diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-20 13:21:15 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2018-07-20 13:21:15 -0400 |
| commit | 6dde771dbfaa39fad654aaac1fb965ed9479f373 (patch) | |
| tree | 7a5b3367fb5dc9f165510aef4737e5195c12e50b | |
| parent | 7f12b7532553fc698a1ff2bc0756e63b96910ca0 (diff) | |
| download | longterm-queue-4.12-6dde771dbfaa39fad654aaac1fb965ed9479f373.tar.gz | |
drop patches with post-4.12 Fixes: tags
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
34 files changed, 0 insertions, 1802 deletions
diff --git a/queue/IB-core-Bound-check-alternate-path-port-number.patch b/queue/IB-core-Bound-check-alternate-path-port-number.patch deleted file mode 100644 index 7114309..0000000 --- a/queue/IB-core-Bound-check-alternate-path-port-number.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 4cae8ff136782d77b108cb3a5ba53e60597ba3a6 Mon Sep 17 00:00:00 2001 -From: Daniel Jurgens <danielj@mellanox.com> -Date: Tue, 5 Dec 2017 22:30:01 +0200 -Subject: [PATCH] IB/core: Bound check alternate path port number - -commit 4cae8ff136782d77b108cb3a5ba53e60597ba3a6 upstream. - -The alternate port number is used as an array index in the IB -security implementation, invalid values can result in a kernel panic. - -Cc: <stable@vger.kernel.org> # v4.12 -Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs") -Signed-off-by: Daniel Jurgens <danielj@mellanox.com> -Reviewed-by: Parav Pandit <parav@mellanox.com> -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Doug Ledford <dledford@redhat.com> - -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index 16d55710b116..d0202bb176a4 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -1971,6 +1971,12 @@ static int modify_qp(struct ib_uverbs_file *file, - goto release_qp; - } - -+ if ((cmd->base.attr_mask & IB_QP_ALT_PATH) && -+ !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) { -+ ret = -EINVAL; -+ goto release_qp; -+ } -+ - attr->qp_state = cmd->base.qp_state; - attr->cur_qp_state = cmd->base.cur_qp_state; - attr->path_mtu = cmd->base.path_mtu; --- -2.15.0 - diff --git a/queue/IB-core-Don-t-enforce-PKey-security-on-SMI-MADs.patch b/queue/IB-core-Don-t-enforce-PKey-security-on-SMI-MADs.patch deleted file mode 100644 index 956ac9b..0000000 --- a/queue/IB-core-Don-t-enforce-PKey-security-on-SMI-MADs.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 0fbe8f575b15585eec3326e43708fbbc024e8486 Mon Sep 17 00:00:00 2001 -From: Daniel Jurgens <danielj@mellanox.com> -Date: Tue, 5 Dec 2017 22:30:02 +0200 -Subject: [PATCH] IB/core: Don't enforce PKey security on SMI MADs - -commit 0fbe8f575b15585eec3326e43708fbbc024e8486 upstream. - -Per the infiniband spec an SMI MAD can have any PKey. Checking the pkey -on SMI MADs is not necessary, and it seems that some older adapters -using the mthca driver don't follow the convention of using the default -PKey, resulting in false denials, or errors querying the PKey cache. - -SMI MAD security is still enforced, only agents allowed to manage the -subnet are able to receive or send SMI MADs. - -Reported-by: Chris Blake <chrisrblake93@gmail.com> -Cc: <stable@vger.kernel.org> # v4.12 -Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams") -Signed-off-by: Daniel Jurgens <danielj@mellanox.com> -Reviewed-by: Parav Pandit <parav@mellanox.com> -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Doug Ledford <dledford@redhat.com> - -diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c -index a337386652b0..feafdb961c48 100644 ---- a/drivers/infiniband/core/security.c -+++ b/drivers/infiniband/core/security.c -@@ -739,8 +739,11 @@ int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index) - if (!rdma_protocol_ib(map->agent.device, map->agent.port_num)) - return 0; - -- if (map->agent.qp->qp_type == IB_QPT_SMI && !map->agent.smp_allowed) -- return -EACCES; -+ if (map->agent.qp->qp_type == IB_QPT_SMI) { -+ if (!map->agent.smp_allowed) -+ return -EACCES; -+ return 0; -+ } - - return ib_security_pkey_access(map->agent.device, - map->agent.port_num, --- -2.15.0 - diff --git a/queue/IB-core-Fix-use-workqueue-without-WQ_MEM_RECLAIM.patch b/queue/IB-core-Fix-use-workqueue-without-WQ_MEM_RECLAIM.patch deleted file mode 100644 index d211739..0000000 --- a/queue/IB-core-Fix-use-workqueue-without-WQ_MEM_RECLAIM.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 39baf10310e6669564a485b55267fae70a4e44ae Mon Sep 17 00:00:00 2001 -From: Parav Pandit <parav@mellanox.com> -Date: Mon, 16 Oct 2017 08:45:15 +0300 -Subject: [PATCH] IB/core: Fix use workqueue without WQ_MEM_RECLAIM - -commit 39baf10310e6669564a485b55267fae70a4e44ae upstream. - -The IB/core provides address resolution service and invokes callback -handler when address resolve request completes of requester in worker -thread context. - -Such caller might allocate or free memory in callback handler -depending on the completion status to make further progress or to -terminate a connection. Most ULPs resolve route which involves -allocating route entry and path record elements in callback event handler. - -It has been noticed that WQ_MEM_RECLAIM flag should not be used for -workers that tend to allocate memory in this [1] thread discussion. - -In order to mitigate this situation, WQ_MEM_RECLAIM flag was dropped for -other such WQs in this [2] patch. - -Similar problem might arise with address resolution path, though its not -yet noticed. The ib_addr workqueue is not memory reclaim path due to its -nature of invoking callback that might allocate memory or don't free any -memory under memory pressure. - -[1] https://www.spinics.net/lists/linux-rdma/msg53239.html -[2] https://www.spinics.net/lists/linux-rdma/msg53416.html - -Fixes: f54816261c2b ("IB/addr: Remove deprecated create_singlethread_workqueue") -Fixes: 5fff41e1f89d ("IB/core: Fix race condition in resolving IP to MAC") -Signed-off-by: Parav Pandit <parav@mellanox.com> -Reviewed-by: Daniel Jurgens <danielj@mellanox.com> -Signed-off-by: Leon Romanovsky <leon@kernel.org> -Signed-off-by: Doug Ledford <dledford@redhat.com> - -diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c -index 12523f630b61..d2f74721b3ba 100644 ---- a/drivers/infiniband/core/addr.c -+++ b/drivers/infiniband/core/addr.c -@@ -852,7 +852,7 @@ static struct notifier_block nb = { - - int addr_init(void) - { -- addr_wq = alloc_ordered_workqueue("ib_addr", WQ_MEM_RECLAIM); -+ addr_wq = alloc_ordered_workqueue("ib_addr", 0); - if (!addr_wq) - return -ENOMEM; - --- -2.15.0 - diff --git a/queue/IB-hfi1-Mask-out-A-bit-from-psn-trace.patch b/queue/IB-hfi1-Mask-out-A-bit-from-psn-trace.patch deleted file mode 100644 index 1747d09..0000000 --- a/queue/IB-hfi1-Mask-out-A-bit-from-psn-trace.patch +++ /dev/null @@ -1,45 +0,0 @@ -From d0a2f454713a42447ee4007582c0e43c47bcf230 Mon Sep 17 00:00:00 2001 -From: Don Hiatt <don.hiatt@intel.com> -Date: Mon, 9 Oct 2017 12:38:12 -0700 -Subject: [PATCH] IB/hfi1: Mask out A bit from psn trace - -commit d0a2f454713a42447ee4007582c0e43c47bcf230 upstream. - -The trace logic prior to the fixes below used to mask the -A bit from the psn. It now mistakenly displays the A bit, -which is already displayed separately. - -Fix by adding the appropriate mask to the psn tracing. - -Fixes: 228d2af1b723 ("IB/hfi1: Separate input/output header tracing") -Fixes: 863cf89d472f ("IB/hfi1: Add 16B trace support") -Reviewed-by: Mike Marciniszyn <mike.marciniszyn@intel.com> -Signed-off-by: Don Hiatt <don.hiatt@intel.com> -Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com> -Signed-off-by: Doug Ledford <dledford@redhat.com> - -diff --git a/drivers/infiniband/hw/hfi1/trace.c b/drivers/infiniband/hw/hfi1/trace.c -index 9938bb983ce6..9749ec9dd9f2 100644 ---- a/drivers/infiniband/hw/hfi1/trace.c -+++ b/drivers/infiniband/hw/hfi1/trace.c -@@ -154,7 +154,7 @@ void hfi1_trace_parse_9b_bth(struct ib_other_headers *ohdr, - *opcode = ib_bth_get_opcode(ohdr); - *tver = ib_bth_get_tver(ohdr); - *pkey = ib_bth_get_pkey(ohdr); -- *psn = ib_bth_get_psn(ohdr); -+ *psn = mask_psn(ib_bth_get_psn(ohdr)); - *qpn = ib_bth_get_qpn(ohdr); - } - -@@ -169,7 +169,7 @@ void hfi1_trace_parse_16b_bth(struct ib_other_headers *ohdr, - *pad = ib_bth_get_pad(ohdr); - *se = ib_bth_get_se(ohdr); - *tver = ib_bth_get_tver(ohdr); -- *psn = ib_bth_get_psn(ohdr); -+ *psn = mask_psn(ib_bth_get_psn(ohdr)); - *qpn = ib_bth_get_qpn(ohdr); - } - --- -2.15.0 - diff --git a/queue/SUNRPC-Fix-a-race-in-the-receive-code-path.patch b/queue/SUNRPC-Fix-a-race-in-the-receive-code-path.patch deleted file mode 100644 index 3c518eb..0000000 --- a/queue/SUNRPC-Fix-a-race-in-the-receive-code-path.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 90d91b0cd371193d9dbfa9beacab8ab9a4cb75e0 Mon Sep 17 00:00:00 2001 -From: Trond Myklebust <trond.myklebust@primarydata.com> -Date: Thu, 14 Dec 2017 21:24:08 -0500 -Subject: [PATCH] SUNRPC: Fix a race in the receive code path - -commit 90d91b0cd371193d9dbfa9beacab8ab9a4cb75e0 upstream. - -We must ensure that the call to rpc_sleep_on() in xprt_transmit() cannot -race with the call to xprt_complete_rqst(). - -Reported-by: Chuck Lever <chuck.lever@oracle.com> -Link: https://bugzilla.linux-nfs.org/show_bug.cgi?id=317 -Fixes: ce7c252a8c74 ("SUNRPC: Add a separate spinlock to protect..") -Cc: stable@vger.kernel.org # 4.14+ -Reviewed-by: Chuck Lever <chuck.lever@oracle.com> -Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com> -Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> - -diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c -index 02a9bacb239b..5b06f6906a27 100644 ---- a/net/sunrpc/xprt.c -+++ b/net/sunrpc/xprt.c -@@ -1001,6 +1001,7 @@ void xprt_transmit(struct rpc_task *task) - { - struct rpc_rqst *req = task->tk_rqstp; - struct rpc_xprt *xprt = req->rq_xprt; -+ unsigned int connect_cookie; - int status, numreqs; - - dprintk("RPC: %5u xprt_transmit(%u)\n", task->tk_pid, req->rq_slen); -@@ -1024,6 +1025,7 @@ void xprt_transmit(struct rpc_task *task) - } else if (!req->rq_bytes_sent) - return; - -+ connect_cookie = xprt->connect_cookie; - req->rq_xtime = ktime_get(); - status = xprt->ops->send_request(task); - trace_xprt_transmit(xprt, req->rq_xid, status); -@@ -1047,20 +1049,28 @@ void xprt_transmit(struct rpc_task *task) - xprt->stat.bklog_u += xprt->backlog.qlen; - xprt->stat.sending_u += xprt->sending.qlen; - xprt->stat.pending_u += xprt->pending.qlen; -+ spin_unlock_bh(&xprt->transport_lock); - -- /* Don't race with disconnect */ -- if (!xprt_connected(xprt)) -- task->tk_status = -ENOTCONN; -- else { -+ req->rq_connect_cookie = connect_cookie; -+ if (rpc_reply_expected(task) && !READ_ONCE(req->rq_reply_bytes_recvd)) { - /* -- * Sleep on the pending queue since -- * we're expecting a reply. -+ * Sleep on the pending queue if we're expecting a reply. -+ * The spinlock ensures atomicity between the test of -+ * req->rq_reply_bytes_recvd, and the call to rpc_sleep_on(). - */ -- if (!req->rq_reply_bytes_recvd && rpc_reply_expected(task)) -+ spin_lock(&xprt->recv_lock); -+ if (!req->rq_reply_bytes_recvd) { - rpc_sleep_on(&xprt->pending, task, xprt_timer); -- req->rq_connect_cookie = xprt->connect_cookie; -+ /* -+ * Send an extra queue wakeup call if the -+ * connection was dropped in case the call to -+ * rpc_sleep_on() raced. -+ */ -+ if (!xprt_connected(xprt)) -+ xprt_wake_pending_tasks(xprt, -ENOTCONN); -+ } -+ spin_unlock(&xprt->recv_lock); - } -- spin_unlock_bh(&xprt->transport_lock); - } - - static void xprt_add_backlog(struct rpc_xprt *xprt, struct rpc_task *task) --- -2.15.0 - diff --git a/queue/arm64-mm-Fix-pte_mkclean-pte_mkdirty-semantics.patch b/queue/arm64-mm-Fix-pte_mkclean-pte_mkdirty-semantics.patch deleted file mode 100644 index dbb7fa9..0000000 --- a/queue/arm64-mm-Fix-pte_mkclean-pte_mkdirty-semantics.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 8781bcbc5e69d7da69e84c7044ca0284848d5d01 Mon Sep 17 00:00:00 2001 -From: Steve Capper <steve.capper@arm.com> -Date: Fri, 1 Dec 2017 17:22:14 +0000 -Subject: [PATCH] arm64: mm: Fix pte_mkclean, pte_mkdirty semantics - -commit 8781bcbc5e69d7da69e84c7044ca0284848d5d01 upstream. - -On systems with hardware dirty bit management, the ltp madvise09 unit -test fails due to dirty bit information being lost and pages being -incorrectly freed. - -This was bisected to: - arm64: Ignore hardware dirty bit updates in ptep_set_wrprotect() - -Reverting this commit leads to a separate problem, that the unit test -retains pages that should have been dropped due to the function -madvise_free_pte_range(.) not cleaning pte's properly. - -Currently pte_mkclean only clears the software dirty bit, thus the -following code sequence can appear: - - pte = pte_mkclean(pte); - if (pte_dirty(pte)) - // this condition can return true with HW DBM! - -This patch also adjusts pte_mkclean to set PTE_RDONLY thus effectively -clearing both the SW and HW dirty information. - -In order for this to function on systems without HW DBM, we need to -also adjust pte_mkdirty to remove the read only bit from writable pte's -to avoid infinite fault loops. - -Cc: <stable@vger.kernel.org> -Fixes: 64c26841b349 ("arm64: Ignore hardware dirty bit updates in ptep_set_wrprotect()") -Reported-by: Bhupinder Thakur <bhupinder.thakur@linaro.org> -Tested-by: Bhupinder Thakur <bhupinder.thakur@linaro.org> -Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> -Signed-off-by: Steve Capper <steve.capper@arm.com> -Signed-off-by: Will Deacon <will.deacon@arm.com> - -diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h -index 149d05fb9421..3ff03a755c32 100644 ---- a/arch/arm64/include/asm/pgtable.h -+++ b/arch/arm64/include/asm/pgtable.h -@@ -149,12 +149,20 @@ static inline pte_t pte_mkwrite(pte_t pte) - - static inline pte_t pte_mkclean(pte_t pte) - { -- return clear_pte_bit(pte, __pgprot(PTE_DIRTY)); -+ pte = clear_pte_bit(pte, __pgprot(PTE_DIRTY)); -+ pte = set_pte_bit(pte, __pgprot(PTE_RDONLY)); -+ -+ return pte; - } - - static inline pte_t pte_mkdirty(pte_t pte) - { -- return set_pte_bit(pte, __pgprot(PTE_DIRTY)); -+ pte = set_pte_bit(pte, __pgprot(PTE_DIRTY)); -+ -+ if (pte_write(pte)) -+ pte = clear_pte_bit(pte, __pgprot(PTE_RDONLY)); -+ -+ return pte; - } - - static inline pte_t pte_mkold(pte_t pte) -@@ -641,28 +649,23 @@ static inline pmd_t pmdp_huge_get_and_clear(struct mm_struct *mm, - #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ - - /* -- * ptep_set_wrprotect - mark read-only while preserving the hardware update of -- * the Access Flag. -+ * ptep_set_wrprotect - mark read-only while trasferring potential hardware -+ * dirty status (PTE_DBM && !PTE_RDONLY) to the software PTE_DIRTY bit. - */ - #define __HAVE_ARCH_PTEP_SET_WRPROTECT - static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long address, pte_t *ptep) - { - pte_t old_pte, pte; - -- /* -- * ptep_set_wrprotect() is only called on CoW mappings which are -- * private (!VM_SHARED) with the pte either read-only (!PTE_WRITE && -- * PTE_RDONLY) or writable and software-dirty (PTE_WRITE && -- * !PTE_RDONLY && PTE_DIRTY); see is_cow_mapping() and -- * protection_map[]. There is no race with the hardware update of the -- * dirty state: clearing of PTE_RDONLY when PTE_WRITE (a.k.a. PTE_DBM) -- * is set. -- */ -- VM_WARN_ONCE(pte_write(*ptep) && !pte_dirty(*ptep), -- "%s: potential race with hardware DBM", __func__); - pte = READ_ONCE(*ptep); - do { - old_pte = pte; -+ /* -+ * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY -+ * clear), set the PTE_DIRTY bit. -+ */ -+ if (pte_hw_dirty(pte)) -+ pte = pte_mkdirty(pte); - pte = pte_wrprotect(pte); - pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep), - pte_val(old_pte), pte_val(pte)); --- -2.15.0 - diff --git a/queue/ath10k-fix-core-PCI-suspend-when-WoWLAN-is-supported.patch b/queue/ath10k-fix-core-PCI-suspend-when-WoWLAN-is-supported.patch deleted file mode 100644 index 4eca9d9..0000000 --- a/queue/ath10k-fix-core-PCI-suspend-when-WoWLAN-is-supported.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 96378bd2c6cda5f04d0f6da2cd35d4670a982c38 Mon Sep 17 00:00:00 2001 -From: Brian Norris <briannorris@chromium.org> -Date: Wed, 4 Oct 2017 12:22:55 +0300 -Subject: [PATCH] ath10k: fix core PCI suspend when WoWLAN is supported but - disabled - -commit 96378bd2c6cda5f04d0f6da2cd35d4670a982c38 upstream. - -For devices where the FW supports WoWLAN but user-space has not -configured it, we don't do any PCI-specific suspend/resume operations, -because mac80211 doesn't call drv_suspend() when !wowlan. This has -particularly bad effects for some platforms, because we don't stop the -power-save timer, and if this timer goes off after the PCI controller -has suspended the link, Bad Things will happen. - -Commit 32faa3f0ee50 ("ath10k: add the PCI PM core suspend/resume ops") -got some of this right, in that it understood there was a problem on -non-WoWLAN firmware. But it forgot the $subject case. - -Fix this by moving all the PCI driver suspend/resume logic exclusively -into the driver PM hooks. This shouldn't affect WoWLAN support much -(this just gets executed later on). - -I would just as well kill the entirety of ath10k_hif_suspend(), as it's -not even implemented on the USB or SDIO drivers. I expect that we don't -need the callback, except to return "supported" (i.e., 0) or "not -supported" (i.e., -EOPNOTSUPP). - -Fixes: 32faa3f0ee50 ("ath10k: add the PCI PM core suspend/resume ops") -Fixes: 77258d409ce4 ("ath10k: enable pci soc powersaving") -Signed-off-by: Brian Norris <briannorris@chromium.org> -Cc: Ryan Hsu <ryanhsu@qti.qualcomm.com> -Cc: Kalle Valo <kvalo@qca.qualcomm.com> -Cc: Michal Kazior <michal.kazior@tieto.com> -Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com> - -diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c -index bc1633945a56..4655c944e3fd 100644 ---- a/drivers/net/wireless/ath/ath10k/pci.c -+++ b/drivers/net/wireless/ath/ath10k/pci.c -@@ -2580,6 +2580,12 @@ void ath10k_pci_hif_power_down(struct ath10k *ar) - #ifdef CONFIG_PM - - static int ath10k_pci_hif_suspend(struct ath10k *ar) -+{ -+ /* Nothing to do; the important stuff is in the driver suspend. */ -+ return 0; -+} -+ -+static int ath10k_pci_suspend(struct ath10k *ar) - { - /* The grace timer can still be counting down and ar->ps_awake be true. - * It is known that the device may be asleep after resuming regardless -@@ -2592,6 +2598,12 @@ static int ath10k_pci_hif_suspend(struct ath10k *ar) - } - - static int ath10k_pci_hif_resume(struct ath10k *ar) -+{ -+ /* Nothing to do; the important stuff is in the driver resume. */ -+ return 0; -+} -+ -+static int ath10k_pci_resume(struct ath10k *ar) - { - struct ath10k_pci *ar_pci = ath10k_pci_priv(ar); - struct pci_dev *pdev = ar_pci->pdev; -@@ -3403,11 +3415,7 @@ static int ath10k_pci_pm_suspend(struct device *dev) - struct ath10k *ar = dev_get_drvdata(dev); - int ret; - -- if (test_bit(ATH10K_FW_FEATURE_WOWLAN_SUPPORT, -- ar->running_fw->fw_file.fw_features)) -- return 0; -- -- ret = ath10k_hif_suspend(ar); -+ ret = ath10k_pci_suspend(ar); - if (ret) - ath10k_warn(ar, "failed to suspend hif: %d\n", ret); - -@@ -3419,11 +3427,7 @@ static int ath10k_pci_pm_resume(struct device *dev) - struct ath10k *ar = dev_get_drvdata(dev); - int ret; - -- if (test_bit(ATH10K_FW_FEATURE_WOWLAN_SUPPORT, -- ar->running_fw->fw_file.fw_features)) -- return 0; -- -- ret = ath10k_hif_resume(ar); -+ ret = ath10k_pci_resume(ar); - if (ret) - ath10k_warn(ar, "failed to resume hif: %d\n", ret); - --- -2.15.0 - diff --git a/queue/autofs-fix-careless-error-in-recent-commit.patch b/queue/autofs-fix-careless-error-in-recent-commit.patch deleted file mode 100644 index d7f1dfe..0000000 --- a/queue/autofs-fix-careless-error-in-recent-commit.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 302ec300ef8a545a7fc7f667e5fd743b091c2eeb Mon Sep 17 00:00:00 2001 -From: NeilBrown <neilb@suse.com> -Date: Thu, 14 Dec 2017 15:32:38 -0800 -Subject: [PATCH] autofs: fix careless error in recent commit - -commit 302ec300ef8a545a7fc7f667e5fd743b091c2eeb upstream. - -Commit ecc0c469f277 ("autofs: don't fail mount for transient error") was -meant to replace an 'if' with a 'switch', but instead added the 'switch' -leaving the case in place. - -Link: http://lkml.kernel.org/r/87zi6wstmw.fsf@notabene.neil.brown.name -Fixes: ecc0c469f277 ("autofs: don't fail mount for transient error") -Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk> -Signed-off-by: NeilBrown <neilb@suse.com> -Cc: Ian Kent <raven@themaw.net> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> - -diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c -index 8fc41705c7cd..961a12dc6dc8 100644 ---- a/fs/autofs4/waitq.c -+++ b/fs/autofs4/waitq.c -@@ -170,7 +170,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - - mutex_unlock(&sbi->wq_mutex); - -- if (autofs4_write(sbi, pipe, &pkt, pktsz)) - switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) { - case 0: - break; --- -2.15.0 - diff --git a/queue/crypto-af_alg-fix-NULL-pointer-dereference-in.patch b/queue/crypto-af_alg-fix-NULL-pointer-dereference-in.patch deleted file mode 100644 index e9589db..0000000 --- a/queue/crypto-af_alg-fix-NULL-pointer-dereference-in.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 887207ed9e5812ed9239b6d07185a2d35dda91db Mon Sep 17 00:00:00 2001 -From: Eric Biggers <ebiggers@google.com> -Date: Tue, 28 Nov 2017 00:46:24 -0800 -Subject: [PATCH] crypto: af_alg - fix NULL pointer dereference in - -commit 887207ed9e5812ed9239b6d07185a2d35dda91db upstream. - - af_alg_free_areq_sgls() - -If allocating the ->tsgl member of 'struct af_alg_async_req' failed, -during cleanup we dereferenced the NULL ->tsgl pointer in -af_alg_free_areq_sgls(), because ->tsgl_entries was nonzero. - -Fix it by only freeing the ->tsgl list if it is non-NULL. - -This affected both algif_skcipher and algif_aead. - -Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management") -Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") -Reported-by: syzbot <syzkaller@googlegroups.com> -Cc: <stable@vger.kernel.org> # v4.14+ -Signed-off-by: Eric Biggers <ebiggers@google.com> -Reviewed-by: Stephan Mueller <smueller@chronox.de> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 85cea9de324a..1e5353f62067 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -672,14 +672,15 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq) - } - - tsgl = areq->tsgl; -- for_each_sg(tsgl, sg, areq->tsgl_entries, i) { -- if (!sg_page(sg)) -- continue; -- put_page(sg_page(sg)); -- } -+ if (tsgl) { -+ for_each_sg(tsgl, sg, areq->tsgl_entries, i) { -+ if (!sg_page(sg)) -+ continue; -+ put_page(sg_page(sg)); -+ } - -- if (areq->tsgl && areq->tsgl_entries) - sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl)); -+ } - } - EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls); - --- -2.15.0 - diff --git a/queue/crypto-algif_aead-fix-reference-counting-of-null-skc.patch b/queue/crypto-algif_aead-fix-reference-counting-of-null-skc.patch deleted file mode 100644 index e975302..0000000 --- a/queue/crypto-algif_aead-fix-reference-counting-of-null-skc.patch +++ /dev/null @@ -1,45 +0,0 @@ -From b32a7dc8aef1882fbf983eb354837488cc9d54dc Mon Sep 17 00:00:00 2001 -From: Eric Biggers <ebiggers@google.com> -Date: Mon, 27 Nov 2017 23:23:05 -0800 -Subject: [PATCH] crypto: algif_aead - fix reference counting of null skcipher - -commit b32a7dc8aef1882fbf983eb354837488cc9d54dc upstream. - -In the AEAD interface for AF_ALG, the reference to the "null skcipher" -held by each tfm was being dropped in the wrong place -- when each -af_alg_ctx was freed instead of when the aead_tfm was freed. As -discovered by syzkaller, a specially crafted program could use this to -cause the null skcipher to be freed while it is still in use. - -Fix it by dropping the reference in the right place. - -Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst") -Reported-by: syzbot <syzkaller@googlegroups.com> -Cc: <stable@vger.kernel.org> # v4.14+ -Signed-off-by: Eric Biggers <ebiggers@google.com> -Reviewed-by: Stephan Mueller <smueller@chronox.de> -Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> - -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index aacae0837aff..9d73be28cf01 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -487,6 +487,7 @@ static void aead_release(void *private) - struct aead_tfm *tfm = private; - - crypto_free_aead(tfm->aead); -+ crypto_put_default_null_skcipher2(); - kfree(tfm); - } - -@@ -519,7 +520,6 @@ static void aead_sock_destruct(struct sock *sk) - unsigned int ivlen = crypto_aead_ivsize(tfm); - - af_alg_pull_tsgl(sk, ctx->used, NULL, 0); -- crypto_put_default_null_skcipher2(); - sock_kzfree_s(sk, ctx->iv, ivlen); - sock_kfree_s(sk, ctx, ctx->len); - af_alg_release_parent(sk); --- -2.15.0 - diff --git a/queue/ext4-support-fast-symlinks-from-ext3-file-systems.patch b/queue/ext4-support-fast-symlinks-from-ext3-file-systems.patch deleted file mode 100644 index 5753b8f..0000000 --- a/queue/ext4-support-fast-symlinks-from-ext3-file-systems.patch +++ /dev/null @@ -1,51 +0,0 @@ -From fc82228a5e3860502dbf3bfa4a9570cb7093cf7f Mon Sep 17 00:00:00 2001 -From: Andi Kleen <ak@linux.intel.com> -Date: Sun, 3 Dec 2017 20:38:01 -0500 -Subject: [PATCH] ext4: support fast symlinks from ext3 file systems - -commit fc82228a5e3860502dbf3bfa4a9570cb7093cf7f upstream. - -407cd7fb83c0 (ext4: change fast symlink test to not rely on i_blocks) -broke ~10 years old ext3 file systems created by 2.6.17. Any ELF -executable fails because the /lib/ld-linux.so.2 fast symlink -cannot be read anymore. - -The patch assumed fast symlinks were created in a specific way, -but that's not true on these really old file systems. - -The new behavior is apparently needed only with the large EA inode -feature. - -Revert to the old behavior if the large EA inode feature is not set. - -This makes my old VM boot again. - -Fixes: 407cd7fb83c0 (ext4: change fast symlink test to not rely on i_blocks) -Signed-off-by: Andi Kleen <ak@linux.intel.com> -Signed-off-by: Theodore Ts'o <tytso@mit.edu> -Reviewed-by: Andreas Dilger <adilger@dilger.ca> -Cc: stable@vger.kernel.org - -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 7df2c5644e59..534a9130f625 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -149,6 +149,15 @@ static int ext4_meta_trans_blocks(struct inode *inode, int lblocks, - */ - int ext4_inode_is_fast_symlink(struct inode *inode) - { -+ if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { -+ int ea_blocks = EXT4_I(inode)->i_file_acl ? -+ EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0; -+ -+ if (ext4_has_inline_data(inode)) -+ return 0; -+ -+ return (S_ISLNK(inode->i_mode) && inode->i_blocks - ea_blocks == 0); -+ } - return S_ISLNK(inode->i_mode) && inode->i_size && - (inode->i_size < EXT4_N_BLOCKS * 4); - } --- -2.15.0 - diff --git a/queue/ipmi_si-fix-memory-leak-on-new_smi.patch b/queue/ipmi_si-fix-memory-leak-on-new_smi.patch deleted file mode 100644 index a86d1a6..0000000 --- a/queue/ipmi_si-fix-memory-leak-on-new_smi.patch +++ /dev/null @@ -1,31 +0,0 @@ -From c0a32fe13cd323ca9420500b16fd69589c9ba91e Mon Sep 17 00:00:00 2001 -From: Colin Ian King <colin.king@canonical.com> -Date: Tue, 17 Oct 2017 16:54:52 +0100 -Subject: [PATCH] ipmi_si: fix memory leak on new_smi - -commit c0a32fe13cd323ca9420500b16fd69589c9ba91e upstream. - -The error exit path omits kfree'ing the allocated new_smi, causing a memory -leak. Fix this by kfree'ing new_smi. - -Detected by CoverityScan, CID#14582571 ("Resource Leak") - -Fixes: 7e030d6dff71 ("ipmi: Prefer ACPI system interfaces over SMBIOS ones") -Signed-off-by: Colin Ian King <colin.king@canonical.com> -Signed-off-by: Corey Minyard <cminyard@mvista.com> - -diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c -index 55e0c42bee4d..4c16af64f73a 100644 ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -2004,6 +2004,7 @@ int ipmi_si_add_smi(struct si_sm_io *io) - ipmi_addr_src_to_str(new_smi->io.addr_source), - si_to_str[new_smi->io.si_type]); - rv = -EBUSY; -+ kfree(new_smi); - goto out_err; - } - } --- -2.15.0 - diff --git a/queue/lightnvm-pblk-use-right-flag-for-GC-allocation.patch b/queue/lightnvm-pblk-use-right-flag-for-GC-allocation.patch deleted file mode 100644 index a38bde0..0000000 --- a/queue/lightnvm-pblk-use-right-flag-for-GC-allocation.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 7d327a9ed6c4dca341ebf99012e0a6b80a3050e6 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Javier=20Gonz=C3=A1lez?= <javier@cnexlabs.com> -Date: Fri, 13 Oct 2017 14:46:02 +0200 -Subject: [PATCH] lightnvm: pblk: use right flag for GC allocation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 7d327a9ed6c4dca341ebf99012e0a6b80a3050e6 upstream. - -The data buffer for the GC path allocates virtual memory through -vmalloc. When this change was introduced, a flag signaling kmalloc'ed -memory was wrongly introduced. Use the right flag when creating a bio -from this buffer. - -Fixes: de54e703a422 ("lightnvm: pblk: use vmalloc for GC data buffer") -Signed-off-by: Javier González <javier@cnexlabs.com> -Signed-off-by: Matias Bjørling <m@bjorling.me> -Signed-off-by: Jens Axboe <axboe@kernel.dk> - -diff --git a/drivers/lightnvm/pblk-read.c b/drivers/lightnvm/pblk-read.c -index d682e89e6493..ee8efb55b330 100644 ---- a/drivers/lightnvm/pblk-read.c -+++ b/drivers/lightnvm/pblk-read.c -@@ -499,7 +499,7 @@ int pblk_submit_read_gc(struct pblk *pblk, u64 *lba_list, void *data, - - data_len = (*secs_to_gc) * geo->sec_size; - bio = pblk_bio_map_addr(pblk, data, *secs_to_gc, data_len, -- PBLK_KMALLOC_META, GFP_KERNEL); -+ PBLK_VMALLOC_META, GFP_KERNEL); - if (IS_ERR(bio)) { - pr_err("pblk: could not allocate GC bio (%lu)\n", PTR_ERR(bio)); - goto err_free_dma; -@@ -519,7 +519,7 @@ int pblk_submit_read_gc(struct pblk *pblk, u64 *lba_list, void *data, - if (ret) { - bio_endio(bio); - pr_err("pblk: GC read request failed\n"); -- goto err_free_dma; -+ goto err_free_bio; - } - - if (!wait_for_completion_io_timeout(&wait, -@@ -541,10 +541,13 @@ int pblk_submit_read_gc(struct pblk *pblk, u64 *lba_list, void *data, - atomic_long_sub(*secs_to_gc, &pblk->inflight_reads); - #endif - -+ bio_put(bio); - out: - nvm_dev_dma_free(dev->parent, rqd.meta_list, rqd.dma_meta_list); - return NVM_IO_OK; - -+err_free_bio: -+ bio_put(bio); - err_free_dma: - nvm_dev_dma_free(dev->parent, rqd.meta_list, rqd.dma_meta_list); - return NVM_IO_ERR; --- -2.15.0 - diff --git a/queue/mlxsw-spectrum-Fix-error-return-code-in-mlxsw_sp_por.patch b/queue/mlxsw-spectrum-Fix-error-return-code-in-mlxsw_sp_por.patch deleted file mode 100644 index 9ccfcb0..0000000 --- a/queue/mlxsw-spectrum-Fix-error-return-code-in-mlxsw_sp_por.patch +++ /dev/null @@ -1,31 +0,0 @@ -From d86fd113ebbb37726ef7c7cc6fd6d5ce377455d6 Mon Sep 17 00:00:00 2001 -From: Wei Yongjun <weiyongjun1@huawei.com> -Date: Mon, 6 Nov 2017 11:11:28 +0000 -Subject: [PATCH] mlxsw: spectrum: Fix error return code in - mlxsw_sp_port_create() - -commit d86fd113ebbb37726ef7c7cc6fd6d5ce377455d6 upstream. - -Fix to return a negative error code from the VID create error handling -case instead of 0, as done elsewhere in this function. - -Fixes: c57529e1d5d8 ("mlxsw: spectrum: Replace vPorts with Port-VLAN") -Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> -Reviewed-by: Ido Schimmel <idosch@mellanox.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -index 1497b436be78..b2cd1ebf4e36 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c -@@ -3043,6 +3043,7 @@ static int mlxsw_sp_port_create(struct mlxsw_sp *mlxsw_sp, u8 local_port, - if (IS_ERR(mlxsw_sp_port_vlan)) { - dev_err(mlxsw_sp->bus_info->dev, "Port %d: Failed to create VID 1\n", - mlxsw_sp_port->local_port); -+ err = PTR_ERR(mlxsw_sp_port_vlan); - goto err_port_vlan_get; - } - --- -2.15.0 - diff --git a/queue/mm-oom_reaper-fix-memory-corruption.patch b/queue/mm-oom_reaper-fix-memory-corruption.patch deleted file mode 100644 index b0a6ff2..0000000 --- a/queue/mm-oom_reaper-fix-memory-corruption.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 4837fe37adff1d159904f0c013471b1ecbcb455e Mon Sep 17 00:00:00 2001 -From: Michal Hocko <mhocko@suse.com> -Date: Thu, 14 Dec 2017 15:33:15 -0800 -Subject: [PATCH] mm, oom_reaper: fix memory corruption - -commit 4837fe37adff1d159904f0c013471b1ecbcb455e upstream. - -David Rientjes has reported the following memory corruption while the -oom reaper tries to unmap the victims address space - - BUG: Bad page map in process oom_reaper pte:6353826300000000 pmd:00000000 - addr:00007f50cab1d000 vm_flags:08100073 anon_vma:ffff9eea335603f0 mapping: (null) index:7f50cab1d - file: (null) fault: (null) mmap: (null) readpage: (null) - CPU: 2 PID: 1001 Comm: oom_reaper - Call Trace: - unmap_page_range+0x1068/0x1130 - __oom_reap_task_mm+0xd5/0x16b - oom_reaper+0xff/0x14c - kthread+0xc1/0xe0 - -Tetsuo Handa has noticed that the synchronization inside exit_mmap is -insufficient. We only synchronize with the oom reaper if -tsk_is_oom_victim which is not true if the final __mmput is called from -a different context than the oom victim exit path. This can trivially -happen from context of any task which has grabbed mm reference (e.g. to -read /proc/<pid>/ file which requires mm etc.). - -The race would look like this - - oom_reaper oom_victim task - mmget_not_zero - do_exit - mmput - __oom_reap_task_mm mmput - __mmput - exit_mmap - remove_vma - unmap_page_range - -Fix this issue by providing a new mm_is_oom_victim() helper which -operates on the mm struct rather than a task. Any context which -operates on a remote mm struct should use this helper in place of -tsk_is_oom_victim. The flag is set in mark_oom_victim and never cleared -so it is stable in the exit_mmap path. - -Debugged by Tetsuo Handa. - -Link: http://lkml.kernel.org/r/20171210095130.17110-1-mhocko@kernel.org -Fixes: 212925802454 ("mm: oom: let oom_reap_task and exit_mmap run concurrently") -Signed-off-by: Michal Hocko <mhocko@suse.com> -Reported-by: David Rientjes <rientjes@google.com> -Acked-by: David Rientjes <rientjes@google.com> -Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> -Cc: Andrea Argangeli <andrea@kernel.org> -Cc: <stable@vger.kernel.org> [4.14] -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> - -diff --git a/include/linux/oom.h b/include/linux/oom.h -index 01c91d874a57..5bad038ac012 100644 ---- a/include/linux/oom.h -+++ b/include/linux/oom.h -@@ -66,6 +66,15 @@ static inline bool tsk_is_oom_victim(struct task_struct * tsk) - return tsk->signal->oom_mm; - } - -+/* -+ * Use this helper if tsk->mm != mm and the victim mm needs a special -+ * handling. This is guaranteed to stay true after once set. -+ */ -+static inline bool mm_is_oom_victim(struct mm_struct *mm) -+{ -+ return test_bit(MMF_OOM_VICTIM, &mm->flags); -+} -+ - /* - * Checks whether a page fault on the given mm is still reliable. - * This is no longer true if the oom reaper started to reap the -diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h -index 9c8847395b5e..ec912d01126f 100644 ---- a/include/linux/sched/coredump.h -+++ b/include/linux/sched/coredump.h -@@ -70,6 +70,7 @@ static inline int get_dumpable(struct mm_struct *mm) - #define MMF_UNSTABLE 22 /* mm is unstable for copy_from_user */ - #define MMF_HUGE_ZERO_PAGE 23 /* mm has ever used the global huge zero page */ - #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */ -+#define MMF_OOM_VICTIM 25 /* mm is the oom victim */ - #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP) - - #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\ -diff --git a/mm/mmap.c b/mm/mmap.c -index a4d546821214..9efdc021ad22 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -3019,20 +3019,20 @@ void exit_mmap(struct mm_struct *mm) - /* Use -1 here to ensure all VMAs in the mm are unmapped */ - unmap_vmas(&tlb, vma, 0, -1); - -- set_bit(MMF_OOM_SKIP, &mm->flags); -- if (unlikely(tsk_is_oom_victim(current))) { -+ if (unlikely(mm_is_oom_victim(mm))) { - /* - * Wait for oom_reap_task() to stop working on this - * mm. Because MMF_OOM_SKIP is already set before - * calling down_read(), oom_reap_task() will not run - * on this "mm" post up_write(). - * -- * tsk_is_oom_victim() cannot be set from under us -- * either because current->mm is already set to NULL -+ * mm_is_oom_victim() cannot be set from under us -+ * either because victim->mm is already set to NULL - * under task_lock before calling mmput and oom_mm is -- * set not NULL by the OOM killer only if current->mm -+ * set not NULL by the OOM killer only if victim->mm - * is found not NULL while holding the task_lock. - */ -+ set_bit(MMF_OOM_SKIP, &mm->flags); - down_write(&mm->mmap_sem); - up_write(&mm->mmap_sem); - } -diff --git a/mm/oom_kill.c b/mm/oom_kill.c -index c957be32b27a..29f855551efe 100644 ---- a/mm/oom_kill.c -+++ b/mm/oom_kill.c -@@ -683,8 +683,10 @@ static void mark_oom_victim(struct task_struct *tsk) - return; - - /* oom_mm is bound to the signal struct life time. */ -- if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) -+ if (!cmpxchg(&tsk->signal->oom_mm, NULL, mm)) { - mmgrab(tsk->signal->oom_mm); -+ set_bit(MMF_OOM_VICTIM, &mm->flags); -+ } - - /* - * Make sure that the task is woken up from uninterruptible sleep --- -2.15.0 - diff --git a/queue/net-hns3-add-nic_client-check-when-initialize-roce-b.patch b/queue/net-hns3-add-nic_client-check-when-initialize-roce-b.patch deleted file mode 100644 index c5896a4..0000000 --- a/queue/net-hns3-add-nic_client-check-when-initialize-roce-b.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 3a46f34d20d453f09defb76b11a567647939c0aa Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Tue, 24 Oct 2017 21:02:10 +0800 -Subject: [PATCH] net: hns3: add nic_client check when initialize roce base - information - -commit 3a46f34d20d453f09defb76b11a567647939c0aa upstream. - -Roce driver works base on HNS3 driver.If insmod Roce driver before -NIC driver there is a error because do not check nic_client. This patch -adds nic_client check when initialize roce base information. - -Fixes: 46a3df9 (net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 443124177f05..2c22d3cf6d1e 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -4285,7 +4285,7 @@ static int hclge_init_client_instance(struct hnae3_client *client, - vport->roce.client = client; - } - -- if (hdev->roce_client) { -+ if (hdev->roce_client && hdev->nic_client) { - ret = hclge_init_roce_base_info(vport); - if (ret) - goto err; --- -2.15.0 - diff --git a/queue/net-hns3-fix-a-bug-in-hclge_uninit_client_instance.patch b/queue/net-hns3-fix-a-bug-in-hclge_uninit_client_instance.patch deleted file mode 100644 index 9cc9e5e..0000000 --- a/queue/net-hns3-fix-a-bug-in-hclge_uninit_client_instance.patch +++ /dev/null @@ -1,50 +0,0 @@ -From a17dcf3f0124698d1120da71574bf4c339e5a368 Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Tue, 24 Oct 2017 21:02:11 +0800 -Subject: [PATCH] net: hns3: fix a bug in hclge_uninit_client_instance - -commit a17dcf3f0124698d1120da71574bf4c339e5a368 upstream. - -HNS3 driver initialize hdev->roce_client and vport->roce.client in -hclge_init_client_instance, and need set hdev->roce_client and -vport->roce.client NULL. - -If do not set them NULL when uninit, it will fail in the scene: -insmod hns3.ko, hns-roce.ko, hns-roce-hw-v3.ko successfully, but -rmmod hns3.ko after rmmod hns-roce-hw-v2.ko and hns-roce.ko. -This patch fixes the issue. - -Fixes: 46a3df9 (net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -index 2c22d3cf6d1e..d11a9a56c7d8 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c -@@ -4311,13 +4311,19 @@ static void hclge_uninit_client_instance(struct hnae3_client *client, - - for (i = 0; i < hdev->num_vmdq_vport + 1; i++) { - vport = &hdev->vport[i]; -- if (hdev->roce_client) -+ if (hdev->roce_client) { - hdev->roce_client->ops->uninit_instance(&vport->roce, - 0); -+ hdev->roce_client = NULL; -+ vport->roce.client = NULL; -+ } - if (client->type == HNAE3_CLIENT_ROCE) - return; -- if (client->ops->uninit_instance) -+ if (client->ops->uninit_instance) { - client->ops->uninit_instance(&vport->nic, 0); -+ hdev->nic_client = NULL; -+ vport->nic.client = NULL; -+ } - } - } - --- -2.15.0 - diff --git a/queue/net-hns3-fix-a-bug-when-alloc-new-buffer.patch b/queue/net-hns3-fix-a-bug-when-alloc-new-buffer.patch deleted file mode 100644 index a6e0709..0000000 --- a/queue/net-hns3-fix-a-bug-when-alloc-new-buffer.patch +++ /dev/null @@ -1,32 +0,0 @@ -From b9077428ec5569aacb2952d8a2ffb51c8988d3c2 Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Mon, 23 Oct 2017 19:51:01 +0800 -Subject: [PATCH] net: hns3: fix a bug when alloc new buffer - -commit b9077428ec5569aacb2952d8a2ffb51c8988d3c2 upstream. - -When alloce new buffer to HW, should unmap the old buffer first. -This old code map the old buffer but not unmap the old buffer, -this patch fixes it. - -Fixes: 76ad4f0 (net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -index 8383d6726ae4..3ddcd47fa61c 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -@@ -1595,7 +1595,7 @@ static int hns3_alloc_ring_buffers(struct hns3_enet_ring *ring) - static void hns3_replace_buffer(struct hns3_enet_ring *ring, int i, - struct hns3_desc_cb *res_cb) - { -- hns3_map_buffer(ring, &ring->desc_cb[i]); -+ hns3_unmap_buffer(ring, &ring->desc_cb[i]); - ring->desc_cb[i] = *res_cb; - ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); - } --- -2.15.0 - diff --git a/queue/net-hns3-fix-for-getting-advertised_caps-in-hns3_get.patch b/queue/net-hns3-fix-for-getting-advertised_caps-in-hns3_get.patch deleted file mode 100644 index 19fb36f..0000000 --- a/queue/net-hns3-fix-for-getting-advertised_caps-in-hns3_get.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 2b39cabb2a283cea0c3d96d9370575371726164f Mon Sep 17 00:00:00 2001 -From: Fuyun Liang <liangfuyun1@huawei.com> -Date: Fri, 3 Nov 2017 12:18:26 +0800 -Subject: [PATCH] net: hns3: fix for getting advertised_caps in - hns3_get_link_ksettings - -commit 2b39cabb2a283cea0c3d96d9370575371726164f upstream. - -This patch fixes a bug for ethtool's get_link_ksettings(). -The advertising for autoneg is always added to advertised_caps -whether autoneg is enable or disable. This patch fixes it. - -Fixes: 496d03e (net: hns3: Add Ethtool support to HNS3 driver) -Signed-off-by: Fuyun Liang <liangfuyun1@huawei.com> -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c -index 367b20cef294..0e10a43e29b3 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c -@@ -640,6 +640,9 @@ static int hns3_get_link_ksettings(struct net_device *netdev, - break; - } - -+ if (!cmd->base.autoneg) -+ advertised_caps &= ~HNS3_LM_AUTONEG_BIT; -+ - /* now, map driver link modes to ethtool link modes */ - hns3_driv_to_eth_caps(supported_caps, cmd, false); - hns3_driv_to_eth_caps(advertised_caps, cmd, true); --- -2.15.0 - diff --git a/queue/net-hns3-fix-the-TX-RX-ring.queue_index-in-hns3_ring.patch b/queue/net-hns3-fix-the-TX-RX-ring.queue_index-in-hns3_ring.patch deleted file mode 100644 index a43470c..0000000 --- a/queue/net-hns3-fix-the-TX-RX-ring.queue_index-in-hns3_ring.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 66b447301ac710ee237dba8b653244018fbb6168 Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Mon, 23 Oct 2017 19:51:05 +0800 -Subject: [PATCH] net: hns3: fix the TX/RX ring.queue_index in - hns3_ring_get_cfg - -commit 66b447301ac710ee237dba8b653244018fbb6168 upstream. - -The interface hns3_ring_get_cfg only update TX ring queue_index, -but do not update RX ring queue_index. This patch fixes it. - -Fixes: 76ad4f0 (net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -index 58aa2dd6ace0..14de0f7581c8 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -@@ -2506,16 +2506,16 @@ static int hns3_ring_get_cfg(struct hnae3_queue *q, struct hns3_nic_priv *priv, - - if (ring_type == HNAE3_RING_TYPE_TX) { - ring_data[q->tqp_index].ring = ring; -+ ring_data[q->tqp_index].queue_index = q->tqp_index; - ring->io_base = (u8 __iomem *)q->io_base + HNS3_TX_REG_OFFSET; - } else { - ring_data[q->tqp_index + queue_num].ring = ring; -+ ring_data[q->tqp_index + queue_num].queue_index = q->tqp_index; - ring->io_base = q->io_base; - } - - hnae_set_bit(ring->flag, HNAE3_RING_TYPE_B, ring_type); - -- ring_data[q->tqp_index].queue_index = q->tqp_index; -- - ring->tqp = q; - ring->desc = NULL; - ring->desc_cb = NULL; --- -2.15.0 - diff --git a/queue/net-hns3-fix-the-bug-of-hns3_set_txbd_baseinfo.patch b/queue/net-hns3-fix-the-bug-of-hns3_set_txbd_baseinfo.patch deleted file mode 100644 index 9dab83e..0000000 --- a/queue/net-hns3-fix-the-bug-of-hns3_set_txbd_baseinfo.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 7036d26f328f12a323069eb16d965055b4cb3795 Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Tue, 24 Oct 2017 21:02:09 +0800 -Subject: [PATCH] net: hns3: fix the bug of hns3_set_txbd_baseinfo - -commit 7036d26f328f12a323069eb16d965055b4cb3795 upstream. - -The SC bits of TX BD mean switch control. For this area, value 0 -indicates no switch control, the packet is routed according to the -forwarding table. Value 1 indicates that the packet is transmitted -to the network bypassing the forwarding table. - -As HNS3 driver need support VF later, VF conmunicate with its own -PF need forwarding table. This patch sets SC bits of TX BD 0 and use -forwarding table. - -Fixes: 76ad4f0 (net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -index 537f6c3babb7..c6c5b2a96aaa 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -@@ -716,7 +716,7 @@ static void hns3_set_txbd_baseinfo(u16 *bdtp_fe_sc_vld_ra_ri, int frag_end) - HNS3_TXD_BDTYPE_M, 0); - hnae_set_bit(*bdtp_fe_sc_vld_ra_ri, HNS3_TXD_FE_B, !!frag_end); - hnae_set_bit(*bdtp_fe_sc_vld_ra_ri, HNS3_TXD_VLD_B, 1); -- hnae_set_field(*bdtp_fe_sc_vld_ra_ri, HNS3_TXD_SC_M, HNS3_TXD_SC_S, 1); -+ hnae_set_field(*bdtp_fe_sc_vld_ra_ri, HNS3_TXD_SC_M, HNS3_TXD_SC_S, 0); - } - - static int hns3_fill_desc(struct hns3_enet_ring *ring, void *priv, --- -2.15.0 - diff --git a/queue/net-hns3-fix-the-bug-when-map-buffer-fail.patch b/queue/net-hns3-fix-the-bug-when-map-buffer-fail.patch deleted file mode 100644 index 55f4fc7..0000000 --- a/queue/net-hns3-fix-the-bug-when-map-buffer-fail.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 564883bb4dc1a4f3cba6344e77743175694b0761 Mon Sep 17 00:00:00 2001 -From: Lipeng <lipeng321@huawei.com> -Date: Mon, 23 Oct 2017 19:51:02 +0800 -Subject: [PATCH] net: hns3: fix the bug when map buffer fail - -commit 564883bb4dc1a4f3cba6344e77743175694b0761 upstream. - -If one buffer had been recieved to stack, driver will alloc a new buffer, -map the buffer to device and replace the old buffer. When map fail, should -only free the new alloced buffer, but not free all buffers in the ring. - -Fixes: 76ad4f0 (net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC) - -Signed-off-by: Lipeng <lipeng321@huawei.com> -Signed-off-by: David S. Miller <davem@davemloft.net> - -diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -index 3ddcd47fa61c..58aa2dd6ace0 100644 ---- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c -@@ -1555,7 +1555,7 @@ static int hns3_reserve_buffer_map(struct hns3_enet_ring *ring, - return 0; - - out_with_buf: -- hns3_free_buffers(ring); -+ hns3_free_buffer(ring, cb); - out: - return ret; - } --- -2.15.0 - diff --git a/queue/nullb-fix-error-return-code-in-null_init.patch b/queue/nullb-fix-error-return-code-in-null_init.patch deleted file mode 100644 index 1e40d2a..0000000 --- a/queue/nullb-fix-error-return-code-in-null_init.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 30c516d750396c5f3ec9cb04c9e025c25e91495e Mon Sep 17 00:00:00 2001 -From: Wei Yongjun <weiyongjun1@huawei.com> -Date: Tue, 17 Oct 2017 12:11:46 +0000 -Subject: [PATCH] nullb: fix error return code in null_init() - -commit 30c516d750396c5f3ec9cb04c9e025c25e91495e upstream. - -Fix to return error code -ENOMEM from the null_alloc_dev() error -handling case instead of 0, as done elsewhere in this function. - -Fixes: 2984c8684f96 ("nullb: factor disk parameters") -Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> -Signed-off-by: Jens Axboe <axboe@kernel.dk> - -diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c -index bf2c8ca3242a..50c83c4b2ea0 100644 ---- a/drivers/block/null_blk.c -+++ b/drivers/block/null_blk.c -@@ -1991,8 +1991,10 @@ static int __init null_init(void) - - for (i = 0; i < nr_devices; i++) { - dev = null_alloc_dev(); -- if (!dev) -+ if (!dev) { -+ ret = -ENOMEM; - goto err_dev; -+ } - ret = null_add_dev(dev); - if (ret) { - null_free_dev(dev); --- -2.15.0 - diff --git a/queue/ovl-Pass-ovl_get_nlink-parameters-in-right-order.patch b/queue/ovl-Pass-ovl_get_nlink-parameters-in-right-order.patch deleted file mode 100644 index 574ed2c..0000000 --- a/queue/ovl-Pass-ovl_get_nlink-parameters-in-right-order.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 08d8f8a5b094b66b29936e8751b4a818b8db1207 Mon Sep 17 00:00:00 2001 -From: Vivek Goyal <vgoyal@redhat.com> -Date: Mon, 27 Nov 2017 10:12:44 -0500 -Subject: [PATCH] ovl: Pass ovl_get_nlink() parameters in right order - -commit 08d8f8a5b094b66b29936e8751b4a818b8db1207 upstream. - -Right now we seem to be passing index as "lowerdentry" and origin.dentry -as "upperdentry". IIUC, we should pass these parameters in reversed order -and this looks like a bug. - -Signed-off-by: Vivek Goyal <vgoyal@redhat.com> -Acked-by: Amir Goldstein <amir73il@gmail.com> -Fixes: caf70cb2ba5d ("ovl: cleanup orphan index entries") -Cc: <stable@vger.kernel.org> #v4.13 -Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> - -diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c -index 2a12dc2e9840..beb945e1963c 100644 ---- a/fs/overlayfs/namei.c -+++ b/fs/overlayfs/namei.c -@@ -435,7 +435,7 @@ int ovl_verify_index(struct dentry *index, struct ovl_path *lower, - - /* Check if index is orphan and don't warn before cleaning it */ - if (d_inode(index)->i_nlink == 1 && -- ovl_get_nlink(index, origin.dentry, 0) == 0) -+ ovl_get_nlink(origin.dentry, index, 0) == 0) - err = -ENOENT; - - dput(origin.dentry); --- -2.15.0 - diff --git a/queue/ovl-update-ctx-pos-on-impure-dir-iteration.patch b/queue/ovl-update-ctx-pos-on-impure-dir-iteration.patch deleted file mode 100644 index bb79576..0000000 --- a/queue/ovl-update-ctx-pos-on-impure-dir-iteration.patch +++ /dev/null @@ -1,36 +0,0 @@ -From b02a16e6413a2f782e542ef60bad9ff6bf212f8a Mon Sep 17 00:00:00 2001 -From: Amir Goldstein <amir73il@gmail.com> -Date: Wed, 29 Nov 2017 07:35:21 +0200 -Subject: [PATCH] ovl: update ctx->pos on impure dir iteration - -commit b02a16e6413a2f782e542ef60bad9ff6bf212f8a upstream. - -This fixes a regression with readdir of impure dir in overlayfs -that is shared to VM via 9p fs. - -Reported-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com> -Fixes: 4edb83bb1041 ("ovl: constant d_ino for non-merge dirs") -Cc: <stable@vger.kernel.org> #4.14 -Signed-off-by: Amir Goldstein <amir73il@gmail.com> -Tested-by: Miguel Bernal Marin <miguel.bernal.marin@linux.intel.com> -Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> - -diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c -index 0daa4354fec4..51088849ce97 100644 ---- a/fs/overlayfs/readdir.c -+++ b/fs/overlayfs/readdir.c -@@ -663,7 +663,10 @@ static int ovl_iterate_real(struct file *file, struct dir_context *ctx) - return PTR_ERR(rdt.cache); - } - -- return iterate_dir(od->realfile, &rdt.ctx); -+ err = iterate_dir(od->realfile, &rdt.ctx); -+ ctx->pos = rdt.ctx.pos; -+ -+ return err; - } - - --- -2.15.0 - diff --git a/queue/rpmsg-glink-Initialize-the-intent_req_comp-completio.patch b/queue/rpmsg-glink-Initialize-the-intent_req_comp-completio.patch deleted file mode 100644 index 6686292..0000000 --- a/queue/rpmsg-glink-Initialize-the-intent_req_comp-completio.patch +++ /dev/null @@ -1,32 +0,0 @@ -From 2394facb17bcace4b3c19b50202177a5d8903b64 Mon Sep 17 00:00:00 2001 -From: Arun Kumar Neelakantam <aneela@codeaurora.org> -Date: Mon, 30 Oct 2017 11:11:24 +0530 -Subject: [PATCH] rpmsg: glink: Initialize the "intent_req_comp" completion - variable - -commit 2394facb17bcace4b3c19b50202177a5d8903b64 upstream. - -The "intent_req_comp" variable is used without initialization which -results in NULL pointer dereference in qcom_glink_request_intent(). - -we need to initialize the completion variable before using it. - -Fixes: 27b9c5b66b23 ("rpmsg: glink: Request for intents when unavailable") -Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> -Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> - -diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c -index 5dcc9bf1c5bc..fcd46ab090a7 100644 ---- a/drivers/rpmsg/qcom_glink_native.c -+++ b/drivers/rpmsg/qcom_glink_native.c -@@ -227,6 +227,7 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink, - - init_completion(&channel->open_req); - init_completion(&channel->open_ack); -+ init_completion(&channel->intent_req_comp); - - INIT_LIST_HEAD(&channel->done_intents); - INIT_WORK(&channel->intent_work, qcom_glink_rx_done_work); --- -2.15.0 - diff --git a/queue/sched-rt-Do-not-pull-from-current-CPU-if-only-one-CP.patch b/queue/sched-rt-Do-not-pull-from-current-CPU-if-only-one-CP.patch deleted file mode 100644 index 053696b..0000000 --- a/queue/sched-rt-Do-not-pull-from-current-CPU-if-only-one-CP.patch +++ /dev/null @@ -1,82 +0,0 @@ -From f73c52a5bcd1710994e53fbccc378c42b97a06b6 Mon Sep 17 00:00:00 2001 -From: Steven Rostedt <rostedt@goodmis.org> -Date: Sat, 2 Dec 2017 13:04:54 -0500 -Subject: [PATCH] sched/rt: Do not pull from current CPU if only one CPU to - pull - -commit f73c52a5bcd1710994e53fbccc378c42b97a06b6 upstream. - -Daniel Wagner reported a crash on the BeagleBone Black SoC. - -This is a single CPU architecture, and does not have a functional -arch_send_call_function_single_ipi() implementation which can crash -the kernel if that is called. - -As it only has one CPU, it shouldn't be called, but if the kernel is -compiled for SMP, the push/pull RT scheduling logic now calls it for -irq_work if the one CPU is overloaded, it can use that function to call -itself and crash the kernel. - -Ideally, we should disable the SCHED_FEAT(RT_PUSH_IPI) if the system -only has a single CPU. But SCHED_FEAT is a constant if sched debugging -is turned off. Another fix can also be used, and this should also help -with normal SMP machines. That is, do not initiate the pull code if -there's only one RT overloaded CPU, and that CPU happens to be the -current CPU that is scheduling in a lower priority task. - -Even on a system with many CPUs, if there's many RT tasks waiting to -run on a single CPU, and that CPU schedules in another RT task of lower -priority, it will initiate the PULL logic in case there's a higher -priority RT task on another CPU that is waiting to run. But if there is -no other CPU with waiting RT tasks, it will initiate the RT pull logic -on itself (as it still has RT tasks waiting to run). This is a wasted -effort. - -Not only does this help with SMP code where the current CPU is the only -one with RT overloaded tasks, it should also solve the issue that -Daniel encountered, because it will prevent the PULL logic from -executing, as there's only one CPU on the system, and the check added -here will cause it to exit the RT pull code. - -Reported-by: Daniel Wagner <wagi@monom.org> -Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> -Acked-by: Peter Zijlstra <peterz@infradead.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> -Cc: Thomas Gleixner <tglx@linutronix.de> -Cc: linux-rt-users <linux-rt-users@vger.kernel.org> -Cc: stable@vger.kernel.org -Fixes: 4bdced5c9 ("sched/rt: Simplify the IPI based RT balancing logic") -Link: http://lkml.kernel.org/r/20171202130454.4cbbfe8d@vmware.local.home -Signed-off-by: Ingo Molnar <mingo@kernel.org> - -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 4056c19ca3f0..665ace2fc558 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -2034,8 +2034,9 @@ static void pull_rt_task(struct rq *this_rq) - bool resched = false; - struct task_struct *p; - struct rq *src_rq; -+ int rt_overload_count = rt_overloaded(this_rq); - -- if (likely(!rt_overloaded(this_rq))) -+ if (likely(!rt_overload_count)) - return; - - /* -@@ -2044,6 +2045,11 @@ static void pull_rt_task(struct rq *this_rq) - */ - smp_rmb(); - -+ /* If we are the only overloaded CPU do nothing */ -+ if (rt_overload_count == 1 && -+ cpumask_test_cpu(this_rq->cpu, this_rq->rd->rto_mask)) -+ return; -+ - #ifdef HAVE_RT_PUSH_IPI - if (sched_feat(RT_PUSH_IPI)) { - tell_cpu_to_push(this_rq); --- -2.15.0 - diff --git a/queue/scsi-libsas-fix-length-error-in-sas_smp_handler.patch b/queue/scsi-libsas-fix-length-error-in-sas_smp_handler.patch deleted file mode 100644 index 217c11a..0000000 --- a/queue/scsi-libsas-fix-length-error-in-sas_smp_handler.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 621f6401fdeefe96dfe9eab4b167c7c39f552bb0 Mon Sep 17 00:00:00 2001 -From: Jason Yan <yanaijie@huawei.com> -Date: Mon, 11 Dec 2017 15:03:33 +0800 -Subject: [PATCH] scsi: libsas: fix length error in sas_smp_handler() - -commit 621f6401fdeefe96dfe9eab4b167c7c39f552bb0 upstream. - -The return value of smp_execute_task_sg() is the untransferred residual, -but bsg_job_done() requires the length of payload received. This makes -SMP passthrough commands from userland by sg ioctl to libsas get a wrong -response. The userland tools such as smp_utils failed because of these -wrong responses: - -~#smp_discover /dev/bsg/expander-2\:13 -response too short, len=0 -~#smp_discover /dev/bsg/expander-2\:134 -response too short, len=0 - -Fix this by passing the actual received length to bsg_job_done(). And if -smp_execute_task_sg() returns 0, this means received length is exactly -the buffer length. - -[mkp: typo] - -Fixes: 651a01364994 ("scsi: scsi_transport_sas: switch to bsg-lib for SMP passthrough") -Cc: <stable@vger.kernel.org> # v4.14+ -Signed-off-by: Jason Yan <yanaijie@huawei.com> -Reported-by: chenqilin <chenqilin2@huawei.com> -Tested-by: chenqilin <chenqilin2@huawei.com> -CC: Christoph Hellwig <hch@lst.de> -Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> - -diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c -index 174e5eff6155..c7f21661b3cd 100644 ---- a/drivers/scsi/libsas/sas_expander.c -+++ b/drivers/scsi/libsas/sas_expander.c -@@ -2145,7 +2145,7 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, - struct sas_rphy *rphy) - { - struct domain_device *dev; -- unsigned int reslen = 0; -+ unsigned int rcvlen = 0; - int ret = -EINVAL; - - /* no rphy means no smp target support (ie aic94xx host) */ -@@ -2179,12 +2179,12 @@ void sas_smp_handler(struct bsg_job *job, struct Scsi_Host *shost, - - ret = smp_execute_task_sg(dev, job->request_payload.sg_list, - job->reply_payload.sg_list); -- if (ret > 0) { -- /* positive number is the untransferred residual */ -- reslen = ret; -+ if (ret >= 0) { -+ /* bsg_job_done() requires the length received */ -+ rcvlen = job->reply_payload.payload_len - ret; - ret = 0; - } - - out: -- bsg_job_done(job, ret, reslen); -+ bsg_job_done(job, ret, rcvlen); - } --- -2.15.0 - diff --git a/queue/series b/queue/series index 1cb95d4..e7bef86 100644 --- a/queue/series +++ b/queue/series @@ -1,19 +1,12 @@ 0001-mfd-fsl-imx25-Clean-up-irq-settings-during-removal.patch -0001-crypto-algif_aead-fix-reference-counting-of-null-skc.patch 0001-crypto-rsa-fix-buffer-overread-when-stripping-leadin.patch 0001-crypto-hmac-require-that-the-underlying-hash-algorit.patch 0001-crypto-salsa20-fix-blkcipher_walk-API-usage.patch -0001-crypto-af_alg-fix-NULL-pointer-dereference-in.patch 0001-cifs-fix-NULL-deref-in-SMB2_read.patch -0001-string.h-workaround-for-increased-stack-usage.patch -0001-autofs-fix-careless-error-in-recent-commit.patch 0001-kernel-make-groups_sort-calling-a-responsibility-gro.patch -0001-mm-oom_reaper-fix-memory-corruption.patch 0001-tracing-Allocate-mask_str-buffer-dynamically.patch 0001-USB-uas-and-storage-Add-US_FL_BROKEN_FUA-for-another.patch 0001-USB-core-prevent-malicious-bNumInterfaces-overflow.patch -0001-ovl-Pass-ovl_get_nlink-parameters-in-right-order.patch -0001-ovl-update-ctx-pos-on-impure-dir-iteration.patch 0001-usbip-fix-stub_rx-get_pipe-to-validate-endpoint-numb.patch 0001-usbip-fix-stub_rx-harden-CMD_SUBMIT-path-to-handle-m.patch 0001-usbip-prevent-vhci_hcd-driver-from-leaking-a-socket-.patch @@ -22,25 +15,16 @@ 0001-ceph-drop-negative-child-dentries-before-try-pruning.patch 0001-usb-xhci-fix-TDS-for-MTK-xHCI1.1.patch 0001-xhci-Don-t-add-a-virt_dev-to-the-devs-array-before-i.patch -0001-IB-core-Bound-check-alternate-path-port-number.patch -0001-IB-core-Don-t-enforce-PKey-security-on-SMI-MADs.patch 0001-nfs-don-t-wait-on-commit-in-nfs_commit_inode-if-ther.patch -0001-arm64-mm-Fix-pte_mkclean-pte_mkdirty-semantics.patch 0001-arm64-Initialise-high_memory-global-variable-earlier.patch 0001-arm64-fix-CONFIG_DEBUG_WX-address-reporting.patch 0001-scsi-core-Fix-a-scsi_show_rq-NULL-pointer-dereferenc.patch -0001-scsi-libsas-fix-length-error-in-sas_smp_handler.patch -0001-sched-rt-Do-not-pull-from-current-CPU-if-only-one-CP.patch 0001-dm-fix-various-targets-to-dm_register_target-after-m.patch -0001-SUNRPC-Fix-a-race-in-the-receive-code-path.patch 0001-iw_cxgb4-only-insert-drain-cqes-if-wq-is-flushed.patch -0001-x86-boot-compressed-64-Detect-and-handle-5-level-pag.patch -0001-x86-boot-compressed-64-Print-error-if-5-level-paging.patch 0001-eeprom-at24-change-nvmem-stride-to-1.patch 0001-posix-timer-Properly-check-sigevent-sigev_notify.patch 0001-dmaengine-dmatest-move-callback-wait-queue-to-thread.patch 0001-Revert-exec-avoid-RLIMIT_STACK-races-with-prlimit.patch -0001-ext4-support-fast-symlinks-from-ext3-file-systems.patch 0001-ext4-fix-fdatasync-2-after-fallocate-2-operation.patch 0001-ext4-add-missing-error-check-in-__ext4_new_inode.patch 0001-ext4-fix-crash-when-a-directory-s-i_size-is-too-smal.patch @@ -57,12 +41,10 @@ 0001-PM-s2idle-Clear-the-events_check_enabled-flag.patch 0001-ASoC-Intel-Skylake-Fix-uuid_module-memory-leak-in-fa.patch 0001-dmaengine-ti-dma-crossbar-Correct-am335x-am43xx-mux-.patch -0001-mlxsw-spectrum-Fix-error-return-code-in-mlxsw_sp_por.patch 0001-PCI-PME-Handle-invalid-data-when-reading-Root-Status.patch 0001-powerpc-powernv-cpufreq-Fix-the-frequency-read-by-pr.patch 0001-PCI-Do-not-allocate-more-buses-than-available-in-par.patch 0001-iommu-mediatek-Fix-driver-name.patch -0001-thunderbolt-tb-fix-use-after-free-in-tb_activate_pci.patch 0001-netfilter-ipvs-Fix-inappropriate-output-of-procfs.patch 0001-powerpc-opal-Fix-EBUSY-bug-in-acquiring-tokens.patch 0001-powerpc-ipic-Fix-status-get-and-status-clear.patch @@ -79,9 +61,7 @@ 0001-arm-ccn-perf-Prevent-module-unload-while-PMU-is-in-u.patch 0001-crypto-tcrypt-fix-buffer-lengths-in-test_aead_speed.patch 0001-mm-Handle-0-flags-in-_calc_vm_trans-macro.patch -0001-net-hns3-fix-for-getting-advertised_caps-in-hns3_get.patch 0001-net-hns3-Fix-a-misuse-to-devm_free_irq.patch -0001-staging-rtl8188eu-Revert-part-of-staging-rtl8188eu-f.patch 0001-clk-mediatek-add-the-option-for-determining-PLL-sour.patch 0001-clk-imx-imx7d-Fix-parent-clock-for-OCRAM_CLK.patch 0001-clk-imx6-refine-hdmi_isfr-s-parent-to-make-HDMI-work.patch @@ -98,7 +78,6 @@ 0001-scsi-scsi_debug-write_same-fix-error-report.patch 0001-GFS2-Take-inode-off-order_write-list-when-setting-jd.patch 0001-media-usbtv-fix-brightness-and-contrast-controls.patch -0001-rpmsg-glink-Initialize-the-intent_req_comp-completio.patch 0001-bcache-explicitly-destroy-mutex-while-exiting.patch 0001-bcache-fix-wrong-cache_misses-statistics.patch 0001-Ib-hfi1-Return-actual-operational-VLs-in-port-info-q.patch @@ -122,18 +101,12 @@ 0001-xfs-return-a-distinct-error-code-value-for-IGET_INCO.patch 0001-xfs-fix-incorrect-extent-state-in-xfs_bmap_add_exten.patch 0001-net-dsa-lan9303-Do-not-disable-switch-fabric-port-0-.patch -0001-net-hns3-fix-a-bug-in-hclge_uninit_client_instance.patch -0001-net-hns3-add-nic_client-check-when-initialize-roce-b.patch -0001-net-hns3-fix-the-bug-of-hns3_set_txbd_baseinfo.patch 0001-RDMA-cxgb4-Declare-stag-as-__be32.patch 0001-PCI-Detach-driver-before-procfs-sysfs-teardown-on-de.patch 0001-scsi-hisi_sas-fix-the-risk-of-freeing-slot-twice.patch 0001-scsi-hpsa-cleanup-sas_phy-structures-in-sysfs-when-u.patch 0001-scsi-hpsa-destroy-sas-transport-properties-before-sc.patch 0001-mfd-mxs-lradc-Fix-error-handling-in-mxs_lradc_probe.patch -0001-net-hns3-fix-the-TX-RX-ring.queue_index-in-hns3_ring.patch -0001-net-hns3-fix-the-bug-when-map-buffer-fail.patch -0001-net-hns3-fix-a-bug-when-alloc-new-buffer.patch 0001-serdev-ttyport-enforce-tty-driver-open-requirement.patch 0001-powerpc-perf-hv-24x7-Fix-incorrect-comparison-in-mem.patch 0001-powerpc-xmon-Check-before-calling-xive-functions.patch @@ -145,14 +118,10 @@ 0001-pinctrl-adi2-Fix-Kconfig-build-problem.patch 0001-raid5-Set-R5_Expanded-on-parity-devices-as-well-as-d.patch 0001-scsi-scsi_devinfo-Add-REPORTLUN2-to-EMC-SYMMETRIX-bl.patch -0001-IB-core-Fix-use-workqueue-without-WQ_MEM_RECLAIM.patch 0001-IB-core-Fix-calculation-of-maximum-RoCE-MTU.patch 0001-vt6655-Fix-a-possible-sleep-in-atomic-bug-in-vt6655_.patch -0001-IB-hfi1-Mask-out-A-bit-from-psn-trace.patch 0001-rtl8188eu-Fix-a-possible-sleep-in-atomic-bug-in-rtw_.patch 0001-rtl8188eu-Fix-a-possible-sleep-in-atomic-bug-in-rtw_.patch -0001-ipmi_si-fix-memory-leak-on-new_smi.patch -0001-nullb-fix-error-return-code-in-null_init.patch 0001-scsi-sd-change-manage_start_stop-to-bool-in-sysfs-in.patch 0001-scsi-sd-change-allow_restart-to-bool-in-sysfs-interf.patch 0001-scsi-bfa-integer-overflow-in-debugfs.patch @@ -167,11 +136,9 @@ 0001-icmp-don-t-fail-on-fragment-reassembly-time-exceeded.patch 0001-lightnvm-pblk-prevent-gc-kicks-when-gc-is-not-operat.patch 0001-lightnvm-pblk-fix-changing-GC-group-list-for-a-line.patch -0001-lightnvm-pblk-use-right-flag-for-GC-allocation.patch 0001-lightnvm-pblk-initialize-debug-stat-counter.patch 0001-lightnvm-pblk-fix-min-size-for-page-mempool.patch 0001-lightnvm-pblk-protect-line-bitmap-while-submitting-m.patch 0001-ath9k-fix-tx99-potential-info-leak.patch -0001-ath10k-fix-core-PCI-suspend-when-WoWLAN-is-supported.patch 0001-ath10k-fix-build-errors-with-CONFIG_PM.patch 0001-usb-musb-da8xx-fix-babble-condition-handling.patch diff --git a/queue/staging-rtl8188eu-Revert-part-of-staging-rtl8188eu-f.patch b/queue/staging-rtl8188eu-Revert-part-of-staging-rtl8188eu-f.patch deleted file mode 100644 index 676c179..0000000 --- a/queue/staging-rtl8188eu-Revert-part-of-staging-rtl8188eu-f.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 4004a9870bbefdb6644c3d2033f5315920a3b669 Mon Sep 17 00:00:00 2001 -From: Hans de Goede <hdegoede@redhat.com> -Date: Thu, 2 Nov 2017 10:30:11 +0100 -Subject: [PATCH] staging: rtl8188eu: Revert part of "staging: rtl8188eu: fix - comments with lines over 80 characters" - -commit 4004a9870bbefdb6644c3d2033f5315920a3b669 upstream. - -Commit 74e1e498e84e ("staging: rtl8188eu: fix comments with lines over 80 -characters") not only changed comments but also changed an if check: - --if (pmlmepriv->cur_network.join_res != true) { -+if (!(pmlmepriv->cur_network.join_res)) { - -This is not equivalent as join_res is an int and can have values such -as -2 and -3. - -Note for the next time, please only make one type of changes in a single -clean-up commit. - -Fixes: 74e1e498e84e ("staging: rtl8188eu: fix comments with lines over 80 ...") -Cc: Juliana Rodrigues <juliana.orod@gmail.com> -Signed-off-by: Hans de Goede <hdegoede@redhat.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> - -diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c -index 32a483769975..fa611455109a 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_ap.c -+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c -@@ -754,7 +754,7 @@ static void start_bss_network(struct adapter *padapter, u8 *pbuf) - } - - /* setting only at first time */ -- if (!(pmlmepriv->cur_network.join_res)) { -+ if (pmlmepriv->cur_network.join_res != true) { - /* WEP Key will be set before this function, do not - * clear CAM. - */ --- -2.15.0 - diff --git a/queue/string.h-workaround-for-increased-stack-usage.patch b/queue/string.h-workaround-for-increased-stack-usage.patch deleted file mode 100644 index de1ce9f..0000000 --- a/queue/string.h-workaround-for-increased-stack-usage.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 146734b091430c80d80bb96b1139a96fb4bc830e Mon Sep 17 00:00:00 2001 -From: Arnd Bergmann <arnd@arndb.de> -Date: Thu, 14 Dec 2017 15:32:34 -0800 -Subject: [PATCH] string.h: workaround for increased stack usage - -commit 146734b091430c80d80bb96b1139a96fb4bc830e upstream. - -The hardened strlen() function causes rather large stack usage in at -least one file in the kernel, in particular when CONFIG_KASAN is -enabled: - - drivers/media/usb/em28xx/em28xx-dvb.c: In function 'em28xx_dvb_init': - drivers/media/usb/em28xx/em28xx-dvb.c:2062:1: error: the frame size of 3256 bytes is larger than 204 bytes [-Werror=frame-larger-than=] - -Analyzing this problem led to the discovery that gcc fails to merge the -stack slots for the i2c_board_info[] structures after we strlcpy() into -them, due to the 'noreturn' attribute on the source string length check. - -I reported this as a gcc bug, but it is unlikely to get fixed for gcc-8, -since it is relatively easy to work around, and it gets triggered -rarely. An earlier workaround I did added an empty inline assembly -statement before the call to fortify_panic(), which works surprisingly -well, but is really ugly and unintuitive. - -This is a new approach to the same problem, this time addressing it by -not calling the 'extern __real_strnlen()' function for string constants -where __builtin_strlen() is a compile-time constant and therefore known -to be safe. - -We do this by checking if the last character in the string is a -compile-time constant '\0'. If it is, we can assume that strlen() of -the string is also constant. - -As a side-effect, this should also improve the object code output for -any other call of strlen() on a string constant. - -[akpm@linux-foundation.org: add comment] -Link: http://lkml.kernel.org/r/20171205215143.3085755-1-arnd@arndb.de -Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 -Link: https://patchwork.kernel.org/patch/9980413/ -Link: https://patchwork.kernel.org/patch/9974047/ -Fixes: 6974f0c4555 ("include/linux/string.h: add the option of fortified string.h functions") -Signed-off-by: Arnd Bergmann <arnd@arndb.de> -Cc: Kees Cook <keescook@chromium.org> -Cc: Mauro Carvalho Chehab <mchehab@kernel.org> -Cc: Dmitry Vyukov <dvyukov@google.com> -Cc: Alexander Potapenko <glider@google.com> -Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> -Cc: Daniel Micay <danielmicay@gmail.com> -Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -Cc: Martin Wilck <mwilck@suse.com> -Cc: Dan Williams <dan.j.williams@intel.com> -Cc: <stable@vger.kernel.org> -Signed-off-by: Andrew Morton <akpm@linux-foundation.org> -Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> - -diff --git a/include/linux/string.h b/include/linux/string.h -index 410ecf17de3c..cfd83eb2f926 100644 ---- a/include/linux/string.h -+++ b/include/linux/string.h -@@ -259,7 +259,10 @@ __FORTIFY_INLINE __kernel_size_t strlen(const char *p) - { - __kernel_size_t ret; - size_t p_size = __builtin_object_size(p, 0); -- if (p_size == (size_t)-1) -+ -+ /* Work around gcc excess stack consumption issue */ -+ if (p_size == (size_t)-1 || -+ (__builtin_constant_p(p[p_size - 1]) && p[p_size - 1] == '\0')) - return __builtin_strlen(p); - ret = strnlen(p, p_size); - if (p_size <= ret) --- -2.15.0 - diff --git a/queue/thunderbolt-tb-fix-use-after-free-in-tb_activate_pci.patch b/queue/thunderbolt-tb-fix-use-after-free-in-tb_activate_pci.patch deleted file mode 100644 index c6b56ba..0000000 --- a/queue/thunderbolt-tb-fix-use-after-free-in-tb_activate_pci.patch +++ /dev/null @@ -1,35 +0,0 @@ -From a2e373438f72391493a4425efc1b82030b6b4fd5 Mon Sep 17 00:00:00 2001 -From: "Gustavo A. R. Silva" <garsilva@embeddedor.com> -Date: Sat, 4 Nov 2017 23:52:54 -0500 -Subject: [PATCH] thunderbolt: tb: fix use after free in - tb_activate_pcie_devices -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit a2e373438f72391493a4425efc1b82030b6b4fd5 upstream. - -Add a ̣̣continue statement in order to avoid using a previously -free'd pointer tunnel in list_add. - -Addresses-Coverity-ID: 1415336 -Fixes: 9d3cce0b6136 ("thunderbolt: Introduce thunderbolt bus and connection manager") -Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> -Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> -Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> - -diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c -index 0b22ad9d68b4..f7d0c60c6a11 100644 ---- a/drivers/thunderbolt/tb.c -+++ b/drivers/thunderbolt/tb.c -@@ -224,6 +224,7 @@ static void tb_activate_pcie_devices(struct tb *tb) - tb_port_info(up_port, - "PCIe tunnel activation failed, aborting\n"); - tb_pci_free(tunnel); -+ continue; - } - - list_add(&tunnel->list, &tcm->tunnel_list); --- -2.15.0 - diff --git a/queue/x86-boot-compressed-64-Detect-and-handle-5-level-pag.patch b/queue/x86-boot-compressed-64-Detect-and-handle-5-level-pag.patch deleted file mode 100644 index 513579e..0000000 --- a/queue/x86-boot-compressed-64-Detect-and-handle-5-level-pag.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 08529078d8d9adf689bf39cc38d53979a0869970 Mon Sep 17 00:00:00 2001 -From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> -Date: Mon, 4 Dec 2017 15:40:55 +0300 -Subject: [PATCH] x86/boot/compressed/64: Detect and handle 5-level paging at - boot-time - -commit 08529078d8d9adf689bf39cc38d53979a0869970 upstream. - -Prerequisite for fixing the current problem of instantaneous reboots when a -5-level paging kernel is booted on 4-level paging hardware. - -At the same time this change prepares the decompression code to boot-time -switching between 4- and 5-level paging. - -[ tglx: Folded the GCC < 5 fix. ] - -Fixes: 77ef56e4f0fb ("x86: Enable 5-level paging support via CONFIG_X86_5LEVEL=y") -Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Cc: Andi Kleen <ak@linux.intel.com> -Cc: stable@vger.kernel.org -Cc: Andy Lutomirski <luto@amacapital.net> -Cc: linux-mm@kvack.org -Cc: Cyrill Gorcunov <gorcunov@openvz.org> -Cc: Borislav Petkov <bp@suse.de> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Link: https://lkml.kernel.org/r/20171204124059.63515-2-kirill.shutemov@linux.intel.com - -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index 1e9c322e973a..f25e1530e064 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -80,6 +80,7 @@ vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/kaslr.o - ifdef CONFIG_X86_64 - vmlinux-objs-$(CONFIG_RANDOMIZE_BASE) += $(obj)/pagetable.o - vmlinux-objs-y += $(obj)/mem_encrypt.o -+ vmlinux-objs-y += $(obj)/pgtable_64.o - endif - - $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone -diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S -index 20919b4f3133..fc313e29fe2c 100644 ---- a/arch/x86/boot/compressed/head_64.S -+++ b/arch/x86/boot/compressed/head_64.S -@@ -305,10 +305,18 @@ ENTRY(startup_64) - leaq boot_stack_end(%rbx), %rsp - - #ifdef CONFIG_X86_5LEVEL -- /* Check if 5-level paging has already enabled */ -- movq %cr4, %rax -- testl $X86_CR4_LA57, %eax -- jnz lvl5 -+ /* -+ * Check if we need to enable 5-level paging. -+ * RSI holds real mode data and need to be preserved across -+ * a function call. -+ */ -+ pushq %rsi -+ call l5_paging_required -+ popq %rsi -+ -+ /* If l5_paging_required() returned zero, we're done here. */ -+ cmpq $0, %rax -+ je lvl5 - - /* - * At this point we are in long mode with 4-level paging enabled, -diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c -new file mode 100644 -index 000000000000..b4469a37e9a1 ---- /dev/null -+++ b/arch/x86/boot/compressed/pgtable_64.c -@@ -0,0 +1,28 @@ -+#include <asm/processor.h> -+ -+/* -+ * __force_order is used by special_insns.h asm code to force instruction -+ * serialization. -+ * -+ * It is not referenced from the code, but GCC < 5 with -fPIE would fail -+ * due to an undefined symbol. Define it to make these ancient GCCs work. -+ */ -+unsigned long __force_order; -+ -+int l5_paging_required(void) -+{ -+ /* Check if leaf 7 is supported. */ -+ -+ if (native_cpuid_eax(0) < 7) -+ return 0; -+ -+ /* Check if la57 is supported. */ -+ if (!(native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31)))) -+ return 0; -+ -+ /* Check if 5-level paging has already been enabled. */ -+ if (native_read_cr4() & X86_CR4_LA57) -+ return 0; -+ -+ return 1; -+} --- -2.15.0 - diff --git a/queue/x86-boot-compressed-64-Print-error-if-5-level-paging.patch b/queue/x86-boot-compressed-64-Print-error-if-5-level-paging.patch deleted file mode 100644 index 1f8f5c2..0000000 --- a/queue/x86-boot-compressed-64-Print-error-if-5-level-paging.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 6d7e0ba2d2be9e50cccba213baf07e0e183c1b24 Mon Sep 17 00:00:00 2001 -From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> -Date: Mon, 4 Dec 2017 15:40:56 +0300 -Subject: [PATCH] x86/boot/compressed/64: Print error if 5-level paging is not - supported - -commit 6d7e0ba2d2be9e50cccba213baf07e0e183c1b24 upstream. - -If the machine does not support the paging mode for which the kernel was -compiled, the boot process cannot continue. - -It's not possible to let the kernel detect the mismatch as it does not even -reach the point where cpu features can be evaluted due to a triple fault in -the KASLR setup. - -Instead of instantaneous silent reboot, emit an error message which gives -the user the information why the boot fails. - -Fixes: 77ef56e4f0fb ("x86: Enable 5-level paging support via CONFIG_X86_5LEVEL=y") -Reported-by: Borislav Petkov <bp@suse.de> -Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> -Signed-off-by: Thomas Gleixner <tglx@linutronix.de> -Tested-by: Borislav Petkov <bp@suse.de> -Cc: Andi Kleen <ak@linux.intel.com> -Cc: stable@vger.kernel.org -Cc: Andy Lutomirski <luto@amacapital.net> -Cc: linux-mm@kvack.org -Cc: Cyrill Gorcunov <gorcunov@openvz.org> -Cc: Linus Torvalds <torvalds@linux-foundation.org> -Link: https://lkml.kernel.org/r/20171204124059.63515-3-kirill.shutemov@linux.intel.com - -diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c -index b50c42455e25..98761a1576ce 100644 ---- a/arch/x86/boot/compressed/misc.c -+++ b/arch/x86/boot/compressed/misc.c -@@ -169,6 +169,16 @@ void __puthex(unsigned long value) - } - } - -+static bool l5_supported(void) -+{ -+ /* Check if leaf 7 is supported. */ -+ if (native_cpuid_eax(0) < 7) -+ return 0; -+ -+ /* Check if la57 is supported. */ -+ return native_cpuid_ecx(7) & (1 << (X86_FEATURE_LA57 & 31)); -+} -+ - #if CONFIG_X86_NEED_RELOCS - static void handle_relocations(void *output, unsigned long output_len, - unsigned long virt_addr) -@@ -362,6 +372,12 @@ asmlinkage __visible void *extract_kernel(void *rmode, memptr heap, - console_init(); - debug_putstr("early console in extract_kernel\n"); - -+ if (IS_ENABLED(CONFIG_X86_5LEVEL) && !l5_supported()) { -+ error("This linux kernel as configured requires 5-level paging\n" -+ "This CPU does not support the required 'cr4.la57' feature\n" -+ "Unable to boot - please use a kernel appropriate for your CPU\n"); -+ } -+ - free_mem_ptr = heap; /* Heap */ - free_mem_end_ptr = heap + BOOT_HEAP_SIZE; - --- -2.15.0 - |