December 2017 - Linux-stable-mirror

[Linux-stable-mirror] [PATCH] crypto: pcrypt - fix freeing pcrypt instances

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> pcrypt is using the old way of freeing instances, where the ->free() method specified in the 'struct crypto_template' is passed a pointer to the 'struct crypto_instance'. But the crypto_instance is being kfree()'d directly, which is incorrect because the memory was actually allocated as an aead_instance, which contains the crypto_instance at a nonzero offset. Thus, the wrong pointer was being kfree()'d. Fix it by switching to the new way to free aead_instance's where the ->free() method is specified in the aead_instance itself. Reported-by: syzbot <syzkaller(a)googlegroups.com> Fixes: 0496f56065e0 ("crypto: pcrypt - Add support for new AEAD interface") Cc: <stable(a)vger.kernel.org> # v4.2+ Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- crypto/pcrypt.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index ee9cfb99fe25..f8ec3d4ba4a8 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -254,6 +254,14 @@ static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm) crypto_free_aead(ctx->child); } +static void pcrypt_free(struct aead_instance *inst) +{ + struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst); + + crypto_drop_aead(&ctx->spawn); + kfree(inst); +} + static int pcrypt_init_instance(struct crypto_instance *inst, struct crypto_alg *alg) { @@ -319,6 +327,8 @@ static int pcrypt_create_aead(struct crypto_template *tmpl, struct rtattr **tb, inst->alg.encrypt = pcrypt_aead_encrypt; inst->alg.decrypt = pcrypt_aead_decrypt; + inst->free = pcrypt_free; + err = aead_register_instance(tmpl, inst); if (err) goto out_drop_aead; @@ -349,14 +359,6 @@ static int pcrypt_create(struct crypto_template *tmpl, struct rtattr **tb) return -EINVAL; } -static void pcrypt_free(struct crypto_instance *inst) -{ - struct pcrypt_instance_ctx *ctx = crypto_instance_ctx(inst); - - crypto_drop_aead(&ctx->spawn); - kfree(inst); -} - static int pcrypt_cpumask_change_notify(struct notifier_block *self, unsigned long val, void *data) { @@ -469,7 +471,6 @@ static void pcrypt_fini_padata(struct padata_pcrypt *pcrypt) static struct crypto_template pcrypt_tmpl = { .name = "pcrypt", .create = pcrypt_create, - .free = pcrypt_free, .module = THIS_MODULE, }; -- 2.15.1.620.gb9897f4670-goog

7 years, 1 month

3
2
0 0

[Linux-stable-mirror] [PATCH] crypto: chacha20poly1305 - validate the digest size

by Eric Biggers

From: Eric Biggers <ebiggers(a)google.com> If the rfc7539 template was instantiated with a hash algorithm with digest size larger than 16 bytes (POLY1305_DIGEST_SIZE), then the digest overran the 'tag' buffer in 'struct chachapoly_req_ctx', corrupting the subsequent memory, including 'cryptlen'. This caused a crash during crypto_skcipher_decrypt(). Fix it by, when instantiating the template, requiring that the underlying hash algorithm has the digest size expected for Poly1305. Reproducer: #include <linux/if_alg.h> #include <sys/socket.h> #include <unistd.h> int main() { int algfd, reqfd; struct sockaddr_alg addr = { .salg_type = "aead", .salg_name = "rfc7539(chacha20,sha256)", }; unsigned char buf[32] = { 0 }; algfd = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(algfd, (void *)&addr, sizeof(addr)); setsockopt(algfd, SOL_ALG, ALG_SET_KEY, buf, sizeof(buf)); reqfd = accept(algfd, 0, 0); write(reqfd, buf, 16); read(reqfd, buf, 16); } Reported-by: syzbot <syzkaller(a)googlegroups.com> Fixes: 71ebc4d1b27d ("crypto: chacha20poly1305 - Add a ChaCha20-Poly1305 AEAD construction, RFC7539") Cc: <stable(a)vger.kernel.org> # v4.2+ Signed-off-by: Eric Biggers <ebiggers(a)google.com> --- crypto/chacha20poly1305.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c index db1bc3147bc4..600afa99941f 100644 --- a/crypto/chacha20poly1305.c +++ b/crypto/chacha20poly1305.c @@ -610,6 +610,11 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, algt->mask)); if (IS_ERR(poly)) return PTR_ERR(poly); + poly_hash = __crypto_hash_alg_common(poly); + + err = -EINVAL; + if (poly_hash->digestsize != POLY1305_DIGEST_SIZE) + goto out_put_poly; err = -ENOMEM; inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL); @@ -618,7 +623,6 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, ctx = aead_instance_ctx(inst); ctx->saltlen = CHACHAPOLY_IV_SIZE - ivsize; - poly_hash = __crypto_hash_alg_common(poly); err = crypto_init_ahash_spawn(&ctx->poly, poly_hash, aead_crypto_instance(inst)); if (err) -- 2.15.1.424.g9478a66081-goog

7 years, 1 month

2
1
0 0

[Linux-stable-mirror] Patch "ALSA: hda - Fix yet another i915 pointer leftover in error path" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled ALSA: hda - Fix yet another i915 pointer leftover in error path to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: alsa-hda-fix-yet-another-i915-pointer-leftover-in-error-path.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 97cc2ed27e5a168cf423f67c3bc7c6cc41d12f82 Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai(a)suse.de> Date: Tue, 29 Mar 2016 18:48:07 +0200 Subject: ALSA: hda - Fix yet another i915 pointer leftover in error path From: Takashi Iwai <tiwai(a)suse.de> commit 97cc2ed27e5a168cf423f67c3bc7c6cc41d12f82 upstream. The hdac_acomp object in hdac_i915.c is left as assigned even after binding with i915 actually fails, and this leads to the WARN_ON() at the next load of the module. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94736 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Cc: Kouta Okamoto <kouta.okamoto(a)toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/hda/hdac_i915.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/hda/hdac_i915.c +++ b/sound/hda/hdac_i915.c @@ -240,6 +240,7 @@ out_master_del: out_err: kfree(acomp); bus->audio_component = NULL; + hdac_acomp = NULL; dev_info(dev, "failed to add i915 component master (%d)\n", ret); return ret; Patches currently in stable-queue which might be from tiwai(a)suse.de are queue-4.4/alsa-hda-degrade-i915-binding-failure-message.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.4/alsa-hda-enable-audio-component-for-old-intel-pch-devices.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.4/alsa-hda-clear-the-leftover-component-assignment-at-snd_hdac_i915_exit.patch queue-4.4/alsa-hda-fix-yet-another-i915-pointer-leftover-in-error-path.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] Patch "ALSA: hda - Enable audio component for old Intel PCH devices" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled ALSA: hda - Enable audio component for old Intel PCH devices to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: alsa-hda-enable-audio-component-for-old-intel-pch-devices.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 6603249dcdbb6aab0b726bdf372d6f20c0d2d611 Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai(a)suse.de> Date: Tue, 1 Dec 2015 16:49:35 +0100 Subject: ALSA: hda - Enable audio component for old Intel PCH devices From: Takashi Iwai <tiwai(a)suse.de> commit 6603249dcdbb6aab0b726bdf372d6f20c0d2d611 upstream. As i915 graphics driver provides the notification via audio component, not only the currently implemented HSW+ and VLV+ platforms but also all other PCH-based platforms (e.g. Cougar Point, Panther Point, etc) can use this infrastructure. It'll improve the reliability and the power consumption significantly, especially once when we implement the ELD notification via component. As a preliminary, this patch enables the usage of audio component for all PCH platforms. The HDA controller just needs to set AZX_DCAPS_I915_POWERWELL flag appropriately. The name of the flag is a bit confusing, but this actually works even on the chips without the powerwell but accesses only the other component ops. In the HDMI/DP codec driver side, we just need to register/unregister the notifier for such chips. This can be identified by checking the audio_component field in the assigned hdac_bus. One caveat is that PCH for Haswell and Broadwell must not be bound with i915 audio component, as there are dedicated HD-audio HDMI controllers on these platforms. Ditto for Poulsbo and Oaktrail as they use gma500 graphics, not i915. Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Cc: Kouta Okamoto <kouta.okamoto(a)toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/pci/hda/hda_intel.c | 14 ++++++++++---- sound/pci/hda/patch_hdmi.c | 6 ++++-- 2 files changed, 14 insertions(+), 6 deletions(-) --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -286,13 +286,19 @@ enum { (AZX_DCAPS_OLD_SSYNC | AZX_DCAPS_NO_ALIGN_BUFSIZE) /* quirks for Intel PCH */ -#define AZX_DCAPS_INTEL_PCH_NOPM \ +#define AZX_DCAPS_INTEL_PCH_BASE \ (AZX_DCAPS_NO_ALIGN_BUFSIZE | AZX_DCAPS_COUNT_LPIB_DELAY |\ AZX_DCAPS_REVERSE_ASSIGN | AZX_DCAPS_SNOOP_TYPE(SCH)) +/* PCH up to IVB; bound with i915 audio component for HDMI, no runtime PM */ +#define AZX_DCAPS_INTEL_PCH_NOPM \ + (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_I915_POWERWELL) + +/* PCH for HSW/BDW; with runtime PM, but no i915 binding */ #define AZX_DCAPS_INTEL_PCH \ - (AZX_DCAPS_INTEL_PCH_NOPM | AZX_DCAPS_PM_RUNTIME) + (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME) +/* HSW HDMI */ #define AZX_DCAPS_INTEL_HASWELL \ (/*AZX_DCAPS_ALIGN_BUFSIZE |*/ AZX_DCAPS_COUNT_LPIB_DELAY |\ AZX_DCAPS_PM_RUNTIME | AZX_DCAPS_I915_POWERWELL |\ @@ -2271,10 +2277,10 @@ static const struct pci_device_id azx_id .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, /* Poulsbo */ { PCI_DEVICE(0x8086, 0x811b), - .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, /* Oaktrail */ { PCI_DEVICE(0x8086, 0x080a), - .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_NOPM }, + .driver_data = AZX_DRIVER_SCH | AZX_DCAPS_INTEL_PCH_BASE }, /* BayTrail */ { PCI_DEVICE(0x8086, 0x0f04), .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_BAYTRAIL }, --- a/sound/pci/hda/patch_hdmi.c +++ b/sound/pci/hda/patch_hdmi.c @@ -154,6 +154,8 @@ struct hdmi_spec { struct i915_audio_component_audio_ops i915_audio_ops; }; +#define codec_has_acomp(codec) \ + ((codec)->bus->core.audio_component != NULL) struct hdmi_audio_infoframe { u8 type; /* 0x84 */ @@ -2222,7 +2224,7 @@ static void generic_hdmi_free(struct hda struct hdmi_spec *spec = codec->spec; int pin_idx; - if (is_haswell_plus(codec) || is_valleyview_plus(codec)) + if (codec_has_acomp(codec)) snd_hdac_i915_register_notifier(NULL); for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { @@ -2395,7 +2397,7 @@ static int patch_generic_hdmi(struct hda is_broxton(codec)) codec->core.link_power_control = 1; - if (is_haswell_plus(codec) || is_valleyview_plus(codec)) { + if (codec_has_acomp(codec)) { codec->depop_delay = 0; spec->i915_audio_ops.audio_ptr = codec; spec->i915_audio_ops.pin_eld_notify = intel_pin_eld_notify; Patches currently in stable-queue which might be from tiwai(a)suse.de are queue-4.4/alsa-hda-degrade-i915-binding-failure-message.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.4/alsa-hda-enable-audio-component-for-old-intel-pch-devices.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.4/alsa-hda-clear-the-leftover-component-assignment-at-snd_hdac_i915_exit.patch queue-4.4/alsa-hda-fix-yet-another-i915-pointer-leftover-in-error-path.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] Patch "ALSA: hda - Degrade i915 binding failure message" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled ALSA: hda - Degrade i915 binding failure message to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: alsa-hda-degrade-i915-binding-failure-message.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From bed2e98e1f4db8b827df507abc30be7b11b0613d Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai(a)suse.de> Date: Wed, 20 Jan 2016 15:00:26 +0100 Subject: ALSA: hda - Degrade i915 binding failure message From: Takashi Iwai <tiwai(a)suse.de> commit bed2e98e1f4db8b827df507abc30be7b11b0613d upstream. Currently HD-audio driver on Intel Skylake or Broxteon gives an error message when binding with i915 audio component fails. However, this isn't any serious error on a system without Intel graphics. Indeed there are such systems, where a third-party codec (e.g. Creative) is put on the mobo while using other discrete GPU (e.g. Nvidia). Printing a kernel "error" message is overreaction in such a case. This patch downgrades the print level for that message. For systems that mandate the i915 binding (e.g. Haswell or Broadwell HDMI/DP), another kernel error message is shown in addition to make clear what went wrong. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111021 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Cc: Kouta Okamoto <kouta.okamoto(a)toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/hda/hdac_i915.c | 2 +- sound/pci/hda/hda_intel.c | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) --- a/sound/hda/hdac_i915.c +++ b/sound/hda/hdac_i915.c @@ -240,7 +240,7 @@ out_master_del: out_err: kfree(acomp); bus->audio_component = NULL; - dev_err(dev, "failed to add i915 component master (%d)\n", ret); + dev_info(dev, "failed to add i915 component master (%d)\n", ret); return ret; } --- a/sound/pci/hda/hda_intel.c +++ b/sound/pci/hda/hda_intel.c @@ -2088,9 +2088,11 @@ static int azx_probe_continue(struct azx * for other chips, still continue probing as other * codecs can be on the same link. */ - if (CONTROLLER_IN_GPU(pci)) + if (CONTROLLER_IN_GPU(pci)) { + dev_err(chip->card->dev, + "HSW/BDW HD-audio HDMI/DP requires binding with gfx driver\n"); goto out_free; - else + } else goto skip_i915; } Patches currently in stable-queue which might be from tiwai(a)suse.de are queue-4.4/alsa-hda-degrade-i915-binding-failure-message.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.4/alsa-hda-enable-audio-component-for-old-intel-pch-devices.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.4/alsa-hda-clear-the-leftover-component-assignment-at-snd_hdac_i915_exit.patch queue-4.4/alsa-hda-fix-yet-another-i915-pointer-leftover-in-error-path.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] Patch "ALSA: hda - Clear the leftover component assignment at snd_hdac_i915_exit()" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled ALSA: hda - Clear the leftover component assignment at snd_hdac_i915_exit() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: alsa-hda-clear-the-leftover-component-assignment-at-snd_hdac_i915_exit.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From faafd03d23c913633d2ef7e6ffebdce01b164409 Mon Sep 17 00:00:00 2001 From: Takashi Iwai <tiwai(a)suse.de> Date: Tue, 29 Mar 2016 12:29:24 +0200 Subject: ALSA: hda - Clear the leftover component assignment at snd_hdac_i915_exit() From: Takashi Iwai <tiwai(a)suse.de> commit faafd03d23c913633d2ef7e6ffebdce01b164409 upstream. The commit [d745f5e7b8b2: ALSA: hda - Add the pin / port mapping on Intel ILK and VLV] introduced a WARN_ON() to check the pointer for avoiding the double initializations. But hdac_acomp pointer wasn't cleared at snd_hdac_i915_exit(), thus after reloading the HD-audio driver, it may result in the false positive warning. This patch makes sure to clear the leftover pointer at exit. Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=94736 Reported-by: Daniela Doras-prodan <daniela.doras-prodan(a)intel.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Cc: Kouta Okamoto <kouta.okamoto(a)toshiba.co.jp> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- sound/hda/hdac_i915.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/hda/hdac_i915.c +++ b/sound/hda/hdac_i915.c @@ -273,6 +273,7 @@ int snd_hdac_i915_exit(struct hdac_bus * kfree(acomp); bus->audio_component = NULL; + hdac_acomp = NULL; return 0; } Patches currently in stable-queue which might be from tiwai(a)suse.de are queue-4.4/alsa-hda-degrade-i915-binding-failure-message.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.4/alsa-hda-enable-audio-component-for-old-intel-pch-devices.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.4/alsa-hda-clear-the-leftover-component-assignment-at-snd_hdac_i915_exit.patch queue-4.4/alsa-hda-fix-yet-another-i915-pointer-leftover-in-error-path.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] Patch "Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"" has been added to the 4.9-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 7db920f717539237ba4b662ee9faf06d8817bf61 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Date: Fri, 22 Dec 2017 08:43:23 +0100 Subject: Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> This reverts commit 7336f5481f6cf913a2d29d98c6e11f4bbe19d3b2 which is commit a0085f2510e8976614ad8f766b209448b385492f upstream. It causes problems with working systems, as noted by a number of the ChromeOS developers. Cc: Sukumar Ghorai <sukumar.ghorai(a)intel.com> Cc: Amit K Bag <amit.k.bag(a)intel.com> Cc: Oliver Neukum <oneukum(a)suse.com> Cc: Marcel Holtmann <marcel(a)holtmann.org> Cc: Matthias Kaehlcke <mka(a)chromium.org> Reported-by: Guenter Roeck <linux(a)roeck-us.net> Reported-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/bluetooth/btusb.c | 5 ----- 1 file changed, 5 deletions(-) --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -1059,10 +1059,6 @@ static int btusb_open(struct hci_dev *hd } data->intf->needs_remote_wakeup = 1; - /* device specific wakeup source enabled and required for USB - * remote wakeup while host is suspended - */ - device_wakeup_enable(&data->udev->dev); if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) goto done; @@ -1126,7 +1122,6 @@ static int btusb_close(struct hci_dev *h goto failed; data->intf->needs_remote_wakeup = 0; - device_wakeup_disable(&data->udev->dev); usb_autopm_put_interface(data->intf); failed: Patches currently in stable-queue which might be from gregkh(a)linuxfoundation.org are queue-4.9/thermal-drivers-hisi-fix-kernel-panic-on-alarm-interrupt.patch queue-4.9/cpuidle-validate-cpu_dev-in-cpuidle_add_sysfs.patch queue-4.9/bna-integer-overflow-bug-in-debugfs.patch queue-4.9/cpuidle-fix-broadcast-control-when-broadcast-can-not-be-entered.patch queue-4.9/hwmon-asus_atk0110-fix-uninitialized-data-access.patch queue-4.9/r8152-fix-the-list-rx_done-may-be-used-without-initialization.patch queue-4.9/scsi-cxgb4i-fix-tx-skb-leak.patch queue-4.9/xhci-plat-register-shutdown-for-xhci_plat.patch queue-4.9/x86-mm-refactor-flush_tlb_mm_range-to-merge-local-and-remote-cases.patch queue-4.9/hwmon-max31790-set-correct-pwm-value.patch queue-4.9/kvm-pci-assign-do-not-map-smm-memory-slot-pages-in-vt-d-page-tables.patch queue-4.9/x86-kvm-vmx-remove-unused-variable-in-segment_base.patch queue-4.9/arm-dma-mapping-disallow-dma_get_sgtable-for-non-kernel-managed-memory.patch queue-4.9/kvm-fix-usage-of-uninit-spinlock-in-avic_vm_destroy.patch queue-4.9/tracing-exclude-generic-fields-from-histograms.patch queue-4.9/revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup.patch queue-4.9/infiniband-fix-alignment-of-mmap-cookies-to-support-vipt-caching.patch queue-4.9/backlight-pwm_bl-fix-overflow-condition.patch queue-4.9/arm-kprobes-fix-the-return-address-of-multiple-kretprobes.patch queue-4.9/x86-mm-pass-flush_tlb_info-to-flush_tlb_others-etc.patch queue-4.9/x86-unify-tss_struct.patch queue-4.9/net-moxa-fix-tx-overrun-memory-leak.patch queue-4.9/netfilter-nfnetlink_queue-fix-secctx-memory-leak.patch queue-4.9/tcp-fix-under-evaluated-ssthresh-in-tcp-vegas.patch queue-4.9/x86-mm-rework-lazy-tlb-to-track-the-actual-loaded-mm.patch queue-4.9/clk-sunxi-ng-sun6i-rename-hdmi-ddc-clock-to-avoid-name-collision.patch queue-4.9/netfilter-nfnl_cthelper-fix-runtime-expectation-policy-updates.patch queue-4.9/asoc-img-parallel-out-add-pm_runtime_get-put-to-set_fmt-callback.patch queue-4.9/x86-mm-kvm-teach-kvm-s-vmx-code-that-cr3-isn-t-a-constant.patch queue-4.9/r8152-prevent-the-driver-from-transmitting-packets-with-carrier-off.patch queue-4.9/x86-mm-use-new-merged-flush-logic-in-arch_tlbbatch_flush.patch queue-4.9/i2c-mux-pca954x-add-missing-pca9546-definition-to-chip_desc.patch queue-4.9/cpuidle-powernv-pass-correct-drv-cpumask-for-registration.patch queue-4.9/i40iw-receive-netdev-events-post-inet_notifier-state.patch queue-4.9/netfilter-nfnl_cthelper-fix-a-race-when-walk-the-nf_ct_helper_hash-table.patch queue-4.9/platform-x86-asus-wireless-send-an-ev_syn-syn_report-between-state-changes.patch queue-4.9/net-ipv6-send-ns-for-dad-when-link-operationally-up.patch queue-4.9/ib-rxe-increment-msn-only-when-completing-a-request.patch queue-4.9/sch_dsmark-fix-invalid-skb_cow-usage.patch queue-4.9/btrfs-fix-an-integer-overflow-check.patch queue-4.9/crypto-crypto4xx-increase-context-and-scatter-ring-buffer-elements.patch queue-4.9/i40e-do-not-enable-napi-on-q_vectors-that-have-no-rings.patch queue-4.9/pinctrl-st-add-irq_request-release_resources-callbacks.patch queue-4.9/vsock-cancel-packets-when-failing-to-connect.patch queue-4.9/x86-kvm-vmx-simplify-segment_base.patch queue-4.9/scsi-mpt3sas-fix-io-error-occurs-on-pulling-out-a-drive-from-raid1-volume-created-on-two-sata-drive.patch queue-4.9/kvm-vmx-flush-tlb-when-the-apic-access-address-changes.patch queue-4.9/x86-entry-unwind-create-stack-frames-for-saved-interrupt-registers.patch queue-4.9/usb-gadget-udc-remove-pointer-dereference-after-free.patch queue-4.9/thermal-drivers-hisi-fix-multiple-alarm-interrupts-firing.patch queue-4.9/nvme-loop-handle-cpu-unplug-when-re-establishing-the-controller.patch queue-4.9/tipc-fix-nametbl-deadlock-at-tipc_nametbl_unsubscribe.patch queue-4.9/kvm-x86-correct-async-page-present-tracepoint.patch queue-4.9/pci-create-sr-iov-virtfn-physfn-links-before-attaching-driver.patch queue-4.9/vsock-track-pkt-owner-vsock.patch queue-4.9/pci-avoid-bus-reset-if-bridge-itself-is-broken.patch queue-4.9/net-qmi_wwan-add-usb-ids-for-mdm6600-modem-on-motorola-droid-4.patch queue-4.9/ib-rxe-check-for-allocation-failure-on-elem.patch queue-4.9/thermal-drivers-hisi-simplify-the-temperature-step-computation.patch queue-4.9/ixgbe-fix-use-of-uninitialized-padding.patch queue-4.9/pm-opp-move-error-message-to-debug-level.patch queue-4.9/usb-gadget-f_uvc-sanity-check-wmaxpacketsize-for-superspeed.patch queue-4.9/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.9/asoc-sti-fix-reader-substream-pointer-set.patch queue-4.9/ib-core-protect-against-self-requeue-of-a-cq-work-item.patch queue-4.9/x86-mm-reduce-indentation-in-flush_tlb_func.patch queue-4.9/netfilter-nfnl_cthelper-fix-memory-leak.patch queue-4.9/irda-vlsi_ir-fix-check-for-dma-mapping-errors.patch queue-4.9/arm-dts-am335x-evmsk-adjust-mmc2-param-to-allow-suspend.patch queue-4.9/thermal-hisilicon-handle-return-value-of-clk_prepare_enable.patch queue-4.9/nbd-set-queue-timeout-properly.patch queue-4.9/r8152-fix-the-rx-early-size-of-rtl8153.patch queue-4.9/scsi-lpfc-fix-pt2pt-prli-reject.patch queue-4.9/fm10k-fix-mis-ordered-parameters-in-declaration-for-.ndo_set_vf_bw.patch queue-4.9/x86-mm-remove-the-up-asm-tlbflush.h-code-always-use-the-formerly-smp-code.patch queue-4.9/rtc-set-the-alarm-to-the-next-expiring-timer.patch queue-4.9/fm10k-ensure-we-process-sm-mbx-when-processing-vf-mbx.patch queue-4.9/bna-avoid-writing-uninitialized-data-into-hw-registers.patch queue-4.9/scsi-lpfc-plogi-failures-during-npiv-testing.patch queue-4.9/net-ipconfig-fix-ic_close_devs-use-after-free.patch queue-4.9/hid-xinmo-fix-for-out-of-range-for-tht-2p-arcade-controller.patch queue-4.9/net-phy-at803x-change-error-to-einval-for-invalid-mac.patch queue-4.9/hid-corsair-support-for-k65-k70-rapidfire-and-scimitar-pro-rgb.patch queue-4.9/s390-qeth-size-calculation-outbound-buffers.patch queue-4.9/inet-frag-release-spinlock-before-calling-icmp_send.patch queue-4.9/x86-mm-reimplement-flush_tlb_page-using-flush_tlb_mm_range.patch queue-4.9/kvm-vmx-fix-enable-vpid-conditions.patch queue-4.9/hid-corsair-add-driver-scimitar-pro-rgb-gaming-mouse-1b1c-1b3e-support-to-hid-corsair.patch queue-4.9/crypto-deadlock-between-crypto_alg_sem-rtnl_mutex-genl_mutex.patch queue-4.9/bnxt_en-fix-null-pointer-dereference-in-reopen-failure-path.patch queue-4.9/sctp-out_qlen-should-be-updated-when-pruning-unsent-queue.patch queue-4.9/kvm-nvmx-fix-host_cr3-host_cr4-cache.patch queue-4.9/s390-qeth-no-eth-header-for-outbound-af_iucv.patch queue-4.9/igb-check-memory-allocation-failure.patch queue-4.9/vhost-vsock-add-pkt-cancel-capability.patch queue-4.9/kvm-mm-account-kvm-related-kmem-slabs-to-kmemcg.patch queue-4.9/arm64-initialise-high_memory-global-variable-earlier.patch queue-4.9/scsi-lpfc-fix-secure-firmware-updates.patch queue-4.9/mm-x86-mm-make-the-batched-unmap-tlb-flush-api-more-generic.patch queue-4.9/netfilter-nf_nat_snmp-fix-panic-when-snmp_trap_helper-fails-to-register.patch queue-4.9/pci-aer-report-non-fatal-errors-only-to-the-affected-endpoint.patch queue-4.9/cxl-check-if-vphb-exists-before-iterating-over-afu-devices.patch queue-4.9/rtc-pl031-make-interrupt-optional.patch queue-4.9/ib-rxe-double-free-on-error.patch queue-4.9/net-do-not-allow-negative-values-for-busy_read-and-busy_poll-sysctl-interfaces.patch queue-4.9/x86-kvm-vmx-defer-tr-reload-after-vm-exit.patch queue-4.9/arm-dts-ti-fix-pci-bus-dtc-warnings.patch queue-4.9/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.9/vfio-pci-virtualize-maximum-payload-size.patch queue-4.9/cpufreq-fix-creation-of-symbolic-links-to-policy-directories.patch queue-4.9/virtio-balloon-use-actual-number-of-stats-for-stats-queue-buffers.patch queue-4.9/mips-math-emu-fix-final-emulation-phase-for-certain-instructions.patch queue-4.9/thermal-drivers-hisi-fix-missing-interrupt-enablement.patch queue-4.9/x86-mm-change-the-leave_mm-condition-for-local-tlb-flushes.patch queue-4.9/rdma-iser-fix-possible-mr-leak-on-device-removal-event.patch queue-4.9/x86-mm-be-more-consistent-wrt-page_shift-vs-page_size-in-tlb-flush-code.patch queue-4.9/virtio_balloon-prevent-uninitialized-variable-use.patch queue-4.9/arm-kprobes-align-stack-to-8-bytes-in-test-code.patch queue-4.9/isdn-kcapi-avoid-uninitialized-data.patch queue-4.9/staging-greybus-light-release-memory-obtained-by-kasprintf.patch queue-4.9/iommu-exynos-workaround-flpd-cache-flush-issues-for-sysmmu-v5.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] Patch "Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature"" has been added to the 4.4-stable tree

by gregkh＠linuxfoundation.org

This is a note to let you know that I've just added the patch titled Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From 7db920f717539237ba4b662ee9faf06d8817bf61 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Date: Fri, 22 Dec 2017 08:43:23 +0100 Subject: Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> This reverts commit ffc7565746bb2fc063fc0f484c55ef6d8951a6ee which is commit a0085f2510e8976614ad8f766b209448b385492f upstream. It causes problems with working systems, as noted by a number of the ChromeOS developers. Cc: Sukumar Ghorai <sukumar.ghorai(a)intel.com> Cc: Amit K Bag <amit.k.bag(a)intel.com> Cc: Oliver Neukum <oneukum(a)suse.com> Cc: Marcel Holtmann <marcel(a)holtmann.org> Cc: Matthias Kaehlcke <mka(a)chromium.org> Reported-by: Guenter Roeck <linux(a)roeck-us.net> Reported-by: Brian Norris <briannorris(a)chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/bluetooth/btusb.c | 5 ----- 1 file changed, 5 deletions(-) --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -1050,10 +1050,6 @@ static int btusb_open(struct hci_dev *hd return err; data->intf->needs_remote_wakeup = 1; - /* device specific wakeup source enabled and required for USB - * remote wakeup while host is suspended - */ - device_wakeup_enable(&data->udev->dev); if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) goto done; @@ -1117,7 +1113,6 @@ static int btusb_close(struct hci_dev *h goto failed; data->intf->needs_remote_wakeup = 0; - device_wakeup_disable(&data->udev->dev); usb_autopm_put_interface(data->intf); failed: Patches currently in stable-queue which might be from gregkh(a)linuxfoundation.org are queue-4.4/cpuidle-validate-cpu_dev-in-cpuidle_add_sysfs.patch queue-4.4/bna-integer-overflow-bug-in-debugfs.patch queue-4.4/cpuidle-fix-broadcast-control-when-broadcast-can-not-be-entered.patch queue-4.4/x86-mm-sched-core-uninline-switch_mm.patch queue-4.4/hwmon-asus_atk0110-fix-uninitialized-data-access.patch queue-4.4/r8152-fix-the-list-rx_done-may-be-used-without-initialization.patch queue-4.4/scsi-cxgb4i-fix-tx-skb-leak.patch queue-4.4/xhci-plat-register-shutdown-for-xhci_plat.patch queue-4.4/kvm-pci-assign-do-not-map-smm-memory-slot-pages-in-vt-d-page-tables.patch queue-4.4/x86-mm-add-a-noinvpcid-boot-option-to-turn-off-invpcid.patch queue-4.4/arm-dma-mapping-disallow-dma_get_sgtable-for-non-kernel-managed-memory.patch queue-4.4/x86-irq-do-not-substract-irq_tlb_count-from-irq_call_count.patch queue-4.4/x86-mm-if-invpcid-is-available-use-it-to-flush-global-mappings.patch queue-4.4/x86-mm-add-invpcid-helpers.patch queue-4.4/revert-bluetooth-btusb-driver-to-enable-the-usb-wakeup.patch queue-4.4/backlight-pwm_bl-fix-overflow-condition.patch queue-4.4/arm-kprobes-fix-the-return-address-of-multiple-kretprobes.patch queue-4.4/netfilter-nfnetlink_queue-fix-secctx-memory-leak.patch queue-4.4/mm-rmap-batched-invalidations-should-use-existing-api.patch queue-4.4/tcp-fix-under-evaluated-ssthresh-in-tcp-vegas.patch queue-4.4/netfilter-nfnl_cthelper-fix-runtime-expectation-policy-updates.patch queue-4.4/r8152-prevent-the-driver-from-transmitting-packets-with-carrier-off.patch queue-4.4/i2c-mux-pca954x-add-missing-pca9546-definition-to-chip_desc.patch queue-4.4/cpuidle-powernv-pass-correct-drv-cpumask-for-registration.patch queue-4.4/sched-core-add-switch_mm_irqs_off-and-use-it-in-the-scheduler.patch queue-4.4/netfilter-nfnl_cthelper-fix-a-race-when-walk-the-nf_ct_helper_hash-table.patch queue-4.4/sch_dsmark-fix-invalid-skb_cow-usage.patch queue-4.4/crypto-crypto4xx-increase-context-and-scatter-ring-buffer-elements.patch queue-4.4/i40e-do-not-enable-napi-on-q_vectors-that-have-no-rings.patch queue-4.4/pinctrl-st-add-irq_request-release_resources-callbacks.patch queue-4.4/arm-hide-finish_arch_post_lock_switch-from-modules.patch queue-4.4/scsi-mpt3sas-fix-io-error-occurs-on-pulling-out-a-drive-from-raid1-volume-created-on-two-sata-drive.patch queue-4.4/usb-gadget-udc-remove-pointer-dereference-after-free.patch queue-4.4/kvm-x86-correct-async-page-present-tracepoint.patch queue-4.4/pci-create-sr-iov-virtfn-physfn-links-before-attaching-driver.patch queue-4.4/pci-avoid-bus-reset-if-bridge-itself-is-broken.patch queue-4.4/net-qmi_wwan-add-usb-ids-for-mdm6600-modem-on-motorola-droid-4.patch queue-4.4/ixgbe-fix-use-of-uninitialized-padding.patch queue-4.4/usb-gadget-f_uvc-sanity-check-wmaxpacketsize-for-superspeed.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-820-g2.patch queue-4.4/x86-mm-sched-core-turn-off-irqs-in-switch_mm.patch queue-4.4/netfilter-nfnl_cthelper-fix-memory-leak.patch queue-4.4/irda-vlsi_ir-fix-check-for-dma-mapping-errors.patch queue-4.4/arm-dts-am335x-evmsk-adjust-mmc2-param-to-allow-suspend.patch queue-4.4/thermal-hisilicon-handle-return-value-of-clk_prepare_enable.patch queue-4.4/scsi-lpfc-fix-pt2pt-prli-reject.patch queue-4.4/rtc-set-the-alarm-to-the-next-expiring-timer.patch queue-4.4/fm10k-ensure-we-process-sm-mbx-when-processing-vf-mbx.patch queue-4.4/bna-avoid-writing-uninitialized-data-into-hw-registers.patch queue-4.4/scsi-lpfc-plogi-failures-during-npiv-testing.patch queue-4.4/hid-xinmo-fix-for-out-of-range-for-tht-2p-arcade-controller.patch queue-4.4/mm-mmu_context-sched-core-fix-mmu_context.h-assumption.patch queue-4.4/net-phy-at803x-change-error-to-einval-for-invalid-mac.patch queue-4.4/x86-mm-fix-invpcid-asm-constraint.patch queue-4.4/x86-mm-build-arch-x86-mm-tlb.c-even-on-smp.patch queue-4.4/inet-frag-release-spinlock-before-calling-icmp_send.patch queue-4.4/kvm-vmx-fix-enable-vpid-conditions.patch queue-4.4/crypto-deadlock-between-crypto_alg_sem-rtnl_mutex-genl_mutex.patch queue-4.4/bnxt_en-fix-null-pointer-dereference-in-reopen-failure-path.patch queue-4.4/s390-qeth-no-eth-header-for-outbound-af_iucv.patch queue-4.4/igb-check-memory-allocation-failure.patch queue-4.4/arm64-initialise-high_memory-global-variable-earlier.patch queue-4.4/scsi-lpfc-fix-secure-firmware-updates.patch queue-4.4/netfilter-nf_nat_snmp-fix-panic-when-snmp_trap_helper-fails-to-register.patch queue-4.4/pci-aer-report-non-fatal-errors-only-to-the-affected-endpoint.patch queue-4.4/cxl-check-if-vphb-exists-before-iterating-over-afu-devices.patch queue-4.4/rtc-pl031-make-interrupt-optional.patch queue-4.4/net-do-not-allow-negative-values-for-busy_read-and-busy_poll-sysctl-interfaces.patch queue-4.4/arm-dts-ti-fix-pci-bus-dtc-warnings.patch queue-4.4/alsa-hda-add-support-for-docking-station-for-hp-840-g3.patch queue-4.4/mips-math-emu-fix-final-emulation-phase-for-certain-instructions.patch queue-4.4/rdma-iser-fix-possible-mr-leak-on-device-removal-event.patch queue-4.4/arm-kprobes-align-stack-to-8-bytes-in-test-code.patch queue-4.4/isdn-kcapi-avoid-uninitialized-data.patch queue-4.4/sched-core-idle_task_exit-shouldn-t-use-switch_mm_irqs_off.patch

7 years, 1 month

1
0
0 0

[Linux-stable-mirror] [PATCH v2 2/2] libnvdimm, btt: Fix an incompatibility in the log layout

by Vishal Verma

Due to a spec misinterpretation, the Linux implementation of the BTT log area had different padding scheme from other implementations, such as UEFI and NVML. This fixes the padding scheme, and defaults to it for new BTT layouts. We attempt to detect the padding scheme in use when probing for an existing BTT. If we detect the older/incompatible scheme, we continue using it. Reported-by: Juston Li <juston.li(a)intel.com> Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: <stable(a)vger.kernel.org> Fixes: 5212e11fde4d ("nd_btt: atomic sector updates") Signed-off-by: Vishal Verma <vishal.l.verma(a)intel.com> --- drivers/nvdimm/btt.c | 201 ++++++++++++++++++++++++++++++++++++++++++--------- drivers/nvdimm/btt.h | 45 +++++++++++- 2 files changed, 211 insertions(+), 35 deletions(-) diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c index e949e3302af4..c586bcdb5190 100644 --- a/drivers/nvdimm/btt.c +++ b/drivers/nvdimm/btt.c @@ -211,12 +211,12 @@ static int btt_map_read(struct arena_info *arena, u32 lba, u32 *mapping, return ret; } -static int btt_log_read_pair(struct arena_info *arena, u32 lane, - struct log_entry *ent) +static int btt_log_group_read(struct arena_info *arena, u32 lane, + struct log_group *log) { return arena_read_bytes(arena, - arena->logoff + (2 * lane * LOG_ENT_SIZE), ent, - 2 * LOG_ENT_SIZE, 0); + arena->logoff + (lane * LOG_GRP_SIZE), log, + LOG_GRP_SIZE, 0); } static struct dentry *debugfs_root; @@ -256,6 +256,8 @@ static void arena_debugfs_init(struct arena_info *a, struct dentry *parent, debugfs_create_x64("logoff", S_IRUGO, d, &a->logoff); debugfs_create_x64("info2off", S_IRUGO, d, &a->info2off); debugfs_create_x32("flags", S_IRUGO, d, &a->flags); + debugfs_create_u32("log_index_0", S_IRUGO, d, &a->log_index[0]); + debugfs_create_u32("log_index_1", S_IRUGO, d, &a->log_index[1]); } static void btt_debugfs_init(struct btt *btt) @@ -274,6 +276,11 @@ static void btt_debugfs_init(struct btt *btt) } } +static u32 log_seq(struct log_group *log, int log_idx) +{ + return le32_to_cpu(log->ent[log_idx].seq); +} + /* * This function accepts two log entries, and uses the * sequence number to find the 'older' entry. @@ -283,8 +290,10 @@ static void btt_debugfs_init(struct btt *btt) * * TODO The logic feels a bit kludge-y. make it better.. */ -static int btt_log_get_old(struct log_entry *ent) +static int btt_log_get_old(struct arena_info *a, struct log_group *log) { + int idx0 = a->log_index[0]; + int idx1 = a->log_index[1]; int old; /* @@ -292,23 +301,23 @@ static int btt_log_get_old(struct log_entry *ent) * the next time, the following logic works out to put this * (next) entry into [1] */ - if (ent[0].seq == 0) { - ent[0].seq = cpu_to_le32(1); + if (log_seq(log, idx0) == 0) { + log->ent[idx0].seq = cpu_to_le32(1); return 0; } - if (ent[0].seq == ent[1].seq) + if (log_seq(log, idx0) == log_seq(log, idx1)) return -EINVAL; - if (le32_to_cpu(ent[0].seq) + le32_to_cpu(ent[1].seq) > 5) + if (log_seq(log, idx0) + log_seq(log, idx1) > 5) return -EINVAL; - if (le32_to_cpu(ent[0].seq) < le32_to_cpu(ent[1].seq)) { - if (le32_to_cpu(ent[1].seq) - le32_to_cpu(ent[0].seq) == 1) + if (log_seq(log, idx0) < log_seq(log, idx1)) { + if ((log_seq(log, idx1) - log_seq(log, idx0)) == 1) old = 0; else old = 1; } else { - if (le32_to_cpu(ent[0].seq) - le32_to_cpu(ent[1].seq) == 1) + if ((log_seq(log, idx0) - log_seq(log, idx1)) == 1) old = 1; else old = 0; @@ -328,17 +337,18 @@ static int btt_log_read(struct arena_info *arena, u32 lane, { int ret; int old_ent, ret_ent; - struct log_entry log[2]; + struct log_group log; - ret = btt_log_read_pair(arena, lane, log); + ret = btt_log_group_read(arena, lane, &log); if (ret) return -EIO; - old_ent = btt_log_get_old(log); + old_ent = btt_log_get_old(arena, &log); if (old_ent < 0 || old_ent > 1) { dev_err(to_dev(arena), "log corruption (%d): lane %d seq [%d, %d]\n", - old_ent, lane, log[0].seq, log[1].seq); + old_ent, lane, log.ent[arena->log_index[0]].seq, + log.ent[arena->log_index[1]].seq); /* TODO set error state? */ return -EIO; } @@ -346,7 +356,7 @@ static int btt_log_read(struct arena_info *arena, u32 lane, ret_ent = (old_flag ? old_ent : (1 - old_ent)); if (ent != NULL) - memcpy(ent, &log[ret_ent], LOG_ENT_SIZE); + memcpy(ent, &log.ent[arena->log_index[ret_ent]], LOG_ENT_SIZE); return ret_ent; } @@ -360,17 +370,13 @@ static int __btt_log_write(struct arena_info *arena, u32 lane, u32 sub, struct log_entry *ent, unsigned long flags) { int ret; - /* - * Ignore the padding in log_entry for calculating log_half. - * The entry is 'committed' when we write the sequence number, - * and we want to ensure that that is the last thing written. - * We don't bother writing the padding as that would be extra - * media wear and write amplification - */ - unsigned int log_half = (LOG_ENT_SIZE - 2 * sizeof(u64)) / 2; - u64 ns_off = arena->logoff + (((2 * lane) + sub) * LOG_ENT_SIZE); + u32 group_slot = arena->log_index[sub]; + unsigned int log_half = LOG_ENT_SIZE / 2; void *src = ent; + u64 ns_off; + ns_off = arena->logoff + (lane * LOG_GRP_SIZE) + + (group_slot * LOG_ENT_SIZE); /* split the 16B write into atomic, durable halves */ ret = arena_write_bytes(arena, ns_off, src, log_half, flags); if (ret) @@ -453,7 +459,7 @@ static int btt_log_init(struct arena_info *arena) { size_t logsize = arena->info2off - arena->logoff; size_t chunk_size = SZ_4K, offset = 0; - struct log_entry log; + struct log_entry ent; void *zerobuf; int ret; u32 i; @@ -485,11 +491,11 @@ static int btt_log_init(struct arena_info *arena) } for (i = 0; i < arena->nfree; i++) { - log.lba = cpu_to_le32(i); - log.old_map = cpu_to_le32(arena->external_nlba + i); - log.new_map = cpu_to_le32(arena->external_nlba + i); - log.seq = cpu_to_le32(LOG_SEQ_INIT); - ret = __btt_log_write(arena, i, 0, &log, 0); + ent.lba = cpu_to_le32(i); + ent.old_map = cpu_to_le32(arena->external_nlba + i); + ent.new_map = cpu_to_le32(arena->external_nlba + i); + ent.seq = cpu_to_le32(LOG_SEQ_INIT); + ret = __btt_log_write(arena, i, 0, &ent, 0); if (ret) goto free; } @@ -594,6 +600,123 @@ static int btt_freelist_init(struct arena_info *arena) return 0; } +static bool ent_is_padding(struct log_entry *ent) +{ + return (ent->lba == 0) && (ent->old_map == 0) && (ent->new_map == 0) + && (ent->seq == 0); +} + +/* + * Detecting valid log indices: We read a log group (see the comments in btt.h + * for a description of a 'log_group' and its 'slots'), and iterate over its + * four slots. We expect that a padding slot will be all-zeroes, and use this + * to detect a padding slot vs. an actual entry. + * + * If a log_group is in the initial state, i.e. hasn't been used since the + * creation of this BTT layout, it will have three of the four slots with + * zeroes. We skip over these log_groups for the detection of log_index. If + * all log_groups are in the initial state (i.e. the BTT has never been + * written to), it is safe to assume the 'new format' of log entries in slots + * (0, 1). + */ +static int log_set_indices(struct arena_info *arena) +{ + bool idx_set = false, initial_state = true; + int ret, log_index[2] = {-1, -1}; + u32 i, j, next_idx = 0; + struct log_group log; + u32 pad_count = 0; + + for (i = 0; i < arena->nfree; i++) { + ret = btt_log_group_read(arena, i, &log); + if (ret < 0) + return ret; + + for (j = 0; j < 4; j++) { + if (!idx_set) { + if (ent_is_padding(&log.ent[j])) { + pad_count++; + continue; + } else { + /* Skip if index has been recorded */ + if ((next_idx == 1) && + (j == log_index[0])) + continue; + /* valid entry, record index */ + log_index[next_idx] = j; + next_idx++; + } + if (next_idx == 2) { + /* two valid entries found */ + idx_set = true; + } else if (next_idx > 2) { + /* too many valid indices */ + return -ENXIO; + } + } else { + /* + * once the indices have been set, just verify + * that all subsequent log groups are either in + * their initial state or follow the same + * indices. + */ + if (j == log_index[0]) { + /* entry must be 'valid' */ + if (ent_is_padding(&log.ent[j])) + return -ENXIO; + } else if (j == log_index[1]) { + ; + /* + * log_index[1] can be padding if the + * lane never got used and it is still + * in the initial state (three 'padding' + * entries) + */ + } else { + /* entry must be invalid (padding) */ + if (!ent_is_padding(&log.ent[j])) + return -ENXIO; + } + } + } + /* + * If any of the log_groups have more than one valid, + * non-padding entry, then the we are no longer in the + * initial_state + */ + if (pad_count < 3) + initial_state = false; + pad_count = 0; + } + + if (!initial_state && !idx_set) + return -ENXIO; + + /* + * If all the entries in the log were in the initial state, + * assume new padding scheme + */ + if (initial_state) + log_index[1] = 1; + + /* + * Only allow the known permutations of log/padding indices, + * i.e. (0, 1), and (0, 2) + */ + if ((log_index[0] == 0) && ((log_index[1] == 1) || (log_index[1] == 2))) + ; /* known index possibilities */ + else { + dev_err(to_dev(arena), "Found an unknown padding scheme\n"); + return -ENXIO; + } + + arena->log_index[0] = log_index[0]; + arena->log_index[1] = log_index[1]; + dev_dbg(to_dev(arena), "log_index_0 = %d\n", log_index[0]); + dev_dbg(to_dev(arena), "log_index_1 = %d\n", log_index[1]); + return 0; +} + static int btt_rtt_init(struct arena_info *arena) { arena->rtt = kcalloc(arena->nfree, sizeof(u32), GFP_KERNEL); @@ -650,8 +773,7 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size, available -= 2 * BTT_PG_SIZE; /* The log takes a fixed amount of space based on nfree */ - logsize = roundup(2 * arena->nfree * sizeof(struct log_entry), - BTT_PG_SIZE); + logsize = roundup(arena->nfree * LOG_GRP_SIZE, BTT_PG_SIZE); available -= logsize; /* Calculate optimal split between map and data area */ @@ -668,6 +790,10 @@ static struct arena_info *alloc_arena(struct btt *btt, size_t size, arena->mapoff = arena->dataoff + datasize; arena->logoff = arena->mapoff + mapsize; arena->info2off = arena->logoff + logsize; + + /* Default log indices are (0,1) */ + arena->log_index[0] = 0; + arena->log_index[1] = 1; return arena; } @@ -758,6 +884,13 @@ static int discover_arenas(struct btt *btt) arena->external_lba_start = cur_nlba; parse_arena_meta(arena, super, cur_off); + ret = log_set_indices(arena); + if (ret) { + dev_err(to_dev(arena), + "Unable to deduce log/padding indices\n"); + goto out; + } + mutex_init(&arena->err_lock); ret = btt_freelist_init(arena); if (ret) diff --git a/drivers/nvdimm/btt.h b/drivers/nvdimm/btt.h index 884fbbbdd18a..db3cb6d4d0d4 100644 --- a/drivers/nvdimm/btt.h +++ b/drivers/nvdimm/btt.h @@ -27,6 +27,7 @@ #define MAP_ERR_MASK (1 << MAP_ERR_SHIFT) #define MAP_LBA_MASK (~((1 << MAP_TRIM_SHIFT) | (1 << MAP_ERR_SHIFT))) #define MAP_ENT_NORMAL 0xC0000000 +#define LOG_GRP_SIZE sizeof(struct log_group) #define LOG_ENT_SIZE sizeof(struct log_entry) #define ARENA_MIN_SIZE (1UL << 24) /* 16 MB */ #define ARENA_MAX_SIZE (1ULL << 39) /* 512 GB */ @@ -50,12 +51,52 @@ enum btt_init_state { INIT_READY }; +/* + * A log group represents one log 'lane', and consists of four log entries. + * Two of the four entries are valid entries, and the remaining two are + * padding. Due to an old bug in the padding location, we need to perform a + * test to determine the padding scheme being used, and use that scheme + * thereafter. + * + * In kernels prior to 4.15, 'log group' would have actual log entries at + * indices (0, 2) and padding at indices (1, 3), where as the correct/updated + * format has log entries at indices (0, 1) and padding at indices (2, 3). + * + * Old (pre 4.15) format: + * +-----------------+-----------------+ + * | ent[0] | ent[1] | + * | 16B | 16B | + * | lba/old/new/seq | pad | + * +-----------------------------------+ + * | ent[2] | ent[3] | + * | 16B | 16B | + * | lba/old/new/seq | pad | + * +-----------------+-----------------+ + * + * New format: + * +-----------------+-----------------+ + * | ent[0] | ent[1] | + * | 16B | 16B | + * | lba/old/new/seq | lba/old/new/seq | + * +-----------------------------------+ + * | ent[2] | ent[3] | + * | 16B | 16B | + * | pad | pad | + * +-----------------+-----------------+ + * + * We detect during start-up which format is in use, and set + * arena->log_index[(0, 1)] with the detected format. + */ + struct log_entry { __le32 lba; __le32 old_map; __le32 new_map; __le32 seq; - __le64 padding[2]; +}; + +struct log_group { + struct log_entry ent[4]; }; struct btt_sb { @@ -126,6 +167,7 @@ struct aligned_lock { * @debugfs_dir: Debugfs dentry * @flags: Arena flags - may signify error states. * @err_lock: Mutex for synchronizing error clearing. + * @log_index: Indices of the valid log entries in a log_group * * arena_info is a per-arena handle. Once an arena is narrowed down for an * IO, this struct is passed around for the duration of the IO. @@ -158,6 +200,7 @@ struct arena_info { /* Arena flags */ u32 flags; struct mutex err_lock; + int log_index[2]; }; /** -- 2.14.3

7 years, 1 month

2
1
0 0

[Linux-stable-mirror] [PATCH] libnvdimm, pfn: fix start_pad handling for aligned namespaces

by Dan Williams

The alignment checks at pfn driver startup fail to properly account for the 'start_pad' in the case where the namespace is misaligned relative to its internal alignment. This is typically triggered in 1G aligned namespace, but could theoretically trigger with small namespace alignments. When this triggers the kernel reports messages of the form: dax2.1: bad offset: 0x3c000000 dax disabled align: 0x40000000 Cc: <stable(a)vger.kernel.org> Fixes: 1ee6667cd8d1 ("libnvdimm, pfn, dax: fix initialization vs autodetect...") Reported-by: Jane Chu <jane.chu(a)oracle.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> --- drivers/nvdimm/pfn_devs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c index 65cc171c721d..db2fc7c02e01 100644 --- a/drivers/nvdimm/pfn_devs.c +++ b/drivers/nvdimm/pfn_devs.c @@ -364,9 +364,9 @@ struct device *nd_pfn_create(struct nd_region *nd_region) int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig) { u64 checksum, offset; - unsigned long align; enum nd_pfn_mode mode; struct nd_namespace_io *nsio; + unsigned long align, start_pad; struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb; struct nd_namespace_common *ndns = nd_pfn->ndns; const u8 *parent_uuid = nd_dev_to_uuid(&ndns->dev); @@ -410,6 +410,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig) align = le32_to_cpu(pfn_sb->align); offset = le64_to_cpu(pfn_sb->dataoff); + start_pad = le32_to_cpu(pfn_sb->start_pad); if (align == 0) align = 1UL << ilog2(offset); mode = le32_to_cpu(pfn_sb->mode); @@ -468,7 +469,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn, const char *sig) return -EBUSY; } - if ((align && !IS_ALIGNED(offset, align)) + if ((align && !IS_ALIGNED(nsio->res.start + offset + start_pad, align)) || !IS_ALIGNED(offset, PAGE_SIZE)) { dev_err(&nd_pfn->dev, "bad offset: %#llx dax disabled align: %#lx\n",

7 years, 1 month

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror December 2017