diff --git a/debian/changelog b/debian/changelog index 97f9a1fff..75ca6a147 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux (4.4.3-1) UNRELEASED; urgency=medium +linux (4.4.4-1) UNRELEASED; urgency=medium [ Salvatore Bonaccorso ] * New upstream stable update: @@ -134,6 +134,350 @@ linux (4.4.3-1) UNRELEASED; urgency=medium - posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper - itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper - modules: fix modparam async_probe request + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.4 + - af_iucv: Validate socket address length in iucv_sock_bind() + - gro: Make GRO aware of lightweight tunnels. + - net: dp83640: Fix tx timestamp overflow handling. + - tunnels: Allow IPv6 UDP checksums to be correctly controlled. + - lwt: fix rx checksum setting for lwt devices tunneling over ipv6 + - tcp: fix NULL deref in tcp_v4_send_ack() + - af_unix: fix struct pid memory leak + - pptp: fix illegal memory access caused by multiple bind()s + - sctp: allow setting SCTP_SACK_IMMEDIATELY by the application + - net: dsa: fix mv88e6xxx switches + - tipc: fix connection abort during subscription cancel + - inet: frag: Always orphan skbs inside ip_defrag() + - switchdev: Require RTNL mutex to be held when sending FDB notifications + - tcp: beware of alignments in tcp_get_info() + - ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail() + - ipv6/udp: use sticky pktinfo egress ifindex on connect() + - ipv6: addrconf: Fix recursive spin lock call + - ipv6: fix a lockdep splat + - unix: correctly track in-flight fds in sending process user_struct + (regression in 4.3.3-6; CVE-2016-2550) + - tcp: do not drop syn_recv on all icmp reports + - net:Add sysctl_max_skb_frags + - tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs + - enic: increment devcmd2 result ring in case of timeout + - sctp: translate network order to host order when users get a hmacid + - net: Copy inner L3 and L4 headers as unaligned on GRE TEB + - flow_dissector: Fix unaligned access in __skb_flow_dissector when used by eth_get_headlen + - bpf: fix branch offset adjustment on backjumps after patching ctx expansion + - bonding: Fix ARP monitor validation + - ipv4: fix memory leaks in ip_cmsg_send() callers + - af_unix: Don't set err in unix_stream_read_generic unless there was an error + - af_unix: Guard against other == sk in unix_dgram_sendmsg + - tipc: fix premature addition of node to lookup table + - tcp: md5: release request socket instead of listener + - qmi_wwan: add "4G LTE usb-modem U901" + - net/mlx4_en: Count HW buffer overrun only once + - net/mlx4_en: Choose time-stamping shift value according to HW frequency + - net/mlx4_en: Avoid changing dev->features directly in run-time + - l2tp: Fix error creating L2TP tunnels + - pppoe: fix reference counting in PPPoE proxy + - net_sched fix: reclassification needs to consider ether protocol changes + - route: check and remove route cache when we get route + - tcp/dccp: fix another race at listener dismantle + - IFF_NO_QUEUE: Fix for drivers not calling ether_setup() + - rtnl: RTM_GETNETCONF: fix wrong return value + - tipc: unlock in error path + - unix_diag: fix incorrect sign extension in unix_lookup_by_ino + - sctp: Fix port hash table size computation + - ext4: fix bh->b_state corruption + - ARM: debug-ll: fix BCM63xx entry for multiplatform + - arm64: errata: Add -mpc-relative-literal-loads to build flags + - KVM: s390: fix guest fprs memory leak + - devm_memremap: Fix error value when memremap failed + - drm/gma500: Use correct unref in the gem bo create function + - ARM: 8457/1: psci-smp is built only for SMP + - lib/ucs2_string: Add ucs2 -> utf8 helper functions + - efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version + - efi: Do variable name validation tests in utf8 + - efi: Make our variable validation list include the guid + - efi: Make efivarfs entries immutable by default + - efi: Add pstore variables to the deletion whitelist + - lib/ucs2_string: Correct ucs2 -> utf8 conversion + - bcache: fix a livelock when we cause a huge number of cache misses + - bcache: Add a cond_resched() call to gc + - bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device + - bcache: fix a leak in bch_cached_dev_run() + - bcache: unregister reboot notifier if bcache fails to unregister device + - bcache: allows use of register in udev to avoid "device_busy" error. + - bcache: prevent crash on changing writeback_running + - bcache: Change refill_dirty() to always scan entire disk if necessary + - dm thin: fix race condition when destroying thin pool workqueue + - can: ems_usb: Fix possible tx overflow + - usb: dwc3: Fix assignment of EP transfer resources + - USB: cp210x: add IDs for GE B650V3 and B850V3 boards + - USB: option: add support for SIM7100E + - USB: option: add "4G LTE usb-modem U901" + - drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE + - spi: omap2-mcspi: Prevent duplicate gpio_request + - iw_cxgb3: Fix incorrectly returning error on success + - drm/i915: shut up gen8+ SDE irq dmesg noise + - ocfs2: unlock inode if deleting inode from orphan fails + - mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED + - mm: numa: quickly fail allocations for NUMA balancing on full nodes + - genirq: Validate action before dereferencing it in handle_irq_event_percpu() + - clocksource/drivers/vt8500: Increase the minimum delta + - s390/kvm: remove dependency on struct save_area definition + - KVM: s390: fix memory overwrites when vx is disabled + - Btrfs: add missing brelse when superblock checksum fails + - Btrfs: igrab inode in writepage + - btrfs: statfs: report zero available if metadata are exhausted + - Btrfs: send, don't BUG_ON() when an empty symlink is found + - Btrfs: fix number of transaction units required to create symlink + - Btrfs: fix transaction handle leak on failure to create hard link + - Btrfs: Initialize btrfs_root->highest_objectid when loading tree root and subvolume roots + - btrfs: initialize the seq counter in struct btrfs_device + - s390: fix normalization bug in exception table sorting + - s390/dasd: prevent incorrect length error under z/VM after PAV changes + - s390/dasd: fix refcount for PAV reassignment + - s390/dasd: fix performance drop + - s390/compat: correct restore of high gprs on signal return + - s390/fpu: signals vs. floating point control register + - uml: flush stdout before forking + - uml: fix hostfs mknod() + - um: link with -lpthread + - locks: fix unlock when fcntl_setlk races with a close + - rtlwifi: rtl_pci: Fix kernel panic + - rtlwifi: rtl8192cu: Add missing parameter setup + - rtlwifi: rtl8192ce: Fix handling of module parameters + - rtlwifi: rtl8192de: Fix incorrect module parameter descriptions + - rtlwifi: rtl8723ae: Fix initialization of module parameters + - rtlwifi: rtl8192se: Fix module parameter initialization + - rtlwifi: rtl8188ee: Fix module parameter initialization + - rtlwifi: rtl8723be: Fix module parameter initialization + - mei: fix fasync return value on error + - mei: validate request value in client notify request ioctl + - namei: ->d_inode of a pinned dentry is stable only for positives + - rc: sunxi-cir: Initialize the spinlock properly + - media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode + - si2157: return -EINVAL if firmware blob is too big + - gspca: ov534/topro: prevent a division by 0 + - vb2: fix a regression in poll() behavior for output,streams + - tda1004x: only update the frontend properties if locked + - dm space map metadata: remove unused variable in brb_pop() + - dm snapshot: fix hung bios when copy error occurs + - dm: fix dm_rq_target_io leak on faults with .request_fn DM w/ blk-mq paths + - coresight: checking for NULL string in coresight_name_match() + - irqchip/omap-intc: Add support for spurious irq handling + - irqchip/mxs: Add missing set_handle_irq() + - irqchip/atmel-aic: Fix wrong bit operation for IRQ priority + - irqchip/gic-v3-its: Fix double ICC_EOIR write for LPI in EOImode==1 + - posix-clock: Fix return code on the poll method's error path + - clockevents/tcb_clksrc: Prevent disabling an already disabled clock + - mmc: usdhi6rol0: handle NULL data in timeout + - mmc: sdhci-pci: Do not default to 33 Ohm driver strength for Intel SPT + - mmc: sdhci: Fix DMA descriptor with zero data length + - mmc: sdio: Fix invalid vdd in voltage switch power cycle + - mmc: mmc: Fix incorrect use of driver strength switching HS200 and HS400 + - mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() + - mmc: core: Enable tuning according to the actual timing + - mmc: mmci: fix an ages old detection error + - mmc: sdhci-acpi: Fix card detect race for Intel BXT/APL + - mmc: pxamci: fix again read-only gpio detection polarity + - mmc: sdhci-pci: Fix card detect race for Intel BXT/APL + - mmc: sdhci: Allow override of mmc host operations + - mmc: sdhci: Allow override of get_cd() called from sdhci_request() + - tools: hv: vss: fix the write()'s argument: error -> vss_msg + - Drivers: hv: vmbus: Fix a Host signaling bug + - Bluetooth: Use continuous scanning when creating LE connections + - Bluetooth: Add support of Toshiba Broadcom based devices + - Bluetooth: Fix incorrect removing of IRKs + - Bluetooth: 6lowpan: Fix kernel NULL pointer dereferences + - Bluetooth: 6lowpan: Fix handling of uncompressed IPv6 packets + - time: Avoid signed overflow in timekeeping_get_ns() + - cputime: Prevent 32bit overflow in time[val|spec]_to_cputime() + - Revert "MIPS: Fix PAGE_MASK definition" + - MIPS: Loongson-3: Fix SMP_ASK_C0COUNT IPI handler + - MIPS: hpet: Choose a safe value for the ETIME check + - MIPS: Fix some missing CONFIG_CPU_MIPSR6 #ifdefs + - MIPS: Fix buffer overflow in syscall_get_arguments() + - EDAC: Robustify workqueues destruction + - EDAC, mc_sysfs: Fix freeing bus' name + - sparc64: fix incorrect sign extension in sys_sparc64_personality + - cxl: use correct operator when writing pcie config space values + - clk: exynos: use irqsave version of spin_lock to avoid deadlock with irqs + - regulator: axp20x: Fix GPIO LDO enable value for AXP22x + - regulator: mt6311: MT6311_REGULATOR needs to select REGMAP_I2C + - virtio_balloon: fix race by fill and leak + - virtio_balloon: fix race between migration and ballooning + - virtio_pci: fix use after free on release + - drm/vmwgfx: Fix an incorrect lock check + - drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates + - drm/vmwgfx: respect 'nomodeset' + - drm/amdgpu: Fix off-by-one errors in amdgpu_vm_bo_map + - drm/amdgpu: call hpd_irq_event on resume + - drm/amdgpu: fix lost sync_to if scheduler is enabled. + - drm/amdgpu: fix tonga smu resume + - drm/amdgpu: fix amdgpu_bo_pin_restricted VRAM placing v2 + - drm/amdgpu: no need to load MC firmware on fiji + - drm/amdgpu: move gmc7 support out of CIK dependency + - drm/amdgpu: iceland use CI based MC IP + - drm/amdgpu: The VI specific EXE bit should only apply to GMC v8.0 above + - drm/amdgpu: pull topaz gmc bits into gmc_v7 + - drm/amdgpu: drop topaz support from gmc8 module + - drm/amdgpu: don't load MEC2 on topaz + - drm/amdgpu: remove exp hardware support from iceland + - drm/amdgpu: fix s4 resume + - drm/amdgpu: remove unnecessary forward declaration + - drm/amdgpu: hold reference to fences in amdgpu_sa_bo_new (v2) + - drm/amdgpu: fix issue with overlapping userptrs + - drm/amdgpu: use post-decrement in error handling + - drm/amdgpu: Don't hang in amdgpu_flip_work_func on disabled crtc. + - drm/amdgpu/pm: adjust display configuration after powerstate + - drm/nouveau/kms: take mode_config mutex in connector hotplug path + - drm/nouveau/display: Enable vblank irqs after display engine is on again. + - drm/nouveau/disp/dp: ensure sink is powered up before attempting link training + - drm/nouveau: platform: Fix deferred probe + - drm/dp/mst: process broadcast messages correctly + - drm/dp/mst: always send reply for UP request + - drm/dp/mst: fix in MSTB RAD initialization + - drm/dp/mst: fix in RAD element access + - drm: Add drm_fixp_from_fraction and drm_fixp2int_ceil + - drm/dp/mst: Calculate MST PBN with 31.32 fixed point + - drm/dp/mst: move GUID storage from mgr, port to only mst branch + - drm/dp/mst: Reverse order of MST enable and clearing VC payload table. + - drm/dp/mst: deallocate payload on port destruction + - drm/radeon: Fix off-by-one errors in radeon_vm_bo_set_addr + - drm/radeon: call hpd_irq_event on resume + - drm/radeon: Fix "slow" audio over DP on DCE8+ + - drm/radeon: clean up fujitsu quirks + - drm/radeon: properly byte swap vce firmware setup + - drm/radeon: cleaned up VCO output settings for DP audio + - drm/radeon: Add a common function for DFS handling + - drm/radeon: fix DP audio support for APU with DCE4.1 display engine + - drm: add helper to check for wc memory support + - drm/radeon: mask out WC from BO on unsupported arches + - drm/radeon: hold reference to fences in radeon_sa_bo_new + - drm: fix missing reference counting decrease + - drm/i915: Restore inhibiting the load of the default context + - drm/i915: intel_hpd_init(): Fix suspend/resume reprobing + - drm/i915: Init power domains early in driver load + - drm/i915: Make sure DC writes are coherent on flush. + - drm/i915/dp: fall back to 18 bpp when sink capability is unknown + - drm/i915: Don't reject primary plane windowing with color keying enabled on SKL+ + - drm/i915/skl: Don't skip mst encoders in skl_ddi_pll_select() + - drm/i915/dsi: defend gpio table against out of bounds access + - drm/i915/dsi: don't pass arbitrary data to sideband + - drm/i915: fix error path in intel_setup_gmbus() + - drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command + - drm/radeon: use post-decrement in error handling + - drm: No-Op redundant calls to drm_vblank_off() (v2) + - drm: Prevent vblank counter bumps > 1 with active vblank clients. (v2) + - drm: Fix drm_vblank_pre/post_modeset regression from Linux 4.4 + - drm: Fix treatment of drm_vblank_offdelay in drm_vblank_on() (v2) + - drm/radeon: Don't hang in radeon_flip_work_func on disabled crtc. (v2) + - drm/radeon/pm: adjust display configuration after powerstate + - make sure that freeing shmem fast symlinks is RCU-delayed + - toshiba_acpi: Fix blank screen at boot if transflective backlight is supported + - ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list + - ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list + - uapi: update install list after nvme.h rename + - lib: sw842: select crc32 + - ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba Portege R700 + - ACPI / video: Add disable_backlight_sysfs_if quirk for the Toshiba Satellite R830 + - ACPI: Revert "ACPI / video: Add Dell Inspiron 5737 to the blacklist" + - ACPI / PCI / hotplug: unlock in error path in acpiphp_enable_slot() + - nfit: fix multi-interface dimm handling, acpi6.1 compatibility + - dmaengine: dw: fix cyclic transfer setup + - dmaengine: dw: fix cyclic transfer callbacks + - dmaengine: at_xdmac: fix resume for cyclic transfers + - dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer + - IB/cm: Fix a recently introduced deadlock + - IB/qib: fix mcast detach when qp not attached + - IB/qib: Support creating qps with GFP_NOIO flag + - IB/mlx5: Expose correct maximum number of CQE capacity + - Thermal: initialize thermal zone device correctly + - Thermal: handle thermal zone device properly during system sleep + - Thermal: do thermal zone update after a cooling device registered + - hwmon: (dell-smm) Blacklist Dell Studio XPS 8000 + - hwmon: (gpio-fan) Remove un-necessary speed_index lookup for thermal hook + - hwmon: (ads1015) Handle negative conversion values correctly + - cpufreq: pxa2xx: fix pxa_cpufreq_change_voltage prototype + - cpufreq: Fix NULL reference crash while accessing policy->governor_data + - seccomp: always propagate NO_NEW_PRIVS on tsync + - libceph: fix ceph_msg_revoke() + - libceph: don't bail early from try_read() when skipping a message + - libceph: use the right footer size when skipping a message + - libceph: don't spam dmesg with stray reply warnings + - sd: Optimal I/O size is in bytes, not sectors + - Staging: speakup: Fix getting port information + - Revert "Staging: panel: usleep_range is preferred over udelay" + - cdc-acm:exclude Samsung phone 04e8:685d + - perf stat: Do not clean event's private stats + - tick/nohz: Set the correct expiry when switching to nohz/lowres mode + - rfkill: fix rfkill_fop_read wait_event usage + - mac80211: Requeue work after scan complete for all VIF types. + - workqueue: handle NUMA_NO_NODE for unbound pool_workqueue lookup + - Revert "workqueue: make sure delayed work run in local cpu" + - ALSA: hda - Apply clock gate workaround to Skylake, too + - ALSA: hda - Fixing background noise on Dell Inspiron 3162 + - target: Fix LUN_RESET active I/O handling for ACK_KREF + - target: Fix LUN_RESET active TMR descriptor handling + - target: Fix TAS handling for multi-session se_node_acls + - target: Fix remote-port TMR ABORT + se_cmd fabric stop + - target: Fix race with SCF_SEND_DELAYED_TAS handling + - spi: atmel: fix gpio chip-select in case of non-DT platform + - qla2xxx: Fix stale pointer access. + - libata: fix sff host state machine locking while polling + - ARCv2: STAR 9000950267: Handle return from intr to Delay Slot #2 + - ARCv2: SMP: Emulate IPI to self using software triggered interrupt + - PCI/AER: Flush workqueue on device remove to avoid use-after-free + - cpuset: make mm migration asynchronous + - cgroup: make sure a parent css isn't offlined before its children + - writeback: keep superblock pinned during cgroup writeback association switches + - phy: core: fix wrong err handle for phy_power_on + - i2c: i801: Adding Intel Lewisburg support for iTCO + - bio: return EINTR if copying to user space got interrupted + - block: fix use-after-free in dio_bio_complete + - nfs: fix nfs_size_to_loff_t + - NFSv4: Fix a dentry leak on alias use + - of/irq: Fix msi-map calculation for nonzero rid-base + - KVM: async_pf: do not warn on page allocation failures + - KVM: arm/arm64: vgic: Ensure bitmaps are long enough + - KVM: x86: fix missed hardware breakpoints + - KVM: x86: fix conversion of addresses to linear in 32-bit protected mode + - KVM: x86: MMU: fix ubsan index-out-of-range warning + - powerpc/eeh: Fix partial hotplug criterion + - tracing: Fix showing function event in available_events + - sunrpc/cache: fix off-by-one in qword_get() + - kernel/resource.c: fix muxed resource handling in __request_region() + - do_last(): don't let a bogus return value from ->open() et.al. to confuse us + - ARM: OMAP2+: Fix onenand initialization to avoid filesystem corruption + - ARM: at91/dt: fix typo in sama5d2 pinmux descriptions + - xen/arm: correctly handle DMA mapping of compound pages + - xen/scsiback: correct frontend counting + - xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY + - xen/pciback: Save the number of MSI-X entries to be copied later. + - xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. + - should_follow_link(): validate ->d_seq after having decided to follow + - do_last(): ELOOP failure exit should be done after leaving RCU mode + - hpfs: don't truncate the file when delete fails + - x86/mpx: Fix off-by-one comparison with nr_registers + - x86/entry/compat: Add missing CLAC to entry_INT80_32 + - x86/irq: Call chip->irq_set_affinity in proper context + - x86/irq: Fix a race in x86_vector_free_irqs() + - x86/irq: Validate that irq descriptor is still active + - x86/irq: Do not use apic_chip_data.old_domain as temporary buffer + - x86/irq: Reorganize the return path in assign_irq_vector + - x86/irq: Reorganize the search in assign_irq_vector + - x86/irq: Check vector allocation early + - x86/irq: Copy vectormask instead of an AND operation + - x86/irq: Get rid of code duplication + - x86/irq: Remove offline cpus from vector cleanup + - x86/irq: Clear move_in_progress before sending cleanup IPI + - x86/irq: Remove the cpumask allocation from send_cleanup_vector() + - x86/irq: Remove outgoing CPU from vector cleanup mask + - x86/irq: Call irq_force_move_complete with irq descriptor + - x86/irq: Plug vector cleanup race + - IB/cma: Fix RDMA port validation for iWarp + - security: let security modules use PTRACE_MODE_* with bitmasks + - iwlwifi: dvm: fix WoWLAN + - iwlwifi: pcie: properly configure the debug buffer size for 8000 + - iwlwifi: update and fix 7265 series PCI IDs + - iwlwifi: mvm: don't allow sched scans without matches to be started [ Roger Shimizu ] * [armhf] dts: imx6dlq-wandboard-revb1: use unique model id @@ -142,8 +486,6 @@ linux (4.4.3-1) UNRELEASED; urgency=medium Buffalo Linkstation devices. [ Ben Hutchings ] - * unix: correctly track in-flight fds in sending process user_struct - (regression in 4.3.3-6; CVE-2016-2550) * udeb: Include more modules, including those needed on Firefly-RK3288, thanks to Vagrant Cascadian (Closes: #815476) - [armhf] core-modules: Include regulator drivers by default @@ -151,10 +493,6 @@ linux (4.4.3-1) UNRELEASED; urgency=medium - mmc-modules: Depends on usb-modules - usb-modules: Include USB PHY drivers by default - [ Aurelien Jarno ] - * [x86] KVM: fix conversion of addresses to linear in 32-bit protected - mode. - [ Ian Campbell ] * [armhf] dts: Add DTB for Novena, patches from Vagrant Cascadian (Closes: #815324) @@ -162,10 +500,8 @@ linux (4.4.3-1) UNRELEASED; urgency=medium [ Uwe Kleine-König ] * [armhf] enable AXP20X_POWER (Closes: #815971) * [rt] Update to 4.4.3-rt9 - * genirq: Validate action before dereferencing it in - handle_irq_event_percpu() - -- Salvatore Bonaccorso Sun, 28 Feb 2016 07:02:42 +0100 + -- Salvatore Bonaccorso Fri, 04 Mar 2016 13:01:58 +0100 linux (4.4.2-3) unstable; urgency=medium diff --git a/debian/patches/bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch b/debian/patches/bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch deleted file mode 100644 index 3eec17f72..000000000 --- a/debian/patches/bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch +++ /dev/null @@ -1,65 +0,0 @@ -From: Rainer Weikusat -Date: Mon, 08 Feb 2016 18:47:19 +0000 -Subject: af_unix: Don't set err in unix_stream_read_generic unless there was an error -Origin: http://mid.gmane.org/87bn7rrqdk.fsf@doppelsaurus.mobileactivedefense.com - -The present unix_stream_read_generic contains various code sequences of -the form - -err = -EDISASTER; -if () - goto out; - -This has the unfortunate side effect of possibly causing the error code -to bleed through to the final - -out: - return copied ? : err; - -and then to be wrongly returned if no data was copied because the caller -didn't supply a data buffer, as demonstrated by the program available at - -http://pad.lv/1540731 - -Change it such that err is only set if an error condition was detected. - -Fixes: 3822b5c2fc62 ("af_unix: Revert 'lock_interruptible' in stream receive code") -Reported-by: Joseph Salisbury -Signed-off-by: Rainer Weikusat ---- ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -2275,13 +2275,15 @@ static int unix_stream_read_generic(stru - size_t size = state->size; - unsigned int last_len; - -- err = -EINVAL; -- if (sk->sk_state != TCP_ESTABLISHED) -+ if (unlikely(sk->sk_state != TCP_ESTABLISHED)) { -+ err = -EINVAL; - goto out; -+ } - -- err = -EOPNOTSUPP; -- if (flags & MSG_OOB) -+ if (unlikely(flags & MSG_OOB)) { -+ err = -EOPNOTSUPP; - goto out; -+ } - - target = sock_rcvlowat(sk, flags & MSG_WAITALL, size); - timeo = sock_rcvtimeo(sk, noblock); -@@ -2327,9 +2329,11 @@ again: - goto unlock; - - unix_state_unlock(sk); -- err = -EAGAIN; -- if (!timeo) -+ if (!timeo) { -+ err = -EAGAIN; - break; -+ } -+ - mutex_unlock(&u->readlock); - - timeo = unix_stream_data_wait(sk, timeo, last, diff --git a/debian/patches/bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch b/debian/patches/bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch deleted file mode 100644 index c61eaf6be..000000000 --- a/debian/patches/bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch +++ /dev/null @@ -1,40 +0,0 @@ -From: Rainer Weikusat -Date: Thu, 11 Feb 2016 19:37:27 +0000 -Subject: af_unix: Guard against other == sk in unix_dgram_sendmsg -Origin: http://mid.gmane.org/87r3gj11jc.fsf_-_@doppelsaurus.mobileactivedefense.com - -The unix_dgram_sendmsg routine use the following test - -if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { - -to determine if sk and other are in an n:1 association (either -established via connect or by using sendto to send messages to an -unrelated socket identified by address). This isn't correct as the -specified address could have been bound to the sending socket itself or -because this socket could have been connected to itself by the time of -the unix_peer_get but disconnected before the unix_state_lock(other). In -both cases, the if-block would be entered despite other == sk which -might either block the sender unintentionally or lead to trying to unlock -the same spin lock twice for a non-blocking send. Add a other != sk -check to guard against this. - -Fixes: 7d267278a9ec ("unix: avoid use-after-free in ep_remove_wait_queue") -Reported-By: Philipp Hahn -Signed-off-by: Rainer Weikusat ---- ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1781,7 +1781,12 @@ restart_locked: - goto out_unlock; - } - -- if (unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { -+ /* other == sk && unix_peer(other) != sk if -+ * - unix_peer(sk) == NULL, destination address bound to sk -+ * - unix_peer(sk) == sk by time of get but disconnected before lock -+ */ -+ if (other != sk && -+ unlikely(unix_peer(other) != sk && unix_recvq_full(other))) { - if (timeo) { - timeo = unix_wait_for_peer(other, timeo); - diff --git a/debian/patches/bugfix/all/bcache-add-a-cond_resched-call-to-gc.patch b/debian/patches/bugfix/all/bcache-add-a-cond_resched-call-to-gc.patch deleted file mode 100644 index 0580e6163..000000000 --- a/debian/patches/bugfix/all/bcache-add-a-cond_resched-call-to-gc.patch +++ /dev/null @@ -1,26 +0,0 @@ -From: Kent Overstreet -Date: Sun, 29 Nov 2015 17:18:33 -0800 -Subject: [2/8] bcache: Add a cond_resched() call to gc -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=c5f1e5adf956e3ba82d204c7c141a75da9fa449a - -Signed-off-by: Takashi Iwai -Tested-by: Eric Wheeler -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/btree.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 4a1179c..22b9e34 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1741,6 +1741,7 @@ static void bch_btree_gc(struct cache_set *c) - do { - ret = btree_root(gc_root, c, &op, &writes, &stats); - closure_sync(&writes); -+ cond_resched(); - - if (ret && ret != -EAGAIN) - pr_warn("gc failed!"); diff --git a/debian/patches/bugfix/all/bcache-allows-use-of-register-in-udev-to-avoid-devic.patch b/debian/patches/bugfix/all/bcache-allows-use-of-register-in-udev-to-avoid-devic.patch deleted file mode 100644 index 782979770..000000000 --- a/debian/patches/bugfix/all/bcache-allows-use-of-register-in-udev-to-avoid-devic.patch +++ /dev/null @@ -1,46 +0,0 @@ -From: Gabriel de Perthuis -Date: Sun, 29 Nov 2015 18:40:23 -0800 -Subject: [6/8] bcache: allows use of register in udev to avoid "device_busy" - error. -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=d7076f21629f8f329bca4a44dc408d94670f49e2 - -Allows to use register, not register_quiet in udev to avoid "device_busy" error. -The initial patch proposed at https://lkml.org/lkml/2013/8/26/549 by Gabriel de Perthuis - does not unlock the mutex and hangs the kernel. - -See http://thread.gmane.org/gmane.linux.kernel.bcache.devel/2594 for the discussion. - -Cc: Denis Bychkov -Cc: Kent Overstreet -Cc: Eric Wheeler -Cc: Gabriel de Perthuis -Cc: stable@vger.kernel.org - -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/super.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 18f14a2..8d0ead9 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1938,6 +1938,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, - else - err = "device busy"; - mutex_unlock(&bch_register_lock); -+ if (attr == &ksysfs_register_quiet) -+ goto out; - } - goto err; - } -@@ -1976,8 +1978,7 @@ out: - err_close: - blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL); - err: -- if (attr != &ksysfs_register_quiet) -- pr_info("error opening %s: %s", path, err); -+ pr_info("error opening %s: %s", path, err); - ret = -EINVAL; - goto out; - } diff --git a/debian/patches/bugfix/all/bcache-change-refill_dirty-to-always-scan-entire-dis.patch b/debian/patches/bugfix/all/bcache-change-refill_dirty-to-always-scan-entire-dis.patch deleted file mode 100644 index 7dae0c8e9..000000000 --- a/debian/patches/bugfix/all/bcache-change-refill_dirty-to-always-scan-entire-dis.patch +++ /dev/null @@ -1,91 +0,0 @@ -From: Kent Overstreet -Date: Sun, 29 Nov 2015 18:47:01 -0800 -Subject: [8/8] bcache: Change refill_dirty() to always scan entire disk if - necessary -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=627ccd20b4ad3ba836472468208e2ac4dfadbf03 - -Previously, it would only scan the entire disk if it was starting from -the very start of the disk - i.e. if the previous scan got to the end. - -This was broken by refill_full_stripes(), which updates last_scanned so -that refill_dirty was never triggering the searched_from_start path. - -But if we change refill_dirty() to always scan the entire disk if -necessary, regardless of what last_scanned was, the code gets cleaner -and we fix that bug too. - -Signed-off-by: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/writeback.c | 37 ++++++++++++++++++++++++++++++------- - 1 file changed, 30 insertions(+), 7 deletions(-) - -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index b23f88d..b9346cd 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -323,6 +323,10 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, unsigned inode, - - static bool dirty_pred(struct keybuf *buf, struct bkey *k) - { -+ struct cached_dev *dc = container_of(buf, struct cached_dev, writeback_keys); -+ -+ BUG_ON(KEY_INODE(k) != dc->disk.id); -+ - return KEY_DIRTY(k); - } - -@@ -372,11 +376,24 @@ next: - } - } - -+/* -+ * Returns true if we scanned the entire disk -+ */ - static bool refill_dirty(struct cached_dev *dc) - { - struct keybuf *buf = &dc->writeback_keys; -+ struct bkey start = KEY(dc->disk.id, 0, 0); - struct bkey end = KEY(dc->disk.id, MAX_KEY_OFFSET, 0); -- bool searched_from_start = false; -+ struct bkey start_pos; -+ -+ /* -+ * make sure keybuf pos is inside the range for this disk - at bringup -+ * we might not be attached yet so this disk's inode nr isn't -+ * initialized then -+ */ -+ if (bkey_cmp(&buf->last_scanned, &start) < 0 || -+ bkey_cmp(&buf->last_scanned, &end) > 0) -+ buf->last_scanned = start; - - if (dc->partial_stripes_expensive) { - refill_full_stripes(dc); -@@ -384,14 +401,20 @@ static bool refill_dirty(struct cached_dev *dc) - return false; - } - -- if (bkey_cmp(&buf->last_scanned, &end) >= 0) { -- buf->last_scanned = KEY(dc->disk.id, 0, 0); -- searched_from_start = true; -- } -- -+ start_pos = buf->last_scanned; - bch_refill_keybuf(dc->disk.c, buf, &end, dirty_pred); - -- return bkey_cmp(&buf->last_scanned, &end) >= 0 && searched_from_start; -+ if (bkey_cmp(&buf->last_scanned, &end) < 0) -+ return false; -+ -+ /* -+ * If we get to the end start scanning again from the beginning, and -+ * only scan up to where we initially started scanning from: -+ */ -+ buf->last_scanned = start; -+ bch_refill_keybuf(dc->disk.c, buf, &start_pos, dirty_pred); -+ -+ return bkey_cmp(&buf->last_scanned, &start_pos) >= 0; - } - - static int bch_writeback_thread(void *arg) diff --git a/debian/patches/bugfix/all/bcache-clear-bcache_dev_unlink_done-flag-when-attach.patch b/debian/patches/bugfix/all/bcache-clear-bcache_dev_unlink_done-flag-when-attach.patch deleted file mode 100644 index 83e0bf81f..000000000 --- a/debian/patches/bugfix/all/bcache-clear-bcache_dev_unlink_done-flag-when-attach.patch +++ /dev/null @@ -1,109 +0,0 @@ -From: Zheng Liu -Date: Sun, 29 Nov 2015 17:19:32 -0800 -Subject: [3/8] bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a - backing device -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=fecaee6f20ee122ad75402c53d8278f9bb142ddc - -This bug can be reproduced by the following script: - - #!/bin/bash - - bcache_sysfs="/sys/fs/bcache" - - function clear_cache() - { - if [ ! -e $bcache_sysfs ]; then - echo "no bcache sysfs" - exit - fi - - cset_uuid=$(ls -l $bcache_sysfs|head -n 2|tail -n 1|awk '{print $9}') - sudo sh -c "echo $cset_uuid > /sys/block/sdb/sdb1/bcache/detach" - sleep 5 - sudo sh -c "echo $cset_uuid > /sys/block/sdb/sdb1/bcache/attach" - } - - for ((i=0;i<10;i++)); do - clear_cache - done - -The warning messages look like below: -[ 275.948611] ------------[ cut here ]------------ -[ 275.963840] WARNING: at fs/sysfs/dir.c:512 sysfs_add_one+0xb8/0xd0() (Tainted: P W ---------------- ) -[ 275.979253] Hardware name: Tecal RH2285 -[ 275.994106] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:09.0/0000:08:00.0/host4/target4:2:1/4:2:1:0/block/sdb/sdb1/bcache/cache' -[ 276.024105] Modules linked in: bcache tcp_diag inet_diag ipmi_devintf ipmi_si ipmi_msghandler -bonding 8021q garp stp llc ipv6 ext3 jbd loop sg iomemory_vsl(P) bnx2 microcode serio_raw i2c_i801 -i2c_core iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 jbd2 mbcache megaraid_sas -pata_acpi ata_generic ata_piix dm_mod [last unloaded: scsi_wait_scan] -[ 276.072643] Pid: 2765, comm: sh Tainted: P W --------------- 2.6.32 #1 -[ 276.089315] Call Trace: -[ 276.105801] [] ? warn_slowpath_common+0x87/0xc0 -[ 276.122650] [] ? warn_slowpath_fmt+0x46/0x50 -[ 276.139361] [] ? sysfs_add_one+0xb8/0xd0 -[ 276.156012] [] ? sysfs_do_create_link+0x12b/0x170 -[ 276.172682] [] ? sysfs_create_link+0x13/0x20 -[ 276.189282] [] ? bcache_device_link+0xc1/0x110 [bcache] -[ 276.205993] [] ? bch_cached_dev_attach+0x478/0x4f0 [bcache] -[ 276.222794] [] ? bch_cached_dev_store+0x627/0x780 [bcache] -[ 276.239680] [] ? alloc_pages_current+0xaa/0x110 -[ 276.256594] [] ? sysfs_write_file+0xe5/0x170 -[ 276.273364] [] ? vfs_write+0xb8/0x1a0 -[ 276.290133] [] ? sys_write+0x51/0x90 -[ 276.306368] [] ? system_call_fastpath+0x16/0x1b -[ 276.322301] ---[ end trace 9f5d4fcdd0c3edfb ]--- -[ 276.338241] ------------[ cut here ]------------ -[ 276.354109] WARNING: at /home/wenqing.lz/bcache/bcache/super.c:720 -bcache_device_link+0xdf/0x110 [bcache]() (Tainted: P W --------------- ) -[ 276.386017] Hardware name: Tecal RH2285 -[ 276.401430] Couldn't create device <-> cache set symlinks -[ 276.401759] Modules linked in: bcache tcp_diag inet_diag ipmi_devintf ipmi_si ipmi_msghandler -bonding 8021q garp stp llc ipv6 ext3 jbd loop sg iomemory_vsl(P) bnx2 microcode serio_raw i2c_i801 -i2c_core iTCO_wdt iTCO_vendor_support i7core_edac edac_core shpchp ext4 jbd2 mbcache megaraid_sas -pata_acpi ata_generic ata_piix dm_mod [last unloaded: scsi_wait_scan] -[ 276.465477] Pid: 2765, comm: sh Tainted: P W --------------- 2.6.32 #1 -[ 276.482169] Call Trace: -[ 276.498610] [] ? warn_slowpath_common+0x87/0xc0 -[ 276.515405] [] ? warn_slowpath_fmt+0x46/0x50 -[ 276.532059] [] ? bcache_device_link+0xdf/0x110 [bcache] -[ 276.548808] [] ? bch_cached_dev_attach+0x478/0x4f0 [bcache] -[ 276.565569] [] ? bch_cached_dev_store+0x627/0x780 [bcache] -[ 276.582418] [] ? alloc_pages_current+0xaa/0x110 -[ 276.599341] [] ? sysfs_write_file+0xe5/0x170 -[ 276.616142] [] ? vfs_write+0xb8/0x1a0 -[ 276.632607] [] ? sys_write+0x51/0x90 -[ 276.648671] [] ? system_call_fastpath+0x16/0x1b -[ 276.664756] ---[ end trace 9f5d4fcdd0c3edfc ]--- - -We forget to clear BCACHE_DEV_UNLINK_DONE flag in bcache_device_attach() -function when we attach a backing device first time. After detaching this -backing device, this flag will be true and sysfs_remove_link() isn't called in -bcache_device_unlink(). Then when we attach this backing device again, -sysfs_create_link() will return EEXIST error in bcache_device_link(). - -So the fix is trival and we clear this flag in bcache_device_link(). - -Signed-off-by: Zheng Liu -Tested-by: Joshua Schmid -Tested-by: Eric Wheeler -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/super.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 679a093..383f060 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -685,6 +685,8 @@ static void bcache_device_link(struct bcache_device *d, struct cache_set *c, - WARN(sysfs_create_link(&d->kobj, &c->kobj, "cache") || - sysfs_create_link(&c->kobj, &d->kobj, d->name), - "Couldn't create device <-> cache set symlinks"); -+ -+ clear_bit(BCACHE_DEV_UNLINK_DONE, &d->flags); - } - - static void bcache_device_detach(struct bcache_device *d) diff --git a/debian/patches/bugfix/all/bcache-fix-a-leak-in-bch_cached_dev_run.patch b/debian/patches/bugfix/all/bcache-fix-a-leak-in-bch_cached_dev_run.patch deleted file mode 100644 index b287e3226..000000000 --- a/debian/patches/bugfix/all/bcache-fix-a-leak-in-bch_cached_dev_run.patch +++ /dev/null @@ -1,32 +0,0 @@ -From: Al Viro -Date: Sun, 29 Nov 2015 17:20:59 -0800 -Subject: [4/8] bcache: fix a leak in bch_cached_dev_run() -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=4d4d8573a8451acc9f01cbea24b7e55f04a252fe - -Signed-off-by: Al Viro -Tested-by: Joshua Schmid -Tested-by: Eric Wheeler -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/super.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 383f060..43e911e 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -849,8 +849,11 @@ void bch_cached_dev_run(struct cached_dev *dc) - buf[SB_LABEL_SIZE] = '\0'; - env[2] = kasprintf(GFP_KERNEL, "CACHED_LABEL=%s", buf); - -- if (atomic_xchg(&dc->running, 1)) -+ if (atomic_xchg(&dc->running, 1)) { -+ kfree(env[1]); -+ kfree(env[2]); - return; -+ } - - if (!d->c && - BDEV_STATE(&dc->sb) != BDEV_STATE_NONE) { diff --git a/debian/patches/bugfix/all/bcache-fix-a-livelock-when-we-cause-a-huge-number-of.patch b/debian/patches/bugfix/all/bcache-fix-a-livelock-when-we-cause-a-huge-number-of.patch deleted file mode 100644 index 88a52f7b1..000000000 --- a/debian/patches/bugfix/all/bcache-fix-a-livelock-when-we-cause-a-huge-number-of.patch +++ /dev/null @@ -1,67 +0,0 @@ -From: Zheng Liu -Date: Sun, 29 Nov 2015 17:17:05 -0800 -Subject: [1/8] bcache: fix a livelock when we cause a huge number of cache - misses -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=2ef9ccbfcb90cf84bdba320a571b18b05c41101b - -Subject : [PATCH v2] bcache: fix a livelock in btree lock -Date : Wed, 25 Feb 2015 20:32:09 +0800 (02/25/2015 04:32:09 AM) - -This commit tries to fix a livelock in bcache. This livelock might -happen when we causes a huge number of cache misses simultaneously. - -When we get a cache miss, bcache will execute the following path. - -->cached_dev_make_request() - ->cached_dev_read() - ->cached_lookup() - ->bch->btree_map_keys() - ->btree_root() <------------------------ - ->bch_btree_map_keys_recurse() | - ->cache_lookup_fn() | - ->cached_dev_cache_miss() | - ->bch_btree_insert_check_key() -| - [If btree->seq is not equal to seq + 1, we should return - EINTR and traverse btree again.] - -In bch_btree_insert_check_key() function we first need to check upgrade -flag (op->lock == -1), and when this flag is true we need to release -read btree->lock and try to take write btree->lock. During taking and -releasing this write lock, btree->seq will be monotone increased in -order to prevent other threads modify this in cache miss (see btree.h:74). -But if there are some cache misses caused by some requested, we could -meet a livelock because btree->seq is always changed by others. Thus no -one can make progress. - -This commit will try to take write btree->lock if it encounters a race -when we traverse btree. Although it sacrifice the scalability but we -can ensure that only one can modify the btree. - -Signed-off-by: Zheng Liu -Tested-by: Joshua Schmid -Tested-by: Eric Wheeler -Cc: Joshua Schmid -Cc: Zhu Yanhai -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/btree.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 83392f8..4a1179c 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -2162,8 +2162,10 @@ int bch_btree_insert_check_key(struct btree *b, struct btree_op *op, - rw_lock(true, b, b->level); - - if (b->key.ptr[0] != btree_ptr || -- b->seq != seq + 1) -+ b->seq != seq + 1) { -+ op->lock = b->level; - goto out; -+ } - } - - SET_KEY_PTRS(check_key, 1); diff --git a/debian/patches/bugfix/all/bcache-prevent-crash-on-changing-writeback_running.patch b/debian/patches/bugfix/all/bcache-prevent-crash-on-changing-writeback_running.patch deleted file mode 100644 index 5d4736fe6..000000000 --- a/debian/patches/bugfix/all/bcache-prevent-crash-on-changing-writeback_running.patch +++ /dev/null @@ -1,32 +0,0 @@ -From: Stefan Bader -Date: Sun, 29 Nov 2015 18:44:49 -0800 -Subject: [7/8] bcache: prevent crash on changing writeback_running -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=8d16ce540c94c9d366eb36fc91b7154d92d6397b - -Added a safeguard in the shutdown case. At least while not being -attached it is also possible to trigger a kernel bug by writing into -writeback_running. This change adds the same check before trying to -wake up the thread for that case. - -Signed-off-by: Stefan Bader -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/writeback.h | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h -index 0a9dab1..073a042 100644 ---- a/drivers/md/bcache/writeback.h -+++ b/drivers/md/bcache/writeback.h -@@ -63,7 +63,8 @@ static inline bool should_writeback(struct cached_dev *dc, struct bio *bio, - - static inline void bch_writeback_queue(struct cached_dev *dc) - { -- wake_up_process(dc->writeback_thread); -+ if (!IS_ERR_OR_NULL(dc->writeback_thread)) -+ wake_up_process(dc->writeback_thread); - } - - static inline void bch_writeback_add(struct cached_dev *dc) diff --git a/debian/patches/bugfix/all/bcache-unregister-reboot-notifier-if-bcache-fails-to.patch b/debian/patches/bugfix/all/bcache-unregister-reboot-notifier-if-bcache-fails-to.patch deleted file mode 100644 index 538f34b02..000000000 --- a/debian/patches/bugfix/all/bcache-unregister-reboot-notifier-if-bcache-fails-to.patch +++ /dev/null @@ -1,35 +0,0 @@ -From: Zheng Liu -Date: Sun, 29 Nov 2015 17:21:57 -0800 -Subject: [5/8] bcache: unregister reboot notifier if bcache fails to - unregister device -Origin: https://git.kernel.org/cgit/linux/kernel/git/axboe/linux-block.git/commit?id=2ecf0cdb2b437402110ab57546e02abfa68a716b - -In bcache_init() function it forgot to unregister reboot notifier if -bcache fails to unregister a block device. This commit fixes this. - -Signed-off-by: Zheng Liu -Tested-by: Joshua Schmid -Tested-by: Eric Wheeler -Cc: Kent Overstreet -Cc: stable@vger.kernel.org -Signed-off-by: Jens Axboe ---- - drivers/md/bcache/super.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 43e911e..18f14a2 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -2071,8 +2071,10 @@ static int __init bcache_init(void) - closure_debug_init(); - - bcache_major = register_blkdev(0, "bcache"); -- if (bcache_major < 0) -+ if (bcache_major < 0) { -+ unregister_reboot_notifier(&reboot); - return bcache_major; -+ } - - if (!(bcache_wq = create_workqueue("bcache")) || - !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) || diff --git a/debian/patches/bugfix/all/bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch b/debian/patches/bugfix/all/bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch deleted file mode 100644 index c67376d95..000000000 --- a/debian/patches/bugfix/all/bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch +++ /dev/null @@ -1,89 +0,0 @@ -From: Daniel Borkmann -Date: Wed, 10 Feb 2016 16:47:11 +0100 -Subject: bpf: fix branch offset adjustment on backjumps after patching ctx - expansion -Origin: https://git.kernel.org/linus/a1b14d27ed0965838350f1377ff97c93ee383492 - -When ctx access is used, the kernel often needs to expand/rewrite -instructions, so after that patching, branch offsets have to be -adjusted for both forward and backward jumps in the new eBPF program, -but for backward jumps it fails to account the delta. Meaning, for -example, if the expansion happens exactly on the insn that sits at -the jump target, it doesn't fix up the back jump offset. - -Analysis on what the check in adjust_branches() is currently doing: - - /* adjust offset of jmps if necessary */ - if (i < pos && i + insn->off + 1 > pos) - insn->off += delta; - else if (i > pos && i + insn->off + 1 < pos) - insn->off -= delta; - -First condition (forward jumps): - - Before: After: - - insns[0] insns[0] - insns[1] <--- i/insn insns[1] <--- i/insn - insns[2] <--- pos insns[P] <--- pos - insns[3] insns[P] `------| delta - insns[4] <--- target_X insns[P] `-----| - insns[5] insns[3] - insns[4] <--- target_X - insns[5] - -First case is if we cross pos-boundary and the jump instruction was -before pos. This is handeled correctly. I.e. if i == pos, then this -would mean our jump that we currently check was the patchlet itself -that we just injected. Since such patchlets are self-contained and -have no awareness of any insns before or after the patched one, the -delta is correctly not adjusted. Also, for the second condition in -case of i + insn->off + 1 == pos, means we jump to that newly patched -instruction, so no offset adjustment are needed. That part is correct. - -Second condition (backward jumps): - - Before: After: - - insns[0] insns[0] - insns[1] <--- target_X insns[1] <--- target_X - insns[2] <--- pos <-- target_Y insns[P] <--- pos <-- target_Y - insns[3] insns[P] `------| delta - insns[4] <--- i/insn insns[P] `-----| - insns[5] insns[3] - insns[4] <--- i/insn - insns[5] - -Second interesting case is where we cross pos-boundary and the jump -instruction was after pos. Backward jump with i == pos would be -impossible and pose a bug somewhere in the patchlet, so the first -condition checking i > pos is okay only by itself. However, i + -insn->off + 1 < pos does not always work as intended to trigger the -adjustment. It works when jump targets would be far off where the -delta wouldn't matter. But, for example, where the fixed insn->off -before pointed to pos (target_Y), it now points to pos + delta, so -that additional room needs to be taken into account for the check. -This means that i) both tests here need to be adjusted into pos + delta, -and ii) for the second condition, the test needs to be <= as pos -itself can be a target in the backjump, too. - -Fixes: 9bac3d6d548e ("bpf: allow extended BPF programs access skb fields") -Signed-off-by: Daniel Borkmann -Signed-off-by: David S. Miller ---- - kernel/bpf/verifier.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index d1d3e8f57de9..2e7f7ab739e4 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -2082,7 +2082,7 @@ static void adjust_branches(struct bpf_prog *prog, int pos, int delta) - /* adjust offset of jmps if necessary */ - if (i < pos && i + insn->off + 1 > pos) - insn->off += delta; -- else if (i > pos && i + insn->off + 1 < pos) -+ else if (i > pos + delta && i + insn->off + 1 <= pos + delta) - insn->off -= delta; - } - } diff --git a/debian/patches/bugfix/all/genirq-Validate-action-before-dereferencing-it-in-ha.patch b/debian/patches/bugfix/all/genirq-Validate-action-before-dereferencing-it-in-ha.patch deleted file mode 100644 index d12bd31e1..000000000 --- a/debian/patches/bugfix/all/genirq-Validate-action-before-dereferencing-it-in-ha.patch +++ /dev/null @@ -1,100 +0,0 @@ -From: Thomas Gleixner -Date: Wed, 13 Jan 2016 14:07:25 +0100 -Subject: [PATCH] genirq: Validate action before dereferencing it in - handle_irq_event_percpu() -Origin: v4.5-rc2, commit:570540d50710ed192e98e2f7f74578c9486b6b05 - -commit 71f64340fc0e changed the handling of irq_desc->action from - -CPU 0 CPU 1 -free_irq() lock(desc) - lock(desc) handle_edge_irq() - if (desc->action) { - handle_irq_event() - action = desc->action - unlock(desc) - desc->action = NULL handle_irq_event_percpu(desc, action) - action->xxx -to - -CPU 0 CPU 1 -free_irq() lock(desc) - lock(desc) handle_edge_irq() - if (desc->action) { - handle_irq_event() - unlock(desc) - desc->action = NULL handle_irq_event_percpu(desc, action) - action = desc->action - action->xxx - -So if free_irq manages to set the action to NULL between the unlock and before -the readout, we happily dereference a null pointer. - -We could simply revert 71f64340fc0e, but we want to preserve the better code -generation. A simple solution is to change the action loop from a do {} while -to a while {} loop. - -This is safe because we either see a valid desc->action or NULL. If the action -is about to be removed it is still valid as free_irq() is blocked on -synchronize_irq(). - -CPU 0 CPU 1 -free_irq() lock(desc) - lock(desc) handle_edge_irq() - handle_irq_event(desc) - set(INPROGRESS) - unlock(desc) - handle_irq_event_percpu(desc) - action = desc->action - desc->action = NULL while (action) { - action->xxx - ... - action = action->next; - sychronize_irq() - while(INPROGRESS); lock(desc) - clr(INPROGRESS) -free(action) - -That's basically the same mechanism as we have for shared -interrupts. action->next can become NULL while handle_irq_event_percpu() -runs. Either it sees the action or NULL. It does not matter, because action -itself cannot go away before the interrupt in progress flag has been cleared. - -Fixes: commit 71f64340fc0e "genirq: Remove the second parameter from handle_irq_event_percpu()" -Reported-by: zyjzyj2000@gmail.com -Signed-off-by: Thomas Gleixner -Cc: Huang Shijie -Cc: Jiang Liu -Cc: Peter Zijlstra -Cc: stable@vger.kernel.org -Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1601131224190.3575@nanos ---- - kernel/irq/handle.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c -index a302cf9a2126..57bff7857e87 100644 ---- a/kernel/irq/handle.c -+++ b/kernel/irq/handle.c -@@ -138,7 +138,8 @@ irqreturn_t handle_irq_event_percpu(struct irq_desc *desc) - unsigned int flags = 0, irq = desc->irq_data.irq; - struct irqaction *action = desc->action; - -- do { -+ /* action might have become NULL since we dropped the lock */ -+ while (action) { - irqreturn_t res; - - trace_irq_handler_entry(irq, action); -@@ -173,7 +174,7 @@ irqreturn_t handle_irq_event_percpu(struct irq_desc *desc) - - retval |= res; - action = action->next; -- } while (action); -+ } - - add_interrupt_randomness(irq, flags); - --- -2.7.0 - diff --git a/debian/patches/bugfix/all/iff_no_queue-fix-for-drivers-not-calling-ether_setup.patch b/debian/patches/bugfix/all/iff_no_queue-fix-for-drivers-not-calling-ether_setup.patch deleted file mode 100644 index defcd9602..000000000 --- a/debian/patches/bugfix/all/iff_no_queue-fix-for-drivers-not-calling-ether_setup.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: Phil Sutter -Date: Wed, 17 Feb 2016 15:37:43 +0100 -Subject: IFF_NO_QUEUE: Fix for drivers not calling ether_setup() -Origin: http://mid.gmane.org/1455719863-25730-1-git-send-email-phil@nwl.cc - -My implementation around IFF_NO_QUEUE driver flag assumed that leaving -tx_queue_len untouched (specifically: not setting it to zero) by drivers -would make it possible to assign a regular qdisc to them without having -to worry about setting tx_queue_len to a useful value. This was only -partially true: I overlooked that some drivers don't call ether_setup() -and therefore not initialize tx_queue_len to the default value of 1000. -Consequently, removing the workarounds in place for that case in qdisc -implementations which cared about it (namely, pfifo, bfifo, gred, htb, -plug and sfb) leads to problems with these specific interface types and -qdiscs. - -Luckily, there's already a sanitization point for drivers setting -tx_queue_len to zero, which can be reused to assign the fallback value -most qdisc implementations used, which is 1. - -Fixes: 348e3435cbefa ("net: sched: drop all special handling of tx_queue_len == 0") -Tested-by: Mathieu Desnoyers -Signed-off-by: Phil Sutter ---- - net/core/dev.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -7125,8 +7125,10 @@ struct net_device *alloc_netdev_mqs(int - dev->priv_flags = IFF_XMIT_DST_RELEASE | IFF_XMIT_DST_RELEASE_PERM; - setup(dev); - -- if (!dev->tx_queue_len) -+ if (!dev->tx_queue_len) { - dev->priv_flags |= IFF_NO_QUEUE; -+ dev->tx_queue_len = 1; -+ } - - dev->num_tx_queues = txqs; - dev->real_num_tx_queues = txqs; diff --git a/debian/patches/bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch b/debian/patches/bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch deleted file mode 100644 index 002fb6052..000000000 --- a/debian/patches/bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch +++ /dev/null @@ -1,38 +0,0 @@ -From: Hariprasad S -Date: Fri, 11 Dec 2015 13:59:17 +0530 -Subject: iw_cxgb3: Fix incorrectly returning error on success -Origin: https://git.kernel.org/linus/67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 - -The cxgb3_*_send() functions return NET_XMIT_ values, which are -positive integers values. So don't treat positive return values -as an error. - -Signed-off-by: Steve Wise -Signed-off-by: Hariprasad Shenai -Signed-off-by: Doug Ledford ---- - drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c -index cb78b1e9bcd9..f504ba73e5dc 100644 ---- a/drivers/infiniband/hw/cxgb3/iwch_cm.c -+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c -@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *tdev, struct sk_buff *skb, struct l2t_en - error = l2t_send(tdev, skb, l2e); - if (error < 0) - kfree_skb(skb); -- return error; -+ return error < 0 ? error : 0; - } - - int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb) -@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb) - error = cxgb3_ofld_send(tdev, skb); - if (error < 0) - kfree_skb(skb); -- return error; -+ return error < 0 ? error : 0; - } - - static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb) diff --git a/debian/patches/bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch b/debian/patches/bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch deleted file mode 100644 index 55090c624..000000000 --- a/debian/patches/bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch +++ /dev/null @@ -1,70 +0,0 @@ -From: Tejun Heo -Date: Tue, 9 Feb 2016 18:14:48 -0500 -Subject: Revert "workqueue: make sure delayed work run in local cpu" -Origin: http://mid.gmane.org/1455059690-18765-2-git-send-email-tj@kernel.org - -This reverts commit 874bbfe600a660cba9c776b3957b1ce393151b76. - -Workqueue used to implicity guarantee that work items queued without -explicit CPU specified are put on the local CPU. Recent changes in -timer broke the guarantee and led to vmstat breakage which was fixed -by 176bed1de5bf ("vmstat: explicitly schedule per-cpu work on the CPU -we need it to run on"). - -vmstat is the most likely to expose the issue and it's quite possible -that there are other similar problems which are a lot more difficult -to trigger. As a preventive measure, 874bbfe600a6 ("workqueue: make -sure delayed work run in local cpu") was applied to restore the local -CPU guarnatee. Unfortunately, the change exposed a bug in timer code -which got fixed by 22b886dd1018 ("timers: Use proper base migration in -add_timer_on()"). Due to code restructuring, the commit couldn't be -backported beyond certain point and stable kernels which only had -874bbfe600a6 started crashing. - -The local CPU guarantee was accidental more than anything else and we -want to get rid of it anyway. As, with the vmstat case fixed, -874bbfe600a6 is causing more problems than it's fixing, it has been -decided to take the chance and officially break the guarantee by -reverting the commit. A debug feature will be added to force foreign -CPU assignment to expose cases relying on the guarantee and fixes for -the individual cases will be backported to stable as necessary. - -Signed-off-by: Tejun Heo -Fixes: 874bbfe600a6 ("workqueue: make sure delayed work run in local cpu") -Link: http://lkml.kernel.org/g/20160120211926.GJ10810@quack.suse.cz -Cc: stable@vger.kernel.org -Cc: Mike Galbraith -Cc: Henrique de Moraes Holschuh -Cc: Daniel Bilik -Cc: Jan Kara -Cc: Shaohua Li -Cc: Sasha Levin -Cc: Ben Hutchings -Cc: Thomas Gleixner -Cc: Daniel Bilik -Cc: Jiri Slaby -Cc: Michal Hocko ---- - kernel/workqueue.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu - timer_stats_timer_set_start_info(&dwork->timer); - - dwork->wq = wq; -- /* timer isn't guaranteed to run in this cpu, record earlier */ -- if (cpu == WORK_CPU_UNBOUND) -- cpu = raw_smp_processor_id(); - dwork->cpu = cpu; - timer->expires = jiffies + delay; - -- add_timer_on(timer, cpu); -+ if (unlikely(cpu != WORK_CPU_UNBOUND)) -+ add_timer_on(timer, cpu); -+ else -+ add_timer(timer); - } - - /** diff --git a/debian/patches/bugfix/all/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch b/debian/patches/bugfix/all/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch deleted file mode 100644 index b646fcc36..000000000 --- a/debian/patches/bugfix/all/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch +++ /dev/null @@ -1,155 +0,0 @@ -From: Hannes Frederic Sowa -Date: Wed, 3 Feb 2016 02:11:03 +0100 -Subject: unix: correctly track in-flight fds in sending process user_struct -Origin: https://git.kernel.org/linus/415e3d3e90ce9e18727e8843ae343eda5a58fad6 - -The commit referenced in the Fixes tag incorrectly accounted the number -of in-flight fds over a unix domain socket to the original opener -of the file-descriptor. This allows another process to arbitrary -deplete the original file-openers resource limit for the maximum of -open files. Instead the sending processes and its struct cred should -be credited. - -To do so, we add a reference counted struct user_struct pointer to the -scm_fp_list and use it to account for the number of inflight unix fds. - -Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") -Reported-by: David Herrmann -Cc: David Herrmann -Cc: Willy Tarreau -Cc: Linus Torvalds -Suggested-by: Linus Torvalds -Signed-off-by: Hannes Frederic Sowa -Signed-off-by: David S. Miller ---- - include/net/af_unix.h | 4 ++-- - include/net/scm.h | 1 + - net/core/scm.c | 7 +++++++ - net/unix/af_unix.c | 4 ++-- - net/unix/garbage.c | 8 ++++---- - 5 files changed, 16 insertions(+), 8 deletions(-) - -diff --git a/include/net/af_unix.h b/include/net/af_unix.h -index 2a91a0561a47..9b4c418bebd8 100644 ---- a/include/net/af_unix.h -+++ b/include/net/af_unix.h -@@ -6,8 +6,8 @@ - #include - #include - --void unix_inflight(struct file *fp); --void unix_notinflight(struct file *fp); -+void unix_inflight(struct user_struct *user, struct file *fp); -+void unix_notinflight(struct user_struct *user, struct file *fp); - void unix_gc(void); - void wait_for_unix_gc(void); - struct sock *unix_get_socket(struct file *filp); -diff --git a/include/net/scm.h b/include/net/scm.h -index 262532d111f5..59fa93c01d2a 100644 ---- a/include/net/scm.h -+++ b/include/net/scm.h -@@ -21,6 +21,7 @@ struct scm_creds { - struct scm_fp_list { - short count; - short max; -+ struct user_struct *user; - struct file *fp[SCM_MAX_FD]; - }; - -diff --git a/net/core/scm.c b/net/core/scm.c -index 14596fb37172..2696aefdc148 100644 ---- a/net/core/scm.c -+++ b/net/core/scm.c -@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - *fplp = fpl; - fpl->count = 0; - fpl->max = SCM_MAX_FD; -+ fpl->user = NULL; - } - fpp = &fpl->fp[fpl->count]; - -@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) - *fpp++ = file; - fpl->count++; - } -+ -+ if (!fpl->user) -+ fpl->user = get_uid(current_user()); -+ - return num; - } - -@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm) - scm->fp = NULL; - for (i=fpl->count-1; i>=0; i--) - fput(fpl->fp[i]); -+ free_uid(fpl->user); - kfree(fpl); - } - } -@@ -336,6 +342,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) - for (i = 0; i < fpl->count; i++) - get_file(fpl->fp[i]); - new_fpl->max = new_fpl->count; -+ new_fpl->user = get_uid(fpl->user); - } - return new_fpl; - } -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index 49d5093eb055..29be035f9c65 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -1496,7 +1496,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) - UNIXCB(skb).fp = NULL; - - for (i = scm->fp->count-1; i >= 0; i--) -- unix_notinflight(scm->fp->fp[i]); -+ unix_notinflight(scm->fp->user, scm->fp->fp[i]); - } - - static void unix_destruct_scm(struct sk_buff *skb) -@@ -1561,7 +1561,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) - return -ENOMEM; - - for (i = scm->fp->count - 1; i >= 0; i--) -- unix_inflight(scm->fp->fp[i]); -+ unix_inflight(scm->fp->user, scm->fp->fp[i]); - return max_level; - } - -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 8fcdc2283af5..6a0d48525fcf 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -116,7 +116,7 @@ struct sock *unix_get_socket(struct file *filp) - * descriptor if it is for an AF_UNIX socket. - */ - --void unix_inflight(struct file *fp) -+void unix_inflight(struct user_struct *user, struct file *fp) - { - struct sock *s = unix_get_socket(fp); - -@@ -133,11 +133,11 @@ void unix_inflight(struct file *fp) - } - unix_tot_inflight++; - } -- fp->f_cred->user->unix_inflight++; -+ user->unix_inflight++; - spin_unlock(&unix_gc_lock); - } - --void unix_notinflight(struct file *fp) -+void unix_notinflight(struct user_struct *user, struct file *fp) - { - struct sock *s = unix_get_socket(fp); - -@@ -152,7 +152,7 @@ void unix_notinflight(struct file *fp) - list_del_init(&u->link); - unix_tot_inflight--; - } -- fp->f_cred->user->unix_inflight--; -+ user->unix_inflight--; - spin_unlock(&unix_gc_lock); - } - diff --git a/debian/patches/bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch b/debian/patches/bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch deleted file mode 100644 index d28050471..000000000 --- a/debian/patches/bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch +++ /dev/null @@ -1,67 +0,0 @@ -From: Daniel Vetter -Date: Fri, 23 Oct 2015 10:56:12 +0200 -Subject: drm/i915: shut up gen8+ SDE irq dmesg noise -Origin: http://cgit.freedesktop.org/drm-intel/commit?id=97e5ed1111dcc5300a0f59a55248cd243937a8ab - -We get tons of cases where the master interrupt handler apparently set -a bit, with the SDEIIR disagreeing. No idea what's going on there, but -it's consistent on gen8+, no one seems to care about it and it's -making CI results flaky. - -Shut it up. - -No idea what's going on here, but we've had fun with PCH interrupts -before: - -commit 44498aea293b37af1d463acd9658cdce1ecdf427 -Author: Paulo Zanoni -Date: Fri Feb 22 17:05:28 2013 -0300 - - drm/i915: also disable south interrupts when handling them - -Note that there's a regression report in Bugzilla, and other -regression reports on the mailing lists keep croping up. But no ill -effects have ever been reported. But for paranoia still keep the -message at a debug level as a breadcrumb, just in case. - -This message was introduced in - -commit 38cc46d73ed99dd7002f1406002e52d7975d16cc -Author: Oscar Mateo -Date: Mon Jun 16 16:10:59 2014 +0100 - - drm/i915/bdw: Ack interrupts before handling them (GEN8) - -v2: Improve commit message a bit. - -Cc: Paulo Zanoni -Signed-off-by: Daniel Vetter -Link: http://patchwork.freedesktop.org/patch/msgid/1445590572-23631-2-git-send-email-daniel.vetter@ffwll.ch -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=92084 -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=80896 -Acked-by: Mika Kuoppala -Signed-off-by: Daniel Vetter -[bwh: Adjust context] ---- - drivers/gpu/drm/i915/i915_irq.c | 10 +++++++--- - 1 file changed, 7 insertions(+), 3 deletions(-) - ---- a/drivers/gpu/drm/i915/i915_irq.c -+++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -2354,9 +2354,13 @@ static irqreturn_t gen8_irq_handler(int - spt_irq_handler(dev, pch_iir); - else - cpt_irq_handler(dev, pch_iir); -- } else -- DRM_ERROR("The master control interrupt lied (SDE)!\n"); -- -+ } else { -+ /* -+ * Like on previous PCH there seems to be something -+ * fishy going on with forwarding PCH interrupts. -+ */ -+ DRM_DEBUG_DRIVER("The master control interrupt lied (SDE)!\n"); -+ } - } - - I915_WRITE_FW(GEN8_MASTER_IRQ, GEN8_MASTER_IRQ_CONTROL); diff --git a/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch b/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch deleted file mode 100644 index dd2d3da59..000000000 --- a/debian/patches/bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch +++ /dev/null @@ -1,60 +0,0 @@ -From: Thomas Hellstrom -Date: Fri, 8 Jan 2016 20:29:40 +0100 -Subject: drm/vmwgfx: Fix a width / pitch mismatch on framebuffer updates -Origin: https://git.kernel.org/linus/a50e2bf5a0f674d62b69f51f6935a30e82bd015c - -When the framebuffer is a vmwgfx dma buffer and a proxy surface is -created, the vmw_kms_update_proxy() function requires that the proxy -surface width and the framebuffer pitch are compatible, otherwise -display corruption occurs as seen in gnome-shell/native with software -3D. Since the framebuffer pitch is determined by user-space, allocate -a proxy surface the width of which is based on the framebuffer pitch -rather than on the framebuffer width. - -Cc: -Reported-by: Raphael Hertzog -Tested-by: Mati Aharoni -Signed-off-by: Thomas Hellstrom -Reviewed-by: Brian Paul -Signed-off-by: Dave Airlie ---- - drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -725,21 +725,25 @@ static int vmw_create_dmabuf_proxy(struc - uint32_t format; - struct drm_vmw_size content_base_size; - struct vmw_resource *res; -+ unsigned int bytes_pp; - int ret; - - switch (mode_cmd->depth) { - case 32: - case 24: - format = SVGA3D_X8R8G8B8; -+ bytes_pp = 4; - break; - - case 16: - case 15: - format = SVGA3D_R5G6B5; -+ bytes_pp = 2; - break; - - case 8: - format = SVGA3D_P8; -+ bytes_pp = 1; - break; - - default: -@@ -747,7 +751,7 @@ static int vmw_create_dmabuf_proxy(struc - return -EINVAL; - } - -- content_base_size.width = mode_cmd->width; -+ content_base_size.width = mode_cmd->pitch / bytes_pp; - content_base_size.height = mode_cmd->height; - content_base_size.depth = 1; - diff --git a/debian/patches/bugfix/x86/kvm-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch b/debian/patches/bugfix/x86/kvm-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch deleted file mode 100644 index 96bf2de67..000000000 --- a/debian/patches/bugfix/x86/kvm-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch +++ /dev/null @@ -1,58 +0,0 @@ -From: Paolo Bonzini -Date: Fri, 19 Feb 2016 18:07:21 +0100 -Subject: KVM: x86: fix conversion of addresses to linear in 32-bit protected - mode -Origin: https://git.kernel.org/linus/0c1d77f4ba5cc9c05a29adca3d6466cdf4969b70 - -Commit e8dd2d2d641c ("Silence compiler warning in arch/x86/kvm/emulate.c", -2015-09-06) broke boot of the Hurd. The bug is that the "default:" -case actually could modify "la", but after the patch this change is -not reflected in *linear. - -The bug is visible whenever a non-zero segment base causes the linear -address to wrap around the 4GB mark. - -Fixes: e8dd2d2d641cb2724ee10e76c0ad02e04289c017 -Cc: stable@vger.kernel.org -Reported-by: Aurelien Jarno -Tested-by: Aurelien Jarno -Signed-off-by: Paolo Bonzini ---- - arch/x86/kvm/emulate.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 1505587..b9b09fe 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -650,10 +650,10 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, - u16 sel; - - la = seg_base(ctxt, addr.seg) + addr.ea; -- *linear = la; - *max_size = 0; - switch (mode) { - case X86EMUL_MODE_PROT64: -+ *linear = la; - if (is_noncanonical_address(la)) - goto bad; - -@@ -662,6 +662,7 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, - goto bad; - break; - default: -+ *linear = la = (u32)la; - usable = ctxt->ops->get_segment(ctxt, &sel, &desc, NULL, - addr.seg); - if (!usable) -@@ -689,7 +690,6 @@ static __always_inline int __linearize(struct x86_emulate_ctxt *ctxt, - if (size > *max_size) - goto bad; - } -- la &= (u32)-1; - break; - } - if (insn_aligned(ctxt, size) && ((la & (size - 1)) != 0)) --- -2.7.0 - diff --git a/debian/patches/features/all/rt/btrfs-initialize-the-seq-counter-in-struct-btrfs_dev.patch b/debian/patches/features/all/rt/btrfs-initialize-the-seq-counter-in-struct-btrfs_dev.patch deleted file mode 100644 index 96e3f46b4..000000000 --- a/debian/patches/features/all/rt/btrfs-initialize-the-seq-counter-in-struct-btrfs_dev.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Sebastian Andrzej Siewior -Date: Fri, 15 Jan 2016 14:28:39 +0100 -Subject: btrfs: initialize the seq counter in struct btrfs_device -Origin: https://www.kernel.org/pub/linux/kernel/projects/rt/4.4/patches-4.4.3-rt9.tar.xz - -I managed to trigger this: -| INFO: trying to register non-static key. -| the code is fine but needs lockdep annotation. -| turning off the locking correctness validator. -| CPU: 1 PID: 781 Comm: systemd-gpt-aut Not tainted 4.4.0-rt2+ #14 -| Hardware name: ARM-Versatile Express -| [<80307cec>] (dump_stack) -| [<80070e98>] (__lock_acquire) -| [<8007184c>] (lock_acquire) -| [<80287800>] (btrfs_ioctl) -| [<8012a8d4>] (do_vfs_ioctl) -| [<8012ac14>] (SyS_ioctl) - -so I think that btrfs_device_data_ordered_init() is not invoked behind -a macro somewhere. - -Fixes: 7cc8e58d53cd ("Btrfs: fix unprotected device's variants on 32bits machine") -Signed-off-by: Sebastian Andrzej Siewior ---- - fs/btrfs/volumes.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -232,6 +232,7 @@ static struct btrfs_device *__alloc_devi - spin_lock_init(&dev->reada_lock); - atomic_set(&dev->reada_in_flight, 0); - atomic_set(&dev->dev_stats_ccnt, 0); -+ btrfs_device_data_ordered_init(dev); - INIT_RADIX_TREE(&dev->reada_zones, GFP_NOFS & ~__GFP_DIRECT_RECLAIM); - INIT_RADIX_TREE(&dev->reada_extents, GFP_NOFS & ~__GFP_DIRECT_RECLAIM); - diff --git a/debian/patches/series b/debian/patches/series index 0405482e6..ef6054aea 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -42,9 +42,6 @@ debian/snd-pcsp-disable-autoload.patch bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch # Arch bug fixes -bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch -bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch -bugfix/x86/kvm-fix-conversion-of-addresses-to-linear-in-32-bit-protected-mode.patch bugfix/mips/mips-math-emu-correctly-handle-nop-emulation.patch # Arch features @@ -105,14 +102,6 @@ bugfix/all/misc-bmp085-Enable-building-as-a-module.patch bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch bugfix/all/disable-some-marvell-phys.patch bugfix/all/rtsx_usb_ms-use-msleep_interruptible-in-polling-loop.patch -bugfix/all/bcache-fix-a-livelock-when-we-cause-a-huge-number-of.patch -bugfix/all/bcache-add-a-cond_resched-call-to-gc.patch -bugfix/all/bcache-clear-bcache_dev_unlink_done-flag-when-attach.patch -bugfix/all/bcache-fix-a-leak-in-bch_cached_dev_run.patch -bugfix/all/bcache-unregister-reboot-notifier-if-bcache-fails-to.patch -bugfix/all/bcache-allows-use-of-register-in-udev-to-avoid-devic.patch -bugfix/all/bcache-prevent-crash-on-changing-writeback_running.patch -bugfix/all/bcache-change-refill_dirty-to-always-scan-entire-dis.patch bugfix/all/rt2x00-fix-monitor-mode-regression.patch # Miscellaneous features @@ -128,12 +117,6 @@ bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch bugfix/all/media-usbvision-fix-crash-on-detecting-device-with-i.patch bugfix/all/ptrace-being-capable-wrt-a-process-requires-mapped-uids-gids.patch bugfix/all/pipe-limit-the-per-user-amount-of-pages-allocated-in.patch -bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch -bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch -bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch -bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch -bugfix/all/bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch -bugfix/all/genirq-Validate-action-before-dereferencing-it-in-ha.patch bugfix/x86/x86-mm-page-align-the-_end-symbol-to-avoid-pfn-conve.patch bugfix/x86/x86-mm-pat-ensure-cpa-pfn-only-contains-page-frame-n.patch bugfix/x86/x86-efi-map-ram-into-the-identity-page-table-for-mix.patch @@ -141,8 +124,6 @@ bugfix/x86/x86-efi-hoist-page-table-switching-code-into-efi_cal.patch bugfix/x86/x86-efi-build-our-own-page-table-structures.patch bugfix/x86/x86-efi-setup-separate-efi-page-tables-in-kexec-path.patch debian/i386-686-pae-pci-set-pci-nobios-by-default.patch -bugfix/all/iff_no_queue-fix-for-drivers-not-calling-ether_setup.patch bugfix/arm/net-mv643xx_eth-fix-packet-corruption-with-tso-and-t.patch bugfix/x86/x86-efi-bgrt-fix-kernel-panic-when-mapping-bgrt-data.patch bugfix/x86/x86-efi-bgrt-replace-early_memremap-with-memremap.patch -bugfix/all/unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch diff --git a/debian/patches/series-rt b/debian/patches/series-rt index 3eb041170..771ec3fb4 100644 --- a/debian/patches/series-rt +++ b/debian/patches/series-rt @@ -15,7 +15,6 @@ features/all/rt/arm64-replace-read_lock-to-rcu-lock-in-call_step_hoo.patch ############################################################ # Stuff broken upstream, patches submitted ############################################################ -features/all/rt/btrfs-initialize-the-seq-counter-in-struct-btrfs_dev.patch features/all/rt/sched-use-tsk_cpus_allowed-instead-of-accessing-cpus.patch features/all/rt/sched-provide-a-tsk_nr_cpus_allowed-helper.patch features/all/rt/drivers-cpuidle-coupled-fix-warning-cpuidle_coupled_.patch