diff --git a/kernel/kernel/actions.py b/kernel/kernel/actions.py index e4aedaef..c408853b 100644 --- a/kernel/kernel/actions.py +++ b/kernel/kernel/actions.py @@ -34,3 +34,18 @@ def install(): # Generate some module lists to use within mkinitramfs shelltools.system("./generate-module-list %s/lib/modules/%s" % (get.installDIR(), kerneltools.__getSuffix())) + + + #mkinitcpio default config + pisitools.dodir("/etc/mkinitcpio.d") + shelltools.touch("linux.preset") + + shelltools.echo("linux.preset", 'ALL_config="/etc/mkinitcpio.conf"\n'+ + + 'ALL_kver="/boot/kernel-%s"\n'% get.srcVERSION() + + + 'default_image="/boot/initramfs-%s.img"\n'% get.srcVERSION() + + + 'default_options="-S autodetect"\n') + + pisitools.insinto("/etc/mkinitcpio.d", "linux.preset") diff --git a/kernel/kernel/files/configs/kernel-x86_64-config b/kernel/kernel/files/configs/kernel-x86_64-config index 9a624aec..8f4c7dbc 100644 --- a/kernel/kernel/files/configs/kernel-x86_64-config +++ b/kernel/kernel/files/configs/kernel-x86_64-config @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 4.4.4 Kernel Configuration +# Linux/x86_64 4.4.8 Kernel Configuration # CONFIG_64BIT=y CONFIG_X86_64=y diff --git a/kernel/kernel/files/patches/linux/patch-4.4.8.xz b/kernel/kernel/files/patches/linux/patch-4.4.8.xz new file mode 100644 index 00000000..95b5d264 Binary files /dev/null and b/kernel/kernel/files/patches/linux/patch-4.4.8.xz differ diff --git a/kernel/kernel/files/patches/mageia/Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch b/kernel/kernel/files/patches/mageia/Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch new file mode 100644 index 00000000..965e5c74 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch @@ -0,0 +1,197 @@ +From 43034bc4606f1f21186ca6fe27bc0448159d5e00 Mon Sep 17 00:00:00 2001 +From: Thomas Backlund +Date: Thu, 10 Mar 2016 15:44:13 +0200 +Subject: [PATCH] Revert "ipmi: Start the timer and thread on internal msgs" + +This reverts commit 0cfec916e86d881e209de4b4ae9959a6271e6660. + +It's reported on ipmi list that Dell R720xd servers will always panic +on dell ipmi services load + +Reverting this fixes the issue. + +Signed-off-by: Thomas Backlund + +--- + drivers/char/ipmi/ipmi_si_intf.c | 73 ++++++++++++++++------------------------ + 1 file changed, 29 insertions(+), 44 deletions(-) + +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 4cc72fa..f667be8 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -412,42 +412,18 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info) + return rv; + } + +-static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val) +-{ +- smi_info->last_timeout_jiffies = jiffies; +- mod_timer(&smi_info->si_timer, new_val); +- smi_info->timer_running = true; +-} +- +-/* +- * Start a new message and (re)start the timer and thread. +- */ +-static void start_new_msg(struct smi_info *smi_info, unsigned char *msg, +- unsigned int size) +-{ +- smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES); +- +- if (smi_info->thread) +- wake_up_process(smi_info->thread); +- +- smi_info->handlers->start_transaction(smi_info->si_sm, msg, size); +-} +- +-static void start_check_enables(struct smi_info *smi_info, bool start_timer) ++static void start_check_enables(struct smi_info *smi_info) + { + unsigned char msg[2]; + + msg[0] = (IPMI_NETFN_APP_REQUEST << 2); + msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD; + +- if (start_timer) +- start_new_msg(smi_info, msg, 2); +- else +- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2); ++ smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2); + smi_info->si_state = SI_CHECKING_ENABLES; + } + +-static void start_clear_flags(struct smi_info *smi_info, bool start_timer) ++static void start_clear_flags(struct smi_info *smi_info) + { + unsigned char msg[3]; + +@@ -456,10 +432,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer) + msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD; + msg[2] = WDT_PRE_TIMEOUT_INT; + +- if (start_timer) +- start_new_msg(smi_info, msg, 3); +- else +- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3); ++ smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3); + smi_info->si_state = SI_CLEARING_FLAGS; + } + +@@ -469,8 +442,10 @@ static void start_getting_msg_queue(struct smi_info *smi_info) + smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD; + smi_info->curr_msg->data_size = 2; + +- start_new_msg(smi_info, smi_info->curr_msg->data, +- smi_info->curr_msg->data_size); ++ smi_info->handlers->start_transaction( ++ smi_info->si_sm, ++ smi_info->curr_msg->data, ++ smi_info->curr_msg->data_size); + smi_info->si_state = SI_GETTING_MESSAGES; + } + +@@ -480,11 +455,20 @@ static void start_getting_events(struct smi_info *smi_info) + smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD; + smi_info->curr_msg->data_size = 2; + +- start_new_msg(smi_info, smi_info->curr_msg->data, +- smi_info->curr_msg->data_size); ++ smi_info->handlers->start_transaction( ++ smi_info->si_sm, ++ smi_info->curr_msg->data, ++ smi_info->curr_msg->data_size); + smi_info->si_state = SI_GETTING_EVENTS; + } + ++static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val) ++{ ++ smi_info->last_timeout_jiffies = jiffies; ++ mod_timer(&smi_info->si_timer, new_val); ++ smi_info->timer_running = true; ++} ++ + /* + * When we have a situtaion where we run out of memory and cannot + * allocate messages, we just leave them in the BMC and run the system +@@ -494,11 +478,11 @@ static void start_getting_events(struct smi_info *smi_info) + * Note that we cannot just use disable_irq(), since the interrupt may + * be shared. + */ +-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer) ++static inline bool disable_si_irq(struct smi_info *smi_info) + { + if ((smi_info->irq) && (!smi_info->interrupt_disabled)) { + smi_info->interrupt_disabled = true; +- start_check_enables(smi_info, start_timer); ++ start_check_enables(smi_info); + return true; + } + return false; +@@ -508,7 +492,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info) + { + if ((smi_info->irq) && (smi_info->interrupt_disabled)) { + smi_info->interrupt_disabled = false; +- start_check_enables(smi_info, true); ++ start_check_enables(smi_info); + return true; + } + return false; +@@ -526,7 +510,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info) + + msg = ipmi_alloc_smi_msg(); + if (!msg) { +- if (!disable_si_irq(smi_info, true)) ++ if (!disable_si_irq(smi_info)) + smi_info->si_state = SI_NORMAL; + } else if (enable_si_irq(smi_info)) { + ipmi_free_smi_msg(msg); +@@ -542,7 +526,7 @@ static void handle_flags(struct smi_info *smi_info) + /* Watchdog pre-timeout */ + smi_inc_stat(smi_info, watchdog_pretimeouts); + +- start_clear_flags(smi_info, true); ++ start_clear_flags(smi_info); + smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT; + if (smi_info->intf) + ipmi_smi_watchdog_pretimeout(smi_info->intf); +@@ -895,7 +879,8 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info, + msg[0] = (IPMI_NETFN_APP_REQUEST << 2); + msg[1] = IPMI_GET_MSG_FLAGS_CMD; + +- start_new_msg(smi_info, msg, 2); ++ smi_info->handlers->start_transaction( ++ smi_info->si_sm, msg, 2); + smi_info->si_state = SI_GETTING_FLAGS; + goto restart; + } +@@ -925,7 +910,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info, + * disable and messages disabled. + */ + if (smi_info->supports_event_msg_buff || smi_info->irq) { +- start_check_enables(smi_info, true); ++ start_check_enables(smi_info); + } else { + smi_info->curr_msg = alloc_msg_handle_irq(smi_info); + if (!smi_info->curr_msg) +@@ -3635,7 +3620,7 @@ static int try_smi_init(struct smi_info *new_smi) + * Start clearing the flags before we enable interrupts or the + * timer to avoid racing with the timer. + */ +- start_clear_flags(new_smi, false); ++ start_clear_flags(new_smi); + + /* + * IRQ is defined to be set when non-zero. req_events will +@@ -3930,7 +3915,7 @@ static void cleanup_one_si(struct smi_info *to_clean) + poll(to_clean); + schedule_timeout_uninterruptible(1); + } +- disable_si_irq(to_clean, false); ++ disable_si_irq(to_clean); + while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) { + poll(to_clean); + schedule_timeout_uninterruptible(1); +-- +2.7.2 + diff --git a/kernel/kernel/files/patches/mageia/ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch b/kernel/kernel/files/patches/mageia/ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch deleted file mode 100644 index 96ca0e8b..00000000 --- a/kernel/kernel/files/patches/mageia/ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch +++ /dev/null @@ -1,44 +0,0 @@ -From f5bdd66c705484b4bc77eb914be15c1b7881fae7 Mon Sep 17 00:00:00 2001 -From: Alexandra Yates -Date: Wed, 17 Feb 2016 19:36:20 -0800 -Subject: [PATCH] Adding Intel Lewisburg device IDs for SATA - -This patch complements the list of device IDs previously -added for lewisburg sata. - -Signed-off-by: Alexandra Yates -Signed-off-by: Tejun Heo -Cc: stable@vger.kernel.org ---- - drivers/ata/ahci.c | 6 ++++++ - 1 file changed, 6 insertions(+) - -diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c -index 546a369..b6263b3 100644 ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -367,15 +367,21 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */ - { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */ - { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/ - { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/ - { PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0xa1d2), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0xa1d6), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/ - { PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ - - /* JMicron 360/1/3/5/6, match class to avoid IDE function */ - { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, --- -2.7.2 - diff --git a/kernel/kernel/files/patches/mageia/ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch b/kernel/kernel/files/patches/mageia/ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch deleted file mode 100644 index 6b53ff17..00000000 --- a/kernel/kernel/files/patches/mageia/ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch +++ /dev/null @@ -1,45 +0,0 @@ -From dc8b4afc4a04fac8ee55a19b59f2356a25e7e778 Mon Sep 17 00:00:00 2001 -From: Manuel Lauss -Date: Sat, 27 Feb 2016 16:10:05 +0100 -Subject: [PATCH] ata: ahci: don't mark HotPlugCapable Ports as - external/removable - -The HPCP bit is set by bioses for on-board sata ports either because -they think sata is hotplug capable in general or to allow Windows -to display a "device eject" icon on ports which are routed to an -external connector bracket. - -However in Redhat Bugzilla #1310682, users report that with kernel 4.4, -where this bit test first appeared, a lot of partitions on sata drives -are now mounted automatically. - -This patch should fix redhat and a lot of other distros which -unconditionally automount all devices which have the "removable" -bit set. - -Signed-off-by: Manuel Lauss -Signed-off-by: Tejun Heo -Fixes: 8a3e33cf92c7 ("ata: ahci: find eSATA ports and flag them as removable" changes userspace behavior) -Link: http://lkml.kernel.org/g/56CF35FA.1070500@redhat.com -Cc: stable@vger.kernel.org #v4.4+ ---- - drivers/ata/libahci.c | 3 +-- - 1 file changed, 1 insertion(+), 2 deletions(-) - -diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c -index 513b3fa..85ea514 100644 ---- a/drivers/ata/libahci.c -+++ b/drivers/ata/libahci.c -@@ -1168,8 +1168,7 @@ static void ahci_port_init(struct device *dev, struct ata_port *ap, - - /* mark esata ports */ - tmp = readl(port_mmio + PORT_CMD); -- if ((tmp & PORT_CMD_HPCP) || -- ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS))) -+ if ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS)) - ap->pflags |= ATA_PFLAG_EXTERNAL; - } - --- -2.7.2 - diff --git a/kernel/kernel/files/patches/mageia/libata-Align-ata_device-s-id-on-a-cacheline.patch b/kernel/kernel/files/patches/mageia/libata-Align-ata_device-s-id-on-a-cacheline.patch deleted file mode 100644 index 2892b5f1..00000000 --- a/kernel/kernel/files/patches/mageia/libata-Align-ata_device-s-id-on-a-cacheline.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 4ee34ea3a12396f35b26d90a094c75db95080baa Mon Sep 17 00:00:00 2001 -From: Harvey Hunt -Date: Wed, 24 Feb 2016 15:16:43 +0000 -Subject: [PATCH] libata: Align ata_device's id on a cacheline - -The id buffer in ata_device is a DMA target, but it isn't explicitly -cacheline aligned. Due to this, adjacent fields can be overwritten with -stale data from memory on non coherent architectures. As a result, the -kernel is sometimes unable to communicate with an ATA device. - -Fix this by ensuring that the id buffer is cacheline aligned. - -This issue is similar to that fixed by Commit 84bda12af31f -("libata: align ap->sector_buf"). - -Signed-off-by: Harvey Hunt -Cc: linux-kernel@vger.kernel.org -Cc: # 2.6.18 -Signed-off-by: Tejun Heo ---- - include/linux/libata.h | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/include/linux/libata.h b/include/linux/libata.h -index bec2abb..2c4ebef 100644 ---- a/include/linux/libata.h -+++ b/include/linux/libata.h -@@ -720,7 +720,7 @@ struct ata_device { - union { - u16 id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */ - u32 gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */ -- }; -+ } ____cacheline_aligned; - - /* DEVSLP Timing Variables from Identify Device Data Log */ - u8 devslp_timing[ATA_LOG_DEVSLP_SIZE]; --- -2.7.2 - diff --git a/kernel/kernel/files/patches/mageia/libata-fix-HDIO_GET_32BIT-ioctl.patch b/kernel/kernel/files/patches/mageia/libata-fix-HDIO_GET_32BIT-ioctl.patch deleted file mode 100644 index b6a453cf..00000000 --- a/kernel/kernel/files/patches/mageia/libata-fix-HDIO_GET_32BIT-ioctl.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann -Date: Thu, 11 Feb 2016 14:16:27 +0100 -Subject: [PATCH] libata: fix HDIO_GET_32BIT ioctl - -As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not -work correctly in compat mode with libata. - -I have investigated the issue further and found multiple problems -that all appeared with the same commit that originally introduced -HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably -also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy -a 'long' variable containing either 0 or 1 to user space. - -The problems with this are: - -* On big-endian machines, this will always write a zero because it - stores the wrong byte into user space. - -* In compat mode, the upper three bytes of the variable are updated - by the compat_hdio_ioctl() function, but they now contain - uninitialized stack data. - -* The hdparm tool calling this ioctl uses a 'static long' variable - to store the result. This means at least the upper bytes are - initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT - would fill them with data that remains stale when the low byte - is overwritten. Fortunately libata doesn't implement any of the - affected ioctl commands, so this would only happen when we query - both an IDE and an ATA device in the same command such as - "hdparm -N -c /dev/hda /dev/sda" - -* The libata code for unknown reasons started using ATA_IOC_GET_IO32 - and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT, - while the ioctl commands that were added later use the normal - HDIO_* names. This is harmless but rather confusing. - -This addresses all four issues by changing the code to use put_user() -on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem -does, and by clarifying the names of the ioctl commands. - -Signed-off-by: Arnd Bergmann -Reported-by: Soohoon Lee -Tested-by: Soohoon Lee -Cc: stable@vger.kernel.org -Signed-off-by: Tejun Heo ---- - drivers/ata/libata-scsi.c | 11 +++++------ - include/linux/ata.h | 4 ++-- - 2 files changed, 7 insertions(+), 8 deletions(-) - -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index 7e959f9..e417e1a 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap) - int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev, - int cmd, void __user *arg) - { -- int val = -EINVAL, rc = -EINVAL; -+ unsigned long val; -+ int rc = -EINVAL; - unsigned long flags; - - switch (cmd) { -- case ATA_IOC_GET_IO32: -+ case HDIO_GET_32BIT: - spin_lock_irqsave(ap->lock, flags); - val = ata_ioc32(ap); - spin_unlock_irqrestore(ap->lock, flags); -- if (copy_to_user(arg, &val, 1)) -- return -EFAULT; -- return 0; -+ return put_user(val, (unsigned long __user *)arg); - -- case ATA_IOC_SET_IO32: -+ case HDIO_SET_32BIT: - val = (unsigned long) arg; - rc = 0; - spin_lock_irqsave(ap->lock, flags); -diff --git a/include/linux/ata.h b/include/linux/ata.h -index d2992bf..c1a2f34 100644 ---- a/include/linux/ata.h -+++ b/include/linux/ata.h -@@ -487,8 +487,8 @@ enum ata_tf_protocols { - }; - - enum ata_ioctls { -- ATA_IOC_GET_IO32 = 0x309, -- ATA_IOC_SET_IO32 = 0x324, -+ ATA_IOC_GET_IO32 = 0x309, /* HDIO_GET_32BIT */ -+ ATA_IOC_SET_IO32 = 0x324, /* HDIO_SET_32BIT */ - }; - - /* core structures */ --- -2.7.2 - diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-check-for-size-overflow.patch b/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-check-for-size-overflow.patch new file mode 100644 index 00000000..0eb09157 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-check-for-size-overflow.patch @@ -0,0 +1,32 @@ +List: netfilter-devel +Subject: [PATCH nf] netfilter: x_tables: check for size overflow +From: Florian Westphal +Date: 2016-03-10 0:56:23 +Message-ID: 1457571383-25520-1-git-send-email-fw () strlen ! de +Ben Hawkes says: + integer overflow in xt_alloc_table_info, which on 32-bit systems can + lead to small structure allocation and a copy_from_user based heap + corruption. + +Reported-by: Ben Hawkes +Signed-off-by: Florian Westphal +--- + net/netfilter/x_tables.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index c8a0b7d..17a9a9f 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + struct xt_table_info *info = NULL; + size_t sz = sizeof(*info) + size; + ++ if (sz < size || sz < sizeof(*info)) ++ return NULL; ++ + /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ + if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) + return NULL; +-- +2.4.10 diff --git a/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch b/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch new file mode 100644 index 00000000..540f5bc3 --- /dev/null +++ b/kernel/kernel/files/patches/mageia/net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch @@ -0,0 +1,152 @@ +List: netfilter-devel +Subject: [PATCH nf] netfilter: x_tables: deal with bogus nextoffset values +From: Florian Westphal +Date: 2016-03-10 0:56:02 +Message-ID: 1457571362-25441-1-git-send-email-fw () strlen ! de + +Ben Hawkes says: + + In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it + is possible for a user-supplied ipt_entry structure to have a large + next_offset field. This field is not bounds checked prior to writing a + counter value at the supplied offset. + +Problem is that xt_entry_foreach() macro stops iterating once e->next_offset +is out of bounds, assuming this is the last entry. + +With malformed data thats not necessarily the case so we can +write outside of allocated area later as we might not have walked the +entire blob. + +Fix this by simplifying mark_source_chains -- it already has to check +if nextoff is in range to catch invalid jumps, so just do the check +when we move to a next entry as well. + +Signed-off-by: Florian Westphal +--- + net/ipv4/netfilter/arp_tables.c | 16 ++++++++-------- + net/ipv4/netfilter/ip_tables.c | 15 ++++++++------- + net/ipv6/netfilter/ip6_tables.c | 13 ++++++------- + 3 files changed, 22 insertions(+), 22 deletions(-) + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index b488cac..5a0b591 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -437,6 +437,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo, + + /* Move along one */ + size = e->next_offset; ++ ++ if (pos + size > newinfo->size - sizeof(*e)) ++ return 0; ++ + e = (struct arpt_entry *) + (entry0 + pos + size); + e->counters.pcnt = pos; +@@ -447,14 +451,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo, + if (strcmp(t->target.u.user.name, + XT_STANDARD_TARGET) == 0 && + newpos >= 0) { +- if (newpos > newinfo->size - +- sizeof(struct arpt_entry)) { +- duprintf("mark_source_chains: " +- "bad verdict (%i)\n", +- newpos); +- return 0; +- } +- + /* This a jump; chase it. */ + duprintf("Jump rule %u -> %u\n", + pos, newpos); +@@ -462,6 +458,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo, + /* ... this is a fallthru */ + newpos = pos + e->next_offset; + } ++ ++ if (newpos > newinfo->size - sizeof(*e)) ++ return 0; ++ + e = (struct arpt_entry *) + (entry0 + newpos); + e->counters.pcnt = pos; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index b99affa..ceb995f 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -519,6 +519,10 @@ mark_source_chains(const struct xt_table_info *newinfo, + + /* Move along one */ + size = e->next_offset; ++ ++ if (pos + size > newinfo->size - sizeof(*e)) ++ return 0; ++ + e = (struct ipt_entry *) + (entry0 + pos + size); + e->counters.pcnt = pos; +@@ -529,13 +533,6 @@ mark_source_chains(const struct xt_table_info *newinfo, + if (strcmp(t->target.u.user.name, + XT_STANDARD_TARGET) == 0 && + newpos >= 0) { +- if (newpos > newinfo->size - +- sizeof(struct ipt_entry)) { +- duprintf("mark_source_chains: " +- "bad verdict (%i)\n", +- newpos); +- return 0; +- } + /* This a jump; chase it. */ + duprintf("Jump rule %u -> %u\n", + pos, newpos); +@@ -543,6 +540,10 @@ mark_source_chains(const struct xt_table_info *newinfo, + /* ... this is a fallthru */ + newpos = pos + e->next_offset; + } ++ ++ if (newpos > newinfo->size - sizeof(*e)) ++ return 0; ++ + e = (struct ipt_entry *) + (entry0 + newpos); + e->counters.pcnt = pos; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 99425cf..d88a794 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -531,6 +531,8 @@ mark_source_chains(const struct xt_table_info *newinfo, + + /* Move along one */ + size = e->next_offset; ++ if (pos + size > newinfo->size - sizeof(*e)) ++ return 0; + e = (struct ip6t_entry *) + (entry0 + pos + size); + e->counters.pcnt = pos; +@@ -541,13 +543,6 @@ mark_source_chains(const struct xt_table_info *newinfo, + if (strcmp(t->target.u.user.name, + XT_STANDARD_TARGET) == 0 && + newpos >= 0) { +- if (newpos > newinfo->size - +- sizeof(struct ip6t_entry)) { +- duprintf("mark_source_chains: " +- "bad verdict (%i)\n", +- newpos); +- return 0; +- } + /* This a jump; chase it. */ + duprintf("Jump rule %u -> %u\n", + pos, newpos); +@@ -555,6 +550,10 @@ mark_source_chains(const struct xt_table_info *newinfo, + /* ... this is a fallthru */ + newpos = pos + e->next_offset; + } ++ ++ if (newpos > newinfo->size - sizeof(*e)) ++ return 0; ++ + e = (struct ip6t_entry *) + (entry0 + newpos); + e->counters.pcnt = pos; +-- +2.4.10 diff --git a/kernel/kernel/files/patches/mageia/pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch b/kernel/kernel/files/patches/mageia/pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch new file mode 100644 index 00000000..8067901f --- /dev/null +++ b/kernel/kernel/files/patches/mageia/pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch @@ -0,0 +1,250 @@ +From 759c01142a5d0f364a462346168a56de28a80f52 Mon Sep 17 00:00:00 2001 +From: Willy Tarreau +Date: Mon, 18 Jan 2016 16:36:09 +0100 +Subject: [PATCH] pipe: limit the per-user amount of pages allocated in pipes + +On no-so-small systems, it is possible for a single process to cause an +OOM condition by filling large pipes with data that are never read. A +typical process filling 4000 pipes with 1 MB of data will use 4 GB of +memory. On small systems it may be tricky to set the pipe max size to +prevent this from happening. + +This patch makes it possible to enforce a per-user soft limit above +which new pipes will be limited to a single page, effectively limiting +them to 4 kB each, as well as a hard limit above which no new pipes may +be created for this user. This has the effect of protecting the system +against memory abuse without hurting other users, and still allowing +pipes to work correctly though with less data at once. + +The limit are controlled by two new sysctls : pipe-user-pages-soft, and +pipe-user-pages-hard. Both may be disabled by setting them to zero. The +default soft limit allows the default number of FDs per process (1024) +to create pipes of the default size (64kB), thus reaching a limit of 64MB +before starting to create only smaller pipes. With 256 processes limited +to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB = +1084 MB of memory allocated for a user. The hard limit is disabled by +default to avoid breaking existing applications that make intensive use +of pipes (eg: for splicing). + +Reported-by: socketpair@gmail.com +Reported-by: Tetsuo Handa +Mitigates: CVE-2013-4312 (Linux 2.0+) +Suggested-by: Linus Torvalds +Signed-off-by: Willy Tarreau +Signed-off-by: Al Viro +--- + Documentation/sysctl/fs.txt | 23 ++++++++++++++++++++++ + fs/pipe.c | 47 +++++++++++++++++++++++++++++++++++++++++++-- + include/linux/pipe_fs_i.h | 4 ++++ + include/linux/sched.h | 1 + + kernel/sysctl.c | 14 ++++++++++++++ + 5 files changed, 87 insertions(+), 2 deletions(-) + +diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt +index 88152f2..302b5ed 100644 +--- a/Documentation/sysctl/fs.txt ++++ b/Documentation/sysctl/fs.txt +@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs: + - nr_open + - overflowuid + - overflowgid ++- pipe-user-pages-hard ++- pipe-user-pages-soft + - protected_hardlinks + - protected_symlinks + - suid_dumpable +@@ -159,6 +161,27 @@ The default is 65534. + + ============================================================== + ++pipe-user-pages-hard: ++ ++Maximum total number of pages a non-privileged user may allocate for pipes. ++Once this limit is reached, no new pipes may be allocated until usage goes ++below the limit again. When set to 0, no limit is applied, which is the default ++setting. ++ ++============================================================== ++ ++pipe-user-pages-soft: ++ ++Maximum total number of pages a non-privileged user may allocate for pipes ++before the pipe size gets limited to a single page. Once this limit is reached, ++new pipes will be limited to a single page in size for this user in order to ++limit total memory usage, and trying to increase them using fcntl() will be ++denied until usage goes below the limit again. The default value allows to ++allocate up to 1024 pipes at their default size. When set to 0, no limit is ++applied. ++ ++============================================================== ++ + protected_hardlinks: + + A long-standing class of security issues is the hardlink-based +diff --git a/fs/pipe.c b/fs/pipe.c +index 42cf8dd..ab8dad3 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -38,6 +38,12 @@ unsigned int pipe_max_size = 1048576; + */ + unsigned int pipe_min_size = PAGE_SIZE; + ++/* Maximum allocatable pages per user. Hard limit is unset by default, soft ++ * matches default values. ++ */ ++unsigned long pipe_user_pages_hard; ++unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR; ++ + /* + * We use a start+len construction, which provides full use of the + * allocated memory. +@@ -583,20 +589,49 @@ pipe_fasync(int fd, struct file *filp, int on) + return retval; + } + ++static void account_pipe_buffers(struct pipe_inode_info *pipe, ++ unsigned long old, unsigned long new) ++{ ++ atomic_long_add(new - old, &pipe->user->pipe_bufs); ++} ++ ++static bool too_many_pipe_buffers_soft(struct user_struct *user) ++{ ++ return pipe_user_pages_soft && ++ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft; ++} ++ ++static bool too_many_pipe_buffers_hard(struct user_struct *user) ++{ ++ return pipe_user_pages_hard && ++ atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard; ++} ++ + struct pipe_inode_info *alloc_pipe_info(void) + { + struct pipe_inode_info *pipe; + + pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL); + if (pipe) { +- pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL); ++ unsigned long pipe_bufs = PIPE_DEF_BUFFERS; ++ struct user_struct *user = get_current_user(); ++ ++ if (!too_many_pipe_buffers_hard(user)) { ++ if (too_many_pipe_buffers_soft(user)) ++ pipe_bufs = 1; ++ pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL); ++ } ++ + if (pipe->bufs) { + init_waitqueue_head(&pipe->wait); + pipe->r_counter = pipe->w_counter = 1; +- pipe->buffers = PIPE_DEF_BUFFERS; ++ pipe->buffers = pipe_bufs; ++ pipe->user = user; ++ account_pipe_buffers(pipe, 0, pipe_bufs); + mutex_init(&pipe->mutex); + return pipe; + } ++ free_uid(user); + kfree(pipe); + } + +@@ -607,6 +642,8 @@ void free_pipe_info(struct pipe_inode_info *pipe) + { + int i; + ++ account_pipe_buffers(pipe, pipe->buffers, 0); ++ free_uid(pipe->user); + for (i = 0; i < pipe->buffers; i++) { + struct pipe_buffer *buf = pipe->bufs + i; + if (buf->ops) +@@ -998,6 +1035,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) + memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer)); + } + ++ account_pipe_buffers(pipe, pipe->buffers, nr_pages); + pipe->curbuf = 0; + kfree(pipe->bufs); + pipe->bufs = bufs; +@@ -1069,6 +1107,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg) + if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) { + ret = -EPERM; + goto out; ++ } else if ((too_many_pipe_buffers_hard(pipe->user) || ++ too_many_pipe_buffers_soft(pipe->user)) && ++ !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) { ++ ret = -EPERM; ++ goto out; + } + ret = pipe_set_size(pipe, nr_pages); + break; +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index eb8b8ac..24f5470 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -42,6 +42,7 @@ struct pipe_buffer { + * @fasync_readers: reader side fasync + * @fasync_writers: writer side fasync + * @bufs: the circular array of pipe buffers ++ * @user: the user who created this pipe + **/ + struct pipe_inode_info { + struct mutex mutex; +@@ -57,6 +58,7 @@ struct pipe_inode_info { + struct fasync_struct *fasync_readers; + struct fasync_struct *fasync_writers; + struct pipe_buffer *bufs; ++ struct user_struct *user; + }; + + /* +@@ -123,6 +125,8 @@ void pipe_unlock(struct pipe_inode_info *); + void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *); + + extern unsigned int pipe_max_size, pipe_min_size; ++extern unsigned long pipe_user_pages_hard; ++extern unsigned long pipe_user_pages_soft; + int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *); + + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 61aa9bb..1589ddc8 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -835,6 +835,7 @@ struct user_struct { + #endif + unsigned long locked_shm; /* How many pages of mlocked shm ? */ + unsigned long unix_inflight; /* How many files in flight in unix sockets */ ++ atomic_long_t pipe_bufs; /* how many pages are allocated in pipe buffers */ + + #ifdef CONFIG_KEYS + struct key *uid_keyring; /* UID specific keyring */ +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index c810f8a..f6fd236 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -1757,6 +1757,20 @@ static struct ctl_table fs_table[] = { + .proc_handler = &pipe_proc_fn, + .extra1 = &pipe_min_size, + }, ++ { ++ .procname = "pipe-user-pages-hard", ++ .data = &pipe_user_pages_hard, ++ .maxlen = sizeof(pipe_user_pages_hard), ++ .mode = 0644, ++ .proc_handler = proc_doulongvec_minmax, ++ }, ++ { ++ .procname = "pipe-user-pages-soft", ++ .data = &pipe_user_pages_soft, ++ .maxlen = sizeof(pipe_user_pages_soft), ++ .mode = 0644, ++ .proc_handler = proc_doulongvec_minmax, ++ }, + { } + }; + +-- +2.7.2 + diff --git a/kernel/kernel/files/patches/mageia/series b/kernel/kernel/files/patches/mageia/series index 9a73c795..6c12247d 100644 --- a/kernel/kernel/files/patches/mageia/series +++ b/kernel/kernel/files/patches/mageia/series @@ -14,27 +14,6 @@ ### ### Stable Queue ### -stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch -stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch -stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch -stable-btrfs-fix-no_space-in-write-and-rm-loop.patch -stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch -stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch -stable-block-initialize-max_dev_sectors-to-0.patch -stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch -stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch -stable-mips-kvm-fix-ioctl-error-handling.patch -stable-kvm-x86-update-tsc-multiplier-on-change.patch -stable-fbcon-set-a-default-value-to-blink-interval.patch -stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch -stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch -stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch -stable-vfio-fix-ioctl-error-handling.patch -stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch -stable-arm-arm64-kvm-fix-ioctl-error-handling.patch -stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch -stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch -stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch ### ### Arch x86 @@ -142,14 +121,13 @@ block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch # ahci ids ahci-add-new-Intel-device-IDs.patch -ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch -# fix unwanted automounting of partitions -ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch +### +### Char +### -# libata fixes -libata-Align-ata_device-s-id-on-a-cacheline.patch -libata-fix-HDIO_GET_32BIT-ioctl.patch +# hard locks Dell R720xd +Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch ### ### File-system @@ -162,6 +140,9 @@ fs-aufs-4.4-modular.patch # ovl fixes fs-ovl-move-super-block-magic-number-to-magic.h.patch +# CVE-2016-2847 +pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch + ### ### FireWire ### @@ -272,6 +253,10 @@ net-netfilter-psd.patch net-netfilter-psd-mdv.patch net-netfilter-psd-2.6.35-buildfix.patch +# CVE pending +net-netfilter-x_tables-check-for-size-overflow.patch +net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch + ### ### Platform drivers ### diff --git a/kernel/kernel/files/patches/mageia/stable-arm-arm64-kvm-fix-ioctl-error-handling.patch b/kernel/kernel/files/patches/mageia/stable-arm-arm64-kvm-fix-ioctl-error-handling.patch deleted file mode 100644 index 507fd847..00000000 --- a/kernel/kernel/files/patches/mageia/stable-arm-arm64-kvm-fix-ioctl-error-handling.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 4cad67fca3fc952d6f2ed9e799621f07666a560f Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" -Date: Sun, 28 Feb 2016 17:32:07 +0200 -Subject: arm/arm64: KVM: Fix ioctl error handling - -From: Michael S. Tsirkin - -commit 4cad67fca3fc952d6f2ed9e799621f07666a560f upstream. - -Calling return copy_to_user(...) in an ioctl will not -do the right thing if there's a pagefault: -copy_to_user returns the number of bytes not copied -in this case. - -Fix up kvm to do - return copy_to_user(...)) ? -EFAULT : 0; - -everywhere. - -Acked-by: Christoffer Dall -Signed-off-by: Michael S. Tsirkin -Signed-off-by: Marc Zyngier -Signed-off-by: Greg Kroah-Hartman - ---- - arch/arm/kvm/guest.c | 2 +- - arch/arm64/kvm/guest.c | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - ---- a/arch/arm/kvm/guest.c -+++ b/arch/arm/kvm/guest.c -@@ -155,7 +155,7 @@ static int get_timer_reg(struct kvm_vcpu - u64 val; - - val = kvm_arm_timer_get_reg(vcpu, reg->id); -- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)); -+ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0; - } - - static unsigned long num_core_regs(void) ---- a/arch/arm64/kvm/guest.c -+++ b/arch/arm64/kvm/guest.c -@@ -186,7 +186,7 @@ static int get_timer_reg(struct kvm_vcpu - u64 val; - - val = kvm_arm_timer_get_reg(vcpu, reg->id); -- return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)); -+ return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0; - } - - /** diff --git a/kernel/kernel/files/patches/mageia/stable-block-initialize-max_dev_sectors-to-0.patch b/kernel/kernel/files/patches/mageia/stable-block-initialize-max_dev_sectors-to-0.patch deleted file mode 100644 index 9546bf7a..00000000 --- a/kernel/kernel/files/patches/mageia/stable-block-initialize-max_dev_sectors-to-0.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 5f009d3f8e6685fe8c6215082c1696a08b411220 Mon Sep 17 00:00:00 2001 -From: Keith Busch -Date: Wed, 10 Feb 2016 16:52:47 -0700 -Subject: block: Initialize max_dev_sectors to 0 - -From: Keith Busch - -commit 5f009d3f8e6685fe8c6215082c1696a08b411220 upstream. - -The new queue limit is not used by the majority of block drivers, and -should be initialized to 0 for the driver's requested settings to be used. - -Signed-off-by: Keith Busch -Acked-by: Martin K. Petersen -Reviewed-by: Sagi Grimberg -Reviewed-by: Christoph Hellwig -Signed-off-by: Jens Axboe -Signed-off-by: Greg Kroah-Hartman - ---- - block/blk-settings.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -91,8 +91,8 @@ void blk_set_default_limits(struct queue - lim->seg_boundary_mask = BLK_SEG_BOUNDARY_MASK; - lim->virt_boundary_mask = 0; - lim->max_segment_size = BLK_MAX_SEGMENT_SIZE; -- lim->max_sectors = lim->max_dev_sectors = lim->max_hw_sectors = -- BLK_SAFE_MAX_SECTORS; -+ lim->max_sectors = lim->max_hw_sectors = BLK_SAFE_MAX_SECTORS; -+ lim->max_dev_sectors = 0; - lim->chunk_sectors = 0; - lim->max_write_same_sectors = 0; - lim->max_discard_sectors = 0; diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch deleted file mode 100644 index 25c4845c..00000000 --- a/kernel/kernel/files/patches/mageia/stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 0a95b851370b84a4b9d92ee6d1fa0926901d0454 Mon Sep 17 00:00:00 2001 -From: Qu Wenruo -Date: Fri, 22 Jan 2016 09:28:38 +0800 -Subject: btrfs: async-thread: Fix a use-after-free error for trace - -From: Qu Wenruo - -commit 0a95b851370b84a4b9d92ee6d1fa0926901d0454 upstream. - -Parameter of trace_btrfs_work_queued() can be freed in its workqueue. -So no one use use that pointer after queue_work(). - -Fix the user-after-free bug by move the trace line before queue_work(). - -Reported-by: Dave Jones -Signed-off-by: Qu Wenruo -Reviewed-by: David Sterba -Signed-off-by: Chris Mason -Signed-off-by: Greg Kroah-Hartman - ---- - fs/btrfs/async-thread.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/fs/btrfs/async-thread.c -+++ b/fs/btrfs/async-thread.c -@@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(st - list_add_tail(&work->ordered_list, &wq->ordered_list); - spin_unlock_irqrestore(&wq->list_lock, flags); - } -- queue_work(wq->normal_wq, &work->normal_work); - trace_btrfs_work_queued(work); -+ queue_work(wq->normal_wq, &work->normal_work); - } - - void btrfs_queue_work(struct btrfs_workqueue *wq, diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch deleted file mode 100644 index 2519f320..00000000 --- a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch +++ /dev/null @@ -1,238 +0,0 @@ -From c2d6cb1636d235257086f939a8194ef0bf93af6e Mon Sep 17 00:00:00 2001 -From: Filipe Manana -Date: Fri, 15 Jan 2016 11:05:12 +0000 -Subject: Btrfs: fix deadlock running delayed iputs at transaction commit time - -From: Filipe Manana - -commit c2d6cb1636d235257086f939a8194ef0bf93af6e upstream. - -While running a stress test I ran into a deadlock when running the delayed -iputs at transaction time, which produced the following report and trace: - -[ 886.399989] ============================================= -[ 886.400871] [ INFO: possible recursive locking detected ] -[ 886.401663] 4.4.0-rc6-btrfs-next-18+ #1 Not tainted -[ 886.402384] --------------------------------------------- -[ 886.403182] fio/8277 is trying to acquire lock: -[ 886.403568] (&fs_info->delayed_iput_sem){++++..}, at: [] btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.403568] -[ 886.403568] but task is already holding lock: -[ 886.403568] (&fs_info->delayed_iput_sem){++++..}, at: [] btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.403568] -[ 886.403568] other info that might help us debug this: -[ 886.403568] Possible unsafe locking scenario: -[ 886.403568] -[ 886.403568] CPU0 -[ 886.403568] ---- -[ 886.403568] lock(&fs_info->delayed_iput_sem); -[ 886.403568] lock(&fs_info->delayed_iput_sem); -[ 886.403568] -[ 886.403568] *** DEADLOCK *** -[ 886.403568] -[ 886.403568] May be due to missing lock nesting notation -[ 886.403568] -[ 886.403568] 3 locks held by fio/8277: -[ 886.403568] #0: (sb_writers#11){.+.+.+}, at: [] __sb_start_write+0x5f/0xb0 -[ 886.403568] #1: (&sb->s_type->i_mutex_key#15){+.+.+.}, at: [] btrfs_file_write_iter+0x73/0x408 [btrfs] -[ 886.403568] #2: (&fs_info->delayed_iput_sem){++++..}, at: [] btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.403568] -[ 886.403568] stack backtrace: -[ 886.403568] CPU: 6 PID: 8277 Comm: fio Not tainted 4.4.0-rc6-btrfs-next-18+ #1 -[ 886.403568] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014 -[ 886.403568] 0000000000000000 ffff88009f80f770 ffffffff8125d4fd ffffffff82af1fc0 -[ 886.403568] ffff88009f80f830 ffffffff8108e5f9 0000000200000000 ffff88009fd92290 -[ 886.403568] 0000000000000000 ffffffff82af1fc0 ffffffff829cfb01 00042b216d008804 -[ 886.403568] Call Trace: -[ 886.403568] [] dump_stack+0x4e/0x79 -[ 886.403568] [] __lock_acquire+0xd42/0xf0b -[ 886.403568] [] ? __module_address+0xdf/0x108 -[ 886.403568] [] lock_acquire+0x10d/0x194 -[ 886.403568] [] ? lock_acquire+0x10d/0x194 -[ 886.403568] [] ? btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.489542] [] down_read+0x3e/0x4d -[ 886.489542] [] ? btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.489542] [] btrfs_run_delayed_iputs+0x36/0xbf [btrfs] -[ 886.489542] [] btrfs_commit_transaction+0x8f5/0x96e [btrfs] -[ 886.489542] [] flush_space+0x435/0x44a [btrfs] -[ 886.489542] [] ? reserve_metadata_bytes+0x26a/0x384 [btrfs] -[ 886.489542] [] reserve_metadata_bytes+0x28d/0x384 [btrfs] -[ 886.489542] [] ? btrfs_block_rsv_refill+0x58/0x96 [btrfs] -[ 886.489542] [] btrfs_block_rsv_refill+0x70/0x96 [btrfs] -[ 886.489542] [] btrfs_evict_inode+0x394/0x55a [btrfs] -[ 886.489542] [] evict+0xa7/0x15c -[ 886.489542] [] iput+0x1d3/0x266 -[ 886.489542] [] btrfs_run_delayed_iputs+0x8f/0xbf [btrfs] -[ 886.489542] [] btrfs_commit_transaction+0x8f5/0x96e [btrfs] -[ 886.489542] [] ? signal_pending_state+0x31/0x31 -[ 886.489542] [] btrfs_alloc_data_chunk_ondemand+0x1d7/0x288 [btrfs] -[ 886.489542] [] btrfs_check_data_free_space+0x40/0x59 [btrfs] -[ 886.489542] [] btrfs_delalloc_reserve_space+0x1e/0x4e [btrfs] -[ 886.489542] [] btrfs_direct_IO+0x10c/0x27e [btrfs] -[ 886.489542] [] generic_file_direct_write+0xb3/0x128 -[ 886.489542] [] btrfs_file_write_iter+0x229/0x408 [btrfs] -[ 886.489542] [] ? __lock_is_held+0x38/0x50 -[ 886.489542] [] __vfs_write+0x7c/0xa5 -[ 886.489542] [] vfs_write+0xa0/0xe4 -[ 886.489542] [] SyS_write+0x50/0x7e -[ 886.489542] [] entry_SYSCALL_64_fastpath+0x12/0x6f -[ 1081.852335] INFO: task fio:8244 blocked for more than 120 seconds. -[ 1081.854348] Not tainted 4.4.0-rc6-btrfs-next-18+ #1 -[ 1081.857560] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. -[ 1081.863227] fio D ffff880213f9bb28 0 8244 8240 0x00000000 -[ 1081.868719] ffff880213f9bb28 00ffffff810fc6b0 ffffffff0000000a ffff88023ed55240 -[ 1081.872499] ffff880206b5d400 ffff880213f9c000 ffff88020a4d5318 ffff880206b5d400 -[ 1081.876834] ffffffff00000001 ffff880206b5d400 ffff880213f9bb40 ffffffff81482ba4 -[ 1081.880782] Call Trace: -[ 1081.881793] [] schedule+0x7f/0x97 -[ 1081.883340] [] rwsem_down_write_failed+0x2d5/0x325 -[ 1081.895525] [] ? trace_hardirqs_on_caller+0x16/0x1ab -[ 1081.897419] [] call_rwsem_down_write_failed+0x13/0x20 -[ 1081.899251] [] ? call_rwsem_down_write_failed+0x13/0x20 -[ 1081.901063] [] ? __down_write_nested.isra.0+0x1f/0x21 -[ 1081.902365] [] down_write+0x43/0x57 -[ 1081.903846] [] ? btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs] -[ 1081.906078] [] btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs] -[ 1081.908846] [] ? mark_held_locks+0x56/0x6c -[ 1081.910409] [] btrfs_check_data_free_space+0x40/0x59 [btrfs] -[ 1081.912482] [] btrfs_delalloc_reserve_space+0x1e/0x4e [btrfs] -[ 1081.914597] [] btrfs_direct_IO+0x10c/0x27e [btrfs] -[ 1081.919037] [] generic_file_direct_write+0xb3/0x128 -[ 1081.920754] [] btrfs_file_write_iter+0x229/0x408 [btrfs] -[ 1081.922496] [] ? __lock_is_held+0x38/0x50 -[ 1081.923922] [] __vfs_write+0x7c/0xa5 -[ 1081.925275] [] vfs_write+0xa0/0xe4 -[ 1081.926584] [] SyS_write+0x50/0x7e -[ 1081.927968] [] entry_SYSCALL_64_fastpath+0x12/0x6f -[ 1081.985293] INFO: lockdep is turned off. -[ 1081.986132] INFO: task fio:8249 blocked for more than 120 seconds. -[ 1081.987434] Not tainted 4.4.0-rc6-btrfs-next-18+ #1 -[ 1081.988534] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. -[ 1081.990147] fio D ffff880218febbb8 0 8249 8240 0x00000000 -[ 1081.991626] ffff880218febbb8 00ffffff81486b8e ffff88020000000b ffff88023ed75240 -[ 1081.993258] ffff8802120a9a00 ffff880218fec000 ffff88020a4d5318 ffff8802120a9a00 -[ 1081.994850] ffffffff00000001 ffff8802120a9a00 ffff880218febbd0 ffffffff81482ba4 -[ 1081.996485] Call Trace: -[ 1081.997037] [] schedule+0x7f/0x97 -[ 1081.998017] [] rwsem_down_write_failed+0x2d5/0x325 -[ 1081.999241] [] ? finish_wait+0x6d/0x76 -[ 1082.000306] [] call_rwsem_down_write_failed+0x13/0x20 -[ 1082.001533] [] ? call_rwsem_down_write_failed+0x13/0x20 -[ 1082.002776] [] ? __down_write_nested.isra.0+0x1f/0x21 -[ 1082.003995] [] down_write+0x43/0x57 -[ 1082.005000] [] ? btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs] -[ 1082.007403] [] btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs] -[ 1082.008988] [] btrfs_fallocate+0x7c1/0xc2f [btrfs] -[ 1082.010193] [] ? percpu_down_read+0x4e/0x77 -[ 1082.011280] [] ? __sb_start_write+0x5f/0xb0 -[ 1082.012265] [] ? __sb_start_write+0x5f/0xb0 -[ 1082.013021] [] vfs_fallocate+0x170/0x1ff -[ 1082.013738] [] ioctl_preallocate+0x89/0x9b -[ 1082.014778] [] do_vfs_ioctl+0x40a/0x4ea -[ 1082.015778] [] ? SYSC_newfstat+0x25/0x2e -[ 1082.016806] [] ? __fget_light+0x4d/0x71 -[ 1082.017789] [] SyS_ioctl+0x57/0x79 -[ 1082.018706] [] entry_SYSCALL_64_fastpath+0x12/0x6f - -This happens because we can recursively acquire the semaphore -fs_info->delayed_iput_sem when attempting to allocate space to satisfy -a file write request as shown in the first trace above - when committing -a transaction we acquire (down_read) the semaphore before running the -delayed iputs, and when running a delayed iput() we can end up calling -an inode's eviction handler, which in turn commits another transaction -and attempts to acquire (down_read) again the semaphore to run more -delayed iput operations. -This results in a deadlock because if a task acquires multiple times a -semaphore it should invoke down_read_nested() with a different lockdep -class for each level of recursion. - -Fix this by simplifying the implementation and use a mutex instead that -is acquired by the cleaner kthread before it runs the delayed iputs -instead of always acquiring a semaphore before delayed references are -run from anywhere. - -Fixes: d7c151717a1e (btrfs: Fix NO_SPACE bug caused by delayed-iput) -Signed-off-by: Filipe Manana -Signed-off-by: Chris Mason -Signed-off-by: Greg Kroah-Hartman - ---- - fs/btrfs/ctree.h | 2 +- - fs/btrfs/disk-io.c | 5 ++++- - fs/btrfs/extent-tree.c | 9 +++++---- - fs/btrfs/inode.c | 4 ---- - 4 files changed, 10 insertions(+), 10 deletions(-) - ---- a/fs/btrfs/ctree.h -+++ b/fs/btrfs/ctree.h -@@ -1572,7 +1572,7 @@ struct btrfs_fs_info { - - spinlock_t delayed_iput_lock; - struct list_head delayed_iputs; -- struct rw_semaphore delayed_iput_sem; -+ struct mutex cleaner_delayed_iput_mutex; - - /* this protects tree_mod_seq_list */ - spinlock_t tree_mod_seq_lock; ---- a/fs/btrfs/disk-io.c -+++ b/fs/btrfs/disk-io.c -@@ -1796,7 +1796,10 @@ static int cleaner_kthread(void *arg) - goto sleep; - } - -+ mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex); - btrfs_run_delayed_iputs(root); -+ mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex); -+ - again = btrfs_clean_one_deleted_snapshot(root); - mutex_unlock(&root->fs_info->cleaner_mutex); - -@@ -2556,8 +2559,8 @@ int open_ctree(struct super_block *sb, - mutex_init(&fs_info->delete_unused_bgs_mutex); - mutex_init(&fs_info->reloc_mutex); - mutex_init(&fs_info->delalloc_root_mutex); -+ mutex_init(&fs_info->cleaner_delayed_iput_mutex); - seqlock_init(&fs_info->profiles_lock); -- init_rwsem(&fs_info->delayed_iput_sem); - - INIT_LIST_HEAD(&fs_info->dirty_cowonly_roots); - INIT_LIST_HEAD(&fs_info->space_info); ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4100,11 +4100,12 @@ commit_trans: - if (ret) - return ret; - /* -- * make sure that all running delayed iput are -- * done -+ * The cleaner kthread might still be doing iput -+ * operations. Wait for it to finish so that -+ * more space is released. - */ -- down_write(&root->fs_info->delayed_iput_sem); -- up_write(&root->fs_info->delayed_iput_sem); -+ mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex); -+ mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex); - goto again; - } else { - btrfs_end_transaction(trans, root); ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -3142,8 +3142,6 @@ void btrfs_run_delayed_iputs(struct btrf - if (empty) - return; - -- down_read(&fs_info->delayed_iput_sem); -- - spin_lock(&fs_info->delayed_iput_lock); - list_splice_init(&fs_info->delayed_iputs, &list); - spin_unlock(&fs_info->delayed_iput_lock); -@@ -3154,8 +3152,6 @@ void btrfs_run_delayed_iputs(struct btrf - iput(delayed->inode); - kfree(delayed); - } -- -- up_read(&root->fs_info->delayed_iput_sem); - } - - /* diff --git a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-no_space-in-write-and-rm-loop.patch b/kernel/kernel/files/patches/mageia/stable-btrfs-fix-no_space-in-write-and-rm-loop.patch deleted file mode 100644 index 6197e535..00000000 --- a/kernel/kernel/files/patches/mageia/stable-btrfs-fix-no_space-in-write-and-rm-loop.patch +++ /dev/null @@ -1,47 +0,0 @@ -From e1746e8381cd2af421f75557b5cae3604fc18b35 Mon Sep 17 00:00:00 2001 -From: Zhao Lei -Date: Tue, 1 Dec 2015 18:39:40 +0800 -Subject: btrfs: Fix no_space in write and rm loop - -From: Zhao Lei - -commit e1746e8381cd2af421f75557b5cae3604fc18b35 upstream. - -I see no_space in v4.4-rc1 again in xfstests generic/102. -It happened randomly in some node only. -(one of 4 phy-node, and a kvm with non-virtio block driver) - -By bisect, we can found the first-bad is: - commit bdced438acd8 ("block: setup bi_phys_segments after splitting")' -But above patch only triggered the bug by making bio operation -faster(or slower). - -Main reason is in our space_allocating code, we need to commit -page writeback before wait it complish, this patch fixed above -bug. - -BTW, there is another reason for generic/102 fail, caused by -disable default mixed-blockgroup, I'll fix it in xfstests. - -Signed-off-by: Zhao Lei -Signed-off-by: Chris Mason -Signed-off-by: Greg Kroah-Hartman - ---- - fs/btrfs/extent-tree.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -4086,8 +4086,10 @@ commit_trans: - !atomic_read(&root->fs_info->open_ioctl_trans)) { - need_commit--; - -- if (need_commit > 0) -+ if (need_commit > 0) { -+ btrfs_start_delalloc_roots(fs_info, 0, -1); - btrfs_wait_ordered_roots(fs_info, -1); -+ } - - trans = btrfs_join_transaction(root); - if (IS_ERR(trans)) diff --git a/kernel/kernel/files/patches/mageia/stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch b/kernel/kernel/files/patches/mageia/stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch deleted file mode 100644 index f29a9f19..00000000 --- a/kernel/kernel/files/patches/mageia/stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch +++ /dev/null @@ -1,104 +0,0 @@ -From deb7deff2f00bdbbcb3d560dad2a89ef37df837d Mon Sep 17 00:00:00 2001 -From: Justin Maggard -Date: Tue, 9 Feb 2016 15:52:08 -0800 -Subject: cifs: fix out-of-bounds access in lease parsing - -From: Justin Maggard - -commit deb7deff2f00bdbbcb3d560dad2a89ef37df837d upstream. - -When opening a file, SMB2_open() attempts to parse the lease state from the -SMB2 CREATE Response. However, the parsing code was not careful to ensure -that the create contexts are not empty or invalid, which can lead to out- -of-bounds memory access. This can be seen easily by trying -to read a file from a OSX 10.11 SMB3 server. Here is sample crash output: - -BUG: unable to handle kernel paging request at ffff8800a1a77cc6 -IP: [] SMB2_open+0x804/0x960 -PGD 8f77067 PUD 0 -Oops: 0000 [#1] SMP -Modules linked in: -CPU: 3 PID: 2876 Comm: cp Not tainted 4.5.0-rc3.x86_64.1+ #14 -Hardware name: NETGEAR ReadyNAS 314 /ReadyNAS 314 , BIOS 4.6.5 10/11/2012 -task: ffff880073cdc080 ti: ffff88005b31c000 task.ti: ffff88005b31c000 -RIP: 0010:[] [] SMB2_open+0x804/0x960 -RSP: 0018:ffff88005b31fa08 EFLAGS: 00010282 -RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000006 -RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff88007eb8c8b0 -RBP: ffff88005b31fad8 R08: 666666203d206363 R09: 6131613030383866 -R10: 3030383866666666 R11: 00000000000002b0 R12: ffff8800660fd800 -R13: ffff8800a1a77cc2 R14: 00000000424d53fe R15: ffff88005f5a28c0 -FS: 00007f7c8a2897c0(0000) GS:ffff88007eb80000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b -CR2: ffff8800a1a77cc6 CR3: 000000005b281000 CR4: 00000000000006e0 -Stack: - ffff88005b31fa70 ffffffff88278789 00000000000001d3 ffff88005f5a2a80 - ffffffff00000003 ffff88005d029d00 ffff88006fde05a0 0000000000000000 - ffff88005b31fc78 ffff88006fde0780 ffff88005b31fb2f 0000000100000fe0 -Call Trace: - [] ? cifsConvertToUTF16+0x159/0x2d0 - [] smb2_open_file+0x98/0x210 - [] ? __kmalloc+0x1c/0xe0 - [] cifs_open+0x2a4/0x720 - [] do_dentry_open+0x1ff/0x310 - [] ? cifsFileInfo_get+0x30/0x30 - [] vfs_open+0x52/0x60 - [] path_openat+0x170/0xf70 - [] ? remove_wait_queue+0x48/0x50 - [] do_filp_open+0x79/0xd0 - [] ? __alloc_fd+0x3a/0x170 - [] do_sys_open+0x114/0x1e0 - [] SyS_open+0x19/0x20 - [] entry_SYSCALL_64_fastpath+0x12/0x6a -Code: 4d 8d 6c 07 04 31 c0 4c 89 ee e8 47 6f e5 ff 31 c9 41 89 ce 44 89 f1 48 c7 c7 28 b1 bd 88 31 c0 49 01 cd 4c 89 ee e8 2b 6f e5 ff <45> 0f b7 75 04 48 c7 c7 31 b1 bd 88 31 c0 4d 01 ee 4c 89 f6 e8 -RIP [] SMB2_open+0x804/0x960 - RSP -CR2: ffff8800a1a77cc6 ----[ end trace d9f69ba64feee469 ]--- - -Signed-off-by: Justin Maggard -Signed-off-by: Steve French -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/smb2pdu.c | 24 ++++++++++++++---------- - 1 file changed, 14 insertions(+), 10 deletions(-) - ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -1109,21 +1109,25 @@ parse_lease_state(struct TCP_Server_Info - { - char *data_offset; - struct create_context *cc; -- unsigned int next = 0; -+ unsigned int next; -+ unsigned int remaining; - char *name; - - data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset); -+ remaining = le32_to_cpu(rsp->CreateContextsLength); - cc = (struct create_context *)data_offset; -- do { -- cc = (struct create_context *)((char *)cc + next); -+ while (remaining >= sizeof(struct create_context)) { - name = le16_to_cpu(cc->NameOffset) + (char *)cc; -- if (le16_to_cpu(cc->NameLength) != 4 || -- strncmp(name, "RqLs", 4)) { -- next = le32_to_cpu(cc->Next); -- continue; -- } -- return server->ops->parse_lease_buf(cc, epoch); -- } while (next != 0); -+ if (le16_to_cpu(cc->NameLength) == 4 && -+ strncmp(name, "RqLs", 4) == 0) -+ return server->ops->parse_lease_buf(cc, epoch); -+ -+ next = le32_to_cpu(cc->Next); -+ if (!next) -+ break; -+ remaining -= next; -+ cc = (struct create_context *)((char *)cc + next); -+ } - - return 0; - } diff --git a/kernel/kernel/files/patches/mageia/stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch b/kernel/kernel/files/patches/mageia/stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch deleted file mode 100644 index 49789516..00000000 --- a/kernel/kernel/files/patches/mageia/stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 6cc3b24235929b54acd5ecc987ef11a425bd209e Mon Sep 17 00:00:00 2001 -From: Pavel Shilovsky -Date: Sat, 27 Feb 2016 11:58:18 +0300 -Subject: CIFS: Fix SMB2+ interim response processing for read requests - -From: Pavel Shilovsky - -commit 6cc3b24235929b54acd5ecc987ef11a425bd209e upstream. - -For interim responses we only need to parse a header and update -a number credits. Now it is done for all SMB2+ command except -SMB2_READ which is wrong. Fix this by adding such processing. - -Signed-off-by: Pavel Shilovsky -Tested-by: Shirish Pargaonkar -Signed-off-by: Steve French -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/cifssmb.c | 21 ++++++++++++++++++--- - 1 file changed, 18 insertions(+), 3 deletions(-) - ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -1396,11 +1396,10 @@ openRetry: - * current bigbuf. - */ - static int --cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) -+discard_remaining_data(struct TCP_Server_Info *server) - { - unsigned int rfclen = get_rfc1002_length(server->smallbuf); - int remaining = rfclen + 4 - server->total_read; -- struct cifs_readdata *rdata = mid->callback_data; - - while (remaining > 0) { - int length; -@@ -1414,10 +1413,20 @@ cifs_readv_discard(struct TCP_Server_Inf - remaining -= length; - } - -- dequeue_mid(mid, rdata->result); - return 0; - } - -+static int -+cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) -+{ -+ int length; -+ struct cifs_readdata *rdata = mid->callback_data; -+ -+ length = discard_remaining_data(server); -+ dequeue_mid(mid, rdata->result); -+ return length; -+} -+ - int - cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) - { -@@ -1446,6 +1455,12 @@ cifs_readv_receive(struct TCP_Server_Inf - return length; - server->total_read += length; - -+ if (server->ops->is_status_pending && -+ server->ops->is_status_pending(buf, server, 0)) { -+ discard_remaining_data(server); -+ return -1; -+ } -+ - /* Was the SMB read successful? */ - rdata->result = server->ops->map_error(buf, false); - if (rdata->result != 0) { diff --git a/kernel/kernel/files/patches/mageia/stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch b/kernel/kernel/files/patches/mageia/stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch deleted file mode 100644 index e0f47f2d..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 0378ba4899d5fbd8494ed6580cbc81d7b44dbac6 Mon Sep 17 00:00:00 2001 -From: Geert Uytterhoeven -Date: Wed, 24 Feb 2016 09:43:23 +0100 -Subject: drivers: sh: Restore legacy clock domain on SuperH platforms - -From: Geert Uytterhoeven - -commit 0378ba4899d5fbd8494ed6580cbc81d7b44dbac6 upstream. - -CONFIG_ARCH_SHMOBILE is not only enabled for Renesas ARM platforms -(which are DT based and multi-platform), but also on a select set of -Renesas SuperH platforms (SH7722/SH7723/SH7724/SH7343/SH7366). Hence -since commit 0ba58de231066e47 ("drivers: sh: Get rid of -CONFIG_ARCH_SHMOBILE_MULTI"), the legacy clock domain is no longer -installed on these SuperH platforms, and module clocks may not be -enabled when needed, leading to driver failures. - -To fix this, add an additional check for CONFIG_OF. - -Fixes: 0ba58de231066e47 ("drivers: sh: Get rid of CONFIG_ARCH_SHMOBILE_MULTI"). -Signed-off-by: Geert Uytterhoeven -Signed-off-by: Simon Horman -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/sh/pm_runtime.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/sh/pm_runtime.c -+++ b/drivers/sh/pm_runtime.c -@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block plat - - static int __init sh_pm_runtime_init(void) - { -- if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) { -+ if (IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_ARCH_SHMOBILE)) { - if (!of_find_compatible_node(NULL, NULL, - "renesas,cpg-mstp-clocks")) - return 0; diff --git a/kernel/kernel/files/patches/mageia/stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch b/kernel/kernel/files/patches/mageia/stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch deleted file mode 100644 index fedcd4e3..00000000 --- a/kernel/kernel/files/patches/mageia/stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch +++ /dev/null @@ -1,46 +0,0 @@ -From a187f17f0e15a046aa5d7263b35df55230d92779 Mon Sep 17 00:00:00 2001 -From: Oded Gabbay -Date: Sat, 30 Jan 2016 07:59:34 +0200 -Subject: drm/amdgpu: mask out WC from BO on unsupported arches -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -From: Oded Gabbay - -commit a187f17f0e15a046aa5d7263b35df55230d92779 upstream. - -Reviewed-by: Christian König -Reviewed-by: Michel Dänzer -Signed-off-by: Oded Gabbay -Signed-off-by: Alex Deucher -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c -@@ -33,6 +33,7 @@ - #include - #include - #include -+#include - #include "amdgpu.h" - #include "amdgpu_trace.h" - -@@ -261,6 +262,13 @@ int amdgpu_bo_create_restricted(struct a - AMDGPU_GEM_DOMAIN_OA); - - bo->flags = flags; -+ -+ /* For architectures that don't support WC memory, -+ * mask out the WC flag from the BO -+ */ -+ if (!drm_arch_can_wc_memory()) -+ bo->flags &= ~AMDGPU_GEM_CREATE_CPU_GTT_USWC; -+ - amdgpu_fill_placement_to_bo(bo, placement); - /* Kernel allocation are uninterruptible */ - r = ttm_bo_init(&adev->mman.bdev, &bo->tbo, size, type, diff --git a/kernel/kernel/files/patches/mageia/stable-fbcon-set-a-default-value-to-blink-interval.patch b/kernel/kernel/files/patches/mageia/stable-fbcon-set-a-default-value-to-blink-interval.patch deleted file mode 100644 index 4f006707..00000000 --- a/kernel/kernel/files/patches/mageia/stable-fbcon-set-a-default-value-to-blink-interval.patch +++ /dev/null @@ -1,66 +0,0 @@ -From a1e533ec07d583d01349ef13c0c965b8633e1b91 Mon Sep 17 00:00:00 2001 -From: Jean-Philippe Brucker -Date: Mon, 15 Feb 2016 18:41:33 +0000 -Subject: fbcon: set a default value to blink interval - -From: Jean-Philippe Brucker - -commit a1e533ec07d583d01349ef13c0c965b8633e1b91 upstream. - -Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459 - fbcon: use the cursor blink interval provided by vt - -two attempts have been made at fixing a possible hang caused by -cursor_timer_handler. That function registers a timer to be triggered at -"jiffies + fbcon_ops.cur_blink_jiffies". - -A new case had been encountered during initialisation of clcd-pl11x: - - fbcon_fb_registered - do_fbcon_takeover - - -> do_register_con_driver - fbcon_startup - (A) add_cursor_timer (with cur_blink_jiffies = 0) - - -> do_bind_con_driver - visual_init - fbcon_init - (B) cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms); - -If we take an softirq anywhere between A and B (and we do), -cursor_timer_handler executes indefinitely. - -Instead of patching all possible paths that lead to this case one at a -time, fix the issue at the source and initialise cur_blink_jiffies to -200ms when allocating fbcon_ops. This was its default value before -aforesaid commit. fbcon_cursor or fbcon_init will refine this value -downstream. - -Signed-off-by: Jean-Philippe Brucker -Tested-by: Scot Doyle -Signed-off-by: Tomi Valkeinen -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/video/console/fbcon.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -709,6 +709,7 @@ static int con2fb_acquire_newinfo(struct - } - - if (!err) { -+ ops->cur_blink_jiffies = HZ / 5; - info->fbcon_par = ops; - - if (vc) -@@ -956,6 +957,7 @@ static const char *fbcon_startup(void) - ops->currcon = -1; - ops->graphics = 1; - ops->cur_rotate = -1; -+ ops->cur_blink_jiffies = HZ / 5; - info->fbcon_par = ops; - p->con_rotate = initial_rotation; - set_blitting_type(vc, info); diff --git a/kernel/kernel/files/patches/mageia/stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch b/kernel/kernel/files/patches/mageia/stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch deleted file mode 100644 index 966e1f1f..00000000 --- a/kernel/kernel/files/patches/mageia/stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 Mon Sep 17 00:00:00 2001 -From: Yadan Fan -Date: Mon, 29 Feb 2016 14:44:57 +0800 -Subject: Fix cifs_uniqueid_to_ino_t() function for s390x - -From: Yadan Fan - -commit 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 upstream. - -This issue is caused by commit 02323db17e3a7 ("cifs: fix -cifs_uniqueid_to_ino_t not to ever return 0"), when BITS_PER_LONG -is 64 on s390x, the corresponding cifs_uniqueid_to_ino_t() -function will cast 64-bit fileid to 32-bit by using (ino_t)fileid, -because ino_t (typdefed __kernel_ino_t) is int type. - -It's defined in arch/s390/include/uapi/asm/posix_types.h - - #ifndef __s390x__ - - typedef unsigned long __kernel_ino_t; - ... - #else /* __s390x__ */ - - typedef unsigned int __kernel_ino_t; - -So the #ifdef condition is wrong for s390x, we can just still use -one cifs_uniqueid_to_ino_t() function with comparing sizeof(ino_t) -and sizeof(u64) to choose the correct execution accordingly. - -Signed-off-by: Yadan Fan -Signed-off-by: Steve French -Signed-off-by: Greg Kroah-Hartman - ---- - fs/cifs/cifsfs.h | 12 ++++-------- - 1 file changed, 4 insertions(+), 8 deletions(-) - ---- a/fs/cifs/cifsfs.h -+++ b/fs/cifs/cifsfs.h -@@ -31,19 +31,15 @@ - * so that it will fit. We use hash_64 to convert the value to 31 bits, and - * then add 1, to ensure that we don't end up with a 0 as the value. - */ --#if BITS_PER_LONG == 64 - static inline ino_t - cifs_uniqueid_to_ino_t(u64 fileid) - { -+ if ((sizeof(ino_t)) < (sizeof(u64))) -+ return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1; -+ - return (ino_t)fileid; -+ - } --#else --static inline ino_t --cifs_uniqueid_to_ino_t(u64 fileid) --{ -- return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1; --} --#endif - - extern struct file_system_type cifs_fs_type; - extern const struct address_space_operations cifs_addr_ops; diff --git a/kernel/kernel/files/patches/mageia/stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch b/kernel/kernel/files/patches/mageia/stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch deleted file mode 100644 index 2b6ca214..00000000 --- a/kernel/kernel/files/patches/mageia/stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 358875fd52ab8f00f66328cbf1a1d2486f265829 Mon Sep 17 00:00:00 2001 -From: Jay Cornwall -Date: Wed, 10 Feb 2016 15:48:01 -0600 -Subject: iommu/amd: Apply workaround for ATS write permission check - -From: Jay Cornwall - -commit 358875fd52ab8f00f66328cbf1a1d2486f265829 upstream. - -The AMD Family 15h Models 30h-3Fh (Kaveri) BIOS and Kernel Developer's -Guide omitted part of the BIOS IOMMU L2 register setup specification. -Without this setup the IOMMU L2 does not fully respect write permissions -when handling an ATS translation request. - -The IOMMU L2 will set PTE dirty bit when handling an ATS translation with -write permission request, even when PTE RW bit is clear. This may occur by -direct translation (which would cause a PPR) or by prefetch request from -the ATC. - -This is observed in practice when the IOMMU L2 modifies a PTE which maps a -pagecache page. The ext4 filesystem driver BUGs when asked to writeback -these (non-modified) pages. - -Enable ATS write permission check in the Kaveri IOMMU L2 if BIOS has not. - -Signed-off-by: Jay Cornwall -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/iommu/amd_iommu_init.c | 29 +++++++++++++++++++++++++++++ - 1 file changed, 29 insertions(+) - ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -1016,6 +1016,34 @@ static void amd_iommu_erratum_746_workar - } - - /* -+ * Family15h Model 30h-3fh (IOMMU Mishandles ATS Write Permission) -+ * Workaround: -+ * BIOS should enable ATS write permission check by setting -+ * L2_DEBUG_3[AtsIgnoreIWDis](D0F2xF4_x47[0]) = 1b -+ */ -+static void amd_iommu_ats_write_check_workaround(struct amd_iommu *iommu) -+{ -+ u32 value; -+ -+ if ((boot_cpu_data.x86 != 0x15) || -+ (boot_cpu_data.x86_model < 0x30) || -+ (boot_cpu_data.x86_model > 0x3f)) -+ return; -+ -+ /* Test L2_DEBUG_3[AtsIgnoreIWDis] == 1 */ -+ value = iommu_read_l2(iommu, 0x47); -+ -+ if (value & BIT(0)) -+ return; -+ -+ /* Set L2_DEBUG_3[AtsIgnoreIWDis] = 1 */ -+ iommu_write_l2(iommu, 0x47, value | BIT(0)); -+ -+ pr_info("AMD-Vi: Applying ATS write check workaround for IOMMU at %s\n", -+ dev_name(&iommu->dev->dev)); -+} -+ -+/* - * This function clues the initialization function for one IOMMU - * together and also allocates the command buffer and programs the - * hardware. It does NOT enable the IOMMU. This is done afterwards. -@@ -1284,6 +1312,7 @@ static int iommu_init_pci(struct amd_iom - } - - amd_iommu_erratum_746_workaround(iommu); -+ amd_iommu_ats_write_check_workaround(iommu); - - iommu->iommu_dev = iommu_device_create(&iommu->dev->dev, iommu, - amd_iommu_groups, "ivhd%d", diff --git a/kernel/kernel/files/patches/mageia/stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch b/kernel/kernel/files/patches/mageia/stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch deleted file mode 100644 index 3d0cee23..00000000 --- a/kernel/kernel/files/patches/mageia/stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 38e45d02ea9f194b89d6bf41e52ccafc8e2c2b47 Mon Sep 17 00:00:00 2001 -From: Suravee Suthikulpanit -Date: Tue, 23 Feb 2016 13:03:30 +0100 -Subject: iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered - -From: Suravee Suthikulpanit - -commit 38e45d02ea9f194b89d6bf41e52ccafc8e2c2b47 upstream. - -The setup code for the performance counters in the AMD IOMMU driver -tests whether the counters can be written. It tests to setup a counter -for device 00:00.0, which fails on systems where this particular device -is not covered by the IOMMU. - -Fix this by not relying on device 00:00.0 but only on the IOMMU being -present. - -Signed-off-by: Suravee Suthikulpanit -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/iommu/amd_iommu_init.c | 34 ++++++++++++++++++++++------------ - 1 file changed, 22 insertions(+), 12 deletions(-) - ---- a/drivers/iommu/amd_iommu_init.c -+++ b/drivers/iommu/amd_iommu_init.c -@@ -228,6 +228,10 @@ static int amd_iommu_enable_interrupts(v - static int __init iommu_go_to_state(enum iommu_init_state state); - static void init_device_table_dma(void); - -+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, -+ u8 bank, u8 cntr, u8 fxn, -+ u64 *value, bool is_write); -+ - static inline void update_last_devid(u16 devid) - { - if (devid > amd_iommu_last_bdf) -@@ -1170,8 +1174,8 @@ static void init_iommu_perf_ctr(struct a - amd_iommu_pc_present = true; - - /* Check if the performance counters can be written to */ -- if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) || -- (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) || -+ if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) || -+ (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) || - (val != val2)) { - pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n"); - amd_iommu_pc_present = false; -@@ -2312,22 +2316,15 @@ u8 amd_iommu_pc_get_max_counters(u16 dev - } - EXPORT_SYMBOL(amd_iommu_pc_get_max_counters); - --int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, -+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu, -+ u8 bank, u8 cntr, u8 fxn, - u64 *value, bool is_write) - { -- struct amd_iommu *iommu; - u32 offset; - u32 max_offset_lim; - -- /* Make sure the IOMMU PC resource is available */ -- if (!amd_iommu_pc_present) -- return -ENODEV; -- -- /* Locate the iommu associated with the device ID */ -- iommu = amd_iommu_rlookup_table[devid]; -- - /* Check for valid iommu and pc register indexing */ -- if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7))) -+ if (WARN_ON((fxn > 0x28) || (fxn & 7))) - return -ENODEV; - - offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn); -@@ -2351,3 +2348,16 @@ int amd_iommu_pc_get_set_reg_val(u16 dev - return 0; - } - EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val); -+ -+int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn, -+ u64 *value, bool is_write) -+{ -+ struct amd_iommu *iommu = amd_iommu_rlookup_table[devid]; -+ -+ /* Make sure the IOMMU PC resource is available */ -+ if (!amd_iommu_pc_present || iommu == NULL) -+ return -ENODEV; -+ -+ return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn, -+ value, is_write); -+} diff --git a/kernel/kernel/files/patches/mageia/stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch b/kernel/kernel/files/patches/mageia/stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch deleted file mode 100644 index 9250c977..00000000 --- a/kernel/kernel/files/patches/mageia/stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch +++ /dev/null @@ -1,68 +0,0 @@ -From e6a8c9b337eed56eb481e1b4dd2180c25a1e5310 Mon Sep 17 00:00:00 2001 -From: Joerg Roedel -Date: Mon, 29 Feb 2016 23:49:47 +0100 -Subject: iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path - -From: Joerg Roedel - -commit e6a8c9b337eed56eb481e1b4dd2180c25a1e5310 upstream. - -In the PCI hotplug path of the Intel IOMMU driver, replace -the usage of the BUS_NOTIFY_DEL_DEVICE notifier, which is -executed before the driver is unbound from the device, with -BUS_NOTIFY_REMOVED_DEVICE, which runs after that. - -This fixes a kernel BUG being triggered in the VT-d code -when the device driver tries to unmap DMA buffers and the -VT-d driver already destroyed all mappings. - -Reported-by: Stefani Seibold -Signed-off-by: Joerg Roedel -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/iommu/dmar.c | 5 +++-- - drivers/iommu/intel-iommu.c | 4 ++-- - 2 files changed, 5 insertions(+), 4 deletions(-) - ---- a/drivers/iommu/dmar.c -+++ b/drivers/iommu/dmar.c -@@ -329,7 +329,8 @@ static int dmar_pci_bus_notifier(struct - /* Only care about add/remove events for physical functions */ - if (pdev->is_virtfn) - return NOTIFY_DONE; -- if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE) -+ if (action != BUS_NOTIFY_ADD_DEVICE && -+ action != BUS_NOTIFY_REMOVED_DEVICE) - return NOTIFY_DONE; - - info = dmar_alloc_pci_notify_info(pdev, action); -@@ -339,7 +340,7 @@ static int dmar_pci_bus_notifier(struct - down_write(&dmar_global_lock); - if (action == BUS_NOTIFY_ADD_DEVICE) - dmar_pci_bus_add_dev(info); -- else if (action == BUS_NOTIFY_DEL_DEVICE) -+ else if (action == BUS_NOTIFY_REMOVED_DEVICE) - dmar_pci_bus_del_dev(info); - up_write(&dmar_global_lock); - ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -4367,7 +4367,7 @@ int dmar_iommu_notify_scope_dev(struct d - rmrru->devices_cnt); - if(ret < 0) - return ret; -- } else if (info->event == BUS_NOTIFY_DEL_DEVICE) { -+ } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) { - dmar_remove_dev_scope(info, rmrr->segment, - rmrru->devices, rmrru->devices_cnt); - } -@@ -4387,7 +4387,7 @@ int dmar_iommu_notify_scope_dev(struct d - break; - else if(ret < 0) - return ret; -- } else if (info->event == BUS_NOTIFY_DEL_DEVICE) { -+ } else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) { - if (dmar_remove_dev_scope(info, atsr->segment, - atsru->devices, atsru->devices_cnt)) - break; diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch deleted file mode 100644 index 19c33135..00000000 --- a/kernel/kernel/files/patches/mageia/stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 70e4da7a8ff62f2775337b705f45c804bb450454 Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Fri, 26 Feb 2016 12:28:40 +0100 -Subject: KVM: x86: fix root cause for missed hardware breakpoints - -From: Paolo Bonzini - -commit 70e4da7a8ff62f2775337b705f45c804bb450454 upstream. - -Commit 172b2386ed16 ("KVM: x86: fix missed hardware breakpoints", -2016-02-10) worked around a case where the debug registers are not loaded -correctly on preemption and on the first entry to KVM_RUN. - -However, Xiao Guangrong pointed out that the root cause must be that -KVM_DEBUGREG_BP_ENABLED is not being set correctly. This can indeed -happen due to the lazy debug exit mechanism, which does not call -kvm_update_dr7. Fix it by replacing the existing loop (more or less -equivalent to kvm_update_dr0123) with calls to all the kvm_update_dr* -functions. - -Fixes: 172b2386ed16a9143d9a456aae5ec87275c61489 -Reviewed-by: Xiao Guangrong -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/x86.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) - ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -2736,7 +2736,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu - } - - kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu); -- vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD; - } - - void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) -@@ -6545,12 +6544,12 @@ static int vcpu_enter_guest(struct kvm_v - * KVM_DEBUGREG_WONT_EXIT again. - */ - if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) { -- int i; -- - WARN_ON(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP); - kvm_x86_ops->sync_dirty_debug_regs(vcpu); -- for (i = 0; i < KVM_NR_DB_REGS; i++) -- vcpu->arch.eff_db[i] = vcpu->arch.db[i]; -+ kvm_update_dr0123(vcpu); -+ kvm_update_dr6(vcpu); -+ kvm_update_dr7(vcpu); -+ vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD; - } - - /* diff --git a/kernel/kernel/files/patches/mageia/stable-kvm-x86-update-tsc-multiplier-on-change.patch b/kernel/kernel/files/patches/mageia/stable-kvm-x86-update-tsc-multiplier-on-change.patch deleted file mode 100644 index ea436218..00000000 --- a/kernel/kernel/files/patches/mageia/stable-kvm-x86-update-tsc-multiplier-on-change.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 2680d6da455b636dd006636780c0f235c6561d70 Mon Sep 17 00:00:00 2001 -From: Owen Hofmann -Date: Tue, 1 Mar 2016 13:36:13 -0800 -Subject: kvm: x86: Update tsc multiplier on change. - -From: Owen Hofmann - -commit 2680d6da455b636dd006636780c0f235c6561d70 upstream. - -vmx.c writes the TSC_MULTIPLIER field in vmx_vcpu_load, but only when a -vcpu has migrated physical cpus. Record the last value written and -update in vmx_vcpu_load on any change, otherwise a cpu migration must -occur for TSC frequency scaling to take effect. - -Fixes: ff2c3a1803775cc72dc6f624b59554956396b0ee -Signed-off-by: Owen Hofmann -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/x86/kvm/vmx.c | 14 +++++++++----- - 1 file changed, 9 insertions(+), 5 deletions(-) - ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -595,6 +595,8 @@ struct vcpu_vmx { - /* Support for PML */ - #define PML_ENTITY_NUM 512 - struct page *pml_pg; -+ -+ u64 current_tsc_ratio; - }; - - enum segment_cache_field { -@@ -2062,14 +2064,16 @@ static void vmx_vcpu_load(struct kvm_vcp - rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp); - vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */ - -- /* Setup TSC multiplier */ -- if (cpu_has_vmx_tsc_scaling()) -- vmcs_write64(TSC_MULTIPLIER, -- vcpu->arch.tsc_scaling_ratio); -- - vmx->loaded_vmcs->cpu = cpu; - } - -+ /* Setup TSC multiplier */ -+ if (kvm_has_tsc_control && -+ vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) { -+ vmx->current_tsc_ratio = vcpu->arch.tsc_scaling_ratio; -+ vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio); -+ } -+ - vmx_vcpu_pi_load(vcpu, cpu); - } - diff --git a/kernel/kernel/files/patches/mageia/stable-mips-kvm-fix-ioctl-error-handling.patch b/kernel/kernel/files/patches/mageia/stable-mips-kvm-fix-ioctl-error-handling.patch deleted file mode 100644 index aa79661b..00000000 --- a/kernel/kernel/files/patches/mageia/stable-mips-kvm-fix-ioctl-error-handling.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 0178fd7dcc4451fcb90bec5e91226586962478d2 Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" -Date: Sun, 28 Feb 2016 17:35:59 +0200 -Subject: mips/kvm: fix ioctl error handling - -From: Michael S. Tsirkin - -commit 0178fd7dcc4451fcb90bec5e91226586962478d2 upstream. - -Returning directly whatever copy_to_user(...) or copy_from_user(...) -returns may not do the right thing if there's a pagefault: -copy_to_user/copy_from_user return the number of bytes not copied in -this case, but ioctls need to return -EFAULT instead. - -Fix up kvm on mips to do - return copy_to_user(...)) ? -EFAULT : 0; -and - return copy_from_user(...)) ? -EFAULT : 0; - -everywhere. - -Signed-off-by: Michael S. Tsirkin -Signed-off-by: Paolo Bonzini -Signed-off-by: Greg Kroah-Hartman - ---- - arch/mips/kvm/mips.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/arch/mips/kvm/mips.c -+++ b/arch/mips/kvm/mips.c -@@ -702,7 +702,7 @@ static int kvm_mips_get_reg(struct kvm_v - } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) { - void __user *uaddr = (void __user *)(long)reg->addr; - -- return copy_to_user(uaddr, vs, 16); -+ return copy_to_user(uaddr, vs, 16) ? -EFAULT : 0; - } else { - return -EINVAL; - } -@@ -732,7 +732,7 @@ static int kvm_mips_set_reg(struct kvm_v - } else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) { - void __user *uaddr = (void __user *)(long)reg->addr; - -- return copy_from_user(vs, uaddr, 16); -+ return copy_from_user(vs, uaddr, 16) ? -EFAULT : 0; - } else { - return -EINVAL; - } diff --git a/kernel/kernel/files/patches/mageia/stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch b/kernel/kernel/files/patches/mageia/stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch deleted file mode 100644 index ef7b3cca..00000000 --- a/kernel/kernel/files/patches/mageia/stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 Mon Sep 17 00:00:00 2001 -From: Helge Deller -Date: Tue, 19 Jan 2016 16:08:49 +0100 -Subject: parisc: Fix ptrace syscall number and return value modification - -From: Helge Deller - -commit 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 upstream. - -Mike Frysinger reported that his ptrace testcase showed strange -behaviour on parisc: It was not possible to avoid a syscall and the -return value of a syscall couldn't be changed. - -To modify a syscall number, we were missing to save the new syscall -number to gr20 which is then picked up later in assembly again. - -The effect that the return value couldn't be changed is a side-effect of -another bug in the assembly code. When a process is ptraced, userspace -expects each syscall to report entrance and exit of a syscall. If a -syscall number was given which doesn't exist, we jumped to the normal -syscall exit code instead of informing userspace that the (non-existant) -syscall exits. This unexpected behaviour confuses userspace and thus the -bug was misinterpreted as if we can't change the return value. - -This patch fixes both problems and was tested on 64bit kernel with -32bit userspace. - -Signed-off-by: Helge Deller -Cc: Mike Frysinger -Tested-by: Mike Frysinger -Signed-off-by: Greg Kroah-Hartman - ---- - arch/parisc/kernel/ptrace.c | 16 +++++++++++----- - arch/parisc/kernel/syscall.S | 5 ++++- - 2 files changed, 15 insertions(+), 6 deletions(-) - ---- a/arch/parisc/kernel/ptrace.c -+++ b/arch/parisc/kernel/ptrace.c -@@ -269,14 +269,19 @@ long compat_arch_ptrace(struct task_stru - - long do_syscall_trace_enter(struct pt_regs *regs) - { -- long ret = 0; -- - /* Do the secure computing check first. */ - secure_computing_strict(regs->gr[20]); - - if (test_thread_flag(TIF_SYSCALL_TRACE) && -- tracehook_report_syscall_entry(regs)) -- ret = -1L; -+ tracehook_report_syscall_entry(regs)) { -+ /* -+ * Tracing decided this syscall should not happen or the -+ * debugger stored an invalid system call number. Skip -+ * the system call and the system call restart handling. -+ */ -+ regs->gr[20] = -1UL; -+ goto out; -+ } - - #ifdef CONFIG_64BIT - if (!is_compat_task()) -@@ -290,7 +295,8 @@ long do_syscall_trace_enter(struct pt_re - regs->gr[24] & 0xffffffff, - regs->gr[23] & 0xffffffff); - -- return ret ? : regs->gr[20]; -+out: -+ return regs->gr[20]; - } - - void do_syscall_trace_exit(struct pt_regs *regs) ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -343,7 +343,7 @@ tracesys_next: - #endif - - comiclr,>>= __NR_Linux_syscalls, %r20, %r0 -- b,n .Lsyscall_nosys -+ b,n .Ltracesys_nosys - - LDREGX %r20(%r19), %r19 - -@@ -359,6 +359,9 @@ tracesys_next: - be 0(%sr7,%r19) - ldo R%tracesys_exit(%r2),%r2 - -+.Ltracesys_nosys: -+ ldo -ENOSYS(%r0),%r28 /* set errno */ -+ - /* Do *not* call this function on the gateway page, because it - makes a direct call to syscall_trace. */ - diff --git a/kernel/kernel/files/patches/mageia/stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch b/kernel/kernel/files/patches/mageia/stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch deleted file mode 100644 index e598869f..00000000 --- a/kernel/kernel/files/patches/mageia/stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 79e3f4a853ed161cd4c06d84b50beebf961a47c6 Mon Sep 17 00:00:00 2001 -From: Murali Karicheri -Date: Mon, 29 Feb 2016 17:18:22 -0600 -Subject: PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer - -From: Murali Karicheri - -commit 79e3f4a853ed161cd4c06d84b50beebf961a47c6 upstream. - -Commit cbce7900598c ("PCI: designware: Make driver arch-agnostic") changed -the host bridge sysdata pointer from the ARM pci_sys_data to the DesignWare -pcie_port structure, and changed pcie-designware.c to reflect that. But it -did not change the corresponding code in pci-keystone-dw.c, so it caused -crashes on Keystone: - - Unable to handle kernel NULL pointer dereference at virtual address 00000030 - pgd = c0003000 - [00000030] *pgd=80000800004003, *pmd=00000000 - Internal error: Oops: 206 [#1] PREEMPT SMP ARM - CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.2-00139-gb74f926 #2 - Hardware name: Keystone - PC is at ks_dw_pcie_msi_irq_unmask+0x24/0x58 - -Change pci-keystone-dw.c to expect sysdata to be the struct pcie_port -pointer. - -[bhelgaas: changelog] -Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic") -Signed-off-by: Murali Karicheri -Signed-off-by: Bjorn Helgaas -CC: Zhou Wang -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/pci/host/pci-keystone-dw.c | 11 +++-------- - 1 file changed, 3 insertions(+), 8 deletions(-) - ---- a/drivers/pci/host/pci-keystone-dw.c -+++ b/drivers/pci/host/pci-keystone-dw.c -@@ -58,11 +58,6 @@ - - #define to_keystone_pcie(x) container_of(x, struct keystone_pcie, pp) - --static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys) --{ -- return sys->private_data; --} -- - static inline void update_reg_offset_bit_pos(u32 offset, u32 *reg_offset, - u32 *bit_pos) - { -@@ -108,7 +103,7 @@ static void ks_dw_pcie_msi_irq_ack(struc - struct pcie_port *pp; - - msi = irq_data_get_msi_desc(d); -- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); -+ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); - ks_pcie = to_keystone_pcie(pp); - offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); - update_reg_offset_bit_pos(offset, ®_offset, &bit_pos); -@@ -146,7 +141,7 @@ static void ks_dw_pcie_msi_irq_mask(stru - u32 offset; - - msi = irq_data_get_msi_desc(d); -- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); -+ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); - ks_pcie = to_keystone_pcie(pp); - offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); - -@@ -167,7 +162,7 @@ static void ks_dw_pcie_msi_irq_unmask(st - u32 offset; - - msi = irq_data_get_msi_desc(d); -- pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi)); -+ pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi); - ks_pcie = to_keystone_pcie(pp); - offset = d->irq - irq_linear_revmap(pp->irq_domain, 0); - diff --git a/kernel/kernel/files/patches/mageia/stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch b/kernel/kernel/files/patches/mageia/stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch deleted file mode 100644 index b68d85b9..00000000 --- a/kernel/kernel/files/patches/mageia/stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch +++ /dev/null @@ -1,100 +0,0 @@ -From a528aca7f359f4b0b1d72ae406097e491a5ba9ea Mon Sep 17 00:00:00 2001 -From: Al Viro -Date: Mon, 29 Feb 2016 12:12:46 -0500 -Subject: use ->d_seq to get coherency between ->d_inode and ->d_flags - -From: Al Viro - -commit a528aca7f359f4b0b1d72ae406097e491a5ba9ea upstream. - -Games with ordering and barriers are way too brittle. Just -bump ->d_seq before and after updating ->d_inode and ->d_flags -type bits, so that verifying ->d_seq would guarantee they are -coherent. - -Signed-off-by: Al Viro -Signed-off-by: Greg Kroah-Hartman - ---- - fs/dcache.c | 20 +++++--------------- - include/linux/dcache.h | 4 +--- - 2 files changed, 6 insertions(+), 18 deletions(-) - ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -269,9 +269,6 @@ static inline int dname_external(const s - return dentry->d_name.name != dentry->d_iname; - } - --/* -- * Make sure other CPUs see the inode attached before the type is set. -- */ - static inline void __d_set_inode_and_type(struct dentry *dentry, - struct inode *inode, - unsigned type_flags) -@@ -279,28 +276,18 @@ static inline void __d_set_inode_and_typ - unsigned flags; - - dentry->d_inode = inode; -- smp_wmb(); - flags = READ_ONCE(dentry->d_flags); - flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); - flags |= type_flags; - WRITE_ONCE(dentry->d_flags, flags); - } - --/* -- * Ideally, we want to make sure that other CPUs see the flags cleared before -- * the inode is detached, but this is really a violation of RCU principles -- * since the ordering suggests we should always set inode before flags. -- * -- * We should instead replace or discard the entire dentry - but that sucks -- * performancewise on mass deletion/rename. -- */ - static inline void __d_clear_type_and_inode(struct dentry *dentry) - { - unsigned flags = READ_ONCE(dentry->d_flags); - - flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU); - WRITE_ONCE(dentry->d_flags, flags); -- smp_wmb(); - dentry->d_inode = NULL; - } - -@@ -370,9 +357,11 @@ static void dentry_unlink_inode(struct d - __releases(dentry->d_inode->i_lock) - { - struct inode *inode = dentry->d_inode; -+ -+ raw_write_seqcount_begin(&dentry->d_seq); - __d_clear_type_and_inode(dentry); - hlist_del_init(&dentry->d_u.d_alias); -- dentry_rcuwalk_invalidate(dentry); -+ raw_write_seqcount_end(&dentry->d_seq); - spin_unlock(&dentry->d_lock); - spin_unlock(&inode->i_lock); - if (!inode->i_nlink) -@@ -1757,8 +1746,9 @@ static void __d_instantiate(struct dentr - spin_lock(&dentry->d_lock); - if (inode) - hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry); -+ raw_write_seqcount_begin(&dentry->d_seq); - __d_set_inode_and_type(dentry, inode, add_flags); -- dentry_rcuwalk_invalidate(dentry); -+ raw_write_seqcount_end(&dentry->d_seq); - spin_unlock(&dentry->d_lock); - fsnotify_d_instantiate(dentry, inode); - } ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -409,9 +409,7 @@ static inline bool d_mountpoint(const st - */ - static inline unsigned __d_entry_type(const struct dentry *dentry) - { -- unsigned type = READ_ONCE(dentry->d_flags); -- smp_rmb(); -- return type & DCACHE_ENTRY_TYPE; -+ return dentry->d_flags & DCACHE_ENTRY_TYPE; - } - - static inline bool d_is_miss(const struct dentry *dentry) diff --git a/kernel/kernel/files/patches/mageia/stable-vfio-fix-ioctl-error-handling.patch b/kernel/kernel/files/patches/mageia/stable-vfio-fix-ioctl-error-handling.patch deleted file mode 100644 index 9b803d1e..00000000 --- a/kernel/kernel/files/patches/mageia/stable-vfio-fix-ioctl-error-handling.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 8160c4e455820d5008a1116d2dca35f0363bb062 Mon Sep 17 00:00:00 2001 -From: "Michael S. Tsirkin" -Date: Sun, 28 Feb 2016 16:31:39 +0200 -Subject: vfio: fix ioctl error handling - -From: Michael S. Tsirkin - -commit 8160c4e455820d5008a1116d2dca35f0363bb062 upstream. - -Calling return copy_to_user(...) in an ioctl will not -do the right thing if there's a pagefault: -copy_to_user returns the number of bytes not copied -in this case. - -Fix up vfio to do - return copy_to_user(...)) ? - -EFAULT : 0; - -everywhere. - -Signed-off-by: Michael S. Tsirkin -Signed-off-by: Alex Williamson -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/vfio/pci/vfio_pci.c | 9 ++++++--- - drivers/vfio/platform/vfio_platform_common.c | 9 ++++++--- - drivers/vfio/vfio_iommu_type1.c | 6 ++++-- - 3 files changed, 16 insertions(+), 8 deletions(-) - ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -446,7 +446,8 @@ static long vfio_pci_ioctl(void *device_ - info.num_regions = VFIO_PCI_NUM_REGIONS; - info.num_irqs = VFIO_PCI_NUM_IRQS; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { - struct pci_dev *pdev = vdev->pdev; -@@ -520,7 +521,8 @@ static long vfio_pci_ioctl(void *device_ - return -EINVAL; - } - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { - struct vfio_irq_info info; -@@ -555,7 +557,8 @@ static long vfio_pci_ioctl(void *device_ - else - info.flags |= VFIO_IRQ_INFO_NORESIZE; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_SET_IRQS) { - struct vfio_irq_set hdr; ---- a/drivers/vfio/platform/vfio_platform_common.c -+++ b/drivers/vfio/platform/vfio_platform_common.c -@@ -219,7 +219,8 @@ static long vfio_platform_ioctl(void *de - info.num_regions = vdev->num_regions; - info.num_irqs = vdev->num_irqs; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_GET_REGION_INFO) { - struct vfio_region_info info; -@@ -240,7 +241,8 @@ static long vfio_platform_ioctl(void *de - info.size = vdev->regions[info.index].size; - info.flags = vdev->regions[info.index].flags; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) { - struct vfio_irq_info info; -@@ -259,7 +261,8 @@ static long vfio_platform_ioctl(void *de - info.flags = vdev->irqs[info.index].flags; - info.count = vdev->irqs[info.index].count; - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_DEVICE_SET_IRQS) { - struct vfio_irq_set hdr; ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -999,7 +999,8 @@ static long vfio_iommu_type1_ioctl(void - - info.iova_pgsizes = vfio_pgsize_bitmap(iommu); - -- return copy_to_user((void __user *)arg, &info, minsz); -+ return copy_to_user((void __user *)arg, &info, minsz) ? -+ -EFAULT : 0; - - } else if (cmd == VFIO_IOMMU_MAP_DMA) { - struct vfio_iommu_type1_dma_map map; -@@ -1032,7 +1033,8 @@ static long vfio_iommu_type1_ioctl(void - if (ret) - return ret; - -- return copy_to_user((void __user *)arg, &unmap, minsz); -+ return copy_to_user((void __user *)arg, &unmap, minsz) ? -+ -EFAULT : 0; - } - - return -ENOTTY; diff --git a/kernel/kernel/pspec.xml b/kernel/kernel/pspec.xml index d8fc1bc9..5b95eb9a 100644 --- a/kernel/kernel/pspec.xml +++ b/kernel/kernel/pspec.xml @@ -29,35 +29,11 @@ - patches/linux/patch-4.4.4.xz - + patches/linux/patch-4.4.8.xz + - patches/mageia/stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch - patches/mageia/stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch - patches/mageia/stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch - patches/mageia/stable-btrfs-fix-no_space-in-write-and-rm-loop.patch - patches/mageia/stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch - patches/mageia/stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch - patches/mageia/stable-block-initialize-max_dev_sectors-to-0.patch - patches/mageia/stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch - patches/mageia/stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch - patches/mageia/stable-mips-kvm-fix-ioctl-error-handling.patch - patches/mageia/stable-kvm-x86-update-tsc-multiplier-on-change.patch - patches/mageia/stable-fbcon-set-a-default-value-to-blink-interval.patch - patches/mageia/stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch - patches/mageia/stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch - patches/mageia/stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch - patches/mageia/stable-vfio-fix-ioctl-error-handling.patch - patches/mageia/stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch - patches/mageia/stable-arm-arm64-kvm-fix-ioctl-error-handling.patch - patches/mageia/stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch - patches/mageia/stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch - patches/mageia/stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch - patches/mageia/ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch - patches/mageia/ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch - patches/mageia/libata-Align-ata_device-s-id-on-a-cacheline.patch - patches/mageia/libata-fix-HDIO_GET_32BIT-ioctl.patch + patches/mageia/Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch patches/mageia/x86-boot-video-80x25-if-break.patch patches/mageia/x86-default_poweroff_up_machines.patch @@ -86,6 +62,7 @@ patches/mageia/fs-aufs-4.4.patch patches/mageia/fs-aufs-4.4-modular.patch patches/mageia/fs-ovl-move-super-block-magic-number-to-magic.h.patch + patches/mageia/pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch patches/mageia/firewire-ieee1394-module-aliases.patch patches/mageia/char-agp-intel-new-Q57-id.patch patches/mageia/gpu-drm-mach64.patch @@ -135,6 +112,8 @@ patches/mageia/net-netfilter-psd.patch patches/mageia/net-netfilter-psd-mdv.patch patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch + patches/mageia/net-netfilter-x_tables-check-for-size-overflow.patch + patches/mageia/net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch patches/mageia/platform-x86-add-shuttle-wmi-driver.patch patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch @@ -183,7 +162,6 @@ patches/mageia/arm-0024-ARM-bcm2835-Add-the-auxiliary-clocks-to-the-device-t.patch patches/mageia/arm-0031-ARM-bcm2835-enable-all-bcm2835-relevant-in-defconfig.patch patches/mageia/arm-0032-ARM-bcm2835-enable-auxiliary-spi-driver-in-defconfig.patch - mageia/net-netfilter-IFWLOG-remove-unused-label.patch @@ -199,6 +177,7 @@ /boot /lib/modules /etc/kernel + /etc/mkinitcpio.d System.Package @@ -238,6 +217,17 @@ + + 2016-04-27 + 4.4.8 + Version Bump. + security + + systemRestart + + Ertuğrul Erata + ertugrulerata@gmail.com + 2016-03-06 4.4.4