Drop patch that was superseded upstream: ramips/0036-mtd-fix-cfi-cmdset-0002-erase-status-check.patch Drop upstreamed patches: - apm821xx/020-0001-crypto-crypto4xx-remove-bad-list_del.patch - apm821xx/020-0011-crypto-crypto4xx-fix-crypto4xx_build_pdr-crypto4xx_b.patch - ath79/0011-MIPS-ath79-fix-register-address-in-ath79_ddr_wb_flus.patch - brcm63xx/001-4.15-08-bcm63xx_enet-correct-clock-usage.patch - brcm63xx/001-4.15-09-bcm63xx_enet-do-not-write-to-random-DMA-channel-on-B.patch - generic/backport/080-net-convert-sock.sk_wmem_alloc-from-atomic_t-to-refc.patch - generic/pending/170-usb-dwc2-Fix-DMA-alignment-to-start-at-allocated-boun.patch - generic/pending/900-gen_stats-fix-netlink-stats-padding.patch In 4.14.55, a patch was introduced that breaks ext4 images in some cases. The newly introduced patch backport-4.14/500-ext4-fix-check-to-prevent-initializing-reserved-inod.patch addresses this breakage. Fixes the following CVEs: - CVE-2018-10876 - CVE-2018-10877 - CVE-2018-10879 - CVE-2018-10880 - CVE-2018-10881 - CVE-2018-10882 - CVE-2018-10883 Compile-tested: ath79, octeon, x86/64 Runtime-tested: ath79, octeon, x86/64 Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>master
parent
c89195eb25
commit
22b9f99b87
@ -1,32 +0,0 @@ |
||||
From a728a196d253530f17da5c86dc7dfbe58c5f7094 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Lamparter <chunkeey@googlemail.com>
|
||||
Date: Fri, 25 Aug 2017 15:47:14 +0200
|
||||
Subject: [PATCH 01/25] crypto: crypto4xx - remove bad list_del
|
||||
|
||||
alg entries are only added to the list, after the registration
|
||||
was successful. If the registration failed, it was never added
|
||||
to the list in the first place.
|
||||
|
||||
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
|
||||
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
||||
---
|
||||
drivers/crypto/amcc/crypto4xx_core.c | 6 ++----
|
||||
1 file changed, 2 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/drivers/crypto/amcc/crypto4xx_core.c
|
||||
+++ b/drivers/crypto/amcc/crypto4xx_core.c
|
||||
@@ -1033,12 +1033,10 @@ int crypto4xx_register_alg(struct crypto
|
||||
break;
|
||||
}
|
||||
|
||||
- if (rc) {
|
||||
- list_del(&alg->entry);
|
||||
+ if (rc)
|
||||
kfree(alg);
|
||||
- } else {
|
||||
+ else
|
||||
list_add_tail(&alg->entry, &sec_dev->alg_list);
|
||||
- }
|
||||
}
|
||||
|
||||
return 0;
|
@ -1,84 +0,0 @@ |
||||
From 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Lamparter <chunkeey@googlemail.com>
|
||||
Date: Fri, 25 Aug 2017 15:47:24 +0200
|
||||
Subject: [PATCH 11/25] crypto: crypto4xx - fix crypto4xx_build_pdr,
|
||||
crypto4xx_build_sdr leak
|
||||
|
||||
If one of the later memory allocations in rypto4xx_build_pdr()
|
||||
fails: dev->pdr (and/or) dev->pdr_uinfo wouldn't be freed.
|
||||
|
||||
crypto4xx_build_sdr() has the same issue with dev->sdr.
|
||||
|
||||
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
|
||||
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
|
||||
---
|
||||
drivers/crypto/amcc/crypto4xx_core.c | 17 +++++++++--------
|
||||
1 file changed, 9 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/drivers/crypto/amcc/crypto4xx_core.c
|
||||
+++ b/drivers/crypto/amcc/crypto4xx_core.c
|
||||
@@ -209,7 +209,7 @@ static u32 crypto4xx_build_pdr(struct cr
|
||||
dev->pdr_pa);
|
||||
return -ENOMEM;
|
||||
}
|
||||
- memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
|
||||
+ memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
|
||||
dev->shadow_sa_pool = dma_alloc_coherent(dev->core_dev->device,
|
||||
256 * PPC4XX_NUM_PD,
|
||||
&dev->shadow_sa_pool_pa,
|
||||
@@ -242,13 +242,15 @@ static u32 crypto4xx_build_pdr(struct cr
|
||||
|
||||
static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev)
|
||||
{
|
||||
- if (dev->pdr != NULL)
|
||||
+ if (dev->pdr)
|
||||
dma_free_coherent(dev->core_dev->device,
|
||||
sizeof(struct ce_pd) * PPC4XX_NUM_PD,
|
||||
dev->pdr, dev->pdr_pa);
|
||||
+
|
||||
if (dev->shadow_sa_pool)
|
||||
dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD,
|
||||
dev->shadow_sa_pool, dev->shadow_sa_pool_pa);
|
||||
+
|
||||
if (dev->shadow_sr_pool)
|
||||
dma_free_coherent(dev->core_dev->device,
|
||||
sizeof(struct sa_state_record) * PPC4XX_NUM_PD,
|
||||
@@ -417,12 +419,12 @@ static u32 crypto4xx_build_sdr(struct cr
|
||||
|
||||
static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev)
|
||||
{
|
||||
- if (dev->sdr != NULL)
|
||||
+ if (dev->sdr)
|
||||
dma_free_coherent(dev->core_dev->device,
|
||||
sizeof(struct ce_sd) * PPC4XX_NUM_SD,
|
||||
dev->sdr, dev->sdr_pa);
|
||||
|
||||
- if (dev->scatter_buffer_va != NULL)
|
||||
+ if (dev->scatter_buffer_va)
|
||||
dma_free_coherent(dev->core_dev->device,
|
||||
PPC4XX_SD_BUFFER_SIZE * PPC4XX_NUM_SD,
|
||||
dev->scatter_buffer_va,
|
||||
@@ -1223,7 +1225,7 @@ static int crypto4xx_probe(struct platfo
|
||||
|
||||
rc = crypto4xx_build_gdr(core_dev->dev);
|
||||
if (rc)
|
||||
- goto err_build_gdr;
|
||||
+ goto err_build_pdr;
|
||||
|
||||
rc = crypto4xx_build_sdr(core_dev->dev);
|
||||
if (rc)
|
||||
@@ -1266,12 +1268,11 @@ err_iomap:
|
||||
err_request_irq:
|
||||
irq_dispose_mapping(core_dev->irq);
|
||||
tasklet_kill(&core_dev->tasklet);
|
||||
- crypto4xx_destroy_sdr(core_dev->dev);
|
||||
err_build_sdr:
|
||||
+ crypto4xx_destroy_sdr(core_dev->dev);
|
||||
crypto4xx_destroy_gdr(core_dev->dev);
|
||||
-err_build_gdr:
|
||||
- crypto4xx_destroy_pdr(core_dev->dev);
|
||||
err_build_pdr:
|
||||
+ crypto4xx_destroy_pdr(core_dev->dev);
|
||||
kfree(core_dev->dev);
|
||||
err_alloc_dev:
|
||||
kfree(core_dev);
|
@ -1,27 +0,0 @@ |
||||
From 54204ef3edbb1aa2390cabba61fe185a12cc39f0 Mon Sep 17 00:00:00 2001
|
||||
From: Felix Fietkau <nbd@nbd.name>
|
||||
Date: Tue, 6 Mar 2018 08:35:44 +0100
|
||||
Subject: [PATCH 11/27] MIPS: ath79: fix register address in
|
||||
ath79_ddr_wb_flush()
|
||||
|
||||
ath79_ddr_wb_flush_base has the type void __iomem *, so register offsets
|
||||
need to be a multiple of 4.
|
||||
|
||||
Cc: Alban Bedel <albeu@free.fr>
|
||||
Fixes: 24b0e3e84fbf ("MIPS: ath79: Improve the DDR controller interface")
|
||||
Signed-off-by: Felix Fietkau <nbd@nbd.name>
|
||||
---
|
||||
arch/mips/ath79/common.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/arch/mips/ath79/common.c
|
||||
+++ b/arch/mips/ath79/common.c
|
||||
@@ -58,7 +58,7 @@ EXPORT_SYMBOL_GPL(ath79_ddr_ctrl_init);
|
||||
|
||||
void ath79_ddr_wb_flush(u32 reg)
|
||||
{
|
||||
- void __iomem *flush_reg = ath79_ddr_wb_flush_base + reg;
|
||||
+ void __iomem *flush_reg = ath79_ddr_wb_flush_base + (reg * 4);
|
||||
|
||||
/* Flush the DDR write buffer. */
|
||||
__raw_writel(0x1, flush_reg);
|
@ -1,101 +0,0 @@ |
||||
From d0423d3e4fa7ae305729cb50369427f075ccb279 Mon Sep 17 00:00:00 2001
|
||||
From: Jonas Gorski <jonas.gorski@gmail.com>
|
||||
Date: Sat, 25 Feb 2017 12:41:28 +0100
|
||||
Subject: [PATCH 1/6] bcm63xx_enet: correct clock usage
|
||||
|
||||
Check the return code of prepare_enable and change one last instance of
|
||||
enable only to prepare_enable. Also properly disable and release the
|
||||
clock in error paths and on remove for enetsw.
|
||||
|
||||
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
|
||||
---
|
||||
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 31 +++++++++++++++++++++-------
|
||||
1 file changed, 23 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
|
||||
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
|
||||
@@ -1773,7 +1773,9 @@ static int bcm_enet_probe(struct platfor
|
||||
ret = PTR_ERR(priv->mac_clk);
|
||||
goto out;
|
||||
}
|
||||
- clk_prepare_enable(priv->mac_clk);
|
||||
+ ret = clk_prepare_enable(priv->mac_clk);
|
||||
+ if (ret)
|
||||
+ goto out_put_clk_mac;
|
||||
|
||||
/* initialize default and fetch platform data */
|
||||
priv->rx_ring_size = BCMENET_DEF_RX_DESC;
|
||||
@@ -1805,9 +1807,11 @@ static int bcm_enet_probe(struct platfor
|
||||
if (IS_ERR(priv->phy_clk)) {
|
||||
ret = PTR_ERR(priv->phy_clk);
|
||||
priv->phy_clk = NULL;
|
||||
- goto out_put_clk_mac;
|
||||
+ goto out_disable_clk_mac;
|
||||
}
|
||||
- clk_prepare_enable(priv->phy_clk);
|
||||
+ ret = clk_prepare_enable(priv->phy_clk);
|
||||
+ if (ret)
|
||||
+ goto out_put_clk_phy;
|
||||
}
|
||||
|
||||
/* do minimal hardware init to be able to probe mii bus */
|
||||
@@ -1901,13 +1905,16 @@ out_free_mdio:
|
||||
out_uninit_hw:
|
||||
/* turn off mdc clock */
|
||||
enet_writel(priv, 0, ENET_MIISC_REG);
|
||||
- if (priv->phy_clk) {
|
||||
+ if (priv->phy_clk)
|
||||
clk_disable_unprepare(priv->phy_clk);
|
||||
+
|
||||
+out_put_clk_phy:
|
||||
+ if (priv->phy_clk)
|
||||
clk_put(priv->phy_clk);
|
||||
- }
|
||||
|
||||
-out_put_clk_mac:
|
||||
+out_disable_clk_mac:
|
||||
clk_disable_unprepare(priv->mac_clk);
|
||||
+out_put_clk_mac:
|
||||
clk_put(priv->mac_clk);
|
||||
out:
|
||||
free_netdev(dev);
|
||||
@@ -2752,7 +2759,9 @@ static int bcm_enetsw_probe(struct platf
|
||||
ret = PTR_ERR(priv->mac_clk);
|
||||
goto out_unmap;
|
||||
}
|
||||
- clk_enable(priv->mac_clk);
|
||||
+ ret = clk_prepare_enable(priv->mac_clk);
|
||||
+ if (ret)
|
||||
+ goto out_put_clk;
|
||||
|
||||
priv->rx_chan = 0;
|
||||
priv->tx_chan = 1;
|
||||
@@ -2773,7 +2782,7 @@ static int bcm_enetsw_probe(struct platf
|
||||
|
||||
ret = register_netdev(dev);
|
||||
if (ret)
|
||||
- goto out_put_clk;
|
||||
+ goto out_disable_clk;
|
||||
|
||||
netif_carrier_off(dev);
|
||||
platform_set_drvdata(pdev, dev);
|
||||
@@ -2782,6 +2791,9 @@ static int bcm_enetsw_probe(struct platf
|
||||
|
||||
return 0;
|
||||
|
||||
+out_disable_clk:
|
||||
+ clk_disable_unprepare(priv->mac_clk);
|
||||
+
|
||||
out_put_clk:
|
||||
clk_put(priv->mac_clk);
|
||||
|
||||
@@ -2813,6 +2825,9 @@ static int bcm_enetsw_remove(struct plat
|
||||
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
|
||||
release_mem_region(res->start, resource_size(res));
|
||||
|
||||
+ clk_disable_unprepare(priv->mac_clk);
|
||||
+ clk_put(priv->mac_clk);
|
||||
+
|
||||
free_netdev(dev);
|
||||
return 0;
|
||||
}
|
@ -1,29 +0,0 @@ |
||||
From 23d94cb855b6f4f0ee1c01679224472104ac6440 Mon Sep 17 00:00:00 2001
|
||||
From: Jonas Gorski <jonas.gorski@gmail.com>
|
||||
Date: Sat, 30 Sep 2017 14:10:18 +0200
|
||||
Subject: [PATCH 2/6] bcm63xx_enet: do not write to random DMA channel on
|
||||
BCM6345
|
||||
|
||||
The DMA controller regs actually point to DMA channel 0, so the write to
|
||||
ENETDMA_CFG_REG will actually modify a random DMA channel.
|
||||
|
||||
Since DMA controller registers do not exist on BCM6345, guard the write
|
||||
with the usual check for dma_has_sram.
|
||||
|
||||
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
|
||||
---
|
||||
drivers/net/ethernet/broadcom/bcm63xx_enet.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
|
||||
+++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
|
||||
@@ -1062,7 +1062,8 @@ static int bcm_enet_open(struct net_devi
|
||||
val = enet_readl(priv, ENET_CTL_REG);
|
||||
val |= ENET_CTL_ENABLE_MASK;
|
||||
enet_writel(priv, val, ENET_CTL_REG);
|
||||
- enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
|
||||
+ if (priv->dma_has_sram)
|
||||
+ enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
|
||||
enet_dmac_writel(priv, priv->dma_chan_en_mask,
|
||||
ENETDMAC_CHANCFG, priv->rx_chan);
|
||||
|
@ -1,172 +0,0 @@ |
||||
From 9bbe60a67be5a1c6f79b3c9be5003481a50529ff Mon Sep 17 00:00:00 2001
|
||||
From: David Woodhouse <dwmw2@infradead.org>
|
||||
Date: Sat, 16 Jun 2018 11:55:44 +0100
|
||||
Subject: atm: Preserve value of skb->truesize when accounting to vcc
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
ATM accounts for in-flight TX packets in sk_wmem_alloc of the VCC on
|
||||
which they are to be sent. But it doesn't take ownership of those
|
||||
packets from the sock (if any) which originally owned them. They should
|
||||
remain owned by their actual sender until they've left the box.
|
||||
|
||||
There's a hack in pskb_expand_head() to avoid adjusting skb->truesize
|
||||
for certain skbs, precisely to avoid messing up sk_wmem_alloc
|
||||
accounting. Ideally that hack would cover the ATM use case too, but it
|
||||
doesn't — skbs which aren't owned by any sock, for example PPP control
|
||||
frames, still get their truesize adjusted when the low-level ATM driver
|
||||
adds headroom.
|
||||
|
||||
This has always been an issue, it seems. The truesize of a packet
|
||||
increases, and sk_wmem_alloc on the VCC goes negative. But this wasn't
|
||||
for normal traffic, only for control frames. So I think we just got away
|
||||
with it, and we probably needed to send 2GiB of LCP echo frames before
|
||||
the misaccounting would ever have caused a problem and caused
|
||||
atm_may_send() to start refusing packets.
|
||||
|
||||
Commit 14afee4b609 ("net: convert sock.sk_wmem_alloc from atomic_t to
|
||||
refcount_t") did exactly what it was intended to do, and turned this
|
||||
mostly-theoretical problem into a real one, causing PPPoATM to fail
|
||||
immediately as sk_wmem_alloc underflows and atm_may_send() *immediately*
|
||||
starts refusing to allow new packets.
|
||||
|
||||
The least intrusive solution to this problem is to stash the value of
|
||||
skb->truesize that was accounted to the VCC, in a new member of the
|
||||
ATM_SKB(skb) structure. Then in atm_pop_raw() subtract precisely that
|
||||
value instead of the then-current value of skb->truesize.
|
||||
|
||||
Fixes: 158f323b9868 ("net: adjust skb->truesize in pskb_expand_head()")
|
||||
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
|
||||
Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
include/linux/atmdev.h | 15 +++++++++++++++
|
||||
net/atm/br2684.c | 3 +--
|
||||
net/atm/clip.c | 3 +--
|
||||
net/atm/common.c | 3 +--
|
||||
net/atm/lec.c | 3 +--
|
||||
net/atm/mpc.c | 3 +--
|
||||
net/atm/pppoatm.c | 3 +--
|
||||
net/atm/raw.c | 4 ++--
|
||||
8 files changed, 23 insertions(+), 14 deletions(-)
|
||||
|
||||
--- a/include/linux/atmdev.h
|
||||
+++ b/include/linux/atmdev.h
|
||||
@@ -214,6 +214,7 @@ struct atmphy_ops {
|
||||
struct atm_skb_data {
|
||||
struct atm_vcc *vcc; /* ATM VCC */
|
||||
unsigned long atm_options; /* ATM layer options */
|
||||
+ unsigned int acct_truesize; /* truesize accounted to vcc */
|
||||
};
|
||||
|
||||
#define VCC_HTABLE_SIZE 32
|
||||
@@ -241,6 +242,20 @@ void vcc_insert_socket(struct sock *sk);
|
||||
|
||||
void atm_dev_release_vccs(struct atm_dev *dev);
|
||||
|
||||
+static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb)
|
||||
+{
|
||||
+ /*
|
||||
+ * Because ATM skbs may not belong to a sock (and we don't
|
||||
+ * necessarily want to), skb->truesize may be adjusted,
|
||||
+ * escaping the hack in pskb_expand_head() which avoids
|
||||
+ * doing so for some cases. So stash the value of truesize
|
||||
+ * at the time we accounted it, and atm_pop_raw() can use
|
||||
+ * that value later, in case it changes.
|
||||
+ */
|
||||
+ refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
|
||||
+ ATM_SKB(skb)->acct_truesize = skb->truesize;
|
||||
+ ATM_SKB(skb)->atm_options = vcc->atm_options;
|
||||
+}
|
||||
|
||||
static inline void atm_force_charge(struct atm_vcc *vcc,int truesize)
|
||||
{
|
||||
--- a/net/atm/br2684.c
|
||||
+++ b/net/atm/br2684.c
|
||||
@@ -252,8 +252,7 @@ static int br2684_xmit_vcc(struct sk_buf
|
||||
|
||||
ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc;
|
||||
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev);
|
||||
- refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc);
|
||||
- ATM_SKB(skb)->atm_options = atmvcc->atm_options;
|
||||
+ atm_account_tx(atmvcc, skb);
|
||||
dev->stats.tx_packets++;
|
||||
dev->stats.tx_bytes += skb->len;
|
||||
|
||||
--- a/net/atm/clip.c
|
||||
+++ b/net/atm/clip.c
|
||||
@@ -381,8 +381,7 @@ static netdev_tx_t clip_start_xmit(struc
|
||||
memcpy(here, llc_oui, sizeof(llc_oui));
|
||||
((__be16 *) here)[3] = skb->protocol;
|
||||
}
|
||||
- refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
|
||||
- ATM_SKB(skb)->atm_options = vcc->atm_options;
|
||||
+ atm_account_tx(vcc, skb);
|
||||
entry->vccs->last_use = jiffies;
|
||||
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev);
|
||||
old = xchg(&entry->vccs->xoff, 1); /* assume XOFF ... */
|
||||
--- a/net/atm/common.c
|
||||
+++ b/net/atm/common.c
|
||||
@@ -630,10 +630,9 @@ int vcc_sendmsg(struct socket *sock, str
|
||||
goto out;
|
||||
}
|
||||
pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
|
||||
- refcount_add(skb->truesize, &sk->sk_wmem_alloc);
|
||||
+ atm_account_tx(vcc, skb);
|
||||
|
||||
skb->dev = NULL; /* for paths shared with net_device interfaces */
|
||||
- ATM_SKB(skb)->atm_options = vcc->atm_options;
|
||||
if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) {
|
||||
kfree_skb(skb);
|
||||
error = -EFAULT;
|
||||
--- a/net/atm/lec.c
|
||||
+++ b/net/atm/lec.c
|
||||
@@ -182,9 +182,8 @@ lec_send(struct atm_vcc *vcc, struct sk_
|
||||
struct net_device *dev = skb->dev;
|
||||
|
||||
ATM_SKB(skb)->vcc = vcc;
|
||||
- ATM_SKB(skb)->atm_options = vcc->atm_options;
|
||||
+ atm_account_tx(vcc, skb);
|
||||
|
||||
- refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
|
||||
if (vcc->send(vcc, skb) < 0) {
|
||||
dev->stats.tx_dropped++;
|
||||
return;
|
||||
--- a/net/atm/mpc.c
|
||||
+++ b/net/atm/mpc.c
|
||||
@@ -555,8 +555,7 @@ static int send_via_shortcut(struct sk_b
|
||||
sizeof(struct llc_snap_hdr));
|
||||
}
|
||||
|
||||
- refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc);
|
||||
- ATM_SKB(skb)->atm_options = entry->shortcut->atm_options;
|
||||
+ atm_account_tx(entry->shortcut, skb);
|
||||
entry->shortcut->send(entry->shortcut, skb);
|
||||
entry->packets_fwded++;
|
||||
mpc->in_ops->put(entry);
|
||||
--- a/net/atm/pppoatm.c
|
||||
+++ b/net/atm/pppoatm.c
|
||||
@@ -350,8 +350,7 @@ static int pppoatm_send(struct ppp_chann
|
||||
return 1;
|
||||
}
|
||||
|
||||
- refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc);
|
||||
- ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options;
|
||||
+ atm_account_tx(vcc, skb);
|
||||
pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n",
|
||||
skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev);
|
||||
ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb)
|
||||
--- a/net/atm/raw.c
|
||||
+++ b/net/atm/raw.c
|
||||
@@ -35,8 +35,8 @@ static void atm_pop_raw(struct atm_vcc *
|
||||
struct sock *sk = sk_atm(vcc);
|
||||
|
||||
pr_debug("(%d) %d -= %d\n",
|
||||
- vcc->vci, sk_wmem_alloc_get(sk), skb->truesize);
|
||||
- WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc));
|
||||
+ vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize);
|
||||
+ WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc));
|
||||
dev_kfree_skb_any(skb);
|
||||
sk->sk_write_space(sk);
|
||||
}
|
@ -0,0 +1,65 @@ |
||||
From 5012284700775a4e6e3fbe7eac4c543c4874b559 Mon Sep 17 00:00:00 2001
|
||||
From: Theodore Ts'o <tytso@mit.edu>
|
||||
Date: Sat, 28 Jul 2018 08:12:04 -0400
|
||||
Subject: [PATCH] ext4: fix check to prevent initializing reserved inodes
|
||||
|
||||
Commit 8844618d8aa7: "ext4: only look at the bg_flags field if it is
|
||||
valid" will complain if block group zero does not have the
|
||||
EXT4_BG_INODE_ZEROED flag set. Unfortunately, this is not correct,
|
||||
since a freshly created file system has this flag cleared. It gets
|
||||
almost immediately after the file system is mounted read-write --- but
|
||||
the following somewhat unlikely sequence will end up triggering a
|
||||
false positive report of a corrupted file system:
|
||||
|
||||
mkfs.ext4 /dev/vdc
|
||||
mount -o ro /dev/vdc /vdc
|
||||
mount -o remount,rw /dev/vdc
|
||||
|
||||
Instead, when initializing the inode table for block group zero, test
|
||||
to make sure that itable_unused count is not too large, since that is
|
||||
the case that will result in some or all of the reserved inodes
|
||||
getting cleared.
|
||||
|
||||
This fixes the failures reported by Eric Whiteney when running
|
||||
generic/230 and generic/231 in the the nojournal test case.
|
||||
|
||||
Fixes: 8844618d8aa7 ("ext4: only look at the bg_flags field if it is valid")
|
||||
Reported-by: Eric Whitney <enwlinux@gmail.com>
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
---
|
||||
fs/ext4/ialloc.c | 5 ++++-
|
||||
fs/ext4/super.c | 8 +-------
|
||||
2 files changed, 5 insertions(+), 8 deletions(-)
|
||||
|
||||
--- a/fs/ext4/ialloc.c
|
||||
+++ b/fs/ext4/ialloc.c
|
||||
@@ -1394,7 +1394,10 @@ int ext4_init_inode_table(struct super_b
|
||||
ext4_itable_unused_count(sb, gdp)),
|
||||
sbi->s_inodes_per_block);
|
||||
|
||||
- if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) {
|
||||
+ if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) ||
|
||||
+ ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) -
|
||||
+ ext4_itable_unused_count(sb, gdp)) <
|
||||
+ EXT4_FIRST_INO(sb)))) {
|
||||
ext4_error(sb, "Something is wrong with group %u: "
|
||||
"used itable blocks: %d; "
|
||||
"itable unused count: %u",
|
||||
--- a/fs/ext4/super.c
|
||||
+++ b/fs/ext4/super.c
|
||||
@@ -3103,14 +3103,8 @@ static ext4_group_t ext4_has_uninit_itab
|
||||
if (!gdp)
|
||||
continue;
|
||||
|
||||
- if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))
|
||||
- continue;
|
||||
- if (group != 0)
|
||||
+ if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)))
|
||||
break;
|
||||
- ext4_error(sb, "Inode table for bg 0 marked as "
|
||||
- "needing zeroing");
|
||||
- if (sb_rdonly(sb))
|
||||
- return ngroups;
|
||||
}
|
||||
|
||||
return group;
|
@ -1,126 +0,0 @@ |
||||
From 028c9191bdf88f120f65626920a6a679170fcc3e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Antti=20Sepp=C3=A4l=C3=A4?= <a.seppala@gmail.com>
|
||||
Date: Thu, 5 Jul 2018 11:37:03 +0300
|
||||
Subject: [PATCH 1/2] usb: dwc2: Fix DMA alignment to start at allocated
|
||||
boundary
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The commit 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more
|
||||
supported way") introduced a common way to align DMA allocations.
|
||||
The code in the commit aligns the struct dma_aligned_buffer but the
|
||||
actual DMA address pointed by data[0] gets aligned to an offset from
|
||||
the allocated boundary by the kmalloc_ptr and the old_xfer_buffer
|
||||
pointers.
|
||||
|
||||
This is against the recommendation in Documentation/DMA-API.txt which
|
||||
states:
|
||||
|
||||
Therefore, it is recommended that driver writers who don't take
|
||||
special care to determine the cache line size at run time only map
|
||||
virtual regions that begin and end on page boundaries (which are
|
||||
guaranteed also to be cache line boundaries).
|
||||
|
||||
The effect of this is that architectures with non-coherent DMA caches
|
||||
may run into memory corruption or kernel crashes with Unhandled
|
||||
kernel unaligned accesses exceptions.
|
||||
|
||||
Fix the alignment by positioning the DMA area in front of the allocation
|
||||
and use memory at the end of the area for storing the orginal
|
||||
transfer_buffer pointer. This may have the added benefit of increased
|
||||
performance as the DMA area is now fully aligned on all architectures.
|
||||
|
||||
Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM).
|
||||
|
||||
Fixes: 3bc04e28a030 ("usb: dwc2: host: Get aligned DMA in a more
|
||||
supported way")
|
||||
|
||||
Signed-off-by: Antti Seppälä <a.seppala@gmail.com>
|
||||
---
|
||||
drivers/usb/dwc2/hcd.c | 44 +++++++++++++++++++++++---------------------
|
||||
1 file changed, 23 insertions(+), 21 deletions(-)
|
||||
|
||||
--- a/drivers/usb/dwc2/hcd.c
|
||||
+++ b/drivers/usb/dwc2/hcd.c
|
||||
@@ -2628,34 +2628,29 @@ static void dwc2_hc_init_xfer(struct dwc
|
||||
|
||||
#define DWC2_USB_DMA_ALIGN 4
|
||||
|
||||
-struct dma_aligned_buffer {
|
||||
- void *kmalloc_ptr;
|
||||
- void *old_xfer_buffer;
|
||||
- u8 data[0];
|
||||
-};
|
||||
-
|
||||
static void dwc2_free_dma_aligned_buffer(struct urb *urb)
|
||||
{
|
||||
- struct dma_aligned_buffer *temp;
|
||||
+ void *stored_xfer_buffer;
|
||||
|
||||
if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
|
||||
return;
|
||||
|
||||
- temp = container_of(urb->transfer_buffer,
|
||||
- struct dma_aligned_buffer, data);
|
||||
+ /* Restore urb->transfer_buffer from the end of the allocated area */
|
||||
+ memcpy(&stored_xfer_buffer, urb->transfer_buffer +
|
||||
+ urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
|
||||
|
||||
if (usb_urb_dir_in(urb))
|
||||
- memcpy(temp->old_xfer_buffer, temp->data,
|
||||
+ memcpy(stored_xfer_buffer, urb->transfer_buffer,
|
||||
urb->transfer_buffer_length);
|
||||
- urb->transfer_buffer = temp->old_xfer_buffer;
|
||||
- kfree(temp->kmalloc_ptr);
|
||||
+ kfree(urb->transfer_buffer);
|
||||
+ urb->transfer_buffer = stored_xfer_buffer;
|
||||
|
||||
urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
|
||||
}
|
||||
|
||||
static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
|
||||
{
|
||||
- struct dma_aligned_buffer *temp, *kmalloc_ptr;
|
||||
+ void *kmalloc_ptr;
|
||||
size_t kmalloc_size;
|
||||
|
||||
if (urb->num_sgs || urb->sg ||
|
||||
@@ -2663,22 +2658,29 @@ static int dwc2_alloc_dma_aligned_buffer
|
||||
!((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
|
||||
return 0;
|
||||
|
||||
- /* Allocate a buffer with enough padding for alignment */
|
||||
+ /*
|
||||
+ * Allocate a buffer with enough padding for original transfer_buffer
|
||||
+ * pointer. This allocation is guaranteed to be aligned properly for
|
||||
+ * DMA
|
||||
+ */
|
||||
kmalloc_size = urb->transfer_buffer_length +
|
||||
- sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
|
||||
+ sizeof(urb->transfer_buffer);
|
||||
|
||||
kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
|
||||
if (!kmalloc_ptr)
|
||||
return -ENOMEM;
|
||||
|
||||
- /* Position our struct dma_aligned_buffer such that data is aligned */
|
||||
- temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
|
||||
- temp->kmalloc_ptr = kmalloc_ptr;
|
||||
- temp->old_xfer_buffer = urb->transfer_buffer;
|
||||
+ /*
|
||||
+ * Position value of original urb->transfer_buffer pointer to the end
|
||||
+ * of allocation for later referencing
|
||||
+ */
|
||||
+ memcpy(kmalloc_ptr + urb->transfer_buffer_length,
|
||||
+ &urb->transfer_buffer, sizeof(urb->transfer_buffer));
|
||||
+
|
||||
if (usb_urb_dir_out(urb))
|
||||
- memcpy(temp->data, urb->transfer_buffer,
|
||||
+ memcpy(kmalloc_ptr, urb->transfer_buffer,
|
||||
urb->transfer_buffer_length);
|
||||
- urb->transfer_buffer = temp->data;
|
||||
+ urb->transfer_buffer = kmalloc_ptr;
|
||||
|
||||
urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
|
||||
|
@ -1,49 +0,0 @@ |
||||
The gen_stats facility will add a header for the toplevel nlattr of type
|
||||
TCA_STATS2 that contains all stats added by qdisc callbacks. A reference
|
||||
to this header is stored in the gnet_dump struct, and when all the
|
||||
per-qdisc callbacks have finished adding their stats, the length of the
|
||||
containing header will be adjusted to the right value.
|
||||
|
||||
However, on architectures that need padding (i.e., that don't set
|
||||
CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), the padding nlattr is added
|
||||
before the stats, which means that the stored pointer will point to the
|
||||
padding, and so when the header is fixed up, the result is just a very
|
||||
big padding nlattr. Because most qdiscs also supply the legacy TCA_STATS
|
||||
struct, this problem has been mostly invisible, but we exposed it with
|
||||
the netlink attribute-based statistics in CAKE.
|
||||
|
||||
Fix the issue by fixing up the stored pointer if it points to a padding
|
||||
nlattr.
|
||||
|
||||
Tested-by: Pete Heist <pete@heistp.net>
|
||||
Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
|
||||
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
|
||||
---
|
||||
net/core/gen_stats.c | 16 ++++++++++++++--
|
||||
1 file changed, 14 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/net/core/gen_stats.c
|
||||
+++ b/net/core/gen_stats.c
|
||||
@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_b
|
||||
d->lock = lock;
|
||||
spin_lock_bh(lock);
|
||||
}
|
||||
- if (d->tail)
|
||||
- return gnet_stats_copy(d, type, NULL, 0, padattr);
|
||||
+ if (d->tail) {
|
||||
+ int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
|
||||
+
|
||||
+ /* The initial attribute added in gnet_stats_copy() may be
|
||||
+ * preceded by a padding attribute, in which case d->tail will
|
||||
+ * end up pointing at the padding instead of the real attribute.
|
||||
+ * Fix this so gnet_stats_finish_copy() adjusts the length of
|
||||
+ * the right attribute.
|
||||
+ */
|
||||
+ if (ret == 0 && d->tail->nla_type == padattr)
|
||||
+ d->tail = (struct nlattr *)((char *)d->tail +
|
||||
+ NLA_ALIGN(d->tail->nla_len));
|
||||
+ return ret;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
}
|
@ -1,29 +0,0 @@ |
||||
From 8e72a3a1be8f6328bd7ef491332ba541547b6086 Mon Sep 17 00:00:00 2001
|
||||
From: John Crispin <blogic@openwrt.org>
|
||||
Date: Mon, 15 Jul 2013 00:38:51 +0200
|
||||
Subject: [PATCH 36/53] mtd: fix cfi cmdset 0002 erase status check
|
||||
|
||||
---
|
||||
drivers/mtd/chips/cfi_cmdset_0002.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
|
||||
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
|
||||
@@ -2295,7 +2295,7 @@ static int __xipram do_erase_chip(struct
|
||||
chip->erase_suspended = 0;
|
||||
}
|
||||
|
||||
- if (chip_ready(map, adr))
|
||||
+ if (chip_good(map, adr, map_word_ff(map)))
|
||||
break;
|
||||
|
||||
if (time_after(jiffies, timeo)) {
|
||||
@@ -2385,7 +2385,7 @@ static int __xipram do_erase_oneblock(st
|
||||
chip->erase_suspended = 0;
|
||||
}
|
||||
|
||||
- if (chip_ready(map, adr)) {
|
||||
+ if (chip_good(map, adr, map_word_ff(map))) {
|
||||
xip_enable(map, chip, adr);
|
||||
break;
|
||||
}
|
Loading…
Reference in new issue