Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95c782ac authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.9.27 into android-4.9 



Changes in 4.9.27:
	timerfd: Protect the might cancel mechanism proper
	Handle mismatched open calls
	tpm_tis: use default timeout value if chip reports it as zero
	scsi: storvsc: Workaround for virtual DVD SCSI version
	hwmon: (it87) Avoid registering the same chip on both SIO addresses
	8250_pci: Fix potential use-after-free in error path
	ceph: try getting buffer capability for readahead/fadvise
	cpu/hotplug: Serialize callback invocations proper
	dm ioctl: prevent stack leak in dm ioctl call
	Linux 4.9.27

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents 2632fef6 89f3b8d5

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 9

SUBLEVEL = 26

SUBLEVEL = 27

EXTRAVERSION =

NAME = Roaring Lionus

drivers/char/tpm/tpm-interface.c

+32 −21
Original line number Diff line number Diff line
@@ -489,8 +489,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type) 
int tpm_get_timeouts(struct tpm_chip *chip)

{

	struct tpm_cmd_t tpm_cmd;

	unsigned long new_timeout[4];

	unsigned long old_timeout[4];

	unsigned long timeout_old[4], timeout_chip[4], timeout_eff[4];

	struct duration_t *duration_cap;

	ssize_t rc;
@@ -542,11 +541,15 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
	    != sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))

		return -EINVAL;



	old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);

	old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);

	old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);

	old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);

	memcpy(new_timeout, old_timeout, sizeof(new_timeout));

	timeout_old[0] = jiffies_to_usecs(chip->timeout_a);

	timeout_old[1] = jiffies_to_usecs(chip->timeout_b);

	timeout_old[2] = jiffies_to_usecs(chip->timeout_c);

	timeout_old[3] = jiffies_to_usecs(chip->timeout_d);

	timeout_chip[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);

	timeout_chip[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);

	timeout_chip[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);

	timeout_chip[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);

	memcpy(timeout_eff, timeout_chip, sizeof(timeout_eff));



	/*

	 * Provide ability for vendor overrides of timeout values in case
@@ -554,16 +557,24 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
	 */

	if (chip->ops->update_timeouts != NULL)

		chip->timeout_adjusted =

			chip->ops->update_timeouts(chip, new_timeout);

			chip->ops->update_timeouts(chip, timeout_eff);



	if (!chip->timeout_adjusted) {

		/* Don't overwrite default if value is 0 */

		if (new_timeout[0] != 0 && new_timeout[0] < 1000) {

		/* Restore default if chip reported 0 */

		int i;



		for (i = 0; i < ARRAY_SIZE(timeout_eff); i++) {

			if (timeout_eff[i])

				continue;



			timeout_eff[i] = timeout_old[i];

			chip->timeout_adjusted = true;

		}



		if (timeout_eff[0] != 0 && timeout_eff[0] < 1000) {

			/* timeouts in msec rather usec */

			for (i = 0; i != ARRAY_SIZE(new_timeout); i++)

				new_timeout[i] *= 1000;

			for (i = 0; i != ARRAY_SIZE(timeout_eff); i++)

				timeout_eff[i] *= 1000;

			chip->timeout_adjusted = true;

		}

	}
@@ -572,16 +583,16 @@ int tpm_get_timeouts(struct tpm_chip *chip) 
	if (chip->timeout_adjusted) {

		dev_info(&chip->dev,

			 HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n",

			 old_timeout[0], new_timeout[0],

			 old_timeout[1], new_timeout[1],

			 old_timeout[2], new_timeout[2],

			 old_timeout[3], new_timeout[3]);

			 timeout_chip[0], timeout_eff[0],

			 timeout_chip[1], timeout_eff[1],

			 timeout_chip[2], timeout_eff[2],

			 timeout_chip[3], timeout_eff[3]);

	}



	chip->timeout_a = usecs_to_jiffies(new_timeout[0]);

	chip->timeout_b = usecs_to_jiffies(new_timeout[1]);

	chip->timeout_c = usecs_to_jiffies(new_timeout[2]);

	chip->timeout_d = usecs_to_jiffies(new_timeout[3]);

	chip->timeout_a = usecs_to_jiffies(timeout_eff[0]);

	chip->timeout_b = usecs_to_jiffies(timeout_eff[1]);

	chip->timeout_c = usecs_to_jiffies(timeout_eff[2]);

	chip->timeout_d = usecs_to_jiffies(timeout_eff[3]);



duration:

	tpm_cmd.header.in = tpm_getcap_header;

drivers/hwmon/it87.c

+19 −5
Original line number Diff line number Diff line
@@ -3115,7 +3115,7 @@ static int __init sm_it87_init(void) 
{

	int sioaddr[2] = { REG_2E, REG_4E };

	struct it87_sio_data sio_data;

	unsigned short isa_address;

	unsigned short isa_address[2];

	bool found = false;

	int i, err;
@@ -3125,15 +3125,29 @@ static int __init sm_it87_init(void) 


	for (i = 0; i < ARRAY_SIZE(sioaddr); i++) {

		memset(&sio_data, 0, sizeof(struct it87_sio_data));

		isa_address = 0;

		err = it87_find(sioaddr[i], &isa_address, &sio_data);

		if (err || isa_address == 0)

		isa_address[i] = 0;

		err = it87_find(sioaddr[i], &isa_address[i], &sio_data);

		if (err || isa_address[i] == 0)

			continue;

		/*

		 * Don't register second chip if its ISA address matches

		 * the first chip's ISA address.

		 */

		if (i && isa_address[i] == isa_address[0])

			break;



		err = it87_device_add(i, isa_address, &sio_data);

		err = it87_device_add(i, isa_address[i], &sio_data);

		if (err)

			goto exit_dev_unregister;



		found = true;



		/*

		 * IT8705F may respond on both SIO addresses.

		 * Stop probing after finding one.

		 */

		if (sio_data.type == it87)

			break;

	}



	if (!found) {

drivers/md/dm-ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -1847,7 +1847,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) 
	if (r)

		goto out;



	param->data_size = sizeof(*param);

	param->data_size = offsetof(struct dm_ioctl, data);

	r = fn(param, input_param_size);



	if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) &&

drivers/scsi/storvsc_drv.c

+17 −10
Original line number Diff line number Diff line
@@ -400,8 +400,6 @@ MODULE_PARM_DESC(storvsc_vcpus_per_sub_channel, "Ratio of VCPUs to subchannels") 
 */

static int storvsc_timeout = 180;



static int msft_blist_flags = BLIST_TRY_VPD_PAGES;



#if IS_ENABLED(CONFIG_SCSI_FC_ATTRS)

static struct scsi_transport_template *fc_transport_template;

#endif
@@ -1283,6 +1281,22 @@ static int storvsc_do_io(struct hv_device *device, 
	return ret;

}



static int storvsc_device_alloc(struct scsi_device *sdevice)

{

	/*

	 * Set blist flag to permit the reading of the VPD pages even when

	 * the target may claim SPC-2 compliance. MSFT targets currently

	 * claim SPC-2 compliance while they implement post SPC-2 features.

	 * With this flag we can correctly handle WRITE_SAME_16 issues.

	 *

	 * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but

	 * still supports REPORT LUN.

	 */

	sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES;



	return 0;

}



static int storvsc_device_configure(struct scsi_device *sdevice)

{
@@ -1297,14 +1311,6 @@ static int storvsc_device_configure(struct scsi_device *sdevice) 


	sdevice->no_write_same = 1;



	/*

	 * Add blist flags to permit the reading of the VPD pages even when

	 * the target may claim SPC-2 compliance. MSFT targets currently

	 * claim SPC-2 compliance while they implement post SPC-2 features.

	 * With this patch we can correctly handle WRITE_SAME_16 issues.

	 */

	sdevice->sdev_bflags |= msft_blist_flags;



	/*

	 * If the host is WIN8 or WIN8 R2, claim conformance to SPC-3

	 * if the device is a MSFT virtual device.  If the host is
@@ -1569,6 +1575,7 @@ static struct scsi_host_template scsi_driver = { 
	.eh_host_reset_handler =	storvsc_host_reset_handler,

	.proc_name =		"storvsc_host",

	.eh_timed_out =		storvsc_eh_timed_out,

	.slave_alloc =		storvsc_device_alloc,

	.slave_configure =	storvsc_device_configure,

	.cmd_per_lun =		255,

	.this_id =		-1,