Update to 4.4.3
Drop several patches that are included in it.
This commit is contained in:
parent
dbe11b4d3b
commit
bcf60af755
|
@ -1,4 +1,143 @@
|
|||
linux (4.4.2-4) UNRELEASED; urgency=medium
|
||||
linux (4.4.3-1) UNRELEASED; urgency=medium
|
||||
|
||||
[ Salvatore Bonaccorso ]
|
||||
* New upstream stable update:
|
||||
https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.3
|
||||
- x86/mm: Fix types used in pgprot cacheability flags translations
|
||||
- x86/mm/pat: Avoid truncation when converting cpa->numpages to address
|
||||
- x86/uaccess/64: Make the __copy_user_nocache() assembly code more readable
|
||||
- x86/uaccess/64: Handle the caching of 4-byte nocache copies properly in __copy_user_nocache()
|
||||
- x86/mm: Fix vmalloc_fault() to handle large pages properly
|
||||
- ALSA: hda - Cancel probe work instead of flush at remove
|
||||
- ALSA: pcm: Fix rwsem deadlock for non-atomic PCM stream
|
||||
- ALSA: seq: Fix leak of pool buffer at concurrent writes
|
||||
- ALSA: seq: Fix double port list deletion
|
||||
- phy: twl4030-usb: Relase usb phy on unload
|
||||
- phy: twl4030-usb: Fix unbalanced pm_runtime_enable on module reload
|
||||
- staging/speakup: Use tty_ldisc_ref() for paste kworker
|
||||
- pty: fix possible use after free of tty->driver_data
|
||||
- pty: make sure super_block is still valid in final /dev/tty close
|
||||
- tty: Add support for PCIe WCH382 2S multi-IO card
|
||||
- serial: 8250_pci: Add Intel Broadwell ports
|
||||
- serial: omap: Prevent DoS using unprivileged ioctl(TIOCSRS485)
|
||||
- ext4: fix scheduling in atomic on group checksum failure
|
||||
- ext4: fix potential integer overflow
|
||||
- ext4: don't read blocks from disk after extents being swapped
|
||||
- btrfs: handle invalid num_stripes in sys_array
|
||||
- Btrfs: fix fitrim discarding device area reserved for boot loader's use
|
||||
- Revert "btrfs: clear PF_NOFREEZE in cleaner_kthread()"
|
||||
- btrfs: properly set the termination value of ctx->pos in readdir
|
||||
- Btrfs: fix invalid page accesses in extent_same (dedup) ioctl
|
||||
- Btrfs: fix page reading in extent_same ioctl leading to csum errors
|
||||
- Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl
|
||||
- Btrfs: fix direct IO requests not reporting IO error to user space
|
||||
- ptrace: use fsuid, fsgid, effective creds for fs access checks
|
||||
- tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines
|
||||
- perf tools: tracepoint_error() can receive e=NULL, robustify it
|
||||
- tracing: Fix freak link error caused by branch tracer
|
||||
- tracepoints: Do not trace when cpu is offline
|
||||
- klist: fix starting point removed bug in klist iterators
|
||||
- scsi: add Synology to 1024 sector blacklist
|
||||
- iscsi-target: Fix potential dead-lock during node acl delete
|
||||
- SCSI: fix crashes in sd and sr runtime PM
|
||||
- drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration
|
||||
- scsi_dh_rdac: always retry MODE SELECT on command lock violation
|
||||
- SCSI: Add Marvell Console to VPD blacklist
|
||||
- scsi: fix soft lockup in scsi_remove_target() on module removal
|
||||
- iio: adis_buffer: Fix out-of-bounds memory access
|
||||
- iio:adc:ti_am335x_adc Fix buffered mode by identifying as software buffer.
|
||||
- iio-light: Use a signed return type for ltr501_match_samp_freq()
|
||||
- iio: add HAS_IOMEM dependency to VF610_ADC
|
||||
- iio: add IIO_TRIGGER dependency to STK8BA50
|
||||
- iio: dac: mcp4725: set iio name property in sysfs
|
||||
- iio: light: acpi-als: Report data as processed
|
||||
- iio: pressure: mpl115: fix temperature offset sign
|
||||
- iio: inkern: fix a NULL dereference on error
|
||||
- cifs: Ratelimit kernel log messages
|
||||
- cifs: fix race between call_async() and reconnect()
|
||||
- cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
|
||||
- cifs: fix erroneous return value
|
||||
- NFS: Fix attribute cache revalidation
|
||||
- pNFS/flexfiles: Fix an Oopsable typo in ff_mirror_match_fh()
|
||||
- nfs: Fix race in __update_open_stateid()
|
||||
- pNFS/flexfiles: Fix an XDR encoding bug in layoutreturn
|
||||
- udf: limit the maximum number of indirect extents in a row
|
||||
- udf: Prevent buffer overrun with multi-byte characters
|
||||
- udf: Check output buffer length when converting name to CS0
|
||||
- SUNRPC: Fixup socket wait for memory
|
||||
- powerpc/eeh: Fix PE location code
|
||||
- powerpc/eeh: Fix stale cached primary bus
|
||||
- powerpc/powernv: Fix stale PE primary bus
|
||||
- powerpc/ioda: Set "read" permission when "write" is set
|
||||
- ARM: mvebu: remove duplicated regulator definition in Armada 388 GP
|
||||
- arm64: mm: avoid calling apply_to_page_range on empty range
|
||||
- ARM: 8519/1: ICST: try other dividends than 1
|
||||
- ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
|
||||
- ARM: nomadik: fix up SD/MMC DT settings
|
||||
- ARM: dts: Fix wl12xx missing clocks that cause hangs
|
||||
- ARM: dts: Fix omap5 PMIC control lines for RTC writes
|
||||
- ARM: dts: omap5-board-common: enable rtc and charging of backup battery
|
||||
- ARM: dts: at91: sama5d4 xplained: properly mux phy interrupt
|
||||
- ARM: dts: at91: sama5d4: fix instance id of DBGU
|
||||
- ARM: dts: at91: sama5d4 xplained: fix phy0 IRQ type
|
||||
- ARM: dts: at91: sama5d4ek: add phy address and IRQ for macb0
|
||||
- ARM: OMAP2+: Fix wait_dll_lock_timed for rodata
|
||||
- ARM: OMAP2+: Fix l2_inv_api_params for rodata
|
||||
- ARM: OMAP2+: Fix l2dis_3630 for rodata
|
||||
- ARM: OMAP2+: Fix save_secure_ram_context for rodata
|
||||
- ARM: OMAP2+: Fix ppa_zero_params and ppa_por_params for rodata
|
||||
- arm64: dma-mapping: fix handling of devices registered before arch_initcall
|
||||
- KVM: arm/arm64: Fix reference to uninitialised VGIC
|
||||
- KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
|
||||
- KVM: PPC: Fix ONE_REG AltiVec support
|
||||
- perf kvm record/report: 'unprocessable sample' error while recording/reporting guest data
|
||||
- mm: soft-offline: check return value in second __get_any_page() call
|
||||
- libnvdimm: fix namespace object confusion in is_uuid_busy()
|
||||
- mm: fix mlock accouting
|
||||
- mm: replace vma_lock_anon_vma with anon_vma_lock_read/write
|
||||
- mm: fix regression in remap_file_pages() emulation
|
||||
- Input: elantech - mark protocols v2 and v3 as semi-mt
|
||||
- Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
|
||||
- string_helpers: fix precision loss for some inputs
|
||||
- Input: vmmouse - fix absolute device registration
|
||||
- iommu/vt-d: Don't skip PCI devices when disabling IOTLB
|
||||
- iommu/amd: Correct the wrong setting of alias DTE in do_attach
|
||||
- iommu/vt-d: Fix mm refcounting to hold mm_count not mm_users
|
||||
- iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
|
||||
- iommu/vt-d: Clear PPR bit to ensure we get more page request interrupts
|
||||
- Revert "xhci: don't finish a TD if we get a short-transfer event mid TD"
|
||||
- xhci: Fix list corruption in urb dequeue at host removal
|
||||
- m32r: fix m32104ut_defconfig build fail
|
||||
- dma-debug: switch check from _text to _stext
|
||||
- scripts/bloat-o-meter: fix python3 syntax error
|
||||
- fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list()
|
||||
- numa: fix /proc/<pid>/numa_maps for hugetlbfs on s390
|
||||
- memcg: only free spare array when readers are done
|
||||
- MAINTAINERS: return arch/sh to maintained state, with new maintainers
|
||||
- radix-tree: fix race in gang lookup
|
||||
- drivers/hwspinlock: fix race between radix tree insertion and lookup
|
||||
- radix-tree: fix oops after radix_tree_iter_retry
|
||||
- dump_stack: avoid potential deadlocks
|
||||
- mm,thp: khugepaged: call pte flush at the time of collapse
|
||||
- intel_scu_ipcutil: underflow in scu_reg_access()
|
||||
- ipc/shm: handle removed segments gracefully in shm_mmap()
|
||||
- devm_memremap_release(): fix memremap'd addr handling
|
||||
- futex: Drop refcount if requeue_pi() acquired the rtmutex
|
||||
- ovl: allow zero size xattr
|
||||
- ovl: use a minimal buffer in ovl_copy_xattr
|
||||
- ovl: check dentry positiveness in ovl_cleanup_whiteouts()
|
||||
- ovl: root: copy attr
|
||||
- ovl: setattr: check permissions before copy-up
|
||||
- libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
|
||||
- xfs: inode recovery readahead can race with inode buffer creation
|
||||
- Revert "xfs: clear PF_NOFREEZE for xfsaild kthread"
|
||||
- xfs: log mount failures don't wait for buffers to be released
|
||||
- prctl: take mmap sem for writing to protect against others
|
||||
- timerfd: Handle relative timers with CONFIG_TIME_LOW_RES proper
|
||||
- posix-timers: Handle relative timers with CONFIG_TIME_LOW_RES proper
|
||||
- itimers: Handle relative timers with CONFIG_TIME_LOW_RES proper
|
||||
- module: wrapper for symbol name.
|
||||
- modules: fix modparam async_probe request
|
||||
|
||||
[ Roger Shimizu ]
|
||||
* [armhf] dts: imx6dlq-wandboard-revb1: use unique model id
|
||||
|
@ -20,7 +159,7 @@ linux (4.4.2-4) UNRELEASED; urgency=medium
|
|||
* [x86] KVM: fix conversion of addresses to linear in 32-bit protected
|
||||
mode.
|
||||
|
||||
-- Roger Shimizu <rogershimizu@gmail.com> Wed, 24 Feb 2016 01:30:38 +0900
|
||||
-- Salvatore Bonaccorso <carnil@debian.org> Sun, 28 Feb 2016 07:02:42 +0100
|
||||
|
||||
linux (4.4.2-3) unstable; urgency=medium
|
||||
|
||||
|
|
|
@ -1,83 +0,0 @@
|
|||
From: Mike Kravetz <mike.kravetz@oracle.com>
|
||||
Date: Fri, 15 Jan 2016 16:57:37 -0800
|
||||
Subject: fs/hugetlbfs/inode.c: fix bugs in hugetlb_vmtruncate_list()
|
||||
Origin: https://git.kernel.org/linus/9aacdd354d197ad64685941b36d28ea20ab88757
|
||||
|
||||
Hillf Danton noticed bugs in the hugetlb_vmtruncate_list routine. The
|
||||
argument end is of type pgoff_t. It was being converted to a vaddr
|
||||
offset and passed to unmap_hugepage_range. However, end was also being
|
||||
used as an argument to the vma_interval_tree_foreach controlling loop.
|
||||
In addition, the conversion of end to vaddr offset was incorrect.
|
||||
|
||||
hugetlb_vmtruncate_list is called as part of a file truncate or
|
||||
fallocate hole punch operation.
|
||||
|
||||
When truncating a hugetlbfs file, this bug could prevent some pages from
|
||||
being unmapped. This is possible if there are multiple vmas mapping the
|
||||
file, and there is a sufficiently sized hole between the mappings. The
|
||||
size of the hole between two vmas (A,B) must be such that the starting
|
||||
virtual address of B is greater than (ending virtual address of A <<
|
||||
PAGE_SHIFT). In this case, the pages in B would not be unmapped. If
|
||||
pages are not properly unmapped during truncate, the following BUG is
|
||||
hit:
|
||||
|
||||
kernel BUG at fs/hugetlbfs/inode.c:428!
|
||||
|
||||
In the fallocate hole punch case, this bug could prevent pages from
|
||||
being unmapped as in the truncate case. However, for hole punch the
|
||||
result is that unmapped pages will not be removed during the operation.
|
||||
For hole punch, it is also possible that more pages than desired will be
|
||||
unmapped. This unnecessary unmapping will cause page faults to
|
||||
reestablish the mappings on subsequent page access.
|
||||
|
||||
Fixes: 1bfad99ab (" hugetlbfs: hugetlb_vmtruncate_list() needs to take a range")Reported-by: Hillf Danton <hillf.zj@alibaba-inc.com>
|
||||
Signed-off-by: Mike Kravetz <mike.kravetz@oracle.com>
|
||||
Cc: Hugh Dickins <hughd@google.com>
|
||||
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
|
||||
Cc: Davidlohr Bueso <dave@stgolabs.net>
|
||||
Cc: Dave Hansen <dave.hansen@linux.intel.com>
|
||||
Cc: <stable@vger.kernel.org> [4.3]
|
||||
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
fs/hugetlbfs/inode.c | 19 +++++++++++--------
|
||||
1 file changed, 11 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
|
||||
index bbc333b01ca3..9c07d2d754c9 100644
|
||||
--- a/fs/hugetlbfs/inode.c
|
||||
+++ b/fs/hugetlbfs/inode.c
|
||||
@@ -463,6 +463,7 @@ hugetlb_vmdelete_list(struct rb_root *root, pgoff_t start, pgoff_t end)
|
||||
*/
|
||||
vma_interval_tree_foreach(vma, root, start, end ? end : ULONG_MAX) {
|
||||
unsigned long v_offset;
|
||||
+ unsigned long v_end;
|
||||
|
||||
/*
|
||||
* Can the expression below overflow on 32-bit arches?
|
||||
@@ -475,15 +476,17 @@ hugetlb_vmdelete_list(struct rb_root *root, pgoff_t start, pgoff_t end)
|
||||
else
|
||||
v_offset = 0;
|
||||
|
||||
- if (end) {
|
||||
- end = ((end - start) << PAGE_SHIFT) +
|
||||
- vma->vm_start + v_offset;
|
||||
- if (end > vma->vm_end)
|
||||
- end = vma->vm_end;
|
||||
- } else
|
||||
- end = vma->vm_end;
|
||||
+ if (!end)
|
||||
+ v_end = vma->vm_end;
|
||||
+ else {
|
||||
+ v_end = ((end - vma->vm_pgoff) << PAGE_SHIFT)
|
||||
+ + vma->vm_start;
|
||||
+ if (v_end > vma->vm_end)
|
||||
+ v_end = vma->vm_end;
|
||||
+ }
|
||||
|
||||
- unmap_hugepage_range(vma, vma->vm_start + v_offset, end, NULL);
|
||||
+ unmap_hugepage_range(vma, vma->vm_start + v_offset, v_end,
|
||||
+ NULL);
|
||||
}
|
||||
}
|
||||
|
|
@ -34,8 +34,6 @@ Signed-off-by: Jann Horn <jann@thejh.net>
|
|||
kernel/ptrace.c | 33 ++++++++++++++++++++++++++++-----
|
||||
1 file changed, 28 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
|
||||
index b760bae..260a08d 100644
|
||||
--- a/kernel/ptrace.c
|
||||
+++ b/kernel/ptrace.c
|
||||
@@ -20,6 +20,7 @@
|
||||
|
@ -46,7 +44,7 @@ index b760bae..260a08d 100644
|
|||
#include <linux/syscalls.h>
|
||||
#include <linux/uaccess.h>
|
||||
#include <linux/regset.h>
|
||||
@@ -207,12 +208,34 @@ static int ptrace_check_attach(struct task_struct *child, bool ignore_state)
|
||||
@@ -207,12 +208,34 @@ static int ptrace_check_attach(struct ta
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
@ -84,16 +82,16 @@ index b760bae..260a08d 100644
|
|||
}
|
||||
|
||||
/* Returns 0 on success, -errno on denial. */
|
||||
@@ -241,7 +264,7 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode)
|
||||
gid_eq(cred->gid, tcred->sgid) &&
|
||||
gid_eq(cred->gid, tcred->gid))
|
||||
@@ -264,7 +287,7 @@ static int __ptrace_may_access(struct ta
|
||||
gid_eq(caller_gid, tcred->sgid) &&
|
||||
gid_eq(caller_gid, tcred->gid))
|
||||
goto ok;
|
||||
- if (ptrace_has_cap(tcred->user_ns, mode))
|
||||
+ if (ptrace_has_cap(tcred, mode))
|
||||
goto ok;
|
||||
rcu_read_unlock();
|
||||
return -EPERM;
|
||||
@@ -252,7 +275,7 @@ ok:
|
||||
@@ -275,7 +298,7 @@ ok:
|
||||
dumpable = get_dumpable(task->mm);
|
||||
rcu_read_lock();
|
||||
if (dumpable != SUID_DUMP_USER &&
|
||||
|
|
|
@ -1,36 +0,0 @@
|
|||
From: Ben Hutchings <ben@decadent.org.uk>
|
||||
Date: Sat, 02 Jan 2016 03:03:27 +0000
|
||||
Subject: Revert "xhci: don't finish a TD if we get a short transfer event mid TD"
|
||||
Bug-Debian: https://bugs.debian.org/808602
|
||||
Bug-Debian: https://bugs.debian.org/808953
|
||||
|
||||
This reverts commit e210c422b6fdd2dc123bedc588f399aefd8bf9de. It
|
||||
caused serious regressions as referenced above.
|
||||
|
||||
---
|
||||
--- a/drivers/usb/host/xhci-ring.c
|
||||
+++ b/drivers/usb/host/xhci-ring.c
|
||||
@@ -2192,10 +2192,6 @@ static int process_bulk_intr_td(struct x
|
||||
}
|
||||
/* Fast path - was this the last TRB in the TD for this URB? */
|
||||
} else if (event_trb == td->last_trb) {
|
||||
- if (td->urb_length_set && trb_comp_code == COMP_SHORT_TX)
|
||||
- return finish_td(xhci, td, event_trb, event, ep,
|
||||
- status, false);
|
||||
-
|
||||
if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
|
||||
td->urb->actual_length =
|
||||
td->urb->transfer_buffer_length -
|
||||
@@ -2247,12 +2243,6 @@ static int process_bulk_intr_td(struct x
|
||||
td->urb->actual_length +=
|
||||
TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
|
||||
EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
|
||||
-
|
||||
- if (trb_comp_code == COMP_SHORT_TX) {
|
||||
- xhci_dbg(xhci, "mid bulk/intr SP, wait for last TRB event\n");
|
||||
- td->urb_length_set = true;
|
||||
- return 0;
|
||||
- }
|
||||
}
|
||||
|
||||
return finish_td(xhci, td, event_trb, event, ep, status, false);
|
|
@ -1,82 +0,0 @@
|
|||
From: Alan Stern <stern@rowland.harvard.edu>
|
||||
Subject: SCSI: fix crashes in sd and sr runtime PM
|
||||
Date: Wed, 20 Jan 2016 11:26:01 -0500 (EST)
|
||||
Origin: http://article.gmane.org/gmane.linux.scsi/109795
|
||||
Bug-Debian: https://bugs.debian.org/801925
|
||||
|
||||
Runtime suspend during driver probe and removal can cause problems.
|
||||
The driver's runtime_suspend or runtime_resume callbacks may invoked
|
||||
before the driver has finished binding to the device or after the
|
||||
driver has unbound from the device.
|
||||
|
||||
This problem shows up with the sd and sr drivers, and can cause disk
|
||||
or CD/DVD drives to become unusable as a result. The fix is simple.
|
||||
The drivers store a pointer to the scsi_disk or scsi_cd structure as
|
||||
their private device data when probing is finished, so we simply have
|
||||
to be sure to clear the private data during removal and test it during
|
||||
runtime suspend/resume.
|
||||
|
||||
This fixes <https://bugs.debian.org/801925>.
|
||||
|
||||
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
|
||||
Reported-by: Paul Menzel <paul.menzel@giantmonkey.de>
|
||||
Reported-by: Erich Schubert <erich@debian.org>
|
||||
Reported-by: Alexandre Rossi <alexandre.rossi@gmail.com>
|
||||
Tested-by: Paul Menzel <paul.menzel@giantmonkey.de>
|
||||
CC: "James E.J. Bottomley" <JBottomley@odin.com>
|
||||
CC: Ben Hutchings <ben@decadent.org.uk>
|
||||
CC: <stable@vger.kernel.org>
|
||||
|
||||
---
|
||||
|
||||
|
||||
[as1795]
|
||||
|
||||
|
||||
drivers/scsi/sd.c | 7 +++++--
|
||||
drivers/scsi/sr.c | 4 ++++
|
||||
2 files changed, 9 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/drivers/scsi/sd.c
|
||||
+++ b/drivers/scsi/sd.c
|
||||
@@ -3142,8 +3142,8 @@ static int sd_suspend_common(struct devi
|
||||
struct scsi_disk *sdkp = dev_get_drvdata(dev);
|
||||
int ret = 0;
|
||||
|
||||
- if (!sdkp)
|
||||
- return 0; /* this can happen */
|
||||
+ if (!sdkp) /* E.g.: runtime suspend following sd_remove() */
|
||||
+ return 0;
|
||||
|
||||
if (sdkp->WCE && sdkp->media_present) {
|
||||
sd_printk(KERN_NOTICE, sdkp, "Synchronizing SCSI cache\n");
|
||||
@@ -3182,6 +3182,9 @@ static int sd_resume(struct device *dev)
|
||||
{
|
||||
struct scsi_disk *sdkp = dev_get_drvdata(dev);
|
||||
|
||||
+ if (!sdkp) /* E.g.: runtime resume at the start of sd_probe() */
|
||||
+ return 0;
|
||||
+
|
||||
if (!sdkp->device->manage_start_stop)
|
||||
return 0;
|
||||
|
||||
--- a/drivers/scsi/sr.c
|
||||
+++ b/drivers/scsi/sr.c
|
||||
@@ -144,6 +144,9 @@ static int sr_runtime_suspend(struct dev
|
||||
{
|
||||
struct scsi_cd *cd = dev_get_drvdata(dev);
|
||||
|
||||
+ if (!cd) /* E.g.: runtime suspend following sr_remove() */
|
||||
+ return 0;
|
||||
+
|
||||
if (cd->media_present)
|
||||
return -EBUSY;
|
||||
else
|
||||
@@ -985,6 +988,7 @@ static int sr_remove(struct device *dev)
|
||||
scsi_autopm_get_device(cd->device);
|
||||
|
||||
del_gendisk(cd->disk);
|
||||
+ dev_set_drvdata(dev, NULL);
|
||||
|
||||
mutex_lock(&sr_ref_mutex);
|
||||
kref_put(&cd->kref, sr_kref_release);
|
|
@ -1,45 +0,0 @@
|
|||
From: Jan Beulich <JBeulich@suse.com>
|
||||
Date: Tue, 26 Jan 2016 04:15:18 -0700
|
||||
Subject: x86/mm: Fix types used in pgprot cacheability flags translations
|
||||
Origin: https://git.kernel.org/linus/3625c2c234ef66acf21a72d47a5ffa94f6c5ebf2
|
||||
|
||||
For PAE kernels "unsigned long" is not suitable to hold page protection
|
||||
flags, since _PAGE_NX doesn't fit there. This is the reason for quite a
|
||||
few W+X pages getting reported as insecure during boot (observed namely
|
||||
for the entire initrd range).
|
||||
|
||||
Fixes: 281d4078be ("x86: Make page cache mode a real type")
|
||||
Signed-off-by: Jan Beulich <jbeulich@suse.com>
|
||||
Reviewed-by: Juergen Gross <JGross@suse.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
Link: http://lkml.kernel.org/r/56A7635602000078000CAFF1@prv-mh.provo.novell.com
|
||||
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
|
||||
---
|
||||
arch/x86/include/asm/pgtable_types.h | 6 ++----
|
||||
1 file changed, 2 insertions(+), 4 deletions(-)
|
||||
|
||||
--- a/arch/x86/include/asm/pgtable_types.h
|
||||
+++ b/arch/x86/include/asm/pgtable_types.h
|
||||
@@ -363,20 +363,18 @@ static inline enum page_cache_mode pgpro
|
||||
}
|
||||
static inline pgprot_t pgprot_4k_2_large(pgprot_t pgprot)
|
||||
{
|
||||
+ pgprotval_t val = pgprot_val(pgprot);
|
||||
pgprot_t new;
|
||||
- unsigned long val;
|
||||
|
||||
- val = pgprot_val(pgprot);
|
||||
pgprot_val(new) = (val & ~(_PAGE_PAT | _PAGE_PAT_LARGE)) |
|
||||
((val & _PAGE_PAT) << (_PAGE_BIT_PAT_LARGE - _PAGE_BIT_PAT));
|
||||
return new;
|
||||
}
|
||||
static inline pgprot_t pgprot_large_2_4k(pgprot_t pgprot)
|
||||
{
|
||||
+ pgprotval_t val = pgprot_val(pgprot);
|
||||
pgprot_t new;
|
||||
- unsigned long val;
|
||||
|
||||
- val = pgprot_val(pgprot);
|
||||
pgprot_val(new) = (val & ~(_PAGE_PAT | _PAGE_PAT_LARGE)) |
|
||||
((val & _PAGE_PAT_LARGE) >>
|
||||
(_PAGE_BIT_PAT_LARGE - _PAGE_BIT_PAT));
|
|
@ -8,11 +8,9 @@ Patch headers added by debian/patches/features/all/aufs4/gen-patch
|
|||
|
||||
aufs4.x-rcN mmap patch
|
||||
|
||||
diff --git a/fs/proc/base.c b/fs/proc/base.c
|
||||
index bd3e9e6..fc42216 100644
|
||||
--- a/fs/proc/base.c
|
||||
+++ b/fs/proc/base.c
|
||||
@@ -1921,7 +1921,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path)
|
||||
@@ -1922,7 +1922,7 @@ static int proc_map_files_get_link(struc
|
||||
down_read(&mm->mmap_sem);
|
||||
vma = find_exact_vma(mm, vm_start, vm_end);
|
||||
if (vma && vma->vm_file) {
|
||||
|
@ -21,11 +19,9 @@ index bd3e9e6..fc42216 100644
|
|||
path_get(path);
|
||||
rc = 0;
|
||||
}
|
||||
diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c
|
||||
index f8595e8..cb8eda0 100644
|
||||
--- a/fs/proc/nommu.c
|
||||
+++ b/fs/proc/nommu.c
|
||||
@@ -45,7 +45,10 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region)
|
||||
@@ -45,7 +45,10 @@ static int nommu_region_show(struct seq_
|
||||
file = region->vm_file;
|
||||
|
||||
if (file) {
|
||||
|
@ -37,11 +33,9 @@ index f8595e8..cb8eda0 100644
|
|||
dev = inode->i_sb->s_dev;
|
||||
ino = inode->i_ino;
|
||||
}
|
||||
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
|
||||
index 187b3b5..e03793e 100644
|
||||
--- a/fs/proc/task_mmu.c
|
||||
+++ b/fs/proc/task_mmu.c
|
||||
@@ -281,7 +281,10 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid)
|
||||
@@ -281,7 +281,10 @@ show_map_vma(struct seq_file *m, struct
|
||||
const char *name = NULL;
|
||||
|
||||
if (file) {
|
||||
|
@ -53,7 +47,7 @@ index 187b3b5..e03793e 100644
|
|||
dev = inode->i_sb->s_dev;
|
||||
ino = inode->i_ino;
|
||||
pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
|
||||
@@ -1505,7 +1508,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid)
|
||||
@@ -1506,7 +1509,7 @@ static int show_numa_map(struct seq_file
|
||||
struct proc_maps_private *proc_priv = &numa_priv->proc_maps;
|
||||
struct vm_area_struct *vma = v;
|
||||
struct numa_maps *md = &numa_priv->md;
|
||||
|
@ -62,11 +56,9 @@ index 187b3b5..e03793e 100644
|
|||
struct mm_struct *mm = vma->vm_mm;
|
||||
struct mm_walk walk = {
|
||||
.hugetlb_entry = gather_hugetlb_stats,
|
||||
diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
|
||||
index e0d64c9..7aa92db 100644
|
||||
--- a/fs/proc/task_nommu.c
|
||||
+++ b/fs/proc/task_nommu.c
|
||||
@@ -160,7 +160,10 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma,
|
||||
@@ -160,7 +160,10 @@ static int nommu_vma_show(struct seq_fil
|
||||
file = vma->vm_file;
|
||||
|
||||
if (file) {
|
||||
|
@ -78,11 +70,9 @@ index e0d64c9..7aa92db 100644
|
|||
dev = inode->i_sb->s_dev;
|
||||
ino = inode->i_ino;
|
||||
pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT;
|
||||
diff --git a/include/linux/mm.h b/include/linux/mm.h
|
||||
index 00bad77..cc616b0 100644
|
||||
--- a/include/linux/mm.h
|
||||
+++ b/include/linux/mm.h
|
||||
@@ -1183,6 +1183,28 @@ static inline int fixup_user_fault(struct task_struct *tsk,
|
||||
@@ -1183,6 +1183,28 @@ static inline int fixup_user_fault(struc
|
||||
}
|
||||
#endif
|
||||
|
||||
|
@ -111,8 +101,6 @@ index 00bad77..cc616b0 100644
|
|||
extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
|
||||
extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
|
||||
void *buf, int len, int write);
|
||||
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
|
||||
index f8d1492..c3a3760 100644
|
||||
--- a/include/linux/mm_types.h
|
||||
+++ b/include/linux/mm_types.h
|
||||
@@ -272,6 +272,7 @@ struct vm_region {
|
||||
|
@ -131,11 +119,9 @@ index f8d1492..c3a3760 100644
|
|||
void * vm_private_data; /* was vm_pte (shared mem) */
|
||||
|
||||
#ifndef CONFIG_MMU
|
||||
diff --git a/kernel/fork.c b/kernel/fork.c
|
||||
index f97f2c4..3ef40d6 100644
|
||||
--- a/kernel/fork.c
|
||||
+++ b/kernel/fork.c
|
||||
@@ -464,7 +464,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm)
|
||||
@@ -465,7 +465,7 @@ static int dup_mmap(struct mm_struct *mm
|
||||
struct inode *inode = file_inode(file);
|
||||
struct address_space *mapping = file->f_mapping;
|
||||
|
||||
|
@ -144,11 +130,9 @@ index f97f2c4..3ef40d6 100644
|
|||
if (tmp->vm_flags & VM_DENYWRITE)
|
||||
atomic_dec(&inode->i_writecount);
|
||||
i_mmap_lock_write(mapping);
|
||||
diff --git a/mm/Makefile b/mm/Makefile
|
||||
index 2ed4319..e3a53f5 100644
|
||||
--- a/mm/Makefile
|
||||
+++ b/mm/Makefile
|
||||
@@ -21,7 +21,7 @@ obj-y := filemap.o mempool.o oom_kill.o \
|
||||
@@ -21,7 +21,7 @@ obj-y := filemap.o mempool.o oom_kill.
|
||||
mm_init.o mmu_context.o percpu.o slab_common.o \
|
||||
compaction.o vmacache.o \
|
||||
interval_tree.o list_lru.o workingset.o \
|
||||
|
@ -157,11 +141,9 @@ index 2ed4319..e3a53f5 100644
|
|||
|
||||
obj-y += init-mm.o
|
||||
|
||||
diff --git a/mm/filemap.c b/mm/filemap.c
|
||||
index 1bb0076..8eaece8 100644
|
||||
--- a/mm/filemap.c
|
||||
+++ b/mm/filemap.c
|
||||
@@ -2128,7 +2128,7 @@ int filemap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
|
||||
@@ -2128,7 +2128,7 @@ int filemap_page_mkwrite(struct vm_area_
|
||||
int ret = VM_FAULT_LOCKED;
|
||||
|
||||
sb_start_pagefault(inode->i_sb);
|
||||
|
@ -170,11 +152,9 @@ index 1bb0076..8eaece8 100644
|
|||
lock_page(page);
|
||||
if (page->mapping != inode->i_mapping) {
|
||||
unlock_page(page);
|
||||
diff --git a/mm/memory.c b/mm/memory.c
|
||||
index deb679c..df2ce3e 100644
|
||||
--- a/mm/memory.c
|
||||
+++ b/mm/memory.c
|
||||
@@ -2035,7 +2035,7 @@ static inline int wp_page_reuse(struct mm_struct *mm,
|
||||
@@ -2035,7 +2035,7 @@ static inline int wp_page_reuse(struct m
|
||||
}
|
||||
|
||||
if (!page_mkwrite)
|
||||
|
@ -183,11 +163,9 @@ index deb679c..df2ce3e 100644
|
|||
}
|
||||
|
||||
return VM_FAULT_WRITE;
|
||||
diff --git a/mm/mmap.c b/mm/mmap.c
|
||||
index 2ce04a6..f555c0a 100644
|
||||
--- a/mm/mmap.c
|
||||
+++ b/mm/mmap.c
|
||||
@@ -275,7 +275,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
|
||||
@@ -275,7 +275,7 @@ static struct vm_area_struct *remove_vma
|
||||
if (vma->vm_ops && vma->vm_ops->close)
|
||||
vma->vm_ops->close(vma);
|
||||
if (vma->vm_file)
|
||||
|
@ -196,7 +174,7 @@ index 2ce04a6..f555c0a 100644
|
|||
mpol_put(vma_policy(vma));
|
||||
kmem_cache_free(vm_area_cachep, vma);
|
||||
return next;
|
||||
@@ -887,7 +887,7 @@ again: remove_next = 1 + (end > next->vm_end);
|
||||
@@ -891,7 +891,7 @@ again: remove_next = 1 + (end > next->
|
||||
if (remove_next) {
|
||||
if (file) {
|
||||
uprobe_munmap(next, next->vm_start, next->vm_end);
|
||||
|
@ -205,7 +183,7 @@ index 2ce04a6..f555c0a 100644
|
|||
}
|
||||
if (next->anon_vma)
|
||||
anon_vma_merge(vma, next);
|
||||
@@ -1681,8 +1681,8 @@ out:
|
||||
@@ -1685,8 +1685,8 @@ out:
|
||||
return addr;
|
||||
|
||||
unmap_and_free_vma:
|
||||
|
@ -215,7 +193,7 @@ index 2ce04a6..f555c0a 100644
|
|||
|
||||
/* Undo any partial mapping done by a device driver. */
|
||||
unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
|
||||
@@ -2488,7 +2488,7 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||
@@ -2483,7 +2483,7 @@ static int __split_vma(struct mm_struct
|
||||
goto out_free_mpol;
|
||||
|
||||
if (new->vm_file)
|
||||
|
@ -224,7 +202,7 @@ index 2ce04a6..f555c0a 100644
|
|||
|
||||
if (new->vm_ops && new->vm_ops->open)
|
||||
new->vm_ops->open(new);
|
||||
@@ -2507,7 +2507,7 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
|
||||
@@ -2502,7 +2502,7 @@ static int __split_vma(struct mm_struct
|
||||
if (new->vm_ops && new->vm_ops->close)
|
||||
new->vm_ops->close(new);
|
||||
if (new->vm_file)
|
||||
|
@ -233,7 +211,7 @@ index 2ce04a6..f555c0a 100644
|
|||
unlink_anon_vmas(new);
|
||||
out_free_mpol:
|
||||
mpol_put(vma_policy(new));
|
||||
@@ -2649,7 +2649,6 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
|
||||
@@ -2644,7 +2644,6 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
|
||||
struct vm_area_struct *vma;
|
||||
unsigned long populate = 0;
|
||||
unsigned long ret = -EINVAL;
|
||||
|
@ -241,8 +219,8 @@ index 2ce04a6..f555c0a 100644
|
|||
|
||||
pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. "
|
||||
"See Documentation/vm/remap_file_pages.txt.\n",
|
||||
@@ -2693,10 +2692,10 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
|
||||
munlock_vma_pages_range(vma, start, start + size);
|
||||
@@ -2712,10 +2711,10 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
|
||||
}
|
||||
}
|
||||
|
||||
- file = get_file(vma->vm_file);
|
||||
|
@ -254,7 +232,7 @@ index 2ce04a6..f555c0a 100644
|
|||
out:
|
||||
up_write(&mm->mmap_sem);
|
||||
if (populate)
|
||||
@@ -2966,7 +2965,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
|
||||
@@ -2985,7 +2984,7 @@ struct vm_area_struct *copy_vma(struct v
|
||||
if (anon_vma_clone(new_vma, vma))
|
||||
goto out_free_mempol;
|
||||
if (new_vma->vm_file)
|
||||
|
@ -263,11 +241,9 @@ index 2ce04a6..f555c0a 100644
|
|||
if (new_vma->vm_ops && new_vma->vm_ops->open)
|
||||
new_vma->vm_ops->open(new_vma);
|
||||
vma_link(mm, new_vma, prev, rb_link, rb_parent);
|
||||
diff --git a/mm/nommu.c b/mm/nommu.c
|
||||
index 92be862..29179f7 100644
|
||||
--- a/mm/nommu.c
|
||||
+++ b/mm/nommu.c
|
||||
@@ -671,7 +671,7 @@ static void __put_nommu_region(struct vm_region *region)
|
||||
@@ -671,7 +671,7 @@ static void __put_nommu_region(struct vm
|
||||
up_write(&nommu_region_sem);
|
||||
|
||||
if (region->vm_file)
|
||||
|
@ -276,7 +252,7 @@ index 92be862..29179f7 100644
|
|||
|
||||
/* IO memory and memory shared directly out of the pagecache
|
||||
* from ramfs/tmpfs mustn't be released here */
|
||||
@@ -829,7 +829,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma)
|
||||
@@ -829,7 +829,7 @@ static void delete_vma(struct mm_struct
|
||||
if (vma->vm_ops && vma->vm_ops->close)
|
||||
vma->vm_ops->close(vma);
|
||||
if (vma->vm_file)
|
||||
|
@ -307,9 +283,6 @@ index 92be862..29179f7 100644
|
|||
kmem_cache_free(vm_area_cachep, vma);
|
||||
return ret;
|
||||
|
||||
diff --git a/mm/prfile.c b/mm/prfile.c
|
||||
new file mode 100644
|
||||
index 0000000..b323b8a
|
||||
--- /dev/null
|
||||
+++ b/mm/prfile.c
|
||||
@@ -0,0 +1,86 @@
|
||||
|
|
|
@ -103,7 +103,6 @@ bugfix/all/misc-bmp085-Enable-building-as-a-module.patch
|
|||
bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch
|
||||
bugfix/all/disable-some-marvell-phys.patch
|
||||
bugfix/all/rtsx_usb_ms-use-msleep_interruptible-in-polling-loop.patch
|
||||
bugfix/all/revert-xhci-don-t-finish-a-td-if-we-get-a-short-transfer.patch
|
||||
bugfix/all/bcache-fix-a-livelock-when-we-cause-a-huge-number-of.patch
|
||||
bugfix/all/bcache-add-a-cond_resched-call-to-gc.patch
|
||||
bugfix/all/bcache-clear-bcache_dev_unlink_done-flag-when-attach.patch
|
||||
|
@ -112,7 +111,6 @@ bugfix/all/bcache-unregister-reboot-notifier-if-bcache-fails-to.patch
|
|||
bugfix/all/bcache-allows-use-of-register-in-udev-to-avoid-devic.patch
|
||||
bugfix/all/bcache-prevent-crash-on-changing-writeback_running.patch
|
||||
bugfix/all/bcache-change-refill_dirty-to-always-scan-entire-dis.patch
|
||||
bugfix/all/scsi-fix-crashes-in-sd-and-sr-runtime-pm.patch
|
||||
bugfix/all/rt2x00-fix-monitor-mode-regression.patch
|
||||
|
||||
# Miscellaneous features
|
||||
|
@ -129,7 +127,6 @@ bugfix/all/media-usbvision-fix-crash-on-detecting-device-with-i.patch
|
|||
bugfix/all/ptrace-being-capable-wrt-a-process-requires-mapped-uids-gids.patch
|
||||
bugfix/all/pipe-limit-the-per-user-amount-of-pages-allocated-in.patch
|
||||
bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch
|
||||
bugfix/all/fs-hugetlbfs-inode.c-fix-bugs-in-hugetlb_vmtruncate_.patch
|
||||
bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
|
||||
bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch
|
||||
bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch
|
||||
|
@ -140,7 +137,6 @@ bugfix/x86/x86-efi-map-ram-into-the-identity-page-table-for-mix.patch
|
|||
bugfix/x86/x86-efi-hoist-page-table-switching-code-into-efi_cal.patch
|
||||
bugfix/x86/x86-efi-build-our-own-page-table-structures.patch
|
||||
bugfix/x86/x86-efi-setup-separate-efi-page-tables-in-kexec-path.patch
|
||||
bugfix/x86/x86-mm-fix-types-used-in-pgprot-cacheability-flags-t.patch
|
||||
debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
|
||||
bugfix/all/iff_no_queue-fix-for-drivers-not-calling-ether_setup.patch
|
||||
bugfix/arm/net-mv643xx_eth-fix-packet-corruption-with-tso-and-t.patch
|
||||
|
|
Loading…
Reference in New Issue