From 3db0c8c92d686bac48b0d5fc5567211929922f6e Mon Sep 17 00:00:00 2001 From: ertugerata Date: Sat, 5 Sep 2015 23:42:50 +0300 Subject: [PATCH] add new patches.in 4.1.6 --- ..._64-Don-t-save-flags-on-context-swit.patch | 62 + ...LL-pointer-dereference-in-runtime-PM.patch | 83 + ...evert-libata-Implement-NCQ-autosense.patch | 120 + ...plement-support-for-sense-data-repor.patch | 212 ++ ...-Set-information-field-for-autosense.patch | 169 + ...ert-ext4-remove-block_device_ejected.patch | 53 + .../gpu-drm-i915-Avoid-TP3-on-CHV.patch | 81 + ...-remove-HBR2-from-chv-supported-list.patch | 44 + kernel/kernel/files/patches/mageia/series | 51 + ...-pxa-pxa3xx-fix-cken-register-access.patch | 38 + ...ees-when-releasing-metadata-snapshot.patch | 33 + ...able-drm-radeon-add-new-oland-pci-id.patch | 26 + ...rm-vmwgfx-fix-execbuf-locking-issues.patch | 60 + ...s-mci-csrows-array-elements-properly.patch | 39 + ...reed-memory-during-device-disconnect.patch | 52 + ...c-fix-limit-in-uclogic_tablet_enable.patch | 33 + ...-task-using-same-semaphore-set-exits.patch | 254 ++ ...sem.c-update-correct-memory-barriers.patch | 86 + ...e-iwlwifi-pcie-fix-prepare-card-flow.patch | 83 + ...-localmodconfig-use-kbuild-files-too.patch | 36 + ...olate-hugetlbfs-page-w-refcount-held.patch | 48 + ...age-refcount-of-unknown-non-lru-page.patch | 37 + .../patches/mageia/stable-net_41.mbox.patch | 3345 +++++++++++++++++ ...rf-fix-double-free-of-the-aux-buffer.patch | 49 + ...-fasync-handling-on-inherited-events.patch | 69 + ...perf_event_ioc_period-migration-race.patch | 125 + ...ble-perf-fix-running-time-accounting.patch | 49 + ...ter-memory-leak-fix-and-fix-the-leak.patch | 88 + ...erence-when-pci-driver-used-as-an-ap.patch | 59 + ...-module-parameter-for-msi-interrupts.patch | 30 + ...-xen-pv-apic-driver-for-domu-as-well.patch | 87 + ...th-work_busy-in-purge_persistent_gnt.patch | 40 + ...on-t-add-indirect-pages-to-list-when.patch | 44 + ...en-unmapping-the-ring-on-hvm-backend.patch | 40 + ...apic-Fix-fallout-from-x2apic-cleanup.patch | 81 + ...e-trace_cpu_idle-to-mwait_idle-calls.patch | 46 + kernel/kernel/pspec.xml | 23 +- 37 files changed, 5873 insertions(+), 2 deletions(-) create mode 100644 kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch create mode 100644 kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch create mode 100644 kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch create mode 100644 kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch create mode 100644 kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch create mode 100644 kernel/kernel/files/patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch create mode 100644 kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch create mode 100644 kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch create mode 100644 kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch create mode 100644 kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch create mode 100644 kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch diff --git a/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch b/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch new file mode 100644 index 00000000..12178194 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch @@ -0,0 +1,62 @@ +From 512255a2ad2c832ca7d4de9f31245f73781922d0 Mon Sep 17 00:00:00 2001 +From: Andy Lutomirski +Date: Mon, 17 Aug 2015 12:22:50 -0700 +Subject: [PATCH] Revert "sched/x86_64: Don't save flags on context switch" + +This reverts commit: + + 2c7577a75837 ("sched/x86_64: Don't save flags on context switch") + +It was a nice speedup. It's also not quite correct: SYSENTER +enables interrupts too early. + +We can re-add this optimization once the SYSENTER code is beaten +into shape, which should happen in 4.3 or 4.4. + +Signed-off-by: Andy Lutomirski +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: stable@vger.kernel.org # v3.19 +Link: http://lkml.kernel.org/r/85f56651f59f76624e80785a8fd3bdfdd089a818.1439838962.git.luto@kernel.org +Signed-off-by: Ingo Molnar +--- + arch/x86/include/asm/switch_to.h | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h +index 751bf4b..d7f3b3b 100644 +--- a/arch/x86/include/asm/switch_to.h ++++ b/arch/x86/include/asm/switch_to.h +@@ -79,12 +79,12 @@ do { \ + #else /* CONFIG_X86_32 */ + + /* frame pointer must be last for get_wchan */ +-#define SAVE_CONTEXT "pushq %%rbp ; movq %%rsi,%%rbp\n\t" +-#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp\t" ++#define SAVE_CONTEXT "pushf ; pushq %%rbp ; movq %%rsi,%%rbp\n\t" ++#define RESTORE_CONTEXT "movq %%rbp,%%rsi ; popq %%rbp ; popf\t" + + #define __EXTRA_CLOBBER \ + , "rcx", "rbx", "rdx", "r8", "r9", "r10", "r11", \ +- "r12", "r13", "r14", "r15", "flags" ++ "r12", "r13", "r14", "r15" + + #ifdef CONFIG_CC_STACKPROTECTOR + #define __switch_canary \ +@@ -100,11 +100,7 @@ do { \ + #define __switch_canary_iparam + #endif /* CC_STACKPROTECTOR */ + +-/* +- * There is no need to save or restore flags, because flags are always +- * clean in kernel mode, with the possible exception of IOPL. Kernel IOPL +- * has no effect. +- */ ++/* Save restore flags to clear handle leaking NT */ + #define switch_to(prev, next, last) \ + asm volatile(SAVE_CONTEXT \ + "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */ \ +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch b/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch new file mode 100644 index 00000000..e7623744 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch @@ -0,0 +1,83 @@ +From 49718f0fb8c9af192b33d8af3a2826db04025371 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 17 Aug 2015 11:02:42 -0400 +Subject: [PATCH] SCSI: Fix NULL pointer dereference in runtime PM +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +The routines in scsi_rpm.c assume that if a runtime-PM callback is +invoked for a SCSI device, it can only mean that the device's driver +has asked the block layer to handle the runtime power management (by +calling blk_pm_runtime_init(), which among other things sets q->dev). + +However, this assumption turns out to be wrong for things like the ses +driver. Normally ses devices are not allowed to do runtime PM, but +userspace can override this setting. If this happens, the kernel gets +a NULL pointer dereference when blk_post_runtime_resume() tries to use +the uninitialized q->dev pointer. + +This patch fixes the problem by calling the block layer's runtime-PM +routines only if the device's driver really does have a runtime-PM +callback routine. Since ses doesn't define any such callbacks, the +crash won't occur. + +This fixes Bugzilla #101371. + +Signed-off-by: Alan Stern +Reported-by: Stanisław Pitucha +Reported-by: Ilan Cohen +Tested-by: Ilan Cohen +Reviewed-by: Johannes Thumshirn +Cc: stable@vger.kernel.org +Signed-off-by: James Bottomley +--- + drivers/scsi/scsi_pm.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c +index 9e43ae1..e4b7998 100644 +--- a/drivers/scsi/scsi_pm.c ++++ b/drivers/scsi/scsi_pm.c +@@ -217,15 +217,15 @@ static int sdev_runtime_suspend(struct device *dev) + { + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + struct scsi_device *sdev = to_scsi_device(dev); +- int err; ++ int err = 0; + +- err = blk_pre_runtime_suspend(sdev->request_queue); +- if (err) +- return err; +- if (pm && pm->runtime_suspend) ++ if (pm && pm->runtime_suspend) { ++ err = blk_pre_runtime_suspend(sdev->request_queue); ++ if (err) ++ return err; + err = pm->runtime_suspend(dev); +- blk_post_runtime_suspend(sdev->request_queue, err); +- ++ blk_post_runtime_suspend(sdev->request_queue, err); ++ } + return err; + } + +@@ -248,11 +248,11 @@ static int sdev_runtime_resume(struct device *dev) + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + int err = 0; + +- blk_pre_runtime_resume(sdev->request_queue); +- if (pm && pm->runtime_resume) ++ if (pm && pm->runtime_resume) { ++ blk_pre_runtime_resume(sdev->request_queue); + err = pm->runtime_resume(dev); +- blk_post_runtime_resume(sdev->request_queue, err); +- ++ blk_post_runtime_resume(sdev->request_queue, err); ++ } + return err; + } + +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch new file mode 100644 index 00000000..dbb919f3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch @@ -0,0 +1,120 @@ +From 74a80d67b8316eb3fbeb73dafc060a5a0a708587 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:46:39 -0400 +Subject: [PATCH] Revert "libata: Implement NCQ autosense" + +This reverts commit 42b966fbf35da9c87f08d98f9b8978edf9e717cf. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Cc: stable@vger.kernel.org #v4.1+ +--- + drivers/ata/libata-eh.c | 18 ------------------ + drivers/ata/libata-scsi.c | 9 ++------- + drivers/ata/libata.h | 1 - + include/linux/ata.h | 2 -- + 4 files changed, 2 insertions(+), 28 deletions(-) + +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 16125be..cb0508a 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1592,8 +1592,6 @@ static int ata_eh_read_log_10h(struct ata_device *dev, + tf->hob_lbah = buf[10]; + tf->nsect = buf[12]; + tf->hob_nsect = buf[13]; +- if (ata_id_has_ncq_autosense(dev->id)) +- tf->auxiliary = buf[14] << 16 | buf[15] << 8 | buf[16]; + + return 0; + } +@@ -1791,18 +1789,6 @@ void ata_eh_analyze_ncq_error(struct ata_link *link) + memcpy(&qc->result_tf, &tf, sizeof(tf)); + qc->result_tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_LBA | ATA_TFLAG_LBA48; + qc->err_mask |= AC_ERR_DEV | AC_ERR_NCQ; +- if (qc->result_tf.auxiliary) { +- char sense_key, asc, ascq; +- +- sense_key = (qc->result_tf.auxiliary >> 16) & 0xff; +- asc = (qc->result_tf.auxiliary >> 8) & 0xff; +- ascq = qc->result_tf.auxiliary & 0xff; +- ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", +- sense_key, asc, ascq); +- ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); +- qc->flags |= ATA_QCFLAG_SENSE_VALID; +- } +- + ehc->i.err_mask &= ~AC_ERR_DEV; + } + +@@ -1832,10 +1818,6 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, + return ATA_EH_RESET; + } + +- /* Set by NCQ autosense */ +- if (qc->flags & ATA_QCFLAG_SENSE_VALID) +- return 0; +- + if (stat & (ATA_ERR | ATA_DF)) + qc->err_mask |= AC_ERR_DEV; + else +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index e1ecd2a..0d7f0da 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -270,11 +270,8 @@ DEVICE_ATTR(unload_heads, S_IRUGO | S_IWUSR, + ata_scsi_park_show, ata_scsi_park_store); + EXPORT_SYMBOL_GPL(dev_attr_unload_heads); + +-void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) ++static void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) + { +- if (!cmd) +- return; +- + cmd->result = (DRIVER_SENSE << 24) | SAM_STAT_CHECK_CONDITION; + + scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); +@@ -1780,9 +1777,7 @@ static void ata_scsi_qc_complete(struct ata_queued_cmd *qc) + ((cdb[2] & 0x20) || need_sense)) { + ata_gen_passthru_sense(qc); + } else { +- if (qc->flags & ATA_QCFLAG_SENSE_VALID) { +- cmd->result = SAM_STAT_CHECK_CONDITION; +- } else if (!need_sense) { ++ if (!need_sense) { + cmd->result = SAM_STAT_GOOD; + } else { + /* TODO: decide which descriptor format to use +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index 8cfdd96..f840ca1 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -137,7 +137,6 @@ extern int ata_scsi_add_hosts(struct ata_host *host, + struct scsi_host_template *sht); + extern void ata_scsi_scan_host(struct ata_port *ap, int sync); + extern int ata_scsi_offline_dev(struct ata_device *dev); +-extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); + extern void ata_scsi_media_change_notify(struct ata_device *dev); + extern void ata_scsi_hotplug(struct work_struct *work); + extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); +diff --git a/include/linux/ata.h b/include/linux/ata.h +index 0e6a782..d2992bf 100644 +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -528,8 +528,6 @@ struct ata_bmdma_prd { + #define ata_id_cdb_intr(id) (((id)[ATA_ID_CONFIG] & 0x60) == 0x20) + #define ata_id_has_da(id) ((id)[ATA_ID_SATA_CAPABILITY_2] & (1 << 4)) + #define ata_id_has_devslp(id) ((id)[ATA_ID_FEATURE_SUPP] & (1 << 8)) +-#define ata_id_has_ncq_autosense(id) \ +- ((id)[ATA_ID_FEATURE_SUPP] & (1 << 7)) + + static inline bool ata_id_has_hipm(const u16 *id) + { +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch new file mode 100644 index 00000000..69533d57 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch @@ -0,0 +1,212 @@ +From 84ded2f8e7dda336fc2fb3570726ceb3b3b3590f Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:45:34 -0400 +Subject: [PATCH] Revert "libata: Implement support for sense data reporting" + +This reverts commit fe7173c206de63fc28475ee6ae42ff95c05692de. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +ATA_ID_COMMAND_SET_3/4 constants are not reverted as they're used by +later changes. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Cc: stable@vger.kernel.org #v4.1+ +--- + drivers/ata/libata-core.c | 20 +---------- + drivers/ata/libata-eh.c | 86 ++--------------------------------------------- + include/linux/ata.h | 16 --------- + 3 files changed, 4 insertions(+), 118 deletions(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 426bc12..19bcb80 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2147,24 +2147,6 @@ static int ata_dev_config_ncq(struct ata_device *dev, + return 0; + } + +-static void ata_dev_config_sense_reporting(struct ata_device *dev) +-{ +- unsigned int err_mask; +- +- if (!ata_id_has_sense_reporting(dev->id)) +- return; +- +- if (ata_id_sense_reporting_enabled(dev->id)) +- return; +- +- err_mask = ata_dev_set_feature(dev, SETFEATURE_SENSE_DATA, 0x1); +- if (err_mask) { +- ata_dev_dbg(dev, +- "failed to enable Sense Data Reporting, Emask 0x%x\n", +- err_mask); +- } +-} +- + /** + * ata_dev_configure - Configure the specified ATA/ATAPI device + * @dev: Target device to configure +@@ -2387,7 +2369,7 @@ int ata_dev_configure(struct ata_device *dev) + dev->devslp_timing[i] = sata_setting[j]; + } + } +- ata_dev_config_sense_reporting(dev); ++ + dev->cdb_len = 16; + } + +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index af08d32..16125be 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1630,70 +1630,6 @@ unsigned int atapi_eh_tur(struct ata_device *dev, u8 *r_sense_key) + } + + /** +- * ata_eh_request_sense - perform REQUEST_SENSE_DATA_EXT +- * @dev: device to perform REQUEST_SENSE_SENSE_DATA_EXT to +- * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) +- * @dfl_sense_key: default sense key to use +- * +- * Perform REQUEST_SENSE_DATA_EXT after the device reported CHECK +- * SENSE. This function is EH helper. +- * +- * LOCKING: +- * Kernel thread context (may sleep). +- * +- * RETURNS: +- * encoded sense data on success, 0 on failure or if sense data +- * is not available. +- */ +-static u32 ata_eh_request_sense(struct ata_queued_cmd *qc, +- struct scsi_cmnd *cmd) +-{ +- struct ata_device *dev = qc->dev; +- struct ata_taskfile tf; +- unsigned int err_mask; +- +- if (!cmd) +- return 0; +- +- DPRINTK("ATA request sense\n"); +- ata_dev_warn(dev, "request sense\n"); +- if (!ata_id_sense_reporting_enabled(dev->id)) { +- ata_dev_warn(qc->dev, "sense data reporting disabled\n"); +- return 0; +- } +- ata_tf_init(dev, &tf); +- +- tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE; +- tf.flags |= ATA_TFLAG_LBA | ATA_TFLAG_LBA48; +- tf.command = ATA_CMD_REQ_SENSE_DATA; +- tf.protocol = ATA_PROT_NODATA; +- +- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0); +- /* +- * ACS-4 states: +- * The device may set the SENSE DATA AVAILABLE bit to one in the +- * STATUS field and clear the ERROR bit to zero in the STATUS field +- * to indicate that the command returned completion without an error +- * and the sense data described in table 306 is available. +- * +- * IOW the 'ATA_SENSE' bit might not be set even though valid +- * sense data is available. +- * So check for both. +- */ +- if ((tf.command & ATA_SENSE) || +- tf.lbah != 0 || tf.lbam != 0 || tf.lbal != 0) { +- ata_scsi_set_sense(cmd, tf.lbah, tf.lbam, tf.lbal); +- qc->flags |= ATA_QCFLAG_SENSE_VALID; +- ata_dev_warn(dev, "sense data %02x/%02x/%02x\n", +- tf.lbah, tf.lbam, tf.lbal); +- } else { +- ata_dev_warn(dev, "request sense failed stat %02x emask %x\n", +- tf.command, err_mask); +- } +- return err_mask; +-} +- +-/** + * atapi_eh_request_sense - perform ATAPI REQUEST_SENSE + * @dev: device to perform REQUEST_SENSE to + * @sense_buf: result sense data buffer (SCSI_SENSE_BUFFERSIZE bytes long) +@@ -1896,22 +1832,7 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, + return ATA_EH_RESET; + } + +- /* +- * Sense data reporting does not work if the +- * device fault bit is set. +- */ +- if ((stat & ATA_SENSE) && !(stat & ATA_DF) && +- !(qc->flags & ATA_QCFLAG_SENSE_VALID)) { +- if (!(qc->ap->pflags & ATA_PFLAG_FROZEN)) { +- tmp = ata_eh_request_sense(qc, qc->scsicmd); +- if (tmp) +- qc->err_mask |= tmp; +- } else { +- ata_dev_warn(qc->dev, "sense data available but port frozen\n"); +- } +- } +- +- /* Set by NCQ autosense or request sense above */ ++ /* Set by NCQ autosense */ + if (qc->flags & ATA_QCFLAG_SENSE_VALID) + return 0; + +@@ -2658,15 +2579,14 @@ static void ata_eh_link_report(struct ata_link *link) + + #ifdef CONFIG_ATA_VERBOSE_ERROR + if (res->command & (ATA_BUSY | ATA_DRDY | ATA_DF | ATA_DRQ | +- ATA_SENSE | ATA_ERR)) { ++ ATA_ERR)) { + if (res->command & ATA_BUSY) + ata_dev_err(qc->dev, "status: { Busy }\n"); + else +- ata_dev_err(qc->dev, "status: { %s%s%s%s%s}\n", ++ ata_dev_err(qc->dev, "status: { %s%s%s%s}\n", + res->command & ATA_DRDY ? "DRDY " : "", + res->command & ATA_DF ? "DF " : "", + res->command & ATA_DRQ ? "DRQ " : "", +- res->command & ATA_SENSE ? "SENSE " : "", + res->command & ATA_ERR ? "ERR " : ""); + } + +diff --git a/include/linux/ata.h b/include/linux/ata.h +index 6c78956..0e6a782 100644 +--- a/include/linux/ata.h ++++ b/include/linux/ata.h +@@ -385,8 +385,6 @@ enum { + SATA_SSP = 0x06, /* Software Settings Preservation */ + SATA_DEVSLP = 0x09, /* Device Sleep */ + +- SETFEATURE_SENSE_DATA = 0xC3, /* Sense Data Reporting feature */ +- + /* feature values for SET_MAX */ + ATA_SET_MAX_ADDR = 0x00, + ATA_SET_MAX_PASSWD = 0x01, +@@ -710,20 +708,6 @@ static inline bool ata_id_has_read_log_d + return id[ATA_ID_COMMAND_SET_3] & (1 << 3); + } + +-static inline bool ata_id_has_sense_reporting(const u16 *id) +-{ +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) +- return false; +- return id[ATA_ID_COMMAND_SET_3] & (1 << 6); +-} +- +-static inline bool ata_id_sense_reporting_enabled(const u16 *id) +-{ +- if (!(id[ATA_ID_CFS_ENABLE_2] & (1 << 15))) +- return false; +- return id[ATA_ID_COMMAND_SET_4] & (1 << 6); +-} +- + /** + * ata_id_major_version - get ATA level of drive + * @id: Identify data diff --git a/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch b/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch new file mode 100644 index 00000000..f51f3667 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch @@ -0,0 +1,169 @@ +From fe16d4f202c59a560533a223bc6375739ee30944 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Mon, 3 Aug 2015 11:41:33 -0400 +Subject: [PATCH] Revert "libata-eh: Set 'information' field for autosense" + +This reverts commit a1524f226a02aa6edebd90ae0752e97cfd78b159. + +As implemented, ACS-4 sense reporting for ATA devices bypasses error +diagnosis and handling in libata degrading EH behavior significantly. +Revert the related changes for now. + +Signed-off-by: Tejun Heo +Cc: Hannes Reinecke +Cc: stable@vger.kernel.org #v4.1+ +--- + drivers/ata/libata-core.c | 4 ++-- + drivers/ata/libata-eh.c | 3 --- + drivers/ata/libata-scsi.c | 12 ------------ + drivers/ata/libata.h | 5 +---- + drivers/scsi/scsi_error.c | 31 ------------------------------- + include/scsi/scsi_eh.h | 1 - + 6 files changed, 3 insertions(+), 53 deletions(-) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index db5d9f7..426bc12 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -694,11 +694,11 @@ static int ata_rwcmd_protocol(struct ata_taskfile *tf, struct ata_device *dev) + * RETURNS: + * Block address read from @tf. + */ +-u64 ata_tf_read_block(const struct ata_taskfile *tf, struct ata_device *dev) ++u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev) + { + u64 block = 0; + +- if (!dev || tf->flags & ATA_TFLAG_LBA) { ++ if (tf->flags & ATA_TFLAG_LBA) { + if (tf->flags & ATA_TFLAG_LBA48) { + block |= (u64)tf->hob_lbah << 40; + block |= (u64)tf->hob_lbam << 32; +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 7465031..af08d32 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -1864,7 +1864,6 @@ void ata_eh_analyze_ncq_error(struct ata_link *link) + ata_dev_dbg(dev, "NCQ Autosense %02x/%02x/%02x\n", + sense_key, asc, ascq); + ata_scsi_set_sense(qc->scsicmd, sense_key, asc, ascq); +- ata_scsi_set_sense_information(qc->scsicmd, &qc->result_tf); + qc->flags |= ATA_QCFLAG_SENSE_VALID; + } + +@@ -1907,8 +1906,6 @@ static unsigned int ata_eh_analyze_tf(struct ata_queued_cmd *qc, + tmp = ata_eh_request_sense(qc, qc->scsicmd); + if (tmp) + qc->err_mask |= tmp; +- else +- ata_scsi_set_sense_information(qc->scsicmd, tf); + } else { + ata_dev_warn(qc->dev, "sense data available but port frozen\n"); + } +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 641a61a..e1ecd2a 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -280,18 +280,6 @@ void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq) + scsi_build_sense_buffer(0, cmd->sense_buffer, sk, asc, ascq); + } + +-void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, +- const struct ata_taskfile *tf) +-{ +- u64 information; +- +- if (!cmd) +- return; +- +- information = ata_tf_read_block(tf, NULL); +- scsi_set_sense_information(cmd->sense_buffer, information); +-} +- + static ssize_t + ata_scsi_em_message_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) +diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h +index a998a17..8cfdd96 100644 +--- a/drivers/ata/libata.h ++++ b/drivers/ata/libata.h +@@ -67,8 +67,7 @@ extern struct ata_queued_cmd *ata_qc_new_init(struct ata_device *dev, int tag); + extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev, + u64 block, u32 n_block, unsigned int tf_flags, + unsigned int tag); +-extern u64 ata_tf_read_block(const struct ata_taskfile *tf, +- struct ata_device *dev); ++extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev); + extern unsigned ata_exec_internal(struct ata_device *dev, + struct ata_taskfile *tf, const u8 *cdb, + int dma_dir, void *buf, unsigned int buflen, +@@ -139,8 +138,6 @@ extern int ata_scsi_add_hosts(struct ata_host *host, + extern void ata_scsi_scan_host(struct ata_port *ap, int sync); + extern int ata_scsi_offline_dev(struct ata_device *dev); + extern void ata_scsi_set_sense(struct scsi_cmnd *cmd, u8 sk, u8 asc, u8 ascq); +-extern void ata_scsi_set_sense_information(struct scsi_cmnd *cmd, +- const struct ata_taskfile *tf); + extern void ata_scsi_media_change_notify(struct ata_device *dev); + extern void ata_scsi_hotplug(struct work_struct *work); + extern void ata_schedule_scsi_eh(struct Scsi_Host *shost); +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index 106884a..b79bbea 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -26,7 +26,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -2523,33 +2522,3 @@ void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq) + } + } + EXPORT_SYMBOL(scsi_build_sense_buffer); +- +-/** +- * scsi_set_sense_information - set the information field in a +- * formatted sense data buffer +- * @buf: Where to build sense data +- * @info: 64-bit information value to be set +- * +- **/ +-void scsi_set_sense_information(u8 *buf, u64 info) +-{ +- if ((buf[0] & 0x7f) == 0x72) { +- u8 *ucp, len; +- +- len = buf[7]; +- ucp = (char *)scsi_sense_desc_find(buf, len + 8, 0); +- if (!ucp) { +- buf[7] = len + 0xa; +- ucp = buf + 8 + len; +- } +- ucp[0] = 0; +- ucp[1] = 0xa; +- ucp[2] = 0x80; /* Valid bit */ +- ucp[3] = 0; +- put_unaligned_be64(info, &ucp[4]); +- } else if ((buf[0] & 0x7f) == 0x70) { +- buf[0] |= 0x80; +- put_unaligned_be64(info, &buf[3]); +- } +-} +-EXPORT_SYMBOL(scsi_set_sense_information); +diff --git a/include/scsi/scsi_eh.h b/include/scsi/scsi_eh.h +index 4942710..8d1d7fa 100644 +--- a/include/scsi/scsi_eh.h ++++ b/include/scsi/scsi_eh.h +@@ -28,7 +28,6 @@ extern int scsi_get_sense_info_fld(const u8 * sense_buffer, int sb_len, + u64 * info_out); + + extern void scsi_build_sense_buffer(int desc, u8 *buf, u8 key, u8 asc, u8 ascq); +-extern void scsi_set_sense_information(u8 *buf, u64 info); + + extern int scsi_ioctl_reset(struct scsi_device *, int __user *); + +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch b/kernel/kernel/files/patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch new file mode 100644 index 00000000..9e639714 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch @@ -0,0 +1,53 @@ +From 42378f40dd5bbe59fa41b0499f10789eb5d44d89 Mon Sep 17 00:00:00 2001 +From: Thomas Backlund +Date: Tue, 18 Aug 2015 22:24:50 +0300 +Subject: [PATCH] Revert "ext4: remove block_device_ejected" + +This reverts commit 08439fec266c3cc5702953b4f54bdf5649357de0. + +its reported on stable@ ml to break usb storage + +Signed-off-by: Thomas Backlund +--- + fs/ext4/super.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ca9d4a2..9829003 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -324,6 +324,22 @@ static void save_error_info(struct super_block *sb, const char *func, + ext4_commit_super(sb, 1); + } + ++/* ++ * The del_gendisk() function uninitializes the disk-specific data ++ * structures, including the bdi structure, without telling anyone ++ * else. Once this happens, any attempt to call mark_buffer_dirty() ++ * (for example, by ext4_commit_super), will cause a kernel OOPS. ++ * This is a kludge to prevent these oops until we can put in a proper ++ * hook in del_gendisk() to inform the VFS and file system layers. ++ */ ++static int block_device_ejected(struct super_block *sb) ++{ ++ struct inode *bd_inode = sb->s_bdev->bd_inode; ++ struct backing_dev_info *bdi = inode_to_bdi(bd_inode); ++ ++ return bdi->dev == NULL; ++} ++ + static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn) + { + struct super_block *sb = journal->j_private; +@@ -4590,7 +4606,7 @@ static int ext4_commit_super(struct super_block *sb, int sync) + struct buffer_head *sbh = EXT4_SB(sb)->s_sbh; + int error = 0; + +- if (!sbh) ++ if (!sbh || block_device_ejected(sb)) + return error; + if (buffer_write_io_error(sbh)) { + /* +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch b/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch new file mode 100644 index 00000000..8fb32d99 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch @@ -0,0 +1,81 @@ +From ed63baaf849e91c84ac3e042b1fd6a0af07c16f3 Mon Sep 17 00:00:00 2001 +From: "Thulasimani,Sivakumar" +Date: Tue, 18 Aug 2015 15:30:37 +0530 +Subject: [PATCH] drm/i915: Avoid TP3 on CHV +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This patch removes TP3 support on CHV since there is no support +for HBR2 on this platform. + +v2: rename the function to indicate it checks source rates (Jani) +v3: update comment to indicate TP3 dependency on HBR2 supported + hardware (Jani) + +Cc: stable@vger.kernel.org # v4.1+ +Reviewed-by: Ville Syrjälä +Signed-off-by: Sivakumar Thulasimani +[Jani: fixed a couple of checkpatch warnings.] +Signed-off-by: Jani Nikula + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 7ad0e0b..1df0e1f 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -1166,6 +1166,19 @@ intel_dp_sink_rates(struct intel_dp *intel_dp, const int **sink_rates) + return (intel_dp_max_link_bw(intel_dp) >> 3) + 1; + } + ++static bool intel_dp_source_supports_hbr2(struct drm_device *dev) ++{ ++ /* WaDisableHBR2:skl */ ++ if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) ++ return false; ++ ++ if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || ++ (INTEL_INFO(dev)->gen >= 9)) ++ return true; ++ else ++ return false; ++} ++ + static int + intel_dp_source_rates(struct drm_device *dev, const int **source_rates) + { +@@ -1176,12 +1189,8 @@ intel_dp_source_rates(struct drm_device *dev, const int **source_rates) + + *source_rates = default_rates; + +- /* WaDisableHBR2:skl */ +- if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) +- return (DP_LINK_BW_2_7 >> 3) + 1; +- +- if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || +- (INTEL_INFO(dev)->gen >= 9)) ++ /* This depends on the fact that 5.4 is last value in the array */ ++ if (intel_dp_source_supports_hbr2(dev)) + return (DP_LINK_BW_5_4 >> 3) + 1; + else + return (DP_LINK_BW_2_7 >> 3) + 1; +@@ -3936,10 +3945,15 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp) + } + } + +- /* Training Pattern 3 support, both source and sink */ ++ /* Training Pattern 3 support, Intel platforms that support HBR2 alone ++ * have support for TP3 hence that check is used along with dpcd check ++ * to ensure TP3 can be enabled. ++ * SKL < B0: due it's WaDisableHBR2 is the only exception where TP3 is ++ * supported but still not enabled. ++ */ + if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 && + intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED && +- (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)) { ++ intel_dp_source_supports_hbr2(dev)) { + intel_dp->use_tps3 = true; + DRM_DEBUG_KMS("Displayport TPS3 supported\n"); + } else +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch b/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch new file mode 100644 index 00000000..892f4d25 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch @@ -0,0 +1,44 @@ +From 5e86dfe39f54ab13fd8079ac3d6cb100318909a3 Mon Sep 17 00:00:00 2001 +From: "Thulasimani,Sivakumar" +Date: Tue, 18 Aug 2015 11:07:57 +0530 +Subject: [PATCH] drm/i915: remove HBR2 from chv supported list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This patch removes 5.4Gbps from supported link rate for CHV since +it is not supported in it. + +v2: change the ordering for better readability (Ville) + +Cc: stable@vger.kernel.org # v4.1+ +Reviewed-by: Ville Syrjälä +Signed-off-by: Sivakumar Thulasimani +Signed-off-by: Jani Nikula +--- + drivers/gpu/drm/i915/intel_dp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c +index 6c8bf34..7ad0e0b 100644 +--- a/drivers/gpu/drm/i915/intel_dp.c ++++ b/drivers/gpu/drm/i915/intel_dp.c +@@ -1176,11 +1176,12 @@ intel_dp_source_rates(struct drm_device *dev, const int **source_rates) + + *source_rates = default_rates; + ++ /* WaDisableHBR2:skl */ + if (IS_SKYLAKE(dev) && INTEL_REVID(dev) <= SKL_REVID_B0) +- /* WaDisableHBR2:skl */ + return (DP_LINK_BW_2_7 >> 3) + 1; +- else if (INTEL_INFO(dev)->gen >= 8 || +- (IS_HASWELL(dev) && !IS_HSW_ULX(dev))) ++ ++ if ((IS_HASWELL(dev) && !IS_HSW_ULX(dev)) || IS_BROADWELL(dev) || ++ (INTEL_INFO(dev)->gen >= 9)) + return (DP_LINK_BW_5_4 >> 3) + 1; + else + return (DP_LINK_BW_2_7 >> 3) + 1; +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index 21fc891b..f1c2fe31 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,6 +14,33 @@ ### ### Stable Queue ### +stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch +stable-ipc-sem.c-update-correct-memory-barriers.patch +stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch +stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch +stable-clk-pxa-pxa3xx-fix-cken-register-access.patch +stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch +stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch +stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch +stable-perf-fix-fasync-handling-on-inherited-events.patch +stable-perf-fix-running-time-accounting.patch +stable-perf-fix-double-free-of-the-aux-buffer.patch +stable-perf-fix-perf_event_ioc_period-migration-race.patch +stable-iwlwifi-pcie-fix-prepare-card-flow.patch +stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch +stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch +stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch +stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch +stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch +stable-localmodconfig-use-kbuild-files-too.patch +stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch +stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch +stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch +stable-drm-radeon-add-new-oland-pci-id.patch +stable-drm-vmwgfx-fix-execbuf-locking-issues.patch + +# DaveM +stable-net_41.mbox.patch ### ### Arch x86 @@ -38,6 +65,15 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch # slows down boot Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch +# wrong optimization +Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch + +# fix unbootable systems +x86-apic-Fix-fallout-from-x2apic-cleanup.patch + +# fixes powertop +x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch + ### ### Core ### @@ -120,6 +156,14 @@ ata-jmicron-disable-broken-async_suspend.patch block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch block-cfq-iosched-fix-the-setting-of-IOPS-mode-on-SSDs.patch +# libata eh breakage +ata-Revert-libata-eh-Set-information-field-for-autosense.patch +ata-Revert-libata-Implement-support-for-sense-data-repor.patch +ata-Revert-libata-Implement-NCQ-autosense.patch + +# ses driver crash +SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch + ### ### File-system ### @@ -128,6 +172,9 @@ block-cfq-iosched-fix-the-setting-of-IOPS-mode-on-SSDs.patch fs-aufs4.patch fs-aufs4-modular.patch +# ext4 +fs-Revert-ext4-remove-block_device_ejected.patch + ### ### FireWire ### @@ -161,6 +208,10 @@ gpu-drm-mach64-linux-3.14-buildfix.patch gpu-drm-mach64-3.17-buildfix.patch gpu-drm-mach64-3.18-buildfix.patch +# i915 +gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch +gpu-drm-i915-Avoid-TP3-on-CHV.patch + ### ### Hardware Monitoring ### diff --git a/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch b/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch new file mode 100644 index 00000000..203cd5f0 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-clk-pxa-pxa3xx-fix-cken-register-access.patch @@ -0,0 +1,38 @@ +From b93028c9af807b9474789e6aba34a6135b6cb708 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Tue, 4 Aug 2015 08:21:33 +0200 +Subject: clk: pxa: pxa3xx: fix CKEN register access + +From: Robert Jarzmik + +commit b93028c9af807b9474789e6aba34a6135b6cb708 upstream. + +Clocks 0 to 31 are on CKENA, and not CKENB. The clock register names +were inadequately inverted. As a consequence, all clock operations were +happening on CKENB, because almost all but 2 clocks are on CKENA. + +As the clocks were activated by the bootloader in the former tests, it +escaped the testing that the wrong clock gate was manipulated. The error +was revealed by changing the pxa3xx-nand driver to a module, where upon +unloading, the wrong clock was disabled in CKENB. + +Fixes: 9bbb8a338fb2 ("clk: pxa: add pxa3xx clock driver") +Signed-off-by: Robert Jarzmik +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/pxa/clk-pxa3xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/pxa/clk-pxa3xx.c ++++ b/drivers/clk/pxa/clk-pxa3xx.c +@@ -126,7 +126,7 @@ PARENTS(pxa3xx_ac97_bus) = { "ring_osc_6 + PARENTS(pxa3xx_sbus) = { "ring_osc_60mhz", "system_bus" }; + PARENTS(pxa3xx_smemcbus) = { "ring_osc_60mhz", "smemc" }; + +-#define CKEN_AB(bit) ((CKEN_ ## bit > 31) ? &CKENA : &CKENB) ++#define CKEN_AB(bit) ((CKEN_ ## bit > 31) ? &CKENB : &CKENA) + #define PXA3XX_CKEN(dev_id, con_id, parents, mult_lp, div_lp, mult_hp, \ + div_hp, bit, is_lp, flags) \ + PXA_CKEN(dev_id, con_id, bit, parents, mult_lp, div_lp, \ diff --git a/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch b/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch new file mode 100644 index 00000000..3f3678c8 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-dm-thin-metadata-delete-btrees-when-releasing-metadata-snapshot.patch @@ -0,0 +1,33 @@ +From 7f518ad0a212e2a6fd68630e176af1de395070a7 Mon Sep 17 00:00:00 2001 +From: Joe Thornber +Date: Wed, 12 Aug 2015 15:10:21 +0100 +Subject: dm thin metadata: delete btrees when releasing metadata snapshot + +From: Joe Thornber + +commit 7f518ad0a212e2a6fd68630e176af1de395070a7 upstream. + +The device details and mapping trees were just being decremented +before. Now btree_del() is called to do a deep delete. + +Signed-off-by: Joe Thornber +Signed-off-by: Mike Snitzer +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-thin-metadata.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -1295,8 +1295,8 @@ static int __release_metadata_snap(struc + return r; + + disk_super = dm_block_data(copy); +- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->data_mapping_root)); +- dm_sm_dec_block(pmd->metadata_sm, le64_to_cpu(disk_super->device_details_root)); ++ dm_btree_del(&pmd->info, le64_to_cpu(disk_super->data_mapping_root)); ++ dm_btree_del(&pmd->details_info, le64_to_cpu(disk_super->device_details_root)); + dm_sm_dec_block(pmd->metadata_sm, held_root); + + return dm_tm_unlock(pmd->tm, copy); diff --git a/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch b/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch new file mode 100644 index 00000000..fc3b4431 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-radeon-add-new-oland-pci-id.patch @@ -0,0 +1,26 @@ +From e037239e5e7b61007763984aa35a8329596d8c88 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 10 Aug 2015 15:28:49 -0400 +Subject: drm/radeon: add new OLAND pci id + +From: Alex Deucher + +commit e037239e5e7b61007763984aa35a8329596d8c88 upstream. + +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + include/drm/drm_pciids.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -172,6 +172,7 @@ + {0x1002, 0x6610, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6611, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6613, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6617, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6620, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6621, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6623, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_OLAND|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \ diff --git a/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch b/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch new file mode 100644 index 00000000..c8232310 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-drm-vmwgfx-fix-execbuf-locking-issues.patch @@ -0,0 +1,60 @@ +From 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Tue, 11 Aug 2015 22:31:17 -0700 +Subject: drm/vmwgfx: Fix execbuf locking issues + +From: Thomas Hellstrom + +commit 3e04e2fe6d87807d27521ad6ebb9e7919d628f25 upstream. + +This addresses two issues that cause problems with viewperf maya-03 in +situation with memory pressure. + +The first issue causes attempts to unreserve buffers if batched +reservation fails due to, for example, a signal pending. While previously +the ttm_eu api was resistant against this type of error, it is no longer +and the lockdep code will complain about attempting to unreserve buffers +that are not reserved. The issue is resolved by avoid calling +ttm_eu_backoff_reservation in the buffer reserve error path. + +The second issue is that the binding_mutex may be held when user-space +fence objects are created and hence during memory reclaims. This may cause +recursive attempts to grab the binding mutex. The issue is resolved by not +holding the binding mutex across fence creation and submission. + +Signed-off-by: Thomas Hellstrom +Reviewed-by: Sinclair Yeh +Signed-off-by: Dave Airlie +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -2492,7 +2492,7 @@ int vmw_execbuf_process(struct drm_file + ret = ttm_eu_reserve_buffers(&ticket, &sw_context->validate_nodes, + true, NULL); + if (unlikely(ret != 0)) +- goto out_err; ++ goto out_err_nores; + + ret = vmw_validate_buffers(dev_priv, sw_context); + if (unlikely(ret != 0)) +@@ -2536,6 +2536,7 @@ int vmw_execbuf_process(struct drm_file + vmw_resource_relocations_free(&sw_context->res_relocations); + + vmw_fifo_commit(dev_priv, command_size); ++ mutex_unlock(&dev_priv->binding_mutex); + + vmw_query_bo_switch_commit(dev_priv, sw_context); + ret = vmw_execbuf_fence_commands(file_priv, dev_priv, +@@ -2551,7 +2552,6 @@ int vmw_execbuf_process(struct drm_file + DRM_ERROR("Fence submission error. Syncing.\n"); + + vmw_resource_list_unreserve(&sw_context->resource_list, false); +- mutex_unlock(&dev_priv->binding_mutex); + + ttm_eu_fence_buffer_objects(&ticket, &sw_context->validate_nodes, + (void *) fence); diff --git a/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch b/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch new file mode 100644 index 00000000..bc5b51c9 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-edac-ppc4xx-access-mci-csrows-array-elements-properly.patch @@ -0,0 +1,39 @@ +From 5c16179b550b9fd8114637a56b153c9768ea06a5 Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Tue, 21 Jul 2015 11:00:53 +0200 +Subject: EDAC, ppc4xx: Access mci->csrows array elements properly + +From: Michael Walle + +commit 5c16179b550b9fd8114637a56b153c9768ea06a5 upstream. + +The commit + + de3910eb79ac ("edac: change the mem allocation scheme to + make Documentation/kobject.txt happy") + +changed the memory allocation for the csrows member. But ppc4xx_edac was +forgotten in the patch. Fix it. + +Signed-off-by: Michael Walle +Cc: linux-edac +Cc: Mauro Carvalho Chehab +Link: http://lkml.kernel.org/r/1437469253-8611-1-git-send-email-michael@walle.cc +Signed-off-by: Borislav Petkov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/edac/ppc4xx_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/ppc4xx_edac.c ++++ b/drivers/edac/ppc4xx_edac.c +@@ -920,7 +920,7 @@ static int ppc4xx_edac_init_csrows(struc + */ + + for (row = 0; row < mci->nr_csrows; row++) { +- struct csrow_info *csi = &mci->csrows[row]; ++ struct csrow_info *csi = mci->csrows[row]; + + /* + * Get the configuration settings for this diff --git a/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch b/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch new file mode 100644 index 00000000..a1548fe1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-hid-hid-input-fix-accessing-freed-memory-during-device-disconnect.patch @@ -0,0 +1,52 @@ +From 0621809e37936e7c2b3eac9165cf2aad7f9189eb Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 3 Aug 2015 14:57:30 +0900 +Subject: HID: hid-input: Fix accessing freed memory during device disconnect + +From: Krzysztof Kozlowski + +commit 0621809e37936e7c2b3eac9165cf2aad7f9189eb upstream. + +During unbinding the driver was dereferencing a pointer to memory +already freed by power_supply_unregister(). + +Driver was freeing its internal description of battery through pointers +stored in power_supply structure. However, because the core owns the +power supply instance, after calling power_supply_unregister() this +memory is freed and the driver cannot access these members. + +Fix this by storing the pointer to internal description of battery in a +local variable before calling power_supply_unregister(), so the pointer +remains valid. + +Signed-off-by: Krzysztof Kozlowski +Reported-by: H.J. Lu +Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core") +Reviewed-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-input.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -462,12 +462,15 @@ out: + + static void hidinput_cleanup_battery(struct hid_device *dev) + { ++ const struct power_supply_desc *psy_desc; ++ + if (!dev->battery) + return; + ++ psy_desc = dev->battery->desc; + power_supply_unregister(dev->battery); +- kfree(dev->battery->desc->name); +- kfree(dev->battery->desc); ++ kfree(psy_desc->name); ++ kfree(psy_desc); + dev->battery = NULL; + } + #else /* !CONFIG_HID_BATTERY_STRENGTH */ diff --git a/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch b/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch new file mode 100644 index 00000000..54b4f47c --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-hid-uclogic-fix-limit-in-uclogic_tablet_enable.patch @@ -0,0 +1,33 @@ +From 4a8e70f5d0d80675fc17b9ba1e62db8ca6b91775 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 29 Jul 2015 13:16:06 +0300 +Subject: HID: uclogic: fix limit in uclogic_tablet_enable() + +From: Dan Carpenter + +commit 4a8e70f5d0d80675fc17b9ba1e62db8ca6b91775 upstream. + +The limit should be ARRAY_SIZE(params) (5 elements) here instead of +sizeof(params) (20 bytes). + +Fixes: 08177f40bd00 ('HID: uclogic: merge hid-huion driver in hid-uclogic') +Signed-off-by: Dan Carpenter +Reviewed-by: Nikolai Kondrashov +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-uclogic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/hid-uclogic.c ++++ b/drivers/hid/hid-uclogic.c +@@ -858,7 +858,7 @@ static int uclogic_tablet_enable(struct + for (p = drvdata->rdesc; + p <= drvdata->rdesc + drvdata->rsize - 4;) { + if (p[0] == 0xFE && p[1] == 0xED && p[2] == 0x1D && +- p[3] < sizeof(params)) { ++ p[3] < ARRAY_SIZE(params)) { + v = params[p[3]]; + put_unaligned(cpu_to_le32(v), (s32 *)p); + p += 4; diff --git a/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch b/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch new file mode 100644 index 00000000..22323f88 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ipc-sem-fix-use-after-free-on-ipc_rmid-after-a-task-using-same-semaphore-set-exits.patch @@ -0,0 +1,254 @@ +From 602b8593d2b4138c10e922eeaafe306f6b51817b Mon Sep 17 00:00:00 2001 +From: "Herton R. Krzesinski" +Date: Fri, 14 Aug 2015 15:35:02 -0700 +Subject: ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits + +From: "Herton R. Krzesinski" + +commit 602b8593d2b4138c10e922eeaafe306f6b51817b upstream. + +The current semaphore code allows a potential use after free: in +exit_sem we may free the task's sem_undo_list while there is still +another task looping through the same semaphore set and cleaning the +sem_undo list at freeary function (the task called IPC_RMID for the same +semaphore set). + +For example, with a test program [1] running which keeps forking a lot +of processes (which then do a semop call with SEM_UNDO flag), and with +the parent right after removing the semaphore set with IPC_RMID, and a +kernel built with CONFIG_SLAB, CONFIG_SLAB_DEBUG and +CONFIG_DEBUG_SPINLOCK, you can easily see something like the following +in the kernel log: + + Slab corruption (Not tainted): kmalloc-64 start=ffff88003b45c1c0, len=64 + 000: 6b 6b 6b 6b 6b 6b 6b 6b 00 6b 6b 6b 6b 6b 6b 6b kkkkkkkk.kkkkkkk + 010: ff ff ff ff 6b 6b 6b 6b ff ff ff ff ff ff ff ff ....kkkk........ + Prev obj: start=ffff88003b45c180, len=64 + 000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a .....N......ZZZZ + 010: ff ff ff ff ff ff ff ff c0 fb 01 37 00 88 ff ff ...........7.... + Next obj: start=ffff88003b45c200, len=64 + 000: 00 00 00 00 ad 4e ad de ff ff ff ff 5a 5a 5a 5a .....N......ZZZZ + 010: ff ff ff ff ff ff ff ff 68 29 a7 3c 00 88 ff ff ........h).<.... + BUG: spinlock wrong CPU on CPU#2, test/18028 + general protection fault: 0000 [#1] SMP + Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib] + CPU: 2 PID: 18028 Comm: test Not tainted 4.2.0-rc5+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 + RIP: spin_dump+0x53/0xc0 + Call Trace: + spin_bug+0x30/0x40 + do_raw_spin_unlock+0x71/0xa0 + _raw_spin_unlock+0xe/0x10 + freeary+0x82/0x2a0 + ? _raw_spin_lock+0xe/0x10 + semctl_down.clone.0+0xce/0x160 + ? __do_page_fault+0x19a/0x430 + ? __audit_syscall_entry+0xa8/0x100 + SyS_semctl+0x236/0x2c0 + ? syscall_trace_leave+0xde/0x130 + entry_SYSCALL_64_fastpath+0x12/0x71 + Code: 8b 80 88 03 00 00 48 8d 88 60 05 00 00 48 c7 c7 a0 2c a4 81 31 c0 65 8b 15 eb 40 f3 7e e8 08 31 68 00 4d 85 e4 44 8b 4b 08 74 5e <45> 8b 84 24 88 03 00 00 49 8d 8c 24 60 05 00 00 8b 53 04 48 89 + RIP [] spin_dump+0x53/0xc0 + RSP + ---[ end trace 783ebb76612867a0 ]--- + NMI watchdog: BUG: soft lockup - CPU#3 stuck for 22s! [test:18053] + Modules linked in: 8021q mrp garp stp llc nf_conntrack_ipv4 nf_defrag_ipv4 ip6t_REJECT nf_reject_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter ip6_tables binfmt_misc ppdev input_leds joydev parport_pc parport floppy serio_raw virtio_balloon virtio_rng virtio_console virtio_net iosf_mbi crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcspkr qxl ttm drm_kms_helper drm snd_hda_codec_generic i2c_piix4 snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer snd soundcore crc32c_intel virtio_pci virtio_ring virtio pata_acpi ata_generic [last unloaded: speedstep_lib] + CPU: 3 PID: 18053 Comm: test Tainted: G D 4.2.0-rc5+ #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014 + RIP: native_read_tsc+0x0/0x20 + Call Trace: + ? delay_tsc+0x40/0x70 + __delay+0xf/0x20 + do_raw_spin_lock+0x96/0x140 + _raw_spin_lock+0xe/0x10 + sem_lock_and_putref+0x11/0x70 + SYSC_semtimedop+0x7bf/0x960 + ? handle_mm_fault+0xbf6/0x1880 + ? dequeue_task_fair+0x79/0x4a0 + ? __do_page_fault+0x19a/0x430 + ? kfree_debugcheck+0x16/0x40 + ? __do_page_fault+0x19a/0x430 + ? __audit_syscall_entry+0xa8/0x100 + ? do_audit_syscall_entry+0x66/0x70 + ? syscall_trace_enter_phase1+0x139/0x160 + SyS_semtimedop+0xe/0x10 + SyS_semop+0x10/0x20 + entry_SYSCALL_64_fastpath+0x12/0x71 + Code: 47 10 83 e8 01 85 c0 89 47 10 75 08 65 48 89 3d 1f 74 ff 7e c9 c3 0f 1f 44 00 00 55 48 89 e5 e8 87 17 04 00 66 90 c9 c3 0f 1f 00 <55> 48 89 e5 0f 31 89 c1 48 89 d0 48 c1 e0 20 89 c9 48 09 c8 c9 + Kernel panic - not syncing: softlockup: hung tasks + +I wasn't able to trigger any badness on a recent kernel without the +proper config debugs enabled, however I have softlockup reports on some +kernel versions, in the semaphore code, which are similar as above (the +scenario is seen on some servers running IBM DB2 which uses semaphore +syscalls). + +The patch here fixes the race against freeary, by acquiring or waiting +on the sem_undo_list lock as necessary (exit_sem can race with freeary, +while freeary sets un->semid to -1 and removes the same sem_undo from +list_proc or when it removes the last sem_undo). + +After the patch I'm unable to reproduce the problem using the test case +[1]. + +[1] Test case used below: + + #include + #include + #include + #include + #include + #include + #include + #include + #include + + #define NSEM 1 + #define NSET 5 + + int sid[NSET]; + + void thread() + { + struct sembuf op; + int s; + uid_t pid = getuid(); + + s = rand() % NSET; + op.sem_num = pid % NSEM; + op.sem_op = 1; + op.sem_flg = SEM_UNDO; + + semop(sid[s], &op, 1); + exit(EXIT_SUCCESS); + } + + void create_set() + { + int i, j; + pid_t p; + union { + int val; + struct semid_ds *buf; + unsigned short int *array; + struct seminfo *__buf; + } un; + + /* Create and initialize semaphore set */ + for (i = 0; i < NSET; i++) { + sid[i] = semget(IPC_PRIVATE , NSEM, 0644 | IPC_CREAT); + if (sid[i] < 0) { + perror("semget"); + exit(EXIT_FAILURE); + } + } + un.val = 0; + for (i = 0; i < NSET; i++) { + for (j = 0; j < NSEM; j++) { + if (semctl(sid[i], j, SETVAL, un) < 0) + perror("semctl"); + } + } + + /* Launch threads that operate on semaphore set */ + for (i = 0; i < NSEM * NSET * NSET; i++) { + p = fork(); + if (p < 0) + perror("fork"); + if (p == 0) + thread(); + } + + /* Free semaphore set */ + for (i = 0; i < NSET; i++) { + if (semctl(sid[i], NSEM, IPC_RMID)) + perror("IPC_RMID"); + } + + /* Wait for forked processes to exit */ + while (wait(NULL)) { + if (errno == ECHILD) + break; + }; + } + + int main(int argc, char **argv) + { + pid_t p; + + srand(time(NULL)); + + while (1) { + p = fork(); + if (p < 0) { + perror("fork"); + exit(EXIT_FAILURE); + } + if (p == 0) { + create_set(); + goto end; + } + + /* Wait for forked processes to exit */ + while (wait(NULL)) { + if (errno == ECHILD) + break; + }; + } + end: + return 0; + } + +[akpm@linux-foundation.org: use normal comment layout] +Signed-off-by: Herton R. Krzesinski +Acked-by: Manfred Spraul +Cc: Davidlohr Bueso +Cc: Rafael Aquini +CC: Aristeu Rozanski +Cc: David Jeffery +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman + +Signed-off-by: Linus Torvalds + +--- + ipc/sem.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -2074,17 +2074,28 @@ void exit_sem(struct task_struct *tsk) + rcu_read_lock(); + un = list_entry_rcu(ulp->list_proc.next, + struct sem_undo, list_proc); +- if (&un->list_proc == &ulp->list_proc) +- semid = -1; +- else +- semid = un->semid; ++ if (&un->list_proc == &ulp->list_proc) { ++ /* ++ * We must wait for freeary() before freeing this ulp, ++ * in case we raced with last sem_undo. There is a small ++ * possibility where we exit while freeary() didn't ++ * finish unlocking sem_undo_list. ++ */ ++ spin_unlock_wait(&ulp->lock); ++ rcu_read_unlock(); ++ break; ++ } ++ spin_lock(&ulp->lock); ++ semid = un->semid; ++ spin_unlock(&ulp->lock); + ++ /* exit_sem raced with IPC_RMID, nothing to do */ + if (semid == -1) { + rcu_read_unlock(); +- break; ++ continue; + } + +- sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, un->semid); ++ sma = sem_obtain_object_check(tsk->nsproxy->ipc_ns, semid); + /* exit_sem raced with IPC_RMID, nothing to do */ + if (IS_ERR(sma)) { + rcu_read_unlock(); diff --git a/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch b/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch new file mode 100644 index 00000000..c5fbdbfd --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-ipc-sem.c-update-correct-memory-barriers.patch @@ -0,0 +1,86 @@ +From 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 Mon Sep 17 00:00:00 2001 +From: Manfred Spraul +Date: Fri, 14 Aug 2015 15:35:10 -0700 +Subject: ipc/sem.c: update/correct memory barriers + +From: Manfred Spraul + +commit 3ed1f8a99d70ea1cd1508910eb107d0edcae5009 upstream. + +sem_lock() did not properly pair memory barriers: + +!spin_is_locked() and spin_unlock_wait() are both only control barriers. +The code needs an acquire barrier, otherwise the cpu might perform read +operations before the lock test. + +As no primitive exists inside and since it seems +noone wants another primitive, the code creates a local primitive within +ipc/sem.c. + +With regards to -stable: + +The change of sem_wait_array() is a bugfix, the change to sem_lock() is a +nop (just a preprocessor redefinition to improve the readability). The +bugfix is necessary for all kernels that use sem_wait_array() (i.e.: +starting from 3.10). + +Signed-off-by: Manfred Spraul +Reported-by: Oleg Nesterov +Acked-by: Peter Zijlstra (Intel) +Cc: "Paul E. McKenney" +Cc: Kirill Tkhai +Cc: Ingo Molnar +Cc: Josh Poimboeuf +Cc: Davidlohr Bueso +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + ipc/sem.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -253,6 +253,16 @@ static void sem_rcu_free(struct rcu_head + } + + /* ++ * spin_unlock_wait() and !spin_is_locked() are not memory barriers, they ++ * are only control barriers. ++ * The code must pair with spin_unlock(&sem->lock) or ++ * spin_unlock(&sem_perm.lock), thus just the control barrier is insufficient. ++ * ++ * smp_rmb() is sufficient, as writes cannot pass the control barrier. ++ */ ++#define ipc_smp_acquire__after_spin_is_unlocked() smp_rmb() ++ ++/* + * Wait until all currently ongoing simple ops have completed. + * Caller must own sem_perm.lock. + * New simple ops cannot start, because simple ops first check +@@ -275,6 +285,7 @@ static void sem_wait_array(struct sem_ar + sem = sma->sem_base + i; + spin_unlock_wait(&sem->lock); + } ++ ipc_smp_acquire__after_spin_is_unlocked(); + } + + /* +@@ -327,13 +338,12 @@ static inline int sem_lock(struct sem_ar + /* Then check that the global lock is free */ + if (!spin_is_locked(&sma->sem_perm.lock)) { + /* +- * The ipc object lock check must be visible on all +- * cores before rechecking the complex count. Otherwise +- * we can race with another thread that does: ++ * We need a memory barrier with acquire semantics, ++ * otherwise we can race with another thread that does: + * complex_count++; + * spin_unlock(sem_perm.lock); + */ +- smp_rmb(); ++ ipc_smp_acquire__after_spin_is_unlocked(); + + /* + * Now repeat the test of complex_count: diff --git a/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch b/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch new file mode 100644 index 00000000..6aa67a1e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-iwlwifi-pcie-fix-prepare-card-flow.patch @@ -0,0 +1,83 @@ +From c9fdec9f3970eeaa1b176422f46167f5f5158804 Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Mon, 20 Jul 2015 12:14:39 +0300 +Subject: iwlwifi: pcie: fix prepare card flow + +From: Emmanuel Grumbach + +commit c9fdec9f3970eeaa1b176422f46167f5f5158804 upstream. + +When the card is not owned by the PCIe bus, we need to +acquire ownership first. This flow is implemented in +iwl_pcie_prepare_card_hw. Because of a hardware bug, we +need to disable link power management before we can +request ownership otherwise the other user of the device +won't get notified that we are requesting the device which +will prevent us from acquire ownership. + +Same holds for the down flow where we need to make sure +that any other potential user is notified that the driver +is going down. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/trans.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c +@@ -457,10 +457,16 @@ static void iwl_pcie_apm_stop(struct iwl + if (trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) + iwl_set_bits_prph(trans, APMG_PCIDEV_STT_REG, + APMG_PCIDEV_STT_VAL_WAKE_ME); +- else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) ++ else if (trans->cfg->device_family == IWL_DEVICE_FAMILY_8000) { ++ iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, ++ CSR_RESET_LINK_PWR_MGMT_DISABLED); + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, + CSR_HW_IF_CONFIG_REG_PREPARE | + CSR_HW_IF_CONFIG_REG_ENABLE_PME); ++ mdelay(1); ++ iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, ++ CSR_RESET_LINK_PWR_MGMT_DISABLED); ++ } + mdelay(5); + } + +@@ -555,6 +561,10 @@ static int iwl_pcie_prepare_card_hw(stru + if (ret >= 0) + return 0; + ++ iwl_set_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, ++ CSR_RESET_LINK_PWR_MGMT_DISABLED); ++ msleep(1); ++ + for (iter = 0; iter < 10; iter++) { + /* If HW is not ready, prepare the conditions to check again */ + iwl_set_bit(trans, CSR_HW_IF_CONFIG_REG, +@@ -562,8 +572,10 @@ static int iwl_pcie_prepare_card_hw(stru + + do { + ret = iwl_pcie_set_hw_ready(trans); +- if (ret >= 0) +- return 0; ++ if (ret >= 0) { ++ ret = 0; ++ goto out; ++ } + + usleep_range(200, 1000); + t += 200; +@@ -573,6 +585,10 @@ static int iwl_pcie_prepare_card_hw(stru + + IWL_ERR(trans, "Couldn't prepare the card\n"); + ++out: ++ iwl_clear_bit(trans, CSR_DBG_LINK_PWR_MGMT_REG, ++ CSR_RESET_LINK_PWR_MGMT_DISABLED); ++ + return ret; + } + diff --git a/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch b/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch new file mode 100644 index 00000000..8fd1677b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-localmodconfig-use-kbuild-files-too.patch @@ -0,0 +1,36 @@ +From c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Mon, 27 Jul 2015 00:06:55 +0200 +Subject: localmodconfig: Use Kbuild files too + +From: Richard Weinberger + +commit c0ddc8c745b7f89c50385fd7aa03c78dc543fa7a upstream. + +In kbuild it is allowed to define objects in files named "Makefile" +and "Kbuild". +Currently localmodconfig reads objects only from "Makefile"s and misses +modules like nouveau. + +Link: http://lkml.kernel.org/r/1437948415-16290-1-git-send-email-richard@nod.at + +Reported-and-tested-by: Leonidas Spyropoulos +Signed-off-by: Richard Weinberger +Signed-off-by: Steven Rostedt +Signed-off-by: Greg Kroah-Hartman + +--- + scripts/kconfig/streamline_config.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/scripts/kconfig/streamline_config.pl ++++ b/scripts/kconfig/streamline_config.pl +@@ -137,7 +137,7 @@ my $ksource = ($ARGV[0] ? $ARGV[0] : '.' + my $kconfig = $ARGV[1]; + my $lsmod_file = $ENV{'LSMOD'}; + +-my @makefiles = `find $ksource -name Makefile 2>/dev/null`; ++my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`; + chomp @makefiles; + + my %depends; diff --git a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch new file mode 100644 index 00000000..66962bb1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-fail-isolate-hugetlbfs-page-w-refcount-held.patch @@ -0,0 +1,48 @@ +From 036138080a4376e5f3e5d0cca8ac99084c5cf06e Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Fri, 14 Aug 2015 15:34:59 -0700 +Subject: mm/hwpoison: fix fail isolate hugetlbfs page w/ refcount held + +From: Wanpeng Li + +commit 036138080a4376e5f3e5d0cca8ac99084c5cf06e upstream. + +Hugetlbfs pages will get a refcount in get_any_page() or +madvise_hwpoison() if soft offlining through madvise. The refcount which +is held by the soft offline path should be released if we fail to isolate +hugetlbfs pages. + +Fix it by reducing the refcount for both isolation success and failure. + +Signed-off-by: Wanpeng Li +Acked-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory-failure.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1589,13 +1589,12 @@ static int soft_offline_huge_page(struct + unlock_page(hpage); + + ret = isolate_huge_page(hpage, &pagelist); +- if (ret) { +- /* +- * get_any_page() and isolate_huge_page() takes a refcount each, +- * so need to drop one here. +- */ +- put_page(hpage); +- } else { ++ /* ++ * get_any_page() and isolate_huge_page() takes a refcount each, ++ * so need to drop one here. ++ */ ++ put_page(hpage); ++ if (!ret) { + pr_info("soft offline: %#lx hugepage failed to isolate\n", pfn); + return -EBUSY; + } diff --git a/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch new file mode 100644 index 00000000..5179e96a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-mm-hwpoison-fix-page-refcount-of-unknown-non-lru-page.patch @@ -0,0 +1,37 @@ +From 4f32be677b124a49459e2603321c7a5605ceb9f8 Mon Sep 17 00:00:00 2001 +From: Wanpeng Li +Date: Fri, 14 Aug 2015 15:34:56 -0700 +Subject: mm/hwpoison: fix page refcount of unknown non LRU page + +From: Wanpeng Li + +commit 4f32be677b124a49459e2603321c7a5605ceb9f8 upstream. + +After trying to drain pages from pagevec/pageset, we try to get reference +count of the page again, however, the reference count of the page is not +reduced if the page is still not on LRU list. + +Fix it by adding the put_page() to drop the page reference which is from +__get_any_page(). + +Signed-off-by: Wanpeng Li +Acked-by: Naoya Horiguchi +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/memory-failure.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1558,6 +1558,8 @@ static int get_any_page(struct page *pag + */ + ret = __get_any_page(page, pfn, 0); + if (!PageLRU(page)) { ++ /* Drop page reference which is from __get_any_page() */ ++ put_page(page); + pr_info("soft_offline: %#lx: unknown non LRU page type %lx\n", + pfn, page->flags); + return -EIO; diff --git a/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch b/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch new file mode 100644 index 00000000..0b56b06b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-net_41.mbox.patch @@ -0,0 +1,3345 @@ +From 8c2854df13fbdfb163bc66939d6d09bb0ca306f6 Mon Sep 17 00:00:00 2001 +From: Angga +Date: Fri, 3 Jul 2015 14:40:52 +1200 +Subject: [PATCH 01/46] ipv6: Make MLD packets to only be processed locally + +[ Upstream commit 4c938d22c88a9ddccc8c55a85e0430e9c62b1ac5 ] + +Before commit daad151263cf ("ipv6: Make ipv6_is_mld() inline and use it +from ip6_mc_input().") MLD packets were only processed locally. After the +change, a copy of MLD packet goes through ip6_mr_input, causing +MRT6MSG_NOCACHE message to be generated to user space. + +Make MLD packet only processed locally. + +Fixes: daad151263cf ("ipv6: Make ipv6_is_mld() inline and use it from ip6_mc_input().") +Signed-off-by: Hermin Anggawijaya +Signed-off-by: David S. Miller +--- + net/ipv6/ip6_input.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index f2e464e..57990c9 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -331,10 +331,10 @@ int ip6_mc_input(struct sk_buff *skb) + if (offset < 0) + goto out; + +- if (!ipv6_is_mld(skb, nexthdr, offset)) +- goto out; ++ if (ipv6_is_mld(skb, nexthdr, offset)) ++ deliver = true; + +- deliver = true; ++ goto out; + } + /* unknown RA - process it normally */ + } +-- +2.1.0 + + +From b8c2c9a2ae175da385649f0855b9b9fb03b6a799 Mon Sep 17 00:00:00 2001 +From: Phil Sutter +Date: Mon, 6 Jul 2015 15:51:20 +0200 +Subject: [PATCH 02/46] rhashtable: fix for resize events during table walk + +[ Upstream commit 142b942a75cb10ede1b42bf85368d41449ab4e3b ] + +If rhashtable_walk_next detects a resize operation in progress, it jumps +to the new table and continues walking that one. But it misses to drop +the reference to it's current item, leading it to continue traversing +the new table's bucket in which the current item is sorted into, and +after reaching that bucket's end continues traversing the new table's +second bucket instead of the first one, thereby potentially missing +items. + +This fixes the rhashtable runtime test for me. Bug probably introduced +by Herbert Xu's patch eddee5ba ("rhashtable: Fix walker behaviour during +rehash") although not explicitly tested. + +Fixes: eddee5ba ("rhashtable: Fix walker behaviour during rehash") +Signed-off-by: Phil Sutter +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +--- + lib/rhashtable.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index 8609378..cf910e4 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -612,6 +612,8 @@ next: + iter->skip = 0; + } + ++ iter->p = NULL; ++ + /* Ensure we see any new tables. */ + smp_rmb(); + +@@ -622,8 +624,6 @@ next: + return ERR_PTR(-EAGAIN); + } + +- iter->p = NULL; +- + out: + + return obj; +-- +2.1.0 + + +From 1ab639a7e8ab4f2263a5fdd611b33e0b9aff6b09 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 6 Jul 2015 17:13:26 +0200 +Subject: [PATCH 03/46] net: graceful exit from netif_alloc_netdev_queues() + +[ Upstream commit d339727c2b1a10f25e6636670ab6e1841170e328 ] + +User space can crash kernel with + +ip link add ifb10 numtxqueues 100000 type ifb + +We must replace a BUG_ON() by proper test and return -EINVAL for +crazy values. + +Fixes: 60877a32bce00 ("net: allow large number of tx queues") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/core/dev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index aa82f9a..4723914 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6297,7 +6297,8 @@ static int netif_alloc_netdev_queues(struct net_device *dev) + struct netdev_queue *tx; + size_t sz = count * sizeof(*tx); + +- BUG_ON(count < 1 || count > 0xffff); ++ if (count < 1 || count > 0xffff) ++ return -EINVAL; + + tx = kzalloc(sz, GFP_KERNEL | __GFP_NOWARN | __GFP_REPEAT); + if (!tx) { +-- +2.1.0 + + +From fa72557a85e0032a819bcd857de185da10799dd4 Mon Sep 17 00:00:00 2001 +From: Nicolas Dichtel +Date: Mon, 6 Jul 2015 17:25:10 +0200 +Subject: [PATCH 04/46] Revert "dev: set iflink to 0 for virtual interfaces" + +[ Upstream commit 95ec655bc465ccb2a3329d4aff9a45e3c8188db5 ] + +This reverts commit e1622baf54df8cc958bf29d71de5ad545ea7d93c. + +The side effect of this commit is to add a '@NONE' after each virtual +interface name with a 'ip link'. It may break existing scripts. + +Reported-by: Olivier Hartkopp +Signed-off-by: Nicolas Dichtel +Tested-by: Oliver Hartkopp +Signed-off-by: David S. Miller +--- + net/core/dev.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 4723914..877ec57 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -672,10 +672,6 @@ int dev_get_iflink(const struct net_device *dev) + if (dev->netdev_ops && dev->netdev_ops->ndo_get_iflink) + return dev->netdev_ops->ndo_get_iflink(dev); + +- /* If dev->rtnl_link_ops is set, it's a virtual interface. */ +- if (dev->rtnl_link_ops) +- return 0; +- + return dev->ifindex; + } + EXPORT_SYMBOL(dev_get_iflink); +-- +2.1.0 + + +From 75cead319911eab1b9813c55274b391128329d9b Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Tue, 7 Jul 2015 00:07:52 +0200 +Subject: [PATCH 05/46] rtnetlink: verify IFLA_VF_INFO attributes before + passing them to driver + +[ Upstream commit 4f7d2cdfdde71ffe962399b7020c674050329423 ] + +Jason Gunthorpe reported that since commit c02db8c6290b ("rtnetlink: make +SR-IOV VF interface symmetric"), we don't verify IFLA_VF_INFO attributes +anymore with respect to their policy, that is, ifla_vfinfo_policy[]. + +Before, they were part of ifla_policy[], but they have been nested since +placed under IFLA_VFINFO_LIST, that contains the attribute IFLA_VF_INFO, +which is another nested attribute for the actual VF attributes such as +IFLA_VF_MAC, IFLA_VF_VLAN, etc. + +Despite the policy being split out from ifla_policy[] in this commit, +it's never applied anywhere. nla_for_each_nested() only does basic nla_ok() +testing for struct nlattr, but it doesn't know about the data context and +their requirements. + +Fix, on top of Jason's initial work, does 1) parsing of the attributes +with the right policy, and 2) using the resulting parsed attribute table +from 1) instead of the nla_for_each_nested() loop (just like we used to +do when still part of ifla_policy[]). + +Reference: http://thread.gmane.org/gmane.linux.network/368913 +Fixes: c02db8c6290b ("rtnetlink: make SR-IOV VF interface symmetric") +Reported-by: Jason Gunthorpe +Cc: Chris Wright +Cc: Sucheta Chakraborty +Cc: Greg Rose +Cc: Jeff Kirsher +Cc: Rony Efraim +Cc: Vlad Zolotarov +Cc: Nicolas Dichtel +Cc: Thomas Graf +Signed-off-by: Jason Gunthorpe +Signed-off-by: Daniel Borkmann +Acked-by: Vlad Zolotarov +Signed-off-by: David S. Miller +--- + net/core/rtnetlink.c | 187 ++++++++++++++++++++++++++------------------------- + 1 file changed, 96 insertions(+), 91 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 8de3682..fe95cb7 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1287,10 +1287,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { + [IFLA_INFO_SLAVE_DATA] = { .type = NLA_NESTED }, + }; + +-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = { +- [IFLA_VF_INFO] = { .type = NLA_NESTED }, +-}; +- + static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = { + [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) }, + [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) }, +@@ -1437,96 +1433,98 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[]) + return 0; + } + +-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr) ++static int do_setvfinfo(struct net_device *dev, struct nlattr **tb) + { +- int rem, err = -EINVAL; +- struct nlattr *vf; + const struct net_device_ops *ops = dev->netdev_ops; ++ int err = -EINVAL; + +- nla_for_each_nested(vf, attr, rem) { +- switch (nla_type(vf)) { +- case IFLA_VF_MAC: { +- struct ifla_vf_mac *ivm; +- ivm = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_mac) +- err = ops->ndo_set_vf_mac(dev, ivm->vf, +- ivm->mac); +- break; +- } +- case IFLA_VF_VLAN: { +- struct ifla_vf_vlan *ivv; +- ivv = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_vlan) +- err = ops->ndo_set_vf_vlan(dev, ivv->vf, +- ivv->vlan, +- ivv->qos); +- break; +- } +- case IFLA_VF_TX_RATE: { +- struct ifla_vf_tx_rate *ivt; +- struct ifla_vf_info ivf; +- ivt = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_get_vf_config) +- err = ops->ndo_get_vf_config(dev, ivt->vf, +- &ivf); +- if (err) +- break; +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_rate) +- err = ops->ndo_set_vf_rate(dev, ivt->vf, +- ivf.min_tx_rate, +- ivt->rate); +- break; +- } +- case IFLA_VF_RATE: { +- struct ifla_vf_rate *ivt; +- ivt = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_rate) +- err = ops->ndo_set_vf_rate(dev, ivt->vf, +- ivt->min_tx_rate, +- ivt->max_tx_rate); +- break; +- } +- case IFLA_VF_SPOOFCHK: { +- struct ifla_vf_spoofchk *ivs; +- ivs = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_spoofchk) +- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, +- ivs->setting); +- break; +- } +- case IFLA_VF_LINK_STATE: { +- struct ifla_vf_link_state *ivl; +- ivl = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_link_state) +- err = ops->ndo_set_vf_link_state(dev, ivl->vf, +- ivl->link_state); +- break; +- } +- case IFLA_VF_RSS_QUERY_EN: { +- struct ifla_vf_rss_query_en *ivrssq_en; ++ if (tb[IFLA_VF_MAC]) { ++ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]); + +- ivrssq_en = nla_data(vf); +- err = -EOPNOTSUPP; +- if (ops->ndo_set_vf_rss_query_en) +- err = ops->ndo_set_vf_rss_query_en(dev, +- ivrssq_en->vf, +- ivrssq_en->setting); +- break; +- } +- default: +- err = -EINVAL; +- break; +- } +- if (err) +- break; ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_mac) ++ err = ops->ndo_set_vf_mac(dev, ivm->vf, ++ ivm->mac); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_VLAN]) { ++ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_vlan) ++ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan, ++ ivv->qos); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_TX_RATE]) { ++ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]); ++ struct ifla_vf_info ivf; ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_get_vf_config) ++ err = ops->ndo_get_vf_config(dev, ivt->vf, &ivf); ++ if (err < 0) ++ return err; ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_rate) ++ err = ops->ndo_set_vf_rate(dev, ivt->vf, ++ ivf.min_tx_rate, ++ ivt->rate); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_RATE]) { ++ struct ifla_vf_rate *ivt = nla_data(tb[IFLA_VF_RATE]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_rate) ++ err = ops->ndo_set_vf_rate(dev, ivt->vf, ++ ivt->min_tx_rate, ++ ivt->max_tx_rate); ++ if (err < 0) ++ return err; + } ++ ++ if (tb[IFLA_VF_SPOOFCHK]) { ++ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_spoofchk) ++ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf, ++ ivs->setting); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_LINK_STATE]) { ++ struct ifla_vf_link_state *ivl = nla_data(tb[IFLA_VF_LINK_STATE]); ++ ++ err = -EOPNOTSUPP; ++ if (ops->ndo_set_vf_link_state) ++ err = ops->ndo_set_vf_link_state(dev, ivl->vf, ++ ivl->link_state); ++ if (err < 0) ++ return err; ++ } ++ ++ if (tb[IFLA_VF_RSS_QUERY_EN]) { ++ struct ifla_vf_rss_query_en *ivrssq_en; ++ ++ err = -EOPNOTSUPP; ++ ivrssq_en = nla_data(tb[IFLA_VF_RSS_QUERY_EN]); ++ if (ops->ndo_set_vf_rss_query_en) ++ err = ops->ndo_set_vf_rss_query_en(dev, ivrssq_en->vf, ++ ivrssq_en->setting); ++ if (err < 0) ++ return err; ++ } ++ + return err; + } + +@@ -1722,14 +1720,21 @@ static int do_setlink(const struct sk_buff *skb, + } + + if (tb[IFLA_VFINFO_LIST]) { ++ struct nlattr *vfinfo[IFLA_VF_MAX + 1]; + struct nlattr *attr; + int rem; ++ + nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) { +- if (nla_type(attr) != IFLA_VF_INFO) { ++ if (nla_type(attr) != IFLA_VF_INFO || ++ nla_len(attr) < NLA_HDRLEN) { + err = -EINVAL; + goto errout; + } +- err = do_setvfinfo(dev, attr); ++ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr, ++ ifla_vf_policy); ++ if (err < 0) ++ goto errout; ++ err = do_setvfinfo(dev, vfinfo); + if (err < 0) + goto errout; + status |= DO_SETLINK_NOTIFY; +-- +2.1.0 + + +From e2205c42c1e82d357f7c5007f1507e0b9f341092 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timo=20Ter=C3=A4s?= +Date: Tue, 7 Jul 2015 08:34:13 +0300 +Subject: [PATCH 06/46] ip_tunnel: fix ipv4 pmtu check to honor inner ip header + df +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit fc24f2b2094366da8786f59f2606307e934cea17 ] + +Frag needed should be sent only if the inner header asked +to not fragment. Currently fragmentation is broken if the +tunnel has df set, but df was not asked in the original +packet. The tunnel's df needs to be still checked to update +internally the pmtu cache. + +Commit 23a3647bc4f93bac broke it, and this commit fixes +the ipv4 df check back to the way it was. + +Fixes: 23a3647bc4f93bac ("ip_tunnels: Use skb-len to PMTU check.") +Cc: Pravin B Shelar +Signed-off-by: Timo Teräs +Acked-by: Pravin B Shelar +Signed-off-by: David S. Miller +--- + net/ipv4/ip_tunnel.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 4c2c3ba..626d9e5 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -586,7 +586,8 @@ int ip_tunnel_encap(struct sk_buff *skb, struct ip_tunnel *t, + EXPORT_SYMBOL(ip_tunnel_encap); + + static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, +- struct rtable *rt, __be16 df) ++ struct rtable *rt, __be16 df, ++ const struct iphdr *inner_iph) + { + struct ip_tunnel *tunnel = netdev_priv(dev); + int pkt_size = skb->len - tunnel->hlen - dev->hard_header_len; +@@ -603,7 +604,8 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, + + if (skb->protocol == htons(ETH_P_IP)) { + if (!skb_is_gso(skb) && +- (df & htons(IP_DF)) && mtu < pkt_size) { ++ (inner_iph->frag_off & htons(IP_DF)) && ++ mtu < pkt_size) { + memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); + return -E2BIG; +@@ -737,7 +739,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, + goto tx_error; + } + +- if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off)) { ++ if (tnl_update_pmtu(dev, skb, rt, tnl_params->frag_off, inner_iph)) { + ip_rt_put(rt); + goto tx_error; + } +-- +2.1.0 + + +From b663e59e521c92aec57078e512f54fa6cabe998a Mon Sep 17 00:00:00 2001 +From: Stephen Smalley +Date: Tue, 7 Jul 2015 09:43:45 -0400 +Subject: [PATCH 07/46] net/tipc: initialize security state for new connection + socket + +[ Upstream commit fdd75ea8df370f206a8163786e7470c1277a5064 ] + +Calling connect() with an AF_TIPC socket would trigger a series +of error messages from SELinux along the lines of: +SELinux: Invalid class 0 +type=AVC msg=audit(1434126658.487:34500): avc: denied { } + for pid=292 comm="kworker/u16:5" scontext=system_u:system_r:kernel_t:s0 + tcontext=system_u:object_r:unlabeled_t:s0 tclass= + permissive=0 + +This was due to a failure to initialize the security state of the new +connection sock by the tipc code, leaving it with junk in the security +class field and an unlabeled secid. Add a call to security_sk_clone() +to inherit the security state from the parent socket. + +Reported-by: Tim Shearer +Signed-off-by: Stephen Smalley +Acked-by: Paul Moore +Acked-by: Ying Xue +Signed-off-by: David S. Miller +--- + net/tipc/socket.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index f485600..20cc6df 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2009,6 +2009,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags) + res = tipc_sk_create(sock_net(sock->sk), new_sock, 0, 1); + if (res) + goto exit; ++ security_sk_clone(sock->sk, new_sock->sk); + + new_sk = new_sock->sk; + new_tsock = tipc_sk(new_sk); +-- +2.1.0 + + +From b5e30ebfbf8c2b93970492ab66be1778b3114332 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 7 Jul 2015 15:55:56 +0200 +Subject: [PATCH 08/46] bridge: mdb: zero out the local br_ip variable before + use + +[ Upstream commit f1158b74e54f2e2462ba5e2f45a118246d9d5b43 ] + +Since commit b0e9a30dd669 ("bridge: Add vlan id to multicast groups") +there's a check in br_ip_equal() for a matching vlan id, but the mdb +functions were not modified to use (or at least zero it) so when an +entry was added it would have a garbage vlan id (from the local br_ip +variable in __br_mdb_add/del) and this would prevent it from being +matched and also deleted. So zero out the whole local ip var to protect +ourselves from future changes and also to fix the current bug, since +there's no vlan id support in the mdb uapi - use always vlan id 0. +Example before patch: +root@debian:~# bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent +root@debian:~# bridge mdb +dev br0 port eth1 grp 239.0.0.1 permanent +root@debian:~# bridge mdb del dev br0 port eth1 grp 239.0.0.1 permanent +RTNETLINK answers: Invalid argument + +After patch: +root@debian:~# bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent +root@debian:~# bridge mdb +dev br0 port eth1 grp 239.0.0.1 permanent +root@debian:~# bridge mdb del dev br0 port eth1 grp 239.0.0.1 permanent +root@debian:~# bridge mdb + +Signed-off-by: Nikolay Aleksandrov +Fixes: b0e9a30dd669 ("bridge: Add vlan id to multicast groups") +Signed-off-by: David S. Miller +--- + net/bridge/br_mdb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c +index e29ad70..cc00066 100644 +--- a/net/bridge/br_mdb.c ++++ b/net/bridge/br_mdb.c +@@ -371,6 +371,7 @@ static int __br_mdb_add(struct net *net, struct net_bridge *br, + if (!p || p->br != br || p->state == BR_STATE_DISABLED) + return -EINVAL; + ++ memset(&ip, 0, sizeof(ip)); + ip.proto = entry->addr.proto; + if (ip.proto == htons(ETH_P_IP)) + ip.u.ip4 = entry->addr.u.ip4; +@@ -417,6 +418,7 @@ static int __br_mdb_del(struct net_bridge *br, struct br_mdb_entry *entry) + if (!netif_running(br->dev) || br->multicast_disabled) + return -EINVAL; + ++ memset(&ip, 0, sizeof(ip)); + ip.proto = entry->addr.proto; + if (ip.proto == htons(ETH_P_IP)) { + if (timer_pending(&br->ip4_other_query.timer)) +-- +2.1.0 + + +From fe98c4431957e308595cc5af799cb9f86c0875d1 Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Wed, 8 Jul 2015 21:42:11 +0200 +Subject: [PATCH 09/46] net: pktgen: fix race between pktgen_thread_worker() + and kthread_stop() + +[ Upstream commit fecdf8be2d91e04b0a9a4f79ff06499a36f5d14f ] + +pktgen_thread_worker() is obviously racy, kthread_stop() can come +between the kthread_should_stop() check and set_current_state(). + +Signed-off-by: Oleg Nesterov +Reported-by: Jan Stancek +Reported-by: Marcelo Leitner +Signed-off-by: David S. Miller +--- + net/core/pktgen.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index 508155b..043ea186 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -3490,8 +3490,10 @@ static int pktgen_thread_worker(void *arg) + pktgen_rem_thread(t); + + /* Wait for kthread_stop */ +- while (!kthread_should_stop()) { ++ for (;;) { + set_current_state(TASK_INTERRUPTIBLE); ++ if (kthread_should_stop()) ++ break; + schedule(); + } + __set_current_state(TASK_RUNNING); +-- +2.1.0 + + +From 15d50c4f295d8403f6fd818391e04b2c4f3e9637 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 9 Jul 2015 18:56:07 +0200 +Subject: [PATCH 10/46] bridge: fix potential crash in __netdev_pick_tx() + +[ Upstream commit a7d35f9d73e9ffa74a02304b817e579eec632f67 ] + +Commit c29390c6dfee ("xps: must clear sender_cpu before forwarding") +fixed an issue in normal forward path, caused by sender_cpu & napi_id +skb fields being an union. + +Bridge is another point where skb can be forwarded, so we need +the same cure. + +Bug triggers if packet was received on a NIC using skb_mark_napi_id() + +Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices") +Signed-off-by: Eric Dumazet +Reported-by: Bob Liu +Tested-by: Bob Liu +Signed-off-by: David S. Miller +--- + net/bridge/br_forward.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c +index e97572b..0ff6e1b 100644 +--- a/net/bridge/br_forward.c ++++ b/net/bridge/br_forward.c +@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb) + } else { + skb_push(skb, ETH_HLEN); + br_drop_fake_rtable(skb); ++ skb_sender_cpu_clear(skb); + dev_queue_xmit(skb); + } + +-- +2.1.0 + + +From 7bb85c2bd072511dd095c3c8ecbe063064ba2c5f Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Thu, 9 Jul 2015 09:59:09 +0300 +Subject: [PATCH 11/46] net: do not process device backlog during + unregistration + +[ Upstream commit e9e4dd3267d0c5234c5c0f47440456b10875dec9 ] + +commit 381c759d9916 ("ipv4: Avoid crashing in ip_error") +fixes a problem where processed packet comes from device +with destroyed inetdev (dev->ip_ptr). This is not expected +because inetdev_destroy is called in NETDEV_UNREGISTER +phase and packets should not be processed after +dev_close_many() and synchronize_net(). Above fix is still +required because inetdev_destroy can be called for other +reasons. But it shows the real problem: backlog can keep +packets for long time and they do not hold reference to +device. Such packets are then delivered to upper levels +at the same time when device is unregistered. +Calling flush_backlog after NETDEV_UNREGISTER_FINAL still +accounts all packets from backlog but before that some packets +continue to be delivered to upper levels long after the +synchronize_net call which is supposed to wait the last +ones. Also, as Eric pointed out, processed packets, mostly +from other devices, can continue to add new packets to backlog. + +Fix the problem by moving flush_backlog early, after the +device driver is stopped and before the synchronize_net() call. +Then use netif_running check to make sure we do not add more +packets to backlog. We have to do it in enqueue_to_backlog +context when the local IRQ is disabled. As result, after the +flush_backlog and synchronize_net sequence all packets +should be accounted. + +Thanks to Eric W. Biederman for the test script and his +valuable feedback! + +Reported-by: Vittorio Gambaletta +Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue") +Cc: Eric W. Biederman +Cc: Stephen Hemminger +Signed-off-by: Julian Anastasov +Signed-off-by: David S. Miller +--- + net/core/dev.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 877ec57..cb49e01 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3337,6 +3337,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu, + local_irq_save(flags); + + rps_lock(sd); ++ if (!netif_running(skb->dev)) ++ goto drop; + qlen = skb_queue_len(&sd->input_pkt_queue); + if (qlen <= netdev_max_backlog && !skb_flow_limit(skb, qlen)) { + if (qlen) { +@@ -3358,6 +3360,7 @@ enqueue: + goto enqueue; + } + ++drop: + sd->dropped++; + rps_unlock(sd); + +@@ -6023,6 +6026,7 @@ static void rollback_registered_many(struct list_head *head) + unlist_netdevice(dev); + + dev->reg_state = NETREG_UNREGISTERING; ++ on_each_cpu(flush_backlog, dev, 1); + } + + synchronize_net(); +@@ -6647,8 +6651,6 @@ void netdev_run_todo(void) + + dev->reg_state = NETREG_UNREGISTERED; + +- on_each_cpu(flush_backlog, dev, 1); +- + netdev_wait_allrefs(dev); + + /* paranoia */ +-- +2.1.0 + + +From c979c0e11800c79634b6b9d33ddb8f4cc03c81fa Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Thu, 9 Jul 2015 09:59:10 +0300 +Subject: [PATCH 12/46] net: call rcu_read_lock early in process_backlog + +[ Upstream commit 2c17d27c36dcce2b6bf689f41a46b9e909877c21 ] + +Incoming packet should be either in backlog queue or +in RCU read-side section. Otherwise, the final sequence of +flush_backlog() and synchronize_net() may miss packets +that can run without device reference: + +CPU 1 CPU 2 + skb->dev: no reference + process_backlog:__skb_dequeue + process_backlog:local_irq_enable + +on_each_cpu for +flush_backlog => IPI(hardirq): flush_backlog + - packet not found in backlog + + CPU delayed ... +synchronize_net +- no ongoing RCU +read-side sections + +netdev_run_todo, +rcu_barrier: no +ongoing callbacks + __netif_receive_skb_core:rcu_read_lock + - too late +free dev + process packet for freed dev + +Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue") +Cc: Eric W. Biederman +Cc: Stephen Hemminger +Signed-off-by: Julian Anastasov +Signed-off-by: David S. Miller +--- + net/core/dev.c | 30 +++++++++++++++--------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index cb49e01..a42b232 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3666,8 +3666,6 @@ static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc) + + pt_prev = NULL; + +- rcu_read_lock(); +- + another_round: + skb->skb_iif = skb->dev->ifindex; + +@@ -3677,7 +3675,7 @@ another_round: + skb->protocol == cpu_to_be16(ETH_P_8021AD)) { + skb = skb_vlan_untag(skb); + if (unlikely(!skb)) +- goto unlock; ++ goto out; + } + + #ifdef CONFIG_NET_CLS_ACT +@@ -3707,7 +3705,7 @@ skip_taps: + if (static_key_false(&ingress_needed)) { + skb = handle_ing(skb, &pt_prev, &ret, orig_dev); + if (!skb) +- goto unlock; ++ goto out; + } + + skb->tc_verd = 0; +@@ -3724,7 +3722,7 @@ ncls: + if (vlan_do_receive(&skb)) + goto another_round; + else if (unlikely(!skb)) +- goto unlock; ++ goto out; + } + + rx_handler = rcu_dereference(skb->dev->rx_handler); +@@ -3736,7 +3734,7 @@ ncls: + switch (rx_handler(&skb)) { + case RX_HANDLER_CONSUMED: + ret = NET_RX_SUCCESS; +- goto unlock; ++ goto out; + case RX_HANDLER_ANOTHER: + goto another_round; + case RX_HANDLER_EXACT: +@@ -3790,8 +3788,7 @@ drop: + ret = NET_RX_DROP; + } + +-unlock: +- rcu_read_unlock(); ++out: + return ret; + } + +@@ -3822,29 +3819,30 @@ static int __netif_receive_skb(struct sk_buff *skb) + + static int netif_receive_skb_internal(struct sk_buff *skb) + { ++ int ret; ++ + net_timestamp_check(netdev_tstamp_prequeue, skb); + + if (skb_defer_rx_timestamp(skb)) + return NET_RX_SUCCESS; + ++ rcu_read_lock(); ++ + #ifdef CONFIG_RPS + if (static_key_false(&rps_needed)) { + struct rps_dev_flow voidflow, *rflow = &voidflow; +- int cpu, ret; +- +- rcu_read_lock(); +- +- cpu = get_rps_cpu(skb->dev, skb, &rflow); ++ int cpu = get_rps_cpu(skb->dev, skb, &rflow); + + if (cpu >= 0) { + ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail); + rcu_read_unlock(); + return ret; + } +- rcu_read_unlock(); + } + #endif +- return __netif_receive_skb(skb); ++ ret = __netif_receive_skb(skb); ++ rcu_read_unlock(); ++ return ret; + } + + /** +@@ -4389,8 +4387,10 @@ static int process_backlog(struct napi_struct *napi, int quota) + struct sk_buff *skb; + + while ((skb = __skb_dequeue(&sd->process_queue))) { ++ rcu_read_lock(); + local_irq_enable(); + __netif_receive_skb(skb); ++ rcu_read_unlock(); + local_irq_disable(); + input_queue_head_incr(sd); + if (++work >= quota) { +-- +2.1.0 + + +From 9648a7edaa4326282fef3dbb8de9756d8edbfd0a Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sun, 12 Jul 2015 01:20:55 +0300 +Subject: [PATCH 13/46] net/xen-netback: off by one in BUG_ON() condition + +[ Upstream commit 50c2e4dd6749725338621fff456b26d3a592259f ] + +The > should be >=. I also added spaces around the '-' operations so +the code is a little more consistent and matches the condition better. + +Fixes: f53c3fe8dad7 ('xen-netback: Introduce TX grant mapping') +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +--- + drivers/net/xen-netback/netback.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c +index 0d25943..0866c5d 100644 +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -1571,13 +1571,13 @@ static inline void xenvif_tx_dealloc_action(struct xenvif_queue *queue) + smp_rmb(); + + while (dc != dp) { +- BUG_ON(gop - queue->tx_unmap_ops > MAX_PENDING_REQS); ++ BUG_ON(gop - queue->tx_unmap_ops >= MAX_PENDING_REQS); + pending_idx = + queue->dealloc_ring[pending_index(dc++)]; + +- pending_idx_release[gop-queue->tx_unmap_ops] = ++ pending_idx_release[gop - queue->tx_unmap_ops] = + pending_idx; +- queue->pages_to_unmap[gop-queue->tx_unmap_ops] = ++ queue->pages_to_unmap[gop - queue->tx_unmap_ops] = + queue->mmap_pages[pending_idx]; + gnttab_set_unmap_op(gop, + idx_to_kaddr(queue, pending_idx), +-- +2.1.0 + + +From d015db1b0649539f4473113aec24589a84c49dda Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Mon, 13 Jul 2015 16:04:13 +0800 +Subject: [PATCH 14/46] net: Clone skb before setting peeked flag + +[ Upstream commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ] + +Shared skbs must not be modified and this is crucial for broadcast +and/or multicast paths where we use it as an optimisation to avoid +unnecessary cloning. + +The function skb_recv_datagram breaks this rule by setting peeked +without cloning the skb first. This causes funky races which leads +to double-free. + +This patch fixes this by cloning the skb and replacing the skb +in the list when setting skb->peeked. + +Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv") +Reported-by: Konstantin Khlebnikov +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +--- + net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++--- + 1 file changed, 38 insertions(+), 3 deletions(-) + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index b80fb91..4e9a3f6 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -131,6 +131,35 @@ out_noerr: + goto out; + } + ++static int skb_set_peeked(struct sk_buff *skb) ++{ ++ struct sk_buff *nskb; ++ ++ if (skb->peeked) ++ return 0; ++ ++ /* We have to unshare an skb before modifying it. */ ++ if (!skb_shared(skb)) ++ goto done; ++ ++ nskb = skb_clone(skb, GFP_ATOMIC); ++ if (!nskb) ++ return -ENOMEM; ++ ++ skb->prev->next = nskb; ++ skb->next->prev = nskb; ++ nskb->prev = skb->prev; ++ nskb->next = skb->next; ++ ++ consume_skb(skb); ++ skb = nskb; ++ ++done: ++ skb->peeked = 1; ++ ++ return 0; ++} ++ + /** + * __skb_recv_datagram - Receive a datagram skbuff + * @sk: socket +@@ -165,7 +194,9 @@ out_noerr: + struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, + int *peeked, int *off, int *err) + { ++ struct sk_buff_head *queue = &sk->sk_receive_queue; + struct sk_buff *skb, *last; ++ unsigned long cpu_flags; + long timeo; + /* + * Caller is allowed not to check sk->sk_err before skb_recv_datagram() +@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, + * Look at current nfs client by the way... + * However, this function was correct in any case. 8) + */ +- unsigned long cpu_flags; +- struct sk_buff_head *queue = &sk->sk_receive_queue; + int _off = *off; + + last = (struct sk_buff *)queue; +@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, + _off -= skb->len; + continue; + } +- skb->peeked = 1; ++ ++ error = skb_set_peeked(skb); ++ if (error) ++ goto unlock_err; ++ + atomic_inc(&skb->users); + } else + __skb_unlink(skb, queue); +@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, + + return NULL; + ++unlock_err: ++ spin_unlock_irqrestore(&queue->lock, cpu_flags); + no_packet: + *err = error; + return NULL; +-- +2.1.0 + + +From cf2492918d52dee5f35b16cbba65d7000ff35ce2 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Mon, 13 Jul 2015 20:01:42 +0800 +Subject: [PATCH 15/46] net: Fix skb csum races when peeking + +[ Upstream commit 89c22d8c3b278212eef6a8cc66b570bc840a6f5a ] + +When we calculate the checksum on the recv path, we store the +result in the skb as an optimisation in case we need the checksum +again down the line. + +This is in fact bogus for the MSG_PEEK case as this is done without +any locking. So multiple threads can peek and then store the result +to the same skb, potentially resulting in bogus skb states. + +This patch fixes this by only storing the result if the skb is not +shared. This preserves the optimisations for the few cases where +it can be done safely due to locking or other reasons, e.g., SIOCINQ. + +Signed-off-by: Herbert Xu +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/core/datagram.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 4e9a3f6..4967262 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -657,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) + !skb->csum_complete_sw) + netdev_rx_csum_fault(skb->dev); + } +- skb->csum_valid = !sum; ++ if (!skb_shared(skb)) ++ skb->csum_valid = !sum; + return sum; + } + EXPORT_SYMBOL(__skb_checksum_complete_head); +@@ -677,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb) + netdev_rx_csum_fault(skb->dev); + } + +- /* Save full packet checksum */ +- skb->csum = csum; +- skb->ip_summed = CHECKSUM_COMPLETE; +- skb->csum_complete_sw = 1; +- skb->csum_valid = !sum; ++ if (!skb_shared(skb)) { ++ /* Save full packet checksum */ ++ skb->csum = csum; ++ skb->ip_summed = CHECKSUM_COMPLETE; ++ skb->csum_complete_sw = 1; ++ skb->csum_valid = !sum; ++ } + + return sum; + } +-- +2.1.0 + + +From e2d3e7bcf6679da22c3a68837c4b3c78db3ec110 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Tue, 4 Aug 2015 15:42:47 +0800 +Subject: [PATCH 16/46] net: Fix skb_set_peeked use-after-free bug + +[ Upstream commit a0a2a6602496a45ae838a96db8b8173794b5d398 ] + +The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone +skb before setting peeked flag") introduced a use-after-free bug +in skb_recv_datagram. This is because skb_set_peeked may create +a new skb and free the existing one. As it stands the caller will +continue to use the old freed skb. + +This patch fixes it by making skb_set_peeked return the new skb +(or the old one if unchanged). + +Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag") +Reported-by: Brenden Blanco +Signed-off-by: Herbert Xu +Tested-by: Brenden Blanco +Reviewed-by: Konstantin Khlebnikov +Signed-off-by: David S. Miller +--- + net/core/datagram.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/net/core/datagram.c b/net/core/datagram.c +index 4967262..617088a 100644 +--- a/net/core/datagram.c ++++ b/net/core/datagram.c +@@ -131,12 +131,12 @@ out_noerr: + goto out; + } + +-static int skb_set_peeked(struct sk_buff *skb) ++static struct sk_buff *skb_set_peeked(struct sk_buff *skb) + { + struct sk_buff *nskb; + + if (skb->peeked) +- return 0; ++ return skb; + + /* We have to unshare an skb before modifying it. */ + if (!skb_shared(skb)) +@@ -144,7 +144,7 @@ static int skb_set_peeked(struct sk_buff *skb) + + nskb = skb_clone(skb, GFP_ATOMIC); + if (!nskb) +- return -ENOMEM; ++ return ERR_PTR(-ENOMEM); + + skb->prev->next = nskb; + skb->next->prev = nskb; +@@ -157,7 +157,7 @@ static int skb_set_peeked(struct sk_buff *skb) + done: + skb->peeked = 1; + +- return 0; ++ return skb; + } + + /** +@@ -229,8 +229,9 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, + continue; + } + +- error = skb_set_peeked(skb); +- if (error) ++ skb = skb_set_peeked(skb); ++ error = PTR_ERR(skb); ++ if (IS_ERR(skb)) + goto unlock_err; + + atomic_inc(&skb->users); +-- +2.1.0 + + +From f82e3fd078652a9b64f6b129d5b8eddb76481093 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Mon, 13 Jul 2015 06:36:19 -0700 +Subject: [PATCH 17/46] bridge: mdb: fix double add notification + +[ Upstream commit 5ebc784625ea68a9570d1f70557e7932988cd1b4 ] + +Since the mdb add/del code was introduced there have been 2 br_mdb_notify +calls when doing br_mdb_add() resulting in 2 notifications on each add. + +Example: + Command: bridge mdb add dev br0 port eth1 grp 239.0.0.1 permanent + Before patch: + root@debian:~# bridge monitor all + [MDB]dev br0 port eth1 grp 239.0.0.1 permanent + [MDB]dev br0 port eth1 grp 239.0.0.1 permanent + + After patch: + root@debian:~# bridge monitor all + [MDB]dev br0 port eth1 grp 239.0.0.1 permanent + +Signed-off-by: Nikolay Aleksandrov +Fixes: cfd567543590 ("bridge: add support of adding and deleting mdb entries") +Signed-off-by: David S. Miller +--- + net/bridge/br_mdb.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/net/bridge/br_mdb.c b/net/bridge/br_mdb.c +index cc00066..d1f910c 100644 +--- a/net/bridge/br_mdb.c ++++ b/net/bridge/br_mdb.c +@@ -348,7 +348,6 @@ static int br_mdb_add_group(struct net_bridge *br, struct net_bridge_port *port, + return -ENOMEM; + rcu_assign_pointer(*pp, p); + +- br_mdb_notify(br->dev, port, group, RTM_NEWMDB); + return 0; + } + +-- +2.1.0 + + +From 8e96bd6de5d8c4acd2faeb9b950bd2ff42a8275a Mon Sep 17 00:00:00 2001 +From: WANG Cong +Date: Mon, 13 Jul 2015 12:30:07 -0700 +Subject: [PATCH 18/46] fq_codel: fix a use-after-free + +[ Upstream commit 052cbda41fdc243a8d40cce7ab3a6327b4b2887e ] + +Fixes: 25331d6ce42b ("net: sched: implement qstat helper routines") +Cc: John Fastabend +Signed-off-by: Cong Wang +Signed-off-by: Cong Wang +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/sched/sch_fq_codel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index c244c45b..9291598 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -162,10 +162,10 @@ static unsigned int fq_codel_drop(struct Qdisc *sch) + skb = dequeue_head(flow); + len = qdisc_pkt_len(skb); + q->backlogs[idx] -= len; +- kfree_skb(skb); + sch->q.qlen--; + qdisc_qstats_drop(sch); + qdisc_qstats_backlog_dec(sch, skb); ++ kfree_skb(skb); + flow->dropped++; + return idx; + } +-- +2.1.0 + + +From d4657581d01faad94a50b03f31bbe33c3b6dcb14 Mon Sep 17 00:00:00 2001 +From: Tilman Schmidt +Date: Tue, 14 Jul 2015 00:37:13 +0200 +Subject: [PATCH 19/46] isdn/gigaset: reset tty->receive_room when attaching + ser_gigaset + +[ Upstream commit fd98e9419d8d622a4de91f76b306af6aa627aa9c ] + +Commit 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc"), +first merged in kernel release 3.10, caused the following regression +in the Gigaset M101 driver: + +Before that commit, when closing the N_TTY line discipline in +preparation to switching to N_GIGASET_M101, receive_room would be +reset to a non-zero value by the call to n_tty_flush_buffer() in +n_tty's close method. With the removal of that call, receive_room +might be left at zero, blocking data reception on the serial line. + +The present patch fixes that regression by setting receive_room +to an appropriate value in the ldisc open method. + +Fixes: 79901317ce80 ("n_tty: Don't flush buffer when closing ldisc") +Signed-off-by: Tilman Schmidt +Signed-off-by: David S. Miller +--- + drivers/isdn/gigaset/ser-gigaset.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c +index 8c91fd5..3ac9c41 100644 +--- a/drivers/isdn/gigaset/ser-gigaset.c ++++ b/drivers/isdn/gigaset/ser-gigaset.c +@@ -524,9 +524,18 @@ gigaset_tty_open(struct tty_struct *tty) + cs->hw.ser->tty = tty; + atomic_set(&cs->hw.ser->refcnt, 1); + init_completion(&cs->hw.ser->dead_cmp); +- + tty->disc_data = cs; + ++ /* Set the amount of data we're willing to receive per call ++ * from the hardware driver to half of the input buffer size ++ * to leave some reserve. ++ * Note: We don't do flow control towards the hardware driver. ++ * If more data is received than will fit into the input buffer, ++ * it will be dropped and an error will be logged. This should ++ * never happen as the device is slow and the buffer size ample. ++ */ ++ tty->receive_room = RBUFSIZE/2; ++ + /* OK.. Initialization of the datastructures and the HW is done.. Now + * startup system and notify the LL that we are ready to run + */ +-- +2.1.0 + + +From a5802a78d70219bb1f2e5f6726486e3834b1270d Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 14 Jul 2015 08:10:22 +0200 +Subject: [PATCH 20/46] ipv6: lock socket in ip6_datagram_connect() + +[ Upstream commit 03645a11a570d52e70631838cb786eb4253eb463 ] + +ip6_datagram_connect() is doing a lot of socket changes without +socket being locked. + +This looks wrong, at least for udp_lib_rehash() which could corrupt +lists because of concurrent udp_sk(sk)->udp_portaddr_hash accesses. + +Signed-off-by: Eric Dumazet +Acked-by: Herbert Xu +Signed-off-by: David S. Miller +--- + include/net/ip.h | 1 + + net/ipv4/datagram.c | 16 ++++++++++++---- + net/ipv6/datagram.c | 20 +++++++++++++++----- + 3 files changed, 28 insertions(+), 9 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index d14af7e..f41fc49 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -161,6 +161,7 @@ static inline __u8 get_rtconn_flags(struct ipcm_cookie* ipc, struct sock* sk) + } + + /* datagram.c */ ++int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); + int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); + + void ip4_datagram_release_cb(struct sock *sk); +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index 90c0e83..574fad9 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -20,7 +20,7 @@ + #include + #include + +-int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) ++int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + { + struct inet_sock *inet = inet_sk(sk); + struct sockaddr_in *usin = (struct sockaddr_in *) uaddr; +@@ -39,8 +39,6 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + + sk_dst_reset(sk); + +- lock_sock(sk); +- + oif = sk->sk_bound_dev_if; + saddr = inet->inet_saddr; + if (ipv4_is_multicast(usin->sin_addr.s_addr)) { +@@ -82,9 +80,19 @@ int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + sk_dst_set(sk, &rt->dst); + err = 0; + out: +- release_sock(sk); + return err; + } ++EXPORT_SYMBOL(__ip4_datagram_connect); ++ ++int ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) ++{ ++ int res; ++ ++ lock_sock(sk); ++ res = __ip4_datagram_connect(sk, uaddr, addr_len); ++ release_sock(sk); ++ return res; ++} + EXPORT_SYMBOL(ip4_datagram_connect); + + /* Because UDP xmit path can manipulate sk_dst_cache without holding +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 62d908e..b10a889 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -40,7 +40,7 @@ static bool ipv6_mapped_addr_any(const struct in6_addr *a) + return ipv6_addr_v4mapped(a) && (a->s6_addr32[3] == 0); + } + +-int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) ++static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + { + struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr; + struct inet_sock *inet = inet_sk(sk); +@@ -56,7 +56,7 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + if (usin->sin6_family == AF_INET) { + if (__ipv6_only_sock(sk)) + return -EAFNOSUPPORT; +- err = ip4_datagram_connect(sk, uaddr, addr_len); ++ err = __ip4_datagram_connect(sk, uaddr, addr_len); + goto ipv4_connected; + } + +@@ -98,9 +98,9 @@ int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) + sin.sin_addr.s_addr = daddr->s6_addr32[3]; + sin.sin_port = usin->sin6_port; + +- err = ip4_datagram_connect(sk, +- (struct sockaddr *) &sin, +- sizeof(sin)); ++ err = __ip4_datagram_connect(sk, ++ (struct sockaddr *) &sin, ++ sizeof(sin)); + + ipv4_connected: + if (err) +@@ -204,6 +204,16 @@ out: + fl6_sock_release(flowlabel); + return err; + } ++ ++int ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) ++{ ++ int res; ++ ++ lock_sock(sk); ++ res = __ip6_datagram_connect(sk, uaddr, addr_len); ++ release_sock(sk); ++ return res; ++} + EXPORT_SYMBOL_GPL(ip6_datagram_connect); + + int ip6_datagram_connect_v6_only(struct sock *sk, struct sockaddr *uaddr, +-- +2.1.0 + + +From 1c0df6bdc731f7692a1fafd9c606135ba714e7c6 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Wed, 15 Jul 2015 21:52:51 +0200 +Subject: [PATCH 21/46] bonding: fix destruction of bond with devices different + from arphrd_ether + +[ Upstream commit 06f6d1094aa0992432b1e2a0920b0ee86ccd83bf ] + +When the bonding is being unloaded and the netdevice notifier is +unregistered it executes NETDEV_UNREGISTER for each device which should +remove the bond's proc entry but if the device enslaved is not of +ARPHRD_ETHER type and is in front of the bonding, it may execute +bond_release_and_destroy() first which would release the last slave and +destroy the bond device leaving the proc entry and thus we will get the +following error (with dynamic debug on for bond_netdev_event to see the +events order): +[ 908.963051] eql: event: 9 +[ 908.963052] eql: IFF_SLAVE +[ 908.963054] eql: event: 2 +[ 908.963056] eql: IFF_SLAVE +[ 908.963058] eql: event: 6 +[ 908.963059] eql: IFF_SLAVE +[ 908.963110] bond0: Releasing active interface eql +[ 908.976168] bond0: Destroying bond bond0 +[ 908.976266] bond0 (unregistering): Released all slaves +[ 908.984097] ------------[ cut here ]------------ +[ 908.984107] WARNING: CPU: 0 PID: 1787 at fs/proc/generic.c:575 +remove_proc_entry+0x112/0x160() +[ 908.984110] remove_proc_entry: removing non-empty directory +'net/bonding', leaking at least 'bond0' +[ 908.984111] Modules linked in: bonding(-) eql(O) 9p nfsd auth_rpcgss +oid_registry nfs_acl nfs lockd grace fscache sunrpc crct10dif_pclmul +crc32_pclmul crc32c_intel ghash_clmulni_intel ppdev qxl drm_kms_helper +snd_hda_codec_generic aesni_intel ttm aes_x86_64 glue_helper pcspkr lrw +gf128mul ablk_helper cryptd snd_hda_intel virtio_console snd_hda_codec +psmouse serio_raw snd_hwdep snd_hda_core 9pnet_virtio 9pnet evdev joydev +drm virtio_balloon snd_pcm snd_timer snd soundcore i2c_piix4 i2c_core +pvpanic acpi_cpufreq parport_pc parport processor thermal_sys button +autofs4 ext4 crc16 mbcache jbd2 hid_generic usbhid hid sg sr_mod cdrom +ata_generic virtio_blk virtio_net floppy ata_piix e1000 libata ehci_pci +virtio_pci scsi_mod uhci_hcd ehci_hcd virtio_ring virtio usbcore +usb_common [last unloaded: bonding] + +[ 908.984168] CPU: 0 PID: 1787 Comm: rmmod Tainted: G W O +4.2.0-rc2+ #8 +[ 908.984170] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 +[ 908.984172] 0000000000000000 ffffffff81732d41 ffffffff81525b34 +ffff8800358dfda8 +[ 908.984175] ffffffff8106c521 ffff88003595af78 ffff88003595af40 +ffff88003e3a4280 +[ 908.984178] ffffffffa058d040 0000000000000000 ffffffff8106c59a +ffffffff8172ebd0 +[ 908.984181] Call Trace: +[ 908.984188] [] ? dump_stack+0x40/0x50 +[ 908.984193] [] ? warn_slowpath_common+0x81/0xb0 +[ 908.984196] [] ? warn_slowpath_fmt+0x4a/0x50 +[ 908.984199] [] ? remove_proc_entry+0x112/0x160 +[ 908.984205] [] ? bond_destroy_proc_dir+0x26/0x30 +[bonding] +[ 908.984208] [] ? bond_net_exit+0x8e/0xa0 [bonding] +[ 908.984217] [] ? ops_exit_list.isra.4+0x37/0x70 +[ 908.984225] [] ? +unregister_pernet_operations+0x8d/0xd0 +[ 908.984228] [] ? +unregister_pernet_subsys+0x1d/0x30 +[ 908.984232] [] ? bonding_exit+0x23/0xdba [bonding] +[ 908.984236] [] ? SyS_delete_module+0x18a/0x250 +[ 908.984241] [] ? task_work_run+0x89/0xc0 +[ 908.984244] [] ? +entry_SYSCALL_64_fastpath+0x16/0x75 +[ 908.984247] ---[ end trace 7c006ed4abbef24b ]--- + +Thus remove the proc entry manually if bond_release_and_destroy() is +used. Because of the checks in bond_remove_proc_entry() it's not a +problem for a bond device to change namespaces (the bug fixed by the +Fixes commit) but since commit +f9399814927ad ("bonding: Don't allow bond devices to change network +namespaces.") that can't happen anyway. + +Reported-by: Carol Soto +Signed-off-by: Nikolay Aleksandrov +Fixes: a64d49c3dd50 ("bonding: Manage /proc/net/bonding/ entries from + the netdev events") +Tested-by: Carol L Soto +Signed-off-by: David S. Miller +--- + drivers/net/bonding/bond_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index d5fe5d5..6a4e523 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1902,6 +1902,7 @@ static int bond_release_and_destroy(struct net_device *bond_dev, + bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; + netdev_info(bond_dev, "Destroying bond %s\n", + bond_dev->name); ++ bond_remove_proc_entry(bond); + unregister_netdevice(bond_dev); + } + return ret; +-- +2.1.0 + + +From 69200c77f33e23a81609bc618659a4859c188a98 Mon Sep 17 00:00:00 2001 +From: Herbert Xu +Date: Mon, 20 Jul 2015 17:55:38 +0800 +Subject: [PATCH 22/46] Revert "sit: Add gro callbacks to sit_offload" + +[ Upstream commit fdbf5b097bbd9693a86c0b8bfdd071a9a2117cfc ] + +This patch reverts 19424e052fb44da2f00d1a868cbb51f3e9f4bbb5 ("sit: +Add gro callbacks to sit_offload") because it generates packets +that cannot be handled even by our own GSO. + +Reported-by: Wolfgang Walter +Signed-off-by: Herbert Xu +Signed-off-by: David S. Miller +--- + net/ipv6/ip6_offload.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c +index e893cd1..08b6204 100644 +--- a/net/ipv6/ip6_offload.c ++++ b/net/ipv6/ip6_offload.c +@@ -292,8 +292,6 @@ static struct packet_offload ipv6_packet_offload __read_mostly = { + static const struct net_offload sit_offload = { + .callbacks = { + .gso_segment = ipv6_gso_segment, +- .gro_receive = ipv6_gro_receive, +- .gro_complete = ipv6_gro_complete, + }, + }; + +-- +2.1.0 + + +From 0479ad88a4eb6dd0d05a5712ff1d489fc27feaa4 Mon Sep 17 00:00:00 2001 +From: dingtianhong +Date: Thu, 16 Jul 2015 16:30:02 +0800 +Subject: [PATCH 23/46] bonding: correct the MAC address for "follow" + fail_over_mac policy + +[ Upstream commit a951bc1e6ba58f11df5ed5ddc41311e10f5fd20b ] + +The "follow" fail_over_mac policy is useful for multiport devices that +either become confused or incur a performance penalty when multiple +ports are programmed with the same MAC address, but the same MAC +address still may happened by this steps for this policy: + +1) echo +eth0 > /sys/class/net/bond0/bonding/slaves + bond0 has the same mac address with eth0, it is MAC1. + +2) echo +eth1 > /sys/class/net/bond0/bonding/slaves + eth1 is backup, eth1 has MAC2. + +3) ifconfig eth0 down + eth1 became active slave, bond will swap MAC for eth0 and eth1, + so eth1 has MAC1, and eth0 has MAC2. + +4) ifconfig eth1 down + there is no active slave, and eth1 still has MAC1, eth2 has MAC2. + +5) ifconfig eth0 up + the eth0 became active slave again, the bond set eth0 to MAC1. + +Something wrong here, then if you set eth1 up, the eth0 and eth1 will have the same +MAC address, it will break this policy for ACTIVE_BACKUP mode. + +This patch will fix this problem by finding the old active slave and +swap them MAC address before change active slave. + +Signed-off-by: Ding Tianhong +Tested-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +--- + drivers/net/bonding/bond_main.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 6a4e523..16d87bf 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -625,6 +625,23 @@ static void bond_set_dev_addr(struct net_device *bond_dev, + call_netdevice_notifiers(NETDEV_CHANGEADDR, bond_dev); + } + ++static struct slave *bond_get_old_active(struct bonding *bond, ++ struct slave *new_active) ++{ ++ struct slave *slave; ++ struct list_head *iter; ++ ++ bond_for_each_slave(bond, slave, iter) { ++ if (slave == new_active) ++ continue; ++ ++ if (ether_addr_equal(bond->dev->dev_addr, slave->dev->dev_addr)) ++ return slave; ++ } ++ ++ return NULL; ++} ++ + /* bond_do_fail_over_mac + * + * Perform special MAC address swapping for fail_over_mac settings +@@ -652,6 +669,9 @@ static void bond_do_fail_over_mac(struct bonding *bond, + if (!new_active) + return; + ++ if (!old_active) ++ old_active = bond_get_old_active(bond, new_active); ++ + if (old_active) { + ether_addr_copy(tmp_mac, new_active->dev->dev_addr); + ether_addr_copy(saddr.sa_data, +-- +2.1.0 + + +From 6fef6e2a4f97d67ea0c20473d228e755e3f96a21 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 17 Jul 2015 22:38:43 +0200 +Subject: [PATCH 24/46] sched: cls_bpf: fix panic on filter replace + +[ Upstream commit f6bfc46da6292b630ba389592123f0dd02066172 ] + +The following test case causes a NULL pointer dereference in cls_bpf: + + FOO="1,6 0 0 4294967295," + tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok + tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ + bpf bytecode "$FOO" flowid 1:1 action drop + +The problem is that commit 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") +accidentally swapped the arguments of list_replace_rcu(), the old +element needs to be the first argument and the new element the second. + +Fixes: 1f947bf151e9 ("net: sched: rcu'ify cls_bpf") +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Acked-by: Alexei Starovoitov +Signed-off-by: David S. Miller +--- + net/sched/cls_bpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c +index 91bd9c1..c0b86f2 100644 +--- a/net/sched/cls_bpf.c ++++ b/net/sched/cls_bpf.c +@@ -364,7 +364,7 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, + goto errout; + + if (oldprog) { +- list_replace_rcu(&prog->link, &oldprog->link); ++ list_replace_rcu(&oldprog->link, &prog->link); + tcf_unbind_filter(tp, &oldprog->res); + call_rcu(&oldprog->rcu, __cls_bpf_delete_prog); + } else { +-- +2.1.0 + + +From 8c2111406c9cc807767ecc64ae29a409cf486c94 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 17 Jul 2015 22:38:45 +0200 +Subject: [PATCH 25/46] sched: cls_flow: fix panic on filter replace + +[ Upstream commit 32b2f4b196b37695fdb42b31afcbc15399d6ef91 ] + +The following test case causes a NULL pointer dereference in cls_flow: + + tc filter add dev foo parent 1: handle 0x1 flow hash keys dst action ok + tc filter replace dev foo parent 1: pref 49152 handle 0x1 \ + flow hash keys mark action drop + +To be more precise, actually two different panics are fixed, the first +occurs because tcf_exts_init() is not called on the newly allocated +filter when we do a replace. And the second panic uncovered after that +happens since the arguments of list_replace_rcu() are swapped, the old +element needs to be the first argument and the new element the second. + +Fixes: 70da9f0bf999 ("net: sched: cls_flow use RCU") +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Signed-off-by: David S. Miller +--- + net/sched/cls_flow.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/sched/cls_flow.c b/net/sched/cls_flow.c +index a620c4e..75df923 100644 +--- a/net/sched/cls_flow.c ++++ b/net/sched/cls_flow.c +@@ -419,6 +419,8 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, + if (!fnew) + goto err2; + ++ tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE); ++ + fold = (struct flow_filter *)*arg; + if (fold) { + err = -EINVAL; +@@ -480,7 +482,6 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, + fnew->mask = ~0U; + fnew->tp = tp; + get_random_bytes(&fnew->hashrnd, 4); +- tcf_exts_init(&fnew->exts, TCA_FLOW_ACT, TCA_FLOW_POLICE); + } + + fnew->perturb_timer.function = flow_perturbation; +@@ -520,7 +521,7 @@ static int flow_change(struct net *net, struct sk_buff *in_skb, + if (*arg == 0) + list_add_tail_rcu(&fnew->list, &head->filters); + else +- list_replace_rcu(&fnew->list, &fold->list); ++ list_replace_rcu(&fold->list, &fnew->list); + + *arg = (unsigned long)fnew; + +-- +2.1.0 + + +From fe0e0574a708320517330ca57865f1d4d2530cfc Mon Sep 17 00:00:00 2001 +From: Edward Hyunkoo Jee +Date: Tue, 21 Jul 2015 09:43:59 +0200 +Subject: [PATCH 26/46] inet: frags: fix defragmented packet's IP header for + af_packet + +[ Upstream commit 0848f6428ba3a2e42db124d41ac6f548655735bf ] + +When ip_frag_queue() computes positions, it assumes that the passed +sk_buff does not contain L2 headers. + +However, when PACKET_FANOUT_FLAG_DEFRAG is used, IP reassembly +functions can be called on outgoing packets that contain L2 headers. + +Also, IPv4 checksum is not corrected after reassembly. + +Fixes: 7736d33f4262 ("packet: Add pre-defragmentation support for ipv4 fanouts.") +Signed-off-by: Edward Hyunkoo Jee +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Cc: Jerry Chu +Signed-off-by: David S. Miller +--- + net/ipv4/ip_fragment.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index cc1da6d..cae22a1 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -342,7 +342,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) + ihl = ip_hdrlen(skb); + + /* Determine the position of this fragment. */ +- end = offset + skb->len - ihl; ++ end = offset + skb->len - skb_network_offset(skb) - ihl; + err = -EINVAL; + + /* Is this the final fragment? */ +@@ -372,7 +372,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb) + goto err; + + err = -ENOMEM; +- if (!pskb_pull(skb, ihl)) ++ if (!pskb_pull(skb, skb_network_offset(skb) + ihl)) + goto err; + + err = pskb_trim_rcsum(skb, end - offset); +@@ -613,6 +613,9 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev, + iph->frag_off = qp->q.max_size ? htons(IP_DF) : 0; + iph->tot_len = htons(len); + iph->tos |= ecn; ++ ++ ip_send_check(iph); ++ + IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS); + qp->q.fragments = NULL; + qp->q.fragments_tail = NULL; +-- +2.1.0 + + +From 5dfcd4a0749d9d421ec04dedf37d9f07a0c22f3a Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 21 Jul 2015 16:33:50 +0200 +Subject: [PATCH 27/46] netlink: don't hold mutex in rcu callback when + releasing mmapd ring + +[ Upstream commit 0470eb99b4721586ccac954faac3fa4472da0845 ] + +Kirill A. Shutemov says: + +This simple test-case trigers few locking asserts in kernel: + +int main(int argc, char **argv) +{ + unsigned int block_size = 16 * 4096; + struct nl_mmap_req req = { + .nm_block_size = block_size, + .nm_block_nr = 64, + .nm_frame_size = 16384, + .nm_frame_nr = 64 * block_size / 16384, + }; + unsigned int ring_size; + int fd; + + fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); + if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0) + exit(1); + if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0) + exit(1); + + ring_size = req.nm_block_nr * req.nm_block_size; + mmap(NULL, 2 * ring_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); + return 0; +} + ++++ exited with 0 +++ +BUG: sleeping function called from invalid context at /home/kas/git/public/linux-mm/kernel/locking/mutex.c:616 +in_atomic(): 1, irqs_disabled(): 0, pid: 1, name: init +3 locks held by init/1: + #0: (reboot_mutex){+.+...}, at: [] SyS_reboot+0xa9/0x220 + #1: ((reboot_notifier_list).rwsem){.+.+..}, at: [] __blocking_notifier_call_chain+0x39/0x70 + #2: (rcu_callback){......}, at: [] rcu_do_batch.isra.49+0x160/0x10c0 +Preemption disabled at:[] __delay+0xf/0x20 + +CPU: 1 PID: 1 Comm: init Not tainted 4.1.0-00009-gbddf4c4818e0 #253 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Debian-1.8.2-1 04/01/2014 + ffff88017b3d8000 ffff88027bc03c38 ffffffff81929ceb 0000000000000102 + 0000000000000000 ffff88027bc03c68 ffffffff81085a9d 0000000000000002 + ffffffff81ca2a20 0000000000000268 0000000000000000 ffff88027bc03c98 +Call Trace: + [] dump_stack+0x4f/0x7b + [] ___might_sleep+0x16d/0x270 + [] __might_sleep+0x4d/0x90 + [] mutex_lock_nested+0x2f/0x430 + [] ? _raw_spin_unlock_irqrestore+0x5d/0x80 + [] ? __this_cpu_preempt_check+0x13/0x20 + [] netlink_set_ring+0x1ed/0x350 + [] ? netlink_undo_bind+0x70/0x70 + [] netlink_sock_destruct+0x80/0x150 + [] __sk_free+0x1d/0x160 + [] sk_free+0x19/0x20 +[..] + +Cong Wang says: + +We can't hold mutex lock in a rcu callback, [..] + +Thomas Graf says: + +The socket should be dead at this point. It might be simpler to +add a netlink_release_ring() function which doesn't require +locking at all. + +Reported-by: "Kirill A. Shutemov" +Diagnosed-by: Cong Wang +Suggested-by: Thomas Graf +Signed-off-by: Florian Westphal +Signed-off-by: David S. Miller +--- + net/netlink/af_netlink.c | 79 ++++++++++++++++++++++++++++-------------------- + 1 file changed, 47 insertions(+), 32 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index bf6e766..ea5ed7a 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -355,25 +355,52 @@ err1: + return NULL; + } + ++ ++static void ++__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec, ++ unsigned int order) ++{ ++ struct netlink_sock *nlk = nlk_sk(sk); ++ struct sk_buff_head *queue; ++ struct netlink_ring *ring; ++ ++ queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; ++ ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; ++ ++ spin_lock_bh(&queue->lock); ++ ++ ring->frame_max = req->nm_frame_nr - 1; ++ ring->head = 0; ++ ring->frame_size = req->nm_frame_size; ++ ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; ++ ++ swap(ring->pg_vec_len, req->nm_block_nr); ++ swap(ring->pg_vec_order, order); ++ swap(ring->pg_vec, pg_vec); ++ ++ __skb_queue_purge(queue); ++ spin_unlock_bh(&queue->lock); ++ ++ WARN_ON(atomic_read(&nlk->mapped)); ++ ++ if (pg_vec) ++ free_pg_vec(pg_vec, order, req->nm_block_nr); ++} ++ + static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, +- bool closing, bool tx_ring) ++ bool tx_ring) + { + struct netlink_sock *nlk = nlk_sk(sk); + struct netlink_ring *ring; +- struct sk_buff_head *queue; + void **pg_vec = NULL; + unsigned int order = 0; +- int err; + + ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; +- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; + +- if (!closing) { +- if (atomic_read(&nlk->mapped)) +- return -EBUSY; +- if (atomic_read(&ring->pending)) +- return -EBUSY; +- } ++ if (atomic_read(&nlk->mapped)) ++ return -EBUSY; ++ if (atomic_read(&ring->pending)) ++ return -EBUSY; + + if (req->nm_block_nr) { + if (ring->pg_vec != NULL) +@@ -405,31 +432,19 @@ static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, + return -EINVAL; + } + +- err = -EBUSY; + mutex_lock(&nlk->pg_vec_lock); +- if (closing || atomic_read(&nlk->mapped) == 0) { +- err = 0; +- spin_lock_bh(&queue->lock); +- +- ring->frame_max = req->nm_frame_nr - 1; +- ring->head = 0; +- ring->frame_size = req->nm_frame_size; +- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; +- +- swap(ring->pg_vec_len, req->nm_block_nr); +- swap(ring->pg_vec_order, order); +- swap(ring->pg_vec, pg_vec); +- +- __skb_queue_purge(queue); +- spin_unlock_bh(&queue->lock); +- +- WARN_ON(atomic_read(&nlk->mapped)); ++ if (atomic_read(&nlk->mapped) == 0) { ++ __netlink_set_ring(sk, req, tx_ring, pg_vec, order); ++ mutex_unlock(&nlk->pg_vec_lock); ++ return 0; + } ++ + mutex_unlock(&nlk->pg_vec_lock); + + if (pg_vec) + free_pg_vec(pg_vec, order, req->nm_block_nr); +- return err; ++ ++ return -EBUSY; + } + + static void netlink_mm_open(struct vm_area_struct *vma) +@@ -898,10 +913,10 @@ static void netlink_sock_destruct(struct sock *sk) + + memset(&req, 0, sizeof(req)); + if (nlk->rx_ring.pg_vec) +- netlink_set_ring(sk, &req, true, false); ++ __netlink_set_ring(sk, &req, false, NULL, 0); + memset(&req, 0, sizeof(req)); + if (nlk->tx_ring.pg_vec) +- netlink_set_ring(sk, &req, true, true); ++ __netlink_set_ring(sk, &req, true, NULL, 0); + } + #endif /* CONFIG_NETLINK_MMAP */ + +@@ -2197,7 +2212,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, + return -EINVAL; + if (copy_from_user(&req, optval, sizeof(req))) + return -EFAULT; +- err = netlink_set_ring(sk, &req, false, ++ err = netlink_set_ring(sk, &req, + optname == NETLINK_TX_RING); + break; + } +-- +2.1.0 + + +From c8a958d63443e2d143d1710ee437c17438fd12e5 Mon Sep 17 00:00:00 2001 +From: "Michael S. Tsirkin" +Date: Wed, 15 Jul 2015 15:26:19 +0300 +Subject: [PATCH 28/46] virtio_net: don't require ANY_LAYOUT with VERSION_1 + +[ Upstream commit 75993300d008f418ee2569a632185fc1d7d50674 ] + +ANY_LAYOUT is a compatibility feature. It's implied +for VERSION_1 devices, and non-transitional devices +might not offer it. Change code to behave accordingly. + +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Paolo Bonzini +Reviewed-by: Stefan Hajnoczi +Signed-off-by: David S. Miller +--- + drivers/net/virtio_net.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 63c7810..7fbca37 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1828,7 +1828,8 @@ static int virtnet_probe(struct virtio_device *vdev) + else + vi->hdr_len = sizeof(struct virtio_net_hdr); + +- if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT)) ++ if (virtio_has_feature(vdev, VIRTIO_F_ANY_LAYOUT) || ++ virtio_has_feature(vdev, VIRTIO_F_VERSION_1)) + vi->any_header_sg = true; + + if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ)) +-- +2.1.0 + + +From d5df2abc93d5027ec62fb714d6bb9b14bed65548 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Wed, 22 Jul 2015 13:03:40 +0200 +Subject: [PATCH 29/46] bridge: netlink: fix slave_changelink/br_setport race + conditions + +[ Upstream commit 963ad94853000ab100f5ff19eea80095660d41b4 ] + +Since slave_changelink support was added there have been a few race +conditions when using br_setport() since some of the port functions it +uses require the bridge lock. It is very easy to trigger a lockup due to +some internal spin_lock() usage without bh disabled, also it's possible to +get the bridge into an inconsistent state. + +Signed-off-by: Nikolay Aleksandrov +Fixes: 3ac636b8591c ("bridge: implement rtnl_link_ops->slave_changelink") +Reviewed-by: Jiri Pirko +Signed-off-by: David S. Miller +--- + net/bridge/br_netlink.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 4b5c236..20e06a9 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -711,9 +711,17 @@ static int br_port_slave_changelink(struct net_device *brdev, + struct nlattr *tb[], + struct nlattr *data[]) + { ++ struct net_bridge *br = netdev_priv(brdev); ++ int ret; ++ + if (!data) + return 0; +- return br_setport(br_port_get_rtnl(dev), data); ++ ++ spin_lock_bh(&br->lock); ++ ret = br_setport(br_port_get_rtnl(dev), data); ++ spin_unlock_bh(&br->lock); ++ ++ return ret; + } + + static int br_port_fill_slave_info(struct sk_buff *skb, +-- +2.1.0 + + +From 8002540aec64b57e8a2a93adf4ad893b085f9ae6 Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Wed, 22 Jul 2015 16:53:47 +0300 +Subject: [PATCH 30/46] net/mlx4_core: Fix wrong index in propagating port + change event to VFs + +[ Upstream commit 1c1bf34951e8d17941bf708d1901c47e81b15d55 ] + +The port-change event processing in procedure mlx4_eq_int() uses "slave" +as the vf_oper array index. Since the value of "slave" is the PF function +index, the result is that the PF link state is used for deciding to +propagate the event for all the VFs. The VF link state should be used, +so the VF function index should be used here. + +Fixes: 948e306d7d64 ('net/mlx4: Add VF link state support') +Signed-off-by: Jack Morgenstein +Signed-off-by: Matan Barak +Signed-off-by: Or Gerlitz +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/mellanox/mlx4/eq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c +index 2619c9f..983b1d5 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c +@@ -573,7 +573,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) + continue; + mlx4_dbg(dev, "%s: Sending MLX4_PORT_CHANGE_SUBTYPE_DOWN to slave: %d, port:%d\n", + __func__, i, port); +- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; ++ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; + if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) { + eqe->event.port_change.port = + cpu_to_be32( +@@ -608,7 +608,7 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) + continue; + if (i == mlx4_master_func_num(dev)) + continue; +- s_info = &priv->mfunc.master.vf_oper[slave].vport[port].state; ++ s_info = &priv->mfunc.master.vf_oper[i].vport[port].state; + if (IFLA_VF_LINK_STATE_AUTO == s_info->link_state) { + eqe->event.port_change.port = + cpu_to_be32( +-- +2.1.0 + + +From 9df9bb9ae0c1579a4e6e63fc6ebfb7d1e0a16ebb Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Mon, 27 Jul 2015 13:08:06 -0700 +Subject: [PATCH 31/46] fib_trie: Drop unnecessary calls to leaf_pull_suffix + +[ Upstream commit 1513069edcf8dd86cfd8d5daef482b97d6b93df6 ] + +It was reported that update_suffix was taking a long time on systems where +a large number of leaves were attached to a single node. As it turns out +fib_table_flush was calling update_suffix for each leaf that didn't have all +of the aliases stripped from it. As a result, on this large node removing +one leaf would result in us calling update_suffix for every other leaf on +the node. + +The fix is to just remove the calls to leaf_pull_suffix since they are +redundant as we already have a call in resize that will go through and +update the suffix length for the node before we exit out of +fib_table_flush or fib_table_flush_external. + +Reported-by: David Ahern +Signed-off-by: Alexander Duyck +Tested-by: David Ahern +Signed-off-by: David S. Miller +--- + net/ipv4/fib_trie.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 09b62e1..210ceca 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -1780,8 +1780,6 @@ void fib_table_flush_external(struct fib_table *tb) + if (hlist_empty(&n->leaf)) { + put_child_root(pn, n->key, NULL); + node_free(n); +- } else { +- leaf_pull_suffix(pn, n); + } + } + } +@@ -1852,8 +1850,6 @@ int fib_table_flush(struct fib_table *tb) + if (hlist_empty(&n->leaf)) { + put_child_root(pn, n->key, NULL); + node_free(n); +- } else { +- leaf_pull_suffix(pn, n); + } + } + +-- +2.1.0 + + +From 9119c5bc8f4ef473506590477e0dc196c2bc496d Mon Sep 17 00:00:00 2001 +From: Lars Westerhoff +Date: Tue, 28 Jul 2015 01:32:21 +0300 +Subject: [PATCH 32/46] packet: missing dev_put() in packet_do_bind() + +[ Upstream commit 158cd4af8dedbda0d612d448c724c715d0dda649 ] + +When binding a PF_PACKET socket, the use count of the bound interface is +always increased with dev_hold in dev_get_by_{index,name}. However, +when rebound with the same protocol and device as in the previous bind +the use count of the interface was not decreased. Ultimately, this +caused the deletion of the interface to fail with the following message: + +unregister_netdevice: waiting for dummy0 to become free. Usage count = 1 + +This patch moves the dev_put out of the conditional part that was only +executed when either the protocol or device changed on a bind. + +Fixes: 902fefb82ef7 ('packet: improve socket create/bind latency in some cases') +Signed-off-by: Lars Westerhoff +Signed-off-by: Dan Carpenter +Reviewed-by: Daniel Borkmann +Signed-off-by: David S. Miller +--- + net/packet/af_packet.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index fe1610d..733ef5a 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2688,7 +2688,7 @@ static int packet_release(struct socket *sock) + static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) + { + struct packet_sock *po = pkt_sk(sk); +- const struct net_device *dev_curr; ++ struct net_device *dev_curr; + __be16 proto_curr; + bool need_rehook; + +@@ -2712,15 +2712,13 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 proto) + + po->num = proto; + po->prot_hook.type = proto; +- +- if (po->prot_hook.dev) +- dev_put(po->prot_hook.dev); +- + po->prot_hook.dev = dev; + + po->ifindex = dev ? dev->ifindex : 0; + packet_cached_dev_assign(po, dev); + } ++ if (dev_curr) ++ dev_put(dev_curr); + + if (proto == 0 || !need_rehook) + goto out_unlock; +-- +2.1.0 + + +From dbd3501b0f680161110947cb7ba49b308a2d182e Mon Sep 17 00:00:00 2001 +From: Alexander Drozdov +Date: Tue, 28 Jul 2015 13:57:01 +0300 +Subject: [PATCH 33/46] packet: tpacket_snd(): fix signed/unsigned comparison + +[ Upstream commit dbd46ab412b8fb395f2b0ff6f6a7eec9df311550 ] + +tpacket_fill_skb() can return a negative value (-errno) which +is stored in tp_len variable. In that case the following +condition will be (but shouldn't be) true: + +tp_len > dev->mtu + dev->hard_header_len + +as dev->mtu and dev->hard_header_len are both unsigned. + +That may lead to just returning an incorrect EMSGSIZE errno +to the user. + +Fixes: 52f1454f629fa ("packet: allow to transmit +4 byte in TX_RING slot for VLAN case") +Signed-off-by: Alexander Drozdov +Acked-by: Daniel Borkmann +Signed-off-by: David S. Miller +--- + net/packet/af_packet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 733ef5a..e1ea5d4 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2307,7 +2307,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) + } + tp_len = tpacket_fill_skb(po, skb, ph, dev, size_max, proto, + addr, hlen); +- if (tp_len > dev->mtu + dev->hard_header_len) { ++ if (likely(tp_len >= 0) && ++ tp_len > dev->mtu + dev->hard_header_len) { + struct ethhdr *ehdr; + /* Earlier code assumed this would be a VLAN pkt, + * double-check this now that we have the actual +-- +2.1.0 + + +From 9f07a1825bac3efa34dcb2d50944377edcf39d38 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Wed, 29 Jul 2015 18:40:56 +0200 +Subject: [PATCH 34/46] act_bpf: fix memory leaks when replacing bpf programs + +[ Upstream commit f4eaed28c7834fc049c754f63e6988bbd73778d9 ] + +We currently trigger multiple memory leaks when replacing bpf +actions, besides others: + + comm "tc", pid 1909, jiffies 4294851310 (age 1602.796s) + hex dump (first 32 bytes): + 01 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 ................ + 18 b0 98 6d 00 88 ff ff 00 00 00 00 00 00 00 00 ...m............ + backtrace: + [] kmemleak_alloc+0x4e/0xb0 + [] __vmalloc_node_range+0x1bd/0x2c0 + [] __vmalloc+0x4a/0x50 + [] bpf_prog_alloc+0x3a/0xa0 + [] bpf_prog_create+0x44/0xa0 + [] tcf_bpf_init+0x28b/0x3c0 [act_bpf] + [] tcf_action_init_1+0x191/0x1b0 + [] tcf_action_init+0x82/0xf0 + [] tcf_exts_validate+0xb2/0xc0 + [] cls_bpf_modify_existing+0x98/0x340 [cls_bpf] + [] cls_bpf_change+0x1a6/0x274 [cls_bpf] + [] tc_ctl_tfilter+0x335/0x910 + [] rtnetlink_rcv_msg+0x95/0x240 + [] netlink_rcv_skb+0xaf/0xc0 + [] rtnetlink_rcv+0x2e/0x40 + [] netlink_unicast+0xef/0x1b0 + +Issue is that the old content from tcf_bpf is allocated and needs +to be released when we replace it. We seem to do that since the +beginning of act_bpf on the filter and insns, later on the name as +well. + +Example test case, after patch: + + # FOO="1,6 0 0 4294967295," + # BAR="1,6 0 0 4294967294," + # tc actions add action bpf bytecode "$FOO" index 2 + # tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe + index 2 ref 1 bind 0 + # tc actions replace action bpf bytecode "$BAR" index 2 + # tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe + index 2 ref 1 bind 0 + # tc actions replace action bpf bytecode "$FOO" index 2 + # tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe + index 2 ref 1 bind 0 + # tc actions del action bpf index 2 + [...] + # echo "scan" > /sys/kernel/debug/kmemleak + # cat /sys/kernel/debug/kmemleak | grep "comm \"tc\"" | wc -l + 0 + +Fixes: d23b8ad8ab23 ("tc: add BPF based action") +Signed-off-by: Daniel Borkmann +Signed-off-by: David S. Miller +--- + net/sched/act_bpf.c | 50 +++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 35 insertions(+), 15 deletions(-) + +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index dc6a2d3..521ffca 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -27,9 +27,10 @@ + struct tcf_bpf_cfg { + struct bpf_prog *filter; + struct sock_filter *bpf_ops; +- char *bpf_name; ++ const char *bpf_name; + u32 bpf_fd; + u16 bpf_num_ops; ++ bool is_ebpf; + }; + + static int tcf_bpf(struct sk_buff *skb, const struct tc_action *act, +@@ -200,6 +201,7 @@ static int tcf_bpf_init_from_ops(struct nlattr **tb, struct tcf_bpf_cfg *cfg) + cfg->bpf_ops = bpf_ops; + cfg->bpf_num_ops = bpf_num_ops; + cfg->filter = fp; ++ cfg->is_ebpf = false; + + return 0; + } +@@ -234,18 +236,40 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg) + cfg->bpf_fd = bpf_fd; + cfg->bpf_name = name; + cfg->filter = fp; ++ cfg->is_ebpf = true; + + return 0; + } + ++static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg) ++{ ++ if (cfg->is_ebpf) ++ bpf_prog_put(cfg->filter); ++ else ++ bpf_prog_destroy(cfg->filter); ++ ++ kfree(cfg->bpf_ops); ++ kfree(cfg->bpf_name); ++} ++ ++static void tcf_bpf_prog_fill_cfg(const struct tcf_bpf *prog, ++ struct tcf_bpf_cfg *cfg) ++{ ++ cfg->is_ebpf = tcf_bpf_is_ebpf(prog); ++ cfg->filter = prog->filter; ++ ++ cfg->bpf_ops = prog->bpf_ops; ++ cfg->bpf_name = prog->bpf_name; ++} ++ + static int tcf_bpf_init(struct net *net, struct nlattr *nla, + struct nlattr *est, struct tc_action *act, + int replace, int bind) + { + struct nlattr *tb[TCA_ACT_BPF_MAX + 1]; ++ struct tcf_bpf_cfg cfg, old; + struct tc_act_bpf *parm; + struct tcf_bpf *prog; +- struct tcf_bpf_cfg cfg; + bool is_bpf, is_ebpf; + int ret; + +@@ -294,6 +318,9 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, + prog = to_bpf(act); + spin_lock_bh(&prog->tcf_lock); + ++ if (ret != ACT_P_CREATED) ++ tcf_bpf_prog_fill_cfg(prog, &old); ++ + prog->bpf_ops = cfg.bpf_ops; + prog->bpf_name = cfg.bpf_name; + +@@ -309,29 +336,22 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, + + if (ret == ACT_P_CREATED) + tcf_hash_insert(act); ++ else ++ tcf_bpf_cfg_cleanup(&old); + + return ret; + + destroy_fp: +- if (is_ebpf) +- bpf_prog_put(cfg.filter); +- else +- bpf_prog_destroy(cfg.filter); +- +- kfree(cfg.bpf_ops); +- kfree(cfg.bpf_name); +- ++ tcf_bpf_cfg_cleanup(&cfg); + return ret; + } + + static void tcf_bpf_cleanup(struct tc_action *act, int bind) + { +- const struct tcf_bpf *prog = act->priv; ++ struct tcf_bpf_cfg tmp; + +- if (tcf_bpf_is_ebpf(prog)) +- bpf_prog_put(prog->filter); +- else +- bpf_prog_destroy(prog->filter); ++ tcf_bpf_prog_fill_cfg(act->priv, &tmp); ++ tcf_bpf_cfg_cleanup(&tmp); + } + + static struct tc_action_ops act_bpf_ops __read_mostly = { +-- +2.1.0 + + +From a376fa38ddfa431270ed3127873550282d677fe7 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Wed, 29 Jul 2015 23:35:25 +0200 +Subject: [PATCH 35/46] net: sched: fix refcount imbalance in actions + +[ Upstream commit 28e6b67f0b292f557468c139085303b15f1a678f ] + +Since commit 55334a5db5cd ("net_sched: act: refuse to remove bound action +outside"), we end up with a wrong reference count for a tc action. + +Test case 1: + + FOO="1,6 0 0 4294967295," + BAR="1,6 0 0 4294967294," + tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 \ + action bpf bytecode "$FOO" + tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe + index 1 ref 1 bind 1 + tc actions replace action bpf bytecode "$BAR" index 1 + tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967294' default-action pipe + index 1 ref 2 bind 1 + tc actions replace action bpf bytecode "$FOO" index 1 + tc actions show action bpf + action order 0: bpf bytecode '1,6 0 0 4294967295' default-action pipe + index 1 ref 3 bind 1 + +Test case 2: + + FOO="1,6 0 0 4294967295," + tc filter add dev foo parent 1: bpf bytecode "$FOO" flowid 1:1 action ok + tc actions show action gact + action order 0: gact action pass + random type none pass val 0 + index 1 ref 1 bind 1 + tc actions add action drop index 1 + RTNETLINK answers: File exists [...] + tc actions show action gact + action order 0: gact action pass + random type none pass val 0 + index 1 ref 2 bind 1 + tc actions add action drop index 1 + RTNETLINK answers: File exists [...] + tc actions show action gact + action order 0: gact action pass + random type none pass val 0 + index 1 ref 3 bind 1 + +What happens is that in tcf_hash_check(), we check tcf_common for a given +index and increase tcfc_refcnt and conditionally tcfc_bindcnt when we've +found an existing action. Now there are the following cases: + + 1) We do a late binding of an action. In that case, we leave the + tcfc_refcnt/tcfc_bindcnt increased and are done with the ->init() + handler. This is correctly handeled. + + 2) We replace the given action, or we try to add one without replacing + and find out that the action at a specific index already exists + (thus, we go out with error in that case). + +In case of 2), we have to undo the reference count increase from +tcf_hash_check() in the tcf_hash_check() function. Currently, we fail to +do so because of the 'tcfc_bindcnt > 0' check which bails out early with +an -EPERM error. + +Now, while commit 55334a5db5cd prevents 'tc actions del action ...' on an +already classifier-bound action to drop the reference count (which could +then become negative, wrap around etc), this restriction only accounts for +invocations outside a specific action's ->init() handler. + +One possible solution would be to add a flag thus we possibly trigger +the -EPERM ony in situations where it is indeed relevant. + +After the patch, above test cases have correct reference count again. + +Fixes: 55334a5db5cd ("net_sched: act: refuse to remove bound action outside") +Signed-off-by: Daniel Borkmann +Reviewed-by: Cong Wang +Signed-off-by: David S. Miller +--- + include/net/act_api.h | 8 +++++++- + net/sched/act_api.c | 11 ++++++----- + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/include/net/act_api.h b/include/net/act_api.h +index 3ee4c92..931738b 100644 +--- a/include/net/act_api.h ++++ b/include/net/act_api.h +@@ -99,7 +99,6 @@ struct tc_action_ops { + + int tcf_hash_search(struct tc_action *a, u32 index); + void tcf_hash_destroy(struct tc_action *a); +-int tcf_hash_release(struct tc_action *a, int bind); + u32 tcf_hash_new_index(struct tcf_hashinfo *hinfo); + int tcf_hash_check(u32 index, struct tc_action *a, int bind); + int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a, +@@ -107,6 +106,13 @@ int tcf_hash_create(u32 index, struct nlattr *est, struct tc_action *a, + void tcf_hash_cleanup(struct tc_action *a, struct nlattr *est); + void tcf_hash_insert(struct tc_action *a); + ++int __tcf_hash_release(struct tc_action *a, bool bind, bool strict); ++ ++static inline int tcf_hash_release(struct tc_action *a, bool bind) ++{ ++ return __tcf_hash_release(a, bind, false); ++} ++ + int tcf_register_action(struct tc_action_ops *a, unsigned int mask); + int tcf_unregister_action(struct tc_action_ops *a); + int tcf_action_destroy(struct list_head *actions, int bind); +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index 3d43e49..f8d9c2a 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -45,7 +45,7 @@ void tcf_hash_destroy(struct tc_action *a) + } + EXPORT_SYMBOL(tcf_hash_destroy); + +-int tcf_hash_release(struct tc_action *a, int bind) ++int __tcf_hash_release(struct tc_action *a, bool bind, bool strict) + { + struct tcf_common *p = a->priv; + int ret = 0; +@@ -53,7 +53,7 @@ int tcf_hash_release(struct tc_action *a, int bind) + if (p) { + if (bind) + p->tcfc_bindcnt--; +- else if (p->tcfc_bindcnt > 0) ++ else if (strict && p->tcfc_bindcnt > 0) + return -EPERM; + + p->tcfc_refcnt--; +@@ -64,9 +64,10 @@ int tcf_hash_release(struct tc_action *a, int bind) + ret = 1; + } + } ++ + return ret; + } +-EXPORT_SYMBOL(tcf_hash_release); ++EXPORT_SYMBOL(__tcf_hash_release); + + static int tcf_dump_walker(struct sk_buff *skb, struct netlink_callback *cb, + struct tc_action *a) +@@ -136,7 +137,7 @@ static int tcf_del_walker(struct sk_buff *skb, struct tc_action *a) + head = &hinfo->htab[tcf_hash(i, hinfo->hmask)]; + hlist_for_each_entry_safe(p, n, head, tcfc_head) { + a->priv = p; +- ret = tcf_hash_release(a, 0); ++ ret = __tcf_hash_release(a, false, true); + if (ret == ACT_P_DELETED) { + module_put(a->ops->owner); + n_i++; +@@ -413,7 +414,7 @@ int tcf_action_destroy(struct list_head *actions, int bind) + int ret = 0; + + list_for_each_entry_safe(a, tmp, actions, list) { +- ret = tcf_hash_release(a, bind); ++ ret = __tcf_hash_release(a, bind, true); + if (ret == ACT_P_DELETED) + module_put(a->ops->owner); + else if (ret < 0) +-- +2.1.0 + + +From 40df9588f4415a976f1b67f344757d26f157e4f8 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Sun, 2 Aug 2015 19:29:16 +0200 +Subject: [PATCH 36/46] rocker: free netdevice during netdevice removal + +[ Upstream commit 1ebd47efa4e17391dfac8caa349c6a8d35f996d1 ] + +When removing a port's netdevice in 'rocker_remove_ports', we should +also free the allocated 'net_device' structure. Do that by calling +'free_netdev' after unregistering it. + +Signed-off-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Fixes: 4b8ac9660af ("rocker: introduce rocker switch driver") +Acked-by: Scott Feldman +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/rocker/rocker.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c +index cf98cc9..73b6fc2 100644 +--- a/drivers/net/ethernet/rocker/rocker.c ++++ b/drivers/net/ethernet/rocker/rocker.c +@@ -4587,6 +4587,7 @@ static void rocker_remove_ports(struct rocker *rocker) + rocker_port = rocker->ports[i]; + rocker_port_ig_tbl(rocker_port, ROCKER_OP_FLAG_REMOVE); + unregister_netdev(rocker_port->dev); ++ free_netdev(rocker_port->dev); + } + kfree(rocker->ports); + } +-- +2.1.0 + + +From b2c177c64de1f863de832da667ef6f626ccddb48 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 1 Aug 2015 15:33:26 +0300 +Subject: [PATCH 37/46] rds: fix an integer overflow test in + rds_info_getsockopt() + +[ Upstream commit 468b732b6f76b138c0926eadf38ac88467dcd271 ] + +"len" is a signed integer. We check that len is not negative, so it +goes from zero to INT_MAX. PAGE_SIZE is unsigned long so the comparison +is type promoted to unsigned long. ULONG_MAX - 4095 is a higher than +INT_MAX so the condition can never be true. + +I don't know if this is harmful but it seems safe to limit "len" to +INT_MAX - 4095. + +Fixes: a8c879a7ee98 ('RDS: Info and stats') +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +--- + net/rds/info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rds/info.c b/net/rds/info.c +index 9a6b4f6..140a44a 100644 +--- a/net/rds/info.c ++++ b/net/rds/info.c +@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval, + + /* check for all kinds of wrapping and the like */ + start = (unsigned long)optval; +- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) { ++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) { + ret = -EINVAL; + goto out; + } +-- +2.1.0 + + +From 346f0535765909d0f5fda364f365e05f8e602879 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 1 Aug 2015 12:14:33 +0200 +Subject: [PATCH 38/46] udp: fix dst races with multicast early demux +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 10e2eb878f3ca07ac2f05fa5ca5e6c4c9174a27a ] + +Multicast dst are not cached. They carry DST_NOCACHE. + +As mentioned in commit f8864972126899 ("ipv4: fix dst race in +sk_dst_get()"), these dst need special care before caching them +into a socket. + +Caching them is allowed only if their refcnt was not 0, ie we +must use atomic_inc_not_zero() + +Also, we must use READ_ONCE() to fetch sk->sk_rx_dst, as mentioned +in commit d0c294c53a771 ("tcp: prevent fetching dst twice in early demux +code") + +Fixes: 421b3885bf6d ("udp: ipv4: Add udp early demux") +Tested-by: Gregory Hoggarth +Signed-off-by: Eric Dumazet +Reported-by: Gregory Hoggarth +Reported-by: Alex Gartrell +Cc: Michal Kubeček +Signed-off-by: David S. Miller +--- + net/ipv4/udp.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 83aa604..1b8c5ba 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1995,12 +1995,19 @@ void udp_v4_early_demux(struct sk_buff *skb) + + skb->sk = sk; + skb->destructor = sock_efree; +- dst = sk->sk_rx_dst; ++ dst = READ_ONCE(sk->sk_rx_dst); + + if (dst) + dst = dst_check(dst, 0); +- if (dst) +- skb_dst_set_noref(skb, dst); ++ if (dst) { ++ /* DST_NOCACHE can not be used without taking a reference */ ++ if (dst->flags & DST_NOCACHE) { ++ if (likely(atomic_inc_not_zero(&dst->__refcnt))) ++ skb_dst_set(skb, dst); ++ } else { ++ skb_dst_set_noref(skb, dst); ++ } ++ } + } + + int udp_rcv(struct sk_buff *skb) +-- +2.1.0 + + +From 469e1ebf7f9f83516cd805f0a8f2392d1b8298a3 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 4 Aug 2015 19:06:32 +0200 +Subject: [PATCH 39/46] bridge: netlink: account for the IFLA_BRPORT_PROXYARP + attribute size and policy + +[ Upstream commit 355b9f9df1f0311f20087350aee8ad96eedca8a9 ] + +The attribute size wasn't accounted for in the get_slave_size() callback +(br_port_get_slave_size) when it was introduced, so fix it now. Also add +a policy entry for it in br_port_policy. + +Signed-off-by: Nikolay Aleksandrov +Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP") +Signed-off-by: David S. Miller +--- + net/bridge/br_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 20e06a9..95ef032 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -112,6 +112,7 @@ static inline size_t br_port_info_size(void) + + nla_total_size(1) /* IFLA_BRPORT_FAST_LEAVE */ + + nla_total_size(1) /* IFLA_BRPORT_LEARNING */ + + nla_total_size(1) /* IFLA_BRPORT_UNICAST_FLOOD */ ++ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */ + + 0; + } + +@@ -504,6 +505,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { + [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 }, + [IFLA_BRPORT_LEARNING] = { .type = NLA_U8 }, + [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 }, ++ [IFLA_BRPORT_PROXYARP] = { .type = NLA_U8 }, + }; + + /* Change the state of the port and notify spanning tree */ +-- +2.1.0 + + +From 7cea8ba728e377145ddb3c0c449beca792171109 Mon Sep 17 00:00:00 2001 +From: Nikolay Aleksandrov +Date: Tue, 4 Aug 2015 19:06:33 +0200 +Subject: [PATCH 40/46] bridge: netlink: account for the + IFLA_BRPORT_PROXYARP_WIFI attribute size and policy + +[ Upstream commit 786c2077ec8e9eab37a88fc14aac4309a8061e18 ] + +The attribute size wasn't accounted for in the get_slave_size() callback +(br_port_get_slave_size) when it was introduced, so fix it now. Also add +a policy entry for it in br_port_policy. + +Signed-off-by: Nikolay Aleksandrov +Fixes: 842a9ae08a25 ("bridge: Extend Proxy ARP design to allow optional rules for Wi-Fi") +Signed-off-by: David S. Miller +--- + net/bridge/br_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 95ef032..a7559ef 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -113,6 +113,7 @@ static inline size_t br_port_info_size(void) + + nla_total_size(1) /* IFLA_BRPORT_LEARNING */ + + nla_total_size(1) /* IFLA_BRPORT_UNICAST_FLOOD */ + + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */ ++ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP_WIFI */ + + 0; + } + +@@ -506,6 +507,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = { + [IFLA_BRPORT_LEARNING] = { .type = NLA_U8 }, + [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 }, + [IFLA_BRPORT_PROXYARP] = { .type = NLA_U8 }, ++ [IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 }, + }; + + /* Change the state of the port and notify spanning tree */ +-- +2.1.0 + + +From 61c226cb391165314b5ee42cc6f72bc9b29bc897 Mon Sep 17 00:00:00 2001 +From: Ivan Vecera +Date: Thu, 6 Aug 2015 22:48:23 +0200 +Subject: [PATCH 41/46] bna: fix interrupts storm caused by erroneous packets + +[ Upstream commit ade4dc3e616e33c80d7e62855fe1b6f9895bc7c3 ] + +The commit "e29aa33 bna: Enable Multi Buffer RX" moved packets counter +increment from the beginning of the NAPI processing loop after the check +for erroneous packets so they are never accounted. This counter is used +to inform firmware about number of processed completions (packets). +As these packets are never acked the firmware fires IRQs for them again +and again. + +Fixes: e29aa33 ("bna: Enable Multi Buffer RX") +Signed-off-by: Ivan Vecera +Acked-by: Rasesh Mody +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/brocade/bna/bnad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c +index caae6cb..a1c30ee 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad.c ++++ b/drivers/net/ethernet/brocade/bna/bnad.c +@@ -675,6 +675,7 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) + if (!next_cmpl->valid) + break; + } ++ packets++; + + /* TODO: BNA_CQ_EF_LOCAL ? */ + if (unlikely(flags & (BNA_CQ_EF_MAC_ERROR | +@@ -691,7 +692,6 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget) + else + bnad_cq_setup_skb_frags(rcb, skb, sop_ci, nvecs, len); + +- packets++; + rcb->rxq->rx_packets++; + rcb->rxq->rx_bytes += totlen; + ccb->bytes_per_intr += totlen; +-- +2.1.0 + + +From a4f50b7501f98b5e76e695bb3f8c892429082f90 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 7 Aug 2015 00:26:41 +0200 +Subject: [PATCH 42/46] netlink: make sure -EBUSY won't escape from + netlink_insert + +[ Upstream commit 4e7c1330689e27556de407d3fdadc65ffff5eb12 ] + +Linus reports the following deadlock on rtnl_mutex; triggered only +once so far (extract): + +[12236.694209] NetworkManager D 0000000000013b80 0 1047 1 0x00000000 +[12236.694218] ffff88003f902640 0000000000000000 ffffffff815d15a9 0000000000000018 +[12236.694224] ffff880119538000 ffff88003f902640 ffffffff81a8ff84 00000000ffffffff +[12236.694230] ffffffff81a8ff88 ffff880119c47f00 ffffffff815d133a ffffffff81a8ff80 +[12236.694235] Call Trace: +[12236.694250] [] ? schedule_preempt_disabled+0x9/0x10 +[12236.694257] [] ? schedule+0x2a/0x70 +[12236.694263] [] ? schedule_preempt_disabled+0x9/0x10 +[12236.694271] [] ? __mutex_lock_slowpath+0x7f/0xf0 +[12236.694280] [] ? mutex_lock+0x16/0x30 +[12236.694291] [] ? rtnetlink_rcv+0x10/0x30 +[12236.694299] [] ? netlink_unicast+0xfb/0x180 +[12236.694309] [] ? rtnl_getlink+0x113/0x190 +[12236.694319] [] ? rtnetlink_rcv_msg+0x7a/0x210 +[12236.694331] [] ? sock_has_perm+0x5c/0x70 +[12236.694339] [] ? rtnetlink_rcv+0x30/0x30 +[12236.694346] [] ? netlink_rcv_skb+0x9c/0xc0 +[12236.694354] [] ? rtnetlink_rcv+0x1f/0x30 +[12236.694360] [] ? netlink_unicast+0xfb/0x180 +[12236.694367] [] ? netlink_sendmsg+0x484/0x5d0 +[12236.694376] [] ? __wake_up+0x2f/0x50 +[12236.694387] [] ? sock_sendmsg+0x33/0x40 +[12236.694396] [] ? ___sys_sendmsg+0x22e/0x240 +[12236.694405] [] ? ___sys_recvmsg+0x135/0x1a0 +[12236.694415] [] ? eventfd_write+0x82/0x210 +[12236.694423] [] ? fsnotify+0x32e/0x4c0 +[12236.694429] [] ? wake_up_q+0x60/0x60 +[12236.694434] [] ? __sys_sendmsg+0x39/0x70 +[12236.694440] [] ? entry_SYSCALL_64_fastpath+0x12/0x6a + +It seems so far plausible that the recursive call into rtnetlink_rcv() +looks suspicious. One way, where this could trigger is that the senders +NETLINK_CB(skb).portid was wrongly 0 (which is rtnetlink socket), so +the rtnl_getlink() request's answer would be sent to the kernel instead +to the actual user process, thus grabbing rtnl_mutex() twice. + +One theory would be that netlink_autobind() triggered via netlink_sendmsg() +internally overwrites the -EBUSY error to 0, but where it is wrongly +originating from __netlink_insert() instead. That would reset the +socket's portid to 0, which is then filled into NETLINK_CB(skb).portid +later on. As commit d470e3b483dc ("[NETLINK]: Fix two socket hashing bugs.") +also puts it, -EBUSY should not be propagated from netlink_insert(). + +It looks like it's very unlikely to reproduce. We need to trigger the +rhashtable_insert_rehash() handler under a situation where rehashing +currently occurs (one /rare/ way would be to hit ht->elasticity limits +while not filled enough to expand the hashtable, but that would rather +require a specifically crafted bind() sequence with knowledge about +destination slots, seems unlikely). It probably makes sense to guard +__netlink_insert() in any case and remap that error. It was suggested +that EOVERFLOW might be better than an already overloaded ENOMEM. + +Reference: http://thread.gmane.org/gmane.linux.network/372676 +Reported-by: Linus Torvalds +Signed-off-by: Daniel Borkmann +Acked-by: Herbert Xu +Acked-by: Thomas Graf +Signed-off-by: David S. Miller +--- + net/netlink/af_netlink.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index ea5ed7a..4856d97 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1094,6 +1094,11 @@ static int netlink_insert(struct sock *sk, u32 portid) + + err = __netlink_insert(table, sk); + if (err) { ++ /* In case the hashtable backend returns with -EBUSY ++ * from here, it must not escape to the caller. ++ */ ++ if (unlikely(err == -EBUSY)) ++ err = -EOVERFLOW; + if (err == -EEXIST) + err = -EADDRINUSE; + nlk_sk(sk)->portid = 0; +-- +2.1.0 + + +From 538c509b7f2287f77363c6410216160d082dba22 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 10 Aug 2015 15:07:34 -0700 +Subject: [PATCH 43/46] inet: fix possible request socket leak + +[ Upstream commit 3257d8b12f954c462d29de6201664a846328a522 ] + +In commit b357a364c57c9 ("inet: fix possible panic in +reqsk_queue_unlink()"), I missed fact that tcp_check_req() +can return the listener socket in one case, and that we must +release the request socket refcount or we leak it. + +Tested: + + Following packetdrill test template shows the issue + +0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 ++0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 ++0 bind(3, ..., ...) = 0 ++0 listen(3, 1) = 0 + ++0 < S 0:0(0) win 2920 ++0 > S. 0:0(0) ack 1 ++.002 < . 1:1(0) ack 21 win 2920 ++0 > R 21:21(0) + +Fixes: b357a364c57c9 ("inet: fix possible panic in reqsk_queue_unlink()") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/ipv4/tcp_ipv4.c | 2 +- + net/ipv6/tcp_ipv6.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index fc1c658..441ca6f 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1348,7 +1348,7 @@ static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb) + req = inet_csk_search_req(sk, th->source, iph->saddr, iph->daddr); + if (req) { + nsk = tcp_check_req(sk, skb, req, false); +- if (!nsk) ++ if (!nsk || nsk == sk) + reqsk_put(req); + return nsk; + } +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 3adffb3..e541d68 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -946,7 +946,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb) + &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb)); + if (req) { + nsk = tcp_check_req(sk, skb, req, false); +- if (!nsk) ++ if (!nsk || nsk == sk) + reqsk_put(req); + return nsk; + } +-- +2.1.0 + + +From 5712cc9fa64a51b05baa1fa1e7a56e911ad47e3e Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 10 Aug 2015 09:09:13 -0700 +Subject: [PATCH 44/46] inet: fix races with reqsk timers + +[ Upstream commit 2235f2ac75fd2501c251b0b699a9632e80239a6d ] + +reqsk_queue_destroy() and reqsk_queue_unlink() should use +del_timer_sync() instead of del_timer() before calling reqsk_put(), +otherwise we could free a req still used by another cpu. + +But before doing so, reqsk_queue_destroy() must release syn_wait_lock +spinlock or risk a dead lock, as reqsk_timer_handler() might +need to take this same spinlock from reqsk_queue_unlink() (called from +inet_csk_reqsk_queue_drop()) + +Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/core/request_sock.c | 8 +++++++- + net/ipv4/inet_connection_sock.c | 2 +- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/net/core/request_sock.c b/net/core/request_sock.c +index 87b22c0..b42f0e2 100644 +--- a/net/core/request_sock.c ++++ b/net/core/request_sock.c +@@ -103,10 +103,16 @@ void reqsk_queue_destroy(struct request_sock_queue *queue) + spin_lock_bh(&queue->syn_wait_lock); + while ((req = lopt->syn_table[i]) != NULL) { + lopt->syn_table[i] = req->dl_next; ++ /* Because of following del_timer_sync(), ++ * we must release the spinlock here ++ * or risk a dead lock. ++ */ ++ spin_unlock_bh(&queue->syn_wait_lock); + atomic_inc(&lopt->qlen_dec); +- if (del_timer(&req->rsk_timer)) ++ if (del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + reqsk_put(req); ++ spin_lock_bh(&queue->syn_wait_lock); + } + spin_unlock_bh(&queue->syn_wait_lock); + } +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 8976ca4..b27fc40 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -584,7 +584,7 @@ static bool reqsk_queue_unlink(struct request_sock_queue *queue, + } + + spin_unlock(&queue->syn_wait_lock); +- if (del_timer(&req->rsk_timer)) ++ if (del_timer_sync(&req->rsk_timer)) + reqsk_put(req); + return found; + } +-- +2.1.0 + + +From 6f5087e42a1d9b2ebb7340eeea948b9524e54862 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Sat, 8 Aug 2015 12:58:57 -0700 +Subject: [PATCH 45/46] net: dsa: Do not override PHY interface if already + configured + +[ Upstream commit 211c504a444710b1d8ce3431ac19f2578602ca27 ] + +In case we need to divert reads/writes using the slave MII bus, we may have +already fetched a valid PHY interface property from Device Tree, and that +mode is used by the PHY driver to make configuration decisions. + +If we could not fetch the "phy-mode" property, we will assign p->phy_interface +to PHY_INTERFACE_MODE_NA, such that we can actually check for that condition as +to whether or not we should override the interface value. + +Fixes: 19334920eaf7 ("net: dsa: Set valid phy interface type") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +--- + net/dsa/slave.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 827cda56..57978c5 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -732,7 +732,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p, + return -ENODEV; + + /* Use already configured phy mode */ +- p->phy_interface = p->phy->interface; ++ if (p->phy_interface == PHY_INTERFACE_MODE_NA) ++ p->phy_interface = p->phy->interface; + phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, + p->phy_interface); + +-- +2.1.0 + + +From 75eefed4fed0fd630556144eedcfed7e017ca96a Mon Sep 17 00:00:00 2001 +From: Andy Whitcroft +Date: Thu, 13 Aug 2015 20:49:01 +0100 +Subject: [PATCH 46/46] ipv4: off-by-one in continuation handling in + /proc/net/route + +[ Upstream commit 25b97c016b26039982daaa2c11d83979f93b71ab ] + +When generating /proc/net/route we emit a header followed by a line for +each route. When a short read is performed we will restart this process +based on the open file descriptor. When calculating the start point we +fail to take into account that the 0th entry is the header. This leads +us to skip the first entry when doing a continuation read. + +This can be easily seen with the comparison below: + + while read l; do echo "$l"; done A + cat /proc/net/route >B + diff -bu A B | grep '^[+-]' + +On my example machine I have approximatly 10KB of route output. There we +see the very first non-title element is lost in the while read case, +and an entry around the 8K mark in the cat case: + + +wlan0 00000000 02021EAC 0003 0 0 400 00000000 0 0 0 + -tun1 00C0AC0A 00000000 0001 0 0 950 00C0FFFF 0 0 0 + +Fix up the off-by-one when reaquiring position on continuation. + +Fixes: 8be33e955cb9 ("fib_trie: Fib walk rcu should take a tnode and key instead of a trie and a leaf") +BugLink: http://bugs.launchpad.net/bugs/1483440 +Acked-by: Alexander Duyck +Signed-off-by: Andy Whitcroft +Signed-off-by: David S. Miller +--- + net/ipv4/fib_trie.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c +index 210ceca..0ca933d 100644 +--- a/net/ipv4/fib_trie.c ++++ b/net/ipv4/fib_trie.c +@@ -2453,7 +2453,7 @@ static struct key_vector *fib_route_get_idx(struct fib_route_iter *iter, + key = l->key + 1; + iter->pos++; + +- if (pos-- <= 0) ++ if (--pos <= 0) + break; + + l = NULL; +-- +2.1.0 + diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch new file mode 100644 index 00000000..ec441704 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-perf-fix-double-free-of-the-aux-buffer.patch @@ -0,0 +1,49 @@ +From ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 27 Jul 2015 00:31:08 +0100 +Subject: perf: Fix double-free of the AUX buffer + +From: Ben Hutchings + +commit ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 upstream. + +If rb->aux_refcount is decremented to zero before rb->refcount, +__rb_free_aux() may be called twice resulting in a double free of +rb->aux_pages. Fix this by adding a check to __rb_free_aux(). + +Signed-off-by: Ben Hutchings +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 57ffc5ca679f ("perf: Fix AUX buffer refcounting") +Link: http://lkml.kernel.org/r/1437953468.12842.17.camel@decadent.org.uk +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/ring_buffer.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -547,11 +547,13 @@ static void __rb_free_aux(struct ring_bu + rb->aux_priv = NULL; + } + +- for (pg = 0; pg < rb->aux_nr_pages; pg++) +- rb_free_aux_page(rb, pg); ++ if (rb->aux_nr_pages) { ++ for (pg = 0; pg < rb->aux_nr_pages; pg++) ++ rb_free_aux_page(rb, pg); + +- kfree(rb->aux_pages); +- rb->aux_nr_pages = 0; ++ kfree(rb->aux_pages); ++ rb->aux_nr_pages = 0; ++ } + } + + void rb_free_aux(struct ring_buffer *rb) diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch new file mode 100644 index 00000000..c9c5315b --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-perf-fix-fasync-handling-on-inherited-events.patch @@ -0,0 +1,69 @@ +From fed66e2cdd4f127a43fd11b8d92a99bdd429528c Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 11 Jun 2015 10:32:01 +0200 +Subject: perf: Fix fasync handling on inherited events + +From: Peter Zijlstra + +commit fed66e2cdd4f127a43fd11b8d92a99bdd429528c upstream. + +Vince reported that the fasync signal stuff doesn't work proper for +inherited events. So fix that. + +Installing fasync allocates memory and sets filp->f_flags |= FASYNC, +which upon the demise of the file descriptor ensures the allocation is +freed and state is updated. + +Now for perf, we can have the events stick around for a while after the +original FD is dead because of references from child events. So we +cannot copy the fasync pointer around. We can however consistently use +the parent's fasync, as that will be updated. + +Reported-and-Tested-by: Vince Weaver +Signed-off-by: Peter Zijlstra (Intel) +Cc: Arnaldo Carvalho deMelo +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: eranian@google.com +Link: http://lkml.kernel.org/r/1434011521.1495.71.camel@twins +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4766,12 +4766,20 @@ static const struct file_operations perf + * to user-space before waking everybody up. + */ + ++static inline struct fasync_struct **perf_event_fasync(struct perf_event *event) ++{ ++ /* only the parent has fasync state */ ++ if (event->parent) ++ event = event->parent; ++ return &event->fasync; ++} ++ + void perf_event_wakeup(struct perf_event *event) + { + ring_buffer_wakeup(event); + + if (event->pending_kill) { +- kill_fasync(&event->fasync, SIGIO, event->pending_kill); ++ kill_fasync(perf_event_fasync(event), SIGIO, event->pending_kill); + event->pending_kill = 0; + } + } +@@ -6117,7 +6125,7 @@ static int __perf_event_overflow(struct + else + perf_event_output(event, data, regs); + +- if (event->fasync && event->pending_kill) { ++ if (*perf_event_fasync(event) && event->pending_kill) { + event->pending_wakeup = 1; + irq_work_queue(&event->pending); + } diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch new file mode 100644 index 00000000..15f3ac35 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-perf-fix-perf_event_ioc_period-migration-race.patch @@ -0,0 +1,125 @@ +From c7999c6f3fed9e383d3131474588f282ae6d56b9 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Tue, 4 Aug 2015 19:22:49 +0200 +Subject: perf: Fix PERF_EVENT_IOC_PERIOD migration race + +From: Peter Zijlstra + +commit c7999c6f3fed9e383d3131474588f282ae6d56b9 upstream. + +I ran the perf fuzzer, which triggered some WARN()s which are due to +trying to stop/restart an event on the wrong CPU. + +Use the normal IPI pattern to ensure we run the code on the correct CPU. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Vince Weaver +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: bad7192b842c ("perf: Fix PERF_EVENT_IOC_PERIOD to force-reset the period") +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 75 +++++++++++++++++++++++++++++++++++++-------------- + 1 file changed, 55 insertions(+), 20 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3976,28 +3976,21 @@ static void perf_event_for_each(struct p + perf_event_for_each_child(sibling, func); + } + +-static int perf_event_period(struct perf_event *event, u64 __user *arg) +-{ +- struct perf_event_context *ctx = event->ctx; +- int ret = 0, active; ++struct period_event { ++ struct perf_event *event; + u64 value; ++}; + +- if (!is_sampling_event(event)) +- return -EINVAL; +- +- if (copy_from_user(&value, arg, sizeof(value))) +- return -EFAULT; +- +- if (!value) +- return -EINVAL; ++static int __perf_event_period(void *info) ++{ ++ struct period_event *pe = info; ++ struct perf_event *event = pe->event; ++ struct perf_event_context *ctx = event->ctx; ++ u64 value = pe->value; ++ bool active; + +- raw_spin_lock_irq(&ctx->lock); ++ raw_spin_lock(&ctx->lock); + if (event->attr.freq) { +- if (value > sysctl_perf_event_sample_rate) { +- ret = -EINVAL; +- goto unlock; +- } +- + event->attr.sample_freq = value; + } else { + event->attr.sample_period = value; +@@ -4016,11 +4009,53 @@ static int perf_event_period(struct perf + event->pmu->start(event, PERF_EF_RELOAD); + perf_pmu_enable(ctx->pmu); + } ++ raw_spin_unlock(&ctx->lock); ++ ++ return 0; ++} ++ ++static int perf_event_period(struct perf_event *event, u64 __user *arg) ++{ ++ struct period_event pe = { .event = event, }; ++ struct perf_event_context *ctx = event->ctx; ++ struct task_struct *task; ++ u64 value; ++ ++ if (!is_sampling_event(event)) ++ return -EINVAL; ++ ++ if (copy_from_user(&value, arg, sizeof(value))) ++ return -EFAULT; ++ ++ if (!value) ++ return -EINVAL; ++ ++ if (event->attr.freq && value > sysctl_perf_event_sample_rate) ++ return -EINVAL; ++ ++ task = ctx->task; ++ pe.value = value; ++ ++ if (!task) { ++ cpu_function_call(event->cpu, __perf_event_period, &pe); ++ return 0; ++ } ++ ++retry: ++ if (!task_function_call(task, __perf_event_period, &pe)) ++ return 0; ++ ++ raw_spin_lock_irq(&ctx->lock); ++ if (ctx->is_active) { ++ raw_spin_unlock_irq(&ctx->lock); ++ task = ctx->task; ++ goto retry; ++ } + +-unlock: ++ __perf_event_period(&pe); + raw_spin_unlock_irq(&ctx->lock); + +- return ret; ++ return 0; + } + + static const struct file_operations perf_fops; diff --git a/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch b/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch new file mode 100644 index 00000000..7fae9b52 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-perf-fix-running-time-accounting.patch @@ -0,0 +1,49 @@ +From 00a2916f7f82c348a2a94dbb572874173bc308a3 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 27 Jul 2015 10:35:07 +0200 +Subject: perf: Fix running time accounting + +From: Peter Zijlstra + +commit 00a2916f7f82c348a2a94dbb572874173bc308a3 upstream. + +A recent fix to the shadow timestamp inadvertly broke the running time +accounting. + +We must not update the running timestamp if we fail to schedule the +event, the event will not have ran. This can (and did) result in +negative total runtime because the stopped timestamp was before the +running timestamp (we 'started' but never stopped the event -- because +it never really started we didn't have to stop it either). + +Reported-and-Tested-by: Vince Weaver +Fixes: 72f669c0086f ("perf: Update shadow timestamp before add event") +Signed-off-by: Peter Zijlstra (Intel) +Cc: Shaohua Li +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1886,8 +1886,6 @@ event_sched_in(struct perf_event *event, + + perf_pmu_disable(event->pmu); + +- event->tstamp_running += tstamp - event->tstamp_stopped; +- + perf_set_shadow_time(event, ctx, tstamp); + + perf_log_itrace_start(event); +@@ -1899,6 +1897,8 @@ event_sched_in(struct perf_event *event, + goto out; + } + ++ event->tstamp_running += tstamp - event->tstamp_stopped; ++ + if (!is_software_event(event)) + cpuctx->active_oncpu++; + if (!ctx->nr_active++) diff --git a/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch b/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch new file mode 100644 index 00000000..a20f3929 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-rsi-fix-failure-to-load-firmware-after-memory-leak-fix-and-fix-the-leak.patch @@ -0,0 +1,88 @@ +From 5d5cd85ff441534a52f23f821d0a7c644d3b6cce Mon Sep 17 00:00:00 2001 +From: Mike Looijmans +Date: Tue, 28 Jul 2015 07:51:01 +0200 +Subject: rsi: Fix failure to load firmware after memory leak fix and fix the leak + +From: Mike Looijmans + +commit 5d5cd85ff441534a52f23f821d0a7c644d3b6cce upstream. + +Fixes commit eae79b4f3e82 ("rsi: fix memory leak in rsi_load_ta_instructions()") +which stopped the driver from functioning. + +Firmware data has been allocated using vmalloc(), resulting in memory +that cannot be used for DMA. Hence the firmware was first copied to a +buffer allocated with kmalloc() in the original code. This patch reverts +the commit and only calls "kfree()" to release the buffer after sending +the data. This fixes the memory leak without breaking the driver. + +Add a comment to the kmemdup() calls to explain why this is done, and abort +if memory allocation fails. + +Tested on a Topic Miami-Florida board which contains the rsi SDIO chip. + +Also added the same kfree() call to the USB glue driver. This was not +tested on actual hardware though, as I only have the SDIO version. + +Fixes: eae79b4f3e82 ("rsi: fix memory leak in rsi_load_ta_instructions()") +Signed-off-by: Mike Looijmans +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rsi/rsi_91x_sdio_ops.c | 8 +++++++- + drivers/net/wireless/rsi/rsi_91x_usb_ops.c | 4 ++++ + 2 files changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c +@@ -172,6 +172,7 @@ static int rsi_load_ta_instructions(stru + (struct rsi_91x_sdiodev *)adapter->rsi_dev; + u32 len; + u32 num_blocks; ++ const u8 *fw; + const struct firmware *fw_entry = NULL; + u32 block_size = dev->tx_blk_size; + int status = 0; +@@ -200,6 +201,10 @@ static int rsi_load_ta_instructions(stru + return status; + } + ++ /* Copy firmware into DMA-accessible memory */ ++ fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); ++ if (!fw) ++ return -ENOMEM; + len = fw_entry->size; + + if (len % 4) +@@ -210,7 +215,8 @@ static int rsi_load_ta_instructions(stru + rsi_dbg(INIT_ZONE, "%s: Instruction size:%d\n", __func__, len); + rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks); + +- status = rsi_copy_to_card(common, fw_entry->data, len, num_blocks); ++ status = rsi_copy_to_card(common, fw, len, num_blocks); ++ kfree(fw); + release_firmware(fw_entry); + return status; + } +--- a/drivers/net/wireless/rsi/rsi_91x_usb_ops.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb_ops.c +@@ -146,7 +146,10 @@ static int rsi_load_ta_instructions(stru + return status; + } + ++ /* Copy firmware into DMA-accessible memory */ + fw = kmemdup(fw_entry->data, fw_entry->size, GFP_KERNEL); ++ if (!fw) ++ return -ENOMEM; + len = fw_entry->size; + + if (len % 4) +@@ -158,6 +161,7 @@ static int rsi_load_ta_instructions(stru + rsi_dbg(INIT_ZONE, "%s: num blocks: %d\n", __func__, num_blocks); + + status = rsi_copy_to_card(common, fw, len, num_blocks); ++ kfree(fw); + release_firmware(fw_entry); + return status; + } diff --git a/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch b/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch new file mode 100644 index 00000000..e15d8bb4 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-rtlwifi-fix-null-dereference-when-pci-driver-used-as-an-ap.patch @@ -0,0 +1,59 @@ +From 7c62940165e9ae4004ce4e6b5117330bab94df68 Mon Sep 17 00:00:00 2001 +From: Luis Felipe Dominguez Vega +Date: Wed, 29 Jul 2015 21:11:20 -0500 +Subject: rtlwifi: Fix NULL dereference when PCI driver used as an AP + +From: Luis Felipe Dominguez Vega + +commit 7c62940165e9ae4004ce4e6b5117330bab94df68 upstream. + +In commit 33511b157bbcebaef853cc1811992b664a2e5862 ("rtlwifi: add support to +send beacon frame"), the mechanism for sending beacons was established. That +patch works correctly for rtl8192cu, but there is a possibility of getting +the following warnings in the PCI drivers: + +WARNING: CPU: 1 PID: 2439 at net/mac80211/driver-ops.h:12 +ieee80211_bss_info_change_notify+0x179/0x1d0 [mac80211]() +wlp5s0: Failed check-sdata-in-driver check, flags: 0x0 + +The warning is followed by a NULL pointer dereference as follows: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000006 +IP: [] rtl_get_tcb_desc+0x5e/0x760 [rtlwifi] + +This problem was reported at http://thread.gmane.org/gmane.linux.kernel.wireless.general/138645, +but no solution was found at that time. + +The problem was also reported at https://bugzilla.kernel.org/show_bug.cgi?id=9744 +and this solution was developed and tested there. + +The USB driver works with a NULL final argument in the adapter_tx() callback; +however, the PCI drivers need a struct rtl_tcb_desc in that position. + +Fixes: 33511b157bbc ("rtlwifi: add support to send beacon frame.") +Signed-off-by: Luis Felipe Dominguez Vega +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/rtlwifi/core.c ++++ b/drivers/net/wireless/rtlwifi/core.c +@@ -1015,9 +1015,12 @@ static void send_beacon_frame(struct iee + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct sk_buff *skb = ieee80211_beacon_get(hw, vif); ++ struct rtl_tcb_desc tcb_desc; + +- if (skb) +- rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, NULL); ++ if (skb) { ++ memset(&tcb_desc, 0, sizeof(struct rtl_tcb_desc)); ++ rtlpriv->intf_ops->adapter_tx(hw, NULL, skb, &tcb_desc); ++ } + } + + static void rtl_op_bss_info_changed(struct ieee80211_hw *hw, diff --git a/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch b/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch new file mode 100644 index 00000000..2ab05f5e --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-rtlwifi-rtl8723be-add-module-parameter-for-msi-interrupts.patch @@ -0,0 +1,30 @@ +From 741e3b9902d11585e18bfc7f8d47e913616bb070 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Sun, 2 Aug 2015 13:24:13 -0500 +Subject: rtlwifi: rtl8723be: Add module parameter for MSI interrupts + +From: Larry Finger + +commit 741e3b9902d11585e18bfc7f8d47e913616bb070 upstream. + +The driver code allows for the disabling of MSI interrupts; however the +module_parm line was missed and the option fails to show with modinfo. + +Signed-off-by: Larry Finger +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/rtlwifi/rtl8723be/sw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c +@@ -385,6 +385,7 @@ module_param_named(debug, rtl8723be_mod_ + module_param_named(ips, rtl8723be_mod_params.inactiveps, bool, 0444); + module_param_named(swlps, rtl8723be_mod_params.swctrl_lps, bool, 0444); + module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444); ++module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444); + module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog, + bool, 0444); + MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); diff --git a/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch b/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch new file mode 100644 index 00000000..d2672797 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-x86-xen-build-xen-pv-apic-driver-for-domu-as-well.patch @@ -0,0 +1,87 @@ +From fc5fee86bdd3d720e2d1d324e4fae0c35845fa63 Mon Sep 17 00:00:00 2001 +From: "Jason A. Donenfeld" +Date: Mon, 10 Aug 2015 15:40:27 +0200 +Subject: x86/xen: build "Xen PV" APIC driver for domU as well + +From: "Jason A. Donenfeld" + +commit fc5fee86bdd3d720e2d1d324e4fae0c35845fa63 upstream. + +It turns out that a PV domU also requires the "Xen PV" APIC +driver. Otherwise, the flat driver is used and we get stuck in busy +loops that never exit, such as in this stack trace: + +(gdb) target remote localhost:9999 +Remote debugging using localhost:9999 +__xapic_wait_icr_idle () at ./arch/x86/include/asm/ipi.h:56 +56 while (native_apic_mem_read(APIC_ICR) & APIC_ICR_BUSY) +(gdb) bt + #0 __xapic_wait_icr_idle () at ./arch/x86/include/asm/ipi.h:56 + #1 __default_send_IPI_shortcut (shortcut=, +dest=, vector=) at +./arch/x86/include/asm/ipi.h:75 + #2 apic_send_IPI_self (vector=246) at arch/x86/kernel/apic/probe_64.c:54 + #3 0xffffffff81011336 in arch_irq_work_raise () at +arch/x86/kernel/irq_work.c:47 + #4 0xffffffff8114990c in irq_work_queue (work=0xffff88000fc0e400) at +kernel/irq_work.c:100 + #5 0xffffffff8110c29d in wake_up_klogd () at kernel/printk/printk.c:2633 + #6 0xffffffff8110ca60 in vprintk_emit (facility=0, level=, dict=0x0 , dictlen=, +fmt=, args=) + at kernel/printk/printk.c:1778 + #7 0xffffffff816010c8 in printk (fmt=) at +kernel/printk/printk.c:1868 + #8 0xffffffffc00013ea in ?? () + #9 0x0000000000000000 in ?? () + +Mailing-list-thread: https://lkml.org/lkml/2015/8/4/755 +Signed-off-by: Jason A. Donenfeld +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/xen/Makefile | 4 ++-- + arch/x86/xen/xen-ops.h | 6 ++---- + 2 files changed, 4 insertions(+), 6 deletions(-) + +--- a/arch/x86/xen/Makefile ++++ b/arch/x86/xen/Makefile +@@ -13,13 +13,13 @@ CFLAGS_mmu.o := $(nostackp) + obj-y := enlighten.o setup.o multicalls.o mmu.o irq.o \ + time.o xen-asm.o xen-asm_$(BITS).o \ + grant-table.o suspend.o platform-pci-unplug.o \ +- p2m.o ++ p2m.o apic.o + + obj-$(CONFIG_EVENT_TRACING) += trace.o + + obj-$(CONFIG_SMP) += smp.o + obj-$(CONFIG_PARAVIRT_SPINLOCKS)+= spinlock.o + obj-$(CONFIG_XEN_DEBUG_FS) += debugfs.o +-obj-$(CONFIG_XEN_DOM0) += apic.o vga.o ++obj-$(CONFIG_XEN_DOM0) += vga.o + obj-$(CONFIG_SWIOTLB_XEN) += pci-swiotlb-xen.o + obj-$(CONFIG_XEN_EFI) += efi.o +--- a/arch/x86/xen/xen-ops.h ++++ b/arch/x86/xen/xen-ops.h +@@ -101,17 +101,15 @@ struct dom0_vga_console_info; + + #ifdef CONFIG_XEN_DOM0 + void __init xen_init_vga(const struct dom0_vga_console_info *, size_t size); +-void __init xen_init_apic(void); + #else + static inline void __init xen_init_vga(const struct dom0_vga_console_info *info, + size_t size) + { + } +-static inline void __init xen_init_apic(void) +-{ +-} + #endif + ++void __init xen_init_apic(void); ++ + #ifdef CONFIG_XEN_EFI + extern void xen_efi_init(void); + #else diff --git a/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch b/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch new file mode 100644 index 00000000..770bcb0a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-xen-blkback-replace-work_pending-with-work_busy-in-purge_persistent_gnt.patch @@ -0,0 +1,40 @@ +From 53bc7dc004fecf39e0ba70f2f8d120a1444315d3 Mon Sep 17 00:00:00 2001 +From: Bob Liu +Date: Wed, 22 Jul 2015 14:40:10 +0800 +Subject: xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bob Liu + +commit 53bc7dc004fecf39e0ba70f2f8d120a1444315d3 upstream. + +The BUG_ON() in purge_persistent_gnt() will be triggered when previous purge +work haven't finished. + +There is a work_pending() before this BUG_ON, but it doesn't account if the work +is still currently running. + +Acked-by: Roger Pau Monné +Signed-off-by: Bob Liu +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/xen-blkback/blkback.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/block/xen-blkback/blkback.c ++++ b/drivers/block/xen-blkback/blkback.c +@@ -362,8 +362,8 @@ static void purge_persistent_gnt(struct + return; + } + +- if (work_pending(&blkif->persistent_purge_work)) { +- pr_alert_ratelimited("Scheduled work from previous purge is still pending, cannot purge list\n"); ++ if (work_busy(&blkif->persistent_purge_work)) { ++ pr_alert_ratelimited("Scheduled work from previous purge is still busy, cannot purge list\n"); + return; + } + diff --git a/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch b/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch new file mode 100644 index 00000000..aeb4f074 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-xen-blkfront-don-t-add-indirect-pages-to-list-when.patch @@ -0,0 +1,44 @@ +From 7b0767502b5db11cb1f0daef2d01f6d71b1192dc Mon Sep 17 00:00:00 2001 +From: Bob Liu +Date: Wed, 22 Jul 2015 14:40:09 +0800 +Subject: xen-blkfront: don't add indirect pages to list when + !feature_persistent +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bob Liu + +commit 7b0767502b5db11cb1f0daef2d01f6d71b1192dc upstream. + +We should consider info->feature_persistent when adding indirect page to list +info->indirect_pages, else the BUG_ON() in blkif_free() would be triggered. + +When we are using persistent grants the indirect_pages list +should always be empty because blkfront has pre-allocated enough +persistent pages to fill all requests on the ring. + +Acked-by: Roger Pau Monné +Signed-off-by: Bob Liu +Signed-off-by: Konrad Rzeszutek Wilk +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/xen-blkfront.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -1118,8 +1118,10 @@ static void blkif_completion(struct blk_ + * Add the used indirect page back to the list of + * available pages for indirect grefs. + */ +- indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); +- list_add(&indirect_page->lru, &info->indirect_pages); ++ if (!info->feature_persistent) { ++ indirect_page = pfn_to_page(s->indirect_grants[i]->pfn); ++ list_add(&indirect_page->lru, &info->indirect_pages); ++ } + s->indirect_grants[i]->gref = GRANT_INVALID_REF; + list_add_tail(&s->indirect_grants[i]->node, &info->grants); + } diff --git a/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch b/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch new file mode 100644 index 00000000..68e0e3e1 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/stable-xen-xenbus-don-t-leak-memory-when-unmapping-the-ring-on-hvm-backend.patch @@ -0,0 +1,40 @@ +From c22fe519e7e2b94ad173e0ea3b89c1a7d8be8d00 Mon Sep 17 00:00:00 2001 +From: Julien Grall +Date: Mon, 10 Aug 2015 19:10:38 +0100 +Subject: xen/xenbus: Don't leak memory when unmapping the ring on HVM backend + +From: Julien Grall + +commit c22fe519e7e2b94ad173e0ea3b89c1a7d8be8d00 upstream. + +The commit ccc9d90a9a8b5c4ad7e9708ec41f75ff9e98d61d "xenbus_client: +Extend interface to support multi-page ring" removes the call to +free_xenballooned_pages() in xenbus_unmap_ring_vfree_hvm(), leaking a +page for every shared ring. + +Only with backends running in HVM domains were affected. + +Signed-off-by: Julien Grall +Reviewed-by: Boris Ostrovsky +Reviewed-by: Wei Liu +Signed-off-by: David Vrabel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/xen/xenbus/xenbus_client.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/xen/xenbus/xenbus_client.c ++++ b/drivers/xen/xenbus/xenbus_client.c +@@ -814,8 +814,10 @@ static int xenbus_unmap_ring_vfree_hvm(s + + rv = xenbus_unmap_ring(dev, node->handles, node->nr_handles, + addrs); +- if (!rv) ++ if (!rv) { + vunmap(vaddr); ++ free_xenballooned_pages(node->nr_handles, node->hvm.pages); ++ } + else + WARN(1, "Leaking %p, size %u page(s)\n", vaddr, + node->nr_handles); diff --git a/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch b/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch new file mode 100644 index 00000000..6899f63a --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch @@ -0,0 +1,81 @@ +From a57e456a7b28431b55e407e5ab78ebd5b378d19e Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Sat, 22 Aug 2015 16:41:17 +0200 +Subject: [PATCH] x86/apic: Fix fallout from x2apic cleanup + +In the recent x2apic cleanup I got two things really wrong: +1) The safety check in __disable_x2apic which allows the function to + be called unconditionally is backwards. The check is there to + prevent access to the apic MSR in case that the machine has no + apic. Though right now it returns if the machine has an apic and + therefor the disabling of x2apic is never invoked. + +2) x2apic_disable() sets x2apic_mode to 0 after registering the local + apic. That's wrong, because register_lapic_address() checks x2apic + mode and therefor takes the wrong code path. + +This results in boot failures on machines with x2apic preenabled by +BIOS and can also lead to an fatal MSR access on machines without +apic. + +The solutions are simple: +1) Correct the sanity check for apic availability +2) Clear x2apic_mode _before_ calling register_lapic_address() + +Fixes: 659006bf3ae3 'x86/x2apic: Split enable and setup function' +Reported-and-tested-by: Javier Monteagudo +Signed-off-by: Thomas Gleixner +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1224764 +Cc: stable@vger.kernel.org # 4.0+ +Cc: Laura Abbott +Cc: Jiang Liu +Cc: Joerg Roedel +Cc: Tony Luck +Cc: Borislav Petkov +--- + arch/x86/kernel/apic/apic.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index dcb5285..cde732c 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1424,7 +1424,7 @@ static inline void __x2apic_disable(void) + { + u64 msr; + +- if (cpu_has_apic) ++ if (!cpu_has_apic) + return; + + rdmsrl(MSR_IA32_APICBASE, msr); +@@ -1483,10 +1483,13 @@ void x2apic_setup(void) + + static __init void x2apic_disable(void) + { +- u32 x2apic_id; ++ u32 x2apic_id, state = x2apic_state; + +- if (x2apic_state != X2APIC_ON) +- goto out; ++ x2apic_mode = 0; ++ x2apic_state = X2APIC_DISABLED; ++ ++ if (state != X2APIC_ON) ++ return; + + x2apic_id = read_apic_id(); + if (x2apic_id >= 255) +@@ -1494,9 +1497,6 @@ static __init void x2apic_disable(void) + + __x2apic_disable(); + register_lapic_address(mp_lapic_addr); +-out: +- x2apic_state = X2APIC_DISABLED; +- x2apic_mode = 0; + } + + static __init void x2apic_enable(void) +-- +2.4.5 + diff --git a/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch b/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch new file mode 100644 index 00000000..ee6f69f6 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch @@ -0,0 +1,46 @@ +From e43d0189ac02415fe4487f79fc35e8f147e9ea0d Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Thu, 20 Aug 2015 12:54:39 +0800 +Subject: [PATCH] x86/idle: Restore trace_cpu_idle to mwait_idle() calls + +Commit b253149b843f ("sched/idle/x86: Restore mwait_idle() to fix boot +hangs, to improve power savings and to improve performance") restores +mwait_idle(), but the trace_cpu_idle related calls are missing. This +causes powertop on my old desktop powered by Intel Core2 E6550 to +report zero wakeups and zero events. + +Add them back to restore the proper behaviour. + +Fixes: b253149b843f ("sched/idle/x86: Restore mwait_idle() to ...") +Signed-off-by: Jisheng Zhang +Cc: +Cc: stable@vger.kernel.org # 4.1 +Link: http://lkml.kernel.org/r/1440046479-4262-1-git-send-email-jszhang@marvell.com +Signed-off-by: Thomas Gleixner +--- + arch/x86/kernel/process.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 397688b..c27cad7 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -408,6 +408,7 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) + static void mwait_idle(void) + { + if (!current_set_polling_and_test()) { ++ trace_cpu_idle_rcuidle(1, smp_processor_id()); + if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) { + smp_mb(); /* quirk */ + clflush((void *)¤t_thread_info()->flags); +@@ -419,6 +420,7 @@ static void mwait_idle(void) + __sti_mwait(0, 0); + else + local_irq_enable(); ++ trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id()); + } else { + local_irq_enable(); + } +-- +2.4.5 + diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index 42ade15b..e091fae4 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -13,6 +13,7 @@ i The Linux kernel (the core of the Linux operating system) for Pisi Linux kernel contains the Linux kernel, the core of any Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc. https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.1.tar.gz + configs/kernel-i686-config configs/kernel-x86_64-config @@ -123,6 +124,16 @@ i patches/mageia/3rd-rtl8723bs.patch patches/mageia/3rd-rtl8723bs-buildfix.patch patches/mageia/3rd-rtl8723bs-updates.patch + patches/mageia/Revert-sched-x86_64-Don-t-save-flags-on-context-swit.patch + patches/mageia/SCSI-Fix-NULL-pointer-dereference-in-runtime-PM.patch + patches/mageia/ata-Revert-libata-eh-Set-information-field-for-autosense.patch + patches/mageia/ata-Revert-libata-Implement-support-for-sense-data-repor.patch + patches/mageia/ata-Revert-libata-Implement-NCQ-autosense.patch + patches/mageia/fs-Revert-ext4-remove-block_device_ejected.patch + patches/mageia/gpu-drm-i915-remove-HBR2-from-chv-supported-list.patch + patches/mageia/gpu-drm-i915-Avoid-TP3-on-CHV.patch + patches/mageia/x86-apic-Fix-fallout-from-x2apic-cleanup.patch + patches/mageia/x86-idle-Restore-trace_cpu_idle-to-mwait_idle-calls.patch @@ -177,7 +188,15 @@ i - + + 2015-08-18 4.1.6 Version bump to 4.1.6 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6 @@ -185,7 +204,7 @@ i Ertuğrul Erata ertugrulerata@gmail.com - + 2015-08-13 4.1.5 Version bump to 4.1.5 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.5