3f353c3ed4242c672c118b1701e572e8f35db220
4505 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Greg Kroah-Hartman
|
3f353c3ed4 |
Merge 4.9.38 into android-4.9
Changes in 4.9.38 mqueue: fix a use-after-free in sys_mq_notify() Add "shutdown" to "struct class". tpm: Issue a TPM2_Shutdown for TPM2 devices. tools include: Add a __fallthrough statement tools string: Use __fallthrough in perf_atoll() tools strfilter: Use __fallthrough perf top: Use __fallthrough perf thread_map: Correctly size buffer used with dirent->dt_name perf intel-pt: Use __fallthrough perf tests: Avoid possible truncation with dirent->d_name + snprintf perf bench numa: Avoid possible truncation when using snprintf() perf header: Fix handling of PERF_EVENT_UPDATE__SCALE perf scripting perl: Fix compile error with some perl5 versions perf probe: Fix to probe on gcc generated symbols for offline kernel perf probe: Add error checks to offline probe post-processing md: fix incorrect use of lexx_to_cpu in does_sb_need_changing md: fix super_offset endianness in super_1_rdev_size_change locking/rwsem-spinlock: Fix EINTR branch in __down_write_common() staging: vt6556: vnt_start Fix missing call to vnt_key_init_table. staging: comedi: fix clean-up of comedi_class in comedi_init() crypto: caam - fix gfp allocation flags (part I) crypto: rsa-pkcs1pad - use constant time memory comparison for MACs ext4: check return value of kstrtoull correctly in reserved_clusters_store x86/mm/pat: Don't report PAT on CPUs that don't support it saa7134: fix warm Medion 7134 EEPROM read Linux 4.9.38 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 Jason Yan
|
3953403ca6 |
md: fix super_offset endianness in super_1_rdev_size_change
commit 3fb632e40d7667d8bedfabc28850ac06d5493f54 upstream. The sb->super_offset should be big-endian, but the rdev->sb_start is in host byte order, so fix this by adding cpu_to_le64. Signed-off-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Shaohua Li <shli@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Jason Yan
|
9a37d02c49 |
md: fix incorrect use of lexx_to_cpu in does_sb_need_changing
commit 1345921393ba23b60d3fcf15933e699232ad25ae upstream. The sb->layout is of type __le32, so we shoud use le32_to_cpu. Signed-off-by: Jason Yan <yanaijie@huawei.com> Signed-off-by: Shaohua Li <shli@fb.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
184ce810ce |
Merge 4.9.36 into android-4.9
Changes in 4.9.36 ipv6: release dst on error in ip6_dst_lookup_tail net: don't call strlen on non-terminated string in dev_set_alias() decnet: dn_rtmsg: Improve input length sanitization in dnrmg_receive_user_skb net: Zero ifla_vf_info in rtnl_fill_vfinfo() net: vrf: Make add_fib_rules per network namespace flag af_unix: Add sockaddr length checks before accessing sa_family in bind and connect handlers Fix an intermittent pr_emerg warning about lo becoming free. sctp: disable BH in sctp_for_each_endpoint net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx net: tipc: Fix a sleep-in-atomic bug in tipc_msg_reverse net/mlx5e: Added BW check for DIM decision mechanism net/mlx5e: Fix wrong indications in DIM due to counter wraparound proc: snmp6: Use correct type in memset igmp: acquire pmc lock for ip_mc_clear_src() igmp: add a missing spin_lock_init() ipv6: fix calling in6_ifa_hold incorrectly for dad work sctp: return next obj by passing pos + 1 into sctp_transport_get_idx net/mlx5e: Avoid doing a cleanup call if the profile doesn't have it net/mlx5: Wait for FW readiness before initializing command interface net/mlx5e: Fix timestamping capabilities reporting decnet: always not take dst->__refcnt when inserting dst into hash table net: 8021q: Fix one possible panic caused by BUG_ON in free_netdev sfc: provide dummy definitions of vswitch functions ipv6: Do not leak throw route references rtnetlink: add IFLA_GROUP to ifla_policy netfilter: xt_TCPMSS: add more sanity tests on tcph->doff netfilter: synproxy: fix conntrackd interaction NFSv4: fix a reference leak caused WARNING messages NFSv4.x/callback: Create the callback service through svc_create_pooled xen/blkback: don't use xen_blkif_get() in xen-blkback kthread drm/ast: Handle configuration without P2A bridge mm, swap_cgroup: reschedule when neeed in swap_cgroup_swapoff() MIPS: head: Reorder instructions missing a delay slot MIPS: Avoid accidental raw backtrace MIPS: pm-cps: Drop manual cache-line alignment of ready_count MIPS: Fix IRQ tracing & lockdep when rescheduling ALSA: hda - Fix endless loop of codec configure ALSA: hda - set input_path bitmap to zero after moving it to new place NFSv4.1: Fix a race in nfs4_proc_layoutget gpiolib: fix filtering out unwanted events drm/vmwgfx: Free hash table allocated by cmdbuf managed res mgr dm thin: do not queue freed thin mapping for next stage processing x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() usb: gadget: f_fs: Fix possibe deadlock l2tp: fix race in l2tp_recv_common() l2tp: ensure session can't get removed during pppol2tp_session_ioctl() l2tp: fix duplicate session creation l2tp: hold session while sending creation notifications l2tp: take a reference on sessions used in genetlink handlers mm: numa: avoid waiting on freed migrated pages sparc64: Handle PIO & MEM non-resumable errors. sparc64: Zero pages on allocation for mondo and error queues. net: ethtool: add support for 2500BaseT and 5000BaseT link modes net: phy: add an option to disable EEE advertisement dt-bindings: net: add EEE capability constants net: phy: fix sign type error in genphy_config_eee_advert net: phy: use boolean dt properties for eee broken modes dt: bindings: net: use boolean dt properties for eee broken modes ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage xen/blkback: don't free be structure too early KVM: x86: fix fixing of hypercalls scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type stmmac: add missing of_node_put scsi: lpfc: Set elsiocb contexts to NULL after freeing it qla2xxx: Terminate exchange if corrupted qla2xxx: Fix erroneous invalid handle message drm/amdgpu: fix program vce instance logic error. drm/amdgpu: add support for new hainan variants net: phy: dp83848: add DP83620 PHY support perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug net: korina: Fix NAPI versus resources freeing powerpc/eeh: Enable IO path on permanent error net: ethtool: Initialize buffer when querying device channel settings xen-netback: fix memory leaks on XenBus disconnect xen-netback: protect resource cleaning on XenBus disconnect bnxt_en: Fix "uninitialized variable" bug in TPA code path. bpf: don't trigger OOM killer under pressure with map alloc objtool: Fix IRET's opcode gianfar: Do not reuse pages from emergency reserve Btrfs: Fix deadlock between direct IO and fast fsync Btrfs: fix truncate down when no_holes feature is enabled virtio_console: fix a crash in config_work_handler swiotlb-xen: update dev_addr after swapping pages xen-netfront: Fix Rx stall during network stress and OOM scsi: virtio_scsi: Reject commands when virtqueue is broken iwlwifi: fix kernel crash when unregistering thermal zone platform/x86: ideapad-laptop: handle ACPI event 1 amd-xgbe: Check xgbe_init() return code net: dsa: Check return value of phy_connect_direct() drm/amdgpu: check ring being ready before using vfio/spapr: fail tce_iommu_attach_group() when iommu_data is null mlxsw: spectrum_router: Correctly reallocate adjacency entries virtio_net: fix PAGE_SIZE > 64k ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit() vxlan: do not age static remote mac entries ibmveth: Add a proper check for the availability of the checksum features kernel/panic.c: add missing \n Documentation: devicetree: change the mediatek ethernet compatible string drm/etnaviv: trick drm_mm into giving out a low IOVA perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code pinctrl: intel: Set pin direction properly net: phy: marvell: fix Marvell 88E1512 used in SGMII mode mac80211: recalculate min channel width on VHT opmode changes perf/x86/intel: Use ULL constant to prevent undefined shift behaviour HID: i2c-hid: Add sleep between POWER ON and RESET scsi: lpfc: avoid double free of resource identifiers spi: davinci: use dma_mapping_error() arm64: assembler: make adr_l work in modules under KASLR net: thunderx: acpi: fix LMAC initialization drm/radeon/si: load special ucode for certain MC configs drm/amd/powerplay: fix vce cg logic error on CZ/St. drm/amd/powerplay: refine vce dpm update code on Cz. pmem: return EIO on read_pmem() failure mac80211: initialize SMPS field in HT capabilities x86/tsc: Add the Intel Denverton Processor to native_calibrate_tsc() x86/mpx: Use compatible types in comparison to fix sparse error perf/core: Fix sys_perf_event_open() vs. hotplug perf/x86: Reject non sampling events with precise_ip aio: fix lock dep warning coredump: Ensure proper size of sparse core files swiotlb: ensure that page-sized mappings are page-aligned s390/ctl_reg: make __ctl_load a full memory barrier usb: dwc2: gadget: Fix GUSBCFG.USBTRDTIM value be2net: fix status check in be_cmd_pmac_add() be2net: don't delete MAC on close on unprivileged BE3 VFs be2net: fix MAC addr setting on privileged BE3 VFs perf probe: Fix to show correct locations for events on modules net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types tipc: allocate user memory with GFP_KERNEL flag perf probe: Fix to probe on gcc generated functions in modules net/mlx4_core: Eliminate warning messages for SRQ_LIMIT under SRIOV sctp: check af before verify address in sctp_addr_id2transport ip6_tunnel, ip6_gre: fix setting of DSCP on encapsulated packets ravb: Fix use-after-free on `ifconfig eth0 down` mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings xfrm: fix stack access out of bounds with CONFIG_XFRM_SUB_POLICY xfrm: NULL dereference on allocation failure xfrm: Oops on error in pfkey_msg2xfrm_state() netfilter: use skb_to_full_sk in ip_route_me_harder watchdog: bcm281xx: Fix use of uninitialized spinlock. sched/loadavg: Avoid loadavg spikes caused by delayed NO_HZ accounting spi: When no dma_chan map buffers with spi_master's parent spi: fix device-node leaks regulator: tps65086: Fix expected switch DT node names regulator: tps65086: Fix DT node referencing in of_parse_cb ARM: OMAP2+: omap_device: Sync omap_device and pm_runtime after probe defer ARM: dts: OMAP3: Fix MFG ID EEPROM ARM64/ACPI: Fix BAD_MADT_GICC_ENTRY() macro implementation ARM: 8685/1: ensure memblock-limit is pmd-aligned tools arch: Sync arch/x86/lib/memcpy_64.S with the kernel x86/boot/KASLR: Fix kexec crash due to 'virt_addr' calculation bug x86/mpx: Correctly report do_mpx_bt_fault() failures to user-space x86/mm: Fix flush_tlb_page() on Xen ocfs2: o2hb: revert hb threshold to keep compatible iommu/vt-d: Don't over-free page table directories iommu: Handle default domain attach failure iommu/dma: Don't reserve PCI I/O windows iommu/amd: Fix incorrect error handling in amd_iommu_bind_pasid() iommu/amd: Fix interrupt remapping when disable guest_mode cpufreq: s3c2416: double free on driver init error path clk: scpi: don't add cpufreq device if the scpi dvfs node is disabled objtool: Fix another GCC jump table detection issue infiniband: hns: avoid gcc-7.0.1 warning for uninitialized data brcmfmac: avoid writing channel out of allocated array i2c: brcmstb: Fix START and STOP conditions mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program arm64: fix NULL dereference in have_cpu_die() KVM: x86: fix emulation of RSM and IRET instructions KVM: x86/vPMU: fix undefined shift in intel_pmu_refresh() KVM: x86: zero base3 of unusable segments KVM: nVMX: Fix exception injection Linux 4.9.36 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 Vallish Vaidyeshwara
|
1c0fa383b3 |
dm thin: do not queue freed thin mapping for next stage processing
commit 00a0ea33b495ee6149bf5a77ac5807ce87323abb upstream.
process_prepared_discard_passdown_pt1() should cleanup
dm_thin_new_mapping in cases of error.
dm_pool_inc_data_range() can fail trying to get a block reference:
metadata operation 'dm_pool_inc_data_range' failed: error = -61
When dm_pool_inc_data_range() fails, dm thin aborts current metadata
transaction and marks pool as PM_READ_ONLY. Memory for thin mapping
is released as well. However, current thin mapping will be queued
onto next stage as part of queue_passdown_pt2() or passdown_endio().
This dangling thin mapping memory when processed and accessed in
next stage will lead to device mapper crashing.
Code flow without fix:
-> process_prepared_discard_passdown_pt1(m)
-> dm_thin_remove_range()
-> discard passdown
--> passdown_endio(m) queues m onto next stage
-> dm_pool_inc_data_range() fails, frees memory m
but does not remove it from next stage queue
-> process_prepared_discard_passdown_pt2(m)
-> processes freed memory m and crashes
One such stack:
Call Trace:
[<ffffffffa037a46f>] dm_cell_release_no_holder+0x2f/0x70 [dm_bio_prison]
[<ffffffffa039b6dc>] cell_defer_no_holder+0x3c/0x80 [dm_thin_pool]
[<ffffffffa039b88b>] process_prepared_discard_passdown_pt2+0x4b/0x90 [dm_thin_pool]
[<ffffffffa0399611>] process_prepared+0x81/0xa0 [dm_thin_pool]
[<ffffffffa039e735>] do_worker+0xc5/0x820 [dm_thin_pool]
[<ffffffff8152bf54>] ? __schedule+0x244/0x680
[<ffffffff81087e72>] ? pwq_activate_delayed_work+0x42/0xb0
[<ffffffff81089f53>] process_one_work+0x153/0x3f0
[<ffffffff8108a71b>] worker_thread+0x12b/0x4b0
[<ffffffff8108a5f0>] ? rescuer_thread+0x350/0x350
[<ffffffff8108fd6a>] kthread+0xca/0xe0
[<ffffffff8108fca0>] ? kthread_park+0x60/0x60
[<ffffffff81530b45>] ret_from_fork+0x25/0x30
The fix is to first take the block ref count for discarded block and
then do a passdown discard of this block. If block ref count fails,
then bail out aborting current metadata transaction, mark pool as
PM_READ_ONLY and also free current thin mapping memory (existing error
handling code) without queueing this thin mapping onto next stage of
processing. If block ref count succeeds, then passdown discard of this
block. Discard callback of passdown_endio() will queue this thin mapping
onto next stage of processing.
Code flow with fix:
-> process_prepared_discard_passdown_pt1(m)
-> dm_thin_remove_range()
-> dm_pool_inc_data_range()
--> if fails, free memory m and bail out
-> discard passdown
--> passdown_endio(m) queues m onto next stage
Reviewed-by: Eduardo Valentin <eduval@amazon.com>
Reviewed-by: Cristian Gafton <gafton@amazon.com>
Reviewed-by: Anchal Agarwal <anchalag@amazon.com>
Signed-off-by: Vallish Vaidyeshwara <vallish@amazon.com>
Reviewed-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
 David Zeuthen
|
8f3ac4c1ba |
ANDROID: Update init/do_mounts_dm.c to the latest ChromiumOS version.
This is needed for AVB. Bug: None Test: Compiles. Change-Id: I45b5d435652ab66ec07420ab17f2c7889f7e4d95 Signed-off-by: David Zeuthen <zeuthen@google.com> |
||
|
Greg Kroah-Hartman
|
951d823c04 |
Merge 4.9.30 into android-4.9
Changes in 4.9.30 usb: misc: legousbtower: Fix buffers on stack usb: misc: legousbtower: Fix memory leak USB: ene_usb6250: fix DMA to the stack watchdog: pcwd_usb: fix NULL-deref at probe char: lp: fix possible integer overflow in lp_setup() USB: core: replace %p with %pK tpm_tis_core: Choose appropriate timeout for reading burstcount ALSA: hda: Fix cpu lockup when stopping the cmd dmas ARM: tegra: paz00: Mark panel regulator as enabled on boot fanotify: don't expose EOPENSTALE to userspace tpm_tis_spi: Use single function to transfer data tpm_tis_spi: Abort transfer when too many wait states are signaled tpm_tis_spi: Check correct byte for wait state indicator tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes tpm_tis_spi: Add small delay after last transfer tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver tpm: add sleep only for retry in i2c_nuvoton_write_status() tpm_crb: check for bad response size ASoC: cs4271: configure reset GPIO as output mlx5: Fix mlx5_ib_map_mr_sg mr length infiniband: call ipv6 route lookup via the stub interface dm btree: fix for dm_btree_find_lowest_key() dm raid: select the Kconfig option CONFIG_MD_RAID0 dm bufio: avoid a possible ABBA deadlock dm bufio: check new buffer allocation watermark every 30 seconds dm mpath: split and rename activate_path() to prepare for its expanded use dm cache metadata: fail operations if fail_io mode has been established dm bufio: make the parameter "retain_bytes" unsigned long dm thin metadata: call precommit before saving the roots dm space map disk: fix some book keeping in the disk space map md: update slab_cache before releasing new stripes when stripes resizing md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop rtlwifi: rtl8821ae: setup 8812ae RFE according to device type mwifiex: MAC randomization should not be persistent mwifiex: pcie: fix cmd_buf use-after-free in remove/reset ima: accept previously set IMA_NEW_FILE KVM: x86: Fix load damaged SSEx MXCSR register KVM: x86: Fix potential preemption when get the current kvmclock timestamp KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation x86: fix 32-bit case of __get_user_asm_u64() regulator: rk808: Fix RK818 LDO2 regulator: tps65023: Fix inverted core enable logic. s390/kdump: Add final note s390/cputime: fix incorrect system time ath9k_htc: Add support of AirTies 1eda:2315 AR9271 device ath9k_htc: fix NULL-deref at probe drm/amdgpu: Make display watermark calculations more accurate drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. drm/amdgpu: Add missing lb_vblank_lead_lines setup to DCE-6 path. drm/nouveau/therm: remove ineffective workarounds for alarm bugs drm/nouveau/tmr: ack interrupt before processing alarms drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm drm/nouveau/tmr: avoid processing completed alarms when adding a new one drm/nouveau/tmr: handle races with hw when updating the next alarm time gpio: omap: return error if requested debounce time is not possible cdc-acm: fix possible invalid access when processing notification ohci-pci: add qemu quirk cxl: Force context lock during EEH flow cxl: Route eeh events to all drivers in cxl_pci_error_detected() proc: Fix unbalanced hard link numbers of: fix sparse warning in of_pci_range_parser_one of: fix "/cpus" reference leak in of_numa_parse_cpu_nodes() of: fdt: add missing allocation-failure check ibmvscsis: Do not send aborted task response iio: dac: ad7303: fix channel description IIO: bmp280-core.c: fix error in humidity calculation IB/hfi1: Return an error on memory allocation failure IB/hfi1: Fix a subcontext memory leak pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes pid_ns: Fix race between setns'ed fork() and zap_pid_ns_processes() USB: serial: ftdi_sio: fix setting latency for unprivileged users USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs USB: chaoskey: fix Alea quirk on big-endian hosts f2fs: check entire encrypted bigname when finding a dentry fscrypt: avoid collisions when presenting long encrypted filenames libnvdimm: fix clear length of nvdimm_forget_poison() xhci: remove GFP_DMA flag from allocation usb: host: xhci-plat: propagate return value of platform_get_irq() xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton usb: host: xhci-mem: allocate zeroed Scratchpad Buffer net: irda: irda-usb: fix firmware name on big-endian hosts usbvision: fix NULL-deref at probe mceusb: fix NULL-deref at probe ttusb2: limit messages to buffer size dvb-usb-dibusb-mc-common: Add MODULE_LICENSE usb: dwc3: gadget: Prevent losing events in event cache usb: musb: tusb6010_omap: Do not reset the other direction's packet size usb: musb: Fix trying to suspend while active for OTG configurations USB: iowarrior: fix info ioctl on big-endian hosts usb: serial: option: add Telit ME910 support USB: serial: qcserial: add more Lenovo EM74xx device IDs USB: serial: mct_u232: fix big-endian baud-rate handling USB: serial: io_ti: fix div-by-zero in set_termios USB: hub: fix SS hub-descriptor handling USB: hub: fix non-SS hub-descriptor handling ipx: call ipxitf_put() in ioctl error path iio: proximity: as3935: fix as3935_write iio: hid-sensor: Store restore poll and hysteresis on S3 s5p-mfc: Fix race between interrupt routine and device functions gspca: konica: add missing endpoint sanity check s5p-mfc: Fix unbalanced call to clock management dib0700: fix NULL-deref at probe zr364xx: enforce minimum size when reading header dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops digitv: limit messages to buffer size dw2102: limit messages to buffer size cx231xx-audio: fix init error path cx231xx-audio: fix NULL-deref at probe cx231xx-cards: fix NULL-deref at probe powerpc/mm: Ensure IRQs are off in switch_mm() powerpc/eeh: Avoid use after free in eeh_handle_special_event() powerpc/book3s/mce: Move add_taint() later in virtual mode powerpc/pseries: Fix of_node_put() underflow during DLPAR remove powerpc/iommu: Do not call PageTransHuge() on tail pages powerpc/64e: Fix hang when debugging programs with relocated kernel powerpc/tm: Fix FP and VMX register corruption arm64: KVM: Do not use stack-protector to compile EL2 code arm: KVM: Do not use stack-protector to compile HYP code KVM: arm: plug potential guest hardware debug leakage ARM: 8662/1: module: split core and init PLT sections ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call ARM: dts: at91: sama5d3_xplained: fix ADC vref ARM: dts: at91: sama5d3_xplained: not all ADC channels are available ARM: dts: imx6sx-sdb: Remove OPP override arm64: dts: hi6220: Reset the mmc hosts arm64: xchg: hazard against entire exchange variable arm64: ensure extension of smp_store_release value arm64: armv8_deprecated: ensure extension of addr arm64: uaccess: ensure extension of access_ok() addr arm64: documentation: document tagged pointer stack constraints staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. staging: rtl8192e: fix 2 byte alignment of register BSSIDR. staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. staging: rtl8192e: GetTs Fix invalid TID 7 warning. iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings metag/uaccess: Fix access_ok() metag/uaccess: Check access_ok in strncpy_from_user stackprotector: Increase the per-task stack canary's random range from 32 bits to 64 bits on 64-bit platforms uwb: fix device quirk on big-endian hosts genirq: Fix chained interrupt data ordering nvme: unmap CMB and remove sysfs file in reset path MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6 osf_wait4(): fix infoleak um: Fix to call read_initrd after init_bootmem tracing/kprobes: Enforce kprobes teardown after testing PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms PCI: Fix another sanity check bug in /proc/pci mmap PCI: Only allow WC mmap on prefetchable resources PCI: Freeze PME scan before suspending devices mtd: nand: orion: fix clk handling mtd: nand: omap2: Fix partition creation via cmdline mtdparts mtd: nand: add ooblayout for old hamming layout drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 NFSv4: Fix a hang in OPEN related to server reboot NFS: Fix use after free in write error path NFS: Use GFP_NOIO for two allocations in writeback nfsd: fix undefined behavior in nfsd4_layout_verify nfsd: encoders mustn't use unitialized values in error cases drivers: char: mem: Check for address space wraparound with mmap() drm/i915/gvt: Disable access to stolen memory as a guest Linux 4.9.30 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 NeilBrown
|
7e78978787 |
md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop
commit 065e519e71b2c1f41936cce75b46b5ab34adb588 upstream.
if called md_set_readonly and set MD_CLOSING bit, the mddev cannot
be opened any more due to the MD_CLOING bit wasn't cleared. Thus it
needs to be cleared in md_ioctl after any call to md_set_readonly()
or do_md_stop().
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes:
|
||
 Dennis Yang
|
fa9a4a9c6d |
md: update slab_cache before releasing new stripes when stripes resizing
commit 583da48e388f472e8818d9bb60ef6a1d40ee9f9d upstream.
When growing raid5 device on machine with small memory, there is chance that
mdadm will be killed and the following bug report can be observed. The same
bug could also be reproduced in linux-4.10.6.
[57600.075774] BUG: unable to handle kernel NULL pointer dereference at (null)
[57600.083796] IP: [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20
[57600.110378] PGD 421cf067 PUD 4442d067 PMD 0
[57600.114678] Oops: 0002 [#1] SMP
[57600.180799] CPU: 1 PID: 25990 Comm: mdadm Tainted: P O 4.2.8 #1
[57600.187849] Hardware name: To be filled by O.E.M. To be filled by O.E.M./MAHOBAY, BIOS QV05AR66 03/06/2013
[57600.197490] task: ffff880044e47240 ti: ffff880043070000 task.ti: ffff880043070000
[57600.204963] RIP: 0010:[<ffffffff81a6aa87>] [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20
[57600.213057] RSP: 0018:ffff880043073810 EFLAGS: 00010046
[57600.218359] RAX: 0000000000000000 RBX: 000000000000000c RCX: ffff88011e296dd0
[57600.225486] RDX: 0000000000000001 RSI: ffffe8ffffcb46c0 RDI: 0000000000000000
[57600.232613] RBP: ffff880043073878 R08: ffff88011e5f8170 R09: 0000000000000282
[57600.239739] R10: 0000000000000005 R11: 28f5c28f5c28f5c3 R12: ffff880043073838
[57600.246872] R13: ffffe8ffffcb46c0 R14: 0000000000000000 R15: ffff8800b9706a00
[57600.253999] FS: 00007f576106c700(0000) GS:ffff88011e280000(0000) knlGS:0000000000000000
[57600.262078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[57600.267817] CR2: 0000000000000000 CR3: 00000000428fe000 CR4: 00000000001406e0
[57600.274942] Stack:
[57600.276949] ffffffff8114ee35 ffff880043073868 0000000000000282 000000000000eb3f
[57600.284383] ffffffff81119043 ffff880043073838 ffff880043073838 ffff88003e197b98
[57600.291820] ffffe8ffffcb46c0 ffff88003e197360 0000000000000286 ffff880043073968
[57600.299254] Call Trace:
[57600.301698] [<ffffffff8114ee35>] ? cache_flusharray+0x35/0xe0
[57600.307523] [<ffffffff81119043>] ? __page_cache_release+0x23/0x110
[57600.313779] [<ffffffff8114eb53>] kmem_cache_free+0x63/0xc0
[57600.319344] [<ffffffff81579942>] drop_one_stripe+0x62/0x90
[57600.324915] [<ffffffff81579b5b>] raid5_cache_scan+0x8b/0xb0
[57600.330563] [<ffffffff8111b98a>] shrink_slab.part.36+0x19a/0x250
[57600.336650] [<ffffffff8111e38c>] shrink_zone+0x23c/0x250
[57600.342039] [<ffffffff8111e4f3>] do_try_to_free_pages+0x153/0x420
[57600.348210] [<ffffffff8111e851>] try_to_free_pages+0x91/0xa0
[57600.353959] [<ffffffff811145b1>] __alloc_pages_nodemask+0x4d1/0x8b0
[57600.360303] [<ffffffff8157a30b>] check_reshape+0x62b/0x770
[57600.365866] [<ffffffff8157a4a5>] raid5_check_reshape+0x55/0xa0
[57600.371778] [<ffffffff81583df7>] update_raid_disks+0xc7/0x110
[57600.377604] [<ffffffff81592b73>] md_ioctl+0xd83/0x1b10
[57600.382827] [<ffffffff81385380>] blkdev_ioctl+0x170/0x690
[57600.388307] [<ffffffff81195238>] block_ioctl+0x38/0x40
[57600.393525] [<ffffffff811731c5>] do_vfs_ioctl+0x2b5/0x480
[57600.399010] [<ffffffff8115e07b>] ? vfs_write+0x14b/0x1f0
[57600.404400] [<ffffffff811733cc>] SyS_ioctl+0x3c/0x70
[57600.409447] [<ffffffff81a6ad97>] entry_SYSCALL_64_fastpath+0x12/0x6a
[57600.415875] Code: 00 00 00 00 55 48 89 e5 8b 07 85 c0 74 04 31 c0 5d c3 ba 01 00 00 00 f0 0f b1 17 85 c0 75 ef b0 01 5d c3 90 31 c0 ba 01 00 00 00 <f0> 0f b1 17 85 c0 75 01 c3 55 89 c6 48 89 e5 e8 85 d1 63 ff 5d
[57600.435460] RIP [<ffffffff81a6aa87>] _raw_spin_lock+0x7/0x20
[57600.441208] RSP <ffff880043073810>
[57600.444690] CR2: 0000000000000000
[57600.448000] ---[ end trace cbc6b5cc4bf9831d ]---
The problem is that resize_stripes() releases new stripe_heads before assigning new
slab cache to conf->slab_cache. If the shrinker function raid5_cache_scan() gets called
after resize_stripes() starting releasing new stripes but right before new slab cache
being assigned, it is possible that these new stripe_heads will be freed with the old
slab_cache which was already been destoryed and that triggers this bug.
Signed-off-by: Dennis Yang <dennisyang@qnap.com>
Fixes:
|
||
 Joe Thornber
|
f2bb8bcbc0 |
dm space map disk: fix some book keeping in the disk space map
commit 0377a07c7a035e0d033cd8b29f0cb15244c0916a upstream. When decrementing the reference count for a block, the free count wasn't being updated if the reference count went to zero. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Joe Thornber
|
cc681811a9 |
dm thin metadata: call precommit before saving the roots
commit 91bcdb92d39711d1adb40c26b653b7978d93eb98 upstream. These calls were the wrong way round in __write_initial_superblock. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Mikulas Patocka
|
eeaf13394d |
dm bufio: make the parameter "retain_bytes" unsigned long
commit 13840d38016203f0095cd547b90352812d24b787 upstream. Change the type of the parameter "retain_bytes" from unsigned to unsigned long, so that on 64-bit machines the user can set more than 4GiB of data to be retained. Also, change the type of the variable "count" in the function "__evict_old_buffers" to unsigned long. The assignment "count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY];" could result in unsigned long to unsigned overflow and that could result in buffers not being freed when they should. While at it, avoid division in get_retain_buffers(). Division is slow, we can change it to shift because we have precalculated the log2 of block size. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Mike Snitzer
|
e69242436b |
dm cache metadata: fail operations if fail_io mode has been established
commit 10add84e276432d9dd8044679a1028dd4084117e upstream. Otherwise it is possible to trigger crashes due to the metadata being inaccessible yet these methods don't safely account for that possibility without these checks. Reported-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Bart Van Assche
|
042d8dbf69 |
dm mpath: split and rename activate_path() to prepare for its expanded use
commit 89bfce763e43fa4897e0d3af6b29ed909df64cfd upstream. activate_path() is renamed to activate_path_work() which now calls activate_or_offline_path(). activate_or_offline_path() will be used by the next commit. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Cc: Hannes Reinecke <hare@suse.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Mikulas Patocka
|
e08047c90c |
dm bufio: check new buffer allocation watermark every 30 seconds
commit 390020ad2af9ca04844c4f3b1f299ad8746d84c8 upstream.
dm-bufio checks a watermark when it allocates a new buffer in
__bufio_new(). However, it doesn't check the watermark when the user
changes /sys/module/dm_bufio/parameters/max_cache_size_bytes.
This may result in a problem - if the watermark is high enough so that
all possible buffers are allocated and if the user lowers the value of
"max_cache_size_bytes", the watermark will never be checked against the
new value because no new buffer would be allocated.
To fix this, change __evict_old_buffers() so that it checks the
watermark. __evict_old_buffers() is called every 30 seconds, so if the
user reduces "max_cache_size_bytes", dm-bufio will react to this change
within 30 seconds and decrease memory consumption.
Depends-on: 1b0fb5a5b2 ("dm bufio: avoid a possible ABBA deadlock")
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Mikulas Patocka
|
98e7b9d45b |
dm bufio: avoid a possible ABBA deadlock
commit 1b0fb5a5b2dc0dddcfa575060441a7176ba7ac37 upstream. __get_memory_limit() tests if dm_bufio_cache_size changed and calls __cache_size_refresh() if it did. It takes dm_bufio_clients_lock while it already holds the client lock. However, lock ordering is violated because in cleanup_old_buffers() dm_bufio_clients_lock is taken before the client lock. This results in a possible deadlock and lockdep engine warning. Fix this deadlock by changing mutex_lock() to mutex_trylock(). If the lock can't be taken, it will be re-checked next time when a new buffer is allocated. Also add "unlikely" to the if condition, so that the optimizer assumes that the condition is false. Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Mikulas Patocka
|
c5066c4c1b |
dm raid: select the Kconfig option CONFIG_MD_RAID0
commit 7b81ef8b14f80033e4a4168d199a0f5fd79b9426 upstream. Since the commit |
||
 Vinothkumar Raja
|
4de8eceefb |
dm btree: fix for dm_btree_find_lowest_key()
commit 7d1fedb6e96a960aa91e4ff70714c3fb09195a5a upstream. dm_btree_find_lowest_key() is giving incorrect results. find_key() traverses the btree correctly for finding the highest key, but there is an error in the way it traverses the btree for retrieving the lowest key. dm_btree_find_lowest_key() fetches the first key of the rightmost block of the btree instead of fetching the first key from the leftmost block. Fix this by conditionally passing the correct parameter to value64() based on the @find_highest flag. Signed-off-by: Erez Zadok <ezk@fsl.cs.sunysb.edu> Signed-off-by: Vinothkumar Raja <vinraja@cs.stonybrook.edu> Signed-off-by: Nidhi Panpalia <npanpalia@cs.stonybrook.edu> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
33c4c2a6d1 |
Merge 4.9.29 into android-4.9
Changes in 4.9.29 xen: adjust early dom0 p2m handling to xen hypervisor behavior target: Fix compare_and_write_callback handling for non GOOD status target/fileio: Fix zero-length READ and WRITE handling iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement usb: xhci: bInterval quirk for TI TUSB73x0 usb: host: xhci: print correct command ring address USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications" staging: vt6656: use off stack for in buffer USB transfers. staging: vt6656: use off stack for out buffer USB transfers. staging: gdm724x: gdm_mux: fix use-after-free on module unload staging: comedi: jr3_pci: fix possible null pointer dereference staging: comedi: jr3_pci: cope with jiffies wraparound usb: misc: add missing continue in switch usb: gadget: legacy gadgets are optional usb: Make sure usb/phy/of gets built-in usb: hub: Fix error loop seen after hub communication errors usb: hub: Do not attempt to autosuspend disconnected devices x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug x86, pmem: Fix cache flushing for iovec write < 8 bytes um: Fix PTRACE_POKEUSER on x86_64 perf/x86: Fix Broadwell-EP DRAM RAPL events KVM: x86: fix user triggerable warning in kvm_apic_accept_events() KVM: arm/arm64: fix races in kvm_psci_vcpu_on arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses block: fix blk_integrity_register to use template's interval_exp if not 0 crypto: algif_aead - Require setkey before accept(2) crypto: ccp - Use only the relevant interrupt bits crypto: ccp - Disable interrupts early on unload crypto: ccp - Change ISR handler method for a v3 CCP crypto: ccp - Change ISR handler method for a v5 CCP dm era: save spacemap metadata root after the pre-commit dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue() dm thin: fix a memory leak when passing discard bio down vfio/type1: Remove locked page accounting workqueue iov_iter: don't revert iov buffer if csum error IB/core: Fix sysfs registration error flow IB/core: For multicast functions, verify that LIDs are multicast LIDs IB/IPoIB: ibX: failed to create mcg debug file IB/mlx4: Fix ib device initialization error flow IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level IB/hfi1: Prevent kernel QP post send hard lockups perf auxtrace: Fix no_size logic in addr_filter__resolve_kernel_syms() ext4: evict inline data when writing to memory map orangefs: fix bounds check for listxattr orangefs: clean up oversize xattr validation orangefs: do not set getattr_time on orangefs_lookup orangefs: do not check possibly stale size on truncate fs/xattr.c: zero out memory copied to userspace in getxattr ceph: fix memory leak in __ceph_setxattr() fs/block_dev: always invalidate cleancache in invalidate_bdev() mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC Fix match_prepath() Set unicode flag on cifs echo request to avoid Mac error SMB3: Work around mount failure when using SMB3 dialect to Macs CIFS: fix mapping of SFM_SPACE and SFM_PERIOD cifs: fix leak in FSCTL_ENUM_SNAPS response handling cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops CIFS: fix oplock break deadlocks cifs: fix CIFS_IOC_GET_MNT_INFO oops CIFS: add misssing SFM mapping for doublequote padata: free correct variable device-dax: fix cdev leak fscrypt: fix context consistency check when key(s) unavailable serial: samsung: Use right device for DMA-mapping calls serial: omap: fix runtime-pm handling on unbind serial: omap: suspend device on probe errors tty: pty: Fix ldisc flush after userspace become aware of the data already Bluetooth: Fix user channel for 32bit userspace on 64bit kernel Bluetooth: hci_bcm: add missing tty-device sanity check Bluetooth: hci_intel: add missing tty-device sanity check ipmi: Fix kernel panic at ipmi_ssif_thread() libnvdimm, region: fix flush hint detection crash libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify libnvdimm, pfn: fix 'npfns' vs section alignment pstore: Fix flags to enable dumps on powerpc pstore: Shut down worker when unregistering Linux 4.9.29 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
Dennis Yang
|
1773131ec4 |
dm thin: fix a memory leak when passing discard bio down
commit 948f581a53b704b984aa20df009f0a2b4cf7f907 upstream.
dm-thin does not free the discard_parent bio after all chained sub
bios finished. The following kmemleak report could be observed after
pool with discard_passdown option processes discard bios in
linux v4.11-rc7. To fix this, we drop the discard_parent bio reference
when its endio (passdown_endio) called.
unreferenced object 0xffff8803d6b29700 (size 256):
comm "kworker/u8:0", pid 30349, jiffies 4379504020 (age 143002.776s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01 00 00 00 00 00 00 f0 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81a5efd9>] kmemleak_alloc+0x49/0xa0
[<ffffffff8114ec34>] kmem_cache_alloc+0xb4/0x100
[<ffffffff8110eec0>] mempool_alloc_slab+0x10/0x20
[<ffffffff8110efa5>] mempool_alloc+0x55/0x150
[<ffffffff81374939>] bio_alloc_bioset+0xb9/0x260
[<ffffffffa018fd20>] process_prepared_discard_passdown_pt1+0x40/0x1c0 [dm_thin_pool]
[<ffffffffa018b409>] break_up_discard_bio+0x1a9/0x200 [dm_thin_pool]
[<ffffffffa018b484>] process_discard_cell_passdown+0x24/0x40 [dm_thin_pool]
[<ffffffffa018b24d>] process_discard_bio+0xdd/0xf0 [dm_thin_pool]
[<ffffffffa018ecf6>] do_worker+0xa76/0xd50 [dm_thin_pool]
[<ffffffff81086239>] process_one_work+0x139/0x370
[<ffffffff810867b1>] worker_thread+0x61/0x450
[<ffffffff8108b316>] kthread+0xd6/0xf0
[<ffffffff81a6cd1f>] ret_from_fork+0x3f/0x70
[<ffffffffffffffff>] 0xffffffffffffffff
Signed-off-by: Dennis Yang <dennisyang@qnap.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Bart Van Assche
|
f32e35bc3d |
dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue()
commit 23a601248958fa4142d49294352fe8d1fdf3e509 upstream. Otherwise the request-based DM blk-mq request_queue will be put into service without being properly exported via sysfs. Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com> Reviewed-by: Hannes Reinecke <hare@suse.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Somasundaram Krishnasamy
|
f6ec18eb74 |
dm era: save spacemap metadata root after the pre-commit
commit 117aceb030307dcd431fdcff87ce988d3016c34a upstream. When committing era metadata to disk, it doesn't always save the latest spacemap metadata root in superblock. Due to this, metadata is getting corrupted sometimes when reopening the device. The correct order of update should be, pre-commit (shadows spacemap root), save the spacemap root (newly shadowed block) to in-core superblock and then the final commit. Signed-off-by: Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
95c782ac1d |
Merge 4.9.27 into android-4.9
Changes in 4.9.27: timerfd: Protect the might cancel mechanism proper Handle mismatched open calls tpm_tis: use default timeout value if chip reports it as zero scsi: storvsc: Workaround for virtual DVD SCSI version hwmon: (it87) Avoid registering the same chip on both SIO addresses 8250_pci: Fix potential use-after-free in error path ceph: try getting buffer capability for readahead/fadvise cpu/hotplug: Serialize callback invocations proper dm ioctl: prevent stack leak in dm ioctl call Linux 4.9.27 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 Adrian Salido
|
a0d50c80a2 |
dm ioctl: prevent stack leak in dm ioctl call
commit 4617f564c06117c7d1b611be49521a4430042287 upstream. When calling a dm ioctl that doesn't process any data (IOCTL_FLAGS_NO_PARAMS), the contents of the data field in struct dm_ioctl are left initialized. Current code is incorrectly extending the size of data copied back to user, causing the contents of kernel stack to be leaked to user. Fix by only copying contents before data and allow the functions processing the ioctl to override. Signed-off-by: Adrian Salido <salidoa@google.com> Reviewed-by: Alasdair G Kergon <agk@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
44e63be68c |
Merge 4.9.22 into android-4.9
Changes in 4.9.22: ppdev: check before attaching port ppdev: fix registering same device name drm/vmwgfx: Type-check lookups of fence objects drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces drm/vmwgfx: Remove getparam error message drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() sysfs: be careful of error returns from ops->show() staging: android: ashmem: lseek failed due to no FMODE_LSEEK. arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd iio: bmg160: reset chip when probing arm64: mm: unaligned access by user-land should be received as SIGBUS cfg80211: check rdev resume callback only for registered wiphy Reset TreeId to zero on SMB2 TREE_CONNECT mm/page_alloc.c: fix print order in show_free_areas() ptrace: fix PTRACE_LISTEN race corrupting task->state dm verity fec: limit error correction recursion dm verity fec: fix bufio leaks ACPI / gpio: do not fall back to parsing _CRS when we get a deferral Kbuild: use cc-disable-warning consistently for maybe-uninitialized orangefs: move features validation to fix filesystem hang xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files ring-buffer: Fix return value check in test_ringbuffer() mac80211: unconditionally start new netdev queues with iTXQ support brcmfmac: use local iftype avoiding use-after-free of virtual interface metag/usercopy: Drop unused macros metag/usercopy: Fix alignment error checking metag/usercopy: Add early abort to copy_to_user metag/usercopy: Zero rest of buffer from copy_from_user metag/usercopy: Set flags before ADDZ metag/usercopy: Fix src fixup in from user rapf loops metag/usercopy: Add missing fixups powerpc: Disable HFSCR[TM] if TM is not supported powerpc/mm: Add missing global TLB invalidate if cxl is active powerpc/64: Fix flush_(d|i)cache_range() called from modules powerpc: Don't try to fix up misaligned load-with-reservation instructions powerpc/crypto/crc32c-vpmsum: Fix missing preempt_disable() dm raid: fix NULL pointer dereference for raid1 without bitmap nios2: reserve boot memory for device tree xtensa: make __pa work with uncached KSEG addresses s390/decompressor: fix initrd corruption caused by bss clear s390/uaccess: get_user() should zero on failure (again) MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels MIPS: ralink: Fix typos in rt3883 pinctrl MIPS: End spinlocks with .insn MIPS: Lantiq: fix missing xbar kernel panic MIPS: Check TLB before handle_ri_rdhwr() for Loongson-3 MIPS: Add MIPS_CPU_FTLB for Loongson-3A R2 MIPS: Flush wrong invalid FTLB entry for huge page MIPS: c-r4k: Fix Loongson-3's vcache/scache waysize calculation Documentation: stable-kernel-rules: fix stable-tag format mm/mempolicy.c: fix error handling in set_mempolicy and mbind. random: use chacha20 for get_random_int/long drm/sun4i: tcon: Move SoC specific quirks to a DT matched data structure drm/sun4i: Add compatible strings for A31/A31s display pipelines drm/sun4i: Add compatible string for A31/A31s TCON (timing controller) clk: lpc32xx: add a quirk for PWM and MS clock dividers HID: usbhid: Add quirks for Mayflash/Dragonrise GameCube and PS3 adapters HID: i2c-hid: add a simple quirk to fix device defects usb: dwc3: gadget: delay unmap of bounced requests ASoC: Intel: bytct_rt5640: change default capture settings arm64: dts: hisi: fix hip06 sas am-max-trans quirk net/mlx4_core: Use device ID defines clocksource/drivers/arm_arch_timer: Don't assume clock runs in suspend scsi: ufs: introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk HID: sensor-hub add quirk for Microsoft Surface 3 HID: sensor-hub: add quirk for Microchip MM7150 HID: multitouch: enable the Surface 3 Type Cover to report multitouch data HID: multitouch: do not retrieve all reports for all devices mmc: sdhci-msm: Enable few quirks scsi: ufs: ensure that host pa_tactivate is higher than device svcauth_gss: Close connection when dropping an incoming message x86/intel_idle: Add CPU model 0x4a (Atom Z34xx series) arm64: PCI: Manage controller-specific data on per-controller basis arm64: PCI: Add local struct device pointers PCI: thunder-pem: Factor out resource lookup scsi: ufs: add quirk to increase host PA_SaveConfigTime ALSA: usb-audio: add implicit fb quirk for Axe-Fx II PCI: Expand "VPD access disabled" quirk message ALSA: usb-audio: Add native DSD support for TEAC 501/503 DAC platform/x86: acer-wmi: Only supports AMW0_GUID1 on acer family nvme: simplify stripe quirk ACPI / sysfs: Provide quirk mechanism to prevent GPE flooding HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD HID: usbhid: Add quirk for Mayflash/Dragonrise DolphinBar. drm/edid: constify edid quirk list drm/i915: fix INTEL_BDW_IDS definition drm/i915: more .is_mobile cleanups for BDW drm/i915: actually drive the BDW reserved IDs ASoC: Intel: bytcr_rt5640: quirks for Insyde devices scsi: ufs: introduce a new ufshcd_statea UFSHCD_STATE_EH_SCHEDULED scsi: ufs: issue link starup 2 times if device isn't active usb: chipidea: msm: Rely on core to override AHBBURST serial: 8250_omap: Add OMAP_DMA_TX_KICK quirk for AM437x Input: gpio_keys - add support for GPIO descriptors ARM: davinci: PM: support da8xx DT platforms usb: xhci: add quirk flag for broken PED bits usb: host: xhci-plat: enable BROKEN_PED quirk if platform requested usb: dwc3: host: pass quirk-broken-port-ped property for known broken revisions drm/mga: remove device_is_agp callback ARM: dts: STiH407-family: set snps,dis_u3_susphy_quirk PCI: Add ACS quirk for Intel Union Point sata: ahci-da850: implement a workaround for the softreset quirk ACPI / button: Change default behavior to lid_init_state=open ASoC: rt5670: Add missing 10EC5072 ACPI ID ASoC: codecs: rt5670: add quirk for Lenovo Thinkpad 10 ASoC: Intel: Baytrail: add quirk for Lenovo Thinkpad 10 ASoC: Intel: cht_bsw_rt5645: harden ACPI device detection ASoC: Intel: cht_bsw_rt5645: add Baytrail MCLK support ACPI: save NVS memory for Lenovo G50-45 ASoC: sun4i-i2s: Add quirks to handle a31 compatible HID: wacom: don't apply generic settings to old devices arm: kernel: Add SMC structure parameter firmware: qcom: scm: Fix interrupted SCM calls drm/msm/adreno: move function declarations to header file ARM: smccc: Update HVC comment to describe new quirk parameter PCI: Add Broadcom Northstar2 PAXC quirk for device class and MPSS PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports mmc: sdhci-of-esdhc: remove default broken-cd for ARM PCI: Sort the list of devices with D3 delay quirk by ID PCI: Add ACS quirk for Qualcomm QDF2400 and QDF2432 watchdog: s3c2410: Fix infinite interrupt in soft mode platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB platform/x86: asus-wmi: Detect quirk_no_rfkill from the DSDT x86/reboot/quirks: Add ASUS EeeBook X205TA reboot quirk x86/reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk usb-storage: Add ignore-residue quirk for Initio INIC-3619 x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk Linux 4.9.22 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 Dmitry Bilunov
|
27d382fb6a |
dm raid: fix NULL pointer dereference for raid1 without bitmap
commit 7a0c5c5b834fb60764b494b0e39c239da3b0774b upstream. Commit |
||
 Sami Tolvanen
|
ab83597b9d |
dm verity fec: fix bufio leaks
commit 86e3e83b443669dd2bcc5c8a83b23e3aa0694c0d upstream.
Buffers read through dm_bufio_read() were not released in all code paths.
Fixes:
|
||
|
Sami Tolvanen
|
2ff0876426 |
dm verity fec: limit error correction recursion
commit f1a880a93baaadb14c10a348fd199f1cdb6bcccd upstream.
If the hash tree itself is sufficiently corrupt in addition to data blocks,
it's possible for error correction to end up in a deep recursive loop,
which eventually causes a kernel panic. This change limits the
recursion to a reasonable level during a single I/O operation.
Fixes:
|
||
|
Greg Kroah-Hartman
|
68565811fe |
Merge 4.9.21 into android-4.9
Changes in 4.9.21: libceph: force GFP_NOIO for socket allocations xen/setup: Don't relocate p2m over existing one xfs: only update mount/resv fields on success in __xfs_ag_resv_init xfs: use per-AG reservations for the finobt xfs: pull up iolock from xfs_free_eofblocks() xfs: sync eofblocks scans under iolock are livelock prone xfs: fix eofblocks race with file extending async dio writes xfs: fix toctou race when locking an inode to access the data map xfs: fail _dir_open when readahead fails xfs: filter out obviously bad btree pointers xfs: check for obviously bad level values in the bmbt root xfs: verify free block header fields xfs: allow unwritten extents in the CoW fork xfs: mark speculative prealloc CoW fork extents unwritten xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t xfs: update ctime and mtime on clone destinatation inodes xfs: reject all unaligned direct writes to reflinked files xfs: don't fail xfs_extent_busy allocation xfs: handle indlen shortage on delalloc extent merge xfs: split indlen reservations fairly when under reserved xfs: fix uninitialized variable in _reflink_convert_cow xfs: don't reserve blocks for right shift transactions xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment xfs: tune down agno asserts in the bmap code xfs: only reclaim unwritten COW extents periodically xfs: fix and streamline error handling in xfs_end_io xfs: Use xfs_icluster_size_fsb() to calculate inode alignment mask xfs: use iomap new flag for newly allocated delalloc blocks xfs: try any AG when allocating the first btree block when reflinking scsi: sg: check length passed to SG_NEXT_CMD_LEN scsi: libsas: fix ata xfer length scsi: scsi_dh_alua: Check scsi_device_get() return value scsi: scsi_dh_alua: Ensure that alua_activate() calls the completion function PCI: iproc: Save host bridge window resource in struct iproc_pcie ALSA: seq: Fix race during FIFO resize ALSA: hda - fix a problem for lineout on a Dell AIO machine ASoC: atmel-classd: fix audio clock rate ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of pointer HID: wacom: Don't add ghost interface as shared data mmc: sdhci: Disable runtime pm when the sdio_irq is enabled mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection NFSv4.1 fix infinite loop on IO BAD_STATEID error nfsd: map the ENOKEY to nfserr_perm for avoiding warning parisc: Clean up fixup routines for get_user()/put_user() parisc: Avoid stalled CPU warnings after system shutdown parisc: Fix access fault handling in pa_memcpy() ACPI: Fix incompatibility with mcount-based function graph tracing ACPI: Do not create a platform_device for IOAPIC/IOxAPIC tty/serial: atmel: fix race condition (TX+DMA) tty/serial: atmel: fix TX path in atmel_console_write() USB: fix linked-list corruption in rh_call_control() serial: mxs-auart: Fix baudrate calculation KVM: x86: clear bus pointer when destroyed KVM: kvm_io_bus_unregister_dev() should never fail drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags drm/vc4: Allocate the right amount of space for boot-time CRTC state. drm/etnaviv: (re-)protect fence allocation with GPU mutex x86/mm/KASLR: Exclude EFI region from KASLR VA space randomization x86/mce: Fix copy/paste error in exception table entries lib/syscall: Clear return values when no stack mm: rmap: fix huge file mmap accounting in the memcg stats mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() ARM: BCM5301X: Add back handler ignoring external imprecise aborts qla2xxx: Allow vref count to timeout on vport delete. ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags MIPS: Lantiq: Fix cascaded IRQ setup mm: workingset: fix premature shadow node shrinking with cgroups blk: improve order of bio handling in generic_make_request() blk: Ensure users for current->bio_list can see the full list. padata: avoid race in reordering nvme/core: Fix race kicking freed request_queue nvme/pci: Disable on removal when disconnected Linux 4.9.21 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
|
NeilBrown
|
5959cded91 |
blk: Ensure users for current->bio_list can see the full list.
commit f5fe1b51905df7cfe4fdfd85c5fb7bc5b71a094f upstream.
Commit 79bd99596b73 ("blk: improve order of bio handling in generic_make_request()")
changed current->bio_list so that it did not contain *all* of the
queued bios, but only those submitted by the currently running
make_request_fn.
There are two places which walk the list and requeue selected bios,
and others that check if the list is empty. These are no longer
correct.
So redefine current->bio_list to point to an array of two lists, which
contain all queued bios, and adjust various code to test or walk both
lists.
Signed-off-by: NeilBrown <neilb@suse.com>
Fixes: 79bd99596b73 ("blk: improve order of bio handling in generic_make_request()")
Signed-off-by: Jens Axboe <axboe@fb.com>
Cc: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
Greg Kroah-Hartman
|
6bf53d4143 |
Merge 4.9.18 into android-4.9
Changes in 4.9.18: drm/vc4: Fix termination of the initial scan for branch targets. drm/vc4: Use runtime autosuspend to avoid thrashing V3D power state. give up on gcc ilog2() constant optimizations qla2xxx: Fix memory leak for abts processing qla2xxx: Fix request queue corruption. parisc: Optimize flush_kernel_vmap_range and invalidate_kernel_vmap_range parisc: Fix system shutdown halt perf/core: Fix use-after-free in perf_release() perf/core: Fix event inheritance on fork() xprtrdma: Squelch kbuild sparse complaint NFS prevent double free in async nfs4_exchange_id cpufreq: Fix and clean up show_cpuinfo_cur_freq() powerpc/boot: Fix zImage TOC alignment md/raid1/10: fix potential deadlock target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export scsi: lpfc: Add shutdown method for kexec scsi: libiscsi: add lock around task lists to fix list corruption regression target: Fix VERIFY_16 handling in sbc_parse_cdb isdn/gigaset: fix NULL-deref at probe gfs2: Avoid alignment hole in struct lm_lockname percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages cgroup/pids: remove spurious suspicious RCU usage warning drm/amdgpu/si: add dpm quirk for Oland ext4: fix fencepost in s_first_meta_bg validation Linux 4.9.18 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> |
||
 Shaohua Li
|
ad5166415f |
md/raid1/10: fix potential deadlock
commit 61eb2b43b99ebdc9bc6bc83d9792257b243e7cb3 upstream.
Neil Brown pointed out a potential deadlock in raid 10 code with
bio_split/chain. The raid1 code could have the same issue, but recent
barrier rework makes it less likely to happen. The deadlock happens in
below sequence:
1. generic_make_request(bio), this will set current->bio_list
2. raid10_make_request will split bio to bio1 and bio2
3. __make_request(bio1), wait_barrer, add underlayer disk bio to
current->bio_list
4. __make_request(bio2), wait_barrer
If raise_barrier happens between 3 & 4, since wait_barrier runs at 3,
raise_barrier waits for IO completion from 3. And since raise_barrier
sets barrier, 4 waits for raise_barrier. But IO from 3 can't be
dispatched because raid10_make_request() doesn't finished yet.
The solution is to adjust the IO ordering. Quotes from Neil:
"
It is much safer to:
if (need to split) {
split = bio_split(bio, ...)
bio_chain(...)
make_request_fn(split);
generic_make_request(bio);
} else
make_request_fn(mddev, bio);
This way we first process the initial section of the bio (in 'split')
which will queue some requests to the underlying devices. These
requests will be queued in generic_make_request.
Then we queue the remainder of the bio, which will be added to the end
of the generic_make_request queue.
Then we return.
generic_make_request() will pop the lower-level device requests off the
queue and handle them first. Then it will process the remainder
of the original bio once the first section has been fully processed.
"
Note, this only happens in read path. In write path, the bio is flushed to
underlaying disks either by blk flush (from schedule) or offladed to raid1/10d.
It's queued in current->bio_list.
Cc: Coly Li <colyli@suse.de>
Suggested-by: NeilBrown <neilb@suse.com>
Reviewed-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
 Badhri Jagan Sridharan
|
9b7246ebf0 |
ANDROID: android-verity: do not compile as independent module
dm-android-verity depends on optional kernel command line parameters.
When compiled as module the __setup macro ends up being a no-op
resulting in the following warnings:
/work/build/batch/drivers/md/dm-android-verity.c:91:19: warning: 'verity_buildvariant' defined but not used [-Wunused-function]
static int __init verity_buildvariant(char *line)
^~~~~~~~~~~~~~~~~~~
/work/build/batch/drivers/md/dm-android-verity.c:83:19: warning: 'verity_keyid_param' defined but not used [-Wunused-function]
static int __init verity_keyid_param(char *line)
^~~~~~~~~~~~~~~~~~
/work/build/batch/drivers/md/dm-android-verity.c:75:19: warning: 'verity_mode_param' defined but not used [-Wunused-function]
static int __init verity_mode_param(char *line)
^~~~~~~~~~~~~~~~~
/work/build/batch/drivers/md/dm-android-verity.c:67:19: warning: 'verified_boot_state_param' defined but not used [-Wunused-function]
static int __init verified_boot_state_param(char *line)
^~~~~~~~~~~~~~~~~~~~~~~~~
Tested with allmodconfig.
Change-Id: Idfe0c97b216bb620cc7264e968b494eb3a765157
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
|
||
|
Mikulas Patocka
|
04ab239838 |
dm: flush queued bios when process blocks to avoid deadlock
am:
|
||
|
Mikulas Patocka
|
21582cd0b6 |
dm: flush queued bios when process blocks to avoid deadlock
commit d67a5f4b5947aba4bfe9a80a2b86079c215ca755 upstream. Commit |
||
 Bowgo Tsai
|
80f190c3be |
ANDROID: dm: android-verity: allow disable dm-verity for Treble VTS
To start Treble VTS test, a single AOSP system.img will be flashed onto
the device. The size of AOSP system.img might be different than the
system partition size on device, making locating verity metadata fail
(at the last fixed size of the partition).
This change allows disabling dm-verity on system partition when the
device is unlocked (orange device state) with invalid metadata.
BUG: 35603549
Test: boot device with a different-sized system.img, checks verity is
not enabled via:
"adb shell getprop | grep partition.system.verified"
Change-Id: Ide78dca4eefde4ab019e4b202d3f590dcb1bb506
Signed-off-by: Bowgo Tsai <bowgotsai@google.com>
|
||
 colyli@suse.de
|
42e5c23d67 |
md linear: fix a race between linear_add() and linear_congested()
am:
|
||
 Heinz Mauelshagen
|
8e9e5fc202 |
dm raid: fix data corruption on reshape request
am:
|
||
|
Mike Snitzer
|
6bdafe157b |
dm round robin: revert "use percpu 'repeat_count' and 'current_path'"
am:
|
||
|
Mikulas Patocka
|
9a7a03a000 |
dm stats: fix a leaked s->histogram_boundaries array
am:
|
||
|
Joe Thornber
|
e62ebc22f6 |
dm cache: fix corruption seen when using cache > 2TB
am:
|
||
|
colyli@suse.de
|
6f9c02ab9d |
md linear: fix a race between linear_add() and linear_congested()
commit 03a9e24ef2aaa5f1f9837356aed79c860521407a upstream.
Recently I receive a bug report that on Linux v3.0 based kerenl, hot add
disk to a md linear device causes kernel crash at linear_congested(). From
the crash image analysis, I find in linear_congested(), mddev->raid_disks
contains value N, but conf->disks[] only has N-1 pointers available. Then
a NULL pointer deference crashes the kernel.
There is a race between linear_add() and linear_congested(), RCU stuffs
used in these two functions cannot avoid the race. Since Linuv v4.0
RCU code is replaced by introducing mddev_suspend(). After checking the
upstream code, it seems linear_congested() is not called in
generic_make_request() code patch, so mddev_suspend() cannot provent it
from being called. The possible race still exists.
Here I explain how the race still exists in current code. For a machine
has many CPUs, on one CPU, linear_add() is called to add a hard disk to a
md linear device; at the same time on other CPU, linear_congested() is
called to detect whether this md linear device is congested before issuing
an I/O request onto it.
Now I use a possible code execution time sequence to demo how the possible
race happens,
seq linear_add() linear_congested()
0 conf=mddev->private
1 oldconf=mddev->private
2 mddev->raid_disks++
3 for (i=0; i<mddev->raid_disks;i++)
4 bdev_get_queue(conf->disks[i].rdev->bdev)
5 mddev->private=newconf
In linear_add() mddev->raid_disks is increased in time seq 2, and on
another CPU in linear_congested() the for-loop iterates conf->disks[i] by
the increased mddev->raid_disks in time seq 3,4. But conf with one more
element (which is a pointer to struct dev_info type) to conf->disks[] is
not updated yet, accessing its structure member in time seq 4 will cause a
NULL pointer deference fault.
To fix this race, there are 2 parts of modification in the patch,
1) Add 'int raid_disks' in struct linear_conf, as a copy of
mddev->raid_disks. It is initialized in linear_conf(), always being
consistent with pointers number of 'struct dev_info disks[]'. When
iterating conf->disks[] in linear_congested(), use conf->raid_disks to
replace mddev->raid_disks in the for-loop, then NULL pointer deference
will not happen again.
2) RCU stuffs are back again, and use kfree_rcu() in linear_add() to
free oldconf memory. Because oldconf may be referenced as mddev->private
in linear_congested(), kfree_rcu() makes sure that its memory will not
be released until no one uses it any more.
Also some code comments are added in this patch, to make this modification
to be easier understandable.
This patch can be applied for kernels since v4.0 after commit:
|
||
|
Heinz Mauelshagen
|
2937e22c23 |
dm raid: fix data corruption on reshape request
commit d36a19541fe8f392778ac137d60f9be8dfdd8f9d upstream.
The lvm2 sequence to manage dm-raid constructor flags that trigger a
rebuild or a reshape is defined as:
1) load table with flags (e.g. rebuild/delta_disks/data_offset)
2) clear out the flags in lvm2 metadata
3) store the lvm2 metadata, reload the table to reset the flags
previously established during the initial load (1) -- in order to
prevent repeatedly requesting a rebuild or a reshape on activation
Currently, loading an inactive table with rebuild/reshape flags
specified will cause dm-raid to rebuild/reshape on resume and thus start
updating the raid metadata (about the progress). When the second table
reload, to reset the flags, occurs the constructor accesses the volatile
progress state kept in the raid superblocks. Because the active mapping
is still processing the rebuild/reshape, that position will be stale by
the time the device is resumed.
In the reshape case, this causes data corruption by processing already
reshaped stripes again. In the rebuild case, it does _not_ cause data
corruption but instead involves superfluous rebuilds.
Fix by keeping the raid set frozen during the first resume and then
allow the rebuild/reshape during the second resume.
Fixes:
|
||
|
Mike Snitzer
|
b7f874eedc |
dm round robin: revert "use percpu 'repeat_count' and 'current_path'"
commit 37a098e9d10db6e2efc05fe61e3a6ff2e9802c53 upstream. The sloppy nature of lockless access to percpu pointers (s->current_path) in rr_select_path(), from multiple threads, is causing some paths to used more than others -- which results in less IO performance being observed. Revert these upstream commits to restore truly symmetric round-robin IO submission in DM multipath: |
||
|
Mikulas Patocka
|
bad6c16b81 |
dm stats: fix a leaked s->histogram_boundaries array
commit 6085831883c25860264721df15f05bbded45e2a2 upstream.
Fixes:
|
||
|
Joe Thornber
|
9987feba90 |
dm cache: fix corruption seen when using cache > 2TB
commit ca763d0a53b264a650342cee206512bc92ac7050 upstream. A rounding bug due to compiler generated temporary being 32bit was found in remap_to_cache(). A localized cast in remap_to_cache() fixes the corruption but this preferred fix (changing from uint32_t to sector_t) eliminates potential for future rounding errors elsewhere. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Greg Hackmann
|
d319660640 |
ANDROID: dm: android-verity: fix table_make_digest() error handling
If table_make_digest() fails, verify_verity_signature() would try to pass the returned ERR_PTR() to kfree(). This fixes the smatch error: drivers/md/dm-android-verity.c:601 verify_verity_signature() error: 'pks' dereferencing possible ERR_PTR() Change-Id: I9b9b7764b538cb4a5f94337660e9b0f149b139be Signed-off-by: Greg Hackmann <ghackmann@google.com> |
||
 Todd Kjos
|
0455ac9d3c | Merge branch 'upstream-linux-4.9.y' into android-4.9 | ||
 Kent Overstreet
|
8629aed238 |
bcache: Make gc wakeup sane, remove set_task_state()
commit be628be09563f8f6e81929efbd7cf3f45c344416 upstream. Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com> Cc: Coly Li <colyli@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
 Dmitry Shmidt
|
cb057345da |
Merge tag 'v4.9.10' into android-4.9-aosp
This is the 4.9.10 stable release |