Annotation of /trunk/kernel-alx/patches-3.10/0181-3.10.82-all-fixes.patch
Parent Directory | Revision Log
Revision 2669 -
(hide annotations)
(download)
Tue Jul 21 16:20:24 2015 UTC (9 years, 2 months ago) by niro
File size: 7862 byte(s)
Tue Jul 21 16:20:24 2015 UTC (9 years, 2 months ago) by niro
File size: 7862 byte(s)
-linux-3.10.82
1 | niro | 2669 | diff --git a/Makefile b/Makefile |
2 | index 6d19e37d36d5..5e3e665a10b7 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,6 +1,6 @@ | ||
6 | VERSION = 3 | ||
7 | PATCHLEVEL = 10 | ||
8 | -SUBLEVEL = 81 | ||
9 | +SUBLEVEL = 82 | ||
10 | EXTRAVERSION = | ||
11 | NAME = TOSSUG Baby Fish | ||
12 | |||
13 | diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c | ||
14 | index d1939a9539c0..04aefffb4dd9 100644 | ||
15 | --- a/drivers/crypto/caam/caamrng.c | ||
16 | +++ b/drivers/crypto/caam/caamrng.c | ||
17 | @@ -56,7 +56,7 @@ | ||
18 | |||
19 | /* Buffer, its dma address and lock */ | ||
20 | struct buf_data { | ||
21 | - u8 buf[RN_BUF_SIZE]; | ||
22 | + u8 buf[RN_BUF_SIZE] ____cacheline_aligned; | ||
23 | dma_addr_t addr; | ||
24 | struct completion filled; | ||
25 | u32 hw_desc[DESC_JOB_O_LEN]; | ||
26 | diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c | ||
27 | index f6341e8622ee..7bd2acce9f81 100644 | ||
28 | --- a/drivers/gpu/drm/mgag200/mgag200_mode.c | ||
29 | +++ b/drivers/gpu/drm/mgag200/mgag200_mode.c | ||
30 | @@ -1487,6 +1487,11 @@ static int mga_vga_mode_valid(struct drm_connector *connector, | ||
31 | return MODE_BANDWIDTH; | ||
32 | } | ||
33 | |||
34 | + if ((mode->hdisplay % 8) != 0 || (mode->hsync_start % 8) != 0 || | ||
35 | + (mode->hsync_end % 8) != 0 || (mode->htotal % 8) != 0) { | ||
36 | + return MODE_H_ILLEGAL; | ||
37 | + } | ||
38 | + | ||
39 | if (mode->crtc_hdisplay > 2048 || mode->crtc_hsync_start > 4096 || | ||
40 | mode->crtc_hsync_end > 4096 || mode->crtc_htotal > 4096 || | ||
41 | mode->crtc_vdisplay > 2048 || mode->crtc_vsync_start > 4096 || | ||
42 | diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c | ||
43 | index 572579f87de4..90861416b9e9 100644 | ||
44 | --- a/drivers/scsi/lpfc/lpfc_sli.c | ||
45 | +++ b/drivers/scsi/lpfc/lpfc_sli.c | ||
46 | @@ -263,6 +263,16 @@ lpfc_sli4_eq_get(struct lpfc_queue *q) | ||
47 | return NULL; | ||
48 | |||
49 | q->hba_index = idx; | ||
50 | + | ||
51 | + /* | ||
52 | + * insert barrier for instruction interlock : data from the hardware | ||
53 | + * must have the valid bit checked before it can be copied and acted | ||
54 | + * upon. Given what was seen in lpfc_sli4_cq_get() of speculative | ||
55 | + * instructions allowing action on content before valid bit checked, | ||
56 | + * add barrier here as well. May not be needed as "content" is a | ||
57 | + * single 32-bit entity here (vs multi word structure for cq's). | ||
58 | + */ | ||
59 | + mb(); | ||
60 | return eqe; | ||
61 | } | ||
62 | |||
63 | @@ -368,6 +378,17 @@ lpfc_sli4_cq_get(struct lpfc_queue *q) | ||
64 | |||
65 | cqe = q->qe[q->hba_index].cqe; | ||
66 | q->hba_index = idx; | ||
67 | + | ||
68 | + /* | ||
69 | + * insert barrier for instruction interlock : data from the hardware | ||
70 | + * must have the valid bit checked before it can be copied and acted | ||
71 | + * upon. Speculative instructions were allowing a bcopy at the start | ||
72 | + * of lpfc_sli4_fp_handle_wcqe(), which is called immediately | ||
73 | + * after our return, to copy data before the valid bit check above | ||
74 | + * was done. As such, some of the copied data was stale. The barrier | ||
75 | + * ensures the check is before any data is copied. | ||
76 | + */ | ||
77 | + mb(); | ||
78 | return cqe; | ||
79 | } | ||
80 | |||
81 | diff --git a/fs/pipe.c b/fs/pipe.c | ||
82 | index 0e0752ef2715..3e7ab278bb0c 100644 | ||
83 | --- a/fs/pipe.c | ||
84 | +++ b/fs/pipe.c | ||
85 | @@ -117,25 +117,27 @@ void pipe_wait(struct pipe_inode_info *pipe) | ||
86 | } | ||
87 | |||
88 | static int | ||
89 | -pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, | ||
90 | - int atomic) | ||
91 | +pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov, | ||
92 | + size_t *remaining, int atomic) | ||
93 | { | ||
94 | unsigned long copy; | ||
95 | |||
96 | - while (len > 0) { | ||
97 | + while (*remaining > 0) { | ||
98 | while (!iov->iov_len) | ||
99 | iov++; | ||
100 | - copy = min_t(unsigned long, len, iov->iov_len); | ||
101 | + copy = min_t(unsigned long, *remaining, iov->iov_len); | ||
102 | |||
103 | if (atomic) { | ||
104 | - if (__copy_from_user_inatomic(to, iov->iov_base, copy)) | ||
105 | + if (__copy_from_user_inatomic(addr + *offset, | ||
106 | + iov->iov_base, copy)) | ||
107 | return -EFAULT; | ||
108 | } else { | ||
109 | - if (copy_from_user(to, iov->iov_base, copy)) | ||
110 | + if (copy_from_user(addr + *offset, | ||
111 | + iov->iov_base, copy)) | ||
112 | return -EFAULT; | ||
113 | } | ||
114 | - to += copy; | ||
115 | - len -= copy; | ||
116 | + *offset += copy; | ||
117 | + *remaining -= copy; | ||
118 | iov->iov_base += copy; | ||
119 | iov->iov_len -= copy; | ||
120 | } | ||
121 | @@ -143,25 +145,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len, | ||
122 | } | ||
123 | |||
124 | static int | ||
125 | -pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len, | ||
126 | - int atomic) | ||
127 | +pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset, | ||
128 | + size_t *remaining, int atomic) | ||
129 | { | ||
130 | unsigned long copy; | ||
131 | |||
132 | - while (len > 0) { | ||
133 | + while (*remaining > 0) { | ||
134 | while (!iov->iov_len) | ||
135 | iov++; | ||
136 | - copy = min_t(unsigned long, len, iov->iov_len); | ||
137 | + copy = min_t(unsigned long, *remaining, iov->iov_len); | ||
138 | |||
139 | if (atomic) { | ||
140 | - if (__copy_to_user_inatomic(iov->iov_base, from, copy)) | ||
141 | + if (__copy_to_user_inatomic(iov->iov_base, | ||
142 | + addr + *offset, copy)) | ||
143 | return -EFAULT; | ||
144 | } else { | ||
145 | - if (copy_to_user(iov->iov_base, from, copy)) | ||
146 | + if (copy_to_user(iov->iov_base, | ||
147 | + addr + *offset, copy)) | ||
148 | return -EFAULT; | ||
149 | } | ||
150 | - from += copy; | ||
151 | - len -= copy; | ||
152 | + *offset += copy; | ||
153 | + *remaining -= copy; | ||
154 | iov->iov_base += copy; | ||
155 | iov->iov_len -= copy; | ||
156 | } | ||
157 | @@ -395,7 +399,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, | ||
158 | struct pipe_buffer *buf = pipe->bufs + curbuf; | ||
159 | const struct pipe_buf_operations *ops = buf->ops; | ||
160 | void *addr; | ||
161 | - size_t chars = buf->len; | ||
162 | + size_t chars = buf->len, remaining; | ||
163 | int error, atomic; | ||
164 | |||
165 | if (chars > total_len) | ||
166 | @@ -409,9 +413,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov, | ||
167 | } | ||
168 | |||
169 | atomic = !iov_fault_in_pages_write(iov, chars); | ||
170 | + remaining = chars; | ||
171 | redo: | ||
172 | addr = ops->map(pipe, buf, atomic); | ||
173 | - error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic); | ||
174 | + error = pipe_iov_copy_to_user(iov, addr, &buf->offset, | ||
175 | + &remaining, atomic); | ||
176 | ops->unmap(pipe, buf, addr); | ||
177 | if (unlikely(error)) { | ||
178 | /* | ||
179 | @@ -426,7 +432,6 @@ redo: | ||
180 | break; | ||
181 | } | ||
182 | ret += chars; | ||
183 | - buf->offset += chars; | ||
184 | buf->len -= chars; | ||
185 | |||
186 | /* Was it a packet buffer? Clean up and exit */ | ||
187 | @@ -531,6 +536,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, | ||
188 | if (ops->can_merge && offset + chars <= PAGE_SIZE) { | ||
189 | int error, atomic = 1; | ||
190 | void *addr; | ||
191 | + size_t remaining = chars; | ||
192 | |||
193 | error = ops->confirm(pipe, buf); | ||
194 | if (error) | ||
195 | @@ -539,8 +545,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov, | ||
196 | iov_fault_in_pages_read(iov, chars); | ||
197 | redo1: | ||
198 | addr = ops->map(pipe, buf, atomic); | ||
199 | - error = pipe_iov_copy_from_user(offset + addr, iov, | ||
200 | - chars, atomic); | ||
201 | + error = pipe_iov_copy_from_user(addr, &offset, iov, | ||
202 | + &remaining, atomic); | ||
203 | ops->unmap(pipe, buf, addr); | ||
204 | ret = error; | ||
205 | do_wakeup = 1; | ||
206 | @@ -575,6 +581,8 @@ redo1: | ||
207 | struct page *page = pipe->tmp_page; | ||
208 | char *src; | ||
209 | int error, atomic = 1; | ||
210 | + int offset = 0; | ||
211 | + size_t remaining; | ||
212 | |||
213 | if (!page) { | ||
214 | page = alloc_page(GFP_HIGHUSER); | ||
215 | @@ -595,14 +603,15 @@ redo1: | ||
216 | chars = total_len; | ||
217 | |||
218 | iov_fault_in_pages_read(iov, chars); | ||
219 | + remaining = chars; | ||
220 | redo2: | ||
221 | if (atomic) | ||
222 | src = kmap_atomic(page); | ||
223 | else | ||
224 | src = kmap(page); | ||
225 | |||
226 | - error = pipe_iov_copy_from_user(src, iov, chars, | ||
227 | - atomic); | ||
228 | + error = pipe_iov_copy_from_user(src, &offset, iov, | ||
229 | + &remaining, atomic); | ||
230 | if (atomic) | ||
231 | kunmap_atomic(src); | ||
232 | else | ||
233 | diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c | ||
234 | index 0a1edc694d67..fe3e086d38e9 100644 | ||
235 | --- a/kernel/trace/trace_events_filter.c | ||
236 | +++ b/kernel/trace/trace_events_filter.c | ||
237 | @@ -1328,19 +1328,24 @@ static int check_preds(struct filter_parse_state *ps) | ||
238 | { | ||
239 | int n_normal_preds = 0, n_logical_preds = 0; | ||
240 | struct postfix_elt *elt; | ||
241 | + int cnt = 0; | ||
242 | |||
243 | list_for_each_entry(elt, &ps->postfix, list) { | ||
244 | - if (elt->op == OP_NONE) | ||
245 | + if (elt->op == OP_NONE) { | ||
246 | + cnt++; | ||
247 | continue; | ||
248 | + } | ||
249 | |||
250 | + cnt--; | ||
251 | if (elt->op == OP_AND || elt->op == OP_OR) { | ||
252 | n_logical_preds++; | ||
253 | continue; | ||
254 | } | ||
255 | n_normal_preds++; | ||
256 | + WARN_ON_ONCE(cnt < 0); | ||
257 | } | ||
258 | |||
259 | - if (!n_normal_preds || n_logical_preds >= n_normal_preds) { | ||
260 | + if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) { | ||
261 | parse_error(ps, FILT_ERR_INVALID_FILTER, 0); | ||
262 | return -EINVAL; | ||
263 | } |