Lunev <redacted>
CC: Tingwei Liu <redacted>
CC: Alexey Kuznetsov <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
include/net/ip_fib.h | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:17:39
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
commit d63ac5f6cf31c8a83170a9509b350c1489a7262b upstream.
Commit 44ae3ab3358e962039c36ad4ae461ae9fb29596c forgot to update
the entry for the 970MP rev 1.0 processor when moving some CPU
features bits to the MMU feature bit mask. This breaks booting
on some rare G5 models using that chip revision.
Reported-by: Phileas Fogg <redacted>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Ben Hutchings <redacted>
---
arch/powerpc/kernel/cputable.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:18:17
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lekensteyn <redacted>
commit d627b62ff8d4d36761adbcd90ff143d79c94ab22 upstream.
This is rather a hack to fix brightness hotkeys on a Clevo laptop. CADL is not
used anywhere in the driver code at the moment, but it could be used in BIOS as
is the case with the Clevo laptop.
The Clevo B7130 requires the CADL field to contain at least the ID of
the LCD device. If this field is empty, the ACPI methods that are called
on pressing brightness / display switching hotkeys will not trigger a
notification. As a result, it appears as no hotkey has been pressed.
Reference: https://bugs.freedesktop.org/show_bug.cgi?id=45452
Tested-by: Peter Wu <redacted>
Signed-off-by: Peter Wu <redacted>
Acked-by: Jesse Barnes <redacted>
Signed-off-by: Daniel Vetter <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/gpu/drm/i915/intel_opregion.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
@@ -419,6 +419,25 @@ blind_set:gotoend;}+staticvoidintel_setup_cadls(structdrm_device*dev)+{+structdrm_i915_private*dev_priv=dev->dev_private;+structintel_opregion*opregion=&dev_priv->opregion;+inti=0;+u32disp_id;++/* Initialize the CADL field by duplicating the DIDL values.+*Technically,thisisnotalwayscorrectasdisplayoutputsmayexist,+*butnotactive.ThisinitializationisnecessaryforsomeClevo+*laptopsthatcheckthisfieldbeforeprocessingthebrightnessand+*displayswitchinghotkeys.JustlikeDIDL,CADLisNULL-terminatedif+*therearelessthaneightdevices.*/+do{+disp_id=ioread32(&opregion->acpi->didl[i]);+iowrite32(disp_id,&opregion->acpi->cadl[i]);+}while(++i<8&&disp_id!=0);+}+voidintel_opregion_init(structdrm_device*dev){structdrm_i915_private*dev_priv=dev->dev_private;
@@ -428,8 +447,10 @@ void intel_opregion_init(struct drm_devireturn;if(opregion->acpi){-if(drm_core_check_feature(dev,DRIVER_MODESET))+if(drm_core_check_feature(dev,DRIVER_MODESET)){intel_didl_outputs(dev);+intel_setup_cadls(dev);+}/* Notify BIOS we are ready to handle ACPI video ext notifs.*Rightnow,alltheeventsarehandledbytheACPIvideomodule.
From: Ben Hutchings <hidden> Date: 2013-03-25 01:18:36
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <redacted>
commit 4502403dcf8f5c76abd4dbab8726c8e4ecb5cd34 upstream.
The call tree here is:
sk_clone_lock() <- takes bh_lock_sock(newsk);
xfrm_sk_clone_policy()
__xfrm_sk_clone_policy()
clone_policy() <- uses GFP_ATOMIC for allocations
security_xfrm_policy_clone()
security_ops->xfrm_policy_clone_security()
selinux_xfrm_policy_clone()
Signed-off-by: Dan Carpenter <redacted>
Signed-off-by: James Morris <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
security/selinux/xfrm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:19:24
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xufeng Zhang <redacted>
[ Upstream commit 2317f449af30073cfa6ec8352e4a65a89e357bdd ]
sctp_assoc_lookup_tsn() function searchs which transport a certain TSN
was sent on, if not found in the active_path transport, then go search
all the other transports in the peer's transport_addr_list, however, we
should continue to the next entry rather than break the loop when meet
the active_path transport.
Signed-off-by: Xufeng Zhang <redacted>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Vlad Yasevich <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/sctp/associola.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:19:45
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larry Finger <redacted>
commit 9437a248e7cac427c898bdb11bd1ac6844a1ead4 upstream.
The driver was failing to clear the BSSID when a disconnect happened. That
prevented a reconnection. This problem is reported at
https://bugzilla.redhat.com/show_bug.cgi?id=789605,
https://bugzilla.redhat.com/show_bug.cgi?id=866786,
https://bugzilla.redhat.com/show_bug.cgi?id=906734, and
https://bugzilla.kernel.org/show_bug.cgi?id=46171.
Thanks to Jussi Kivilinna for making the critical observation
that led to the solution.
Reported-by: Jussi Kivilinna <redacted>
Tested-by: Jussi Kivilinna <redacted>
Tested-by: Alessandro Lannocca <redacted>
Signed-off-by: Larry Finger <redacted>
Signed-off-by: John W. Linville <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/wireless/rtlwifi/rtl8192cu/hw.c | 87 +++++++++++----------------
1 file changed, 35 insertions(+), 52 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:20:09
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Yasevich <redacted>
[ Upstream commit f2815633504b442ca0b0605c16bf3d88a3a0fcea ]
When SCTP is done processing a duplicate cookie chunk, it tries
to delete a newly created association. For that, it has to set
the right association for the side-effect processing to work.
However, when it uses the SCTP_CMD_NEW_ASOC command, that performs
more work then really needed (like hashing the associationa and
assigning it an id) and there is no point to do that only to
delete the association as a next step. In fact, it also creates
an impossible condition where an association may be found by
the getsockopt() call, and that association is empty. This
causes a crash in some sctp getsockopts.
The solution is rather simple. We simply use SCTP_CMD_SET_ASOC
command that doesn't have all the overhead and does exactly
what we need.
Reported-by: Karl Heiss <redacted>
Tested-by: Karl Heiss <redacted>
CC: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Vlad Yasevich <redacted>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/sctp/sm_statefuns.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
@@ -2044,7 +2044,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(const struct sctp_endpoint *ep,}/* Delete the tempory new association. */-sctp_add_cmd_sf(commands,SCTP_CMD_NEW_ASOC,SCTP_ASOC(new_asoc));+sctp_add_cmd_sf(commands,SCTP_CMD_SET_ASOC,SCTP_ASOC(new_asoc));sctp_add_cmd_sf(commands,SCTP_CMD_DELETE_TCB,SCTP_NULL());/* Restore association pointer to provide SCTP command interpeter
From: Ben Hutchings <hidden> Date: 2013-03-25 01:20:36
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Veaceslav Falico <redacted>
[ Upstream commit 3f315bef23075ea8a98a6fe4221a83b83456d970 ]
__netpoll_cleanup() is called in netconsole_netdev_event() while holding a
spinlock. Release/acquire the spinlock before/after it and restart the
loop. Also, disable the netconsole completely, because we won't have chance
after the restart of the loop, and might end up in a situation where
nt->enabled == 1 and nt->np.dev == NULL.
Signed-off-by: Veaceslav Falico <redacted>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/netconsole.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:20:53
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Michael S. Tsirkin" <mst@redhat.com>
commit 46aa92d1ba162b4b3d6b7102440e459d4e4ee255 upstream.
ubuf info allocator uses guest controlled head as an index,
so a malicious guest could put the same head entry in the ring twice,
and we will get two callbacks on the same value.
To fix use upend_idx which is guaranteed to be unique.
Reported-by: Rusty Russell <redacted>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/vhost/net.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:21:21
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ward <redacted>
[ Upstream commit 4660c7f498c07c43173142ea95145e9dac5a6d14 ]
This is needed in order to detect if the timestamp option appears
more than once in a packet, to remove the option if the packet is
fragmented, etc. My previous change neglected to store the option
location when the router addresses were prespecified and Pointer >
Length. But now the option location is also stored when Flag is an
unrecognized value, to ensure these option handling behaviors are
still performed.
Signed-off-by: David Ward <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/ipv4/ip_options.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
@@ -358,7 +358,6 @@ int ip_options_compile(struct net *net,}switch(optptr[3]&0xF){caseIPOPT_TS_TSONLY:-opt->ts=optptr-iph;if(skb)timeptr=&optptr[optptr[2]-1];opt->ts_needtime=1;
@@ -369,7 +368,6 @@ int ip_options_compile(struct net *net,pp_ptr=optptr+2;gotoerror;}-opt->ts=optptr-iph;if(rt){memcpy(&optptr[optptr[2]-1],&rt->rt_spec_dst,4);timeptr=&optptr[optptr[2]+3];
@@ -383,7 +381,6 @@ int ip_options_compile(struct net *net,pp_ptr=optptr+2;gotoerror;}-opt->ts=optptr-iph;{__be32addr;memcpy(&addr,&optptr[optptr[2]-1],4);
@@ -416,12 +413,12 @@ int ip_options_compile(struct net *net,pp_ptr=optptr+3;gotoerror;}-opt->ts=optptr-iph;if(skb){optptr[3]=(optptr[3]&0xF)|((overflow+1)<<4);opt->is_changed=1;}}+opt->ts=optptr-iph;break;caseIPOPT_RA:if(optlen<4){
From: Ben Hutchings <hidden> Date: 2013-03-25 01:21:22
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tkhai Kirill <redacted>
[ Upstream commit cb29529ea0030e60ef1bbbf8399a43d397a51526 ]
If a machine has X (X < 4) sunsu ports and cmdline
option "console=ttySY" is passed, where X < Y <= 4,
than the following panic happens:
Unable to handle kernel NULL pointer dereference
TPC: <sunsu_console_setup+0x78/0xe0>
RPC: <sunsu_console_setup+0x74/0xe0>
I7: <register_console+0x378/0x3e0>
Call Trace:
[0000000000453a38] register_console+0x378/0x3e0
[0000000000576fa0] uart_add_one_port+0x2e0/0x340
[000000000057af40] su_probe+0x160/0x2e0
[00000000005b8a4c] platform_drv_probe+0xc/0x20
[00000000005b6c2c] driver_probe_device+0x12c/0x220
[00000000005b6da8] __driver_attach+0x88/0xa0
[00000000005b4df4] bus_for_each_dev+0x54/0xa0
[00000000005b5a54] bus_add_driver+0x154/0x260
[00000000005b7190] driver_register+0x50/0x180
[00000000006d250c] sunsu_init+0x18c/0x1e0
[00000000006c2668] do_one_initcall+0xe8/0x160
[00000000006c282c] kernel_init_freeable+0x12c/0x1e0
[0000000000603764] kernel_init+0x4/0x100
[0000000000405f64] ret_from_syscall+0x1c/0x2c
[0000000000000000] (null)
1)Fix the panic;
2)Increment registered port number every successful
probe.
Signed-off-by: Kirill Tkhai <redacted>
CC: David Miller <davem@davemloft.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/tty/serial/sunsu.c | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:21:24
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Yasevich <redacted>
[ Upstream commit a5b8db91442fce9c9713fcd656c3698f1adde1d6 ]
Range/validity checks on rta_type in rtnetlink_rcv_msg() do
not account for flags that may be set. This causes the function
to return -EINVAL when flags are set on the type (for example
NLA_F_NESTED).
Signed-off-by: Vlad Yasevich <redacted>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
net/core/rtnetlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:22:11
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <redacted>
[ Upstream commit 16fad69cfe4adbbfa813de516757b87bcae36d93 ]
Chrome OS team reported a crash on a Pixel ChromeBook in TCP stack :
https://code.google.com/p/chromium/issues/detail?id=182056
commit a21d45726acac (tcp: avoid order-1 allocations on wifi and tx
path) did a poor choice adding an 'avail_size' field to skb, while
what we really needed was a 'reserved_tailroom' one.
It would have avoided commit 22b4a4f22da (tcp: fix retransmit of
partially acked frames) and this commit.
Crash occurs because skb_split() is not aware of the 'avail_size'
management (and should not be aware)
Signed-off-by: Eric Dumazet <redacted>
Reported-by: Mukesh Agrawal <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
include/linux/skbuff.h | 7 +++++--
net/ipv4/tcp.c | 2 +-
net/ipv4/tcp_output.c | 1 -
3 files changed, 6 insertions(+), 4 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:22:49
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Hodgson <redacted>
[ Upstream commit 3dca9d2dc285faf1910d405b65df845cab061356 ]
efx_nic_fatal_interrupt() disables DMA before scheduling a reset.
After this, we need not and *cannot* flush queues.
Signed-off-by: Ben Hutchings <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/efx.c | 33 +++++++++++++++++++--------------
1 file changed, 19 insertions(+), 14 deletions(-)
@@ -650,25 +650,30 @@ static void efx_fini_channels(struct efx_nic *efx)structefx_channel*channel;structefx_tx_queue*tx_queue;structefx_rx_queue*rx_queue;+structpci_dev*dev=efx->pci_dev;intrc;EFX_ASSERT_RESET_SERIALISED(efx);BUG_ON(efx->port_enabled);-rc=efx_nic_flush_queues(efx);-if(rc&&EFX_WORKAROUND_7803(efx)){-/* Schedule a reset to recover from the flush failure. The-*descriptorcachesreferencememorywe'reabouttofree,-*butfalcon_reconfigure_mac_wrapper()won'treconnect-*theMACsbecauseofthependingreset.*/-netif_err(efx,drv,efx->net_dev,-"Resetting to recover from flush failure\n");-efx_schedule_reset(efx,RESET_TYPE_ALL);-}elseif(rc){-netif_err(efx,drv,efx->net_dev,"failed to flush queues\n");-}else{-netif_dbg(efx,drv,efx->net_dev,-"successfully flushed all queues\n");+/* Only perform flush if dma is enabled */+if(dev->is_busmaster){+rc=efx_nic_flush_queues(efx);++if(rc&&EFX_WORKAROUND_7803(efx)){+/* Schedule a reset to recover from the flush failure. The+*descriptorcachesreferencememorywe'reabouttofree,+*butfalcon_reconfigure_mac_wrapper()won'treconnect+*theMACsbecauseofthependingreset.*/+netif_err(efx,drv,efx->net_dev,+"Resetting to recover from flush failure\n");+efx_schedule_reset(efx,RESET_TYPE_ALL);+}elseif(rc){+netif_err(efx,drv,efx->net_dev,"failed to flush queues\n");+}else{+netif_dbg(efx,drv,efx->net_dev,+"successfully flushed all queues\n");+}}efx_for_each_channel(channel,efx){
From: Ben Hutchings <hidden> Date: 2013-03-25 01:23:11
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Frederic Sowa <redacted>
[ Upstream commit 5a3da1fe9561828d0ca7eca664b16ec2b9bf0055 ]
This patch introduces a constant limit of the fragment queue hash
table bucket list lengths. Currently the limit 128 is choosen somewhat
arbitrary and just ensures that we can fill up the fragment cache with
empty packets up to the default ip_frag_high_thresh limits. It should
just protect from list iteration eating considerable amounts of cpu.
If we reach the maximum length in one hash bucket a warning is printed.
This is implemented on the caller side of inet_frag_find to distinguish
between the different users of inet_fragment.c.
I dropped the out of memory warning in the ipv4 fragment lookup path,
because we already get a warning by the slab allocator.
Cc: Eric Dumazet <redacted>
Cc: Jesper Dangaard Brouer <redacted>
Signed-off-by: Hannes Frederic Sowa <redacted>
Acked-by: Eric Dumazet <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <redacted>
---
include/net/inet_frag.h | 9 +++++++++
net/ipv4/inet_fragment.c | 20 +++++++++++++++++++-
net/ipv4/ip_fragment.c | 12 ++++++------
net/ipv6/netfilter/nf_conntrack_reasm.c | 11 ++++++-----
net/ipv6/reassembly.c | 8 ++++++--
5 files changed, 46 insertions(+), 14 deletions(-)
@@ -293,14 +295,12 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)hash=ipqhashfn(iph->id,iph->saddr,iph->daddr,iph->protocol);q=inet_frag_find(&net->ipv4.frags,&ip4_frags,&arg,hash);-if(q==NULL)-gotoout_nomem;+if(IS_ERR_OR_NULL(q)){+inet_frag_maybe_warn_overflow(q,pr_fmt());+returnNULL;+}returncontainer_of(q,structipq,q);--out_nomem:-LIMIT_NETDEBUG(KERN_ERR"ip_frag_create: no memory left !\n");-returnNULL;}/* Is the fragment too far ahead to be part of ipq? */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:23:13
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commits a606f4325dca6950996abbae452d33f2af095f39,
d5e8cc6c946e0857826dcfbb3585068858445bfe,
525d9e824018cd7cc8d8d44832ddcd363abfe6e1 ]
The TX DMA engine issues upstream read requests when there is room in
the TX FIFO for the completion. However, the fetches for the rest of
the packet might be delayed by any back pressure. Since a flush must
wait for an EOP, the entire flush may be delayed by back pressure.
Mitigate this by disabling flow control before the flushes are
started. Since PF and VF flushes run in parallel introduce
fc_disable, a reference count of the number of flushes outstanding.
The same principle could be applied to Falcon, but that
would bring with it its own testing.
We sometimes hit a "failed to flush" timeout on some TX queues, but the
flushes have completed and the flush completion events seem to go missing.
In this case, we can check the TX_DESC_PTR_TBL register and drain the
queues if the flushes had finished.
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2:
- Call efx_nic_type::finish_flush() on both success and failure paths
- Check the TX_DESC_PTR_TBL registers in the polling loop
- Declare efx_mcdi_set_mac() extern]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/falcon.c | 2 ++
drivers/net/ethernet/sfc/mcdi.h | 1 +
drivers/net/ethernet/sfc/mcdi_mac.c | 4 +++-
drivers/net/ethernet/sfc/net_driver.h | 6 ++++++
drivers/net/ethernet/sfc/nic.c | 21 ++++++++++++++++++---
drivers/net/ethernet/sfc/nic.h | 2 ++
drivers/net/ethernet/sfc/siena.c | 15 ++++++++++++++-
7 files changed, 46 insertions(+), 5 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:23:58
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Liu <redacted>
commit 3a2256702e47f68f921dfad41b1764d05c572329 upstream.
This commit fixes a wrong return value of the number of the allocated
blocks in ext4_split_extent. When the length of blocks we want to
allocate is greater than the length of the current extent, we return a
wrong number. Let's see what happens in the following case when we
call ext4_split_extent().
map: [48, 72]
ex: [32, 64, u]
'ex' will be split into two parts:
ex1: [32, 47, u]
ex2: [48, 64, w]
'map->m_len' is returned from this function, and the value is 24. But
the real length is 16. So it should be fixed.
Meanwhile in this commit we use right length of the allocated blocks
when get_reserved_cluster_alloc in ext4_ext_handle_uninitialized_extents
is called.
Signed-off-by: Zheng Liu <redacted>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: Dmitry Monakhov <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
fs/ext4/extents.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/ext4/extents.c+++ b/fs/ext4/extents.c
@@ -2960,6 +2960,7 @@ static int ext4_split_extent(handle_t *hinterr=0;intuninitialized;intsplit_flag1,flags1;+intallocated=map->m_len;depth=ext_depth(inode);ex=path[depth].p_ext;
@@ -2979,6 +2980,8 @@ static int ext4_split_extent(handle_t *hmap->m_lblk+map->m_len,split_flag1,flags1);if(err)gotoout;+}else{+allocated=ee_len-(map->m_lblk-ee_block);}ext4_ext_drop_refs(path);
@@ -3001,7 +3004,7 @@ static int ext4_split_extent(handle_t *hext4_ext_show_leaf(inode,path);out:-returnerr?err:map->m_len;+returnerr?err:allocated;}#define EXT4_EXT_ZERO_LEN 7
From: Ben Hutchings <hidden> Date: 2013-03-25 01:23:59
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commits 06e63c57acbb1df7c35ebe846ae416a8b88dfafa,
b590ace09d51cd39744e0f7662c5e4a0d1b5d952 and
c73e787a8db9117d59b5180baf83203a42ecadca ]
We assume that the mapping between DMA and virtual addresses is done
on whole pages, so we can find the page offset of an RX buffer using
the lower bits of the DMA address. However, swiotlb maps in units of
2K, breaking this assumption.
Add an explicit page_offset field to struct efx_rx_buffer.
Signed-off-by: Ben Hutchings <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/net_driver.h | 4 +++-
drivers/net/ethernet/sfc/rx.c | 10 +++++-----
2 files changed, 8 insertions(+), 6 deletions(-)
@@ -95,11 +95,7 @@ static unsigned int rx_refill_limit = 95;staticinlineunsignedintefx_rx_buf_offset(structefx_nic*efx,structefx_rx_buffer*buf){-/* Offset is always within one page, so we don't need to consider-*thepageorder.-*/-return(((__forceunsignedlong)buf->dma_addr&(PAGE_SIZE-1))+-efx->type->rx_buffer_hash_size);+returnbuf->page_offset+efx->type->rx_buffer_hash_size;}staticinlineunsignedintefx_rx_buf_size(structefx_nic*efx){
@@ -194,6 +190,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)structefx_rx_buffer*rx_buf;structpage*page;void*page_addr;+unsignedintpage_offset;structefx_rx_page_state*state;dma_addr_tdma_addr;unsignedindex,count;
@@ -220,12 +217,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)page_addr+=sizeof(structefx_rx_page_state);dma_addr+=sizeof(structefx_rx_page_state);+page_offset=sizeof(structefx_rx_page_state);split:index=rx_queue->added_count&rx_queue->ptr_mask;rx_buf=efx_rx_buffer(rx_queue,index);rx_buf->dma_addr=dma_addr+EFX_PAGE_IP_ALIGN;rx_buf->u.page=page;+rx_buf->page_offset=page_offset+EFX_PAGE_IP_ALIGN;rx_buf->len=efx->rx_buffer_len-EFX_PAGE_IP_ALIGN;rx_buf->is_page=true;++rx_queue->added_count;
@@ -237,6 +236,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)get_page(page);dma_addr+=(PAGE_SIZE>>1);page_addr+=(PAGE_SIZE>>1);+page_offset+=(PAGE_SIZE>>1);++count;gotosplit;}
From: Ben Hutchings <hidden> Date: 2013-03-25 01:24:45
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit 35205b211c8d17a8a0b5e8926cb7c73e9a7ef1ad ]
efx_device_detach_sync() locks all TX queues before marking the device
detached and thus disabling further TX scheduling. But it can still
be interrupted by TX completions which then result in TX scheduling in
soft interrupt context. This will deadlock when it tries to acquire
a TX queue lock that efx_device_detach_sync() already acquired.
To avoid deadlock, we must use netif_tx_{,un}lock_bh().
Signed-off-by: Ben Hutchings <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/efx.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:24:46
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit ad56edad089b56300fd13bb9eeb7d0424d978239 upstream.
jbd2_journal_dirty_metadata() didn't get a reference to journal_head it
was working with. This is OK in most of the cases since the journal head
should be attached to a transaction but in rare occasions when we are
journalling data, __ext4_journalled_writepage() can race with
jbd2_journal_invalidatepage() stripping buffers from a page and thus
journal head can be freed under hands of jbd2_journal_dirty_metadata().
Fix the problem by getting own journal head reference in
jbd2_journal_dirty_metadata() (and also in jbd2_journal_set_triggers()
which can possibly have the same issue).
Reported-by: Zheng Liu <redacted>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Ben Hutchings <redacted>
---
fs/jbd2/transaction.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
@@ -1070,17 +1073,18 @@ int jbd2_journal_dirty_metadata(handle_t{transaction_t*transaction=handle->h_transaction;journal_t*journal=transaction->t_journal;-structjournal_head*jh=bh2jh(bh);+structjournal_head*jh;intret=0;-jbd_debug(5,"journal_head %p\n",jh);-JBUFFER_TRACE(jh,"entry");if(is_handle_aborted(handle))gotoout;-if(!buffer_jbd(bh)){+jh=jbd2_journal_grab_journal_head(bh);+if(!jh){ret=-EUCLEAN;gotoout;}+jbd_debug(5,"journal_head %p\n",jh);+JBUFFER_TRACE(jh,"entry");jbd_lock_bh_state(bh);
@@ -1171,6 +1175,7 @@ int jbd2_journal_dirty_metadata(handle_tspin_unlock(&journal->j_list_lock);out_unlock_bh:jbd_unlock_bh_state(bh);+jbd2_journal_put_journal_head(jh);out:JBUFFER_TRACE(jh,"exit");WARN_ON(ret);/* All errors are bugs, so dump the stack */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:24:47
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <redacted>
[ Upstream commit fae8563b25f73dc584a07bcda7a82750ff4f7672 ]
Using TX push when notifying the NIC of multiple new descriptors in
the ring will very occasionally cause the TX DMA engine to re-use an
old descriptor. This can result in a duplicated or partly duplicated
packet (new headers with old data), or an IOMMU page fault. This does
not happen when the pushed descriptor is the only one written.
TX push also provides little latency benefit when a packet requires
more than one descriptor.
Signed-off-by: Ben Hutchings <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/net/ethernet/sfc/nic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
@@ -371,7 +371,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)returnfalse;tx_queue->empty_read_count=0;-return((empty_read_count^write_count)&~EFX_EMPTY_COUNT_VALID)==0;+return((empty_read_count^write_count)&~EFX_EMPTY_COUNT_VALID)==0+&&tx_queue->write_count-write_count==1;}/* For each entry inserted into the software descriptor ring, create a
From: Ben Hutchings <hidden> Date: 2013-03-25 01:25:50
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Czerner <redacted>
commit 810da240f221d64bf90020f25941b05b378186fe upstream.
We're using macro EXT4_B2C() to convert number of blocks to number of
clusters for bigalloc file systems. However, we should be using
EXT4_NUM_B2C().
Signed-off-by: Lukas Czerner <redacted>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
[bwh: Backported to 3.2:
- Adjust context
- Drop changes in ext4_setup_new_descs() and ext4_calculate_overhead()]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -4865,11 +4865,11 @@ int ext4_group_add_blocks(handle_t *handdesc->bg_checksum=ext4_group_desc_csum(sbi,block_group,desc);ext4_unlock_group(sb,block_group);percpu_counter_add(&sbi->s_freeclusters_counter,-EXT4_B2C(sbi,blocks_freed));+EXT4_NUM_B2C(sbi,blocks_freed));if(sbi->s_log_groups_per_flex){ext4_group_tflex_group=ext4_flex_group(sbi,block_group);-atomic_add(EXT4_B2C(sbi,blocks_freed),+atomic_add(EXT4_NUM_B2C(sbi,blocks_freed),&sbi->s_flex_groups[flex_group].free_clusters);}---a/fs/ext4/resize.c+++b/fs/ext4/resize.c
@@ -938,7 +938,7 @@ int ext4_group_add(struct super_block *s/* Update the free space counts */percpu_counter_add(&sbi->s_freeclusters_counter,-EXT4_B2C(sbi,input->free_blocks_count));+EXT4_NUM_B2C(sbi,input->free_blocks_count));percpu_counter_add(&sbi->s_freeinodes_counter,EXT4_INODES_PER_GROUP(sb));
@@ -946,7 +946,7 @@ int ext4_group_add(struct super_block *ssbi->s_log_groups_per_flex){ext4_group_tflex_group;flex_group=ext4_flex_group(sbi,input->group);-atomic_add(EXT4_B2C(sbi,input->free_blocks_count),+atomic_add(EXT4_NUM_B2C(sbi,input->free_blocks_count),&sbi->s_flex_groups[flex_group].free_clusters);atomic_add(EXT4_INODES_PER_GROUP(sb),&sbi->s_flex_groups[flex_group].free_inodes);
From: Ben Hutchings <hidden> Date: 2013-03-25 01:26:17
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 90ba983f6889e65a3b506b30dc606aa9d1d46cd2 upstream.
A user who was using a 8TB+ file system and with a very large flexbg
size (> 65536) could cause the atomic_t used in the struct flex_groups
to overflow. This was detected by PaX security patchset:
http://forums.grsecurity.net/viewtopic.php?f=3&t=3289&p=12551#p12551
This bug was introduced in commit 9f24e4208f7e, so it's been around
since 2.6.30. :-(
Fix this by using an atomic64_t for struct orlav_stats's
free_clusters.
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Lukas Czerner <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
fs/ext4/ext4.h | 6 +++---
fs/ext4/ialloc.c | 4 ++--
fs/ext4/mballoc.c | 12 ++++++------
fs/ext4/resize.c | 4 ++--
fs/ext4/super.c | 4 ++--
5 files changed, 15 insertions(+), 15 deletions(-)
--- a/fs/ext4/ext4.h+++ b/fs/ext4/ext4.h
@@ -309,9 +309,9 @@ struct ext4_group_desc*/structflex_groups{-atomic_tfree_inodes;-atomic_tfree_clusters;-atomic_tused_dirs;+atomic64_tfree_clusters;+atomic_tfree_inodes;+atomic_tused_dirs;};#define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */---a/fs/ext4/ialloc.c+++b/fs/ext4/ialloc.c
From: Ben Hutchings <hidden> Date: 2013-03-25 01:26:34
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <redacted>
commit 24261fc23db950951760d00c188ba63cc756b932 upstream.
cifsFileInfo objects hold references to dentries and it is possible that
these will still be around in workqueues when VFS decides to kill super
block during unmount.
This results in panics like this one:
BUG: Dentry ffff88001f5e76c0{i=66b4a,n=1M-2} still in use (1) [unmount of cifs cifs]
------------[ cut here ]------------
kernel BUG at fs/dcache.c:943!
[..]
Process umount (pid: 1781, threadinfo ffff88003d6e8000, task ffff880035eeaec0)
[..]
Call Trace:
[<ffffffff811b44f3>] shrink_dcache_for_umount+0x33/0x60
[<ffffffff8119f7fc>] generic_shutdown_super+0x2c/0xe0
[<ffffffff8119f946>] kill_anon_super+0x16/0x30
[<ffffffffa036623a>] cifs_kill_sb+0x1a/0x30 [cifs]
[<ffffffff8119fcc7>] deactivate_locked_super+0x57/0x80
[<ffffffff811a085e>] deactivate_super+0x4e/0x70
[<ffffffff811bb417>] mntput_no_expire+0xd7/0x130
[<ffffffff811bc30c>] sys_umount+0x9c/0x3c0
[<ffffffff81657c19>] system_call_fastpath+0x16/0x1b
Fix this by making each cifsFileInfo object hold a reference to cifs
super block, which implicitly keeps VFS super block around as well.
Signed-off-by: Mateusz Guzik <redacted>
Reviewed-by: Jeff Layton <redacted>
Reported-and-Tested-by: Ben Greear <redacted>
Signed-off-by: Steve French <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
fs/cifs/cifsfs.c | 24 ++++++++++++++++++++++++
fs/cifs/cifsfs.h | 4 ++++
fs/cifs/file.c | 6 +++++-
3 files changed, 33 insertions(+), 1 deletion(-)
@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_texternconststructaddress_space_operationscifs_addr_ops;externconststructaddress_space_operationscifs_addr_ops_smallbuf;+/* Functions related to super block operations */+externvoidcifs_sb_active(structsuper_block*sb);+externvoidcifs_sb_deactive(structsuper_block*sb);+/* Functions related to inodes */externconststructinode_operationscifs_dir_inode_ops;externstructinode*cifs_root_iget(structsuper_block*);---a/fs/cifs/file.c+++b/fs/cifs/file.c
@@ -265,6 +265,8 @@ cifs_new_fileinfo(__u16 fileHandle, strumutex_init(&pCifsFile->fh_mutex);INIT_WORK(&pCifsFile->oplock_break,cifs_oplock_break);+cifs_sb_active(inode->i_sb);+spin_lock(&cifs_file_list_lock);list_add(&pCifsFile->tlist,&(tlink_tcon(tlink)->openFileList));/* if readable file instance put first in list*/
From: Ben Hutchings <hidden> Date: 2013-03-25 01:26:50
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 2721e72dd10f71a3ba90f59781becf02638aa0d9 upstream.
Although the swap is wrapped with a spin_lock, the assignment
of the temp buffer used to swap is not within that lock.
It needs to be moved into that lock, otherwise two swaps
happening on two different CPUs, can end up using the wrong
temp buffer to assign in the swap.
Luckily, all current callers of the swap function appear to have
their own locks. But in case something is added that allows two
different callers to call the swap, then there's a chance that
this race can trigger and corrupt the buffers.
New code is coming soon that will allow for this race to trigger.
I've Cc'd stable, so this bug will not show up if someone backports
one of the changes that can trigger this bug.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Ben Hutchings <redacted>
---
kernel/trace/trace.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:26:52
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <redacted>
commit 2563a4524febe8f4a98e717e02436d1aaf672aa2 upstream.
Masks kernel address info-leak in object dumps with the %pK suffix,
so they cannot be used to target kernel memory corruption attacks if
the kptr_restrict sysctl is set.
Signed-off-by: Kees Cook <redacted>
Signed-off-by: Daniel Vetter <redacted>
[bwh: Backported to 3.2: the rest of the format string is different]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/gpu/drm/i915/i915_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:27:27
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 69d34da2984c95b33ea21518227e1f9470f11d95 upstream.
Seems that the tracer flags have never been protected from
synchronous writes. Luckily, admins don't usually modify the
tracing flags via two different tasks. But if scripts were to
be used to modify them, then they could get corrupted.
Move the trace_types_lock that protects against tracers changing
to also protect the flags being set.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
[bwh: Backported to 3.2: also move failure return in
tracing_trace_options_write() after unlocking]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -2686,13 +2688,13 @@ tracing_trace_options_write(struct file}/* If no option could be set, test the specific tracer options */-if(!trace_options[i]){-mutex_lock(&trace_types_lock);+if(!trace_options[i])ret=set_tracer_option(current_trace,cmp,neg);-mutex_unlock(&trace_types_lock);-if(ret)-returnret;-}++mutex_unlock(&trace_types_lock);++if(ret)+returnret;*ppos+=cnt;
From: Ben Hutchings <hidden> Date: 2013-03-25 01:27:44
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <redacted>
commit 3118a4f652c7b12c752f3222af0447008f9b2368 upstream.
It is possible to wrap the counter used to allocate the buffer for
relocation copies. This could lead to heap writing overflows.
CVE-2013-0913
v3: collapse test, improve comment
v2: move check into validate_exec_list
Signed-off-by: Kees Cook <redacted>
Reported-by: Pinkie Pie
Reviewed-by: Chris Wilson <redacted>
Signed-off-by: Daniel Vetter <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:28:26
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>
commit 613f04a0f51e6e68ac6fe571ab79da3c0a5eb4da upstream.
The latency tracers require the buffers to be in overwrite mode,
otherwise they get screwed up. Force the buffers to stay in overwrite
mode when latency tracers are enabled.
Added a flag_changed() method to the tracer structure to allow
the tracers to see what flags are being changed, and also be able
to prevent the change from happing.
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
[bwh: Backported to 3.2:
- Adjust context
- Drop some changes that are not needed because trace_set_options() is not
separate from tracing_trace_options_write()]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -2636,11 +2636,25 @@ static int set_tracer_option(struct tracreturn-EINVAL;}-staticvoidset_tracer_flags(unsignedintmask,intenabled)+/* Some tracers require overwrite to stay enabled */+inttrace_keep_overwrite(structtracer*tracer,u32mask,intset)+{+if(tracer->enabled&&(mask&TRACE_ITER_OVERWRITE)&&!set)+return-1;++return0;+}++intset_tracer_flag(unsignedintmask,intenabled){/* do nothing if flag is already set */if(!!(trace_flags&mask)==!!enabled)-return;+return0;++/* Give the tracer a chance to approve the change */+if(current_trace->flag_changed)+if(current_trace->flag_changed(current_trace,mask,!!enabled))+return-EINVAL;if(enabled)trace_flags|=mask;
@@ -271,10 +271,14 @@ struct tracer {enumprint_line_t(*print_line)(structtrace_iterator*iter);/* If you handled the flag setting, return 0 */int(*set_flag)(u32old_flags,u32bit,intset);+/* Return 0 if OK with change, else return non-zero */+int(*flag_changed)(structtracer*tracer,+u32mask,intset);structtracer*next;structtracer_flags*flags;intprint_max;intuse_max_tr;+boolenabled;};
@@ -528,8 +528,11 @@ static void stop_wakeup_tracer(struct trstaticint__wakeup_tracer_init(structtrace_array*tr){-save_lat_flag=trace_flags&TRACE_ITER_LATENCY_FMT;-trace_flags|=TRACE_ITER_LATENCY_FMT;+save_flags=trace_flags;++/* non overwrite screws up the latency tracers */+set_tracer_flag(TRACE_ITER_OVERWRITE,1);+set_tracer_flag(TRACE_ITER_LATENCY_FMT,1);tracing_max_latency=0;wakeup_trace=tr;
@@ -551,12 +554,15 @@ static int wakeup_rt_tracer_init(structstaticvoidwakeup_tracer_reset(structtrace_array*tr){+intlat_flag=save_flags&TRACE_ITER_LATENCY_FMT;+intoverwrite_flag=save_flags&TRACE_ITER_OVERWRITE;+stop_wakeup_tracer(tr);/* make sure we put back any tasks we are tracing */wakeup_reset(tr);-if(!save_lat_flag)-trace_flags&=~TRACE_ITER_LATENCY_FMT;+set_tracer_flag(TRACE_ITER_LATENCY_FMT,lat_flag);+set_tracer_flag(TRACE_ITER_OVERWRITE,overwrite_flag);}staticvoidwakeup_tracer_start(structtrace_array*tr)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:28:47
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <hare@suse.de>
commit 00eed9c814cb8f281be6f0f5d8f45025dc0a97eb upstream.
xhci has its own interrupt enabling routine, which will try to
use MSI-X/MSI if present. So the usb core shouldn't try to enable
legacy interrupts; on some machines the xhci legacy IRQ setting
is invalid.
v3: Be careful to not break XHCI_BROKEN_MSI workaround (by trenn)
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Oliver Neukum <redacted>
Cc: Thomas Renninger <redacted>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Frederik Himpe <redacted>
Cc: David Haerdeman <david@hardeman.nu>
Cc: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Sarah Sharp <redacted>
Reviewed-by: Thomas Renninger <redacted>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/core/hcd-pci.c | 23 ++++++++++++++---------
drivers/usb/host/xhci.c | 3 ++-
2 files changed, 16 insertions(+), 10 deletions(-)
@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *destructhc_driver*driver;structusb_hcd*hcd;intretval;+inthcd_irq=0;if(usb_disabled())return-ENODEV;
@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dereturn-ENODEV;dev->current_state=PCI_D0;-/* The xHCI driver supports MSI and MSI-X,-*sodon'tfailiftheBIOSdoesn'tprovidealegacyIRQ.+/*+*ThexHCIdriverhasitsownirqmanagement+*makesureirqsetupisnottouchedforxhciingenerichcdcode*/-if(!dev->irq&&(driver->flags&HCD_MASK)!=HCD_USB3){-dev_err(&dev->dev,-"Found HC with no IRQ. Check BIOS/PCI %s setup!\n",-pci_name(dev));-retval=-ENODEV;-gotodisable_pci;+if((driver->flags&HCD_MASK)!=HCD_USB3){+if(!dev->irq){+dev_err(&dev->dev,+"Found HC with no IRQ. Check BIOS/PCI %s setup!\n",+pci_name(dev));+retval=-ENODEV;+gotodisable_pci;+}+hcd_irq=dev->irq;}hcd=usb_create_hcd(driver,&dev->dev,pci_name(dev));
@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *depci_set_master(dev);-retval=usb_add_hcd(hcd,dev->irq,IRQF_SHARED);+retval=usb_add_hcd(hcd,hcd_irq,IRQF_SHARED);if(retval!=0)gotounmap_registers;set_hs_companion(dev,hcd);---a/drivers/usb/host/xhci.c+++b/drivers/usb/host/xhci.c
@@ -342,7 +342,7 @@ static int xhci_try_enable_msi(struct us*generateinterrupts.Don'teventrytoenableMSI.*/if(xhci->quirks&XHCI_BROKEN_MSI)-return0;+gotolegacy_irq;/* unregister the legacy interrupt */if(hcd->irq)
@@ -363,6 +363,7 @@ static int xhci_try_enable_msi(struct usreturn-EINVAL;}+legacy_irq:/* fall back to legacy interrupt*/ret=request_irq(pdev->irq,&usb_hcd_irq,IRQF_SHARED,hcd->irq_descr,hcd);
From: Ben Hutchings <hidden> Date: 2013-03-25 01:29:05
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 2b405bfa84063bfa35621d2d6879f52693c614b0 upstream.
In data=journal mode, if we unmount the file system before a
transaction has a chance to complete, when the journal inode is being
evicted, we can end up calling into jbd2_log_wait_commit() for the
last transaction, after the journalling machinery has been shut down.
Arguably we should adjust ext4_should_journal_data() to return FALSE
for the journal inode, but the only place it matters is
ext4_evict_inode(), and so to save a bit of CPU time, and to make the
patch much more obviously correct by inspection(tm), we'll fix it by
explicitly not trying to waiting for a journal commit when we are
evicting the journal inode, since it's guaranteed to never succeed in
this case.
This can be easily replicated via:
mount -t ext4 -o data=journal /dev/vdb /vdb ; umount /vdb
------------[ cut here ]------------
WARNING: at /usr/projects/linux/ext4/fs/jbd2/journal.c:542 __jbd2_log_start_commit+0xba/0xcd()
Hardware name: Bochs
JBD2: bad log_start_commit: 3005630206 3005630206 0 0
Modules linked in:
Pid: 2909, comm: umount Not tainted 3.8.0-rc3 #1020
Call Trace:
[<c015c0ef>] warn_slowpath_common+0x68/0x7d
[<c02b7e7d>] ? __jbd2_log_start_commit+0xba/0xcd
[<c015c177>] warn_slowpath_fmt+0x2b/0x2f
[<c02b7e7d>] __jbd2_log_start_commit+0xba/0xcd
[<c02b8075>] jbd2_log_start_commit+0x24/0x34
[<c0279ed5>] ext4_evict_inode+0x71/0x2e3
[<c021f0ec>] evict+0x94/0x135
[<c021f9aa>] iput+0x10a/0x110
[<c02b7836>] jbd2_journal_destroy+0x190/0x1ce
[<c0175284>] ? bit_waitqueue+0x50/0x50
[<c028d23f>] ext4_put_super+0x52/0x294
[<c020efe3>] generic_shutdown_super+0x48/0xb4
[<c020f071>] kill_block_super+0x22/0x60
[<c020f3e0>] deactivate_locked_super+0x22/0x49
[<c020f5d6>] deactivate_super+0x30/0x33
[<c0222795>] mntput_no_expire+0x107/0x10c
[<c02233a7>] sys_umount+0x2cf/0x2e0
[<c02233ca>] sys_oldumount+0x12/0x14
[<c08096b8>] syscall_call+0x7/0xb
---[ end trace 6a954cc790501c1f ]---
jbd2_log_wait_commit: error: j_commit_request=-1289337090, tid=0
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ben Hutchings <redacted>
---
fs/ext4/inode.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:29:32
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fleming <redacted>
commit e971318bbed610e28bb3fde9d548e6aaf0a6b02e upstream.
Some firmware exhibits a bug where the same VariableName and
VendorGuid values are returned on multiple invocations of
GetNextVariableName(). See,
https://bugzilla.kernel.org/show_bug.cgi?id=47631
As a consequence of such a bug, Andre reports hitting the following
WARN_ON() in the sysfs code after updating the BIOS on his, "Gigabyte
Technology Co., Ltd. To be filled by O.E.M./Z77X-UD3H, BIOS F19e
11/21/2012)" machine,
[ 0.581554] EFI Variables Facility v0.08 2004-May-17
[ 0.584914] ------------[ cut here ]------------
[ 0.585639] WARNING: at /home/andre/linux/fs/sysfs/dir.c:536 sysfs_add_one+0xd4/0x100()
[ 0.586381] Hardware name: To be filled by O.E.M.
[ 0.587123] sysfs: cannot create duplicate filename '/firmware/efi/vars/SbAslBufferPtrVar-01f33c25-764d-43ea-aeea-6b5a41f3f3e8'
[ 0.588694] Modules linked in:
[ 0.589484] Pid: 1, comm: swapper/0 Not tainted 3.8.0+ #7
[ 0.590280] Call Trace:
[ 0.591066] [<ffffffff81208954>] ? sysfs_add_one+0xd4/0x100
[ 0.591861] [<ffffffff810587bf>] warn_slowpath_common+0x7f/0xc0
[ 0.592650] [<ffffffff810588bc>] warn_slowpath_fmt+0x4c/0x50
[ 0.593429] [<ffffffff8134dd85>] ? strlcat+0x65/0x80
[ 0.594203] [<ffffffff81208954>] sysfs_add_one+0xd4/0x100
[ 0.594979] [<ffffffff81208b78>] create_dir+0x78/0xd0
[ 0.595753] [<ffffffff81208ec6>] sysfs_create_dir+0x86/0xe0
[ 0.596532] [<ffffffff81347e4c>] kobject_add_internal+0x9c/0x220
[ 0.597310] [<ffffffff81348307>] kobject_init_and_add+0x67/0x90
[ 0.598083] [<ffffffff81584a71>] ? efivar_create_sysfs_entry+0x61/0x1c0
[ 0.598859] [<ffffffff81584b2b>] efivar_create_sysfs_entry+0x11b/0x1c0
[ 0.599631] [<ffffffff8158517e>] register_efivars+0xde/0x420
[ 0.600395] [<ffffffff81d430a7>] ? edd_init+0x2f5/0x2f5
[ 0.601150] [<ffffffff81d4315f>] efivars_init+0xb8/0x104
[ 0.601903] [<ffffffff8100215a>] do_one_initcall+0x12a/0x180
[ 0.602659] [<ffffffff81d05d80>] kernel_init_freeable+0x13e/0x1c6
[ 0.603418] [<ffffffff81d05586>] ? loglevel+0x31/0x31
[ 0.604183] [<ffffffff816a6530>] ? rest_init+0x80/0x80
[ 0.604936] [<ffffffff816a653e>] kernel_init+0xe/0xf0
[ 0.605681] [<ffffffff816ce7ec>] ret_from_fork+0x7c/0xb0
[ 0.606414] [<ffffffff816a6530>] ? rest_init+0x80/0x80
[ 0.607143] ---[ end trace 1609741ab737eb29 ]---
There's not much we can do to work around and keep traversing the
variable list once we hit this firmware bug. Our only solution is to
terminate the loop because, as Lingzhu reports, some machines get
stuck when they encounter duplicate names,
> I had an IBM System x3100 M4 and x3850 X5 on which kernel would
> get stuck in infinite loop creating duplicate sysfs files because,
> for some reason, there are several duplicate boot entries in nvram
> getting GetNextVariableName into a circle of iteration (with
> period > 2).
Also disable the workqueue, as efivar_update_sysfs_entries() uses
GetNextVariableName() to figure out which variables have been created
since the last iteration. That algorithm isn't going to work if
GetNextVariableName() returns duplicates. Note that we don't disable
EFI variable creation completely on the affected machines, it's just
that any pstore dump-* files won't appear in sysfs until the next
boot.
Reported-by: Andre Heider <redacted>
Reported-by: Lingzhu Xiang <redacted>
Tested-by: Lingzhu Xiang <redacted>
Cc: Seiji Aguchi <redacted>
Signed-off-by: Matt Fleming <redacted>
[bwh: Backported to 3.2: reason is not checked in efi_pstore_write()]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -159,6 +159,7 @@ efivar_create_sysfs_entry(struct efivarsstaticvoidefivar_update_sysfs_entries(structwork_struct*);staticDECLARE_WORK(efivar_work,efivar_update_sysfs_entries);+staticboolefivar_wq_enabled=true;/* Return the number of unicode characters in data */staticunsignedlong
@@ -842,7 +843,8 @@ static int efi_pstore_write(enum pstore_if(found)efivar_unregister(found);-schedule_work(&efivar_work);+if(efivar_wq_enabled)+schedule_work(&efivar_work);*id=part;returnret;
From: Ben Hutchings <hidden> Date: 2013-03-25 01:29:47
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <redacted>
commit ec0971ba5372a4dfa753f232449d23a8fd98490e upstream.
We know that with some firmware implementations writing too much data to
UEFI variables can lead to bricking machines. Recent changes attempt to
address this issue, but for some it may still be prudent to avoid
writing large amounts of data until the solution has been proven on a
wide variety of hardware.
Crash dumps or other data from pstore can potentially be a large data
source. Add a pstore_module parameter to efivars to allow disabling its
use as a backend for pstore. Also add a config option,
CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE, to allow setting the default
value of this paramter to true (i.e. disabled by default).
Signed-off-by: Seth Forshee <redacted>
Cc: Josh Boyer <redacted>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Seiji Aguchi <redacted>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Matt Fleming <redacted>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <redacted>
---
@@ -62,6 +62,15 @@ config EFI_VARS_PSTOREwillallowwritingconsolemessages,crashdumps,oranythingelsesupportedbypstoretoEFIvariables.+configEFI_VARS_PSTORE_DEFAULT_DISABLE+bool"Disable using efivars as a pstore backend by default"+depends onEFI_VARS_PSTORE+defaultn+help+SayingYherewilldisabletheuseofefivarsasastorage+backendforpstorebydefault.Thissettingcanbeoverridden+usingtheefivarsmodule'spstore_disableparameter.+configEFI_PCDPbool"Console device selection via EFI PCDP or HCDP table"depends onACPI&&EFI&&IA64---a/drivers/firmware/efivars.c+++b/drivers/firmware/efivars.c
From: Ben Hutchings <hidden> Date: 2013-03-25 01:29:48
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: CQ Tang <redacted>
commit 66db3feb486c01349f767b98ebb10b0c3d2d021b upstream.
The increment of "to" in copy_user_handle_tail() will have incremented
before a failure has been noted. This causes us to skip a byte in the
failure case.
Only do the increment when assured there is no failure.
Signed-off-by: CQ Tang <redacted>
Link: http://lkml.kernel.org/r/20130318150221.8439.993.stgit@phlsvslse11.ph.intel.com
Signed-off-by: Mike Marciniszyn <redacted>
Signed-off-by: H. Peter Anvin <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
arch/x86/lib/usercopy_64.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:30:21
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 511f3c5326eabe1ece35202a404c24c0aeacc246 upstream.
This patch (as1666) fixes a regression in the UDC core. The core
takes care of unbinding gadget drivers, and it does the unbinding
before telling the UDC driver to turn off the controller hardware.
When the call to the udc_stop callback is made, the gadget no longer
has a driver. The callback routine should not be invoked with a
pointer to the old driver; doing so can cause problems (such as
use-after-free accesses in net2280).
This patch should be applied, with appropriate context changes, to all
the stable kernels going back to 3.1.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <redacted>
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/gadget/udc-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:30:45
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <redacted>
commit 618aa1068df29c37a58045fe940f9106664153fd upstream.
Remove bogus disconnect test introduced by 95bef012e ("USB: more serial
drivers writing after disconnect") which prevented queued data from
being freed on disconnect.
The possible IO it was supposed to prevent is long gone.
Signed-off-by: Johan Hovold <redacted>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/serial/garmin_gps.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
@@ -985,8 +982,6 @@ static void garmin_close(struct usb_seri/* keep reset state so we know that we must start a new session */if(garmin_data_p->state!=STATE_RESET)garmin_data_p->state=STATE_DISCONNECTED;--mutex_unlock(&port->serial->disc_mutex);}
From: Ben Hutchings <hidden> Date: 2013-03-25 01:31:01
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <redacted>
commit f8264340e694604863255cc0276491d17c402390 upstream.
According to XHCI specification (5.5.2.1) the IP is bit 0 and IE is bit 1
of IMAN register. Previously their definitions were reversed.
Even though there are no ill effects being observed from the swapped
definitions (because IMAN_IP is RW1C and in legacy PCI case we come in
with it already set to 1 so it was clearing itself even though we were
setting IMAN_IE instead of IMAN_IP), we should still correct the values.
This patch should be backported to kernels as old as 2.6.36, that
contain the commit 4e833c0b87a30798e67f06120cecebef6ee9644c "xhci: don't
re-enable IE constantly".
Signed-off-by: Dmitry Torokhov <redacted>
Signed-off-by: Sarah Sharp <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
drivers/usb/host/xhci.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
@@ -206,8 +206,8 @@ struct xhci_op_regs {/* bits 12:31 are reserved (and should be preserved on writes). *//* IMAN - Interrupt Management Register */-#define IMAN_IP (1 << 1)-#define IMAN_IE (1 << 0)+#define IMAN_IE (1 << 1)+#define IMAN_IP (1 << 0)/* USBSTS - USB status - status bitmasks *//* HC not running - set to 1 when run/stop bit is cleared. */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:31:20
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit 4d7b86c98e445b075c2c4c3757eb6d3d6efbe72e upstream.
In check_input_term() and parse_audio_feature_unit(), propagate the
error value that has been returned by a failing function instead of
-EINVAL. That helps cleaning up the error pathes in the mixer.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
sound/usb/mixer.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/sound/usb/mixer.c+++ b/sound/usb/mixer.c
@@ -711,8 +711,9 @@ static int check_input_term(struct mixercaseUAC2_CLOCK_SELECTOR:{structuac_selector_unit_descriptor*d=p1;/* call recursively to retrieve the channel info */-if(check_input_term(state,d->baSourceID[0],term)<0)-return-ENODEV;+err=check_input_term(state,d->baSourceID[0],term);+if(err<0)+returnerr;term->type=d->bDescriptorSubtype<<16;/* virtual type */term->id=id;term->name=uac_selector_unit_iSelector(d);
@@ -1263,8 +1264,9 @@ static int parse_audio_feature_unit(strureturnerr;/* determine the input source type and name */-if(check_input_term(state,hdr->bSourceID,&iterm)<0)-return-EINVAL;+err=check_input_term(state,hdr->bSourceID,&iterm);+if(err<0)+returnerr;master_bits=snd_usb_combine_bytes(bmaControls,csize);/* master configuration quirks */
From: Ben Hutchings <hidden> Date: 2013-03-25 01:31:37
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <redacted>
commit a686fd141e20244ad75f80ad54706da07d7bb90a upstream.
There is a typo in convert_to_spdif_status() about checking the
emphasis IEC958 status bit. It should check the given value instead
of the resultant value.
Reported-by: Martin Weishart <redacted>
Signed-off-by: Takashi Iwai <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
sound/pci/hda/hda_codec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
From: Ben Hutchings <hidden> Date: 2013-03-25 01:31:52
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit 83ea5d18d74f032a760fecde78c0210f66f7f70c upstream.
Creation of individual mixer controls may fail, but that shouldn't cause
the entire mixer creation to fail. Even worse, if the mixer creation
fails, that will error out the entire device probing.
All the functions called by parse_audio_unit() should return -EINVAL if
they find descriptors that are unsupported or believed to be malformed,
so we can safely handle this error code as a non-fatal condition in
snd_usb_mixer_controls().
That fixes a long standing bug which is commonly worked around by
adding quirks which make the driver ignore entire interfaces. Some of
them might now be unnecessary.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Reported-and-tested-by: Rodolfo Thomazelli <redacted>
Signed-off-by: Takashi Iwai <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
sound/usb/mixer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/usb/mixer.c+++ b/sound/usb/mixer.c
@@ -2020,7 +2020,7 @@ static int snd_usb_mixer_controls(structstate.oterm.type=le16_to_cpu(desc->wTerminalType);state.oterm.name=desc->iTerminal;err=parse_audio_unit(&state,desc->bSourceID);-if(err<0)+if(err<0&&err!=-EINVAL)returnerr;}else{/* UAC_VERSION_2 */structuac2_output_terminal_descriptor*desc=p;
@@ -2032,12 +2032,12 @@ static int snd_usb_mixer_controls(structstate.oterm.type=le16_to_cpu(desc->wTerminalType);state.oterm.name=desc->iTerminal;err=parse_audio_unit(&state,desc->bSourceID);-if(err<0)+if(err<0&&err!=-EINVAL)returnerr;/* for UAC2, use the same approach to also add the clock selectors */err=parse_audio_unit(&state,desc->bCSourceID);-if(err<0)+if(err<0&&err!=-EINVAL)returnerr;}}
From: Ben Hutchings <hidden> Date: 2013-03-25 01:32:34
3.2-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <redacted>
commit f853c616883a8de966873a1dab283f1369e275a1 upstream.
We've had several reports of people attempting to mount Windows 8 shares
and getting failures with a return code of -EINVAL. The default sec=
mode changed recently to sec=ntlmssp. With that, we expect and parse a
SPNEGO blob from the server in the NEGOTIATE reply.
The current decode_negTokenInit function first parses all of the
mechTypes and then tries to parse the rest of the negTokenInit reply.
The parser however currently expects a mechListMIC or nothing to follow the
mechTypes, but Windows 8 puts a mechToken field there instead to carry
some info for the new NegoEx stuff.
In practice, we don't do anything with the fields after the mechTypes
anyway so I don't see any real benefit in continuing to parse them.
This patch just has the kernel ignore the fields after the mechTypes.
We'll probably need to reinstate some of this if we ever want to support
NegoEx.
Reported-by: Jason Burgess <redacted>
Reported-by: Yan Li <redacted>
Signed-off-by: Jeff Layton <redacted>
Signed-off-by: Steve French <redacted>
Signed-off-by: Ben Hutchings <redacted>
---
fs/cifs/asn1.c | 53 +++++------------------------------------------------
1 file changed, 5 insertions(+), 48 deletions(-)
--- a/fs/cifs/asn1.c+++ b/fs/cifs/asn1.c
@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *secur}}-/* mechlistMIC */-if(asn1_header_decode(&ctx,&end,&cls,&con,&tag)==0){-/* Check if we have reached the end of the blob, but with-nomechListMic(e.g.NTLMSSPinsteadofKRB5)*/-if(ctx.error==ASN1_ERR_DEC_EMPTY)-gotodecode_negtoken_exit;-cFYI(1,"Error decoding last part negTokenInit exit3");-return0;-}elseif((cls!=ASN1_CTX)||(con!=ASN1_CON)){-/* tag = 3 indicating mechListMIC */-cFYI(1,"Exit 4 cls = %d con = %d tag = %d end = %p (%d)",-cls,con,tag,end,*end);-return0;-}--/* sequence */-if(asn1_header_decode(&ctx,&end,&cls,&con,&tag)==0){-cFYI(1,"Error decoding last part negTokenInit exit5");-return0;-}elseif((cls!=ASN1_UNI)||(con!=ASN1_CON)-||(tag!=ASN1_SEQ)){-cFYI(1,"cls = %d con = %d tag = %d end = %p (%d)",-cls,con,tag,end,*end);-}--/* sequence of */-if(asn1_header_decode(&ctx,&end,&cls,&con,&tag)==0){-cFYI(1,"Error decoding last part negTokenInit exit 7");-return0;-}elseif((cls!=ASN1_CTX)||(con!=ASN1_CON)){-cFYI(1,"Exit 8 cls = %d con = %d tag = %d end = %p (%d)",-cls,con,tag,end,*end);-return0;-}--/* general string */-if(asn1_header_decode(&ctx,&end,&cls,&con,&tag)==0){-cFYI(1,"Error decoding last part negTokenInit exit9");-return0;-}elseif((cls!=ASN1_UNI)||(con!=ASN1_PRI)-||(tag!=ASN1_GENSTR)){-cFYI(1,"Exit10 cls = %d con = %d tag = %d end = %p (%d)",-cls,con,tag,end,*end);-return0;-}-cFYI(1,"Need to call asn1_octets_decode() function for %s",-ctx.pointer);/* is this UTF-8 or ASCII? */-decode_negtoken_exit:+/*+*WecurrentlyignoreanythingattheendoftheSPNEGOblobafter+*themechTypeshavebeenparsed,sincenoneofthatinfois+*usedatthemoment.+*/return1;}