17 Jun, 2014

20 commits

  • Greg Kroah-Hartman
     
  • commit 754a292fe6b08196cb135c03b404444e17de520a upstream.

    Add support for Marvell Technology Group Ltd. 88SE91A0 SATA 6Gb/s
    Controller by adding its PCI ID.

    Signed-off-by: Andreas Schrägle
    Signed-off-by: Tejun Heo
    Signed-off-by: Greg Kroah-Hartman

    Andreas Schrägle
     
  • commit d251836508fb26cd1a22b41381739835ee23728d upstream.

    This device normally comes with a proprietary driver, using a web GUI
    to configure RAID:
    http://www.highpoint-tech.com/USA_new/series_rr600-download.htm
    But thankfully it also works out of the box with the AHCI driver,
    being just a Marvell 88SE9235.

    Devices 640L, 644L, 644LS should also be supported but not tested here.

    Signed-off-by: Jérôme Carretero
    Signed-off-by: Tejun Heo
    Signed-off-by: Greg Kroah-Hartman

    Jérôme Carretero
     
  • commit 74a86272f05c3dae40f2d7b17ff09a0608cf3304 upstream.

    Added support for Sveon STV27 device (rtl2832u + FC0013 tuner)

    Signed-off-by: Alessandro Miceli
    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Greg Kroah-Hartman

    Alessandro Miceli
     
  • commit f27f5b0ee4967babfb8b03511f5e76b79d781014 upstream.

    Added Sveon STV20 device based on Realtek RTL2832U and FC0012 tuner

    Signed-off-by: Alessandro Miceli
    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Greg Kroah-Hartman

    Alessandro Miceli
     
  • commit 9ca24ae4083665bda38da45f4b5dc9bbaf936bc0 upstream.

    Add USB ID for Peak DVB-T USB.

    [crope@iki.fi: fix Brian email address and indentation]
    Signed-off-by: Brian Healy
    Signed-off-by: Antti Palosaari
    Signed-off-by: Greg Kroah-Hartman

    Signed-off-by: Mauro Carvalho Chehab

    Brian Healy
     
  • commit 60aa4c6fa5723af72cff154a5cd33ac4995d1e0a upstream.

    Signed-off-by: Jan Vcelak
    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Greg Kroah-Hartman

    Jan Vcelak
     
  • commit ac298ccdde4fe9b0a966e548a232ff4e8a6b8a31 upstream.

    0458:707f KYE Systems Corp. (Mouse Systems) TVGo DVB-T03 [RTL2832]

    The USB dongle uses RTL2832U demodulator and FC0012 tuner.

    Signed-off-by: Jan Vcelak
    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Greg Kroah-Hartman

    Jan Vcelak
     
  • commit a24bc323eb07e2a3a751e23c172b68d1b239db67 upstream.

    I've got the following DAB USB stick that also works fine with the
    DVB_USB_RTL28XXU driver after I added its USB ID:
    Bus 001 Device 009: ID 0ccd:00b4 TerraTec Electronic GmbH

    [crope@iki.fi: apply patch partly manually]
    Signed-off-by: Till Dörges
    Signed-off-by: Antti Palosaari
    Signed-off-by: Mauro Carvalho Chehab
    Signed-off-by: Greg Kroah-Hartman

    Till Dörges
     
  • commit c40765d919d25d2d44d99c4ce39e48808f137e1e upstream.

    According the spec the host should read H_CSR again
    after asserting reset H_RST to ensure that reset was
    read by the firmware

    Signed-off-by: Tomas Winkler
    Signed-off-by: Alexander Usyskin
    Signed-off-by: Greg Kroah-Hartman

    Tomas Winkler
     
  • commit 07cd7be3d92eeeae1f92a017f2cfe4fdd9256526 upstream.

    It my take time till ME_RDY will be cleared after the reset,
    so we cannot check the bit before we got the interrupt

    Signed-off-by: Tomas Winkler
    Signed-off-by: Alexander Usyskin
    Signed-off-by: Greg Kroah-Hartman

    Tomas Winkler
     
  • commit b04ada92ffaabb868497a1fce8e4f6bf74e5488f upstream.

    We cleared H_RST for H_CSR on spurious interrupt generated when ME_RDY
    while cleared and not while ME_RDY is set. The spurious interrupt
    is not delivered on all platforms in this case the
    driver may fail to initialize.

    Signed-off-by: Tomas Winkler
    Signed-off-by: Alexander Usyskin
    Signed-off-by: Greg Kroah-Hartman

    Tomas Winkler
     
  • commit b701c0b1fe819a2083fc6ec5332e0e4492b9516d upstream.

    free_msi_irqs() is leaking memory, since list_for_each_entry(entry,
    &dev->msi_list, list) {...} is never executed, because dev->msi_list is
    made empty by the loop just above this one.

    Fix it by relying on zero termination of attribute array like
    populate_msi_sysfs() does.

    Fixes: 1c51b50c2995 ("PCI/MSI: Export MSI mode using attributes, not kobjects")
    Signed-off-by: Alexei Starovoitov
    Signed-off-by: Bjorn Helgaas
    Acked-by: Neil Horman
    Acked-by: Greg Kroah-Hartman
    Signed-off-by: Greg Kroah-Hartman

    Alexei Starovoitov
     
  • commit a3c54931199565930d6d84f4c3456f6440aefd41 upstream.

    Fixes an easy DoS and possible information disclosure.

    This does nothing about the broken state of x32 auditing.

    eparis: If the admin has enabled auditd and has specifically loaded
    audit rules. This bug has been around since before git. Wow...

    Signed-off-by: Andy Lutomirski
    Signed-off-by: Eric Paris
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Andy Lutomirski
     
  • commit e7810c2d2c37fa8e58dda74b00790dab60fe6fba upstream.

    This patch allows READ_CAPACITY + SAI_READ_CAPACITY_16 opcode
    processing to occur while the associated ALUA group is in Standby
    access state.

    This is required to avoid host side LUN probe failures during the
    initial scan if an ALUA group has already implicitly changed into
    Standby access state.

    This addresses a bug reported by Chris + Philip using dm-multipath
    + ESX hosts configured with ALUA multipath.

    (Drop v3.15 specific set_ascq usage - nab)

    Reported-by: Chris Boot
    Reported-by: Philip Gaw
    Cc: Chris Boot
    Cc: Philip Gaw
    Cc: Hannes Reinecke
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Nicholas Bellinger
     
  • commit 2363d196686e44c0158929e7cf96c8589a24a81b upstream.

    This patch fixes a iser-target specific regression introduced in
    v3.15-rc6 with:

    commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a
    Author: Sagi Grimberg
    Date: Tue Apr 29 13:13:47 2014 +0300

    Target/iscsi,iser: Avoid accepting transport connections during stop stage

    where the change to set iscsi_np->enabled = false within
    iscsit_clear_tpg_np_login_thread() meant that a iscsi_np with
    two iscsi_tpg_np exports would have it's parent iscsi_np set
    to a disabled state, even if other iscsi_tpg_np exports still
    existed.

    This patch changes iscsit_clear_tpg_np_login_thread() to only
    set iscsi_np->enabled = false when shutdown = true, and also
    changes iscsit_del_np() to set iscsi_np->enabled = true when
    iscsi_np->np_exports is non zero.

    Cc: Sagi Grimberg
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Nicholas Bellinger
     
  • commit 14f4b54fe38f3a8f8392a50b951c8aa43b63687a upstream.

    When the target is in stop stage, iSER transport initiates RDMA disconnects.
    The iSER initiator may wish to establish a new connection over the
    still existing network portal. In this case iSER transport should not
    accept and resume new RDMA connections. In order to learn that, iscsi_np
    is added with enabled flag so the iSER transport can check when deciding
    weather to accept and resume a new connection request.

    The iscsi_np is enabled after successful transport setup, and disabled
    before iscsi_np login threads are cleaned up.

    Signed-off-by: Sagi Grimberg
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Sagi Grimberg
     
  • commit 137f7df8cead00688524c82360930845396b8a21 upstream.

    Add _TIF_SECCOMP flag to _TIF_WORK_SYSCALL_ENTRY to indicate
    that the system call needs to be checked against a seccomp filter.

    Signed-off-by: Markos Chandras
    Reviewed-by: Paul Burton
    Reviewed-by: James Hogan
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/6405/
    Signed-off-by: Ralf Baechle
    Cc: Ben Hutchings
    Signed-off-by: Greg Kroah-Hartman

    Markos Chandras
     
  • commit 895162b1101b3ea5db08ca6822ae9672717efec0 upstream.

    else we may fail to forward skb even if original fragments do fit
    outgoing link mtu:

    1. remote sends 2k packets in two 1000 byte frags, DF set
    2. we want to forward but only see '2k > mtu and DF set'
    3. we then send icmp error saying that outgoing link is 1500

    But original sender never sent a packet that would not fit
    the outgoing link.

    Setting local_df makes outgoing path test size vs.
    IPCB(skb)->frag_max_size, so we will still send the correct
    error in case the largest original size did not fit
    outgoing link mtu.

    Reported-by: Maxime Bizon
    Suggested-by: Maxime Bizon
    Fixes: 5f2d04f1f9 (ipv4: fix path MTU discovery with connection tracking)
    Signed-off-by: Florian Westphal
    Signed-off-by: Pablo Neira Ayuso
    Cc: Jiri Slaby
    Signed-off-by: Greg Kroah-Hartman

    Florian Westphal
     
  • commit 23adbe12ef7d3d4195e80800ab36b37bee28cd03 upstream.

    The kernel has no concept of capabilities with respect to inodes; inodes
    exist independently of namespaces. For example, inode_capable(inode,
    CAP_LINUX_IMMUTABLE) would be nonsense.

    This patch changes inode_capable to check for uid and gid mappings and
    renames it to capable_wrt_inode_uidgid, which should make it more
    obvious what it does.

    Fixes CVE-2014-4014.

    Cc: Theodore Ts'o
    Cc: Serge Hallyn
    Cc: "Eric W. Biederman"
    Cc: Dave Chinner
    Signed-off-by: Andy Lutomirski
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Andy Lutomirski
     

12 Jun, 2014

20 commits

  • Greg Kroah-Hartman
     
  • Based on commit ea8ea460c9ace60bbb5ac6e5521d637d5c15293d upstream

    This missing IOTLB flush was added as a minor, inconsequential bug-fix
    in commit ea8ea460c ("iommu/vt-d: Clean up and fix page table clear/free
    behaviour") in 3.15. It wasn't originally intended for -stable but a
    couple of users have reported issues which turn out to be fixed by
    adding the missing flush.

    Signed-off-by: David Woodhouse

    David Woodhouse
     
  • commit 99e4b98dbe3ad1fe38a74d12c3b8d44a55930de4 upstream.

    The chips variable needs to be incremented for each chip that is
    found in the spi_present_mask when registering via device tree.
    Without this and the checking a negative index is passed to the
    data->chip array in a subsequent loop.

    Signed-off-by: Michael Welling
    Acked-by: Peter Korsgaard
    Signed-off-by: Linus Walleij
    Signed-off-by: Greg Kroah-Hartman

    Michael Welling
     
  • commit 80f65de3c9b8101c1613fa82df500ba6a099a11c upstream.

    Atm we set the parent of the dp i2c device to be the correspondig
    connector device. During driver cleanup we first remove the connector
    device through intel_modeset_cleanup()->drm_sysfs_connector_remove() and
    only after that the i2c device through the encoder's destroy callback.
    This order is not supported by the device core and we'll get a warning,
    see the below bugzilla ticket. The proper order is to remove first any
    child device and only then the parent device.

    The first part of the fix changes the i2c device's parent to be the drm
    device. Its logical owner is not the connector anyway, but the encoder.
    Since the encoder doesn't have a device object, the next best choice is
    the drm device. This is the same what we do in the case of the sdvo i2c
    device and what the nouveau driver does.

    The second part creates a symlink in the connector's sysfs directory
    pointing to the i2c device. This is so, that we keep the current ABI,
    which also makes sense in case someone wants to look up the i2c device
    belonging to a specific connector.

    Reference: http://lists.freedesktop.org/archives/intel-gfx/2014-January/038782.html
    Reference: http://lists.freedesktop.org/archives/intel-gfx/2014-February/039427.html
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=70523
    Signed-off-by: Imre Deak
    Reviewed-by: Antti Koskipää
    Signed-off-by: Daniel Vetter
    Cc: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Imre Deak
     
  • commit 4932e2c3c716067f3580e1a9687bed9d751549e3 upstream.

    Since

    commit d9255d57147e1dbcebdf6670409c2fa0ac3609e6
    Author: Paulo Zanoni
    Date:   Thu Sep 26 20:05:59 2013 -0300

    it became clear that we need to separate the unload sequence into two
    parts:

    1. remove all interfaces through which new operations on some object
    (crtc, encoder, connector) can be started and make sure all pending
    operations are completed
    2. do the actual tear down of the internal representation of the above
    objects

    The above commit achieved this separation for connectors by splitting
    out the sysfs removal part from the connector's destroy callback and
    doing this removal before calling drm_mode_config_cleanup() which does
    the actual tear-down of all the drm objects.

    Since we'll have to customize the interface removal part for different
    types of connectors in the upcoming patches, add a new unregister
    callback and move the interface removal part to it.

    No functional change.

    Signed-off-by: Imre Deak
    Reviewed-by: Antti Koskipää
    Signed-off-by: Daniel Vetter
    Cc: Jani Nikula
    Signed-off-by: Greg Kroah-Hartman

    Imre Deak
     
  • commit ecd15dd7e45f3683fa8142b9f2c015dfaa0c243d upstream.

    This bug manifests when calling the nft command line tool without
    nf_tables kernel support.

    kernel message:
    [ 44.071555] Netfilter messages via NETLINK v0.30.
    [ 44.072253] BUG: unable to handle kernel NULL pointer dereference at 0000000000000119
    [ 44.072264] IP: [] netlink_getsockbyportid+0xf/0x70
    [ 44.072272] PGD 7f2b74067 PUD 7f2b73067 PMD 0
    [ 44.072277] Oops: 0000 [#1] SMP
    [...]
    [ 44.072369] Call Trace:
    [ 44.072373] [] netlink_unicast+0x91/0x200
    [ 44.072377] [] netlink_ack+0x99/0x110
    [ 44.072381] [] nfnetlink_rcv+0x3c1/0x408 [nfnetlink]
    [ 44.072385] [] netlink_unicast+0xf3/0x200
    [ 44.072389] [] netlink_sendmsg+0x2ff/0x740
    [ 44.072394] [] ? __mmdrop+0x62/0x90
    [ 44.072398] [] sock_sendmsg+0x8b/0xc0
    [ 44.072403] [] ? copy_user_enhanced_fast_string+0x5/0x10
    [ 44.072406] [] ? move_addr_to_kernel+0x2c/0x50
    [ 44.072410] [] ___sys_sendmsg+0x3c3/0x3d0
    [ 44.072415] [] ? handle_mm_fault+0xa9a/0xc60
    [ 44.072420] [] ? mmap_region+0x166/0x5a0
    [ 44.072424] [] ? __do_page_fault+0x1dc/0x510
    [ 44.072428] [] ? apparmor_capable+0x1c/0x60
    [ 44.072435] [] ? _raw_spin_unlock_bh+0x1a/0x20
    [ 44.072439] [] ? release_sock+0x106/0x150
    [ 44.072443] [] __sys_sendmsg+0x42/0x80
    [ 44.072446] [] SyS_sendmsg+0x12/0x20
    [ 44.072450] [] system_call_fastpath+0x1a/0x1f

    Signed-off-by: Denys Fedoryshchenko
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Greg Kroah-Hartman

    Denys Fedoryshchenko
     
  • commit a8951d5814e1373807a94f79f7ccec7041325470 upstream.

    Dst is released one line before we access it again with dst->error.

    Fixes: 58e35d147128 netfilter: ipv6: propagate routing errors from
    ip6_route_me_harder()

    Signed-off-by: Sergey Popovich
    Signed-off-by: Pablo Neira Ayuso
    Signed-off-by: Greg Kroah-Hartman

    Sergey Popovich
     
  • commit f1453773514bb8b0bba0716301e8c8f17f8d39c7 upstream.

    This patch fixes a OOPs where an attempt to write to the per-device
    alua_access_state configfs attribute at:

    /sys/kernel/config/target/core/$HBA/$DEV/alua/$TG_PT_GP/alua_access_state

    results in an NULL pointer dereference when the backend device has not
    yet been configured.

    This patch adds an explicit check for DF_CONFIGURED, and fails with
    -ENODEV to avoid this case.

    Reported-by: Chris Boot
    Reported-by: Philip Gaw
    Cc: Chris Boot
    Cc: Philip Gaw
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Nicholas Bellinger
     
  • commit 79d59d08082dd0a0a18f8ceb78c99f9f321d72aa upstream.

    In non-leading connection login, iscsi_login_non_zero_tsih_s1() calls
    iscsi_change_param_value() with the buffer it uses to hold the login
    PDU, not a temporary buffer. This leads to the login header getting
    corrupted and login failing for non-leading connections in MC/S.

    Fix this by adding a wrapper iscsi_change_param_sprintf() that handles
    the temporary buffer itself to avoid confusion. Also handle sending a
    reject in case of failure in the wrapper, which lets the calling code
    get quite a bit smaller and easier to read.

    Finally, bump the size of the temporary buffer from 32 to 64 bytes to be
    safe, since "MaxRecvDataSegmentLength=" by itself is 25 bytes; with a
    trailing NUL, a value >= 1M will lead to a buffer overrun. (This isn't
    the default but we don't need to run right at the ragged edge here)

    Reported-by: Santosh Kulkarni
    Signed-off-by: Roland Dreier
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Roland Dreier
     
  • commit 6cc44a6fb46e1ecc1c28125aa8fa34d317aa9ea7 upstream.

    This patch addresses a bug where an early exception for SCSI WRITE
    with ImmediateData=Yes was missing the target_put_sess_cmd() call
    to drop the extra se_cmd->cmd_kref reference obtained during the
    normal iscsit_setup_scsi_cmd() codepath execution.

    This bug was manifesting itself during session shutdown within
    isert_cq_rx_comp_err() where target_wait_for_sess_cmds() would
    end up waiting indefinately for the last se_cmd->cmd_kref put to
    occur for the failed SCSI WRITE + ImmediateData descriptors.

    This fix follows what traditional iscsi-target code already does
    for the same failure case within iscsit_get_immediate_data().

    Reported-by: Sagi Grimberg
    Cc: Sagi Grimberg
    Cc: Or Gerlitz
    Signed-off-by: Nicholas Bellinger
    Signed-off-by: Greg Kroah-Hartman

    Nicholas Bellinger
     
  • commit 624483f3ea82598ab0f62f1bdb9177f531ab1892 upstream.

    While working address sanitizer for kernel I've discovered
    use-after-free bug in __put_anon_vma.

    For the last anon_vma, anon_vma->root freed before child anon_vma.
    Later in anon_vma_free(anon_vma) we are referencing to already freed
    anon_vma->root to check rwsem.

    This fixes it by freeing the child anon_vma before freeing
    anon_vma->root.

    Signed-off-by: Andrey Ryabinin
    Acked-by: Peter Zijlstra
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Andrey Ryabinin
     
  • commit d4c54919ed86302094c0ca7d48a8cbd4ee753e92 upstream.

    The age table walker doesn't check non-present hugetlb entry in common
    path, so hugetlb_entry() callbacks must check it. The reason for this
    behavior is that some callers want to handle it in its own way.

    [ I think that reason is bogus, btw - it should just do what the regular
    code does, which is to call the "pte_hole()" function for such hugetlb
    entries - Linus]

    However, some callers don't check it now, which causes unpredictable
    result, for example when we have a race between migrating hugepage and
    reading /proc/pid/numa_maps. This patch fixes it by adding !pte_present
    checks on buggy callbacks.

    This bug exists for years and got visible by introducing hugepage
    migration.

    ChangeLog v2:
    - fix if condition (check !pte_present() instead of pte_present())

    Reported-by: Sasha Levin
    Signed-off-by: Naoya Horiguchi
    Cc: Rik van Riel
    Signed-off-by: Andrew Morton
    [ Backported to 3.15. Signed-off-by: Josh Boyer ]
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Naoya Horiguchi
     
  • commit bf8102228a8bf053051f311e5486042fe0542894 upstream.

    This change makes the busy calculation using 64 bit math which prevents
    overflow for large values of aperf/mperf.

    Signed-off-by: Doug Smythies
    Signed-off-by: Dirk Brandewie
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Doug Smythies
     
  • commit c4ee841f602e5eef8eab673295c49c5b49d7732b upstream.

    The PID assumes that samples are of equal time, which for a deferable
    timers this is not true when the system goes idle. This causes the
    PID to take a long time to converge to the min P state and depending
    on the pattern of the idle load can make the P state appear stuck.

    The hold-off value of three sample times before using the scaling is
    to give a grace period for applications that have high performance
    requirements and spend a lot of time idle, The poster child for this
    behavior is the ffmpeg benchmark in the Phoronix test suite.

    Signed-off-by: Dirk Brandewie
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Dirk Brandewie
     
  • commit f0fe3cd7e12d8290c82284b5c8aee723cbd0371a upstream.

    Changing to fixed point math throughout the busy calculation in
    commit e66c1768 (Change busy calculation to use fixed point
    math.) Introduced some inaccuracies by rounding the busy value at two
    points in the calculation. This change removes roundings and moves
    the rounding to the output of the PID where the calculations are
    complete and the value returned as an integer.

    Fixes: e66c17683746 (intel_pstate: Change busy calculation to use fixed point math.)
    Reported-by: Doug Smythies
    Signed-off-by: Dirk Brandewie
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Dirk Brandewie
     
  • commit adacdf3f2b8e65aa441613cf61c4f598e9042690 upstream.

    Commit fcb6a15c (intel_pstate: Take core C0 time into account for core
    busy calculation) introduced a regression referenced below. The issue
    with "lockup" after suspend that this commit was addressing is now dealt
    with in the suspend path.

    Fixes: fcb6a15c2e7e (intel_pstate: Take core C0 time into account for core busy calculation)
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=66581
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=75121
    Reported-by: Doug Smythies
    Signed-off-by: Dirk Brandewie
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Dirk Brandewie
     
  • commit d37e2b764499e092ebc493d6f980827feb952e23 upstream.

    Remove unneeded sample buffers, intel_pstate operates on the most
    recent sample only. This save some memory and make the code more
    readable.

    Signed-off-by: Dirk Brandewie
    Signed-off-by: Rafael J. Wysocki
    Signed-off-by: Greg Kroah-Hartman

    Dirk Brandewie
     
  • commit 0c36b390a546055b6815d4b93a2c9fed4d980ffb upstream.

    The percpu-refcount infrastructure uses the underscore variants of
    this_cpu_ops in order to modify percpu reference counters.
    (e.g. __this_cpu_inc()).

    However the underscore variants do not atomically update the percpu
    variable, instead they may be implemented using read-modify-write
    semantics (more than one instruction). Therefore it is only safe to
    use the underscore variant if the context is always the same (process,
    softirq, or hardirq). Otherwise it is possible to lose updates.

    This problem is something that Sebastian has seen within the aio
    subsystem which uses percpu refcounters both in process and softirq
    context leading to reference counts that never dropped to zeroes; even
    though the number of "get" and "put" calls matched.

    Fix this by using the non-underscore this_cpu_ops variant which
    provides correct per cpu atomic semantics and fixes the corrupted
    reference counts.

    Cc: Kent Overstreet
    Reported-by: Sebastian Ott
    Signed-off-by: Heiko Carstens
    Signed-off-by: Tejun Heo
    References: http://lkml.kernel.org/g/alpine.LFD.2.11.1406041540520.21183@denkbrett
    Signed-off-by: Greg Kroah-Hartman

    Sebastian Ott
     
  • commit 8ef42ddd9a53b73e6fc3934278710c27f80f324f upstream.

    Not all host controller drivers have bus-suspend and bus-resume
    methods. When one doesn't, it will cause problems if runtime PM is
    enabled in the kernel. The PM core will attempt to suspend the
    controller's root hub, the suspend will fail because there is no
    bus-suspend routine, and a -EBUSY error code will be returned to the
    PM core. This will cause the suspend attempt to be repeated shortly
    thereafter, in a never-ending loop.

    Part of the problem is that the original error code -ENOENT gets
    changed to -EBUSY in usb_runtime_suspend(), on the grounds that the PM
    core will interpret -ENOENT as meaning that the root hub has gotten
    into a runtime-PM error state. While this change is appropriate for
    real USB devices, it's not such a good idea for a root hub. In fact,
    considering the root hub to be in a runtime-PM error state would not
    be far from the truth. Therefore this patch updates
    usb_runtime_suspend() so that it adjusts error codes only for
    non-root-hub devices.

    Furthermore, the patch attempts to prevent the problem from occurring
    in the first place by not enabling runtime PM by default for root hubs
    whose host controller driver doesn't have bus_suspend and bus_resume
    methods.

    Signed-off-by: Alan Stern
    Reported-by: Will Deacon
    Tested-by: Will Deacon
    Signed-off-by: Greg Kroah-Hartman

    Alan Stern
     
  • commit b38f09ccc3fd453180e96273bf3f34083c30809a upstream.

    Sony VAIO t-series machines are not capable of switching usb2 ports over
    from Intel EHCI to xHCI controller. If tried the USB2 port will be left
    unconnected and unusable.

    This patch should be backported to stable kernels as old as 3.12,
    that contain the commit 26b76798e0507429506b93cd49f8c4cfdab06896
    "Intel xhci: refactor EHCI/xHCI port switching"

    Reported-by: Jorge
    Tested-by: Jorge
    Signed-off-by: Mathias Nyman
    Signed-off-by: Greg Kroah-Hartman

    Mathias Nyman