This is the start of the stable review cycle for the 4.9.166 release.
There are 30 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu Mar 28 04:25:51 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.166-rc…
or in the git tree and branch …
[View More]at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.166-rc1
Arnd Bergmann <arnd(a)arndb.de>
ath10k: avoid possible string overflow
Baolin Wang <baolin.wang(a)linaro.org>
power: supply: charger-manager: Fix incorrect return value
Enric Balletbo i Serra <enric.balletbo(a)collabora.com>
pwm-backlight: Enable/disable the PWM before/after LCD enable toggle.
Baolin Wang <baolin.wang(a)linaro.org>
rtc: Fix overflow when converting time64_t to rtc_time
kehuanlin <chgokhl(a)gmail.com>
scsi: ufs: fix wrong command type of UTRD for UFSHCI v2.1
Andrey Konovalov <andreyknvl(a)google.com>
USB: core: only clean up what we allocated
Peter Zijlstra <peterz(a)infradead.org>
lib/int_sqrt: optimize small argument
Lanqing Liu <lanqing.liu(a)spreadtrum.com>
serial: sprd: clear timeout interrupt only rather than all interrupts
Qiao Zhou <qiaozhou(a)asrmicro.com>
arm64: traps: disable irq in die()
Al Viro <viro(a)ZenIV.linux.org.uk>
Hang/soft lockup in d_invalidate with simultaneous calls
Wei Qiao <wei.qiao(a)spreadtrum.com>
serial: sprd: adjust TIMEOUT to a big value
Eric Dumazet <edumazet(a)google.com>
tcp/dccp: drop SYN packets if accept queue is full
Hui Wang <hui.wang(a)canonical.com>
ALSA: hda - Enforces runtime_resume after S3 and S4 for each codec
Takashi Iwai <tiwai(a)suse.de>
ALSA: hda - Record the current power state before suspend/resume calls
Waiman Long <longman(a)redhat.com>
locking/lockdep: Add debug_locks check in __lock_downgrade()
Myungho Jung <mhjungk(a)gmail.com>
Bluetooth: Fix decrementing reference count twice in releasing socket
Hans Verkuil <hverkuil(a)xs4all.nl>
media: v4l2-ctrls.c/uvc: zero v4l2_event
zhangyi (F) <yi.zhang(a)huawei.com>
ext4: brelse all indirect buffer in ext4_ind_remove_space()
Lukas Czerner <lczerner(a)redhat.com>
ext4: fix data corruption caused by unaligned direct AIO
Jiufei Xue <jiufei.xue(a)linux.alibaba.com>
ext4: fix NULL pointer dereference while journal is aborted
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Move objtool_file struct off the stack
Chen Jie <chenjie6(a)huawei.com>
futex: Ensure that futex address is aligned in handle_futex_death()
Archer Yan <ayan(a)wavecomp.com>
MIPS: Fix kernel crash for R6 in jump label branch function
Yasha Cherikovsky <yasha.che3(a)gmail.com>
MIPS: Ensure ELF appended dtb is relocated
Yifeng Li <tomli(a)tomli.me>
mips: loongson64: lemote-2f: Add IRQF_NO_SUSPEND to "cascade" irqaction.
Jan Kara <jack(a)suse.cz>
udf: Fix crash on IO error during truncate
Ilya Dryomov <idryomov(a)gmail.com>
libceph: wait for latest osdmap in ceph_monc_blacklist_add()
Stanislaw Gruszka <sgruszka(a)redhat.com>
iommu/amd: fix sg->dma_address for sg->offset bigger than PAGE_SIZE
Thomas Zimmermann <tzimmermann(a)suse.de>
drm/vmwgfx: Don't double-free the mode stored in par->set_mode
Arnd Bergmann <arnd(a)arndb.de>
mmc: pxamci: fix enum type confusion
-------------
Diffstat:
Makefile | 4 +--
arch/arm64/kernel/traps.c | 8 +++--
arch/mips/include/asm/jump_label.h | 8 ++---
arch/mips/kernel/vmlinux.lds.S | 12 ++++---
arch/mips/loongson64/lemote-2f/irq.c | 2 +-
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 12 ++-----
drivers/iommu/amd_iommu.c | 7 ++++-
drivers/media/usb/uvc/uvc_ctrl.c | 2 +-
drivers/media/v4l2-core/v4l2-ctrls.c | 2 +-
drivers/mmc/host/pxamci.c | 2 +-
drivers/net/wireless/ath/ath10k/wmi.c | 2 +-
drivers/power/supply/charger-manager.c | 3 +-
drivers/rtc/rtc-lib.c | 6 ++--
drivers/scsi/ufs/ufshcd.c | 14 +++++----
drivers/tty/serial/sprd_serial.c | 6 ++--
drivers/usb/core/config.c | 9 ++++--
drivers/video/backlight/pwm_bl.c | 9 +++---
fs/dcache.c | 10 +++---
fs/ext4/ext4_jbd2.h | 2 +-
fs/ext4/file.c | 2 +-
fs/ext4/indirect.c | 12 ++++---
fs/udf/truncate.c | 3 ++
include/linux/ceph/libceph.h | 2 ++
include/net/inet_connection_sock.h | 5 ---
kernel/futex.c | 4 +++
kernel/locking/lockdep.c | 3 ++
lib/int_sqrt.c | 3 ++
net/bluetooth/hci_sock.c | 3 +-
net/ceph/ceph_common.c | 18 ++++++++++-
net/ceph/mon_client.c | 9 ++++++
net/dccp/ipv4.c | 8 +----
net/dccp/ipv6.c | 2 +-
net/ipv4/tcp_input.c | 8 +----
sound/pci/hda/hda_codec.c | 57 ++++++++++++++++++++++++++++++++--
tools/objtool/check.c | 3 +-
35 files changed, 175 insertions(+), 87 deletions(-)
[View Less]
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 91740fc8242b4f260cfa4d4536d8551804777fae Mon Sep 17 00:00:00 2001
From: Kohji Okuno <okuno.kohji(a)jp.panasonic.com>
Date: Tue, 26 Feb 2019 11:34:13 +0900
…
[View More]Subject: [PATCH] ARM: imx6q: cpuidle: fix bug that CPU might not wake up at
expected time
In the current cpuidle implementation for i.MX6q, the CPU that sets
'WAIT_UNCLOCKED' and the CPU that returns to 'WAIT_CLOCKED' are always
the same. While the CPU that sets 'WAIT_UNCLOCKED' is in IDLE state of
"WAIT", if the other CPU wakes up and enters IDLE state of "WFI"
istead of "WAIT", this CPU can not wake up at expired time.
Because, in the case of "WFI", the CPU must be waked up by the local
timer interrupt. But, while 'WAIT_UNCLOCKED' is set, the local timer
is stopped, when all CPUs execute "wfi" instruction. As a result, the
local timer interrupt is not fired.
In this situation, this CPU will wake up by IRQ different from local
timer. (e.g. broacast timer)
So, this fix changes CPU to return to 'WAIT_CLOCKED'.
Signed-off-by: Kohji Okuno <okuno.kohji(a)jp.panasonic.com>
Fixes: e5f9dec8ff5f ("ARM: imx6q: support WAIT mode using cpuidle")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Shawn Guo <shawnguo(a)kernel.org>
diff --git a/arch/arm/mach-imx/cpuidle-imx6q.c b/arch/arm/mach-imx/cpuidle-imx6q.c
index bfeb25aaf9a2..326e870d7123 100644
--- a/arch/arm/mach-imx/cpuidle-imx6q.c
+++ b/arch/arm/mach-imx/cpuidle-imx6q.c
@@ -16,30 +16,23 @@
#include "cpuidle.h"
#include "hardware.h"
-static atomic_t master = ATOMIC_INIT(0);
-static DEFINE_SPINLOCK(master_lock);
+static int num_idle_cpus = 0;
+static DEFINE_SPINLOCK(cpuidle_lock);
static int imx6q_enter_wait(struct cpuidle_device *dev,
struct cpuidle_driver *drv, int index)
{
- if (atomic_inc_return(&master) == num_online_cpus()) {
- /*
- * With this lock, we prevent other cpu to exit and enter
- * this function again and become the master.
- */
- if (!spin_trylock(&master_lock))
- goto idle;
+ spin_lock(&cpuidle_lock);
+ if (++num_idle_cpus == num_online_cpus())
imx6_set_lpm(WAIT_UNCLOCKED);
- cpu_do_idle();
- imx6_set_lpm(WAIT_CLOCKED);
- spin_unlock(&master_lock);
- goto done;
- }
+ spin_unlock(&cpuidle_lock);
-idle:
cpu_do_idle();
-done:
- atomic_dec(&master);
+
+ spin_lock(&cpuidle_lock);
+ if (num_idle_cpus-- == num_online_cpus())
+ imx6_set_lpm(WAIT_CLOCKED);
+ spin_unlock(&cpuidle_lock);
return index;
}
[View Less]
The patch below does not apply to the 3.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From fe67888fc007a76b81e37da23ce5bd8fb95890b0 Mon Sep 17 00:00:00 2001
From: Steffen Maier <maier(a)linux.ibm.com>
Date: Tue, 26 Mar 2019 14:36:58 +0100
Subject:…
[View More] [PATCH] scsi: zfcp: fix rport unblock if deleted SCSI devices on
Scsi_Host
An already deleted SCSI device can exist on the Scsi_Host and remain there
because something still holds a reference. A new SCSI device with the same
H:C:T:L and FCP device, target port WWPN, and FCP LUN can be created. When
we try to unblock an rport, we still find the deleted SCSI device and
return early because the zfcp_scsi_dev of that SCSI device is not
ZFCP_STATUS_COMMON_UNBLOCKED. Hence we miss to unblock the rport, even if
the new proper SCSI device would be in good state.
Therefore, skip deleted SCSI devices when iterating the sdevs of the shost.
[cf. __scsi_device_lookup{_by_target}() or scsi_device_get()]
The following abbreviated trace sequence can indicate such problem:
Area : REC
Tag : ersfs_3
LUN : 0x4045400300000000
WWPN : 0x50050763031bd327
LUN status : 0x40000000 not ZFCP_STATUS_COMMON_UNBLOCKED
Ready count : n not incremented yet
Running count : 0x00000000
ERP want : 0x01
ERP need : 0xc1 ZFCP_ERP_ACTION_NONE
Area : REC
Tag : ersfs_3
LUN : 0x4045400300000000
WWPN : 0x50050763031bd327
LUN status : 0x41000000
Ready count : n+1
Running count : 0x00000000
ERP want : 0x01
ERP need : 0x01
...
Area : REC
Level : 4 only with increased trace level
Tag : ertru_l
LUN : 0x4045400300000000
WWPN : 0x50050763031bd327
LUN status : 0x40000000
Request ID : 0x0000000000000000
ERP status : 0x01800000
ERP step : 0x1000
ERP action : 0x01
ERP count : 0x00
NOT followed by a trace record with tag "scpaddy"
for WWPN 0x50050763031bd327.
Signed-off-by: Steffen Maier <maier(a)linux.ibm.com>
Fixes: 6f2ce1c6af37 ("scsi: zfcp: fix rport unblock race with LUN recovery")
Cc: <stable(a)vger.kernel.org> #2.6.32+
Reviewed-by: Jens Remus <jremus(a)linux.ibm.com>
Reviewed-by: Benjamin Block <bblock(a)linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com>
diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
index 744a64680d5b..c0b2348d7ce6 100644
--- a/drivers/s390/scsi/zfcp_erp.c
+++ b/drivers/s390/scsi/zfcp_erp.c
@@ -1341,6 +1341,9 @@ static void zfcp_erp_try_rport_unblock(struct zfcp_port *port)
struct zfcp_scsi_dev *zsdev = sdev_to_zfcp(sdev);
int lun_status;
+ if (sdev->sdev_state == SDEV_DEL ||
+ sdev->sdev_state == SDEV_CANCEL)
+ continue;
if (zsdev->port != port)
continue;
/* LUN under port of interest */
[View Less]
On Fri, 2019-03-29 at 17:01 +0100, Thomas Weißschuh wrote:
> Hi Ben,
>
> I forgot you to Cc: on the following mail:
>
> https://lore.kernel.org/stable/20190329154756.GA14540@fralrnd0033.fra.amade…
>
> Thomas
>
> On Fri, Mar 29, 2019 at 04:47:58PM +0100, Thomas Weißschuh wrote:
> > > 3.16.60-rc1 review patch. If anyone has any objections, please let me know.
> >
> > Sorry for the late response, this just hit the kernel in Debian Jessie
> &…
[View More]gt; (oldstable) a few days ago.
> >
> > > ------------------
> > >
> > > From: Alexey Khoroshilov <khoroshilov(a)ispras.ru>
> > >
> > > commit 5738a09d58d5ad2871f1f9a42bf6a3aa9ece5b3c upstream.
> > >
> > > vmxnet3_drv does not check dma_addr with dma_mapping_error()
> > > after mapping dma memory. The patch adds the checks and
> > > tries to handle failures.
> >
> > We are seeing kernel panics/machine freezes/BUGs with the new 3.16.64 from Debian.
> > I bisected it with the vanilla stable kernel and it boiled down to this commit.
> > VMs of multiple nodes of our vmware cluster are affected.
> > The bug can be triggered in multiple ways, I have seen it when an external
> > network request is served, when installing packages over the network and
> > performing a git clone.
[...]
I missed the upstream follow-up to this, which was commit 58caf637365f
"Driver: Vmxnet3: Fix regression caused by 5738a09".
I'm attaching a backport of that. I don't have any VMware installation
to test on; could you do that?
Ben.
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[View Less]
From: Eric Biggers <ebiggers(a)google.com>
If the rfc7539 template is instantiated with specific implementations,
e.g. "rfc7539(chacha20-generic,poly1305-generic)" rather than
"rfc7539(chacha20,poly1305)", then the implementation names end up
included in the instance's cra_name. This is incorrect because it then
prevents all users from allocating "rfc7539(chacha20,poly1305)", if the
highest priority implementations of chacha20 and poly1305 were selected.
Also, the self-tests aren't run …
[View More]on an instance allocated in this way.
Fix it by setting the instance's cra_name from the underlying
algorithms' actual cra_names, rather than from the requested names.
This matches what other templates do.
Fixes: 71ebc4d1b27d ("crypto: chacha20poly1305 - Add a ChaCha20-Poly1305 AEAD construction, RFC7539")
Cc: <stable(a)vger.kernel.org> # v4.2+
Cc: Martin Willi <martin(a)strongswan.org>
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
crypto/chacha20poly1305.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c
index ed2e12e26dd80..279d816ab51dd 100644
--- a/crypto/chacha20poly1305.c
+++ b/crypto/chacha20poly1305.c
@@ -645,8 +645,8 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb,
err = -ENAMETOOLONG;
if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
- "%s(%s,%s)", name, chacha_name,
- poly_name) >= CRYPTO_MAX_ALG_NAME)
+ "%s(%s,%s)", name, chacha->base.cra_name,
+ poly->cra_name) >= CRYPTO_MAX_ALG_NAME)
goto out_drop_chacha;
if (snprintf(inst->alg.base.cra_driver_name, CRYPTO_MAX_ALG_NAME,
"%s(%s,%s)", name, chacha->base.cra_driver_name,
--
2.21.0
[View Less]
Building arm:mxs_defconfig ... failed
drivers/tty/serial/mxs-auart.c: In function 'mxs_auart_probe':
drivers/tty/serial/mxs-auart.c:1065:3: error: label 'out_disable_clks' used but not defined
Guenter
From: Eric Biggers <ebiggers(a)google.com>
skcipher_walk_done() assumes it's a bug if, after the "slow" path is
executed where the next chunk of data is processed via a bounce buffer,
the algorithm says it didn't process all bytes. Thus it WARNs on this.
However, this can happen legitimately when the message needs to be
evenly divisible into "blocks" but isn't, and the algorithm has a
'walksize' greater than the block size. For example, ecb-aes-neonbs
sets 'walksize' to 128 bytes and …
[View More]only supports messages evenly divisible
into 16-byte blocks. If, say, 17 message bytes remain but they straddle
scatterlist elements, the skcipher_walk code will take the "slow" path
and pass the algorithm all 17 bytes in the bounce buffer. But the
algorithm will only be able to process 16 bytes, triggering the WARN.
Fix this by just removing the WARN_ON(). Returning -EINVAL, as the code
already does, is the right behavior.
This bug was detected by my patches that improve testmgr to fuzz
algorithms against their generic implementation.
Fixes: b286d8b1a690 ("crypto: skcipher - Add skcipher walk interface")
Cc: <stable(a)vger.kernel.org> # v4.10+
Signed-off-by: Eric Biggers <ebiggers(a)google.com>
---
crypto/skcipher.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 0f639f018047d..85836be4f274f 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -131,8 +131,13 @@ int skcipher_walk_done(struct skcipher_walk *walk, int err)
memcpy(walk->dst.virt.addr, walk->page, n);
skcipher_unmap_dst(walk);
} else if (unlikely(walk->flags & SKCIPHER_WALK_SLOW)) {
- if (WARN_ON(err)) {
- /* unexpected case; didn't process all bytes */
+ if (err) {
+ /*
+ * Didn't process all bytes. Either the algorithm is
+ * broken, or this was the last step and it turned out
+ * the message wasn't evenly divisible into blocks but
+ * the algorithm requires it.
+ */
err = -EINVAL;
goto finish;
}
--
2.21.0
[View Less]