From 01bac5e42747c6d14b8975b8e9f41dfc6470c85b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ertu=C4=9Frul=20Erata?= Date: Mon, 26 Oct 2015 16:11:53 +0200 Subject: [PATCH] works for kernel-4.2.4 --- .../cpu-cacheinfo-Fix-teardown-path.patch | 81 ----- ...possible-leak-in-btrfs_ioctl_balance.patch | 53 ++++ ...Handle-escaped-paths-in-prepend_path.patch | 64 ---- ...-are-unreachable-from-their-mnt_root.patch | 110 ------- ..._630-have-separate-stick-button-bits.patch | 115 +++++++ ...-fix-IPv6-packets-not-being-bridged-.patch | 42 --- ...ack-use-nf_ct_tmpl_free-in-CT-synpro.patch | 103 ------- ...lter-ipset-Fixing-unnamed-union-init.patch | 155 ---------- ...Out-of-bound-access-in-hash-net-type.patch | 87 ------ ...les-Use-32-bit-addressing-register-f.patch | 32 -- ...ink-work-around-wrong-endianess-in-r.patch | 54 ---- ...lwifi-fix-firmware-filename-for-3160.patch | 32 ++ kernel/kernel/files/patches/mageia/series | 73 +++-- ...lear-sender-cpu-before-sending-to-tx.patch | 35 +++ ...o-an-inline-function-for-type-safety.patch | 35 +++ ...iple-skbs-on-recv-with-msg_peek-flag.patch | 60 ++++ ...rm-ux500-simplify-secondary-cpu-boot.patch | 280 ++++++++++++++++++ ...ild_cflags_module-for-erratum-843419.patch | 39 +++ ...ble-bpf-clear-sender_cpu-before-xmit.patch | 31 ++ ...get_filter-with-native-ebpf-programs.patch | 65 ++++ ...pported-filters-in-balance-arguments.patch | 57 ++++ ...fix-use-after-free-iterating-extrefs.patch | 61 ++++ ...o-ahash-ensure-statesize-is-non-zero.patch | 37 +++ ...lia_aesni_avx-fix-cpu-feature-checks.patch | 42 +++ ...to-sparc-initialize-blkcipher.ivsize.patch | 68 +++++ ...-drm-fix-locking-for-sysfs-dpms-file.patch | 72 +++++ ...erence-when-userspace-has-an-open-fd.patch | 65 ++++ ...framebuffer-dirty-rectangle-tracking.patch | 50 ++++ ...d-of-kmalloc-for-ethtool_get_strings.patch | 33 +++ ...ters-from-acpi-on-dell-inspiron-7348.patch | 108 +++++++ ...imepm-before-registering-to-the-core.patch | 51 ++++ ...imepm-before-registering-to-the-core.patch | 44 +++ ...imepm-before-registering-to-the-core.patch | 48 +++ ...-inet-fix-race-in-reqsk_queue_unlink.patch | 64 ++++ ...et-fix-races-in-reqsk_queue_hash_req.patch | 52 ++++ ...all-with-rt6_uncached_list_flush_dev.patch | 72 +++++ ...-x86-clean-up-kvm_arch_vcpu_runnable.patch | 90 ++++++ ...6-fix-rsm-into-64-bit-protected-mode.patch | 58 ++++ ...table-kvm-x86-fix-smi-to-halted-vcpu.patch | 32 ++ ...protect-tunnel-del_work-by-ref_count.patch | 55 ++++ ...ble-memcg-convert-threshold-to-bytes.patch | 35 +++ ...ix-max77843_chg_init-return-on-error.patch | 34 +++ ...d-pfmemalloc-check-in-sk_add_backlog.patch | 49 +++ ...fix-preparation-of-a-port-stp-update.patch | 47 +++ ...umbers-for-correct-work-with-ethtool.patch | 40 +++ ...-unix-fix-logic-about-sk_peek_offset.patch | 67 +++++ ...skb-to-alloc-size-to-avoid-msg_trunc.patch | 107 +++++++ ...fsd-blocklayout-accept-any-minlength.patch | 43 +++ ...locate-memory-from-offline-numa-node.patch | 35 +++ ...rride-sk-sk_state-in-pppoe_flush_dev.patch | 76 +++++ ...ff-fix-skb-checksum-flag-on-skb-pull.patch | 68 +++++ ...kbuff-fix-skb-checksum-partial-check.patch | 58 ++++ ...ortance-field-to-new-header-position.patch | 57 ++++ ...e-sure-delayed-work-run-in-local-cpu.patch | 78 +++++ ...ric-Fix-reset-behaviour-on-legacy-bo.patch | 38 --- ...-1.0-only-restrictions-to-support-xh.patch | 56 ---- ...-crash-by-mapping-EFI-memmap-entries.patch | 174 ----------- ...-efi-Fix-multiple-GOP-device-support.patch | 92 ++++++ kernel/kernel/pspec.xml | 36 +-- 59 files changed, 2859 insertions(+), 1036 deletions(-) delete mode 100644 kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch create mode 100644 kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch delete mode 100644 kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch delete mode 100644 kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch create mode 100644 kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch delete mode 100644 kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch create mode 100644 kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch delete mode 100644 kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch delete mode 100644 kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch delete mode 100644 kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch create mode 100644 kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch diff --git a/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch b/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch deleted file mode 100644 index 750fba8d..00000000 --- a/kernel/kernel/files/patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 2110d70c5e58326a10e93cfefdc0b3686e2ada12 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov -Date: Sat, 8 Aug 2015 10:46:02 +0200 -Subject: cpu/cacheinfo: Fix teardown path -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Philip Müller reported a hang when booting 32-bit 4.1 kernel on an AMD -box. A fragment of the splat was enough to pinpoint the issue: - - task: f58e0000 ti: f58e8000 task.ti: f58e800 - EIP: 0060:[] EFLAGS: 00010206 CPU: 0 - EIP is at free_cache_attributes+0x83/0xd0 - EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000 - ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0 - DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 - CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0 - -cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo descriptor -while the respective teardown path cache_shared_cpu_map_remove() didn't. -Fix that. - ->From tglx's version: to be on the safe side, move the cacheinfo -descriptor check to free_cache_attributes(), thus cleaning up the -hotplug path a little and making this even more robust. - -Reported-and-tested-by: Philip Müller -Reviewed-by: Thomas Gleixner -Acked-by: Sudeep Holla -Cc: # 4.1 -Cc: Andre Przywara -Cc: Guenter Roeck -Cc: "H. Peter Anvin" -Cc: Ingo Molnar -Cc: linux-kernel@vger.kernel.org -Cc: manjaro-dev@manjaro.org -Cc: Philip Müller -Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org -Signed-off-by: Borislav Petkov -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c -index 764280a..e9fd32e 100644 ---- a/drivers/base/cacheinfo.c -+++ b/drivers/base/cacheinfo.c -@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - if (sibling == cpu) /* skip itself */ - continue; -+ - sib_cpu_ci = get_cpu_cacheinfo(sibling); -+ if (!sib_cpu_ci->info_list) -+ continue; -+ - sib_leaf = sib_cpu_ci->info_list + index; - cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map); - cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map); -@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu) - - static void free_cache_attributes(unsigned int cpu) - { -+ if (!per_cpu_cacheinfo(cpu)) -+ return; -+ - cache_shared_cpu_map_remove(cpu); - - kfree(per_cpu_cacheinfo(cpu)); -@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb, - break; - case CPU_DEAD: - cache_remove_dev(cpu); -- if (per_cpu_cacheinfo(cpu)) -- free_cache_attributes(cpu); -+ free_cache_attributes(cpu); - break; - } - return notifier_from_errno(rc); --- -cgit v0.10.2 - diff --git a/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch b/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch new file mode 100644 index 00000000..790bf196 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch @@ -0,0 +1,53 @@ +From 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e Mon Sep 17 00:00:00 2001 +From: Christian Engelmayer +Date: Wed, 21 Oct 2015 00:50:06 +0200 +Subject: btrfs: fix possible leak in btrfs_ioctl_balance() + +Commit 8eb934591f8b ("btrfs: check unsupported filters in balance +arguments") adds a jump to exit label out_bargs in case the argument +check fails. At this point in addition to the bargs memory, the +memory for struct btrfs_balance_control has already been allocated. +Ownership of bctl is passed to btrfs_balance() in the good case, +thus the memory is not freed due to the introduced jump. Make sure +that the memory gets freed in any case as necessary. Detected by +Coverity CID 1328378. + +Signed-off-by: Christian Engelmayer +Reviewed-by: David Sterba +Signed-off-by: Chris Mason +--- + fs/btrfs/ioctl.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 3e3e613..8d20f3b 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -4641,7 +4641,7 @@ locked: + + if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { + ret = -EINVAL; +- goto out_bargs; ++ goto out_bctl; + } + + do_balance: +@@ -4655,12 +4655,15 @@ do_balance: + need_unlock = false; + + ret = btrfs_balance(bctl, bargs); ++ bctl = NULL; + + if (arg) { + if (copy_to_user(arg, bargs, sizeof(*bargs))) + ret = -EFAULT; + } + ++out_bctl: ++ kfree(bctl); + out_bargs: + kfree(bargs); + out_unlock: +-- +cgit v0.11.2 + diff --git a/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch b/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch deleted file mode 100644 index d5bce46a..00000000 --- a/kernel/kernel/files/patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 143081a13f31bcf05cb5685f628b6fda65d05237 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Sat, 15 Aug 2015 13:36:12 -0500 -Subject: [PATCH 1/2] dcache: Handle escaped paths in prepend_path - -commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream. - -A rename can result in a dentry that by walking up d_parent -will never reach it's mnt_root. For lack of a better term -I call this an escaped path. - -prepend_path is called by four different functions __d_path, -d_absolute_path, d_path, and getcwd. - -__d_path only wants to see paths are connected to the root it passes -in. So __d_path needs prepend_path to return an error. - -d_absolute_path similarly wants to see paths that are connected to -some root. Escaped paths are not connected to any mnt_root so -d_absolute_path needs prepend_path to return an error greater -than 1. So escaped paths will be treated like paths on lazily -unmounted mounts. - -getcwd needs to prepend "(unreachable)" so getcwd also needs -prepend_path to return an error. - -d_path is the interesting hold out. d_path just wants to print -something, and does not care about the weird cases. Which raises -the question what should be printed? - -Given that / should result in -ENOENT I -believe it is desirable for escaped paths to be printed as empty -paths. As there are not really any meaninful path components when -considered from the perspective of a mount tree. - -So tweak prepend_path to return an empty path with an new error -code of 3 when it encounters an escaped path. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Al Viro ---- - fs/dcache.c | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/fs/dcache.c b/fs/dcache.c -index 9b5fe503f6cb..e3b44ca75a1b 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -2926,6 +2926,13 @@ restart: - - if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { - struct mount *parent = ACCESS_ONCE(mnt->mnt_parent); -+ /* Escaped? */ -+ if (dentry != vfsmnt->mnt_root) { -+ bptr = *buffer; -+ blen = *buflen; -+ error = 3; -+ break; -+ } - /* Global root? */ - if (mnt != parent) { - dentry = ACCESS_ONCE(mnt->mnt_mountpoint); --- -2.2.1 diff --git a/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch b/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch deleted file mode 100644 index ee6045af..00000000 --- a/kernel/kernel/files/patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 701cf206d76af24fc948b3a798c4ee6b7f149910 Mon Sep 17 00:00:00 2001 -From: "Eric W. Biederman" -Date: Sat, 15 Aug 2015 20:27:13 -0500 -Subject: [PATCH 2/2] vfs: Test for and handle paths that are unreachable from - their mnt_root - -commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream. - -In rare cases a directory can be renamed out from under a bind mount. -In those cases without special handling it becomes possible to walk up -the directory tree to the root dentry of the filesystem and down -from the root dentry to every other file or directory on the filesystem. - -Like division by zero .. from an unconnected path can not be given -a useful semantic as there is no predicting at which path component -the code will realize it is unconnected. We certainly can not match -the current behavior as the current behavior is a security hole. - -Therefore when encounting .. when following an unconnected path -return -ENOENT. - -- Add a function path_connected to verify path->dentry is reachable - from path->mnt.mnt_root. AKA to validate that rename did not do - something nasty to the bind mount. - - To avoid races path_connected must be called after following a path - component to it's next path component. - -Signed-off-by: "Eric W. Biederman" -Signed-off-by: Al Viro ---- - fs/namei.c | 27 +++++++++++++++++++++++++-- - 1 file changed, 25 insertions(+), 2 deletions(-) - -diff --git a/fs/namei.c b/fs/namei.c -index 1c2105ed20c5..29b927938b8c 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -560,6 +560,24 @@ static int __nd_alloc_stack(struct nameidata *nd) - return 0; - } - -+/** -+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root -+ * @path: nameidate to verify -+ * -+ * Rename can sometimes move a file or directory outside of a bind -+ * mount, path_connected allows those cases to be detected. -+ */ -+static bool path_connected(const struct path *path) -+{ -+ struct vfsmount *mnt = path->mnt; -+ -+ /* Only bind mounts can have disconnected paths */ -+ if (mnt->mnt_root == mnt->mnt_sb->s_root) -+ return true; -+ -+ return is_subdir(path->dentry, mnt->mnt_root); -+} -+ - static inline int nd_alloc_stack(struct nameidata *nd) - { - if (likely(nd->depth != EMBEDDED_LEVELS)) -@@ -1296,6 +1314,8 @@ static int follow_dotdot_rcu(struct nameidata *nd) - return -ECHILD; - nd->path.dentry = parent; - nd->seq = seq; -+ if (unlikely(!path_connected(&nd->path))) -+ return -ENOENT; - break; - } else { - struct mount *mnt = real_mount(nd->path.mnt); -@@ -1396,7 +1416,7 @@ static void follow_mount(struct path *path) - } - } - --static void follow_dotdot(struct nameidata *nd) -+static int follow_dotdot(struct nameidata *nd) - { - if (!nd->root.mnt) - set_root(nd); -@@ -1412,6 +1432,8 @@ static void follow_dotdot(struct nameidata *nd) - /* rare case of legitimate dget_parent()... */ - nd->path.dentry = dget_parent(nd->path.dentry); - dput(old); -+ if (unlikely(!path_connected(&nd->path))) -+ return -ENOENT; - break; - } - if (!follow_up(&nd->path)) -@@ -1419,6 +1441,7 @@ static void follow_dotdot(struct nameidata *nd) - } - follow_mount(&nd->path); - nd->inode = nd->path.dentry->d_inode; -+ return 0; - } - - /* -@@ -1634,7 +1657,7 @@ static inline int handle_dots(struct nameidata *nd, int type) - if (nd->flags & LOOKUP_RCU) { - return follow_dotdot_rcu(nd); - } else -- follow_dotdot(nd); -+ return follow_dotdot(nd); - } - return 0; - } --- -2.2.1 - diff --git a/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch b/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch new file mode 100644 index 00000000..90364e15 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch @@ -0,0 +1,115 @@ +From: Hans de Goede +Subject: [PATCH] alps: Only the Dell Latitude D420/430/620/630 have separate stick button bits +Date: Wed, 21 Oct 2015 10:16:18 +0200 + +commit 92bac83dd79e ("Input: alps - non interleaved V2 dualpoint has +separate stick button bits") assumes that all alps v2 non-interleaved +dual point setups have the separate stick button bits. + +Later we limited this to Dell laptops only because of reports that this +broke things on non Dell laptops. Now it turns out that this breaks things +on the Dell Latitude D600 too. So it seems that only the Dell Latitude +D420/430/620/630, which all share the same touchpad / stick combo, +have these separate bits. + +This patch limits the checking of the separate bits to only these models +fixing regressions with other models. + +Reported-and-tested-by: Larry Finger +Cc: stable@vger.kernel.org +Tested-by: Hans de Goede +Signed-off-by: Hans de Goede +--- + drivers/input/mouse/alps.c | 48 ++++++++++++++++++++++++++++++++++++++++------ + 1 file changed, 42 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index 4d24686..41e6cb5 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -100,7 +100,7 @@ static const struct alps_nibble_commands alps_v6_nibble_commands[] = { + #define ALPS_FOUR_BUTTONS 0x40 /* 4 direction button present */ + #define ALPS_PS2_INTERLEAVED 0x80 /* 3-byte PS/2 packet interleaved with + 6-byte ALPS packet */ +-#define ALPS_DELL 0x100 /* device is a Dell laptop */ ++#define ALPS_STICK_BITS 0x100 /* separate stick button bits */ + #define ALPS_BUTTONPAD 0x200 /* device is a clickpad */ + + static const struct alps_model_info alps_model_data[] = { +@@ -159,6 +159,43 @@ static const struct alps_protocol_info alps_v8_protocol_data = { + ALPS_PROTO_V8, 0x18, 0x18, 0 + }; + ++/* ++ * Some v2 models report the stick buttons in separate bits ++ */ ++static const struct dmi_system_id alps_dmi_has_separate_stick_buttons[] = { ++#if defined(CONFIG_DMI) && defined(CONFIG_X86) ++ { ++ /* Extrapolated from other entries */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D420"), ++ }, ++ }, ++ { ++ /* Reported-by: Hans de Bruin */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D430"), ++ }, ++ }, ++ { ++ /* Reported-by: Hans de Goede */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D620"), ++ }, ++ }, ++ { ++ /* Extrapolated from other entries */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D630"), ++ }, ++ }, ++#endif ++ { } ++}; ++ + static void alps_set_abs_params_st(struct alps_data *priv, + struct input_dev *dev1); + static void alps_set_abs_params_semi_mt(struct alps_data *priv, +@@ -253,9 +290,8 @@ static void alps_process_packet_v1_v2(struct psmouse *psmouse) + return; + } + +- /* Dell non interleaved V2 dualpoint has separate stick button bits */ +- if (priv->proto_version == ALPS_PROTO_V2 && +- priv->flags == (ALPS_DELL | ALPS_PASS | ALPS_DUALPOINT)) { ++ /* Some models have separate stick button bits */ ++ if (priv->flags & ALPS_STICK_BITS) { + left |= packet[0] & 1; + right |= packet[0] & 2; + middle |= packet[0] & 4; +@@ -2552,8 +2588,6 @@ static int alps_set_protocol(struct psmouse *psmouse, + priv->byte0 = protocol->byte0; + priv->mask0 = protocol->mask0; + priv->flags = protocol->flags; +- if (dmi_name_in_vendors("Dell")) +- priv->flags |= ALPS_DELL; + + priv->x_max = 2000; + priv->y_max = 1400; +@@ -2568,6 +2602,8 @@ static int alps_set_protocol(struct psmouse *psmouse, + priv->set_abs_params = alps_set_abs_params_st; + priv->x_max = 1023; + priv->y_max = 767; ++ if (dmi_check_system(alps_dmi_has_separate_stick_buttons)) ++ priv->flags |= ALPS_STICK_BITS; + break; + + case ALPS_PROTO_V3: +-- +2.5.0 + diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch b/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch deleted file mode 100644 index bf89c51a..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 18e1db67e93ed75d9dc0d34c8d783ccf10547c2b Mon Sep 17 00:00:00 2001 -From: Bernhard Thaler -Date: Thu, 13 Aug 2015 08:58:15 +0200 -Subject: [PATCH] netfilter: bridge: fix IPv6 packets not being bridged with - CONFIG_IPV6=n - -230ac490f7fba introduced a dependency to CONFIG_IPV6 which breaks bridging -of IPv6 packets on a bridge with CONFIG_IPV6=n. - -Sysctl entry /proc/sys/net/bridge/bridge-nf-call-ip6tables defaults to 1, -for this reason packets are handled by br_nf_pre_routing_ipv6(). When compiled -with CONFIG_IPV6=n this function returns NF_DROP but should return NF_ACCEPT -to let packets through. - -Change CONFIG_IPV6=n br_nf_pre_routing_ipv6() return value to NF_ACCEPT. - -Tested with a simple bridge with two interfaces and IPv6 packets trying -to pass from host on left side to host on right side of the bridge. - -Fixes: 230ac490f7fba ("netfilter: bridge: split ipv6 code into separated file") -Signed-off-by: Bernhard Thaler -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/br_netfilter.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h -index bab824b..d4c6b5f 100644 ---- a/include/net/netfilter/br_netfilter.h -+++ b/include/net/netfilter/br_netfilter.h -@@ -59,7 +59,7 @@ static inline unsigned int - br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb, - const struct nf_hook_state *state) - { -- return NF_DROP; -+ return NF_ACCEPT; - } - #endif - --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch b/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch deleted file mode 100644 index efd42653..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 9cf94eab8b309e8bcc78b41dd1561c75b537dd0b Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Mon, 31 Aug 2015 19:11:02 +0200 -Subject: [PATCH] netfilter: conntrack: use nf_ct_tmpl_free in CT/synproxy - error paths - -Commit 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack -templates") migrated templates to the new allocator api, but forgot to -update error paths for them in CT and synproxy to use nf_ct_tmpl_free() -instead of nf_conntrack_free(). - -Due to that, memory is being freed into the wrong kmemcache, but also -we drop the per net reference count of ct objects causing an imbalance. - -In Brad's case, this leads to a wrap-around of net->ct.count and thus -lets __nf_conntrack_alloc() refuse to create a new ct object: - - [ 10.340913] xt_addrtype: ipv6 does not support BROADCAST matching - [ 10.810168] nf_conntrack: table full, dropping packet - [ 11.917416] r8169 0000:07:00.0 eth0: link up - [ 11.917438] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready - [ 12.815902] nf_conntrack: table full, dropping packet - [ 15.688561] nf_conntrack: table full, dropping packet - [ 15.689365] nf_conntrack: table full, dropping packet - [ 15.690169] nf_conntrack: table full, dropping packet - [ 15.690967] nf_conntrack: table full, dropping packet - [...] - -With slab debugging, it also reports the wrong kmemcache (kmalloc-512 vs. -nf_conntrack_ffffffff81ce75c0) and reports poison overwrites, etc. Thus, -to fix the problem, export and use nf_ct_tmpl_free() instead. - -Fixes: 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack templates") -Reported-by: Brad Jackson -Signed-off-by: Daniel Borkmann -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/nf_conntrack.h | 1 + - net/netfilter/nf_conntrack_core.c | 3 ++- - net/netfilter/nf_synproxy_core.c | 2 +- - net/netfilter/xt_CT.c | 2 +- - 4 files changed, 5 insertions(+), 3 deletions(-) - -diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h -index 37cd391..4023c4c 100644 ---- a/include/net/netfilter/nf_conntrack.h -+++ b/include/net/netfilter/nf_conntrack.h -@@ -292,6 +292,7 @@ extern unsigned int nf_conntrack_hash_rnd; - void init_nf_conntrack_hash_rnd(void); - - struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags); -+void nf_ct_tmpl_free(struct nf_conn *tmpl); - - #define NF_CT_STAT_INC(net, count) __this_cpu_inc((net)->ct.stat->count) - #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count) -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 3c20d02..0625a42 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -320,12 +320,13 @@ out_free: - } - EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc); - --static void nf_ct_tmpl_free(struct nf_conn *tmpl) -+void nf_ct_tmpl_free(struct nf_conn *tmpl) - { - nf_ct_ext_destroy(tmpl); - nf_ct_ext_free(tmpl); - kfree(tmpl); - } -+EXPORT_SYMBOL_GPL(nf_ct_tmpl_free); - - static void - destroy_conntrack(struct nf_conntrack *nfct) -diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c -index d7f1685..d6ee8f8 100644 ---- a/net/netfilter/nf_synproxy_core.c -+++ b/net/netfilter/nf_synproxy_core.c -@@ -378,7 +378,7 @@ static int __net_init synproxy_net_init(struct net *net) - err3: - free_percpu(snet->stats); - err2: -- nf_conntrack_free(ct); -+ nf_ct_tmpl_free(ct); - err1: - return err; - } -diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c -index 43ddeee..f3377ce 100644 ---- a/net/netfilter/xt_CT.c -+++ b/net/netfilter/xt_CT.c -@@ -233,7 +233,7 @@ out: - return 0; - - err3: -- nf_conntrack_free(ct); -+ nf_ct_tmpl_free(ct); - err2: - nf_ct_l3proto_module_put(par->family); - err1: --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch deleted file mode 100644 index 9d697cf1..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch +++ /dev/null @@ -1,155 +0,0 @@ -From 96be5f2806cd65a2ebced3bfcdf7df0116e6c4a6 Mon Sep 17 00:00:00 2001 -From: Elad Raz -Date: Sat, 22 Aug 2015 08:44:11 +0300 -Subject: [PATCH] netfilter: ipset: Fixing unnamed union init - -In continue to proposed Vinson Lee's post [1], this patch fixes compilation -issues founded at gcc 4.4.7. The initialization of .cidr field of unnamed -unions causes compilation error in gcc 4.4.x. - -References - -Visible links -[1] https://lkml.org/lkml/2015/7/5/74 - -Signed-off-by: Elad Raz -Signed-off-by: Pablo Neira Ayuso ---- - net/netfilter/ipset/ip_set_hash_netnet.c | 20 ++++++++++++++++++-- - net/netfilter/ipset/ip_set_hash_netportnet.c | 20 ++++++++++++++++++-- - 2 files changed, 36 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c -index 3c862c0..a93dfeb 100644 ---- a/net/netfilter/ipset/ip_set_hash_netnet.c -+++ b/net/netfilter/ipset/ip_set_hash_netnet.c -@@ -131,6 +131,13 @@ hash_netnet4_data_next(struct hash_netnet4_elem *next, - #define HOST_MASK 32 - #include "ip_set_hash_gen.h" - -+static void -+hash_netnet4_init(struct hash_netnet4_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -160,7 +167,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netnet4_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 ip = 0, ip_to = 0, last; - u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2; -@@ -169,6 +176,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netnet4_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) - return -IPSET_ERR_PROTOCOL; -@@ -357,6 +365,13 @@ hash_netnet6_data_next(struct hash_netnet4_elem *next, - #define IP_SET_EMIT_CREATE - #include "ip_set_hash_gen.h" - -+static void -+hash_netnet6_init(struct hash_netnet6_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -385,13 +400,14 @@ hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[], - enum ipset_adt adt, u32 *lineno, u32 flags, bool retried) - { - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netnet6_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - int ret; - - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netnet6_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS))) - return -IPSET_ERR_PROTOCOL; -diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c -index 0c68734..9a14c23 100644 ---- a/net/netfilter/ipset/ip_set_hash_netportnet.c -+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c -@@ -142,6 +142,13 @@ hash_netportnet4_data_next(struct hash_netportnet4_elem *next, - #define HOST_MASK 32 - #include "ip_set_hash_gen.h" - -+static void -+hash_netportnet4_init(struct hash_netportnet4_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -175,7 +182,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netportnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netportnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netportnet4_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 ip = 0, ip_to = 0, ip_last, p = 0, port, port_to; - u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2; -@@ -185,6 +192,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netportnet4_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || -@@ -412,6 +420,13 @@ hash_netportnet6_data_next(struct hash_netportnet4_elem *next, - #define IP_SET_EMIT_CREATE - #include "ip_set_hash_gen.h" - -+static void -+hash_netportnet6_init(struct hash_netportnet6_elem *e) -+{ -+ e->cidr[0] = HOST_MASK; -+ e->cidr[1] = HOST_MASK; -+} -+ - static int - hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb, - const struct xt_action_param *par, -@@ -445,7 +460,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], - { - const struct hash_netportnet *h = set->data; - ipset_adtfn adtfn = set->variant->adt[adt]; -- struct hash_netportnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, }; -+ struct hash_netportnet6_elem e = { }; - struct ip_set_ext ext = IP_SET_INIT_UEXT(set); - u32 port, port_to; - bool with_ports = false; -@@ -454,6 +469,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], - if (tb[IPSET_ATTR_LINENO]) - *lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]); - -+ hash_netportnet6_init(&e); - if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] || - !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) || - !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) || --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch b/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch deleted file mode 100644 index 002628fd..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 6fe7ccfd77415a6ba250c10c580eb3f9acf79753 Mon Sep 17 00:00:00 2001 -From: Jozsef Kadlecsik -Date: Tue, 25 Aug 2015 11:17:51 +0200 -Subject: [PATCH] netfilter: ipset: Out of bound access in hash:net* types - fixed - -Dave Jones reported that KASan detected out of bounds access in hash:net* -types: - -[ 23.139532] ================================================================== -[ 23.146130] BUG: KASan: out of bounds access in hash_net4_add_cidr+0x1db/0x220 at addr ffff8800d4844b58 -[ 23.152937] Write of size 4 by task ipset/457 -[ 23.159742] ============================================================================= -[ 23.166672] BUG kmalloc-512 (Not tainted): kasan: bad access detected -[ 23.173641] ----------------------------------------------------------------------------- -[ 23.194668] INFO: Allocated in hash_net_create+0x16a/0x470 age=7 cpu=1 pid=456 -[ 23.201836] __slab_alloc.constprop.66+0x554/0x620 -[ 23.208994] __kmalloc+0x2f2/0x360 -[ 23.216105] hash_net_create+0x16a/0x470 -[ 23.223238] ip_set_create+0x3e6/0x740 -[ 23.230343] nfnetlink_rcv_msg+0x599/0x640 -[ 23.237454] netlink_rcv_skb+0x14f/0x190 -[ 23.244533] nfnetlink_rcv+0x3f6/0x790 -[ 23.251579] netlink_unicast+0x272/0x390 -[ 23.258573] netlink_sendmsg+0x5a1/0xa50 -[ 23.265485] SYSC_sendto+0x1da/0x2c0 -[ 23.272364] SyS_sendto+0xe/0x10 -[ 23.279168] entry_SYSCALL_64_fastpath+0x12/0x6f - -The bug is fixed in the patch and the testsuite is extended in ipset -to check cidr handling more thoroughly. - -Signed-off-by: Jozsef Kadlecsik ---- - net/netfilter/ipset/ip_set_hash_gen.h | 12 ++++++++---- - 1 file changed, 8 insertions(+), 4 deletions(-) - -diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h -index afe905c..691b54f 100644 ---- a/net/netfilter/ipset/ip_set_hash_gen.h -+++ b/net/netfilter/ipset/ip_set_hash_gen.h -@@ -152,9 +152,13 @@ htable_bits(u32 hashsize) - #define SET_HOST_MASK(family) (family == AF_INET ? 32 : 128) - - #ifdef IP_SET_HASH_WITH_NET0 -+/* cidr from 0 to SET_HOST_MASK() value and c = cidr + 1 */ - #define NLEN(family) (SET_HOST_MASK(family) + 1) -+#define CIDR_POS(c) ((c) - 1) - #else -+/* cidr from 1 to SET_HOST_MASK() value and c = cidr + 1 */ - #define NLEN(family) SET_HOST_MASK(family) -+#define CIDR_POS(c) ((c) - 2) - #endif - - #else -@@ -305,7 +309,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - } else if (h->nets[i].cidr[n] < cidr) { - j = i; - } else if (h->nets[i].cidr[n] == cidr) { -- h->nets[cidr - 1].nets[n]++; -+ h->nets[CIDR_POS(cidr)].nets[n]++; - return; - } - } -@@ -314,7 +318,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - h->nets[i].cidr[n] = h->nets[i - 1].cidr[n]; - } - h->nets[i].cidr[n] = cidr; -- h->nets[cidr - 1].nets[n] = 1; -+ h->nets[CIDR_POS(cidr)].nets[n] = 1; - } - - static void -@@ -325,8 +329,8 @@ mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n) - for (i = 0; i < nets_length; i++) { - if (h->nets[i].cidr[n] != cidr) - continue; -- h->nets[cidr - 1].nets[n]--; -- if (h->nets[cidr - 1].nets[n] > 0) -+ h->nets[CIDR_POS(cidr)].nets[n]--; -+ if (h->nets[CIDR_POS(cidr)].nets[n] > 0) - return; - for (j = i; j < net_end && h->nets[j].cidr[n]; j++) - h->nets[j].cidr[n] = h->nets[j + 1].cidr[n]; --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch b/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch deleted file mode 100644 index c3c88d05..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch +++ /dev/null @@ -1,32 +0,0 @@ -From bf798657eb5ba57552096843c315f096fdf9b715 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Wed, 12 Aug 2015 17:41:00 +0200 -Subject: [PATCH] netfilter: nf_tables: Use 32 bit addressing register from - nft_type_to_reg() - -nft_type_to_reg() needs to return the register in the new 32 bit addressing, -otherwise we hit EINVAL when using mappings. - -Fixes: 49499c3 ("netfilter: nf_tables: switch registers to 32 bit addressing") -Reported-by: Andreas Schultz -Signed-off-by: Pablo Neira Ayuso ---- - include/net/netfilter/nf_tables.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h -index 2a24668..aa8bee7 100644 ---- a/include/net/netfilter/nf_tables.h -+++ b/include/net/netfilter/nf_tables.h -@@ -125,7 +125,7 @@ static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg) - - static inline enum nft_registers nft_type_to_reg(enum nft_data_types type) - { -- return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1; -+ return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE; - } - - unsigned int nft_parse_register(const struct nlattr *attr); --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch b/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch deleted file mode 100644 index f5b695c9..00000000 --- a/kernel/kernel/files/patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch +++ /dev/null @@ -1,54 +0,0 @@ -From a9de9777d613500b089a7416f936bf3ae5f070d2 Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Fri, 28 Aug 2015 21:01:43 +0200 -Subject: [PATCH] netfilter: nfnetlink: work around wrong endianess in res_id - field - -The convention in nfnetlink is to use network byte order in every header field -as well as in the attribute payload. The initial version of the batching -infrastructure assumes that res_id comes in host byte order though. - -The only client of the batching infrastructure is nf_tables, so let's add a -workaround to address this inconsistency. We currently have 11 nfnetlink -subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem -2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias -of nf_tables from the nfnetlink batching path when interpreting the res_id -field. - -Based on original patch from Florian Westphal. - -Reported-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso ---- - net/netfilter/nfnetlink.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index 0c0e8ec..70277b1 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -444,6 +444,7 @@ done: - static void nfnetlink_rcv(struct sk_buff *skb) - { - struct nlmsghdr *nlh = nlmsg_hdr(skb); -+ u_int16_t res_id; - int msglen; - - if (nlh->nlmsg_len < NLMSG_HDRLEN || -@@ -468,7 +469,12 @@ static void nfnetlink_rcv(struct sk_buff *skb) - - nfgenmsg = nlmsg_data(nlh); - skb_pull(skb, msglen); -- nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id); -+ /* Work around old nft using host byte order */ -+ if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES) -+ res_id = NFNL_SUBSYS_NFTABLES; -+ else -+ res_id = ntohs(nfgenmsg->res_id); -+ nfnetlink_rcv_batch(skb, nlh, res_id); - } else { - netlink_rcv_skb(skb, &nfnetlink_rcv_msg); - } --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch b/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch new file mode 100644 index 00000000..fb4624d2 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch @@ -0,0 +1,32 @@ +From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Tue, 22 Sep 2015 10:47:27 +0200 +Subject: [PATCH] iwlwifi: fix firmware filename for 3160 + +The MODULE_FIRMWARE() for 3160 should be using the 7260 version as +it's done in the device configuration struct instead of referencing +IWL3160_UCODE_API_OK which doesn't even exist. + +Cc: [3.8+] +Reported-by: Hauke Mehrtens +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +--- + drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c +index 6951aba..3fb327d 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-7000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-7000.c +@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = { + }; + + MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); +-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK)); ++MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); + MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); + MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK)); +-- +2.6.2 + diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index 7099472e..99f6d3c8 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,6 +14,47 @@ ### ### Stable Queue ### +stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch +stable-l2tp-protect-tunnel-del_work-by-ref_count.patch +stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch +stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch +stable-net-unix-fix-logic-about-sk_peek_offset.patch +stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch +stable-skbuff-fix-skb-checksum-partial-check.patch +stable-net-dsa-fix-preparation-of-a-port-stp-update.patch +stable-inet-fix-races-in-reqsk_queue_hash_req.patch +stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch +stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch +stable-inet-fix-race-in-reqsk_queue_unlink.patch +stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch +stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch +stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch +stable-bpf-clear-sender_cpu-before-xmit.patch +stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch +stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch +stable-tipc-move-fragment-importance-field-to-new-header-position.patch +stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch +stable-drm-fix-locking-for-sysfs-dpms-file.patch +stable-crypto-sparc-initialize-blkcipher.ivsize.patch +stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch +stable-crypto-ahash-ensure-statesize-is-non-zero.patch +stable-memcg-convert-threshold-to-bytes.patch +stable-btrfs-check-unsupported-filters-in-balance-arguments.patch +stable-btrfs-fix-use-after-free-iterating-extrefs.patch +stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch +stable-arm-ux500-simplify-secondary-cpu-boot.patch +stable-nfsd-blocklayout-accept-any-minlength.patch +stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch +stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch +stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch +stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch +stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch +stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch +stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch +stable-kvm-x86-fix-smi-to-halted-vcpu.patch +stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch +stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch +stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch ### ### Arch x86 @@ -38,16 +79,13 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch # slows down boot Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch -# efi bootfix -x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch +# EFI +x86-efi-Fix-multiple-GOP-device-support.patch ### ### Core ### -# amd cpu boot crash (mga#16527) -cpu-cacheinfo-Fix-teardown-path.patch - ### ### i2c ### @@ -130,9 +168,8 @@ scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch fs-aufs4.patch fs-aufs4-modular.patch -# Bind mount escape fixes (CVE-2015-2925) -fs-dcache-Handle-escaped-paths-in-prepend_path.patch -fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch +# btrfs memleak +fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch ### ### FireWire @@ -177,6 +214,9 @@ gpu-drm-mach64-3.18-buildfix.patch input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch +# fix alps breakage +input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch + ### ### idle ### @@ -217,17 +257,12 @@ net-netfilter-psd.patch net-netfilter-psd-mdv.patch net-netfilter-psd-2.6.35-buildfix.patch -# netfilter fixes -net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch -net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch -net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch -net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch -net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch -net-netfilter-ipset-Fixing-unnamed-union-init.patch - # wireless lockup net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch +# iwlwifi borked fw reference +net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch + ### ### Platform drivers ### @@ -275,12 +310,6 @@ hid-usbhid-IBM-BladeCenterHS20-quirk.patch usb-storage-unusual_devs-add-id.patch usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch -# boot hang fix -usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch - -# xhci 1.1 support -usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch - ### ### V4L ### diff --git a/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch b/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch new file mode 100644 index 00000000..e2763086 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: WANG Cong +Date: Tue, 6 Oct 2015 17:23:47 -0700 +Subject: act_mirred: clear sender cpu before sending to tx + +From: WANG Cong + +[ Upstream commit d40496a56430eac0d330378816954619899fe303 ] + +Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") +the skb->sender_cpu needs to be cleared when moving from Rx +Tx, otherwise kernel could crash. + +Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") +Cc: Eric Dumazet +Cc: Jamal Hadi Salim +Signed-off-by: Cong Wang +Signed-off-by: Cong Wang +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/sched/act_mirred.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -168,6 +168,7 @@ static int tcf_mirred(struct sk_buff *sk + + skb2->skb_iif = skb->dev->ifindex; + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + err = dev_queue_xmit(skb2); + + out: diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch new file mode 100644 index 00000000..943f5cd6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Aaron Conole +Date: Sat, 26 Sep 2015 18:50:42 -0400 +Subject: af_unix: Convert the unix_sk macro to an inline function for type safety + +From: Aaron Conole + +[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ] + +As suggested by Eric Dumazet this change replaces the +#define with a static inline function to enjoy +complaints by the compiler when misusing the API. + +Signed-off-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/af_unix.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -63,7 +63,11 @@ struct unix_sock { + #define UNIX_GC_MAYBE_CYCLE 1 + struct socket_wq peer_wq; + }; +-#define unix_sk(__sk) ((struct unix_sock *)__sk) ++ ++static inline struct unix_sock *unix_sk(struct sock *sk) ++{ ++ return (struct unix_sock *)sk; ++} + + #define peer_wait peer_wq.wait + diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch new file mode 100644 index 00000000..c7ed0119 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch @@ -0,0 +1,60 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Aaron Conole +Date: Sat, 26 Sep 2015 18:50:43 -0400 +Subject: af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag + +From: Aaron Conole + +[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ] + +AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag +is set. + +This is referenced in kernel bugzilla #12323 @ +https://bugzilla.kernel.org/show_bug.cgi?id=12323 + +As described both in the BZ and lkml thread @ +http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an +AF_UNIX socket only reads a single skb, where the desired effect is +to return as much skb data has been queued, until hitting the recv +buffer size (whichever comes first). + +The modified MSG_PEEK path will now move to the next skb in the tree +and jump to the again: label, rather than following the natural loop +structure. This requires duplicating some of the loop head actions. + +This was tested using the python socketpair python code attached to +the bugzilla issue. + +Signed-off-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2179,8 +2179,21 @@ unlock: + if (UNIXCB(skb).fp) + scm.fp = scm_fp_dup(UNIXCB(skb).fp); + +- sk_peek_offset_fwd(sk, chunk); ++ if (skip) { ++ sk_peek_offset_fwd(sk, chunk); ++ skip -= chunk; ++ } + ++ if (UNIXCB(skb).fp) ++ break; ++ ++ last = skb; ++ last_len = skb->len; ++ unix_state_lock(sk); ++ skb = skb_peek_next(skb, &sk->sk_receive_queue); ++ if (skb) ++ goto again; ++ unix_state_unlock(sk); + break; + } + } while (size); diff --git a/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch b/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch new file mode 100644 index 00000000..3cdebeec --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch @@ -0,0 +1,280 @@ +From c00def71efd919e8ae835a25f4f4c80a4b2d36d3 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 3 Aug 2015 09:26:52 +0200 +Subject: ARM: ux500: simplify secondary CPU boot + +From: Linus Walleij + +commit c00def71efd919e8ae835a25f4f4c80a4b2d36d3 upstream. + +This removes a lot of ancient cruft from the Ux500 SMP boot. +Instead of the pen grab/release, just point the ROM to +secondary_boot() and start the second CPU there, then send +the IPI. + +Use our own SMP enable method. This enables us to remove the +last static mapping and get both CPUs booting properly. + +Tested this and it just works. + +Signed-off-by: Linus Walleij +Signed-off-by: Olof Johansson +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-ux500/Makefile | 2 + arch/arm/mach-ux500/cpu-db8500.c | 1 + arch/arm/mach-ux500/headsmp.S | 37 ---------- + arch/arm/mach-ux500/platsmp.c | 132 +++++++++++---------------------------- + arch/arm/mach-ux500/setup.h | 1 + 5 files changed, 40 insertions(+), 133 deletions(-) + +--- a/arch/arm/mach-ux500/Makefile ++++ b/arch/arm/mach-ux500/Makefile +@@ -7,7 +7,7 @@ obj-$(CONFIG_CACHE_L2X0) += cache-l2x0.o + obj-$(CONFIG_UX500_SOC_DB8500) += cpu-db8500.o + obj-$(CONFIG_MACH_MOP500) += board-mop500-regulators.o \ + board-mop500-audio.o +-obj-$(CONFIG_SMP) += platsmp.o headsmp.o ++obj-$(CONFIG_SMP) += platsmp.o + obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o + obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o + +--- a/arch/arm/mach-ux500/cpu-db8500.c ++++ b/arch/arm/mach-ux500/cpu-db8500.c +@@ -154,7 +154,6 @@ static const char * stericsson_dt_platfo + }; + + DT_MACHINE_START(U8500_DT, "ST-Ericsson Ux5x0 platform (Device Tree Support)") +- .smp = smp_ops(ux500_smp_ops), + .map_io = u8500_map_io, + .init_irq = ux500_init_irq, + /* we re-use nomadik timer here */ +--- a/arch/arm/mach-ux500/headsmp.S ++++ /dev/null +@@ -1,37 +0,0 @@ +-/* +- * Copyright (c) 2009 ST-Ericsson +- * This file is based ARM Realview platform +- * Copyright (c) 2003 ARM Limited +- * All Rights Reserved +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +-#include +-#include +- +-/* +- * U8500 specific entry point for secondary CPUs. +- */ +-ENTRY(u8500_secondary_startup) +- mrc p15, 0, r0, c0, c0, 5 +- and r0, r0, #15 +- adr r4, 1f +- ldmia r4, {r5, r6} +- sub r4, r4, r5 +- add r6, r6, r4 +-pen: ldr r7, [r6] +- cmp r7, r0 +- bne pen +- +- /* +- * we've been released from the holding pen: secondary_stack +- * should now contain the SVC stack for this core +- */ +- b secondary_startup +-ENDPROC(u8500_secondary_startup) +- +- .align 2 +-1: .long . +- .long pen_release +--- a/arch/arm/mach-ux500/platsmp.c ++++ b/arch/arm/mach-ux500/platsmp.c +@@ -28,135 +28,81 @@ + #include "db8500-regs.h" + #include "id.h" + +-static void __iomem *scu_base; +-static void __iomem *backupram; +- +-/* This is called from headsmp.S to wakeup the secondary core */ +-extern void u8500_secondary_startup(void); +- +-/* +- * Write pen_release in a way that is guaranteed to be visible to all +- * observers, irrespective of whether they're taking part in coherency +- * or not. This is necessary for the hotplug code to work reliably. +- */ +-static void write_pen_release(int val) +-{ +- pen_release = val; +- smp_wmb(); +- sync_cache_w(&pen_release); +-} +- +-static DEFINE_SPINLOCK(boot_lock); +- +-static void ux500_secondary_init(unsigned int cpu) +-{ +- /* +- * let the primary processor know we're out of the +- * pen, then head off into the C entry point +- */ +- write_pen_release(-1); +- +- /* +- * Synchronise with the boot thread. +- */ +- spin_lock(&boot_lock); +- spin_unlock(&boot_lock); +-} ++/* Magic triggers in backup RAM */ ++#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 ++#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 + +-static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) ++static void wakeup_secondary(void) + { +- unsigned long timeout; +- +- /* +- * set synchronisation state between this boot processor +- * and the secondary one +- */ +- spin_lock(&boot_lock); +- +- /* +- * The secondary processor is waiting to be released from +- * the holding pen - release it, then wait for it to flag +- * that it has been released by resetting pen_release. +- */ +- write_pen_release(cpu_logical_map(cpu)); +- +- arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ struct device_node *np; ++ static void __iomem *backupram; + +- timeout = jiffies + (1 * HZ); +- while (time_before(jiffies, timeout)) { +- if (pen_release == -1) +- break; ++ np = of_find_compatible_node(NULL, NULL, "ste,dbx500-backupram"); ++ if (!np) { ++ pr_err("No backupram base address\n"); ++ return; ++ } ++ backupram = of_iomap(np, 0); ++ of_node_put(np); ++ if (!backupram) { ++ pr_err("No backupram remap\n"); ++ return; + } + + /* +- * now the secondary core is starting up let it run its +- * calibrations, then wait for it to finish +- */ +- spin_unlock(&boot_lock); +- +- return pen_release != -1 ? -ENOSYS : 0; +-} +- +-static void __init wakeup_secondary(void) +-{ +- /* + * write the address of secondary startup into the backup ram register + * at offset 0x1FF4, then write the magic number 0xA1FEED01 to the + * backup ram register at offset 0x1FF0, which is what boot rom code +- * is waiting for. This would wake up the secondary core from WFE ++ * is waiting for. This will wake up the secondary core from WFE. + */ +-#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 +- __raw_writel(virt_to_phys(u8500_secondary_startup), +- backupram + UX500_CPU1_JUMPADDR_OFFSET); +- +-#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 +- __raw_writel(0xA1FEED01, +- backupram + UX500_CPU1_WAKEMAGIC_OFFSET); ++ writel(virt_to_phys(secondary_startup), ++ backupram + UX500_CPU1_JUMPADDR_OFFSET); ++ writel(0xA1FEED01, ++ backupram + UX500_CPU1_WAKEMAGIC_OFFSET); + + /* make sure write buffer is drained */ + mb(); ++ iounmap(backupram); + } + +-/* +- * Initialise the CPU possible map early - this describes the CPUs +- * which may be present or become present in the system. +- */ +-static void __init ux500_smp_init_cpus(void) ++static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) + { +- unsigned int i, ncores; + struct device_node *np; ++ static void __iomem *scu_base; ++ unsigned int ncores; ++ int i; + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-scu"); ++ if (!np) { ++ pr_err("No SCU base address\n"); ++ return; ++ } + scu_base = of_iomap(np, 0); + of_node_put(np); +- if (!scu_base) ++ if (!scu_base) { ++ pr_err("No SCU remap\n"); + return; +- backupram = ioremap(U8500_BACKUPRAM0_BASE, SZ_8K); +- ncores = scu_get_core_count(scu_base); +- +- /* sanity check */ +- if (ncores > nr_cpu_ids) { +- pr_warn("SMP: %u cores greater than maximum (%u), clipping\n", +- ncores, nr_cpu_ids); +- ncores = nr_cpu_ids; + } + ++ scu_enable(scu_base); ++ ncores = scu_get_core_count(scu_base); + for (i = 0; i < ncores; i++) + set_cpu_possible(i, true); ++ iounmap(scu_base); + } + +-static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) ++static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) + { +- scu_enable(scu_base); + wakeup_secondary(); ++ arch_send_wakeup_ipi_mask(cpumask_of(cpu)); ++ return 0; + } + + struct smp_operations ux500_smp_ops __initdata = { +- .smp_init_cpus = ux500_smp_init_cpus, + .smp_prepare_cpus = ux500_smp_prepare_cpus, +- .smp_secondary_init = ux500_secondary_init, + .smp_boot_secondary = ux500_boot_secondary, + #ifdef CONFIG_HOTPLUG_CPU + .cpu_die = ux500_cpu_die, + #endif + }; ++CPU_METHOD_OF_DECLARE(ux500_smp, "ste,dbx500-smp", &ux500_smp_ops); +--- a/arch/arm/mach-ux500/setup.h ++++ b/arch/arm/mach-ux500/setup.h +@@ -26,7 +26,6 @@ extern struct device *ux500_soc_device_i + + extern void ux500_timer_init(void); + +-extern struct smp_operations ux500_smp_ops; + extern void ux500_cpu_die(unsigned int cpu); + + #endif /* __ASM_ARCH_SETUP_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch b/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch new file mode 100644 index 00000000..b25ef08a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch @@ -0,0 +1,39 @@ +From b6dd8e0719c0d2d01429639a11b7bc2677de240c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 8 Oct 2015 11:11:17 +0100 +Subject: arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 + +From: Will Deacon + +commit b6dd8e0719c0d2d01429639a11b7bc2677de240c upstream. + +Commit df057cc7b4fa ("arm64: errata: add module build workaround for +erratum #843419") sets CFLAGS_MODULE to ensure that the large memory +model is used by the compiler when building kernel modules. + +However, CFLAGS_MODULE is an environment variable and intended to be +overridden on the command line, which appears to be the case with the +Ubuntu kernel packaging system, so use KBUILD_CFLAGS_MODULE instead. + +Cc: Ard Biesheuvel +Fixes: df057cc7b4fa ("arm64: errata: add module build workaround for erratum #843419") +Reported-by: Dann Frazier +Tested-by: Dann Frazier +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/Makefile ++++ b/arch/arm64/Makefile +@@ -31,7 +31,7 @@ endif + CHECKFLAGS += -D__aarch64__ + + ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) +-CFLAGS_MODULE += -mcmodel=large ++KBUILD_CFLAGS_MODULE += -mcmodel=large + endif + + # Default value diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch b/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch new file mode 100644 index 00000000..1981b7c0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch @@ -0,0 +1,31 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Alexei Starovoitov +Date: Tue, 6 Oct 2015 20:46:07 -0700 +Subject: bpf: clear sender_cpu before xmit + +From: Alexei Starovoitov + +[ Upstream commit 6bf0577374cfb6c2301dbf4934a4f23ad3d72763 ] + +Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") +the skb->sender_cpu needs to be cleared before xmit. + +Fixes: 3896d655f4d4 ("bpf: introduce bpf_clone_redirect() helper") +Signed-off-by: Alexei Starovoitov +Acked-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1412,6 +1412,7 @@ static u64 bpf_clone_redirect(u64 r1, u6 + return dev_forward_skb(dev, skb2); + + skb2->dev = dev; ++ skb_sender_cpu_clear(skb2); + return dev_queue_xmit(skb2); + } + diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch b/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch new file mode 100644 index 00000000..0a66e3b1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch @@ -0,0 +1,65 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Daniel Borkmann +Date: Fri, 2 Oct 2015 12:06:03 +0200 +Subject: bpf: fix panic in SO_GET_FILTER with native ebpf programs + +From: Daniel Borkmann + +[ Upstream commit 93d08b6966cf730ea669d4d98f43627597077153 ] + +When sockets have a native eBPF program attached through +setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to +dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...), +the following panic appears: + + [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null) + [49904.178762] IP: [] sk_get_filter+0x39/0x90 + [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0 + [49904.185196] Oops: 0000 [#1] SMP + [...] + [49904.224677] Call Trace: + [49904.226090] [] sock_getsockopt+0x319/0x740 + [49904.227535] [] ? sock_has_perm+0x63/0x70 + [49904.228953] [] ? release_sock+0x108/0x150 + [49904.230380] [] ? selinux_socket_getsockopt+0x23/0x30 + [49904.231788] [] SyS_getsockopt+0xa6/0xc0 + [49904.233267] [] entry_SYSCALL_64_fastpath+0x12/0x71 + +The underlying issue is the very same as in commit b382c0865600 +("sock, diag: fix panic in sock_diag_put_filterinfo"), that is, +native eBPF programs don't store an original program since this +is only needed in cBPF ones. + +However, sk_get_filter() wasn't updated to test for this at the +time when eBPF could be attached. Just throw an error to the user +to indicate that eBPF cannot be dumped over this interface. +That way, it can also be known that a program _is_ attached (as +opposed to just return 0), and a different (future) method needs +to be consulted for a dump. + +Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") +Signed-off-by: Daniel Borkmann +Acked-by: Alexei Starovoitov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/filter.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -1701,9 +1701,13 @@ int sk_get_filter(struct sock *sk, struc + goto out; + + /* We're copying the filter that has been originally attached, +- * so no conversion/decode needed anymore. ++ * so no conversion/decode needed anymore. eBPF programs that ++ * have no original program cannot be dumped through this. + */ ++ ret = -EACCES; + fprog = filter->prog->orig_prog; ++ if (!fprog) ++ goto out; + + ret = fprog->len; + if (!len) diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch new file mode 100644 index 00000000..44800a6d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch @@ -0,0 +1,57 @@ +From 8eb934591f8bf584969454a658f629cd06e59f3a Mon Sep 17 00:00:00 2001 +From: David Sterba +Date: Mon, 12 Oct 2015 16:55:54 +0200 +Subject: btrfs: check unsupported filters in balance arguments + +From: David Sterba + +commit 8eb934591f8bf584969454a658f629cd06e59f3a upstream. + +We don't verify that all the balance filter arguments supplemented by +the flags are actually known to the kernel. Thus we let it silently pass +and do nothing. + +At the moment this means only the 'limit' filter, but we're going to add +a few more soon so it's better to have that fixed. Also in older stable +kernels so that it works with newer userspace tools. + +Signed-off-by: David Sterba +Signed-off-by: Chris Mason +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/ioctl.c | 5 +++++ + fs/btrfs/volumes.h | 8 ++++++++ + 2 files changed, 13 insertions(+) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -4647,6 +4647,11 @@ locked: + bctl->flags |= BTRFS_BALANCE_TYPE_MASK; + } + ++ if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { ++ ret = -EINVAL; ++ goto out_bargs; ++ } ++ + do_balance: + /* + * Ownership of bctl and mutually_exclusive_operation_running +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -376,6 +376,14 @@ struct map_lookup { + #define BTRFS_BALANCE_ARGS_VRANGE (1ULL << 4) + #define BTRFS_BALANCE_ARGS_LIMIT (1ULL << 5) + ++#define BTRFS_BALANCE_ARGS_MASK \ ++ (BTRFS_BALANCE_ARGS_PROFILES | \ ++ BTRFS_BALANCE_ARGS_USAGE | \ ++ BTRFS_BALANCE_ARGS_DEVID | \ ++ BTRFS_BALANCE_ARGS_DRANGE | \ ++ BTRFS_BALANCE_ARGS_VRANGE | \ ++ BTRFS_BALANCE_ARGS_LIMIT) ++ + /* + * Profile changing flags. When SOFT is set we won't relocate chunk if + * it already has the target profile (even though it may be diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch new file mode 100644 index 00000000..27bec066 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch @@ -0,0 +1,61 @@ +From dc6c5fb3b514221f2e9d21ee626a9d95d3418dff Mon Sep 17 00:00:00 2001 +From: Chris Mason +Date: Tue, 13 Oct 2015 14:06:48 -0400 +Subject: btrfs: fix use after free iterating extrefs + +From: Chris Mason + +commit dc6c5fb3b514221f2e9d21ee626a9d95d3418dff upstream. + +The code for btrfs inode-resolve has never worked properly for +files with enough hard links to trigger extrefs. It was trying to +get the leaf out of a path after freeing the path: + + btrfs_release_path(path); + leaf = path->nodes[0]; + item_size = btrfs_item_size_nr(leaf, slot); + +The fix here is to use the extent buffer we cloned just a little higher +up to avoid deadlocks caused by using the leaf in the path. + +Signed-off-by: Chris Mason +cc: Mark Fasheh +Reviewed-by: Filipe Manana +Reviewed-by: Mark Fasheh +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/backref.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1809,7 +1809,6 @@ static int iterate_inode_extrefs(u64 inu + int found = 0; + struct extent_buffer *eb; + struct btrfs_inode_extref *extref; +- struct extent_buffer *leaf; + u32 item_size; + u32 cur_offset; + unsigned long ptr; +@@ -1837,9 +1836,8 @@ static int iterate_inode_extrefs(u64 inu + btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); + btrfs_release_path(path); + +- leaf = path->nodes[0]; +- item_size = btrfs_item_size_nr(leaf, slot); +- ptr = btrfs_item_ptr_offset(leaf, slot); ++ item_size = btrfs_item_size_nr(eb, slot); ++ ptr = btrfs_item_ptr_offset(eb, slot); + cur_offset = 0; + + while (cur_offset < item_size) { +@@ -1853,7 +1851,7 @@ static int iterate_inode_extrefs(u64 inu + if (ret) + break; + +- cur_offset += btrfs_inode_extref_name_len(leaf, extref); ++ cur_offset += btrfs_inode_extref_name_len(eb, extref); + cur_offset += sizeof(*extref); + } + btrfs_tree_read_unlock_blocking(eb); diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch b/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch new file mode 100644 index 00000000..a869f8d8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch @@ -0,0 +1,37 @@ +From 8996eafdcbad149ac0f772fb1649fbb75c482a6a Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 9 Oct 2015 20:43:33 +0100 +Subject: crypto: ahash - ensure statesize is non-zero + +From: Russell King + +commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream. + +Unlike shash algorithms, ahash drivers must implement export +and import as their descriptors may contain hardware state and +cannot be exported as is. Unfortunately some ahash drivers did +not provide them and end up causing crashes with algif_hash. + +This patch adds a check to prevent these drivers from registering +ahash algorithms until they are fixed. + +Signed-off-by: Russell King +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + crypto/ahash.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -544,7 +544,8 @@ static int ahash_prepare_alg(struct ahas + struct crypto_alg *base = &alg->halg.base; + + if (alg->halg.digestsize > PAGE_SIZE / 8 || +- alg->halg.statesize > PAGE_SIZE / 8) ++ alg->halg.statesize > PAGE_SIZE / 8 || ++ alg->halg.statesize == 0) + return -EINVAL; + + base->cra_type = &crypto_ahash_type; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch b/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch new file mode 100644 index 00000000..62fd0a5b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch @@ -0,0 +1,42 @@ +From 92b279070dd6c94265db32748bbeb5b583588de9 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Tue, 6 Oct 2015 12:31:33 +0100 +Subject: crypto: camellia_aesni_avx - Fix CPU feature checks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ben Hutchings + +commit 92b279070dd6c94265db32748bbeb5b583588de9 upstream. + +We need to explicitly check the AVX and AES CPU features, as we can't +infer them from the related XSAVE feature flags. For example, the +Core i3 2310M passes the XSAVE feature test but does not implement +AES-NI. + +Reported-and-tested-by: Stéphane Glondu +References: https://bugs.debian.org/800934 +Fixes: ce4f5f9b65ae ("x86/fpu, crypto x86/camellia_aesni_avx: Simplify...") +Signed-off-by: Ben Hutchings +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/crypto/camellia_aesni_avx_glue.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/x86/crypto/camellia_aesni_avx_glue.c ++++ b/arch/x86/crypto/camellia_aesni_avx_glue.c +@@ -554,6 +554,11 @@ static int __init camellia_aesni_init(vo + { + const char *feature_name; + ++ if (!cpu_has_avx || !cpu_has_aes || !cpu_has_osxsave) { ++ pr_info("AVX or AES-NI instructions are not detected.\n"); ++ return -ENODEV; ++ } ++ + if (!cpu_has_xfeatures(XSTATE_SSE | XSTATE_YMM, &feature_name)) { + pr_info("CPU feature '%s' is not supported.\n", feature_name); + return -ENODEV; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch b/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch new file mode 100644 index 00000000..da4afaa8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch @@ -0,0 +1,68 @@ +From a66d7f724a96d6fd279bfbd2ee488def6b081bea Mon Sep 17 00:00:00 2001 +From: Dave Kleikamp +Date: Mon, 5 Oct 2015 10:08:51 -0500 +Subject: crypto: sparc - initialize blkcipher.ivsize + +From: Dave Kleikamp + +commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream. + +Some of the crypto algorithms write to the initialization vector, +but no space has been allocated for it. This clobbers adjacent memory. + +Signed-off-by: Dave Kleikamp +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/crypto/aes_glue.c | 2 ++ + arch/sparc/crypto/camellia_glue.c | 1 + + arch/sparc/crypto/des_glue.c | 2 ++ + 3 files changed, 5 insertions(+) + +--- a/arch/sparc/crypto/aes_glue.c ++++ b/arch/sparc/crypto/aes_glue.c +@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = AES_MIN_KEY_SIZE, + .max_keysize = AES_MAX_KEY_SIZE, ++ .ivsize = AES_BLOCK_SIZE, + .setkey = aes_set_key, + .encrypt = ctr_crypt, + .decrypt = ctr_crypt, +--- a/arch/sparc/crypto/camellia_glue.c ++++ b/arch/sparc/crypto/camellia_glue.c +@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = CAMELLIA_MIN_KEY_SIZE, + .max_keysize = CAMELLIA_MAX_KEY_SIZE, ++ .ivsize = CAMELLIA_BLOCK_SIZE, + .setkey = camellia_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +--- a/arch/sparc/crypto/des_glue.c ++++ b/arch/sparc/crypto/des_glue.c +@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES_KEY_SIZE, + .max_keysize = DES_KEY_SIZE, ++ .ivsize = DES_BLOCK_SIZE, + .setkey = des_set_key, + .encrypt = cbc_encrypt, + .decrypt = cbc_decrypt, +@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { + .blkcipher = { + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, ++ .ivsize = DES3_EDE_BLOCK_SIZE, + .setkey = des3_ede_set_key, + .encrypt = cbc3_encrypt, + .decrypt = cbc3_decrypt, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch b/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch new file mode 100644 index 00000000..fd96ce12 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch @@ -0,0 +1,72 @@ +From 621bd0f6982badd6483acb191eb7b6226a578328 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Tue, 29 Sep 2015 09:56:53 +0200 +Subject: drm: Fix locking for sysfs dpms file + +From: Daniel Vetter + +commit 621bd0f6982badd6483acb191eb7b6226a578328 upstream. + +With atomic drivers we need to make sure that (at least in general) +property reads hold the right locks. But the legacy dpms property is +special and can be read locklessly. Since userspace loves to just +randomly look at that all the time (like with "status") do that. + +To make it clear that we play tricks use the READ_ONCE compiler +barrier (and also for paranoia). + +Note that there's not really anything bad going on since even with the +new atomic paths we eventually end up not chasing any pointers (and +hence possibly freed memory and other fun stuff). The locking WARNING +has been added in + +commit 88a48e297b3a3bac6022c03babfb038f1a886cea +Author: Rob Clark +Date: Thu Dec 18 16:01:50 2014 -0500 + + drm: add atomic properties + +but since drivers are converting not everyone will have seen this from +the start. + +Jens reported this and submitted a patch to just grab the +mode_config.connection_mutex, but we can do a bit better. + +v2: Remove unused variables I failed to git add for real. + +Reference: http://mid.gmane.org/20150928194822.GA3930@kernel.dk +Reported-by: Jens Axboe +Tested-by: Jens Axboe +Cc: Rob Clark +Signed-off-by: Daniel Vetter +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/drm_sysfs.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/drm_sysfs.c ++++ b/drivers/gpu/drm/drm_sysfs.c +@@ -235,18 +235,12 @@ static ssize_t dpms_show(struct device * + char *buf) + { + struct drm_connector *connector = to_drm_connector(device); +- struct drm_device *dev = connector->dev; +- uint64_t dpms_status; +- int ret; ++ int dpms; + +- ret = drm_object_property_get_value(&connector->base, +- dev->mode_config.dpms_property, +- &dpms_status); +- if (ret) +- return 0; ++ dpms = READ_ONCE(connector->dpms); + + return snprintf(buf, PAGE_SIZE, "%s\n", +- drm_get_dpms_name((int)dpms_status)); ++ drm_get_dpms_name(dpms)); + } + + static ssize_t enabled_show(struct device *device, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch b/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch new file mode 100644 index 00000000..b718470d --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch @@ -0,0 +1,65 @@ +From f231976c2e8964ceaa9250e57d27c35ff03825c2 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Fri, 2 Oct 2015 14:03:19 +1000 +Subject: drm/nouveau/fbcon: take runpm reference when userspace has an open fd + +From: Ben Skeggs + +commit f231976c2e8964ceaa9250e57d27c35ff03825c2 upstream. + +We need to do this in order to prevent accesses to the device while it's +powered down. Userspace may have an mmap of the fb, and there's no good +way (that I know of) to prevent it from touching the device otherwise. + +This fixes some nasty races between runpm and plymouth on some systems, +which result in the GPU getting very upset and hanging the boot. + +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/nouveau/nouveau_fbcon.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c ++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c +@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info) + return 0; + } + ++static int ++nouveau_fbcon_open(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ int ret = pm_runtime_get_sync(drm->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return ret; ++ return 0; ++} ++ ++static int ++nouveau_fbcon_release(struct fb_info *info, int user) ++{ ++ struct nouveau_fbdev *fbcon = info->par; ++ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); ++ pm_runtime_put(drm->dev->dev); ++ return 0; ++} ++ + static struct fb_ops nouveau_fbcon_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = nouveau_fbcon_fillrect, +@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = + + static struct fb_ops nouveau_fbcon_sw_ops = { + .owner = THIS_MODULE, ++ .fb_open = nouveau_fbcon_open, ++ .fb_release = nouveau_fbcon_release, + .fb_check_var = drm_fb_helper_check_var, + .fb_set_par = drm_fb_helper_set_par, + .fb_fillrect = cfb_fillrect, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch b/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch new file mode 100644 index 00000000..35aaa4a7 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch @@ -0,0 +1,50 @@ +From 60906529bec506a4bde93f04eb5e7a9dd9c42a3b Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Mon, 5 Oct 2015 12:20:26 +0200 +Subject: drm/qxl: fix framebuffer dirty rectangle tracking. + +From: Gerd Hoffmann + +commit 60906529bec506a4bde93f04eb5e7a9dd9c42a3b upstream. + +Commit "c0fe07a drm/qxl: rewrite framebuffer support" has a bug in the +dirty rectangle tracking: Instead of ignoring an empty dirty rectangle +when adding a new dirty region the dirty region gets extended to the +upper left corner. Fix it. + +Signed-off-by: Gerd Hoffmann +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/qxl/qxl_fb.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/qxl/qxl_fb.c ++++ b/drivers/gpu/drm/qxl/qxl_fb.c +@@ -144,14 +144,17 @@ static void qxl_dirty_update(struct qxl_ + + spin_lock_irqsave(&qfbdev->dirty.lock, flags); + +- if (qfbdev->dirty.y1 < y) +- y = qfbdev->dirty.y1; +- if (qfbdev->dirty.y2 > y2) +- y2 = qfbdev->dirty.y2; +- if (qfbdev->dirty.x1 < x) +- x = qfbdev->dirty.x1; +- if (qfbdev->dirty.x2 > x2) +- x2 = qfbdev->dirty.x2; ++ if ((qfbdev->dirty.y2 - qfbdev->dirty.y1) && ++ (qfbdev->dirty.x2 - qfbdev->dirty.x1)) { ++ if (qfbdev->dirty.y1 < y) ++ y = qfbdev->dirty.y1; ++ if (qfbdev->dirty.y2 > y2) ++ y2 = qfbdev->dirty.y2; ++ if (qfbdev->dirty.x1 < x) ++ x = qfbdev->dirty.x1; ++ if (qfbdev->dirty.x2 > x2) ++ x2 = qfbdev->dirty.x2; ++ } + + qfbdev->dirty.x1 = x; + qfbdev->dirty.x2 = x2; diff --git a/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch b/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch new file mode 100644 index 00000000..766c3c9a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Joe Perches +Date: Wed, 14 Oct 2015 01:09:40 -0700 +Subject: ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings + +From: Joe Perches + +[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ] + +It seems that kernel memory can leak into userspace by a +kmalloc, ethtool_get_strings, then copy_to_user sequence. + +Avoid this by using kcalloc to zero fill the copied buffer. + +Signed-off-by: Joe Perches +Acked-by: Ben Hutchings +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct ne + + gstrings.len = ret; + +- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); ++ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); + if (!data) + return -ENOMEM; + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch new file mode 100644 index 00000000..04b514ff --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch @@ -0,0 +1,108 @@ +From 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Thu, 24 Sep 2015 12:06:54 +0300 +Subject: i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 + +From: Mika Westerberg + +commit 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 upstream. + +ACPI SSCN/FMCN methods were originally added because then the platform can +provide the most accurate HCNT/LCNT values to the driver. However, this +seems not to be true for Dell Inspiron 7348 where using these causes the +touchpad to fail in boot: + + i2c_hid i2c-DLL0675:00: failed to retrieve report from device. + i2c_designware INT3433:00: i2c_dw_handle_tx_abort: lost arbitration + i2c_hid i2c-DLL0675:00: failed to retrieve report from device. + i2c_designware INT3433:00: controller timed out + +The values received from ACPI are (in fast mode): + + HCNT: 72 + LCNT: 160 + +this translates to following timings (input clock is 100MHz on Broadwell): + + tHIGH: 720 ns (spec min 600 ns) + tLOW: 1600 ns (spec min 1300 ns) + Bus period: 2920 ns (assuming 300 ns tf and tr) + Bus speed: 342.5 kHz + +Both tHIGH and tLOW are within the I2C specification. + +The calculated values when ACPI parameters are not used are (in fast mode): + + HCNT: 87 + LCNT: 159 + +which translates to: + + tHIGH: 870 ns (spec min 600 ns) + tLOW: 1590 ns (spec min 1300 ns) + Bus period 3060 ns (assuming 300 ns tf and tr) + Bus speed 326.8 kHz + +These values are also within the I2C specification. + +Since both ACPI and calculated values meet the I2C specification timing +requirements it is hard to say why the touchpad does not function properly +with the ACPI values except that the bus speed is higher in this case (but +still well below the max 400kHz). + +Solve this by adding DMI quirk to the driver that disables using ACPI +parameters on this particulare machine. + +Reported-by: Pavel Roskin +Signed-off-by: Mika Westerberg +Tested-by: Pavel Roskin +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struc + } + + #ifdef CONFIG_ACPI ++/* ++ * The HCNT/LCNT information coming from ACPI should be the most accurate ++ * for given platform. However, some systems get it wrong. On such systems ++ * we get better results by calculating those based on the input clock. ++ */ ++static const struct dmi_system_id dw_i2c_no_acpi_params[] = { ++ { ++ .ident = "Dell Inspiron 7348", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), ++ }, ++ }, ++ { } ++}; ++ + static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], + u16 *hcnt, u16 *lcnt, u32 *sda_hold) + { +@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct pl + acpi_handle handle = ACPI_HANDLE(&pdev->dev); + union acpi_object *obj; + ++ if (dmi_check_system(dw_i2c_no_acpi_params)) ++ return; ++ + if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) + return; + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..2e6bb173 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,51 @@ +From 36d48fb5766aee9717e429f772046696b215282d Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 9 Oct 2015 10:39:24 +0100 +Subject: i2c: designware-platdrv: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit 36d48fb5766aee9717e429f772046696b215282d upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. + +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Acked-by: Mika Westerberg +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-designware-platdrv.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -273,12 +273,6 @@ static int dw_i2c_probe(struct platform_ + adap->dev.parent = &pdev->dev; + adap->dev.of_node = pdev->dev.of_node; + +- r = i2c_add_numbered_adapter(adap); +- if (r) { +- dev_err(&pdev->dev, "failure adding adapter\n"); +- return r; +- } +- + if (dev->pm_runtime_disabled) { + pm_runtime_forbid(&pdev->dev); + } else { +@@ -288,6 +282,13 @@ static int dw_i2c_probe(struct platform_ + pm_runtime_enable(&pdev->dev); + } + ++ r = i2c_add_numbered_adapter(adap); ++ if (r) { ++ dev_err(&pdev->dev, "failure adding adapter\n"); ++ pm_runtime_disable(&pdev->dev); ++ return r; ++ } ++ + return 0; + } + diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..ef2da749 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,44 @@ +From 4f7effddf4549d57114289f273710f077c4c330a Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Fri, 9 Oct 2015 10:39:25 +0100 +Subject: i2c: rcar: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit 4f7effddf4549d57114289f273710f077c4c330a upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. While here, move drvdata, too. + +Reported-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-rcar.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -690,15 +690,16 @@ static int rcar_i2c_probe(struct platfor + return ret; + } + ++ pm_runtime_enable(dev); ++ platform_set_drvdata(pdev, priv); ++ + ret = i2c_add_numbered_adapter(adap); + if (ret < 0) { + dev_err(dev, "reg adap failed: %d\n", ret); ++ pm_runtime_disable(dev); + return ret; + } + +- pm_runtime_enable(dev); +- platform_set_drvdata(pdev, priv); +- + dev_info(dev, "probed\n"); + + return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch new file mode 100644 index 00000000..dcd4dfab --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch @@ -0,0 +1,48 @@ +From eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Sat, 10 Oct 2015 08:24:23 +0100 +Subject: i2c: s3c2410: enable RuntimePM before registering to the core + +From: Wolfram Sang + +commit eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 upstream. + +The core may register clients attached to this master which may use +funtionality from the master. So, RuntimePM must be enabled before, otherwise +this will fail. While here, move drvdata, too. + +Signed-off-by: Wolfram Sang +Tested-by: Krzysztof Kozlowski +Acked-by: Kukjin Kim +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/i2c/busses/i2c-s3c2410.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -1243,17 +1243,19 @@ static int s3c24xx_i2c_probe(struct plat + i2c->adap.nr = i2c->pdata->bus_num; + i2c->adap.dev.of_node = pdev->dev.of_node; + ++ platform_set_drvdata(pdev, i2c); ++ ++ pm_runtime_enable(&pdev->dev); ++ + ret = i2c_add_numbered_adapter(&i2c->adap); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add bus to i2c core\n"); ++ pm_runtime_disable(&pdev->dev); + s3c24xx_i2c_deregister_cpufreq(i2c); + clk_unprepare(i2c->clk); + return ret; + } + +- platform_set_drvdata(pdev, i2c); +- +- pm_runtime_enable(&pdev->dev); + pm_runtime_enable(&i2c->adap.dev); + + dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch new file mode 100644 index 00000000..7c98de1b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Thu, 1 Oct 2015 05:39:26 -0700 +Subject: inet: fix race in reqsk_queue_unlink() + +From: Eric Dumazet + +[ Upstream commit 2306c704ce280c97a60d1f45333b822b40281dea ] + +reqsk_timer_handler() tests if icsk_accept_queue.listen_opt +is NULL at its beginning. + +By the time it calls inet_csk_reqsk_queue_drop() and +reqsk_queue_unlink(), listener might have been closed and +inet_csk_listen_stop() had called reqsk_queue_yank_acceptq() +which sets icsk_accept_queue.listen_opt to NULL + +We therefore need to correctly check listen_opt being NULL +after holding syn_wait_lock for proper synchronization. + +Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") +Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()") +Signed-off-by: Eric Dumazet +Cc: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_connection_sock.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack); + static bool reqsk_queue_unlink(struct request_sock_queue *queue, + struct request_sock *req) + { +- struct listen_sock *lopt = queue->listen_opt; + struct request_sock **prev; ++ struct listen_sock *lopt; + bool found = false; + + spin_lock(&queue->syn_wait_lock); +- +- for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; +- prev = &(*prev)->dl_next) { +- if (*prev == req) { +- *prev = req->dl_next; +- found = true; +- break; ++ lopt = queue->listen_opt; ++ if (lopt) { ++ for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; ++ prev = &(*prev)->dl_next) { ++ if (*prev == req) { ++ *prev = req->dl_next; ++ found = true; ++ break; ++ } + } + } +- + spin_unlock(&queue->syn_wait_lock); + if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) + reqsk_put(req); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch new file mode 100644 index 00000000..840bdaf1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch @@ -0,0 +1,52 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Sat, 19 Sep 2015 09:48:04 -0700 +Subject: inet: fix races in reqsk_queue_hash_req() + +From: Eric Dumazet + +[ Upstream commit 29c6852602e259d2c1882f320b29d5c3fec0de04 ] + +Before allowing lockless LISTEN processing, we need to make +sure to arm the SYN_RECV timer before the req socket is visible +in hash tables. + +Also, req->rsk_hash should be written before we set rsk_refcnt +to a non zero value. + +Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") +Signed-off-by: Eric Dumazet +Cc: Ying Cai +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/inet_connection_sock.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request + req->num_timeout = 0; + req->sk = NULL; + ++ setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); ++ mod_timer_pinned(&req->rsk_timer, jiffies + timeout); ++ req->rsk_hash = hash; ++ + /* before letting lookups find us, make sure all req fields + * are committed to memory and refcnt initialized. + */ + smp_wmb(); + atomic_set(&req->rsk_refcnt, 2); +- setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); +- req->rsk_hash = hash; + + spin_lock(&queue->syn_wait_lock); + req->dl_next = lopt->syn_table[hash]; + lopt->syn_table[hash] = req; + spin_unlock(&queue->syn_wait_lock); +- +- mod_timer_pinned(&req->rsk_timer, jiffies + timeout); + } + EXPORT_SYMBOL(reqsk_queue_hash_req); + diff --git a/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch new file mode 100644 index 00000000..675967a5 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch @@ -0,0 +1,72 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: "Eric W. Biederman" +Date: Mon, 12 Oct 2015 11:02:08 -0500 +Subject: ipv6: Don't call with rt6_uncached_list_flush_dev + +From: "Eric W. Biederman" + +[ Upstream commit e332bc67cf5e5e5b71a1aec9750d0791aac65183 ] + +As originally written rt6_uncached_list_flush_dev makes no sense when +called with dev == NULL as it attempts to flush all uncached routes +regardless of network namespace when dev == NULL. Which is simply +incorrect behavior. + +Furthermore at the point rt6_ifdown is called with dev == NULL no more +network devices exist in the network namespace so even if the code in +rt6_uncached_list_flush_dev were to attempt something sensible it +would be meaningless. + +Therefore remove support in rt6_uncached_list_flush_dev for handling +network devices where dev == NULL, and only call rt6_uncached_list_flush_dev + when rt6_ifdown is called with a network device. + +Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister") +Signed-off-by: "Eric W. Biederman" +Reviewed-by: Martin KaFai Lau +Tested-by: Martin KaFai Lau +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/route.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -139,6 +139,9 @@ static void rt6_uncached_list_flush_dev( + struct net_device *loopback_dev = net->loopback_dev; + int cpu; + ++ if (dev == loopback_dev) ++ return; ++ + for_each_possible_cpu(cpu) { + struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu); + struct rt6_info *rt; +@@ -148,14 +151,12 @@ static void rt6_uncached_list_flush_dev( + struct inet6_dev *rt_idev = rt->rt6i_idev; + struct net_device *rt_dev = rt->dst.dev; + +- if (rt_idev && (rt_idev->dev == dev || !dev) && +- rt_idev->dev != loopback_dev) { ++ if (rt_idev->dev == dev) { + rt->rt6i_idev = in6_dev_get(loopback_dev); + in6_dev_put(rt_idev); + } + +- if (rt_dev && (rt_dev == dev || !dev) && +- rt_dev != loopback_dev) { ++ if (rt_dev == dev) { + rt->dst.dev = loopback_dev; + dev_hold(rt->dst.dev); + dev_put(rt_dev); +@@ -2577,7 +2578,8 @@ void rt6_ifdown(struct net *net, struct + + fib6_clean_all(net, fib6_ifdown, &adn); + icmp6_clean_all(fib6_ifdown, &adn); +- rt6_uncached_list_flush_dev(net, dev); ++ if (dev) ++ rt6_uncached_list_flush_dev(net, dev); + } + + struct rt6_mtu_change_arg { diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch new file mode 100644 index 00000000..a9a7be41 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch @@ -0,0 +1,90 @@ +From 5d9bc648b94dd719022343b8675e6c4381f0c45f Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Tue, 13 Oct 2015 10:18:53 +0200 +Subject: KVM: x86: clean up kvm_arch_vcpu_runnable +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paolo Bonzini + +commit 5d9bc648b94dd719022343b8675e6c4381f0c45f upstream. + +Split the huge conditional in two functions. + +Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 +Reviewed-by: Radim Krčmář +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 39 +++++++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 10 deletions(-) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6706,6 +6706,12 @@ static inline int vcpu_block(struct kvm + return 1; + } + ++static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu) ++{ ++ return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && ++ !vcpu->arch.apf.halted); ++} ++ + static int vcpu_run(struct kvm_vcpu *vcpu) + { + int r; +@@ -6714,8 +6720,7 @@ static int vcpu_run(struct kvm_vcpu *vcp + vcpu->srcu_idx = srcu_read_lock(&kvm->srcu); + + for (;;) { +- if (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) ++ if (kvm_vcpu_running(vcpu)) + r = vcpu_enter_guest(vcpu); + else + r = vcpu_block(kvm, vcpu); +@@ -8011,19 +8016,33 @@ void kvm_arch_flush_shadow_memslot(struc + kvm_mmu_invalidate_zap_all_pages(kvm); + } + ++static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu) ++{ ++ if (!list_empty_careful(&vcpu->async_pf.done)) ++ return true; ++ ++ if (kvm_apic_has_events(vcpu)) ++ return true; ++ ++ if (vcpu->arch.pv.pv_unhalted) ++ return true; ++ ++ if (atomic_read(&vcpu->arch.nmi_queued)) ++ return true; ++ ++ if (kvm_arch_interrupt_allowed(vcpu) && ++ kvm_cpu_has_interrupt(vcpu)) ++ return true; ++ ++ return false; ++} ++ + int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) + { + if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) + kvm_x86_ops->check_nested_events(vcpu, false); + +- return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && +- !vcpu->arch.apf.halted) +- || !list_empty_careful(&vcpu->async_pf.done) +- || kvm_apic_has_events(vcpu) +- || vcpu->arch.pv.pv_unhalted +- || atomic_read(&vcpu->arch.nmi_queued) || +- (kvm_arch_interrupt_allowed(vcpu) && +- kvm_cpu_has_interrupt(vcpu)); ++ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu); + } + + int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch new file mode 100644 index 00000000..ea07d9de --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch @@ -0,0 +1,58 @@ +From b10d92a54dac25a6152f1aa1ffc95c12908035ce Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Wed, 14 Oct 2015 15:25:52 +0200 +Subject: KVM: x86: fix RSM into 64-bit protected mode + +From: Paolo Bonzini + +commit b10d92a54dac25a6152f1aa1ffc95c12908035ce upstream. + +In order to get into 64-bit protected mode, you need to enable +paging while EFER.LMA=1. For this to work, CS.L must be 0. +Currently, we load the segments before CR0 and CR4, which means +that if RSM returns into 64-bit protected mode CS.L is already 1 +and everything breaks. + +Luckily, CS.L=0 is always the case when executing RSM, because it +is forbidden to execute RSM from 64-bit protected mode. Hence it +is enough to load CR0 and CR4 first, and only then the segments. + +Fixes: 660a5d517aaab9187f93854425c4c63f4a09195c +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/emulate.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2418,7 +2418,7 @@ static int rsm_load_state_64(struct x86_ + u64 val, cr0, cr4; + u32 base3; + u16 selector; +- int i; ++ int i, r; + + for (i = 0; i < 16; i++) + *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8); +@@ -2460,13 +2460,17 @@ static int rsm_load_state_64(struct x86_ + dt.address = GET_SMSTATE(u64, smbase, 0x7e68); + ctxt->ops->set_gdt(ctxt, &dt); + ++ r = rsm_enter_protected_mode(ctxt, cr0, cr4); ++ if (r != X86EMUL_CONTINUE) ++ return r; ++ + for (i = 0; i < 6; i++) { +- int r = rsm_load_seg_64(ctxt, smbase, i); ++ r = rsm_load_seg_64(ctxt, smbase, i); + if (r != X86EMUL_CONTINUE) + return r; + } + +- return rsm_enter_protected_mode(ctxt, cr0, cr4); ++ return X86EMUL_CONTINUE; + } + + static int em_rsm(struct x86_emulate_ctxt *ctxt) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch new file mode 100644 index 00000000..6f9893bd --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch @@ -0,0 +1,32 @@ +From 73917739334c6509833b0403b81d4a04a8784bdf Mon Sep 17 00:00:00 2001 +From: Paolo Bonzini +Date: Tue, 13 Oct 2015 10:19:35 +0200 +Subject: KVM: x86: fix SMI to halted VCPU + +From: Paolo Bonzini + +commit 73917739334c6509833b0403b81d4a04a8784bdf upstream. + +An SMI to a halted VCPU must wake it up, hence a VCPU with a pending +SMI must be considered runnable. + +Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -8030,6 +8030,9 @@ static inline bool kvm_vcpu_has_events(s + if (atomic_read(&vcpu->arch.nmi_queued)) + return true; + ++ if (test_bit(KVM_REQ_SMI, &vcpu->requests)) ++ return true; ++ + if (kvm_arch_interrupt_allowed(vcpu) && + kvm_cpu_has_interrupt(vcpu)) + return true; diff --git a/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch b/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch new file mode 100644 index 00000000..78d75c2a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Alexander Couzens +Date: Mon, 28 Sep 2015 11:32:42 +0200 +Subject: l2tp: protect tunnel->del_work by ref_count + +From: Alexander Couzens + +[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ] + +There is a small chance that tunnel_free() is called before tunnel->del_work scheduled +resulting in a zero pointer dereference. + +Signed-off-by: Alexander Couzens +Acked-by: James Chapman +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/l2tp/l2tp_core.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct + tunnel = container_of(work, struct l2tp_tunnel, del_work); + sk = l2tp_tunnel_sock_lookup(tunnel); + if (!sk) +- return; ++ goto out; + + sock = sk->sk_socket; + +@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct + } + + l2tp_tunnel_sock_put(sk); ++out: ++ l2tp_tunnel_dec_refcount(tunnel); + } + + /* Create a socket for the tunnel, if one isn't set up by +@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); + */ + int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) + { ++ l2tp_tunnel_inc_refcount(tunnel); + l2tp_tunnel_closeall(tunnel); +- return (false == queue_work(l2tp_wq, &tunnel->del_work)); ++ if (false == queue_work(l2tp_wq, &tunnel->del_work)) { ++ l2tp_tunnel_dec_refcount(tunnel); ++ return 1; ++ } ++ return 0; + } + EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); + diff --git a/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch b/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch new file mode 100644 index 00000000..59f1b712 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch @@ -0,0 +1,35 @@ +From 424cdc14138088ada1b0e407a2195b2783c6e5ef Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Thu, 15 Oct 2015 15:28:29 -0700 +Subject: memcg: convert threshold to bytes + +From: Shaohua Li + +commit 424cdc14138088ada1b0e407a2195b2783c6e5ef upstream. + +page_counter_memparse() returns pages for the threshold, while +mem_cgroup_usage() returns bytes for memory usage. Convert the +threshold to bytes. + +Fixes: 3e32cb2e0a12b6915 ("memcg: rename cgroup_event to mem_cgroup_event"). +Signed-off-by: Shaohua Li +Cc: Johannes Weiner +Acked-by: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memcontrol.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -3687,6 +3687,7 @@ static int __mem_cgroup_usage_register_e + ret = page_counter_memparse(args, "-1", &threshold); + if (ret) + return ret; ++ threshold <<= PAGE_SHIFT; + + mutex_lock(&memcg->thresholds_lock); + diff --git a/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch b/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch new file mode 100644 index 00000000..0798f6b0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch @@ -0,0 +1,34 @@ +From 1b52e50f2a402a266f1ba2281f0a57e87637a047 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 21 Sep 2015 14:26:54 +0200 +Subject: mfd: max77843: Fix max77843_chg_init() return on error + +From: Javier Martinez Canillas + +commit 1b52e50f2a402a266f1ba2281f0a57e87637a047 upstream. + +If i2c_new_dummy() fails in max77843_chg_init(), an PTR_ERR(NULL) is +returned which is 0. So the function was wrongly returning a success +value instead of an error code. + +Fixes: c7f585fe46d8 ("mfd: max77843: Add max77843 MFD driver core driver") +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/max77843.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mfd/max77843.c ++++ b/drivers/mfd/max77843.c +@@ -79,7 +79,7 @@ static int max77843_chg_init(struct max7 + if (!max77843->i2c_chg) { + dev_err(&max77843->i2c->dev, + "Cannot allocate I2C device for Charger\n"); +- return PTR_ERR(max77843->i2c_chg); ++ return -ENODEV; + } + i2c_set_clientdata(max77843->i2c_chg, max77843); + diff --git a/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch b/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch new file mode 100644 index 00000000..2dfdab75 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Eric Dumazet +Date: Tue, 29 Sep 2015 18:52:25 -0700 +Subject: net: add pfmemalloc check in sk_add_backlog() + +From: Eric Dumazet + +[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ] + +Greg reported crashes hitting the following check in __sk_backlog_rcv() + + BUG_ON(!sock_flag(sk, SOCK_MEMALLOC)); + +The pfmemalloc bit is currently checked in sk_filter(). + +This works correctly for TCP, because sk_filter() is ran in +tcp_v[46]_rcv() before hitting the prequeue or backlog checks. + +For UDP or other protocols, this does not work, because the sk_filter() +is ran from sock_queue_rcv_skb(), which might be called _after_ backlog +queuing if socket is owned by user by the time packet is processed by +softirq handler. + +Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing") +Signed-off-by: Eric Dumazet +Reported-by: Greg Thelen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/net/sock.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -826,6 +826,14 @@ static inline __must_check int sk_add_ba + if (sk_rcvqueues_full(sk, limit)) + return -ENOBUFS; + ++ /* ++ * If the skb was allocated from pfmemalloc reserves, only ++ * allow SOCK_MEMALLOC sockets to use it as this socket is ++ * helping free memory ++ */ ++ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) ++ return -ENOMEM; ++ + __sk_add_backlog(sk, skb); + sk->sk_backlog.len += skb->truesize; + return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch b/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch new file mode 100644 index 00000000..5e0635c3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch @@ -0,0 +1,47 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Vivien Didelot +Date: Tue, 29 Sep 2015 14:17:54 -0400 +Subject: net: dsa: fix preparation of a port STP update + +From: Vivien Didelot + +[ Upstream commit 57a47532c4312159935c98b7f1cf0e62296b9171 ] + +Because of the default 0 value of ret in dsa_slave_port_attr_set, a +driver may return -EOPNOTSUPP from the commit phase of a STP state, +which triggers a WARN() from switchdev. + +This happened on a 6185 switch which does not support hardware bridging. + +Fixes: 3563606258cf ("switchdev: convert STP update to switchdev attr set") +Reported-by: Andrew Lunn +Signed-off-by: Vivien Didelot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/slave.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -348,12 +348,17 @@ static int dsa_slave_stp_update(struct n + static int dsa_slave_port_attr_set(struct net_device *dev, + struct switchdev_attr *attr) + { +- int ret = 0; ++ struct dsa_slave_priv *p = netdev_priv(dev); ++ struct dsa_switch *ds = p->parent; ++ int ret; + + switch (attr->id) { + case SWITCHDEV_ATTR_PORT_STP_STATE: +- if (attr->trans == SWITCHDEV_TRANS_COMMIT) +- ret = dsa_slave_stp_update(dev, attr->u.stp_state); ++ if (attr->trans == SWITCHDEV_TRANS_PREPARE) ++ ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP; ++ else ++ ret = ds->drv->port_stp_update(ds, p->port, ++ attr->u.stp_state); + break; + default: + ret = -EOPNOTSUPP; diff --git a/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch b/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch new file mode 100644 index 00000000..17d64561 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch @@ -0,0 +1,40 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Ivan Mikhaylov +Date: Fri, 25 Sep 2015 11:52:27 +0400 +Subject: net/ibm/emac: bump version numbers for correct work with ethtool + +From: Ivan Mikhaylov + +[ Upstream commit 661dfc65f7981481ba2e31aaa702371e82336e56 ] + +The size of the MAC register dump used to be the size specified by the +reg property in the device tree. Userland has no good way of finding +out that size, and it was not specified consistently for each MAC type, +so ethtool would end up printing junk at the end of the register dump +if the device tree didn't match the size it assumed. + +Using the new version numbers indicates unambiguously that the size of +the MAC register dump is dependent only on the MAC type. + +Fixes: 5369c71f7ca2 ("net/ibm/emac: fix size of emac dump memory areas") +Signed-off-by: Ivan Mikhaylov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ibm/emac/core.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/ibm/emac/core.h ++++ b/drivers/net/ethernet/ibm/emac/core.h +@@ -460,8 +460,8 @@ struct emac_ethtool_regs_subhdr { + u32 index; + }; + +-#define EMAC_ETHTOOL_REGS_VER 0 +-#define EMAC4_ETHTOOL_REGS_VER 1 +-#define EMAC4SYNC_ETHTOOL_REGS_VER 2 ++#define EMAC_ETHTOOL_REGS_VER 3 ++#define EMAC4_ETHTOOL_REGS_VER 4 ++#define EMAC4SYNC_ETHTOOL_REGS_VER 5 + + #endif /* __IBM_NEWEMAC_CORE_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch b/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch new file mode 100644 index 00000000..caf341d6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch @@ -0,0 +1,67 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Andrey Vagin +Date: Fri, 2 Oct 2015 00:05:36 +0300 +Subject: net/unix: fix logic about sk_peek_offset + +From: Andrey Vagin + +[ Upstream commit e9193d60d363e4dff75ff6d43a48f22be26d59c7 ] + +Now send with MSG_PEEK can return data from multiple SKBs. + +Unfortunately we take into account the peek offset for each skb, +that is wrong. We need to apply the peek offset only once. + +In addition, the peek offset should be used only if MSG_PEEK is set. + +Cc: "David S. Miller" (maintainer:NETWORKING +Cc: Eric Dumazet (commit_signer:1/14=7%) +Cc: Aaron Conole +Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") +Signed-off-by: Andrey Vagin +Tested-by: Aaron Conole +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/af_unix.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(stru + goto out; + } + ++ if (flags & MSG_PEEK) ++ skip = sk_peek_offset(sk, flags); ++ else ++ skip = 0; ++ + do { + int chunk; + struct sk_buff *skb, *last; +@@ -2112,7 +2117,6 @@ unlock: + break; + } + +- skip = sk_peek_offset(sk, flags); + while (skip >= unix_skb_len(skb)) { + skip -= unix_skb_len(skb); + last = skb; +@@ -2179,14 +2183,12 @@ unlock: + if (UNIXCB(skb).fp) + scm.fp = scm_fp_dup(UNIXCB(skb).fp); + +- if (skip) { +- sk_peek_offset_fwd(sk, chunk); +- skip -= chunk; +- } ++ sk_peek_offset_fwd(sk, chunk); + + if (UNIXCB(skb).fp) + break; + ++ skip = 0; + last = skb; + last_len = skb->len; + unix_state_lock(sk); diff --git a/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch b/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch new file mode 100644 index 00000000..dc17779e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch @@ -0,0 +1,107 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: "Arad, Ronen" +Date: Thu, 15 Oct 2015 01:55:17 -0700 +Subject: netlink: Trim skb to alloc size to avoid MSG_TRUNC + +From: "Arad, Ronen" + +[ Upstream commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe ] + +netlink_dump() allocates skb based on the calculated min_dump_alloc or +a per socket max_recvmsg_len. +min_alloc_size is maximum space required for any single netdev +attributes as calculated by rtnl_calcit(). +max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. +It is capped at 16KiB. +The intention is to avoid small allocations and to minimize the number +of calls required to obtain dump information for all net devices. + +netlink_dump packs as many small messages as could fit within an skb +that was sized for the largest single netdev information. The actual +space available within an skb is larger than what is requested. It could +be much larger and up to near 2x with align to next power of 2 approach. + +Allowing netlink_dump to use all the space available within the +allocated skb increases the buffer size a user has to provide to avoid +truncaion (i.e. MSG_TRUNG flag set). + +It was observed that with many VLANs configured on at least one netdev, +a larger buffer of near 64KiB was necessary to avoid "Message truncated" +error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when +min_alloc_size was only little over 32KiB. + +This patch trims skb to allocated size in order to allow the user to +avoid truncation with more reasonable buffer size. + +Signed-off-by: Ronen Arad +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ + 1 file changed, 22 insertions(+), 12 deletions(-) + +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2750,6 +2750,7 @@ static int netlink_dump(struct sock *sk) + struct sk_buff *skb = NULL; + struct nlmsghdr *nlh; + int len, err = -ENOBUFS; ++ int alloc_min_size; + int alloc_size; + + mutex_lock(nlk->cb_mutex); +@@ -2758,9 +2759,6 @@ static int netlink_dump(struct sock *sk) + goto errout_skb; + } + +- cb = &nlk->cb; +- alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); +- + if (!netlink_rx_is_mmaped(sk) && + atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) + goto errout_skb; +@@ -2770,23 +2768,35 @@ static int netlink_dump(struct sock *sk) + * to reduce number of system calls on dump operations, if user + * ever provided a big enough buffer. + */ +- if (alloc_size < nlk->max_recvmsg_len) { +- skb = netlink_alloc_skb(sk, +- nlk->max_recvmsg_len, +- nlk->portid, ++ cb = &nlk->cb; ++ alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); ++ ++ if (alloc_min_size < nlk->max_recvmsg_len) { ++ alloc_size = nlk->max_recvmsg_len; ++ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL | + __GFP_NOWARN | + __GFP_NORETRY); +- /* available room should be exact amount to avoid MSG_TRUNC */ +- if (skb) +- skb_reserve(skb, skb_tailroom(skb) - +- nlk->max_recvmsg_len); + } +- if (!skb) ++ if (!skb) { ++ alloc_size = alloc_min_size; + skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, + GFP_KERNEL); ++ } + if (!skb) + goto errout_skb; ++ ++ /* Trim skb to allocated size. User is expected to provide buffer as ++ * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at ++ * netlink_recvmsg())). dump will pack as many smaller messages as ++ * could fit within the allocated skb. skb is typically allocated ++ * with larger space than required (could be as much as near 2x the ++ * requested size with align to next power of 2 approach). Allowing ++ * dump to use the excess space makes it difficult for a user to have a ++ * reasonable static buffer based on the expected largest dump of a ++ * single netdev. The outcome is MSG_TRUNC error. ++ */ ++ skb_reserve(skb, skb_tailroom(skb) - alloc_size); + netlink_skb_set_owner_r(skb, sk); + + len = cb->dump(skb, cb); diff --git a/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch b/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch new file mode 100644 index 00000000..93a47304 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch @@ -0,0 +1,43 @@ +From 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Fri, 9 Oct 2015 15:03:26 +0200 +Subject: nfsd/blocklayout: accept any minlength + +From: Christoph Hellwig + +commit 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b upstream. + +Recent Linux clients have started to send GETLAYOUT requests with +minlength less than blocksize. + +Servers aren't really allowed to impose this kind of restriction on +layouts; see RFC 5661 section 18.43.3 for details. + +This has been observed to cause indefinite hangs on fsx runs on some +clients. + +Signed-off-by: Christoph Hellwig +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/blocklayout.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/fs/nfsd/blocklayout.c ++++ b/fs/nfsd/blocklayout.c +@@ -56,14 +56,6 @@ nfsd4_block_proc_layoutget(struct inode + u32 device_generation = 0; + int error; + +- /* +- * We do not attempt to support I/O smaller than the fs block size, +- * or not aligned to it. +- */ +- if (args->lg_minlength < block_size) { +- dprintk("pnfsd: I/O too small\n"); +- goto out_layoutunavailable; +- } + if (seg->offset & (block_size - 1)) { + dprintk("pnfsd: I/O misaligned\n"); + goto out_layoutunavailable; diff --git a/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch b/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch new file mode 100644 index 00000000..d6354343 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Konstantin Khlebnikov +Date: Fri, 2 Oct 2015 13:18:22 +0300 +Subject: ovs: do not allocate memory from offline numa node + +From: Konstantin Khlebnikov + +[ Upstream commit 598c12d0ba6de9060f04999746eb1e015774044b ] + +When openvswitch tries allocate memory from offline numa node 0: +stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0) +It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid)) +[ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h +This patch disables numa affinity in this case. + +Signed-off-by: Konstantin Khlebnikov +Acked-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/openvswitch/flow_table.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/net/openvswitch/flow_table.c ++++ b/net/openvswitch/flow_table.c +@@ -92,7 +92,8 @@ struct sw_flow *ovs_flow_alloc(void) + + /* Initialize the default stat node. */ + stats = kmem_cache_alloc_node(flow_stats_cache, +- GFP_KERNEL | __GFP_ZERO, 0); ++ GFP_KERNEL | __GFP_ZERO, ++ node_online(0) ? 0 : NUMA_NO_NODE); + if (!stats) + goto err; + diff --git a/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch new file mode 100644 index 00000000..0234e75f --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch @@ -0,0 +1,76 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Guillaume Nault +Date: Wed, 30 Sep 2015 11:45:33 +0200 +Subject: ppp: don't override sk->sk_state in pppoe_flush_dev() + +From: Guillaume Nault + +[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ] + +Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"), +pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the +PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to +PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the +following oops: + +[ 570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0 +[ 570.142931] IP: [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0 +[ 570.144601] Oops: 0000 [#1] SMP +[ 570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio +[ 570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1 +[ 570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 +[ 570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000 +[ 570.144601] RIP: 0010:[] [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] RSP: 0018:ffff880036b63e08 EFLAGS: 00010202 +[ 570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206 +[ 570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20 +[ 570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000 +[ 570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780 +[ 570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0 +[ 570.144601] FS: 00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000 +[ 570.144601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0 +[ 570.144601] Stack: +[ 570.144601] ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0 +[ 570.144601] ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008 +[ 570.144601] ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5 +[ 570.144601] Call Trace: +[ 570.144601] [] sock_release+0x1a/0x75 +[ 570.144601] [] sock_close+0xd/0x11 +[ 570.144601] [] __fput+0xff/0x1a5 +[ 570.144601] [] ____fput+0x9/0xb +[ 570.144601] [] task_work_run+0x66/0x90 +[ 570.144601] [] prepare_exit_to_usermode+0x8c/0xa7 +[ 570.144601] [] syscall_return_slowpath+0x16d/0x19b +[ 570.144601] [] int_ret_from_sys_call+0x25/0x9f +[ 570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00 +[ 570.144601] RIP [] pppoe_release+0x50/0x101 [pppoe] +[ 570.144601] RSP +[ 570.144601] CR2: 00000000000004e0 +[ 570.200518] ---[ end trace 46956baf17349563 ]--- + +pppoe_flush_dev() has no reason to override sk->sk_state with +PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to +PPPOX_DEAD, which is the correct state given that sk is unbound and +po->pppoe_dev is NULL. + +Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release") +Tested-by: Oleksii Berezhniak +Signed-off-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ppp/pppoe.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d + if (po->pppoe_dev == dev && + sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { + pppox_unbind_sock(sk); +- sk->sk_state = PPPOX_ZOMBIE; + sk->sk_state_change(sk); + po->pppoe_dev = NULL; + dev_put(dev); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch new file mode 100644 index 00000000..40758742 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch @@ -0,0 +1,68 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Pravin B Shelar +Date: Tue, 22 Sep 2015 12:57:53 -0700 +Subject: skbuff: Fix skb checksum flag on skb pull + +From: Pravin B Shelar + +[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ] + +VXLAN device can receive skb with checksum partial. But the checksum +offset could be in outer header which is pulled on receive. This results +in negative checksum offset for the skb. Such skb can cause the assert +failure in skb_checksum_help(). Following patch fixes the bug by setting +checksum-none while pulling outer header. + +Following is the kernel panic msg from old kernel hitting the bug. + +------------[ cut here ]------------ +kernel BUG at net/core/dev.c:1906! +RIP: 0010:[] skb_checksum_help+0x144/0x150 +Call Trace: + +[] queue_userspace_packet+0x408/0x470 [openvswitch] +[] ovs_dp_upcall+0x5d/0x60 [openvswitch] +[] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch] +[] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch] +[] ovs_vport_receive+0x2a/0x30 [openvswitch] +[] vxlan_rcv+0x53/0x60 [openvswitch] +[] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch] +[] udp_queue_rcv_skb+0x2dc/0x3b0 +[] __udp4_lib_rcv+0x1cf/0x6c0 +[] udp_rcv+0x1a/0x20 +[] ip_local_deliver_finish+0xdd/0x280 +[] ip_local_deliver+0x88/0x90 +[] ip_rcv_finish+0x10d/0x370 +[] ip_rcv+0x235/0x300 +[] __netif_receive_skb+0x55d/0x620 +[] netif_receive_skb+0x80/0x90 +[] virtnet_poll+0x555/0x6f0 +[] net_rx_action+0x134/0x290 +[] __do_softirq+0xa8/0x210 +[] call_softirq+0x1c/0x30 +[] do_softirq+0x65/0xa0 +[] irq_exit+0x8e/0xb0 +[] do_IRQ+0x63/0xe0 +[] common_interrupt+0x6e/0x6e + +Reported-by: Anupam Chanda +Signed-off-by: Pravin B Shelar +Acked-by: Tom Herbert +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(st + { + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); ++ else if (skb->ip_summed == CHECKSUM_PARTIAL && ++ skb_checksum_start_offset(skb) <= len) ++ skb->ip_summed = CHECKSUM_NONE; + } + + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch new file mode 100644 index 00000000..4d3fed25 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch @@ -0,0 +1,58 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Pravin B Shelar +Date: Mon, 28 Sep 2015 17:24:25 -0700 +Subject: skbuff: Fix skb checksum partial check. + +From: Pravin B Shelar + +[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ] + +Earlier patch 6ae459bda tried to detect void ckecksum partial +skb by comparing pull length to checksum offset. But it does +not work for all cases since checksum-offset depends on +updates to skb->data. + +Following patch fixes it by validating checksum start offset +after skb-data pointer is updated. Negative value of checksum +offset start means there is no need to checksum. + +Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull") +Reported-by: Andrew Vagin +Signed-off-by: Pravin B Shelar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/skbuff.h | 2 +- + net/core/skbuff.c | 9 +++++---- + 2 files changed, 6 insertions(+), 5 deletions(-) + +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -2602,7 +2602,7 @@ static inline void skb_postpull_rcsum(st + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); + else if (skb->ip_summed == CHECKSUM_PARTIAL && +- skb_checksum_start_offset(skb) <= len) ++ skb_checksum_start_offset(skb) < 0) + skb->ip_summed = CHECKSUM_NONE; + } + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags); + */ + unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) + { ++ unsigned char *data = skb->data; ++ + BUG_ON(len > skb->len); +- skb->len -= len; +- BUG_ON(skb->len < skb->data_len); +- skb_postpull_rcsum(skb, skb->data, len); +- return skb->data += len; ++ __skb_pull(skb, len); ++ skb_postpull_rcsum(skb, data, len); ++ return skb->data; + } + EXPORT_SYMBOL_GPL(skb_pull_rcsum); + diff --git a/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch b/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch new file mode 100644 index 00000000..866de2e9 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch @@ -0,0 +1,57 @@ +From foo@baz Thu Oct 22 17:25:24 PDT 2015 +From: Jon Paul Maloy +Date: Wed, 14 Oct 2015 09:23:18 -0400 +Subject: tipc: move fragment importance field to new header position + +From: Jon Paul Maloy + +[ Upstream commit dde4b5ae65de659b9ec64bafdde0430459fcb495 ] + +In commit e3eea1eb47a ("tipc: clean up handling of message priorities") +we introduced a field in the packet header for keeping track of the +priority of fragments, since this value is not present in the specified +protocol header. Since the value so far only is used at the transmitting +end of the link, we have not yet officially defined it as part of the +protocol. + +Unfortunately, the field we use for keeping this value, bits 13-15 in +in word 5, has turned out to be a poor choice; it is already used by the +broadcast protocol for carrying the 'network id' field of the sending +node. Since packet fragments also need to be transported across the +broadcast protocol, the risk of conflict is obvious, and we see this +happen when we use network identities larger than 2^13-1. This has +escaped our testing because we have so far only been using small network +id values. + +We now move this field to bits 0-2 in word 9, a field that is guaranteed +to be unused by all involved protocols. + +Fixes: e3eea1eb47a ("tipc: clean up handling of message priorities") +Signed-off-by: Jon Maloy +Acked-by: Ying Xue +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/tipc/msg.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/tipc/msg.h ++++ b/net/tipc/msg.h +@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct + if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m))) + return usr; + if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)) +- return msg_bits(m, 5, 13, 0x7); ++ return msg_bits(m, 9, 0, 0x7); + return TIPC_SYSTEM_IMPORTANCE; + } + +@@ -366,7 +366,7 @@ static inline void msg_set_importance(st + int usr = msg_user(m); + + if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))) +- msg_set_bits(m, 5, 13, 0x7, i); ++ msg_set_bits(m, 9, 0, 0x7, i); + else if (i < TIPC_SYSTEM_IMPORTANCE) + msg_set_user(m, i); + else diff --git a/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch b/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch new file mode 100644 index 00000000..c8324073 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch @@ -0,0 +1,78 @@ +From 874bbfe600a660cba9c776b3957b1ce393151b76 Mon Sep 17 00:00:00 2001 +From: Shaohua Li +Date: Wed, 30 Sep 2015 09:05:30 -0700 +Subject: workqueue: make sure delayed work run in local cpu + +From: Shaohua Li + +commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream. + +My system keeps crashing with below message. vmstat_update() schedules a delayed +work in current cpu and expects the work runs in the cpu. +schedule_delayed_work() is expected to make delayed work run in local cpu. The +problem is timer can be migrated with NO_HZ. __queue_work() queues work in +timer handler, which could run in a different cpu other than where the delayed +work is scheduled. The end result is the delayed work runs in different cpu. +The patch makes __queue_delayed_work records local cpu earlier. Where the timer +runs doesn't change where the work runs with the change. + +[ 28.010131] ------------[ cut here ]------------ +[ 28.010609] kernel BUG at ../mm/vmstat.c:1392! +[ 28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN +[ 28.011860] Modules linked in: +[ 28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G W4.3.0-rc3+ #634 +[ 28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014 +[ 28.014160] Workqueue: events vmstat_update +[ 28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000 +[ 28.015445] RIP: 0010:[] []vmstat_update+0x31/0x80 +[ 28.016282] RSP: 0018:ffff8800ba42fd80 EFLAGS: 00010297 +[ 28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000 +[ 28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d +[ 28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000 +[ 28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640 +[ 28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000 +[ 28.020071] FS: 0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000 +[ 28.020071] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b +[ 28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0 +[ 28.020071] Stack: +[ 28.020071] ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88 +[ 28.020071] ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8 +[ 28.020071] ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340 +[ 28.020071] Call Trace: +[ 28.020071] [] process_one_work+0x1c8/0x540 +[ 28.020071] [] ? process_one_work+0x14b/0x540 +[ 28.020071] [] worker_thread+0x114/0x460 +[ 28.020071] [] ? process_one_work+0x540/0x540 +[ 28.020071] [] kthread+0xf8/0x110 +[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 +[ 28.020071] [] ret_from_fork+0x3f/0x70 +[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 + +Signed-off-by: Shaohua Li +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/workqueue.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu + timer_stats_timer_set_start_info(&dwork->timer); + + dwork->wq = wq; ++ /* timer isn't guaranteed to run in this cpu, record earlier */ ++ if (cpu == WORK_CPU_UNBOUND) ++ cpu = raw_smp_processor_id(); + dwork->cpu = cpu; + timer->expires = jiffies + delay; + +- if (unlikely(cpu != WORK_CPU_UNBOUND)) +- add_timer_on(timer, cpu); +- else +- add_timer(timer); ++ add_timer_on(timer, cpu); + } + + /** diff --git a/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch b/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch deleted file mode 100644 index dd02c4a4..00000000 --- a/kernel/kernel/files/patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 762982db33b23029e98c844611e2e8beeb75bc0d Mon Sep 17 00:00:00 2001 -From: Roger Quadros -Date: Thu, 13 Aug 2015 13:28:42 +0300 -Subject: [PATCH] usb: phy: phy-generic: Fix reset behaviour on legacy boot - -The gpio-desc migration done in v4.0 caused a regression -with legacy boots due to reversed reset logic. -e.g. omap3-beagle USB host breaks on legacy boot. - -Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that -it matches the driver logic and pin behaviour. - -Fixes: e9f2cefb0cdc ("usb: phy: generic: migrate to gpio_desc") -Cc: # 4.0+ -Tested-by: Fabio Estevam -Signed-off-by: Roger Quadros -Signed-off-by: Felipe Balbi ---- - drivers/usb/phy/phy-generic.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c -index ec6ecd0..5320cb8 100644 ---- a/drivers/usb/phy/phy-generic.c -+++ b/drivers/usb/phy/phy-generic.c -@@ -232,7 +232,8 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop, - clk_rate = pdata->clk_rate; - needs_vcc = pdata->needs_vcc; - if (gpio_is_valid(pdata->gpio_reset)) { -- err = devm_gpio_request_one(dev, pdata->gpio_reset, 0, -+ err = devm_gpio_request_one(dev, pdata->gpio_reset, -+ GPIOF_ACTIVE_LOW, - dev_name(dev)); - if (!err) - nop->gpiod_reset = --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch b/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch deleted file mode 100644 index 796b4dae..00000000 --- a/kernel/kernel/files/patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch +++ /dev/null @@ -1,56 +0,0 @@ -From dca7794539eff04b786fb6907186989e5eaaa9c2 Mon Sep 17 00:00:00 2001 -From: Mathias Nyman -Date: Mon, 21 Sep 2015 17:46:16 +0300 -Subject: [PATCH] xhci: change xhci 1.0 only restrictions to support xhci 1.1 - -Some changes between xhci 0.96 and xhci 1.0 specifications forced us to -check the hci version in code, some of these checks were implemented as -hci_version == 1.0, which will not work with new xhci 1.1 controllers. - -xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these -checks to hci_version >= 1.0 - -Cc: -Signed-off-by: Mathias Nyman -Signed-off-by: Greg Kroah-Hartman ---- - drivers/usb/host/xhci-mem.c | 6 +++--- - drivers/usb/host/xhci-ring.c | 4 ++-- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 9a8c936..8497fb8 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1498,10 +1498,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci, - * use Event Data TRBs, and we don't chain in a link TRB on short - * transfers, we're basically dividing by 1. - * -- * xHCI 1.0 specification indicates that the Average TRB Length should -- * be set to 8 for control endpoints. -+ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length -+ * should be set to 8 for control endpoints. - */ -- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100) -+ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100) - ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8)); - else - ep_ctx->tx_info |= -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index 1c61e5e..43291f9 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -3470,8 +3470,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags, - if (start_cycle == 0) - field |= 0x1; - -- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */ -- if (xhci->hci_version == 0x100) { -+ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */ -+ if (xhci->hci_version >= 0x100) { - if (urb->transfer_buffer_length > 0) { - if (setup->bRequestType & USB_DIR_IN) - field |= TRB_TX_TYPE(TRB_DATA_IN); --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch b/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch deleted file mode 100644 index a79001a1..00000000 --- a/kernel/kernel/files/patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch +++ /dev/null @@ -1,174 +0,0 @@ -From a5caa209ba9c29c6421292e7879d2387a2ef39c9 Mon Sep 17 00:00:00 2001 -From: Matt Fleming -Date: Fri, 25 Sep 2015 23:02:18 +0100 -Subject: [PATCH] x86/efi: Fix boot crash by mapping EFI memmap entries - bottom-up at runtime, instead of top-down - -Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced -that signals that the firmware PE/COFF loader supports splitting -code and data sections of PE/COFF images into separate EFI -memory map entries. This allows the kernel to map those regions -with strict memory protections, e.g. EFI_MEMORY_RO for code, -EFI_MEMORY_XP for data, etc. - -Unfortunately, an unwritten requirement of this new feature is -that the regions need to be mapped with the same offsets -relative to each other as observed in the EFI memory map. If -this is not done crashes like this may occur, - - BUG: unable to handle kernel paging request at fffffffefe6086dd - IP: [] 0xfffffffefe6086dd - Call Trace: - [] efi_call+0x7e/0x100 - [] ? virt_efi_set_variable+0x61/0x90 - [] efi_delete_dummy_variable+0x63/0x70 - [] efi_enter_virtual_mode+0x383/0x392 - [] start_kernel+0x38a/0x417 - [] x86_64_start_reservations+0x2a/0x2c - [] x86_64_start_kernel+0xeb/0xef - -Here 0xfffffffefe6086dd refers to an address the firmware -expects to be mapped but which the OS never claimed was mapped. -The issue is that included in these regions are relative -addresses to other regions which were emitted by the firmware -toolchain before the "splitting" of sections occurred at -runtime. - -Needless to say, we don't satisfy this unwritten requirement on -x86_64 and instead map the EFI memory map entries in reverse -order. The above crash is almost certainly triggerable with any -kernel newer than v3.13 because that's when we rewrote the EFI -runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi: -Runtime services virtual mapping"). For kernel versions before -v3.13 things may work by pure luck depending on the -fragmentation of the kernel virtual address space at the time we -map the EFI regions. - -Instead of mapping the EFI memory map entries in reverse order, -where entry N has a higher virtual address than entry N+1, map -them in the same order as they appear in the EFI memory map to -preserve this relative offset between regions. - -This patch has been kept as small as possible with the intention -that it should be applied aggressively to stable and -distribution kernels. It is very much a bugfix rather than -support for a new feature, since when EFI_PROPERTIES_TABLE is -enabled we must map things as outlined above to even boot - we -have no way of asking the firmware not to split the code/data -regions. - -In fact, this patch doesn't even make use of the more strict -memory protections available in UEFI v2.5. That will come later. - -Suggested-by: Ard Biesheuvel -Reported-by: Ard Biesheuvel -Signed-off-by: Matt Fleming -Cc: -Cc: Borislav Petkov -Cc: Chun-Yi -Cc: Dave Young -Cc: H. Peter Anvin -Cc: James Bottomley -Cc: Lee, Chun-Yi -Cc: Leif Lindholm -Cc: Linus Torvalds -Cc: Matthew Garrett -Cc: Mike Galbraith -Cc: Peter Jones -Cc: Peter Zijlstra -Cc: Thomas Gleixner -Cc: linux-kernel@vger.kernel.org -Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk -Signed-off-by: Ingo Molnar ---- - arch/x86/platform/efi/efi.c | 67 ++++++++++++++++++++++++++++++++++++++++++++- - 1 file changed, 66 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index 1db84c0..6a28ded 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -705,6 +705,70 @@ out: - } - - /* -+ * Iterate the EFI memory map in reverse order because the regions -+ * will be mapped top-down. The end result is the same as if we had -+ * mapped things forward, but doesn't require us to change the -+ * existing implementation of efi_map_region(). -+ */ -+static inline void *efi_map_next_entry_reverse(void *entry) -+{ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map_end - memmap.desc_size; -+ -+ entry -= memmap.desc_size; -+ if (entry < memmap.map) -+ return NULL; -+ -+ return entry; -+} -+ -+/* -+ * efi_map_next_entry - Return the next EFI memory map descriptor -+ * @entry: Previous EFI memory map descriptor -+ * -+ * This is a helper function to iterate over the EFI memory map, which -+ * we do in different orders depending on the current configuration. -+ * -+ * To begin traversing the memory map @entry must be %NULL. -+ * -+ * Returns %NULL when we reach the end of the memory map. -+ */ -+static void *efi_map_next_entry(void *entry) -+{ -+ if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) { -+ /* -+ * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE -+ * config table feature requires us to map all entries -+ * in the same order as they appear in the EFI memory -+ * map. That is to say, entry N must have a lower -+ * virtual address than entry N+1. This is because the -+ * firmware toolchain leaves relative references in -+ * the code/data sections, which are split and become -+ * separate EFI memory regions. Mapping things -+ * out-of-order leads to the firmware accessing -+ * unmapped addresses. -+ * -+ * Since we need to map things this way whether or not -+ * the kernel actually makes use of -+ * EFI_PROPERTIES_TABLE, let's just switch to this -+ * scheme by default for 64-bit. -+ */ -+ return efi_map_next_entry_reverse(entry); -+ } -+ -+ /* Initial call */ -+ if (!entry) -+ return memmap.map; -+ -+ entry += memmap.desc_size; -+ if (entry >= memmap.map_end) -+ return NULL; -+ -+ return entry; -+} -+ -+/* - * Map the efi memory ranges of the runtime services and update new_mmap with - * virtual addresses. - */ -@@ -714,7 +778,8 @@ static void * __init efi_map_regions(int *count, int *pg_shift) - unsigned long left = 0; - efi_memory_desc_t *md; - -- for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { -+ p = NULL; -+ while ((p = efi_map_next_entry(p))) { - md = p; - if (!(md->attribute & EFI_MEMORY_RUNTIME)) { - #ifdef CONFIG_X86_64 --- -2.6.0 - diff --git a/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch b/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch new file mode 100644 index 00000000..496144c3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch @@ -0,0 +1,92 @@ +From 8a53554e12e98d1759205afd7b8e9e2ea0936f48 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?= + +Date: Mon, 12 Oct 2015 15:13:56 +0100 +Subject: [PATCH] x86/efi: Fix multiple GOP device support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +When multiple GOP devices exists, but none of them implements +ConOut, the code should just choose the first GOP (according to +the comments). But currently 'fb_base' will refer to the last GOP, +while other parameters to the first GOP, which will likely +result in a garbled display. + +I can reliably reproduce this bug using my ASRock Z87M Extreme4 +motherboard with CSM and integrated GPU disabled, and two PCIe +video cards (NVidia GT640 and GTX980), booting from efi-stub +(booting from grub works fine). On the primary display the +ASRock logo remains and on the secondary screen it is garbled +up completely. + +Signed-off-by: Kővágó, Zoltán +Signed-off-by: Matt Fleming +Cc: +Cc: Linus Torvalds +Cc: Matthew Garrett +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1444659236-24837-2-git-send-email-matt@codeblueprint.co.uk +Signed-off-by: Ingo Molnar +--- + arch/x86/boot/compressed/eboot.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index ee1b6d3..db51c1f 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -667,6 +667,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + bool conout_found = false; + void *dummy = NULL; + u32 h = handles[i]; ++ u32 current_fb_base; + + status = efi_call_early(handle_protocol, h, + proto, (void **)&gop32); +@@ -678,7 +679,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query32(gop32, &info, &size, &fb_base); ++ status = __gop_query32(gop32, &info, &size, ¤t_fb_base); + if (status == EFI_SUCCESS && (!first_gop || conout_found)) { + /* + * Systems that use the UEFI Console Splitter may +@@ -692,6 +693,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto, + pixel_format = info->pixel_format; + pixel_info = info->pixel_information; + pixels_per_scan_line = info->pixels_per_scan_line; ++ fb_base = current_fb_base; + + /* + * Once we've found a GOP supporting ConOut, +@@ -770,6 +772,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + bool conout_found = false; + void *dummy = NULL; + u64 h = handles[i]; ++ u32 current_fb_base; + + status = efi_call_early(handle_protocol, h, + proto, (void **)&gop64); +@@ -781,7 +784,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + if (status == EFI_SUCCESS) + conout_found = true; + +- status = __gop_query64(gop64, &info, &size, &fb_base); ++ status = __gop_query64(gop64, &info, &size, ¤t_fb_base); + if (status == EFI_SUCCESS && (!first_gop || conout_found)) { + /* + * Systems that use the UEFI Console Splitter may +@@ -795,6 +798,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto, + pixel_format = info->pixel_format; + pixel_info = info->pixel_information; + pixels_per_scan_line = info->pixels_per_scan_line; ++ fb_base = current_fb_base; + + /* + * Once we've found a GOP supporting ConOut, +-- +2.6.2 + diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index 05db5206..b87e946a 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -28,15 +28,14 @@ - patches/linux/patch-4.2.3.xz - + patches/linux/patch-4.2.4.xz + patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch - patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch - patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch + patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch patches/mageia/pci-quirks-drop-devinit-exit.patch patches/mageia/acpi-CLEVO-M360S-disable_acpi_irq.patch @@ -56,8 +55,7 @@ patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch patches/mageia/fs-aufs4-modular.patch - patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch - patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch + patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -73,11 +71,12 @@ patches/mageia/gpu-drm-mach64-3.6-buildfix.patch patches/mageia/gpu-drm-mach64-3.7-buildfix.patch patches/mageia/gpu-drm-mach64-3.12-buildfix.patch - patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch + patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch patches/mageia/gpu-drm-mach64-linux-3.14-buildfix.patch patches/mageia/gpu-drm-mach64-3.17-buildfix.patch patches/mageia/gpu-drm-mach64-3.18-buildfix.patch patches/mageia/input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch + patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch patches/mageia/net-sis190-fix-list-usage.patch patches/mageia/net-netfilter-IFWLOG.patch patches/mageia/net-netfilter-IFWLOG-mdv.patch @@ -87,14 +86,9 @@ patches/mageia/net-netfilter-IFWLOG-3.7-buildfix.patch patches/mageia/net-netfilter-psd.patch patches/mageia/net-netfilter-psd-mdv.patch - patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch - patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch - patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch - patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch - patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch - patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch - patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch - patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch + patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch + patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch + patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch patches/mageia/platform-x86-add-shuttle-wmi-driver.patch patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch @@ -103,8 +97,6 @@ patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch patches/mageia/usb-storage-unusual_devs-add-id.patch patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch - patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch - patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch patches/mageia/3rd-3rdparty-1.0-tree.patch patches/mageia/3rd-3rdparty-merge.patch @@ -191,7 +183,15 @@ - + + + 2015-11-26 + 4.2.4 + Version bump to 4.2.4 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4 + security + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-10-04 4.2.3