diff --git a/kernel/kernel/files/configs/kernel-x86_64-config b/kernel/kernel/files/configs/kernel-x86_64-config index 73b96220..116045e8 100644 --- a/kernel/kernel/files/configs/kernel-x86_64-config +++ b/kernel/kernel/files/configs/kernel-x86_64-config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 4.2.4 Kernel Configuration +# Linux/x86_64 4.2.5 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/kernel/kernel/files/patches/linux/patch-4.1.5.xz b/kernel/kernel/files/patches/linux/patch-4.1.5.xz deleted file mode 100644 index 25a374ff..00000000 Binary files a/kernel/kernel/files/patches/linux/patch-4.1.5.xz and /dev/null differ diff --git a/kernel/kernel/files/patches/linux/patch-4.1.7.xz b/kernel/kernel/files/patches/linux/patch-4.1.7.xz deleted file mode 100644 index 056b9d3c..00000000 Binary files a/kernel/kernel/files/patches/linux/patch-4.1.7.xz and /dev/null differ diff --git a/kernel/kernel/files/patches/linux/patch-4.1.8.xz b/kernel/kernel/files/patches/linux/patch-4.1.8.xz deleted file mode 100644 index c2d46113..00000000 Binary files a/kernel/kernel/files/patches/linux/patch-4.1.8.xz and /dev/null differ diff --git a/kernel/kernel/files/patches/linux/patch-4.1.xz b/kernel/kernel/files/patches/linux/patch-4.1.xz deleted file mode 100644 index 8438b0bf..00000000 Binary files a/kernel/kernel/files/patches/linux/patch-4.1.xz and /dev/null differ diff --git a/kernel/kernel/files/patches/linux/patch-4.2.5.xz b/kernel/kernel/files/patches/linux/patch-4.2.5.xz new file mode 100644 index 00000000..fbb95167 Binary files /dev/null and b/kernel/kernel/files/patches/linux/patch-4.2.5.xz differ diff --git a/kernel/kernel/files/patches/mageia/base-cacheinfo-silence-DT-warnings.patch b/kernel/kernel/files/patches/mageia/base-cacheinfo-silence-DT-warnings.patch new file mode 100644 index 00000000..241453ab --- /dev/null +++ b/kernel/kernel/files/patches/mageia/base-cacheinfo-silence-DT-warnings.patch @@ -0,0 +1,49 @@ + +Devicetree is enabled on 32bit kernels for OLPC support, +but this causes error messages: + +'Failed to find cpu0 device node' that breaks bootsplash. + +https://bugs.mageia.org/show_bug.cgi?id=16655#c39 +https://bugs.mageia.org/show_bug.cgi?id=17010 + +So hide them behind debug for cleaner boot. + +Signed-off-by: Thomas Backlund + + +--- linux/drivers/base/cacheinfo.c.orig ++++ linux/drivers/base/cacheinfo.c +@@ -53,12 +53,12 @@ + return 0; + + if (!cpu_dev) { +- pr_err("No cpu device for CPU %d\n", cpu); ++ pr_debug("No cpu device for CPU %d\n", cpu); + return -ENODEV; + } + np = cpu_dev->of_node; + if (!np) { +- pr_err("Failed to find cpu%d device node\n", cpu); ++ pr_debug("Failed to find cpu%d device node\n", cpu); + return -ENOENT; + } + +@@ -203,7 +203,7 @@ + */ + ret = cache_shared_cpu_map_setup(cpu); + if (ret) { +- pr_warn("Unable to detect cache hierarchy from DT for CPU %d\n", ++ pr_debug("Unable to detect cache hierarchy from DT for CPU %d\n", + cpu); + goto free_ci; + } +@@ -540,7 +540,7 @@ + rc = cache_add_dev(cpu); + if (rc) { + free_cache_attributes(cpu); +- pr_err("error populating cacheinfo..cpu%d\n", cpu); ++ pr_debug("error populating cacheinfo..cpu%d\n", cpu); + goto out; + } + } diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index 99f6d3c8..db9cc488 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,47 +14,9 @@ ### ### Stable Queue ### -stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch -stable-l2tp-protect-tunnel-del_work-by-ref_count.patch -stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch -stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch -stable-net-unix-fix-logic-about-sk_peek_offset.patch -stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch -stable-skbuff-fix-skb-checksum-partial-check.patch -stable-net-dsa-fix-preparation-of-a-port-stp-update.patch -stable-inet-fix-races-in-reqsk_queue_hash_req.patch -stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch -stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch -stable-inet-fix-race-in-reqsk_queue_unlink.patch -stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch -stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch -stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch -stable-bpf-clear-sender_cpu-before-xmit.patch -stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch -stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch -stable-tipc-move-fragment-importance-field-to-new-header-position.patch -stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch -stable-drm-fix-locking-for-sysfs-dpms-file.patch -stable-crypto-sparc-initialize-blkcipher.ivsize.patch -stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch -stable-crypto-ahash-ensure-statesize-is-non-zero.patch -stable-memcg-convert-threshold-to-bytes.patch -stable-btrfs-check-unsupported-filters-in-balance-arguments.patch -stable-btrfs-fix-use-after-free-iterating-extrefs.patch -stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch -stable-arm-ux500-simplify-secondary-cpu-boot.patch -stable-nfsd-blocklayout-accept-any-minlength.patch -stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch -stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch -stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch -stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch -stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch -stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch -stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch -stable-kvm-x86-fix-smi-to-halted-vcpu.patch -stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch -stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch -stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch +stable-mac80211-fix-hwflags-debugfs-file-format.patch +stable-ath9k-declare-required-extra-tx-headroom.patch +stable-mmc-core-fix-init_card-in-52mhz.patch ### ### Arch x86 @@ -85,6 +47,7 @@ x86-efi-Fix-multiple-GOP-device-support.patch ### ### Core ### +base-cacheinfo-silence-DT-warnings.patch ### ### i2c diff --git a/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch b/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch deleted file mode 100644 index e2763086..00000000 --- a/kernel/kernel/files/patches/mageia/stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch +++ /dev/null @@ -1,35 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: WANG Cong -Date: Tue, 6 Oct 2015 17:23:47 -0700 -Subject: act_mirred: clear sender cpu before sending to tx - -From: WANG Cong - -[ Upstream commit d40496a56430eac0d330378816954619899fe303 ] - -Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") -the skb->sender_cpu needs to be cleared when moving from Rx -Tx, otherwise kernel could crash. - -Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") -Cc: Eric Dumazet -Cc: Jamal Hadi Salim -Signed-off-by: Cong Wang -Signed-off-by: Cong Wang -Acked-by: Eric Dumazet -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/sched/act_mirred.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/sched/act_mirred.c -+++ b/net/sched/act_mirred.c -@@ -168,6 +168,7 @@ static int tcf_mirred(struct sk_buff *sk - - skb2->skb_iif = skb->dev->ifindex; - skb2->dev = dev; -+ skb_sender_cpu_clear(skb2); - err = dev_queue_xmit(skb2); - - out: diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch deleted file mode 100644 index 943f5cd6..00000000 --- a/kernel/kernel/files/patches/mageia/stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch +++ /dev/null @@ -1,35 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Aaron Conole -Date: Sat, 26 Sep 2015 18:50:42 -0400 -Subject: af_unix: Convert the unix_sk macro to an inline function for type safety - -From: Aaron Conole - -[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ] - -As suggested by Eric Dumazet this change replaces the -#define with a static inline function to enjoy -complaints by the compiler when misusing the API. - -Signed-off-by: Aaron Conole -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - include/net/af_unix.h | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -63,7 +63,11 @@ struct unix_sock { - #define UNIX_GC_MAYBE_CYCLE 1 - struct socket_wq peer_wq; - }; --#define unix_sk(__sk) ((struct unix_sock *)__sk) -+ -+static inline struct unix_sock *unix_sk(struct sock *sk) -+{ -+ return (struct unix_sock *)sk; -+} - - #define peer_wait peer_wq.wait - diff --git a/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch b/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch deleted file mode 100644 index c7ed0119..00000000 --- a/kernel/kernel/files/patches/mageia/stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch +++ /dev/null @@ -1,60 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Aaron Conole -Date: Sat, 26 Sep 2015 18:50:43 -0400 -Subject: af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag - -From: Aaron Conole - -[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ] - -AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag -is set. - -This is referenced in kernel bugzilla #12323 @ -https://bugzilla.kernel.org/show_bug.cgi?id=12323 - -As described both in the BZ and lkml thread @ -http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an -AF_UNIX socket only reads a single skb, where the desired effect is -to return as much skb data has been queued, until hitting the recv -buffer size (whichever comes first). - -The modified MSG_PEEK path will now move to the next skb in the tree -and jump to the again: label, rather than following the natural loop -structure. This requires duplicating some of the loop head actions. - -This was tested using the python socketpair python code attached to -the bugzilla issue. - -Signed-off-by: Aaron Conole -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/unix/af_unix.c | 15 ++++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -2179,8 +2179,21 @@ unlock: - if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); - -- sk_peek_offset_fwd(sk, chunk); -+ if (skip) { -+ sk_peek_offset_fwd(sk, chunk); -+ skip -= chunk; -+ } - -+ if (UNIXCB(skb).fp) -+ break; -+ -+ last = skb; -+ last_len = skb->len; -+ unix_state_lock(sk); -+ skb = skb_peek_next(skb, &sk->sk_receive_queue); -+ if (skb) -+ goto again; -+ unix_state_unlock(sk); - break; - } - } while (size); diff --git a/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch b/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch deleted file mode 100644 index 3cdebeec..00000000 --- a/kernel/kernel/files/patches/mageia/stable-arm-ux500-simplify-secondary-cpu-boot.patch +++ /dev/null @@ -1,280 +0,0 @@ -From c00def71efd919e8ae835a25f4f4c80a4b2d36d3 Mon Sep 17 00:00:00 2001 -From: Linus Walleij -Date: Mon, 3 Aug 2015 09:26:52 +0200 -Subject: ARM: ux500: simplify secondary CPU boot - -From: Linus Walleij - -commit c00def71efd919e8ae835a25f4f4c80a4b2d36d3 upstream. - -This removes a lot of ancient cruft from the Ux500 SMP boot. -Instead of the pen grab/release, just point the ROM to -secondary_boot() and start the second CPU there, then send -the IPI. - -Use our own SMP enable method. This enables us to remove the -last static mapping and get both CPUs booting properly. - -Tested this and it just works. - -Signed-off-by: Linus Walleij -Signed-off-by: Olof Johansson -Signed-off-by: Kevin Hilman -Signed-off-by: Greg Kroah-Hartman - ---- - arch/arm/mach-ux500/Makefile | 2 - arch/arm/mach-ux500/cpu-db8500.c | 1 - arch/arm/mach-ux500/headsmp.S | 37 ---------- - arch/arm/mach-ux500/platsmp.c | 132 +++++++++++---------------------------- - arch/arm/mach-ux500/setup.h | 1 - 5 files changed, 40 insertions(+), 133 deletions(-) - ---- a/arch/arm/mach-ux500/Makefile -+++ b/arch/arm/mach-ux500/Makefile -@@ -7,7 +7,7 @@ obj-$(CONFIG_CACHE_L2X0) += cache-l2x0.o - obj-$(CONFIG_UX500_SOC_DB8500) += cpu-db8500.o - obj-$(CONFIG_MACH_MOP500) += board-mop500-regulators.o \ - board-mop500-audio.o --obj-$(CONFIG_SMP) += platsmp.o headsmp.o -+obj-$(CONFIG_SMP) += platsmp.o - obj-$(CONFIG_HOTPLUG_CPU) += hotplug.o - obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o - ---- a/arch/arm/mach-ux500/cpu-db8500.c -+++ b/arch/arm/mach-ux500/cpu-db8500.c -@@ -154,7 +154,6 @@ static const char * stericsson_dt_platfo - }; - - DT_MACHINE_START(U8500_DT, "ST-Ericsson Ux5x0 platform (Device Tree Support)") -- .smp = smp_ops(ux500_smp_ops), - .map_io = u8500_map_io, - .init_irq = ux500_init_irq, - /* we re-use nomadik timer here */ ---- a/arch/arm/mach-ux500/headsmp.S -+++ /dev/null -@@ -1,37 +0,0 @@ --/* -- * Copyright (c) 2009 ST-Ericsson -- * This file is based ARM Realview platform -- * Copyright (c) 2003 ARM Limited -- * All Rights Reserved -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License version 2 as -- * published by the Free Software Foundation. -- */ --#include --#include -- --/* -- * U8500 specific entry point for secondary CPUs. -- */ --ENTRY(u8500_secondary_startup) -- mrc p15, 0, r0, c0, c0, 5 -- and r0, r0, #15 -- adr r4, 1f -- ldmia r4, {r5, r6} -- sub r4, r4, r5 -- add r6, r6, r4 --pen: ldr r7, [r6] -- cmp r7, r0 -- bne pen -- -- /* -- * we've been released from the holding pen: secondary_stack -- * should now contain the SVC stack for this core -- */ -- b secondary_startup --ENDPROC(u8500_secondary_startup) -- -- .align 2 --1: .long . -- .long pen_release ---- a/arch/arm/mach-ux500/platsmp.c -+++ b/arch/arm/mach-ux500/platsmp.c -@@ -28,135 +28,81 @@ - #include "db8500-regs.h" - #include "id.h" - --static void __iomem *scu_base; --static void __iomem *backupram; -- --/* This is called from headsmp.S to wakeup the secondary core */ --extern void u8500_secondary_startup(void); -- --/* -- * Write pen_release in a way that is guaranteed to be visible to all -- * observers, irrespective of whether they're taking part in coherency -- * or not. This is necessary for the hotplug code to work reliably. -- */ --static void write_pen_release(int val) --{ -- pen_release = val; -- smp_wmb(); -- sync_cache_w(&pen_release); --} -- --static DEFINE_SPINLOCK(boot_lock); -- --static void ux500_secondary_init(unsigned int cpu) --{ -- /* -- * let the primary processor know we're out of the -- * pen, then head off into the C entry point -- */ -- write_pen_release(-1); -- -- /* -- * Synchronise with the boot thread. -- */ -- spin_lock(&boot_lock); -- spin_unlock(&boot_lock); --} -+/* Magic triggers in backup RAM */ -+#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 -+#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 - --static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) -+static void wakeup_secondary(void) - { -- unsigned long timeout; -- -- /* -- * set synchronisation state between this boot processor -- * and the secondary one -- */ -- spin_lock(&boot_lock); -- -- /* -- * The secondary processor is waiting to be released from -- * the holding pen - release it, then wait for it to flag -- * that it has been released by resetting pen_release. -- */ -- write_pen_release(cpu_logical_map(cpu)); -- -- arch_send_wakeup_ipi_mask(cpumask_of(cpu)); -+ struct device_node *np; -+ static void __iomem *backupram; - -- timeout = jiffies + (1 * HZ); -- while (time_before(jiffies, timeout)) { -- if (pen_release == -1) -- break; -+ np = of_find_compatible_node(NULL, NULL, "ste,dbx500-backupram"); -+ if (!np) { -+ pr_err("No backupram base address\n"); -+ return; -+ } -+ backupram = of_iomap(np, 0); -+ of_node_put(np); -+ if (!backupram) { -+ pr_err("No backupram remap\n"); -+ return; - } - - /* -- * now the secondary core is starting up let it run its -- * calibrations, then wait for it to finish -- */ -- spin_unlock(&boot_lock); -- -- return pen_release != -1 ? -ENOSYS : 0; --} -- --static void __init wakeup_secondary(void) --{ -- /* - * write the address of secondary startup into the backup ram register - * at offset 0x1FF4, then write the magic number 0xA1FEED01 to the - * backup ram register at offset 0x1FF0, which is what boot rom code -- * is waiting for. This would wake up the secondary core from WFE -+ * is waiting for. This will wake up the secondary core from WFE. - */ --#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4 -- __raw_writel(virt_to_phys(u8500_secondary_startup), -- backupram + UX500_CPU1_JUMPADDR_OFFSET); -- --#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0 -- __raw_writel(0xA1FEED01, -- backupram + UX500_CPU1_WAKEMAGIC_OFFSET); -+ writel(virt_to_phys(secondary_startup), -+ backupram + UX500_CPU1_JUMPADDR_OFFSET); -+ writel(0xA1FEED01, -+ backupram + UX500_CPU1_WAKEMAGIC_OFFSET); - - /* make sure write buffer is drained */ - mb(); -+ iounmap(backupram); - } - --/* -- * Initialise the CPU possible map early - this describes the CPUs -- * which may be present or become present in the system. -- */ --static void __init ux500_smp_init_cpus(void) -+static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) - { -- unsigned int i, ncores; - struct device_node *np; -+ static void __iomem *scu_base; -+ unsigned int ncores; -+ int i; - - np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-scu"); -+ if (!np) { -+ pr_err("No SCU base address\n"); -+ return; -+ } - scu_base = of_iomap(np, 0); - of_node_put(np); -- if (!scu_base) -+ if (!scu_base) { -+ pr_err("No SCU remap\n"); - return; -- backupram = ioremap(U8500_BACKUPRAM0_BASE, SZ_8K); -- ncores = scu_get_core_count(scu_base); -- -- /* sanity check */ -- if (ncores > nr_cpu_ids) { -- pr_warn("SMP: %u cores greater than maximum (%u), clipping\n", -- ncores, nr_cpu_ids); -- ncores = nr_cpu_ids; - } - -+ scu_enable(scu_base); -+ ncores = scu_get_core_count(scu_base); - for (i = 0; i < ncores; i++) - set_cpu_possible(i, true); -+ iounmap(scu_base); - } - --static void __init ux500_smp_prepare_cpus(unsigned int max_cpus) -+static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle) - { -- scu_enable(scu_base); - wakeup_secondary(); -+ arch_send_wakeup_ipi_mask(cpumask_of(cpu)); -+ return 0; - } - - struct smp_operations ux500_smp_ops __initdata = { -- .smp_init_cpus = ux500_smp_init_cpus, - .smp_prepare_cpus = ux500_smp_prepare_cpus, -- .smp_secondary_init = ux500_secondary_init, - .smp_boot_secondary = ux500_boot_secondary, - #ifdef CONFIG_HOTPLUG_CPU - .cpu_die = ux500_cpu_die, - #endif - }; -+CPU_METHOD_OF_DECLARE(ux500_smp, "ste,dbx500-smp", &ux500_smp_ops); ---- a/arch/arm/mach-ux500/setup.h -+++ b/arch/arm/mach-ux500/setup.h -@@ -26,7 +26,6 @@ extern struct device *ux500_soc_device_i - - extern void ux500_timer_init(void); - --extern struct smp_operations ux500_smp_ops; - extern void ux500_cpu_die(unsigned int cpu); - - #endif /* __ASM_ARCH_SETUP_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch b/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch deleted file mode 100644 index b25ef08a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch +++ /dev/null @@ -1,39 +0,0 @@ -From b6dd8e0719c0d2d01429639a11b7bc2677de240c Mon Sep 17 00:00:00 2001 -From: Will Deacon -Date: Thu, 8 Oct 2015 11:11:17 +0100 -Subject: arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 - -From: Will Deacon - -commit b6dd8e0719c0d2d01429639a11b7bc2677de240c upstream. - -Commit df057cc7b4fa ("arm64: errata: add module build workaround for -erratum #843419") sets CFLAGS_MODULE to ensure that the large memory -model is used by the compiler when building kernel modules. - -However, CFLAGS_MODULE is an environment variable and intended to be -overridden on the command line, which appears to be the case with the -Ubuntu kernel packaging system, so use KBUILD_CFLAGS_MODULE instead. - -Cc: Ard Biesheuvel -Fixes: df057cc7b4fa ("arm64: errata: add module build workaround for erratum #843419") -Reported-by: Dann Frazier -Tested-by: Dann Frazier -Signed-off-by: Will Deacon -Signed-off-by: Greg Kroah-Hartman - ---- - arch/arm64/Makefile | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/arch/arm64/Makefile -+++ b/arch/arm64/Makefile -@@ -31,7 +31,7 @@ endif - CHECKFLAGS += -D__aarch64__ - - ifeq ($(CONFIG_ARM64_ERRATUM_843419), y) --CFLAGS_MODULE += -mcmodel=large -+KBUILD_CFLAGS_MODULE += -mcmodel=large - endif - - # Default value diff --git a/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch b/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch new file mode 100644 index 00000000..16272ae0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch @@ -0,0 +1,31 @@ +From 029cd0370241641eb70235d205aa0b90c84dce44 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Thu, 24 Sep 2015 16:59:46 +0200 +Subject: ath9k: declare required extra tx headroom + +From: Felix Fietkau + +commit 029cd0370241641eb70235d205aa0b90c84dce44 upstream. + +ath9k inserts padding between the 802.11 header and the data area (to +align it). Since it didn't declare this extra required headroom, this +led to some nasty issues like randomly dropped packets in some setups. + +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ath/ath9k/init.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/ath/ath9k/init.c ++++ b/drivers/net/wireless/ath/ath9k/init.c +@@ -874,6 +874,7 @@ static void ath9k_set_hw_capab(struct at + hw->max_rate_tries = 10; + hw->sta_data_size = sizeof(struct ath_node); + hw->vif_data_size = sizeof(struct ath_vif); ++ hw->extra_tx_headroom = 4; + + hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1; + hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1; diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch b/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch deleted file mode 100644 index 1981b7c0..00000000 --- a/kernel/kernel/files/patches/mageia/stable-bpf-clear-sender_cpu-before-xmit.patch +++ /dev/null @@ -1,31 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Alexei Starovoitov -Date: Tue, 6 Oct 2015 20:46:07 -0700 -Subject: bpf: clear sender_cpu before xmit - -From: Alexei Starovoitov - -[ Upstream commit 6bf0577374cfb6c2301dbf4934a4f23ad3d72763 ] - -Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") -the skb->sender_cpu needs to be cleared before xmit. - -Fixes: 3896d655f4d4 ("bpf: introduce bpf_clone_redirect() helper") -Signed-off-by: Alexei Starovoitov -Acked-by: Daniel Borkmann -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/core/filter.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -1412,6 +1412,7 @@ static u64 bpf_clone_redirect(u64 r1, u6 - return dev_forward_skb(dev, skb2); - - skb2->dev = dev; -+ skb_sender_cpu_clear(skb2); - return dev_queue_xmit(skb2); - } - diff --git a/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch b/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch deleted file mode 100644 index 0a66e3b1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch +++ /dev/null @@ -1,65 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Daniel Borkmann -Date: Fri, 2 Oct 2015 12:06:03 +0200 -Subject: bpf: fix panic in SO_GET_FILTER with native ebpf programs - -From: Daniel Borkmann - -[ Upstream commit 93d08b6966cf730ea669d4d98f43627597077153 ] - -When sockets have a native eBPF program attached through -setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to -dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...), -the following panic appears: - - [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null) - [49904.178762] IP: [] sk_get_filter+0x39/0x90 - [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0 - [49904.185196] Oops: 0000 [#1] SMP - [...] - [49904.224677] Call Trace: - [49904.226090] [] sock_getsockopt+0x319/0x740 - [49904.227535] [] ? sock_has_perm+0x63/0x70 - [49904.228953] [] ? release_sock+0x108/0x150 - [49904.230380] [] ? selinux_socket_getsockopt+0x23/0x30 - [49904.231788] [] SyS_getsockopt+0xa6/0xc0 - [49904.233267] [] entry_SYSCALL_64_fastpath+0x12/0x71 - -The underlying issue is the very same as in commit b382c0865600 -("sock, diag: fix panic in sock_diag_put_filterinfo"), that is, -native eBPF programs don't store an original program since this -is only needed in cBPF ones. - -However, sk_get_filter() wasn't updated to test for this at the -time when eBPF could be attached. Just throw an error to the user -to indicate that eBPF cannot be dumped over this interface. -That way, it can also be known that a program _is_ attached (as -opposed to just return 0), and a different (future) method needs -to be consulted for a dump. - -Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets") -Signed-off-by: Daniel Borkmann -Acked-by: Alexei Starovoitov -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/core/filter.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -1701,9 +1701,13 @@ int sk_get_filter(struct sock *sk, struc - goto out; - - /* We're copying the filter that has been originally attached, -- * so no conversion/decode needed anymore. -+ * so no conversion/decode needed anymore. eBPF programs that -+ * have no original program cannot be dumped through this. - */ -+ ret = -EACCES; - fprog = filter->prog->orig_prog; -+ if (!fprog) -+ goto out; - - ret = fprog->len; - if (!len) diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch deleted file mode 100644 index 44800a6d..00000000 --- a/kernel/kernel/files/patches/mageia/stable-btrfs-check-unsupported-filters-in-balance-arguments.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 8eb934591f8bf584969454a658f629cd06e59f3a Mon Sep 17 00:00:00 2001 -From: David Sterba -Date: Mon, 12 Oct 2015 16:55:54 +0200 -Subject: btrfs: check unsupported filters in balance arguments - -From: David Sterba - -commit 8eb934591f8bf584969454a658f629cd06e59f3a upstream. - -We don't verify that all the balance filter arguments supplemented by -the flags are actually known to the kernel. Thus we let it silently pass -and do nothing. - -At the moment this means only the 'limit' filter, but we're going to add -a few more soon so it's better to have that fixed. Also in older stable -kernels so that it works with newer userspace tools. - -Signed-off-by: David Sterba -Signed-off-by: Chris Mason -Signed-off-by: Greg Kroah-Hartman - ---- - fs/btrfs/ioctl.c | 5 +++++ - fs/btrfs/volumes.h | 8 ++++++++ - 2 files changed, 13 insertions(+) - ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -4647,6 +4647,11 @@ locked: - bctl->flags |= BTRFS_BALANCE_TYPE_MASK; - } - -+ if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) { -+ ret = -EINVAL; -+ goto out_bargs; -+ } -+ - do_balance: - /* - * Ownership of bctl and mutually_exclusive_operation_running ---- a/fs/btrfs/volumes.h -+++ b/fs/btrfs/volumes.h -@@ -376,6 +376,14 @@ struct map_lookup { - #define BTRFS_BALANCE_ARGS_VRANGE (1ULL << 4) - #define BTRFS_BALANCE_ARGS_LIMIT (1ULL << 5) - -+#define BTRFS_BALANCE_ARGS_MASK \ -+ (BTRFS_BALANCE_ARGS_PROFILES | \ -+ BTRFS_BALANCE_ARGS_USAGE | \ -+ BTRFS_BALANCE_ARGS_DEVID | \ -+ BTRFS_BALANCE_ARGS_DRANGE | \ -+ BTRFS_BALANCE_ARGS_VRANGE | \ -+ BTRFS_BALANCE_ARGS_LIMIT) -+ - /* - * Profile changing flags. When SOFT is set we won't relocate chunk if - * it already has the target profile (even though it may be diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch deleted file mode 100644 index 27bec066..00000000 --- a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-use-after-free-iterating-extrefs.patch +++ /dev/null @@ -1,61 +0,0 @@ -From dc6c5fb3b514221f2e9d21ee626a9d95d3418dff Mon Sep 17 00:00:00 2001 -From: Chris Mason -Date: Tue, 13 Oct 2015 14:06:48 -0400 -Subject: btrfs: fix use after free iterating extrefs - -From: Chris Mason - -commit dc6c5fb3b514221f2e9d21ee626a9d95d3418dff upstream. - -The code for btrfs inode-resolve has never worked properly for -files with enough hard links to trigger extrefs. It was trying to -get the leaf out of a path after freeing the path: - - btrfs_release_path(path); - leaf = path->nodes[0]; - item_size = btrfs_item_size_nr(leaf, slot); - -The fix here is to use the extent buffer we cloned just a little higher -up to avoid deadlocks caused by using the leaf in the path. - -Signed-off-by: Chris Mason -cc: Mark Fasheh -Reviewed-by: Filipe Manana -Reviewed-by: Mark Fasheh -Signed-off-by: Greg Kroah-Hartman - ---- - fs/btrfs/backref.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - ---- a/fs/btrfs/backref.c -+++ b/fs/btrfs/backref.c -@@ -1809,7 +1809,6 @@ static int iterate_inode_extrefs(u64 inu - int found = 0; - struct extent_buffer *eb; - struct btrfs_inode_extref *extref; -- struct extent_buffer *leaf; - u32 item_size; - u32 cur_offset; - unsigned long ptr; -@@ -1837,9 +1836,8 @@ static int iterate_inode_extrefs(u64 inu - btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK); - btrfs_release_path(path); - -- leaf = path->nodes[0]; -- item_size = btrfs_item_size_nr(leaf, slot); -- ptr = btrfs_item_ptr_offset(leaf, slot); -+ item_size = btrfs_item_size_nr(eb, slot); -+ ptr = btrfs_item_ptr_offset(eb, slot); - cur_offset = 0; - - while (cur_offset < item_size) { -@@ -1853,7 +1851,7 @@ static int iterate_inode_extrefs(u64 inu - if (ret) - break; - -- cur_offset += btrfs_inode_extref_name_len(leaf, extref); -+ cur_offset += btrfs_inode_extref_name_len(eb, extref); - cur_offset += sizeof(*extref); - } - btrfs_tree_read_unlock_blocking(eb); diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch b/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch deleted file mode 100644 index a869f8d8..00000000 --- a/kernel/kernel/files/patches/mageia/stable-crypto-ahash-ensure-statesize-is-non-zero.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 8996eafdcbad149ac0f772fb1649fbb75c482a6a Mon Sep 17 00:00:00 2001 -From: Russell King -Date: Fri, 9 Oct 2015 20:43:33 +0100 -Subject: crypto: ahash - ensure statesize is non-zero - -From: Russell King - -commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream. - -Unlike shash algorithms, ahash drivers must implement export -and import as their descriptors may contain hardware state and -cannot be exported as is. Unfortunately some ahash drivers did -not provide them and end up causing crashes with algif_hash. - -This patch adds a check to prevent these drivers from registering -ahash algorithms until they are fixed. - -Signed-off-by: Russell King -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- - crypto/ahash.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -544,7 +544,8 @@ static int ahash_prepare_alg(struct ahas - struct crypto_alg *base = &alg->halg.base; - - if (alg->halg.digestsize > PAGE_SIZE / 8 || -- alg->halg.statesize > PAGE_SIZE / 8) -+ alg->halg.statesize > PAGE_SIZE / 8 || -+ alg->halg.statesize == 0) - return -EINVAL; - - base->cra_type = &crypto_ahash_type; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch b/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch deleted file mode 100644 index 62fd0a5b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 92b279070dd6c94265db32748bbeb5b583588de9 Mon Sep 17 00:00:00 2001 -From: Ben Hutchings -Date: Tue, 6 Oct 2015 12:31:33 +0100 -Subject: crypto: camellia_aesni_avx - Fix CPU feature checks -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Ben Hutchings - -commit 92b279070dd6c94265db32748bbeb5b583588de9 upstream. - -We need to explicitly check the AVX and AES CPU features, as we can't -infer them from the related XSAVE feature flags. For example, the -Core i3 2310M passes the XSAVE feature test but does not implement -AES-NI. - -Reported-and-tested-by: Stéphane Glondu -References: https://bugs.debian.org/800934 -Fixes: ce4f5f9b65ae ("x86/fpu, crypto x86/camellia_aesni_avx: Simplify...") -Signed-off-by: Ben Hutchings -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/crypto/camellia_aesni_avx_glue.c | 5 +++++ - 1 file changed, 5 insertions(+) - ---- a/arch/x86/crypto/camellia_aesni_avx_glue.c -+++ b/arch/x86/crypto/camellia_aesni_avx_glue.c -@@ -554,6 +554,11 @@ static int __init camellia_aesni_init(vo - { - const char *feature_name; - -+ if (!cpu_has_avx || !cpu_has_aes || !cpu_has_osxsave) { -+ pr_info("AVX or AES-NI instructions are not detected.\n"); -+ return -ENODEV; -+ } -+ - if (!cpu_has_xfeatures(XSTATE_SSE | XSTATE_YMM, &feature_name)) { - pr_info("CPU feature '%s' is not supported.\n", feature_name); - return -ENODEV; diff --git a/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch b/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch deleted file mode 100644 index da4afaa8..00000000 --- a/kernel/kernel/files/patches/mageia/stable-crypto-sparc-initialize-blkcipher.ivsize.patch +++ /dev/null @@ -1,68 +0,0 @@ -From a66d7f724a96d6fd279bfbd2ee488def6b081bea Mon Sep 17 00:00:00 2001 -From: Dave Kleikamp -Date: Mon, 5 Oct 2015 10:08:51 -0500 -Subject: crypto: sparc - initialize blkcipher.ivsize - -From: Dave Kleikamp - -commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream. - -Some of the crypto algorithms write to the initialization vector, -but no space has been allocated for it. This clobbers adjacent memory. - -Signed-off-by: Dave Kleikamp -Signed-off-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- - arch/sparc/crypto/aes_glue.c | 2 ++ - arch/sparc/crypto/camellia_glue.c | 1 + - arch/sparc/crypto/des_glue.c | 2 ++ - 3 files changed, 5 insertions(+) - ---- a/arch/sparc/crypto/aes_glue.c -+++ b/arch/sparc/crypto/aes_glue.c -@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = AES_MIN_KEY_SIZE, - .max_keysize = AES_MAX_KEY_SIZE, -+ .ivsize = AES_BLOCK_SIZE, - .setkey = aes_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, -@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = AES_MIN_KEY_SIZE, - .max_keysize = AES_MAX_KEY_SIZE, -+ .ivsize = AES_BLOCK_SIZE, - .setkey = aes_set_key, - .encrypt = ctr_crypt, - .decrypt = ctr_crypt, ---- a/arch/sparc/crypto/camellia_glue.c -+++ b/arch/sparc/crypto/camellia_glue.c -@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = CAMELLIA_MIN_KEY_SIZE, - .max_keysize = CAMELLIA_MAX_KEY_SIZE, -+ .ivsize = CAMELLIA_BLOCK_SIZE, - .setkey = camellia_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, ---- a/arch/sparc/crypto/des_glue.c -+++ b/arch/sparc/crypto/des_glue.c -@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = DES_KEY_SIZE, - .max_keysize = DES_KEY_SIZE, -+ .ivsize = DES_BLOCK_SIZE, - .setkey = des_set_key, - .encrypt = cbc_encrypt, - .decrypt = cbc_decrypt, -@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { { - .blkcipher = { - .min_keysize = DES3_EDE_KEY_SIZE, - .max_keysize = DES3_EDE_KEY_SIZE, -+ .ivsize = DES3_EDE_BLOCK_SIZE, - .setkey = des3_ede_set_key, - .encrypt = cbc3_encrypt, - .decrypt = cbc3_decrypt, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch b/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch deleted file mode 100644 index fd96ce12..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-fix-locking-for-sysfs-dpms-file.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 621bd0f6982badd6483acb191eb7b6226a578328 Mon Sep 17 00:00:00 2001 -From: Daniel Vetter -Date: Tue, 29 Sep 2015 09:56:53 +0200 -Subject: drm: Fix locking for sysfs dpms file - -From: Daniel Vetter - -commit 621bd0f6982badd6483acb191eb7b6226a578328 upstream. - -With atomic drivers we need to make sure that (at least in general) -property reads hold the right locks. But the legacy dpms property is -special and can be read locklessly. Since userspace loves to just -randomly look at that all the time (like with "status") do that. - -To make it clear that we play tricks use the READ_ONCE compiler -barrier (and also for paranoia). - -Note that there's not really anything bad going on since even with the -new atomic paths we eventually end up not chasing any pointers (and -hence possibly freed memory and other fun stuff). The locking WARNING -has been added in - -commit 88a48e297b3a3bac6022c03babfb038f1a886cea -Author: Rob Clark -Date: Thu Dec 18 16:01:50 2014 -0500 - - drm: add atomic properties - -but since drivers are converting not everyone will have seen this from -the start. - -Jens reported this and submitted a patch to just grab the -mode_config.connection_mutex, but we can do a bit better. - -v2: Remove unused variables I failed to git add for real. - -Reference: http://mid.gmane.org/20150928194822.GA3930@kernel.dk -Reported-by: Jens Axboe -Tested-by: Jens Axboe -Cc: Rob Clark -Signed-off-by: Daniel Vetter -Signed-off-by: Dave Airlie -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/drm_sysfs.c | 12 +++--------- - 1 file changed, 3 insertions(+), 9 deletions(-) - ---- a/drivers/gpu/drm/drm_sysfs.c -+++ b/drivers/gpu/drm/drm_sysfs.c -@@ -235,18 +235,12 @@ static ssize_t dpms_show(struct device * - char *buf) - { - struct drm_connector *connector = to_drm_connector(device); -- struct drm_device *dev = connector->dev; -- uint64_t dpms_status; -- int ret; -+ int dpms; - -- ret = drm_object_property_get_value(&connector->base, -- dev->mode_config.dpms_property, -- &dpms_status); -- if (ret) -- return 0; -+ dpms = READ_ONCE(connector->dpms); - - return snprintf(buf, PAGE_SIZE, "%s\n", -- drm_get_dpms_name((int)dpms_status)); -+ drm_get_dpms_name(dpms)); - } - - static ssize_t enabled_show(struct device *device, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch b/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch deleted file mode 100644 index b718470d..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch +++ /dev/null @@ -1,65 +0,0 @@ -From f231976c2e8964ceaa9250e57d27c35ff03825c2 Mon Sep 17 00:00:00 2001 -From: Ben Skeggs -Date: Fri, 2 Oct 2015 14:03:19 +1000 -Subject: drm/nouveau/fbcon: take runpm reference when userspace has an open fd - -From: Ben Skeggs - -commit f231976c2e8964ceaa9250e57d27c35ff03825c2 upstream. - -We need to do this in order to prevent accesses to the device while it's -powered down. Userspace may have an mmap of the fb, and there's no good -way (that I know of) to prevent it from touching the device otherwise. - -This fixes some nasty races between runpm and plymouth on some systems, -which result in the GPU getting very upset and hanging the boot. - -Signed-off-by: Ben Skeggs -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/nouveau/nouveau_fbcon.c | 24 ++++++++++++++++++++++++ - 1 file changed, 24 insertions(+) - ---- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c -+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c -@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info) - return 0; - } - -+static int -+nouveau_fbcon_open(struct fb_info *info, int user) -+{ -+ struct nouveau_fbdev *fbcon = info->par; -+ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); -+ int ret = pm_runtime_get_sync(drm->dev->dev); -+ if (ret < 0 && ret != -EACCES) -+ return ret; -+ return 0; -+} -+ -+static int -+nouveau_fbcon_release(struct fb_info *info, int user) -+{ -+ struct nouveau_fbdev *fbcon = info->par; -+ struct nouveau_drm *drm = nouveau_drm(fbcon->dev); -+ pm_runtime_put(drm->dev->dev); -+ return 0; -+} -+ - static struct fb_ops nouveau_fbcon_ops = { - .owner = THIS_MODULE, -+ .fb_open = nouveau_fbcon_open, -+ .fb_release = nouveau_fbcon_release, - .fb_check_var = drm_fb_helper_check_var, - .fb_set_par = drm_fb_helper_set_par, - .fb_fillrect = nouveau_fbcon_fillrect, -@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = - - static struct fb_ops nouveau_fbcon_sw_ops = { - .owner = THIS_MODULE, -+ .fb_open = nouveau_fbcon_open, -+ .fb_release = nouveau_fbcon_release, - .fb_check_var = drm_fb_helper_check_var, - .fb_set_par = drm_fb_helper_set_par, - .fb_fillrect = cfb_fillrect, diff --git a/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch b/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch deleted file mode 100644 index 35aaa4a7..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 60906529bec506a4bde93f04eb5e7a9dd9c42a3b Mon Sep 17 00:00:00 2001 -From: Gerd Hoffmann -Date: Mon, 5 Oct 2015 12:20:26 +0200 -Subject: drm/qxl: fix framebuffer dirty rectangle tracking. - -From: Gerd Hoffmann - -commit 60906529bec506a4bde93f04eb5e7a9dd9c42a3b upstream. - -Commit "c0fe07a drm/qxl: rewrite framebuffer support" has a bug in the -dirty rectangle tracking: Instead of ignoring an empty dirty rectangle -when adding a new dirty region the dirty region gets extended to the -upper left corner. Fix it. - -Signed-off-by: Gerd Hoffmann -Signed-off-by: Dave Airlie -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/qxl/qxl_fb.c | 19 +++++++++++-------- - 1 file changed, 11 insertions(+), 8 deletions(-) - ---- a/drivers/gpu/drm/qxl/qxl_fb.c -+++ b/drivers/gpu/drm/qxl/qxl_fb.c -@@ -144,14 +144,17 @@ static void qxl_dirty_update(struct qxl_ - - spin_lock_irqsave(&qfbdev->dirty.lock, flags); - -- if (qfbdev->dirty.y1 < y) -- y = qfbdev->dirty.y1; -- if (qfbdev->dirty.y2 > y2) -- y2 = qfbdev->dirty.y2; -- if (qfbdev->dirty.x1 < x) -- x = qfbdev->dirty.x1; -- if (qfbdev->dirty.x2 > x2) -- x2 = qfbdev->dirty.x2; -+ if ((qfbdev->dirty.y2 - qfbdev->dirty.y1) && -+ (qfbdev->dirty.x2 - qfbdev->dirty.x1)) { -+ if (qfbdev->dirty.y1 < y) -+ y = qfbdev->dirty.y1; -+ if (qfbdev->dirty.y2 > y2) -+ y2 = qfbdev->dirty.y2; -+ if (qfbdev->dirty.x1 < x) -+ x = qfbdev->dirty.x1; -+ if (qfbdev->dirty.x2 > x2) -+ x2 = qfbdev->dirty.x2; -+ } - - qfbdev->dirty.x1 = x; - qfbdev->dirty.x2 = x2; diff --git a/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch b/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch deleted file mode 100644 index 766c3c9a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch +++ /dev/null @@ -1,33 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Joe Perches -Date: Wed, 14 Oct 2015 01:09:40 -0700 -Subject: ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings - -From: Joe Perches - -[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ] - -It seems that kernel memory can leak into userspace by a -kmalloc, ethtool_get_strings, then copy_to_user sequence. - -Avoid this by using kcalloc to zero fill the copied buffer. - -Signed-off-by: Joe Perches -Acked-by: Ben Hutchings -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/core/ethtool.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct ne - - gstrings.len = ret; - -- data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER); -+ data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER); - if (!data) - return -ENOMEM; - diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch deleted file mode 100644 index 04b514ff..00000000 --- a/kernel/kernel/files/patches/mageia/stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 Mon Sep 17 00:00:00 2001 -From: Mika Westerberg -Date: Thu, 24 Sep 2015 12:06:54 +0300 -Subject: i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 - -From: Mika Westerberg - -commit 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 upstream. - -ACPI SSCN/FMCN methods were originally added because then the platform can -provide the most accurate HCNT/LCNT values to the driver. However, this -seems not to be true for Dell Inspiron 7348 where using these causes the -touchpad to fail in boot: - - i2c_hid i2c-DLL0675:00: failed to retrieve report from device. - i2c_designware INT3433:00: i2c_dw_handle_tx_abort: lost arbitration - i2c_hid i2c-DLL0675:00: failed to retrieve report from device. - i2c_designware INT3433:00: controller timed out - -The values received from ACPI are (in fast mode): - - HCNT: 72 - LCNT: 160 - -this translates to following timings (input clock is 100MHz on Broadwell): - - tHIGH: 720 ns (spec min 600 ns) - tLOW: 1600 ns (spec min 1300 ns) - Bus period: 2920 ns (assuming 300 ns tf and tr) - Bus speed: 342.5 kHz - -Both tHIGH and tLOW are within the I2C specification. - -The calculated values when ACPI parameters are not used are (in fast mode): - - HCNT: 87 - LCNT: 159 - -which translates to: - - tHIGH: 870 ns (spec min 600 ns) - tLOW: 1590 ns (spec min 1300 ns) - Bus period 3060 ns (assuming 300 ns tf and tr) - Bus speed 326.8 kHz - -These values are also within the I2C specification. - -Since both ACPI and calculated values meet the I2C specification timing -requirements it is hard to say why the touchpad does not function properly -with the ACPI values except that the bus speed is higher in this case (but -still well below the max 400kHz). - -Solve this by adding DMI quirk to the driver that disables using ACPI -parameters on this particulare machine. - -Reported-by: Pavel Roskin -Signed-off-by: Mika Westerberg -Tested-by: Pavel Roskin -Signed-off-by: Wolfram Sang -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/i2c/busses/i2c-designware-platdrv.c | 20 ++++++++++++++++++++ - 1 file changed, 20 insertions(+) - ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -24,6 +24,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struc - } - - #ifdef CONFIG_ACPI -+/* -+ * The HCNT/LCNT information coming from ACPI should be the most accurate -+ * for given platform. However, some systems get it wrong. On such systems -+ * we get better results by calculating those based on the input clock. -+ */ -+static const struct dmi_system_id dw_i2c_no_acpi_params[] = { -+ { -+ .ident = "Dell Inspiron 7348", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"), -+ }, -+ }, -+ { } -+}; -+ - static void dw_i2c_acpi_params(struct platform_device *pdev, char method[], - u16 *hcnt, u16 *lcnt, u32 *sda_hold) - { -@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct pl - acpi_handle handle = ACPI_HANDLE(&pdev->dev); - union acpi_object *obj; - -+ if (dmi_check_system(dw_i2c_no_acpi_params)) -+ return; -+ - if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf))) - return; - diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch deleted file mode 100644 index 2e6bb173..00000000 --- a/kernel/kernel/files/patches/mageia/stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 36d48fb5766aee9717e429f772046696b215282d Mon Sep 17 00:00:00 2001 -From: Wolfram Sang -Date: Fri, 9 Oct 2015 10:39:24 +0100 -Subject: i2c: designware-platdrv: enable RuntimePM before registering to the core - -From: Wolfram Sang - -commit 36d48fb5766aee9717e429f772046696b215282d upstream. - -The core may register clients attached to this master which may use -funtionality from the master. So, RuntimePM must be enabled before, otherwise -this will fail. - -Signed-off-by: Wolfram Sang -Signed-off-by: Wolfram Sang -Acked-by: Mika Westerberg -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/i2c/busses/i2c-designware-platdrv.c | 13 +++++++------ - 1 file changed, 7 insertions(+), 6 deletions(-) - ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -273,12 +273,6 @@ static int dw_i2c_probe(struct platform_ - adap->dev.parent = &pdev->dev; - adap->dev.of_node = pdev->dev.of_node; - -- r = i2c_add_numbered_adapter(adap); -- if (r) { -- dev_err(&pdev->dev, "failure adding adapter\n"); -- return r; -- } -- - if (dev->pm_runtime_disabled) { - pm_runtime_forbid(&pdev->dev); - } else { -@@ -288,6 +282,13 @@ static int dw_i2c_probe(struct platform_ - pm_runtime_enable(&pdev->dev); - } - -+ r = i2c_add_numbered_adapter(adap); -+ if (r) { -+ dev_err(&pdev->dev, "failure adding adapter\n"); -+ pm_runtime_disable(&pdev->dev); -+ return r; -+ } -+ - return 0; - } - diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch deleted file mode 100644 index ef2da749..00000000 --- a/kernel/kernel/files/patches/mageia/stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 4f7effddf4549d57114289f273710f077c4c330a Mon Sep 17 00:00:00 2001 -From: Wolfram Sang -Date: Fri, 9 Oct 2015 10:39:25 +0100 -Subject: i2c: rcar: enable RuntimePM before registering to the core - -From: Wolfram Sang - -commit 4f7effddf4549d57114289f273710f077c4c330a upstream. - -The core may register clients attached to this master which may use -funtionality from the master. So, RuntimePM must be enabled before, otherwise -this will fail. While here, move drvdata, too. - -Reported-by: Geert Uytterhoeven -Signed-off-by: Wolfram Sang -Signed-off-by: Wolfram Sang -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/i2c/busses/i2c-rcar.c | 7 ++++--- - 1 file changed, 4 insertions(+), 3 deletions(-) - ---- a/drivers/i2c/busses/i2c-rcar.c -+++ b/drivers/i2c/busses/i2c-rcar.c -@@ -690,15 +690,16 @@ static int rcar_i2c_probe(struct platfor - return ret; - } - -+ pm_runtime_enable(dev); -+ platform_set_drvdata(pdev, priv); -+ - ret = i2c_add_numbered_adapter(adap); - if (ret < 0) { - dev_err(dev, "reg adap failed: %d\n", ret); -+ pm_runtime_disable(dev); - return ret; - } - -- pm_runtime_enable(dev); -- platform_set_drvdata(pdev, priv); -- - dev_info(dev, "probed\n"); - - return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch b/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch deleted file mode 100644 index dcd4dfab..00000000 --- a/kernel/kernel/files/patches/mageia/stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch +++ /dev/null @@ -1,48 +0,0 @@ -From eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 Mon Sep 17 00:00:00 2001 -From: Wolfram Sang -Date: Sat, 10 Oct 2015 08:24:23 +0100 -Subject: i2c: s3c2410: enable RuntimePM before registering to the core - -From: Wolfram Sang - -commit eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 upstream. - -The core may register clients attached to this master which may use -funtionality from the master. So, RuntimePM must be enabled before, otherwise -this will fail. While here, move drvdata, too. - -Signed-off-by: Wolfram Sang -Tested-by: Krzysztof Kozlowski -Acked-by: Kukjin Kim -Signed-off-by: Wolfram Sang -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/i2c/busses/i2c-s3c2410.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - ---- a/drivers/i2c/busses/i2c-s3c2410.c -+++ b/drivers/i2c/busses/i2c-s3c2410.c -@@ -1243,17 +1243,19 @@ static int s3c24xx_i2c_probe(struct plat - i2c->adap.nr = i2c->pdata->bus_num; - i2c->adap.dev.of_node = pdev->dev.of_node; - -+ platform_set_drvdata(pdev, i2c); -+ -+ pm_runtime_enable(&pdev->dev); -+ - ret = i2c_add_numbered_adapter(&i2c->adap); - if (ret < 0) { - dev_err(&pdev->dev, "failed to add bus to i2c core\n"); -+ pm_runtime_disable(&pdev->dev); - s3c24xx_i2c_deregister_cpufreq(i2c); - clk_unprepare(i2c->clk); - return ret; - } - -- platform_set_drvdata(pdev, i2c); -- -- pm_runtime_enable(&pdev->dev); - pm_runtime_enable(&i2c->adap.dev); - - dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev)); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch deleted file mode 100644 index 7c98de1b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-inet-fix-race-in-reqsk_queue_unlink.patch +++ /dev/null @@ -1,64 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Eric Dumazet -Date: Thu, 1 Oct 2015 05:39:26 -0700 -Subject: inet: fix race in reqsk_queue_unlink() - -From: Eric Dumazet - -[ Upstream commit 2306c704ce280c97a60d1f45333b822b40281dea ] - -reqsk_timer_handler() tests if icsk_accept_queue.listen_opt -is NULL at its beginning. - -By the time it calls inet_csk_reqsk_queue_drop() and -reqsk_queue_unlink(), listener might have been closed and -inet_csk_listen_stop() had called reqsk_queue_yank_acceptq() -which sets icsk_accept_queue.listen_opt to NULL - -We therefore need to correctly check listen_opt being NULL -after holding syn_wait_lock for proper synchronization. - -Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") -Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()") -Signed-off-by: Eric Dumazet -Cc: Yuchung Cheng -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/inet_connection_sock.c | 19 ++++++++++--------- - 1 file changed, 10 insertions(+), 9 deletions(-) - ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack); - static bool reqsk_queue_unlink(struct request_sock_queue *queue, - struct request_sock *req) - { -- struct listen_sock *lopt = queue->listen_opt; - struct request_sock **prev; -+ struct listen_sock *lopt; - bool found = false; - - spin_lock(&queue->syn_wait_lock); -- -- for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; -- prev = &(*prev)->dl_next) { -- if (*prev == req) { -- *prev = req->dl_next; -- found = true; -- break; -+ lopt = queue->listen_opt; -+ if (lopt) { -+ for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL; -+ prev = &(*prev)->dl_next) { -+ if (*prev == req) { -+ *prev = req->dl_next; -+ found = true; -+ break; -+ } - } - } -- - spin_unlock(&queue->syn_wait_lock); - if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer)) - reqsk_put(req); diff --git a/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch b/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch deleted file mode 100644 index 840bdaf1..00000000 --- a/kernel/kernel/files/patches/mageia/stable-inet-fix-races-in-reqsk_queue_hash_req.patch +++ /dev/null @@ -1,52 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Eric Dumazet -Date: Sat, 19 Sep 2015 09:48:04 -0700 -Subject: inet: fix races in reqsk_queue_hash_req() - -From: Eric Dumazet - -[ Upstream commit 29c6852602e259d2c1882f320b29d5c3fec0de04 ] - -Before allowing lockless LISTEN processing, we need to make -sure to arm the SYN_RECV timer before the req socket is visible -in hash tables. - -Also, req->rsk_hash should be written before we set rsk_refcnt -to a non zero value. - -Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") -Signed-off-by: Eric Dumazet -Cc: Ying Cai -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/inet_connection_sock.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request - req->num_timeout = 0; - req->sk = NULL; - -+ setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); -+ mod_timer_pinned(&req->rsk_timer, jiffies + timeout); -+ req->rsk_hash = hash; -+ - /* before letting lookups find us, make sure all req fields - * are committed to memory and refcnt initialized. - */ - smp_wmb(); - atomic_set(&req->rsk_refcnt, 2); -- setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); -- req->rsk_hash = hash; - - spin_lock(&queue->syn_wait_lock); - req->dl_next = lopt->syn_table[hash]; - lopt->syn_table[hash] = req; - spin_unlock(&queue->syn_wait_lock); -- -- mod_timer_pinned(&req->rsk_timer, jiffies + timeout); - } - EXPORT_SYMBOL(reqsk_queue_hash_req); - diff --git a/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch deleted file mode 100644 index 675967a5..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch +++ /dev/null @@ -1,72 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: "Eric W. Biederman" -Date: Mon, 12 Oct 2015 11:02:08 -0500 -Subject: ipv6: Don't call with rt6_uncached_list_flush_dev - -From: "Eric W. Biederman" - -[ Upstream commit e332bc67cf5e5e5b71a1aec9750d0791aac65183 ] - -As originally written rt6_uncached_list_flush_dev makes no sense when -called with dev == NULL as it attempts to flush all uncached routes -regardless of network namespace when dev == NULL. Which is simply -incorrect behavior. - -Furthermore at the point rt6_ifdown is called with dev == NULL no more -network devices exist in the network namespace so even if the code in -rt6_uncached_list_flush_dev were to attempt something sensible it -would be meaningless. - -Therefore remove support in rt6_uncached_list_flush_dev for handling -network devices where dev == NULL, and only call rt6_uncached_list_flush_dev - when rt6_ifdown is called with a network device. - -Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister") -Signed-off-by: "Eric W. Biederman" -Reviewed-by: Martin KaFai Lau -Tested-by: Martin KaFai Lau -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv6/route.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -139,6 +139,9 @@ static void rt6_uncached_list_flush_dev( - struct net_device *loopback_dev = net->loopback_dev; - int cpu; - -+ if (dev == loopback_dev) -+ return; -+ - for_each_possible_cpu(cpu) { - struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu); - struct rt6_info *rt; -@@ -148,14 +151,12 @@ static void rt6_uncached_list_flush_dev( - struct inet6_dev *rt_idev = rt->rt6i_idev; - struct net_device *rt_dev = rt->dst.dev; - -- if (rt_idev && (rt_idev->dev == dev || !dev) && -- rt_idev->dev != loopback_dev) { -+ if (rt_idev->dev == dev) { - rt->rt6i_idev = in6_dev_get(loopback_dev); - in6_dev_put(rt_idev); - } - -- if (rt_dev && (rt_dev == dev || !dev) && -- rt_dev != loopback_dev) { -+ if (rt_dev == dev) { - rt->dst.dev = loopback_dev; - dev_hold(rt->dst.dev); - dev_put(rt_dev); -@@ -2577,7 +2578,8 @@ void rt6_ifdown(struct net *net, struct - - fib6_clean_all(net, fib6_ifdown, &adn); - icmp6_clean_all(fib6_ifdown, &adn); -- rt6_uncached_list_flush_dev(net, dev); -+ if (dev) -+ rt6_uncached_list_flush_dev(net, dev); - } - - struct rt6_mtu_change_arg { diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch deleted file mode 100644 index a9a7be41..00000000 --- a/kernel/kernel/files/patches/mageia/stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 5d9bc648b94dd719022343b8675e6c4381f0c45f Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Tue, 13 Oct 2015 10:18:53 +0200 -Subject: KVM: x86: clean up kvm_arch_vcpu_runnable -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Paolo Bonzini - -commit 5d9bc648b94dd719022343b8675e6c4381f0c45f upstream. - -Split the huge conditional in two functions. - -Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 -Reviewed-by: Radim Krčmář -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/x86.c | 39 +++++++++++++++++++++++++++++---------- - 1 file changed, 29 insertions(+), 10 deletions(-) - ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -6706,6 +6706,12 @@ static inline int vcpu_block(struct kvm - return 1; - } - -+static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu) -+{ -+ return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && -+ !vcpu->arch.apf.halted); -+} -+ - static int vcpu_run(struct kvm_vcpu *vcpu) - { - int r; -@@ -6714,8 +6720,7 @@ static int vcpu_run(struct kvm_vcpu *vcp - vcpu->srcu_idx = srcu_read_lock(&kvm->srcu); - - for (;;) { -- if (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && -- !vcpu->arch.apf.halted) -+ if (kvm_vcpu_running(vcpu)) - r = vcpu_enter_guest(vcpu); - else - r = vcpu_block(kvm, vcpu); -@@ -8011,19 +8016,33 @@ void kvm_arch_flush_shadow_memslot(struc - kvm_mmu_invalidate_zap_all_pages(kvm); - } - -+static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu) -+{ -+ if (!list_empty_careful(&vcpu->async_pf.done)) -+ return true; -+ -+ if (kvm_apic_has_events(vcpu)) -+ return true; -+ -+ if (vcpu->arch.pv.pv_unhalted) -+ return true; -+ -+ if (atomic_read(&vcpu->arch.nmi_queued)) -+ return true; -+ -+ if (kvm_arch_interrupt_allowed(vcpu) && -+ kvm_cpu_has_interrupt(vcpu)) -+ return true; -+ -+ return false; -+} -+ - int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu) - { - if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events) - kvm_x86_ops->check_nested_events(vcpu, false); - -- return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE && -- !vcpu->arch.apf.halted) -- || !list_empty_careful(&vcpu->async_pf.done) -- || kvm_apic_has_events(vcpu) -- || vcpu->arch.pv.pv_unhalted -- || atomic_read(&vcpu->arch.nmi_queued) || -- (kvm_arch_interrupt_allowed(vcpu) && -- kvm_cpu_has_interrupt(vcpu)); -+ return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu); - } - - int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch deleted file mode 100644 index ea07d9de..00000000 --- a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch +++ /dev/null @@ -1,58 +0,0 @@ -From b10d92a54dac25a6152f1aa1ffc95c12908035ce Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Wed, 14 Oct 2015 15:25:52 +0200 -Subject: KVM: x86: fix RSM into 64-bit protected mode - -From: Paolo Bonzini - -commit b10d92a54dac25a6152f1aa1ffc95c12908035ce upstream. - -In order to get into 64-bit protected mode, you need to enable -paging while EFER.LMA=1. For this to work, CS.L must be 0. -Currently, we load the segments before CR0 and CR4, which means -that if RSM returns into 64-bit protected mode CS.L is already 1 -and everything breaks. - -Luckily, CS.L=0 is always the case when executing RSM, because it -is forbidden to execute RSM from 64-bit protected mode. Hence it -is enough to load CR0 and CR4 first, and only then the segments. - -Fixes: 660a5d517aaab9187f93854425c4c63f4a09195c -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/emulate.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2418,7 +2418,7 @@ static int rsm_load_state_64(struct x86_ - u64 val, cr0, cr4; - u32 base3; - u16 selector; -- int i; -+ int i, r; - - for (i = 0; i < 16; i++) - *reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8); -@@ -2460,13 +2460,17 @@ static int rsm_load_state_64(struct x86_ - dt.address = GET_SMSTATE(u64, smbase, 0x7e68); - ctxt->ops->set_gdt(ctxt, &dt); - -+ r = rsm_enter_protected_mode(ctxt, cr0, cr4); -+ if (r != X86EMUL_CONTINUE) -+ return r; -+ - for (i = 0; i < 6; i++) { -- int r = rsm_load_seg_64(ctxt, smbase, i); -+ r = rsm_load_seg_64(ctxt, smbase, i); - if (r != X86EMUL_CONTINUE) - return r; - } - -- return rsm_enter_protected_mode(ctxt, cr0, cr4); -+ return X86EMUL_CONTINUE; - } - - static int em_rsm(struct x86_emulate_ctxt *ctxt) diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch deleted file mode 100644 index 6f9893bd..00000000 --- a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-smi-to-halted-vcpu.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 73917739334c6509833b0403b81d4a04a8784bdf Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Tue, 13 Oct 2015 10:19:35 +0200 -Subject: KVM: x86: fix SMI to halted VCPU - -From: Paolo Bonzini - -commit 73917739334c6509833b0403b81d4a04a8784bdf upstream. - -An SMI to a halted VCPU must wake it up, hence a VCPU with a pending -SMI must be considered runnable. - -Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16 -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/x86.c | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -8030,6 +8030,9 @@ static inline bool kvm_vcpu_has_events(s - if (atomic_read(&vcpu->arch.nmi_queued)) - return true; - -+ if (test_bit(KVM_REQ_SMI, &vcpu->requests)) -+ return true; -+ - if (kvm_arch_interrupt_allowed(vcpu) && - kvm_cpu_has_interrupt(vcpu)) - return true; diff --git a/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch b/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch deleted file mode 100644 index 78d75c2a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-l2tp-protect-tunnel-del_work-by-ref_count.patch +++ /dev/null @@ -1,55 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Alexander Couzens -Date: Mon, 28 Sep 2015 11:32:42 +0200 -Subject: l2tp: protect tunnel->del_work by ref_count - -From: Alexander Couzens - -[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ] - -There is a small chance that tunnel_free() is called before tunnel->del_work scheduled -resulting in a zero pointer dereference. - -Signed-off-by: Alexander Couzens -Acked-by: James Chapman -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/l2tp/l2tp_core.c | 11 +++++++++-- - 1 file changed, 9 insertions(+), 2 deletions(-) - ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct - tunnel = container_of(work, struct l2tp_tunnel, del_work); - sk = l2tp_tunnel_sock_lookup(tunnel); - if (!sk) -- return; -+ goto out; - - sock = sk->sk_socket; - -@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct - } - - l2tp_tunnel_sock_put(sk); -+out: -+ l2tp_tunnel_dec_refcount(tunnel); - } - - /* Create a socket for the tunnel, if one isn't set up by -@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); - */ - int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) - { -+ l2tp_tunnel_inc_refcount(tunnel); - l2tp_tunnel_closeall(tunnel); -- return (false == queue_work(l2tp_wq, &tunnel->del_work)); -+ if (false == queue_work(l2tp_wq, &tunnel->del_work)) { -+ l2tp_tunnel_dec_refcount(tunnel); -+ return 1; -+ } -+ return 0; - } - EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); - diff --git a/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch b/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch new file mode 100644 index 00000000..0cba04d1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch @@ -0,0 +1,34 @@ +From 4633dfc32c0019bed2996de9bbdbe7f3b518a44e Mon Sep 17 00:00:00 2001 +From: Mohammed Shafi Shajakhan +Date: Thu, 8 Oct 2015 19:20:14 +0530 +Subject: mac80211: Fix hwflags debugfs file format + +From: Mohammed Shafi Shajakhan + +commit 4633dfc32c0019bed2996de9bbdbe7f3b518a44e upstream. + +Commit 30686bf7f5b3 ("mac80211: convert HW flags to unsigned long +bitmap") accidentally removed the newline delimiter from the hwflags +debugfs file. Fix this by adding back the newline between the HW flags. + +Signed-off-by: Mohammed Shafi Shajakhan +[fix commit log] +Signed-off-by: Jouni Malinen +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/debugfs.c ++++ b/net/mac80211/debugfs.c +@@ -148,7 +148,7 @@ static ssize_t hwflags_read(struct file + + for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) { + if (test_bit(i, local->hw.flags)) +- pos += scnprintf(pos, end - pos, "%s", ++ pos += scnprintf(pos, end - pos, "%s\n", + hw_flag_names[i]); + } + diff --git a/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch b/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch deleted file mode 100644 index 59f1b712..00000000 --- a/kernel/kernel/files/patches/mageia/stable-memcg-convert-threshold-to-bytes.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 424cdc14138088ada1b0e407a2195b2783c6e5ef Mon Sep 17 00:00:00 2001 -From: Shaohua Li -Date: Thu, 15 Oct 2015 15:28:29 -0700 -Subject: memcg: convert threshold to bytes - -From: Shaohua Li - -commit 424cdc14138088ada1b0e407a2195b2783c6e5ef upstream. - -page_counter_memparse() returns pages for the threshold, while -mem_cgroup_usage() returns bytes for memory usage. Convert the -threshold to bytes. - -Fixes: 3e32cb2e0a12b6915 ("memcg: rename cgroup_event to mem_cgroup_event"). -Signed-off-by: Shaohua Li -Cc: Johannes Weiner -Acked-by: Michal Hocko -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds -Signed-off-by: Greg Kroah-Hartman - ---- - mm/memcontrol.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -3687,6 +3687,7 @@ static int __mem_cgroup_usage_register_e - ret = page_counter_memparse(args, "-1", &threshold); - if (ret) - return ret; -+ threshold <<= PAGE_SHIFT; - - mutex_lock(&memcg->thresholds_lock); - diff --git a/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch b/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch deleted file mode 100644 index 0798f6b0..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 1b52e50f2a402a266f1ba2281f0a57e87637a047 Mon Sep 17 00:00:00 2001 -From: Javier Martinez Canillas -Date: Mon, 21 Sep 2015 14:26:54 +0200 -Subject: mfd: max77843: Fix max77843_chg_init() return on error - -From: Javier Martinez Canillas - -commit 1b52e50f2a402a266f1ba2281f0a57e87637a047 upstream. - -If i2c_new_dummy() fails in max77843_chg_init(), an PTR_ERR(NULL) is -returned which is 0. So the function was wrongly returning a success -value instead of an error code. - -Fixes: c7f585fe46d8 ("mfd: max77843: Add max77843 MFD driver core driver") -Signed-off-by: Javier Martinez Canillas -Reviewed-by: Krzysztof Kozlowski -Signed-off-by: Lee Jones -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/mfd/max77843.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/mfd/max77843.c -+++ b/drivers/mfd/max77843.c -@@ -79,7 +79,7 @@ static int max77843_chg_init(struct max7 - if (!max77843->i2c_chg) { - dev_err(&max77843->i2c->dev, - "Cannot allocate I2C device for Charger\n"); -- return PTR_ERR(max77843->i2c_chg); -+ return -ENODEV; - } - i2c_set_clientdata(max77843->i2c_chg, max77843); - diff --git a/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch b/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch new file mode 100644 index 00000000..3abec18a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch @@ -0,0 +1,82 @@ +From 08b137d90eec51b0e90c42e123ca8ceb118d233f Mon Sep 17 00:00:00 2001 +From: Chaotian Jing +Date: Mon, 12 Oct 2015 17:22:23 +0800 +Subject: mmc: core: Fix init_card in 52Mhz + +From: Chaotian Jing + +commit 08b137d90eec51b0e90c42e123ca8ceb118d233f upstream. + +Suppose that we got a data crc error, and it triggers the mmc_reset. +mmc_reset will call mmc_send_status to see if HW reset was supported. +before issue CMD13, it will do retune, and if EMMC was in HS400 mode, +it will reduce frequency to 52Mhz firstly, then results in card init +was doing at 52Mhz. +The mmc_send_status was originally only done for mmc_test, should drop +it. And, rename the "eMMC hardware reset" to "Reset test", as we would +also be able to use the test for SD-cards. + +Signed-off-by: Chaotian Jing +Suggested-by: Adrian Hunter +Fixes: bd11e8bd03ca ("mmc: core: Flag re-tuning is needed on CRC errors") +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/card/mmc_test.c | 9 +++------ + drivers/mmc/core/mmc.c | 7 ------- + 2 files changed, 3 insertions(+), 13 deletions(-) + +--- a/drivers/mmc/card/mmc_test.c ++++ b/drivers/mmc/card/mmc_test.c +@@ -2263,15 +2263,12 @@ static int mmc_test_profile_sglen_r_nonb + /* + * eMMC hardware reset. + */ +-static int mmc_test_hw_reset(struct mmc_test_card *test) ++static int mmc_test_reset(struct mmc_test_card *test) + { + struct mmc_card *card = test->card; + struct mmc_host *host = card->host; + int err; + +- if (!mmc_card_mmc(card) || !mmc_can_reset(card)) +- return RESULT_UNSUP_CARD; +- + err = mmc_hw_reset(host); + if (!err) + return RESULT_OK; +@@ -2605,8 +2602,8 @@ static const struct mmc_test_case mmc_te + }, + + { +- .name = "eMMC hardware reset", +- .run = mmc_test_hw_reset, ++ .name = "Reset test", ++ .run = mmc_test_reset, + }, + }; + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -1924,7 +1924,6 @@ EXPORT_SYMBOL(mmc_can_reset); + static int mmc_reset(struct mmc_host *host) + { + struct mmc_card *card = host->card; +- u32 status; + + if (!(host->caps & MMC_CAP_HW_RESET) || !host->ops->hw_reset) + return -EOPNOTSUPP; +@@ -1937,12 +1936,6 @@ static int mmc_reset(struct mmc_host *ho + + host->ops->hw_reset(host); + +- /* If the reset has happened, then a status command will fail */ +- if (!mmc_send_status(card, &status)) { +- mmc_host_clk_release(host); +- return -ENOSYS; +- } +- + /* Set initial state and call mmc_set_ios */ + mmc_set_initial_state(host); + mmc_host_clk_release(host); diff --git a/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch b/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch deleted file mode 100644 index 2dfdab75..00000000 --- a/kernel/kernel/files/patches/mageia/stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch +++ /dev/null @@ -1,49 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Eric Dumazet -Date: Tue, 29 Sep 2015 18:52:25 -0700 -Subject: net: add pfmemalloc check in sk_add_backlog() - -From: Eric Dumazet - -[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ] - -Greg reported crashes hitting the following check in __sk_backlog_rcv() - - BUG_ON(!sock_flag(sk, SOCK_MEMALLOC)); - -The pfmemalloc bit is currently checked in sk_filter(). - -This works correctly for TCP, because sk_filter() is ran in -tcp_v[46]_rcv() before hitting the prequeue or backlog checks. - -For UDP or other protocols, this does not work, because the sk_filter() -is ran from sock_queue_rcv_skb(), which might be called _after_ backlog -queuing if socket is owned by user by the time packet is processed by -softirq handler. - -Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing") -Signed-off-by: Eric Dumazet -Reported-by: Greg Thelen -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - include/net/sock.h | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/include/net/sock.h -+++ b/include/net/sock.h -@@ -826,6 +826,14 @@ static inline __must_check int sk_add_ba - if (sk_rcvqueues_full(sk, limit)) - return -ENOBUFS; - -+ /* -+ * If the skb was allocated from pfmemalloc reserves, only -+ * allow SOCK_MEMALLOC sockets to use it as this socket is -+ * helping free memory -+ */ -+ if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC)) -+ return -ENOMEM; -+ - __sk_add_backlog(sk, skb); - sk->sk_backlog.len += skb->truesize; - return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch b/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch deleted file mode 100644 index 5e0635c3..00000000 --- a/kernel/kernel/files/patches/mageia/stable-net-dsa-fix-preparation-of-a-port-stp-update.patch +++ /dev/null @@ -1,47 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Vivien Didelot -Date: Tue, 29 Sep 2015 14:17:54 -0400 -Subject: net: dsa: fix preparation of a port STP update - -From: Vivien Didelot - -[ Upstream commit 57a47532c4312159935c98b7f1cf0e62296b9171 ] - -Because of the default 0 value of ret in dsa_slave_port_attr_set, a -driver may return -EOPNOTSUPP from the commit phase of a STP state, -which triggers a WARN() from switchdev. - -This happened on a 6185 switch which does not support hardware bridging. - -Fixes: 3563606258cf ("switchdev: convert STP update to switchdev attr set") -Reported-by: Andrew Lunn -Signed-off-by: Vivien Didelot -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/dsa/slave.c | 11 ++++++++--- - 1 file changed, 8 insertions(+), 3 deletions(-) - ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -348,12 +348,17 @@ static int dsa_slave_stp_update(struct n - static int dsa_slave_port_attr_set(struct net_device *dev, - struct switchdev_attr *attr) - { -- int ret = 0; -+ struct dsa_slave_priv *p = netdev_priv(dev); -+ struct dsa_switch *ds = p->parent; -+ int ret; - - switch (attr->id) { - case SWITCHDEV_ATTR_PORT_STP_STATE: -- if (attr->trans == SWITCHDEV_TRANS_COMMIT) -- ret = dsa_slave_stp_update(dev, attr->u.stp_state); -+ if (attr->trans == SWITCHDEV_TRANS_PREPARE) -+ ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP; -+ else -+ ret = ds->drv->port_stp_update(ds, p->port, -+ attr->u.stp_state); - break; - default: - ret = -EOPNOTSUPP; diff --git a/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch b/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch deleted file mode 100644 index 17d64561..00000000 --- a/kernel/kernel/files/patches/mageia/stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch +++ /dev/null @@ -1,40 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Ivan Mikhaylov -Date: Fri, 25 Sep 2015 11:52:27 +0400 -Subject: net/ibm/emac: bump version numbers for correct work with ethtool - -From: Ivan Mikhaylov - -[ Upstream commit 661dfc65f7981481ba2e31aaa702371e82336e56 ] - -The size of the MAC register dump used to be the size specified by the -reg property in the device tree. Userland has no good way of finding -out that size, and it was not specified consistently for each MAC type, -so ethtool would end up printing junk at the end of the register dump -if the device tree didn't match the size it assumed. - -Using the new version numbers indicates unambiguously that the size of -the MAC register dump is dependent only on the MAC type. - -Fixes: 5369c71f7ca2 ("net/ibm/emac: fix size of emac dump memory areas") -Signed-off-by: Ivan Mikhaylov -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ethernet/ibm/emac/core.h | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - ---- a/drivers/net/ethernet/ibm/emac/core.h -+++ b/drivers/net/ethernet/ibm/emac/core.h -@@ -460,8 +460,8 @@ struct emac_ethtool_regs_subhdr { - u32 index; - }; - --#define EMAC_ETHTOOL_REGS_VER 0 --#define EMAC4_ETHTOOL_REGS_VER 1 --#define EMAC4SYNC_ETHTOOL_REGS_VER 2 -+#define EMAC_ETHTOOL_REGS_VER 3 -+#define EMAC4_ETHTOOL_REGS_VER 4 -+#define EMAC4SYNC_ETHTOOL_REGS_VER 5 - - #endif /* __IBM_NEWEMAC_CORE_H */ diff --git a/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch b/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch deleted file mode 100644 index caf341d6..00000000 --- a/kernel/kernel/files/patches/mageia/stable-net-unix-fix-logic-about-sk_peek_offset.patch +++ /dev/null @@ -1,67 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Andrey Vagin -Date: Fri, 2 Oct 2015 00:05:36 +0300 -Subject: net/unix: fix logic about sk_peek_offset - -From: Andrey Vagin - -[ Upstream commit e9193d60d363e4dff75ff6d43a48f22be26d59c7 ] - -Now send with MSG_PEEK can return data from multiple SKBs. - -Unfortunately we take into account the peek offset for each skb, -that is wrong. We need to apply the peek offset only once. - -In addition, the peek offset should be used only if MSG_PEEK is set. - -Cc: "David S. Miller" (maintainer:NETWORKING -Cc: Eric Dumazet (commit_signer:1/14=7%) -Cc: Aaron Conole -Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag") -Signed-off-by: Andrey Vagin -Tested-by: Aaron Conole -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/unix/af_unix.c | 12 +++++++----- - 1 file changed, 7 insertions(+), 5 deletions(-) - ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(stru - goto out; - } - -+ if (flags & MSG_PEEK) -+ skip = sk_peek_offset(sk, flags); -+ else -+ skip = 0; -+ - do { - int chunk; - struct sk_buff *skb, *last; -@@ -2112,7 +2117,6 @@ unlock: - break; - } - -- skip = sk_peek_offset(sk, flags); - while (skip >= unix_skb_len(skb)) { - skip -= unix_skb_len(skb); - last = skb; -@@ -2179,14 +2183,12 @@ unlock: - if (UNIXCB(skb).fp) - scm.fp = scm_fp_dup(UNIXCB(skb).fp); - -- if (skip) { -- sk_peek_offset_fwd(sk, chunk); -- skip -= chunk; -- } -+ sk_peek_offset_fwd(sk, chunk); - - if (UNIXCB(skb).fp) - break; - -+ skip = 0; - last = skb; - last_len = skb->len; - unix_state_lock(sk); diff --git a/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch b/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch deleted file mode 100644 index dc17779e..00000000 --- a/kernel/kernel/files/patches/mageia/stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch +++ /dev/null @@ -1,107 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: "Arad, Ronen" -Date: Thu, 15 Oct 2015 01:55:17 -0700 -Subject: netlink: Trim skb to alloc size to avoid MSG_TRUNC - -From: "Arad, Ronen" - -[ Upstream commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe ] - -netlink_dump() allocates skb based on the calculated min_dump_alloc or -a per socket max_recvmsg_len. -min_alloc_size is maximum space required for any single netdev -attributes as calculated by rtnl_calcit(). -max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. -It is capped at 16KiB. -The intention is to avoid small allocations and to minimize the number -of calls required to obtain dump information for all net devices. - -netlink_dump packs as many small messages as could fit within an skb -that was sized for the largest single netdev information. The actual -space available within an skb is larger than what is requested. It could -be much larger and up to near 2x with align to next power of 2 approach. - -Allowing netlink_dump to use all the space available within the -allocated skb increases the buffer size a user has to provide to avoid -truncaion (i.e. MSG_TRUNG flag set). - -It was observed that with many VLANs configured on at least one netdev, -a larger buffer of near 64KiB was necessary to avoid "Message truncated" -error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when -min_alloc_size was only little over 32KiB. - -This patch trims skb to allocated size in order to allow the user to -avoid truncation with more reasonable buffer size. - -Signed-off-by: Ronen Arad -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ - 1 file changed, 22 insertions(+), 12 deletions(-) - ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2750,6 +2750,7 @@ static int netlink_dump(struct sock *sk) - struct sk_buff *skb = NULL; - struct nlmsghdr *nlh; - int len, err = -ENOBUFS; -+ int alloc_min_size; - int alloc_size; - - mutex_lock(nlk->cb_mutex); -@@ -2758,9 +2759,6 @@ static int netlink_dump(struct sock *sk) - goto errout_skb; - } - -- cb = &nlk->cb; -- alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); -- - if (!netlink_rx_is_mmaped(sk) && - atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) - goto errout_skb; -@@ -2770,23 +2768,35 @@ static int netlink_dump(struct sock *sk) - * to reduce number of system calls on dump operations, if user - * ever provided a big enough buffer. - */ -- if (alloc_size < nlk->max_recvmsg_len) { -- skb = netlink_alloc_skb(sk, -- nlk->max_recvmsg_len, -- nlk->portid, -+ cb = &nlk->cb; -+ alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE); -+ -+ if (alloc_min_size < nlk->max_recvmsg_len) { -+ alloc_size = nlk->max_recvmsg_len; -+ skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, - GFP_KERNEL | - __GFP_NOWARN | - __GFP_NORETRY); -- /* available room should be exact amount to avoid MSG_TRUNC */ -- if (skb) -- skb_reserve(skb, skb_tailroom(skb) - -- nlk->max_recvmsg_len); - } -- if (!skb) -+ if (!skb) { -+ alloc_size = alloc_min_size; - skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, - GFP_KERNEL); -+ } - if (!skb) - goto errout_skb; -+ -+ /* Trim skb to allocated size. User is expected to provide buffer as -+ * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at -+ * netlink_recvmsg())). dump will pack as many smaller messages as -+ * could fit within the allocated skb. skb is typically allocated -+ * with larger space than required (could be as much as near 2x the -+ * requested size with align to next power of 2 approach). Allowing -+ * dump to use the excess space makes it difficult for a user to have a -+ * reasonable static buffer based on the expected largest dump of a -+ * single netdev. The outcome is MSG_TRUNC error. -+ */ -+ skb_reserve(skb, skb_tailroom(skb) - alloc_size); - netlink_skb_set_owner_r(skb, sk); - - len = cb->dump(skb, cb); diff --git a/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch b/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch deleted file mode 100644 index 93a47304..00000000 --- a/kernel/kernel/files/patches/mageia/stable-nfsd-blocklayout-accept-any-minlength.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig -Date: Fri, 9 Oct 2015 15:03:26 +0200 -Subject: nfsd/blocklayout: accept any minlength - -From: Christoph Hellwig - -commit 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b upstream. - -Recent Linux clients have started to send GETLAYOUT requests with -minlength less than blocksize. - -Servers aren't really allowed to impose this kind of restriction on -layouts; see RFC 5661 section 18.43.3 for details. - -This has been observed to cause indefinite hangs on fsx runs on some -clients. - -Signed-off-by: Christoph Hellwig -Signed-off-by: J. Bruce Fields -Signed-off-by: Greg Kroah-Hartman - ---- - fs/nfsd/blocklayout.c | 8 -------- - 1 file changed, 8 deletions(-) - ---- a/fs/nfsd/blocklayout.c -+++ b/fs/nfsd/blocklayout.c -@@ -56,14 +56,6 @@ nfsd4_block_proc_layoutget(struct inode - u32 device_generation = 0; - int error; - -- /* -- * We do not attempt to support I/O smaller than the fs block size, -- * or not aligned to it. -- */ -- if (args->lg_minlength < block_size) { -- dprintk("pnfsd: I/O too small\n"); -- goto out_layoutunavailable; -- } - if (seg->offset & (block_size - 1)) { - dprintk("pnfsd: I/O misaligned\n"); - goto out_layoutunavailable; diff --git a/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch b/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch deleted file mode 100644 index d6354343..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch +++ /dev/null @@ -1,35 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Konstantin Khlebnikov -Date: Fri, 2 Oct 2015 13:18:22 +0300 -Subject: ovs: do not allocate memory from offline numa node - -From: Konstantin Khlebnikov - -[ Upstream commit 598c12d0ba6de9060f04999746eb1e015774044b ] - -When openvswitch tries allocate memory from offline numa node 0: -stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0) -It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid)) -[ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h -This patch disables numa affinity in this case. - -Signed-off-by: Konstantin Khlebnikov -Acked-by: Pravin B Shelar -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/openvswitch/flow_table.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - ---- a/net/openvswitch/flow_table.c -+++ b/net/openvswitch/flow_table.c -@@ -92,7 +92,8 @@ struct sw_flow *ovs_flow_alloc(void) - - /* Initialize the default stat node. */ - stats = kmem_cache_alloc_node(flow_stats_cache, -- GFP_KERNEL | __GFP_ZERO, 0); -+ GFP_KERNEL | __GFP_ZERO, -+ node_online(0) ? 0 : NUMA_NO_NODE); - if (!stats) - goto err; - diff --git a/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch b/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch deleted file mode 100644 index 0234e75f..00000000 --- a/kernel/kernel/files/patches/mageia/stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch +++ /dev/null @@ -1,76 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Guillaume Nault -Date: Wed, 30 Sep 2015 11:45:33 +0200 -Subject: ppp: don't override sk->sk_state in pppoe_flush_dev() - -From: Guillaume Nault - -[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ] - -Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"), -pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the -PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to -PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the -following oops: - -[ 570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0 -[ 570.142931] IP: [] pppoe_release+0x50/0x101 [pppoe] -[ 570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0 -[ 570.144601] Oops: 0000 [#1] SMP -[ 570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio -[ 570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1 -[ 570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014 -[ 570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000 -[ 570.144601] RIP: 0010:[] [] pppoe_release+0x50/0x101 [pppoe] -[ 570.144601] RSP: 0018:ffff880036b63e08 EFLAGS: 00010202 -[ 570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206 -[ 570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20 -[ 570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000 -[ 570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780 -[ 570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0 -[ 570.144601] FS: 00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000 -[ 570.144601] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0 -[ 570.144601] Stack: -[ 570.144601] ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0 -[ 570.144601] ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008 -[ 570.144601] ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5 -[ 570.144601] Call Trace: -[ 570.144601] [] sock_release+0x1a/0x75 -[ 570.144601] [] sock_close+0xd/0x11 -[ 570.144601] [] __fput+0xff/0x1a5 -[ 570.144601] [] ____fput+0x9/0xb -[ 570.144601] [] task_work_run+0x66/0x90 -[ 570.144601] [] prepare_exit_to_usermode+0x8c/0xa7 -[ 570.144601] [] syscall_return_slowpath+0x16d/0x19b -[ 570.144601] [] int_ret_from_sys_call+0x25/0x9f -[ 570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00 -[ 570.144601] RIP [] pppoe_release+0x50/0x101 [pppoe] -[ 570.144601] RSP -[ 570.144601] CR2: 00000000000004e0 -[ 570.200518] ---[ end trace 46956baf17349563 ]--- - -pppoe_flush_dev() has no reason to override sk->sk_state with -PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to -PPPOX_DEAD, which is the correct state given that sk is unbound and -po->pppoe_dev is NULL. - -Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release") -Tested-by: Oleksii Berezhniak -Signed-off-by: Guillaume Nault -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - drivers/net/ppp/pppoe.c | 1 - - 1 file changed, 1 deletion(-) - ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d - if (po->pppoe_dev == dev && - sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) { - pppox_unbind_sock(sk); -- sk->sk_state = PPPOX_ZOMBIE; - sk->sk_state_change(sk); - po->pppoe_dev = NULL; - dev_put(dev); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch deleted file mode 100644 index 40758742..00000000 --- a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch +++ /dev/null @@ -1,68 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Pravin B Shelar -Date: Tue, 22 Sep 2015 12:57:53 -0700 -Subject: skbuff: Fix skb checksum flag on skb pull - -From: Pravin B Shelar - -[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ] - -VXLAN device can receive skb with checksum partial. But the checksum -offset could be in outer header which is pulled on receive. This results -in negative checksum offset for the skb. Such skb can cause the assert -failure in skb_checksum_help(). Following patch fixes the bug by setting -checksum-none while pulling outer header. - -Following is the kernel panic msg from old kernel hitting the bug. - -------------[ cut here ]------------ -kernel BUG at net/core/dev.c:1906! -RIP: 0010:[] skb_checksum_help+0x144/0x150 -Call Trace: - -[] queue_userspace_packet+0x408/0x470 [openvswitch] -[] ovs_dp_upcall+0x5d/0x60 [openvswitch] -[] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch] -[] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch] -[] ovs_vport_receive+0x2a/0x30 [openvswitch] -[] vxlan_rcv+0x53/0x60 [openvswitch] -[] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch] -[] udp_queue_rcv_skb+0x2dc/0x3b0 -[] __udp4_lib_rcv+0x1cf/0x6c0 -[] udp_rcv+0x1a/0x20 -[] ip_local_deliver_finish+0xdd/0x280 -[] ip_local_deliver+0x88/0x90 -[] ip_rcv_finish+0x10d/0x370 -[] ip_rcv+0x235/0x300 -[] __netif_receive_skb+0x55d/0x620 -[] netif_receive_skb+0x80/0x90 -[] virtnet_poll+0x555/0x6f0 -[] net_rx_action+0x134/0x290 -[] __do_softirq+0xa8/0x210 -[] call_softirq+0x1c/0x30 -[] do_softirq+0x65/0xa0 -[] irq_exit+0x8e/0xb0 -[] do_IRQ+0x63/0xe0 -[] common_interrupt+0x6e/0x6e - -Reported-by: Anupam Chanda -Signed-off-by: Pravin B Shelar -Acked-by: Tom Herbert -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/skbuff.h | 3 +++ - 1 file changed, 3 insertions(+) - ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(st - { - if (skb->ip_summed == CHECKSUM_COMPLETE) - skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); -+ else if (skb->ip_summed == CHECKSUM_PARTIAL && -+ skb_checksum_start_offset(skb) <= len) -+ skb->ip_summed = CHECKSUM_NONE; - } - - unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len); diff --git a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch b/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch deleted file mode 100644 index 4d3fed25..00000000 --- a/kernel/kernel/files/patches/mageia/stable-skbuff-fix-skb-checksum-partial-check.patch +++ /dev/null @@ -1,58 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Pravin B Shelar -Date: Mon, 28 Sep 2015 17:24:25 -0700 -Subject: skbuff: Fix skb checksum partial check. - -From: Pravin B Shelar - -[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ] - -Earlier patch 6ae459bda tried to detect void ckecksum partial -skb by comparing pull length to checksum offset. But it does -not work for all cases since checksum-offset depends on -updates to skb->data. - -Following patch fixes it by validating checksum start offset -after skb-data pointer is updated. Negative value of checksum -offset start means there is no need to checksum. - -Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull") -Reported-by: Andrew Vagin -Signed-off-by: Pravin B Shelar -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - include/linux/skbuff.h | 2 +- - net/core/skbuff.c | 9 +++++---- - 2 files changed, 6 insertions(+), 5 deletions(-) - ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -2602,7 +2602,7 @@ static inline void skb_postpull_rcsum(st - if (skb->ip_summed == CHECKSUM_COMPLETE) - skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0)); - else if (skb->ip_summed == CHECKSUM_PARTIAL && -- skb_checksum_start_offset(skb) <= len) -+ skb_checksum_start_offset(skb) < 0) - skb->ip_summed = CHECKSUM_NONE; - } - ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags); - */ - unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len) - { -+ unsigned char *data = skb->data; -+ - BUG_ON(len > skb->len); -- skb->len -= len; -- BUG_ON(skb->len < skb->data_len); -- skb_postpull_rcsum(skb, skb->data, len); -- return skb->data += len; -+ __skb_pull(skb, len); -+ skb_postpull_rcsum(skb, data, len); -+ return skb->data; - } - EXPORT_SYMBOL_GPL(skb_pull_rcsum); - diff --git a/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch b/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch deleted file mode 100644 index 866de2e9..00000000 --- a/kernel/kernel/files/patches/mageia/stable-tipc-move-fragment-importance-field-to-new-header-position.patch +++ /dev/null @@ -1,57 +0,0 @@ -From foo@baz Thu Oct 22 17:25:24 PDT 2015 -From: Jon Paul Maloy -Date: Wed, 14 Oct 2015 09:23:18 -0400 -Subject: tipc: move fragment importance field to new header position - -From: Jon Paul Maloy - -[ Upstream commit dde4b5ae65de659b9ec64bafdde0430459fcb495 ] - -In commit e3eea1eb47a ("tipc: clean up handling of message priorities") -we introduced a field in the packet header for keeping track of the -priority of fragments, since this value is not present in the specified -protocol header. Since the value so far only is used at the transmitting -end of the link, we have not yet officially defined it as part of the -protocol. - -Unfortunately, the field we use for keeping this value, bits 13-15 in -in word 5, has turned out to be a poor choice; it is already used by the -broadcast protocol for carrying the 'network id' field of the sending -node. Since packet fragments also need to be transported across the -broadcast protocol, the risk of conflict is obvious, and we see this -happen when we use network identities larger than 2^13-1. This has -escaped our testing because we have so far only been using small network -id values. - -We now move this field to bits 0-2 in word 9, a field that is guaranteed -to be unused by all involved protocols. - -Fixes: e3eea1eb47a ("tipc: clean up handling of message priorities") -Signed-off-by: Jon Maloy -Acked-by: Ying Xue -Signed-off-by: David S. Miller -Signed-off-by: Greg Kroah-Hartman ---- - net/tipc/msg.h | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/tipc/msg.h -+++ b/net/tipc/msg.h -@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct - if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m))) - return usr; - if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)) -- return msg_bits(m, 5, 13, 0x7); -+ return msg_bits(m, 9, 0, 0x7); - return TIPC_SYSTEM_IMPORTANCE; - } - -@@ -366,7 +366,7 @@ static inline void msg_set_importance(st - int usr = msg_user(m); - - if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))) -- msg_set_bits(m, 5, 13, 0x7, i); -+ msg_set_bits(m, 9, 0, 0x7, i); - else if (i < TIPC_SYSTEM_IMPORTANCE) - msg_set_user(m, i); - else diff --git a/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch b/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch deleted file mode 100644 index c8324073..00000000 --- a/kernel/kernel/files/patches/mageia/stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 874bbfe600a660cba9c776b3957b1ce393151b76 Mon Sep 17 00:00:00 2001 -From: Shaohua Li -Date: Wed, 30 Sep 2015 09:05:30 -0700 -Subject: workqueue: make sure delayed work run in local cpu - -From: Shaohua Li - -commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream. - -My system keeps crashing with below message. vmstat_update() schedules a delayed -work in current cpu and expects the work runs in the cpu. -schedule_delayed_work() is expected to make delayed work run in local cpu. The -problem is timer can be migrated with NO_HZ. __queue_work() queues work in -timer handler, which could run in a different cpu other than where the delayed -work is scheduled. The end result is the delayed work runs in different cpu. -The patch makes __queue_delayed_work records local cpu earlier. Where the timer -runs doesn't change where the work runs with the change. - -[ 28.010131] ------------[ cut here ]------------ -[ 28.010609] kernel BUG at ../mm/vmstat.c:1392! -[ 28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN -[ 28.011860] Modules linked in: -[ 28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G W4.3.0-rc3+ #634 -[ 28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014 -[ 28.014160] Workqueue: events vmstat_update -[ 28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000 -[ 28.015445] RIP: 0010:[] []vmstat_update+0x31/0x80 -[ 28.016282] RSP: 0018:ffff8800ba42fd80 EFLAGS: 00010297 -[ 28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000 -[ 28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d -[ 28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000 -[ 28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640 -[ 28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000 -[ 28.020071] FS: 0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000 -[ 28.020071] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b -[ 28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0 -[ 28.020071] Stack: -[ 28.020071] ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88 -[ 28.020071] ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8 -[ 28.020071] ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340 -[ 28.020071] Call Trace: -[ 28.020071] [] process_one_work+0x1c8/0x540 -[ 28.020071] [] ? process_one_work+0x14b/0x540 -[ 28.020071] [] worker_thread+0x114/0x460 -[ 28.020071] [] ? process_one_work+0x540/0x540 -[ 28.020071] [] kthread+0xf8/0x110 -[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 -[ 28.020071] [] ret_from_fork+0x3f/0x70 -[ 28.020071] [] ?kthread_create_on_node+0x200/0x200 - -Signed-off-by: Shaohua Li -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/workqueue.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu - timer_stats_timer_set_start_info(&dwork->timer); - - dwork->wq = wq; -+ /* timer isn't guaranteed to run in this cpu, record earlier */ -+ if (cpu == WORK_CPU_UNBOUND) -+ cpu = raw_smp_processor_id(); - dwork->cpu = cpu; - timer->expires = jiffies + delay; - -- if (unlikely(cpu != WORK_CPU_UNBOUND)) -- add_timer_on(timer, cpu); -- else -- add_timer(timer); -+ add_timer_on(timer, cpu); - } - - /** diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index f141db33..822e4215 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -28,14 +28,20 @@ - patches/linux/patch-4.2.4.xz - + patches/linux/patch-4.2.5.xz + + + patches/mageia/stable-mac80211-fix-hwflags-debugfs-file-format.patch + patches/mageia/stable-ath9k-declare-required-extra-tx-headroom.patch + patches/mageia/stable-mmc-core-fix-init_card-in-52mhz.patch + patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch + patches/mageia/base-cacheinfo-silence-DT-warnings.patch patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch patches/mageia/pci-quirks-drop-devinit-exit.patch patches/mageia/acpi-CLEVO-M360S-disable_acpi_irq.patch @@ -55,7 +61,7 @@ patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch patches/mageia/fs-aufs4.patch patches/mageia/fs-aufs4-modular.patch - + patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -183,7 +189,15 @@ - + + + 2015-11-30 + 4.2.5 + Version bump to 4.2.5 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.5 + security + Ertuğrul Erata + ertugrulerata@gmail.com + 2015-11-27 4.2.4 diff --git a/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.3.xz b/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.3.xz deleted file mode 100644 index 8ba965b2..00000000 Binary files a/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.3.xz and /dev/null differ diff --git a/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.8.xz b/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.8.xz deleted file mode 100644 index c2d46113..00000000 Binary files a/kernel/tools/cpupowertools/files/patches/linux/patch-4.1.8.xz and /dev/null differ diff --git a/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.5.xz b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.5.xz new file mode 100644 index 00000000..fbb95167 Binary files /dev/null and b/kernel/tools/cpupowertools/files/patches/linux/patch-4.2.5.xz differ