diff options
| -rw-r--r-- | config-armv7 | 1 | ||||
| -rw-r--r-- | config-generic | 2 | ||||
| -rw-r--r-- | gitrev | 2 | ||||
| -rw-r--r-- | intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch | 241 | ||||
| -rw-r--r-- | kernel.spec | 11 | ||||
| -rw-r--r-- | sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch | 80 | ||||
| -rw-r--r-- | sources | 2 |
7 files changed, 93 insertions, 246 deletions
diff --git a/config-armv7 b/config-armv7 index 1efb5899f..63264216c 100644 --- a/config-armv7 +++ b/config-armv7 @@ -356,6 +356,7 @@ CONFIG_QCOM_WCNSS_CTRL=m CONFIG_QCOM_SMSM=y CONFIG_QCOM_SMP2P=m CONFIG_PCIE_QCOM=y +CONFIG_MTD_NAND_QCOM=m # i.MX # CONFIG_MXC_DEBUG_BOARD is not set diff --git a/config-generic b/config-generic index cbbf49eeb..234a6cfee 100644 --- a/config-generic +++ b/config-generic @@ -4685,6 +4685,8 @@ CONFIG_NFSD_V3=y CONFIG_NFSD_V3_ACL=y CONFIG_NFSD_V4=y CONFIG_NFSD_PNFS=y +CONFIG_NFSD_BLOCKLAYOUT=y +CONFIG_NFSD_SCSILAYOUT=y CONFIG_NFSD_V4_SECURITY_LABEL=y CONFIG_NFS_FSCACHE=y # CONFIG_NFS_USE_LEGACY_DNS is not set @@ -1 +1 @@ -e46b4e2b46e173889b19999b8bd033d5e8b3acf0 +11caf57f6a4b8e380001548b8af0a3ae3f7b4354 diff --git a/intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch b/intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch deleted file mode 100644 index 9f3c55d89..000000000 --- a/intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch +++ /dev/null @@ -1,241 +0,0 @@ -From c517e903c4dbc9271b3cfb43b27d303dd6f03cd7 Mon Sep 17 00:00:00 2001 -From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com> -Date: Fri, 18 Mar 2016 15:36:25 +0100 -Subject: [PATCH] intel_pstate: Do not call wrmsrl_on_cpu() with disabled - interrupts - -After commit a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with -utilization update callbacks) wrmsrl_on_cpu() cannot be called in the -intel_pstate_adjust_busy_pstate() path as that is executed with -disabled interrupts. However, atom_set_pstate() called from there -via intel_pstate_set_pstate() uses wrmsrl_on_cpu() to update the -IA32_PERF_CTL MSR which triggers the WARN_ON_ONCE() in -smp_call_function_single(). - -The reason why wrmsrl_on_cpu() is used by atom_set_pstate() is -because intel_pstate_set_pstate() calling it is also invoked during -the initialization and cleanup of the driver and in those cases it is -not guaranteed to be run on the CPU that is being updated. However, -in the case when intel_pstate_set_pstate() is called by -intel_pstate_adjust_busy_pstate(), wrmsrl() can be used to update -the register safely. Moreover, intel_pstate_set_pstate() already -contains code that only is executed if the function is called by -intel_pstate_adjust_busy_pstate() and there is a special argument -passed to it because of that. - -To fix the problem at hand, rearrange the code taking the above -observations into account. - -First, replace the ->set() callback in struct pstate_funcs with a -->get_val() one that will return the value to be written to the -IA32_PERF_CTL MSR without updating the register. - -Second, split intel_pstate_set_pstate() into two functions, -intel_pstate_update_pstate() to be called by -intel_pstate_adjust_busy_pstate() that will contain all of the -intel_pstate_set_pstate() code which only needs to be executed in -that case and will use wrmsrl() to update the MSR (after obtaining -the value to write to it from the ->get_val() callback), and -intel_pstate_set_min_pstate() to be invoked during the -initialization and cleanup that will set the P-state to the -minimum one and will update the MSR using wrmsrl_on_cpu(). - -Finally, move the code shared between intel_pstate_update_pstate() -and intel_pstate_set_min_pstate() to a new static inline function -intel_pstate_record_pstate() and make them both call it. - -Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> -Fixes: a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with utilization update callbacks) ---- - drivers/cpufreq/intel_pstate.c | 73 +++++++++++++++++++++++++----------------- - 1 file changed, 43 insertions(+), 30 deletions(-) - -diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c -index cb5607495816..4b644526fd59 100644 ---- a/drivers/cpufreq/intel_pstate.c -+++ b/drivers/cpufreq/intel_pstate.c -@@ -134,7 +134,7 @@ struct pstate_funcs { - int (*get_min)(void); - int (*get_turbo)(void); - int (*get_scaling)(void); -- void (*set)(struct cpudata*, int pstate); -+ u64 (*get_val)(struct cpudata*, int pstate); - void (*get_vid)(struct cpudata *); - int32_t (*get_target_pstate)(struct cpudata *); - }; -@@ -565,7 +565,7 @@ static int atom_get_turbo_pstate(void) - return value & 0x7F; - } - --static void atom_set_pstate(struct cpudata *cpudata, int pstate) -+static u64 atom_get_val(struct cpudata *cpudata, int pstate) - { - u64 val; - int32_t vid_fp; -@@ -585,9 +585,7 @@ static void atom_set_pstate(struct cpudata *cpudata, int pstate) - if (pstate > cpudata->pstate.max_pstate) - vid = cpudata->vid.turbo; - -- val |= vid; -- -- wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val); -+ return val | vid; - } - - static int silvermont_get_scaling(void) -@@ -711,7 +709,7 @@ static inline int core_get_scaling(void) - return 100000; - } - --static void core_set_pstate(struct cpudata *cpudata, int pstate) -+static u64 core_get_val(struct cpudata *cpudata, int pstate) - { - u64 val; - -@@ -719,7 +717,7 @@ static void core_set_pstate(struct cpudata *cpudata, int pstate) - if (limits->no_turbo && !limits->turbo_disabled) - val |= (u64)1 << 32; - -- wrmsrl(MSR_IA32_PERF_CTL, val); -+ return val; - } - - static int knl_get_turbo_pstate(void) -@@ -750,7 +748,7 @@ static struct cpu_defaults core_params = { - .get_min = core_get_min_pstate, - .get_turbo = core_get_turbo_pstate, - .get_scaling = core_get_scaling, -- .set = core_set_pstate, -+ .get_val = core_get_val, - .get_target_pstate = get_target_pstate_use_performance, - }, - }; -@@ -769,7 +767,7 @@ static struct cpu_defaults silvermont_params = { - .get_max_physical = atom_get_max_pstate, - .get_min = atom_get_min_pstate, - .get_turbo = atom_get_turbo_pstate, -- .set = atom_set_pstate, -+ .get_val = atom_get_val, - .get_scaling = silvermont_get_scaling, - .get_vid = atom_get_vid, - .get_target_pstate = get_target_pstate_use_cpu_load, -@@ -790,7 +788,7 @@ static struct cpu_defaults airmont_params = { - .get_max_physical = atom_get_max_pstate, - .get_min = atom_get_min_pstate, - .get_turbo = atom_get_turbo_pstate, -- .set = atom_set_pstate, -+ .get_val = atom_get_val, - .get_scaling = airmont_get_scaling, - .get_vid = atom_get_vid, - .get_target_pstate = get_target_pstate_use_cpu_load, -@@ -812,7 +810,7 @@ static struct cpu_defaults knl_params = { - .get_min = core_get_min_pstate, - .get_turbo = knl_get_turbo_pstate, - .get_scaling = core_get_scaling, -- .set = core_set_pstate, -+ .get_val = core_get_val, - .get_target_pstate = get_target_pstate_use_performance, - }, - }; -@@ -839,25 +837,24 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max) - *min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf); - } - --static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force) -+static inline void intel_pstate_record_pstate(struct cpudata *cpu, int pstate) - { -- int max_perf, min_perf; -- -- if (force) { -- update_turbo_state(); -- -- intel_pstate_get_min_max(cpu, &min_perf, &max_perf); -- -- pstate = clamp_t(int, pstate, min_perf, max_perf); -- -- if (pstate == cpu->pstate.current_pstate) -- return; -- } - trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu); -- - cpu->pstate.current_pstate = pstate; -+} - -- pstate_funcs.set(cpu, pstate); -+static void intel_pstate_set_min_pstate(struct cpudata *cpu) -+{ -+ int pstate = cpu->pstate.min_pstate; -+ -+ intel_pstate_record_pstate(cpu, pstate); -+ /* -+ * Generally, there is no guarantee that this code will always run on -+ * the CPU being updated, so force the register update to run on the -+ * right CPU. -+ */ -+ wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL, -+ pstate_funcs.get_val(cpu, pstate)); - } - - static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) -@@ -870,7 +867,8 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) - - if (pstate_funcs.get_vid) - pstate_funcs.get_vid(cpu); -- intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false); -+ -+ intel_pstate_set_min_pstate(cpu); - } - - static inline void intel_pstate_calc_busy(struct cpudata *cpu) -@@ -997,6 +995,21 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu) - return cpu->pstate.current_pstate - pid_calc(&cpu->pid, core_busy); - } - -+static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate) -+{ -+ int max_perf, min_perf; -+ -+ update_turbo_state(); -+ -+ intel_pstate_get_min_max(cpu, &min_perf, &max_perf); -+ pstate = clamp_t(int, pstate, min_perf, max_perf); -+ if (pstate == cpu->pstate.current_pstate) -+ return; -+ -+ intel_pstate_record_pstate(cpu, pstate); -+ wrmsrl(MSR_IA32_PERF_CTL, pstate_funcs.get_val(cpu, pstate)); -+} -+ - static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) - { - int from, target_pstate; -@@ -1006,7 +1019,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu) - - target_pstate = pstate_funcs.get_target_pstate(cpu); - -- intel_pstate_set_pstate(cpu, target_pstate, true); -+ intel_pstate_update_pstate(cpu, target_pstate); - - sample = &cpu->sample; - trace_pstate_sample(fp_toint(sample->core_pct_busy), -@@ -1180,7 +1193,7 @@ static void intel_pstate_stop_cpu(struct cpufreq_policy *policy) - if (hwp_active) - return; - -- intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false); -+ intel_pstate_set_min_pstate(cpu); - } - - static int intel_pstate_cpu_init(struct cpufreq_policy *policy) -@@ -1255,7 +1268,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs) - pstate_funcs.get_min = funcs->get_min; - pstate_funcs.get_turbo = funcs->get_turbo; - pstate_funcs.get_scaling = funcs->get_scaling; -- pstate_funcs.set = funcs->set; -+ pstate_funcs.get_val = funcs->get_val; - pstate_funcs.get_vid = funcs->get_vid; - pstate_funcs.get_target_pstate = funcs->get_target_pstate; - --- -2.5.0 - diff --git a/kernel.spec b/kernel.spec index 57abc4008..520ca2769 100644 --- a/kernel.spec +++ b/kernel.spec @@ -69,7 +69,7 @@ Summary: The Linux kernel # The rc snapshot level %define rcrev 0 # The git snapshot level -%define gitrev 25 +%define gitrev 26 # Set rpm version accordingly %define rpmversion 4.%{upstream_sublevel}.0 %endif @@ -612,8 +612,6 @@ Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch #CVE-2016-3134 rhbz 1317383 1317384 Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch -Patch667: intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch - #CVE-2016-3137 rhbz 1317010 1316996 Patch672: cypress_m8-add-sanity-checking.patch @@ -637,6 +635,8 @@ Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch #CVE-2016-3136 rhbz 1317007 1317010 Patch687: mct_u232-sanity-checking-in-probe.patch +Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch + # END OF PATCH DEFINITIONS %endif @@ -2159,6 +2159,11 @@ fi # # %changelog +* Fri Mar 25 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git26.1 +- Linux v4.5-12596-g11caf57f6a4b +- asm-generic, pm+acpi, rtc, hwmon, block, mtd, ubifs, nfsd, kbuild, parisc, + h8, arm64, armsoc + * Thu Mar 24 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git25.1 - Linux v4.5-12330-ge46b4e2b46e1 - trace, thermal, nfsd merges diff --git a/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch b/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch new file mode 100644 index 000000000..3ee63e4d4 --- /dev/null +++ b/sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch @@ -0,0 +1,80 @@ +From cef7f62d5881e886cd514436bc386a7202af25f1 Mon Sep 17 00:00:00 2001 +From: Nicolai Stange <nicstange@gmail.com> +Date: Tue, 15 Mar 2016 13:35:06 +0100 +Subject: [PATCH] sound/usb: fix NULL dereference in usb_audio_probe() + +With commit + + aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share + media resources") + +an access to quirk->media_device without checking for quirk != NULL has +been introduced in usb_audio_probe(). + +With a Plantronics USB headset (device ID 0x047f:0xc010) attached, +this results in the following splat at boot time: + + BUG: unable to handle kernel NULL pointer dereference at 0000000000000014 + IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio] + Oops: 0000 [#1] SMP + [...] + CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13 + Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014 + task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000 + RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>] + usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio] + [...] + Call Trace: + [<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0 + [<ffffffff81509edc>] driver_probe_device+0x22c/0x440 + [<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0 + [<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440 + [<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0 + [<ffffffff815095ce>] driver_attach+0x1e/0x20 + [<ffffffff81509013>] bus_add_driver+0x1c3/0x280 + [<ffffffff8150ab10>] driver_register+0x60/0xe0 + [<ffffffff815a7711>] usb_register_driver+0x81/0x140 + [<ffffffffa08c7000>] ? 0xffffffffa08c7000 + [<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio] + [<ffffffff81002123>] do_one_initcall+0xb3/0x1f0 + [<ffffffff811fb091>] ? __vunmap+0x81/0xd0 + [<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0 + [<ffffffff811b0267>] ? do_init_module+0x27/0x1d8 + [<ffffffff811b029f>] do_init_module+0x5f/0x1d8 + [<ffffffff8112ce35>] load_module+0x1fe5/0x27a0 + [<ffffffff81129870>] ? __symbol_put+0x60/0x60 + [<ffffffff81241690>] ? vfs_read+0x110/0x130 + [<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120 + [<ffffffff8112d8be>] SyS_finit_module+0xe/0x10 + [<ffffffff81003d94>] do_syscall_64+0x64/0x110 + [<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25 + +After encountering this, the system-udevd process seems to be blocked +until it is killed when hitting its timeout of 3min. + +In analogy to the other accesses to members of quirk in usb_audio_probe(), +check for quirk != NULL before accessing its ->media_device. + +Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share + media resources") +Signed-off-by: Nicolai Stange <nicstange@gmail.com> +--- + sound/usb/card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 63244bbba8c7..479621e775bc 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf, + if (err < 0) + goto __error; + +- if (quirk->media_device) { ++ if (quirk && quirk->media_device) { + /* don't want to fail when media_snd_device_create() fails */ + media_snd_device_create(chip, intf); + } +-- +2.5.5 + @@ -1,3 +1,3 @@ a60d48eee08ec0536d5efb17ca819aef linux-4.5.tar.xz 6f557fe90b800b615c85c2ca04da6154 perf-man-4.5.tar.gz -573ece27cbf9ecd41037469878838473 patch-4.5-git25.xz +54ded8d8f3ae3bcf894d8c399ddbe016 patch-4.5-git26.xz |