Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60ec81b5 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 3.18.72 into android-3.18 



Changes in 3.18.72
	ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
	qlge: avoid memcpy buffer overflow
	Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
	tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0
	ipv6: fix memory leak with multiple tables during netns destruction
	ipv6: fix typo in fib6_net_exit()
	f2fs: check hot_data for roll-forward recovery
	Revert "usb: musb: fix tx fifo flush handling again"
	ip6_gre: fix endianness errors in ip6gre_err
	Input: i8042 - add Gigabyte P57 to the keyboard reset table
	crypto: AF_ALG - remove SGL terminator indicator when chaining
	ext4: fix incorrect quotaoff if the quota feature is enabled
	powerpc: Fix DAR reporting when alignment handler faults
	block: Relax a check in blk_start_queue()
	md/bitmap: disable bitmap_resize for file-backed bitmaps.
	skd: Avoid that module unloading triggers a use-after-free
	skd: Submit requests to firmware before triggering the doorbell
	scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled
	scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path
	scsi: zfcp: fix missing trace records for early returns in TMF eh handlers
	scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records
	scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response
	scsi: zfcp: trace high part of "new" 64 bit SCSI LUN
	scsi: sg: remove 'save_scat_len'
	scsi: sg: use standard lists for sg_requests
	scsi: sg: off by one in sg_ioctl()
	scsi: sg: factor out sg_fill_request_table()
	scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE
	scsi: qla2xxx: Fix an integer overflow in sysfs code
	ftrace: Fix selftest goto location on error
	tracing: Apply trace_clock changes to instance max buffer
	ARC: Re-enable MMU upon Machine Check exception
	PCI: shpchp: Enable bridge bus mastering if MSI is enabled
	media: v4l2-compat-ioctl32: Fix timespec conversion
	media: uvcvideo: Prevent heap overflow when accessing mapped controls
	bcache: initialize dirty stripes in flash_dev_run()
	bcache: Fix leak of bdev reference
	bcache: correct cache_dirty_target in __update_writeback_rate()
	bcache: Correct return value for sysfs attach errors
	bcache: fix for gc and write-back race
	bcache: fix bch_hprint crash and improve output
	Linux 3.18.72

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents ad82ff52 0e133352

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 3

PATCHLEVEL = 18

SUBLEVEL = 71

SUBLEVEL = 72

EXTRAVERSION =

NAME = Diseased Newt

arch/arc/kernel/entry.S

+6 −0
Original line number Diff line number Diff line
@@ -315,6 +315,12 @@ ENTRY(EV_MachineCheck) 
	lr  r0, [efa]

	mov r1, sp



	; hardware auto-disables MMU, re-enable it to allow kernel vaddr

	; access for say stack unwinding of modules for crash dumps

	lr	r3, [ARC_REG_PID]

	or	r3, r3, MMU_ENABLE

	sr	r3, [ARC_REG_PID]



	lsr  	r3, r2, 8

	bmsk 	r3, r3, 7

	brne    r3, ECR_C_MCHK_DUP_TLB, 1f

arch/arc/mm/tlb.c

+0 −3
Original line number Diff line number Diff line
@@ -689,9 +689,6 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, 


	local_irq_save(flags);



	/* re-enable the MMU */

	write_aux_reg(ARC_REG_PID, MMU_ENABLE | read_aux_reg(ARC_REG_PID));



	/* loop thru all sets of TLB */

	for (set = 0; set < mmu->sets; set++) {

arch/powerpc/kernel/align.c

+74 −45
Original line number Diff line number Diff line
@@ -236,6 +236,28 @@ static int emulate_dcbz(struct pt_regs *regs, unsigned char __user *addr) 


#define SWIZ_PTR(p)		((unsigned char __user *)((p) ^ swiz))



#define __get_user_or_set_dar(_regs, _dest, _addr)		\

	({							\

		int rc = 0;					\

		typeof(_addr) __addr = (_addr);			\

		if (__get_user_inatomic(_dest, __addr)) {	\

			_regs->dar = (unsigned long)__addr;	\

			rc = -EFAULT;				\

		}						\

		rc;						\

	})



#define __put_user_or_set_dar(_regs, _src, _addr)		\

	({							\

		int rc = 0;					\

		typeof(_addr) __addr = (_addr);			\

		if (__put_user_inatomic(_src, __addr)) {	\

			_regs->dar = (unsigned long)__addr;	\

			rc = -EFAULT;				\

		}						\

		rc;						\

	})



static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr,

			    unsigned int reg, unsigned int nb,

			    unsigned int flags, unsigned int instr,
@@ -264,9 +286,10 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, 
		} else {

			unsigned long pc = regs->nip ^ (swiz & 4);



			if (__get_user_inatomic(instr,

			if (__get_user_or_set_dar(regs, instr,

						  (unsigned int __user *)pc))

				return -EFAULT;



			if (swiz == 0 && (flags & SW))

				instr = cpu_to_le32(instr);

			nb = (instr >> 11) & 0x1f;
@@ -310,30 +333,30 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, 
			       ((nb0 + 3) / 4) * sizeof(unsigned long));



		for (i = 0; i < nb; ++i, ++p)

			if (__get_user_inatomic(REG_BYTE(rptr, i ^ bswiz),

			if (__get_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz),

						  SWIZ_PTR(p)))

				return -EFAULT;

		if (nb0 > 0) {

			rptr = &regs->gpr[0];

			addr += nb;

			for (i = 0; i < nb0; ++i, ++p)

				if (__get_user_inatomic(REG_BYTE(rptr,

								 i ^ bswiz),

				if (__get_user_or_set_dar(regs,

							  REG_BYTE(rptr, i ^ bswiz),

							  SWIZ_PTR(p)))

					return -EFAULT;

		}



	} else {

		for (i = 0; i < nb; ++i, ++p)

			if (__put_user_inatomic(REG_BYTE(rptr, i ^ bswiz),

			if (__put_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz),

						  SWIZ_PTR(p)))

				return -EFAULT;

		if (nb0 > 0) {

			rptr = &regs->gpr[0];

			addr += nb;

			for (i = 0; i < nb0; ++i, ++p)

				if (__put_user_inatomic(REG_BYTE(rptr,

								 i ^ bswiz),

				if (__put_user_or_set_dar(regs,

							  REG_BYTE(rptr, i ^ bswiz),

							  SWIZ_PTR(p)))

					return -EFAULT;

		}
@@ -346,29 +369,32 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, 
 * Only POWER6 has these instructions, and it does true little-endian,

 * so we don't need the address swizzling.

 */

static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg,

			   unsigned int flags)

static int emulate_fp_pair(struct pt_regs *regs, unsigned char __user *addr,

			   unsigned int reg, unsigned int flags)

{

	char *ptr0 = (char *) &current->thread.TS_FPR(reg);

	char *ptr1 = (char *) &current->thread.TS_FPR(reg+1);

	int i, ret, sw = 0;

	int i, sw = 0;



	if (reg & 1)

		return 0;	/* invalid form: FRS/FRT must be even */

	if (flags & SW)

		sw = 7;

	ret = 0;



	for (i = 0; i < 8; ++i) {

		if (!(flags & ST)) {

			ret |= __get_user(ptr0[i^sw], addr + i);

			ret |= __get_user(ptr1[i^sw], addr + i + 8);

			if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i))

				return -EFAULT;

			if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))

				return -EFAULT;

		} else {

			ret |= __put_user(ptr0[i^sw], addr + i);

			ret |= __put_user(ptr1[i^sw], addr + i + 8);

			if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i))

				return -EFAULT;

			if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))

				return -EFAULT;

		}

	}

	if (ret)

		return -EFAULT;



	return 1;	/* exception handled and fixed up */

}
@@ -378,24 +404,27 @@ static int emulate_lq_stq(struct pt_regs *regs, unsigned char __user *addr, 
{

	char *ptr0 = (char *)&regs->gpr[reg];

	char *ptr1 = (char *)&regs->gpr[reg+1];

	int i, ret, sw = 0;

	int i, sw = 0;



	if (reg & 1)

		return 0;	/* invalid form: GPR must be even */

	if (flags & SW)

		sw = 7;

	ret = 0;



	for (i = 0; i < 8; ++i) {

		if (!(flags & ST)) {

			ret |= __get_user(ptr0[i^sw], addr + i);

			ret |= __get_user(ptr1[i^sw], addr + i + 8);

			if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i))

				return -EFAULT;

			if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))

				return -EFAULT;

		} else {

			ret |= __put_user(ptr0[i^sw], addr + i);

			ret |= __put_user(ptr1[i^sw], addr + i + 8);

			if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i))

				return -EFAULT;

			if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8))

				return -EFAULT;

		}

	}

	if (ret)

		return -EFAULT;



	return 1;	/* exception handled and fixed up */

}

#endif /* CONFIG_PPC64 */
@@ -688,9 +717,14 @@ static int emulate_vsx(unsigned char __user *addr, unsigned int reg, 
	for (j = 0; j < length; j += elsize) {

		for (i = 0; i < elsize; ++i) {

			if (flags & ST)

				ret |= __put_user(ptr[i^sw], addr + i);

				ret = __put_user_or_set_dar(regs, ptr[i^sw],

							    addr + i);

			else

				ret |= __get_user(ptr[i^sw], addr + i);

				ret = __get_user_or_set_dar(regs, ptr[i^sw],

							    addr + i);



			if (ret)

				return ret;

		}

		ptr  += elsize;

#ifdef __LITTLE_ENDIAN__
@@ -740,7 +774,7 @@ int fix_alignment(struct pt_regs *regs) 
	unsigned int dsisr;

	unsigned char __user *addr;

	unsigned long p, swiz;

	int ret, i;

	int i;

	union data {

		u64 ll;

		double dd;
@@ -923,7 +957,7 @@ int fix_alignment(struct pt_regs *regs) 
		if (flags & F) {

			/* Special case for 16-byte FP loads and stores */

			PPC_WARN_ALIGNMENT(fp_pair, regs);

			return emulate_fp_pair(addr, reg, flags);

			return emulate_fp_pair(regs, addr, reg, flags);

		} else {

#ifdef CONFIG_PPC64

			/* Special case for 16-byte loads and stores */
@@ -953,14 +987,11 @@ int fix_alignment(struct pt_regs *regs) 
		}



		data.ll = 0;

		ret = 0;

		p = (unsigned long)addr;



		for (i = 0; i < nb; i++)

			ret |= __get_user_inatomic(data.v[start + i],

						   SWIZ_PTR(p++));



		if (unlikely(ret))

			if (__get_user_or_set_dar(regs, data.v[start + i],

						  SWIZ_PTR(p++)))

				return -EFAULT;



	} else if (flags & F) {
@@ -1031,15 +1062,13 @@ int fix_alignment(struct pt_regs *regs) 
			break;

		}



		ret = 0;

		p = (unsigned long)addr;



		for (i = 0; i < nb; i++)

			ret |= __put_user_inatomic(data.v[start + i],

						   SWIZ_PTR(p++));



		if (unlikely(ret))

			if (__put_user_or_set_dar(regs, data.v[start + i],

						  SWIZ_PTR(p++)))

				return -EFAULT;



	} else if (flags & F)

		current->thread.TS_FPR(reg) = data.ll;

	else

block/blk-core.c

+1 −1
Original line number Diff line number Diff line
@@ -196,7 +196,7 @@ EXPORT_SYMBOL(blk_delay_queue); 
 **/

void blk_start_queue(struct request_queue *q)

{

	WARN_ON(!irqs_disabled());

	WARN_ON(!in_interrupt() && !irqs_disabled());



	queue_flag_clear(QUEUE_FLAG_STOPPED, q);

	__blk_run_queue(q);