This is the start of the stable review cycle for the 4.4.159 release.
There are 28 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Sep 29 09:06:27 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.159-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.4.159-rc1
Steve Wise <swise(a)opengridcomputing.com>
iw_cxgb4: only allow 1 flush on user qps
Roderick Colenbrander <roderick.colenbrander(a)sony.com>
HID: sony: Support DS4 dongle
Roderick Colenbrander <roderick.colenbrander(a)sony.com>
HID: sony: Update device ids
Catalin Marinas <catalin.marinas(a)arm.com>
arm64: Add trace_hardirqs_off annotation in ret_to_user
Li Dongyang <dongyangli(a)ddn.com>
ext4: don't mark mmp buffer head dirty
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix online resizing for bigalloc file systems with a 1k block size
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix online resize's handling of a too-small final block group
Theodore Ts'o <tytso(a)mit.edu>
ext4: recalucate superblock checksum after updating free blocks/inodes
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid divide by zero fault when deleting corrupted inline directories
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
tty: vt_ioctl: fix potential Spectre v1
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
Junxiao Bi <junxiao.bi(a)oracle.com>
ocfs2: fix ocfs2 read block panic
Vincent Pelletier <plr.vincent(a)gmail.com>
scsi: target: iscsi: Use hex2bin instead of a re-implementation
Vasily Khoruzhick <vasilykh(a)arista.com>
neighbour: confirm neigh entries when ARP packet is received
Colin Ian King <colin.king(a)canonical.com>
net: hp100: fix always-true check for link up state
Willy Tarreau <w(a)1wt.eu>
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
Eric Dumazet <edumazet(a)google.com>
ipv6: fix possible use-after-free in ip6_xmit()
Toke Høiland-Jørgensen <toke(a)toke.dk>
gso_segment: Reset skb->mac_len after modifying network header
Joel Fernandes (Google) <joel(a)joelfernandes.org>
mm: shmem.c: Correctly annotate new inodes for lockdep
Vaibhav Nagarnaik <vnagarnaik(a)google.com>
ring-buffer: Allow for rescheduling when removing pages
Boris Ostrovsky <boris.ostrovsky(a)oracle.com>
xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't bug in case of too many frags
Mario Limonciello <mario.limonciello(a)dell.com>
platform/x86: alienware-wmi: Correct a memory leak
Willy Tarreau <w(a)1wt.eu>
ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ASoC: cs4265: fix MMTLR Data switch control
Suren Baghdasaryan <surenb(a)google.com>
NFC: Fix the number of pipes
Suren Baghdasaryan <surenb(a)google.com>
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
-------------
Diffstat:
Makefile | 4 ++--
arch/arm64/kernel/entry.S | 3 +++
arch/x86/xen/pmu.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 20 ++++++++++---------
drivers/hid/hid-core.c | 3 +++
drivers/hid/hid-ids.h | 2 ++
drivers/hid/hid-sony.c | 6 ++++++
drivers/infiniband/hw/cxgb4/qp.c | 6 ++++++
drivers/net/appletalk/ipddp.c | 8 ++++++--
drivers/net/ethernet/hp/hp100.c | 2 +-
drivers/net/xen-netfront.c | 8 +++++++-
drivers/platform/x86/alienware-wmi.c | 1 +
drivers/target/iscsi/iscsi_target_auth.c | 30 ++++++++++++++---------------
drivers/tty/vt/vt_ioctl.c | 4 ++++
fs/ext4/dir.c | 20 +++++++++----------
fs/ext4/inline.c | 4 +++-
fs/ext4/mmp.c | 1 -
fs/ext4/resize.c | 23 +++++++++++++++++++++-
fs/ext4/super.c | 2 ++
fs/ocfs2/buffer_head_io.c | 1 +
include/net/nfc/hci.h | 2 +-
kernel/trace/ring_buffer.c | 2 ++
mm/shmem.c | 2 ++
net/core/neighbour.c | 13 ++++++++-----
net/ipv4/af_inet.c | 1 +
net/ipv6/ip6_offload.c | 1 +
net/ipv6/ip6_output.c | 6 ++----
net/nfc/hci/core.c | 10 ++++++++++
sound/firewire/bebob/bebob_maudio.c | 24 +++++++++++++----------
sound/pci/emu10k1/emufx.c | 2 +-
sound/soc/codecs/cs4265.c | 4 ++--
31 files changed, 148 insertions(+), 69 deletions(-)
This is the start of the stable review cycle for the 4.9.130 release.
There are 44 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat Sep 29 09:00:54 UTC 2018.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.130-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.130-rc1
Steve Wise <swise(a)opengridcomputing.com>
iw_cxgb4: only allow 1 flush on user qps
Nadav Amit <namit(a)vmware.com>
vmw_balloon: include asm/io.h
Zachary Zhang <zhangzg(a)marvell.com>
PCI: aardvark: Size bridges before resources allocation
Roderick Colenbrander <roderick.colenbrander(a)sony.com>
HID: sony: Support DS4 dongle
Roderick Colenbrander <roderick.colenbrander(a)sony.com>
HID: sony: Update device ids
Steve Muckle <smuckle(a)google.com>
sched/fair: Fix vruntime_normalized() for remote non-migration wakeup
Eric Biggers <ebiggers(a)google.com>
ext4: show test_dummy_encryption mount option in /proc/mounts
Li Dongyang <dongyangli(a)ddn.com>
ext4: don't mark mmp buffer head dirty
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix online resizing for bigalloc file systems with a 1k block size
Theodore Ts'o <tytso(a)mit.edu>
ext4: fix online resize's handling of a too-small final block group
Theodore Ts'o <tytso(a)mit.edu>
ext4: recalucate superblock checksum after updating free blocks/inodes
Theodore Ts'o <tytso(a)mit.edu>
ext4: avoid divide by zero fault when deleting corrupted inline directories
Theodore Ts'o <tytso(a)mit.edu>
ext4: check to make sure the rename(2)'s destination is not freed
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
tty: vt_ioctl: fix potential Spectre v1
Boris Brezillon <boris.brezillon(a)bootlin.com>
drm/vc4: Fix the "no scaling" case on multi-planar YUV formats
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect()
Lyude Paul <lyude(a)redhat.com>
drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement
Junxiao Bi <junxiao.bi(a)oracle.com>
ocfs2: fix ocfs2 read block panic
Vincent Pelletier <plr.vincent(a)gmail.com>
scsi: target: iscsi: Use hex2bin instead of a re-implementation
Vasily Khoruzhick <vasilykh(a)arista.com>
neighbour: confirm neigh entries when ARP packet is received
Paolo Abeni <pabeni(a)redhat.com>
udp4: fix IP_CMSG_CHECKSUM for connected sockets
Colin Ian King <colin.king(a)canonical.com>
net: hp100: fix always-true check for link up state
Willy Tarreau <w(a)1wt.eu>
net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT
Eric Dumazet <edumazet(a)google.com>
ipv6: fix possible use-after-free in ip6_xmit()
Toke Høiland-Jørgensen <toke(a)toke.dk>
gso_segment: Reset skb->mac_len after modifying network header
Joel Fernandes (Google) <joel(a)joelfernandes.org>
mm: shmem.c: Correctly annotate new inodes for lockdep
Vaibhav Nagarnaik <vnagarnaik(a)google.com>
ring-buffer: Allow for rescheduling when removing pages
Mika Westerberg <mika.westerberg(a)linux.intel.com>
Revert "PCI: Add ACS quirk for Intel 300 series"
Boris Ostrovsky <boris.ostrovsky(a)oracle.com>
xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code
Juergen Gross <jgross(a)suse.com>
xen/netfront: don't bug in case of too many frags
Mario Limonciello <mario.limonciello(a)dell.com>
platform/x86: alienware-wmi: Correct a memory leak
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: oxfw: fix memory leak of private data
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: oxfw: fix memory leak of discovered stream formats at error path
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: oxfw: fix memory leak for model-dependent data at error path
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: fireworks: fix memory leak of response buffer at error path
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-tascam: fix memory leak of private data
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: firewire-digi00x: fix memory leak of private data
Willy Tarreau <w(a)1wt.eu>
ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping
Takashi Sakamoto <o-takashi(a)sakamocchi.jp>
ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error path
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
ASoC: cs4265: fix MMTLR Data switch control
Suren Baghdasaryan <surenb(a)google.com>
NFC: Fix the number of pipes
Suren Baghdasaryan <surenb(a)google.com>
NFC: Fix possible memory corruption when handling SHDLC I-Frame commands
-------------
Diffstat:
Makefile | 4 +--
arch/x86/xen/pmu.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_connector.c | 20 ++++++------
drivers/gpu/drm/nouveau/nouveau_display.c | 33 ++++++++++++++-----
drivers/gpu/drm/vc4/vc4_plane.c | 25 +++++++--------
drivers/hid/hid-core.c | 3 ++
drivers/hid/hid-ids.h | 2 ++
drivers/hid/hid-sony.c | 6 ++++
drivers/infiniband/hw/cxgb4/qp.c | 6 ++++
drivers/misc/vmw_balloon.c | 1 +
drivers/net/appletalk/ipddp.c | 8 +++--
drivers/net/ethernet/hp/hp100.c | 2 +-
drivers/net/xen-netfront.c | 8 ++++-
drivers/pci/host/pci-aardvark.c | 1 +
drivers/pci/quirks.c | 6 ----
drivers/platform/x86/alienware-wmi.c | 1 +
drivers/target/iscsi/iscsi_target_auth.c | 30 +++++++++---------
drivers/tty/vt/vt_ioctl.c | 4 +++
fs/ext4/dir.c | 20 ++++++------
fs/ext4/inline.c | 4 ++-
fs/ext4/mmp.c | 1 -
fs/ext4/namei.c | 6 ++++
fs/ext4/resize.c | 23 +++++++++++++-
fs/ext4/super.c | 4 +++
fs/ocfs2/buffer_head_io.c | 1 +
include/net/nfc/hci.h | 2 +-
kernel/sched/fair.c | 3 +-
kernel/trace/ring_buffer.c | 2 ++
mm/shmem.c | 2 ++
net/core/neighbour.c | 13 +++++---
net/ipv4/af_inet.c | 1 +
net/ipv4/udp.c | 49 +++++++++++++++--------------
net/ipv6/ip6_offload.c | 1 +
net/ipv6/ip6_output.c | 6 ++--
net/nfc/hci/core.c | 10 ++++++
sound/firewire/bebob/bebob.c | 2 ++
sound/firewire/bebob/bebob_maudio.c | 28 ++++++++---------
sound/firewire/digi00x/digi00x.c | 1 +
sound/firewire/fireworks/fireworks.c | 2 ++
sound/firewire/oxfw/oxfw.c | 10 ++++++
sound/firewire/tascam/tascam.c | 1 +
sound/pci/emu10k1/emufx.c | 2 +-
sound/soc/codecs/cs4265.c | 4 +--
43 files changed, 236 insertions(+), 124 deletions(-)
At least on PXA3xx platforms, enabling RDY interrupts in the NDCR register
will only cause the IRQ to latch when the RDY lanes are changing, and not
in case they are already asserted.
This means that if the controller finished the command in flight before
marvell_nfc_wait_op() is called, that function will wait for a change in
the bit that can't ever happen as it is already set.
To mitigate this race, check for the RDY bits after the IRQ was enabled,
and only sleep on the condition if the controller isn't ready yet.
This fixes a bug that was observed with a NAND chip that holds a UBIFS
parition on which file system stress tests were executed. When
marvell_nfc_wait_op() reports an error, UBI/UBIFS will eventually mount
the filesystem read-only, reporting lots of warnings along the way.
Fixes: 02f26ecf8c77 mtd: nand: add reworked Marvell NAND controller driver
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Mack <daniel(a)zonque.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 666f34b58dec..e96ec7b9a152 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -613,7 +613,8 @@ static int marvell_nfc_wait_cmdd(struct nand_chip *chip)
static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
{
struct marvell_nfc *nfc = to_marvell_nfc(chip->controller);
- int ret;
+ int ret = -EALREADY;
+ u32 st;
/* Timeout is expressed in ms */
if (!timeout_ms)
@@ -622,8 +623,15 @@ static int marvell_nfc_wait_op(struct nand_chip *chip, unsigned int timeout_ms)
init_completion(&nfc->complete);
marvell_nfc_enable_int(nfc, NDCR_RDYM);
- ret = wait_for_completion_timeout(&nfc->complete,
- msecs_to_jiffies(timeout_ms));
+
+ /*
+ * Check if the NDSR_RDY bits have already been set before the
+ * interrupt was enabled.
+ */
+ st = readl_relaxed(nfc->regs + NDSR);
+ if (!(st & (NDSR_RDY(0) | NDSR_RDY(1))))
+ ret = wait_for_completion_timeout(&nfc->complete,
+ msecs_to_jiffies(timeout_ms));
marvell_nfc_disable_int(nfc, NDCR_RDYM);
marvell_nfc_clear_int(nfc, NDSR_RDY(0) | NDSR_RDY(1));
if (!ret) {
--
2.17.1
Hi Greg,
On Thu, Sep 27, 2018 at 10:03 AM, Greg Kroah-Hartman
<gregkh(a)linuxfoundation.org> wrote:
> 4.14-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Kirill Kapranov <kirill.kapranov(a)compulab.co.il>
>
> commit 1a4327fbf4554d5b78d75b19a13d40d6de220159 upstream.
>
> On systems where some controllers get a dynamic ID assigned and some have
> a fixed number (e.g. from ACPI tables), the current implementation might
> run into an IDR collision: in case of a fixed bus number is gotten by a
> driver (but not marked busy in IDR tree) and a driver with dynamic bus
> number gets the same ID and predictably fails.
>
> Fix this by means of checking-in fixed IDsin IDR as far as dynamic ones
> at the moment of the controller registration.
>
> Fixes: 9b61e302210e (spi: Pick spi bus number from Linux idr or spi alias)
> Signed-off-by: Kirill Kapranov <kirill.kapranov(a)compulab.co.il>
> Signed-off-by: Mark Brown <broonie(a)kernel.org>
> Cc: stable(a)vger.kernel.org
> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
There is another later patch which fixes this patch.
04b2d03a7565 ("spi: Fix double IDR allocation with DT aliases") , can
you please add it to the release also..
--
Regards
Sudip