diff --git a/debian/changelog b/debian/changelog index 625e2683b..ce4076cb2 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,4 +1,4 @@ -linux (4.9.22-1) UNRELEASED; urgency=medium +linux (4.9.24-1) UNRELEASED; urgency=medium * New upstream stable update: https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.19 @@ -221,6 +221,83 @@ linux (4.9.22-1) UNRELEASED; urgency=medium - [x86] reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk - usb-storage: Add ignore-residue quirk for Initio INIC-3619 - [x86] reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.23 + - [x86] drm/i915/gen9: Increase PCODE request timeout to 50ms + - [x86] drm/i915: Nuke debug messages from the pipe update critical section + - [x86] drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3 + - [x86] drm/i915: Only enable hotplug interrupts if the display interrupts + are enabled + - [x86] drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters. + - [x86] drm/i915: Stop using RP_DOWN_EI on Baytrail + - [x86] drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker) + - [armhf,arm64] i2c: bcm2835: Fix hang for writing messages larger than 16 + bytes + - rt2x00usb: fix anchor initialization + - rt2x00usb: do not anchor rx and tx urb's + - [mips*] Introduce irq_stack + - [mips*] Stack unwinding while on IRQ stack + - [mips*] Only change $28 to thread_info if coming from user mode + - [mips*] Switch to the irq_stack in interrupts + - [mips*] Select HAVE_IRQ_EXIT_ON_IRQ_STACK + - [mips*] IRQ Stack: Fix erroneous jal to plat_irq_dispatch + - [x86] Revert "drm/i915/execlists: Reset RING registers upon resume" + - blk-mq: Avoid memory reclaim when remapping queues + - usb: hub: Wait for connection to be reestablished after port reset + - net/mlx4_en: Fix bad WQE issue + - net/mlx4_core: Fix racy CQ (Completion Queue) free + - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to + VGT transitions + - dma-buf: add support for compat ioctl + https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.24 + - cgroup, kthread: close race window where new kthreads can be migrated to + non-root cgroups + - thp: fix MADV_DONTNEED vs. MADV_FREE race + - thp: fix MADV_DONTNEED vs clear soft dirty race + - zsmalloc: expand class bit + - drm/nouveau/mpeg: mthd returns true on success now + - drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one + - [armhf] drm/etnaviv: fix missing unlock on error in etnaviv_gpu_submit() + - CIFS: reconnect thread reschedule itself + - CIFS: store results of cifs_reopen_file to avoid infinite wait + - Input: xpad - add support for Razer Wildcat gamepad + - [x86] perf: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32() + - [x86] efi: Don't try to reserve runtime regions + - [x86] signals: Fix lower/upper bound reporting in compat siginfo + - [x86] pmem: fix broken __copy_user_nocache cache-bypass assumptions + - [x86] vdso: Ensure vdso32_enabled gets set to valid values only + - [x86] vdso: Plug race between mapping and ELF header setup + - [x86] acpi, nfit, libnvdimm: fix interleave set cookie calculation + (64-bit comparison) + - ACPI / scan: Set the visited flag for all enumerated devices + - [hppa] fix bugs in pa_memcpy + - efi/libstub: Skip GOP with PIXEL_BLT_ONLY format + - efi/fb: Avoid reconfiguration of BAR that covers the framebuffer + - iscsi-target: Fix TMR reference leak during session shutdown + - iscsi-target: Drop work-around for legacy GlobalSAN initiator + - scsi: sr: Sanity check returned mode data + - scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable + - scsi: qla2xxx: Add fix to read correct register value for ISP82xx. + - scsi: sd: Fix capacity calculation with 32-bit sector_t + - target: Avoid mappedlun symlink creation during lun shutdown + - xen, fbfront: fix connecting to backend + - new privimitive: iov_iter_revert() + - make skb_copy_datagram_msg() et.al. preserve ->msg_iter on error + - [x86] libnvdimm: fix blk free space accounting + - [x86] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep + splat + - [armhf] pwm: rockchip: State of PWM clock should synchronize with PWM + enabled state + - cpufreq: Bring CPUs up even if cpufreq_online() failed + - [armhf] irqchip/irq-imx-gpcv2: Fix spinlock initialization + - ftrace: Fix removing of second function probe + - zram: do not use copy_page with non-page aligned address + - ftrace: Fix function pid filter on instances + - crypto: algif_aead - Fix bogus request dereference in completion function + - crypto: ahash - Fix EINPROGRESS notification callback (CVE-2017-7618) + - [hppa] Fix get_user() for 64-bit value on 32-bit kernel + - dvb-usb-v2: avoid use-after-free + - drm/nouveau/disp/mcp7x: disable dptmds workaround (Closes: #850219) + - [x86] mm: Tighten x86 /dev/mem with zeroing reads (CVE-2017-7889) [ Ben Hutchings ] * w1: Really enable W1_MASTER_GPIO as module (Closes: #858975) @@ -230,7 +307,6 @@ linux (4.9.22-1) UNRELEASED; urgency=medium * [s390x] Set NR_CPUS=256 (Closes: #858731) * [x86] usbip: Increase USBIP_VHCI_NR_HCS to 8 and USBIP_VHCI_HC_PORTS to 31 (Closes: #859641) - * drm/nouveau/disp/mcp7x: disable dptmds workaround (Closes: #850219) * [powerpc/powerpc64,ppc64*] target: Enable SCSI_IBMVSCSIS as module * cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores (Closes: #859978) @@ -249,9 +325,6 @@ linux (4.9.22-1) UNRELEASED; urgency=medium - rtmutex: Provide rt_mutex_lock_state() - rtmutex: Provide locked slowpath - rwsem/rt: Lift single reader restriction - * crypto: ahash - Fix EINPROGRESS notification callback (CVE-2017-7618) - * Replace "[media] dvb-usb: Don't use stack for reset either" with upstream - fix [ Salvatore Bonaccorso ] * ping: implement proper locking (CVE-2017-2671) diff --git a/debian/patches/bugfix/all/ACPI-EC-Use-busy-polling-mode-when-GPE-is-not-enable.patch b/debian/patches/bugfix/all/ACPI-EC-Use-busy-polling-mode-when-GPE-is-not-enable.patch deleted file mode 100644 index ad94bb58b..000000000 --- a/debian/patches/bugfix/all/ACPI-EC-Use-busy-polling-mode-when-GPE-is-not-enable.patch +++ /dev/null @@ -1,167 +0,0 @@ -From: Lv Zheng -Date: Fri, 20 Jan 2017 16:42:48 +0800 -Subject: ACPI / EC: Use busy polling mode when GPE is not enabled -Origin: https://git.kernel.org/linus/c3a696b6e8f8f75f9f75e556a9f9f6472eae2655 -Bug: https://bugzilla.kernel.org/show_bug.cgi?id=191561 -Bug-Debian: https://bugs.debian.org/846792 - -When GPE is not enabled, it is not efficient to use the wait polling mode -as it introduces an unexpected scheduler delay. -So before the GPE handler is installed, this patch uses busy polling mode -for all EC(s) and the logic can be applied to non boot EC(s) during the -suspend/resume process. - -Link: https://bugzilla.kernel.org/show_bug.cgi?id=191561 -Tested-by: Jakobus Schurz -Tested-by: Chen Yu -Signed-off-by: Lv Zheng -Signed-off-by: Rafael J. Wysocki ---- - drivers/acpi/ec.c | 62 ++++++++++++++++++++++++------------------------- - drivers/acpi/internal.h | 4 ++-- - 2 files changed, 32 insertions(+), 34 deletions(-) - -diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c -index 6a32cd4ec9da..c24235d8fb52 100644 ---- a/drivers/acpi/ec.c -+++ b/drivers/acpi/ec.c -@@ -704,12 +704,12 @@ static void start_transaction(struct acpi_ec *ec) - - static int ec_guard(struct acpi_ec *ec) - { -- unsigned long guard = usecs_to_jiffies(ec_polling_guard); -+ unsigned long guard = usecs_to_jiffies(ec->polling_guard); - unsigned long timeout = ec->timestamp + guard; - - /* Ensure guarding period before polling EC status */ - do { -- if (ec_busy_polling) { -+ if (ec->busy_polling) { - /* Perform busy polling */ - if (ec_transaction_completed(ec)) - return 0; -@@ -973,6 +973,28 @@ static void acpi_ec_stop(struct acpi_ec *ec, bool suspending) - spin_unlock_irqrestore(&ec->lock, flags); - } - -+static void acpi_ec_enter_noirq(struct acpi_ec *ec) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&ec->lock, flags); -+ ec->busy_polling = true; -+ ec->polling_guard = 0; -+ ec_log_drv("interrupt blocked"); -+ spin_unlock_irqrestore(&ec->lock, flags); -+} -+ -+static void acpi_ec_leave_noirq(struct acpi_ec *ec) -+{ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&ec->lock, flags); -+ ec->busy_polling = ec_busy_polling; -+ ec->polling_guard = ec_polling_guard; -+ ec_log_drv("interrupt unblocked"); -+ spin_unlock_irqrestore(&ec->lock, flags); -+} -+ - void acpi_ec_block_transactions(void) - { - struct acpi_ec *ec = first_ec; -@@ -1253,7 +1275,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, - if (function != ACPI_READ && function != ACPI_WRITE) - return AE_BAD_PARAMETER; - -- if (ec_busy_polling || bits > 8) -+ if (ec->busy_polling || bits > 8) - acpi_ec_burst_enable(ec); - - for (i = 0; i < bytes; ++i, ++address, ++value) -@@ -1261,7 +1283,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address, - acpi_ec_read(ec, address, value) : - acpi_ec_write(ec, address, *value); - -- if (ec_busy_polling || bits > 8) -+ if (ec->busy_polling || bits > 8) - acpi_ec_burst_disable(ec); - - switch (result) { -@@ -1304,6 +1326,8 @@ static struct acpi_ec *acpi_ec_alloc(void) - spin_lock_init(&ec->lock); - INIT_WORK(&ec->work, acpi_ec_event_handler); - ec->timestamp = jiffies; -+ ec->busy_polling = true; -+ ec->polling_guard = 0; - return ec; - } - -@@ -1365,6 +1389,7 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events) - acpi_ec_start(ec, false); - - if (!test_bit(EC_FLAGS_EC_HANDLER_INSTALLED, &ec->flags)) { -+ acpi_ec_enter_noirq(ec); - status = acpi_install_address_space_handler(ec->handle, - ACPI_ADR_SPACE_EC, - &acpi_ec_space_handler, -@@ -1404,6 +1429,7 @@ static int ec_install_handlers(struct acpi_ec *ec, bool handle_events) - /* This is not fatal as we can poll EC events */ - if (ACPI_SUCCESS(status)) { - set_bit(EC_FLAGS_GPE_HANDLER_INSTALLED, &ec->flags); -+ acpi_ec_leave_noirq(ec); - if (test_bit(EC_FLAGS_STARTED, &ec->flags) && - ec->reference_count >= 1) - acpi_ec_enable_gpe(ec, true); -@@ -1786,34 +1812,6 @@ int __init acpi_ec_ecdt_probe(void) - } - - #ifdef CONFIG_PM_SLEEP --static void acpi_ec_enter_noirq(struct acpi_ec *ec) --{ -- unsigned long flags; -- -- if (ec == first_ec) { -- spin_lock_irqsave(&ec->lock, flags); -- ec->saved_busy_polling = ec_busy_polling; -- ec->saved_polling_guard = ec_polling_guard; -- ec_busy_polling = true; -- ec_polling_guard = 0; -- ec_log_drv("interrupt blocked"); -- spin_unlock_irqrestore(&ec->lock, flags); -- } --} -- --static void acpi_ec_leave_noirq(struct acpi_ec *ec) --{ -- unsigned long flags; -- -- if (ec == first_ec) { -- spin_lock_irqsave(&ec->lock, flags); -- ec_busy_polling = ec->saved_busy_polling; -- ec_polling_guard = ec->saved_polling_guard; -- ec_log_drv("interrupt unblocked"); -- spin_unlock_irqrestore(&ec->lock, flags); -- } --} -- - static int acpi_ec_suspend_noirq(struct device *dev) - { - struct acpi_ec *ec = -diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h -index 0c452265c111..219b90bc0922 100644 ---- a/drivers/acpi/internal.h -+++ b/drivers/acpi/internal.h -@@ -172,8 +172,8 @@ struct acpi_ec { - struct work_struct work; - unsigned long timestamp; - unsigned long nr_pending_queries; -- bool saved_busy_polling; -- unsigned int saved_polling_guard; -+ bool busy_polling; -+ unsigned int polling_guard; - }; - - extern struct acpi_ec *first_ec; --- -2.11.0 - diff --git a/debian/patches/bugfix/all/ath9k-fix-null-pointer-dereference.patch b/debian/patches/bugfix/all/ath9k-fix-null-pointer-dereference.patch deleted file mode 100644 index 77891b467..000000000 --- a/debian/patches/bugfix/all/ath9k-fix-null-pointer-dereference.patch +++ /dev/null @@ -1,77 +0,0 @@ -From: Miaoqing Pan -Date: Wed, 16 Nov 2016 17:23:08 +0800 -Subject: ath9k: fix NULL pointer dereference -Origin: https://git.kernel.org/linus/40bea976c72b9ee60f8d097852deb53ccbeaffbe -Bug-Debian: https://bugs.debian.org/851621 - -relay_open() may return NULL, check the return value to avoid the crash. - -BUG: unable to handle kernel NULL pointer dereference at 0000000000000040 -IP: [] ath_cmn_process_fft+0xd5/0x700 [ath9k_common] -PGD 41cf28067 PUD 41be92067 PMD 0 -Oops: 0000 [#1] SMP -CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.8.6+ #35 -Hardware name: Hewlett-Packard h8-1080t/2A86, BIOS 6.15 07/04/2011 -task: ffffffff81e0c4c0 task.stack: ffffffff81e00000 -RIP: 0010:[] [] ath_cmn_process_fft+0xd5/0x700 [ath9k_common] -RSP: 0018:ffff88041f203ca0 EFLAGS: 00010293 -RAX: 0000000000000000 RBX: 000000000000059f RCX: 0000000000000000 -RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffffffff81f0ca98 -RBP: ffff88041f203dc8 R08: ffffffffffffffff R09: 00000000000000ff -R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 -R13: ffffffff81f0ca98 R14: 0000000000000000 R15: 0000000000000000 -FS: 0000000000000000(0000) GS:ffff88041f200000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 0000000000000040 CR3: 000000041b6ec000 CR4: 00000000000006f0 -Stack: -0000000000000363 00000000000003f3 00000000000003f3 00000000000001f9 -000000000000049a 0000000001252c04 ffff88041f203e44 ffff880417b4bfd0 -0000000000000008 ffff88041785b9c0 0000000000000002 ffff88041613dc60 - -Call Trace: - -[] ath9k_tasklet+0x1b1/0x220 [ath9k] -[] tasklet_action+0x4d/0xf0 -[] __do_softirq+0x92/0x2a0 - -Reported-by: Devin Tuchsen -Tested-by: Devin Tuchsen -Signed-off-by: Miaoqing Pan -Signed-off-by: Kalle Valo ---- - drivers/net/wireless/ath/ath9k/common-spectral.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c -index e2512d5bc0e1..eedf86b67cf5 100644 ---- a/drivers/net/wireless/ath/ath9k/common-spectral.c -+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c -@@ -528,6 +528,9 @@ int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_h - if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK)) - return 0; - -+ if (!spec_priv->rfs_chan_spec_scan) -+ return 1; -+ - /* Output buffers are full, no need to process anything - * since there is no space to put the result anyway - */ -@@ -1072,7 +1075,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = { - - void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv) - { -- if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS)) { -+ if (IS_ENABLED(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) { - relay_close(spec_priv->rfs_chan_spec_scan); - spec_priv->rfs_chan_spec_scan = NULL; - } -@@ -1086,6 +1089,9 @@ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, - debugfs_phy, - 1024, 256, &rfs_spec_scan_cb, - NULL); -+ if (!spec_priv->rfs_chan_spec_scan) -+ return; -+ - debugfs_create_file("spectral_scan_ctl", - S_IRUSR | S_IWUSR, - debugfs_phy, spec_priv, diff --git a/debian/patches/bugfix/all/crypto-ahash-fix-einprogress-notification-callback.patch b/debian/patches/bugfix/all/crypto-ahash-fix-einprogress-notification-callback.patch deleted file mode 100644 index 1f69ee5a1..000000000 --- a/debian/patches/bugfix/all/crypto-ahash-fix-einprogress-notification-callback.patch +++ /dev/null @@ -1,226 +0,0 @@ -From: Herbert Xu -Date: Mon, 10 Apr 2017 17:27:57 +0800 -Subject: crypto: ahash - Fix EINPROGRESS notification callback -Origin: https://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6.git/commit?id=ef0579b64e93188710d48667cb5e014926af9f1b -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7618 - -The ahash API modifies the request's callback function in order -to clean up after itself in some corner cases (unaligned final -and missing finup). - -When the request is complete ahash will restore the original -callback and everything is fine. However, when the request gets -an EBUSY on a full queue, an EINPROGRESS callback is made while -the request is still ongoing. - -In this case the ahash API will incorrectly call its own callback. - -This patch fixes the problem by creating a temporary request -object on the stack which is used to relay EINPROGRESS back to -the original completion function. - -This patch also adds code to preserve the original flags value. - -Fixes: ab6bf4e5e5e4 ("crypto: hash - Fix the pointer voodoo in...") -Cc: -Reported-by: Sabrina Dubroca -Tested-by: Sabrina Dubroca -Signed-off-by: Herbert Xu ---- - crypto/ahash.c | 79 ++++++++++++++++++++++++++---------------- - include/crypto/internal/hash.h | 10 ++++++ - 2 files changed, 60 insertions(+), 29 deletions(-) - ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -31,6 +31,7 @@ struct ahash_request_priv { - crypto_completion_t complete; - void *data; - u8 *result; -+ u32 flags; - void *ubuf[] CRYPTO_MINALIGN_ATTR; - }; - -@@ -252,6 +253,8 @@ static int ahash_save_req(struct ahash_r - priv->result = req->result; - priv->complete = req->base.complete; - priv->data = req->base.data; -+ priv->flags = req->base.flags; -+ - /* - * WARNING: We do not backup req->priv here! The req->priv - * is for internal use of the Crypto API and the -@@ -266,38 +269,44 @@ static int ahash_save_req(struct ahash_r - return 0; - } - --static void ahash_restore_req(struct ahash_request *req) -+static void ahash_restore_req(struct ahash_request *req, int err) - { - struct ahash_request_priv *priv = req->priv; - -+ if (!err) -+ memcpy(priv->result, req->result, -+ crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -+ - /* Restore the original crypto request. */ - req->result = priv->result; -- req->base.complete = priv->complete; -- req->base.data = priv->data; -+ -+ ahash_request_set_callback(req, priv->flags, -+ priv->complete, priv->data); - req->priv = NULL; - - /* Free the req->priv.priv from the ADJUSTED request. */ - kzfree(priv); - } - --static void ahash_op_unaligned_finish(struct ahash_request *req, int err) -+static void ahash_notify_einprogress(struct ahash_request *req) - { - struct ahash_request_priv *priv = req->priv; -+ struct crypto_async_request oreq; - -- if (err == -EINPROGRESS) -- return; -- -- if (!err) -- memcpy(priv->result, req->result, -- crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -+ oreq.data = priv->data; - -- ahash_restore_req(req); -+ priv->complete(&oreq, -EINPROGRESS); - } - - static void ahash_op_unaligned_done(struct crypto_async_request *req, int err) - { - struct ahash_request *areq = req->data; - -+ if (err == -EINPROGRESS) { -+ ahash_notify_einprogress(areq); -+ return; -+ } -+ - /* - * Restore the original request, see ahash_op_unaligned() for what - * goes where. -@@ -308,7 +317,7 @@ static void ahash_op_unaligned_done(stru - */ - - /* First copy req->result into req->priv.result */ -- ahash_op_unaligned_finish(areq, err); -+ ahash_restore_req(areq, err); - - /* Complete the ORIGINAL request. */ - areq->base.complete(&areq->base, err); -@@ -324,7 +333,12 @@ static int ahash_op_unaligned(struct aha - return err; - - err = op(req); -- ahash_op_unaligned_finish(req, err); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; -+ -+ ahash_restore_req(req, err); - - return err; - } -@@ -359,25 +373,14 @@ int crypto_ahash_digest(struct ahash_req - } - EXPORT_SYMBOL_GPL(crypto_ahash_digest); - --static void ahash_def_finup_finish2(struct ahash_request *req, int err) -+static void ahash_def_finup_done2(struct crypto_async_request *req, int err) - { -- struct ahash_request_priv *priv = req->priv; -+ struct ahash_request *areq = req->data; - - if (err == -EINPROGRESS) - return; - -- if (!err) -- memcpy(priv->result, req->result, -- crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -- -- ahash_restore_req(req); --} -- --static void ahash_def_finup_done2(struct crypto_async_request *req, int err) --{ -- struct ahash_request *areq = req->data; -- -- ahash_def_finup_finish2(areq, err); -+ ahash_restore_req(areq, err); - - areq->base.complete(&areq->base, err); - } -@@ -388,11 +391,15 @@ static int ahash_def_finup_finish1(struc - goto out; - - req->base.complete = ahash_def_finup_done2; -- req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; -+ - err = crypto_ahash_reqtfm(req)->final(req); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; - - out: -- ahash_def_finup_finish2(req, err); -+ ahash_restore_req(req, err); - return err; - } - -@@ -400,7 +407,16 @@ static void ahash_def_finup_done1(struct - { - struct ahash_request *areq = req->data; - -+ if (err == -EINPROGRESS) { -+ ahash_notify_einprogress(areq); -+ return; -+ } -+ -+ areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; -+ - err = ahash_def_finup_finish1(areq, err); -+ if (areq->priv) -+ return; - - areq->base.complete(&areq->base, err); - } -@@ -415,6 +431,11 @@ static int ahash_def_finup(struct ahash_ - return err; - - err = tfm->update(req); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; -+ - return ahash_def_finup_finish1(req, err); - } - ---- a/include/crypto/internal/hash.h -+++ b/include/crypto/internal/hash.h -@@ -166,6 +166,16 @@ static inline struct ahash_instance *aha - return crypto_alloc_instance2(name, alg, ahash_instance_headroom()); - } - -+static inline void ahash_request_complete(struct ahash_request *req, int err) -+{ -+ req->base.complete(&req->base, err); -+} -+ -+static inline u32 ahash_request_flags(struct ahash_request *req) -+{ -+ return req->base.flags; -+} -+ - static inline struct crypto_ahash *crypto_spawn_ahash( - struct crypto_ahash_spawn *spawn) - { diff --git a/debian/patches/bugfix/all/drm-nouveau-disp-mcp7x-disable-dptmds-workaround.patch b/debian/patches/bugfix/all/drm-nouveau-disp-mcp7x-disable-dptmds-workaround.patch deleted file mode 100644 index facdb8412..000000000 --- a/debian/patches/bugfix/all/drm-nouveau-disp-mcp7x-disable-dptmds-workaround.patch +++ /dev/null @@ -1,28 +0,0 @@ -From: Ben Skeggs -Date: Mon, 9 Jan 2017 10:22:15 +1000 -Subject: drm/nouveau/disp/mcp7x: disable dptmds workaround -Origin: https://git.kernel.org/linus/7dfee6827780d4228148263545af936d0cae8930 -Bug-Debian: https://bugs.debian.org/850219 - -The workaround appears to cause regressions on these boards, and from -inspection of RM traces, NVIDIA don't appear to do it on them either. - -Signed-off-by: Ben Skeggs -Tested-by: Roy Spliet ---- - drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c | 2 -- - 1 file changed, 2 deletions(-) - -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c -index 567466f93cd5..0db8efbf1c2e 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/nv50.c -@@ -433,8 +433,6 @@ nv50_disp_dptmds_war(struct nvkm_device *device) - case 0x94: - case 0x96: - case 0x98: -- case 0xaa: -- case 0xac: - return true; - default: - break; diff --git a/debian/patches/bugfix/all/ext4-fix-bug-838544.patch b/debian/patches/bugfix/all/ext4-fix-bug-838544.patch deleted file mode 100644 index b7b3c7cb9..000000000 --- a/debian/patches/bugfix/all/ext4-fix-bug-838544.patch +++ /dev/null @@ -1,37 +0,0 @@ -From: Daeho Jeong -Date: Thu, 1 Dec 2016 11:49:12 -0500 -Subject: ext4: fix inode checksum calculation problem if i_extra_size is small -Origin: https://git.kernel.org/linus/05ac5aa18abd7db341e54df4ae2b4c98ea0e43b7 -Bug-Debian: https://bugs.debian.org/838544 - -We've fixed the race condition problem in calculating ext4 checksum -value in commit b47820edd163 ("ext4: avoid modifying checksum fields -directly during checksum veficationon"). However, by this change, -when calculating the checksum value of inode whose i_extra_size is -less than 4, we couldn't calculate the checksum value in a proper way. -This problem was found and reported by Nix, Thank you. - -Reported-by: Nix -Signed-off-by: Daeho Jeong -Signed-off-by: Youngjin Gil -Signed-off-by: Darrick J. Wong -Signed-off-by: Theodore Ts'o ---- - fs/ext4/inode.c | 5 ++--- - 1 file changed, 2 insertions(+), 3 deletions(-) - ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -71,10 +71,9 @@ static __u32 ext4_inode_csum(struct inod - csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, - csum_size); - offset += csum_size; -- csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -- EXT4_INODE_SIZE(inode->i_sb) - -- offset); - } -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_INODE_SIZE(inode->i_sb) - offset); - } - - return csum; diff --git a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-firmware-load.patch b/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-firmware-load.patch deleted file mode 100644 index ccb3bde98..000000000 --- a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-firmware-load.patch +++ /dev/null @@ -1,132 +0,0 @@ -From: Mauro Carvalho Chehab -Date: Tue, 24 Jan 2017 08:13:11 -0200 -Subject: [media] dvb-usb: don't use stack for firmware load -Bug-Debian: https://bugs.debian.org/853894 -Origin: https://git.kernel.org/linus/43fab9793c1f44e665b4f98035a14942edf03ddc - -As reported by Marc Duponcheel , firmware load on -dvb-usb is using the stack, with is not allowed anymore on default -Kernel configurations: - -[ 1025.958836] dvb-usb: found a 'WideView WT-220U PenType Receiver (based on ZL353)' in cold state, will try to load a firmware -[ 1025.958853] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw' -[ 1025.958855] dvb-usb: could not stop the USB controller CPU. -[ 1025.958856] dvb-usb: error while transferring firmware (transferred size: -11, block size: 3) -[ 1025.958856] dvb-usb: firmware download failed at 8 with -22 -[ 1025.958867] usbcore: registered new interface driver dvb_usb_dtt200u - -[ 2.789902] dvb-usb: downloading firmware from file 'dvb-usb-wt220u-zl0353-01.fw' -[ 2.789905] ------------[ cut here ]------------ -[ 2.789911] WARNING: CPU: 3 PID: 2196 at drivers/usb/core/hcd.c:1584 usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore] -[ 2.789912] transfer buffer not dma capable -[ 2.789912] Modules linked in: btusb dvb_usb_dtt200u(+) dvb_usb_af9035(+) btrtl btbcm dvb_usb dvb_usb_v2 btintel dvb_core bluetooth rc_core rfkill x86_pkg_temp_thermal intel_powerclamp coretemp crc32_pclmul aesni_intel aes_x86_64 glue_helper lrw gf128mul ablk_helper cryptd drm_kms_helper syscopyarea sysfillrect pcspkr i2c_i801 sysimgblt fb_sys_fops drm i2c_smbus i2c_core r8169 lpc_ich mfd_core mii thermal fan rtc_cmos video button acpi_cpufreq processor snd_hda_codec_realtek snd_hda_codec_generic snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd crc32c_intel ahci libahci libata xhci_pci ehci_pci xhci_hcd ehci_hcd usbcore usb_common dm_mirror dm_region_hash dm_log dm_mod -[ 2.789936] CPU: 3 PID: 2196 Comm: systemd-udevd Not tainted 4.9.0-gentoo #1 -[ 2.789937] Hardware name: ASUS All Series/H81I-PLUS, BIOS 0401 07/23/2013 -[ 2.789938] ffffc9000339b690 ffffffff812bd397 ffffc9000339b6e0 0000000000000000 -[ 2.789939] ffffc9000339b6d0 ffffffff81055c86 000006300339b6a0 ffff880116c0c000 -[ 2.789941] 0000000000000000 0000000000000000 0000000000000001 ffff880116c08000 -[ 2.789942] Call Trace: -[ 2.789945] [] dump_stack+0x4d/0x66 -[ 2.789947] [] __warn+0xc6/0xe0 -[ 2.789948] [] warn_slowpath_fmt+0x4a/0x50 -[ 2.789952] [] usb_hcd_map_urb_for_dma+0x430/0x560 [usbcore] -[ 2.789954] [] ? io_schedule_timeout+0xd8/0x110 -[ 2.789956] [] usb_hcd_submit_urb+0x9c/0x980 [usbcore] -[ 2.789958] [] ? copy_page_to_iter+0x14f/0x2b0 -[ 2.789960] [] ? pagecache_get_page+0x28/0x240 -[ 2.789962] [] ? touch_atime+0x20/0xa0 -[ 2.789964] [] usb_submit_urb+0x2c4/0x520 [usbcore] -[ 2.789967] [] usb_start_wait_urb+0x5a/0xe0 [usbcore] -[ 2.789969] [] usb_control_msg+0xbc/0xf0 [usbcore] -[ 2.789970] [] usb_cypress_writemem+0x3d/0x40 [dvb_usb] -[ 2.789972] [] usb_cypress_load_firmware+0x4f/0x130 [dvb_usb] -[ 2.789973] [] ? console_unlock+0x2fe/0x5d0 -[ 2.789974] [] ? vprintk_emit+0x27c/0x410 -[ 2.789975] [] ? vprintk_default+0x1a/0x20 -[ 2.789976] [] ? printk+0x43/0x4b -[ 2.789977] [] dvb_usb_download_firmware+0x60/0xd0 [dvb_usb] -[ 2.789979] [] dvb_usb_device_init+0x3d8/0x610 [dvb_usb] -[ 2.789981] [] dtt200u_usb_probe+0x92/0xd0 [dvb_usb_dtt200u] -[ 2.789984] [] usb_probe_interface+0xfc/0x270 [usbcore] -[ 2.789985] [] driver_probe_device+0x215/0x2d0 -[ 2.789986] [] __driver_attach+0x96/0xa0 -[ 2.789987] [] ? driver_probe_device+0x2d0/0x2d0 -[ 2.789988] [] bus_for_each_dev+0x5b/0x90 -[ 2.789989] [] driver_attach+0x19/0x20 -[ 2.789990] [] bus_add_driver+0x11c/0x220 -[ 2.789991] [] driver_register+0x5b/0xd0 -[ 2.789994] [] usb_register_driver+0x7c/0x130 [usbcore] -[ 2.789994] [] ? 0xffffffffa06a5000 -[ 2.789996] [] dtt200u_usb_driver_init+0x1e/0x20 [dvb_usb_dtt200u] -[ 2.789997] [] do_one_initcall+0x38/0x140 -[ 2.789998] [] ? __vunmap+0x7c/0xc0 -[ 2.789999] [] ? do_init_module+0x22/0x1d2 -[ 2.790000] [] do_init_module+0x5a/0x1d2 -[ 2.790002] [] load_module+0x1e11/0x2580 -[ 2.790003] [] ? show_taint+0x30/0x30 -[ 2.790004] [] ? kernel_read_file+0x100/0x190 -[ 2.790005] [] SyS_finit_module+0xba/0xc0 -[ 2.790007] [] entry_SYSCALL_64_fastpath+0x13/0x94 -[ 2.790008] ---[ end trace c78a74e78baec6fc ]--- - -So, allocate the structure dynamically. - -Cc: stable@vger.kernel.org # Kernel 4.9+ -Signed-off-by: Mauro Carvalho Chehab -[bwh: Backported to 4.9: adjust context] ---- - drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 19 +++++++++++++------ - 1 file changed, 13 insertions(+), 6 deletions(-) - ---- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -@@ -35,29 +35,34 @@ static int usb_cypress_writemem(struct u - - int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type) - { -- struct hexline hx; -+ struct hexline *hx; - u8 reset; - int ret,pos=0; - -+ hx = kmalloc(sizeof(*hx), GFP_KERNEL); -+ if (!hx) -+ return -ENOMEM; -+ - /* stop the CPU */ - reset = 1; - if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1) - err("could not stop the USB controller CPU."); - -- while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) { -- deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk); -- ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len); -+ while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) { -+ deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n", hx->addr, hx->len, hx->chk); -+ ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len); - -- if (ret != hx.len) { -+ if (ret != hx->len) { - err("error while transferring firmware " - "(transferred size: %d, block size: %d)", -- ret,hx.len); -+ ret, hx->len); - ret = -EINVAL; - break; - } - } - if (ret < 0) { - err("firmware download failed at %d with %d",pos,ret); -+ kfree(hx); - return ret; - } - -@@ -71,6 +76,8 @@ int usb_cypress_load_firmware(struct usb - } else - ret = -EIO; - -+ kfree(hx); -+ - return ret; - } - EXPORT_SYMBOL(usb_cypress_load_firmware); diff --git a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch b/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch deleted file mode 100644 index 2b307cc7c..000000000 --- a/debian/patches/bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch +++ /dev/null @@ -1,71 +0,0 @@ -From: Stefan Brüns -Date: Sun, 12 Feb 2017 13:02:13 -0200 -Subject: [media] dvb-usb-firmware: don't do DMA on stack -Origin: https://git.kernel.org/linus/67b0503db9c29b04eadfeede6bebbfe5ddad94ef -Bug-Debian: https://bugs.debian.org/853894 - -The buffer allocation for the firmware data was changed in -commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load") -but the same applies for the reset value. - -Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load") -Cc: stable@vger.kernel.org -Signed-off-by: Stefan Brüns -Signed-off-by: Mauro Carvalho Chehab ---- - drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 22 ++++++++++++---------- - 1 file changed, 12 insertions(+), 10 deletions(-) - ---- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct u - int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type) - { - struct hexline *hx; -- u8 reset; -- int ret,pos=0; -+ u8 *buf; -+ int ret, pos = 0; -+ u16 cpu_cs_register = cypress[type].cpu_cs_register; - -- hx = kmalloc(sizeof(*hx), GFP_KERNEL); -- if (!hx) -+ buf = kmalloc(sizeof(*hx), GFP_KERNEL); -+ if (!buf) - return -ENOMEM; -+ hx = (struct hexline *)buf; - - /* stop the CPU */ -- reset = 1; -- if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1) -+ buf[0] = 1; -+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) - err("could not stop the USB controller CPU."); - - while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) { -@@ -62,21 +64,21 @@ int usb_cypress_load_firmware(struct usb - } - if (ret < 0) { - err("firmware download failed at %d with %d",pos,ret); -- kfree(hx); -+ kfree(buf); - return ret; - } - - if (ret == 0) { - /* restart the CPU */ -- reset = 0; -- if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) { -+ buf[0] = 0; -+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) { - err("could not restart the USB controller CPU."); - ret = -EINVAL; - } - } else - ret = -EIO; - -- kfree(hx); -+ kfree(buf); - - return ret; - } diff --git a/debian/patches/bugfix/all/mm-memcontrol-use-special-workqueue-for-creating-per-memcg-caches.patch b/debian/patches/bugfix/all/mm-memcontrol-use-special-workqueue-for-creating-per-memcg-caches.patch deleted file mode 100644 index b3365b745..000000000 --- a/debian/patches/bugfix/all/mm-memcontrol-use-special-workqueue-for-creating-per-memcg-caches.patch +++ /dev/null @@ -1,79 +0,0 @@ -From: Vladimir Davydov -Date: Mon, 12 Dec 2016 16:41:29 -0800 -Subject: mm: memcontrol: use special workqueue for creating per-memcg caches -Origin: https://git.kernel.org/linus/13583c3d3224508582ec03d881d0b68dd3ee8e10 -Bug: https://bugzilla.kernel.org/show_bug.cgi?id=172981 - -Creating a lot of cgroups at the same time might stall all worker -threads with kmem cache creation works, because kmem cache creation is -done with the slab_mutex held. The problem was amplified by commits -801faf0db894 ("mm/slab: lockless decision to grow cache") in case of -SLAB and 81ae6d03952c ("mm/slub.c: replace kick_all_cpus_sync() with -synchronize_sched() in kmem_cache_shrink()") in case of SLUB, which -increased the maximal time the slab_mutex can be held. - -To prevent that from happening, let's use a special ordered single -threaded workqueue for kmem cache creation. This shouldn't introduce -any functional changes regarding how kmem caches are created, as the -work function holds the global slab_mutex during its whole runtime -anyway, making it impossible to run more than one work at a time. By -using a single threaded workqueue, we just avoid creating a thread per -each work. Ordering is required to avoid a situation when a cgroup's -work is put off indefinitely because there are other cgroups to serve, -in other words to guarantee fairness. - -Link: https://bugzilla.kernel.org/show_bug.cgi?id=172981 -Link: http://lkml.kernel.org/r/20161004131417.GC1862@esperanza -Signed-off-by: Vladimir Davydov -Reported-by: Doug Smythies -Acked-by: Michal Hocko -Cc: Christoph Lameter -Cc: David Rientjes -Cc: Johannes Weiner -Cc: Joonsoo Kim -Cc: Michal Hocko -Cc: Pekka Enberg -Signed-off-by: Andrew Morton -Signed-off-by: Linus Torvalds ---- - mm/memcontrol.c | 15 ++++++++++++++- - 1 file changed, 14 insertions(+), 1 deletion(-) - ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -2232,6 +2232,8 @@ struct memcg_kmem_cache_create_work { - struct work_struct work; - }; - -+static struct workqueue_struct *memcg_kmem_cache_create_wq; -+ - static void memcg_kmem_cache_create_func(struct work_struct *w) - { - struct memcg_kmem_cache_create_work *cw = -@@ -2263,7 +2265,7 @@ static void __memcg_schedule_kmem_cache_ - cw->cachep = cachep; - INIT_WORK(&cw->work, memcg_kmem_cache_create_func); - -- schedule_work(&cw->work); -+ queue_work(memcg_kmem_cache_create_wq, &cw->work); - } - - static void memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg, -@@ -5811,6 +5813,17 @@ static int __init mem_cgroup_init(void) - { - int cpu, node; - -+#ifndef CONFIG_SLOB -+ /* -+ * Kmem cache creation is mostly done with the slab_mutex held, -+ * so use a special workqueue to avoid stalling all worker -+ * threads in case lots of cgroups are created simultaneously. -+ */ -+ memcg_kmem_cache_create_wq = -+ alloc_ordered_workqueue("memcg_kmem_cache_create", 0); -+ BUG_ON(!memcg_kmem_cache_create_wq); -+#endif -+ - hotcpu_notifier(memcg_cpu_hotplug_callback, 0); - - for_each_possible_cpu(cpu) diff --git a/debian/patches/bugfix/all/nbd-fix-64-bit-division.patch b/debian/patches/bugfix/all/nbd-fix-64-bit-division.patch deleted file mode 100644 index 96c1f0f39..000000000 --- a/debian/patches/bugfix/all/nbd-fix-64-bit-division.patch +++ /dev/null @@ -1,33 +0,0 @@ -From: Jens Axboe -Date: Sat, 3 Dec 2016 12:08:03 -0700 -Subject: [PATCH] nbd: fix 64-bit division -Origin: https://git.kernel.org/linus/e88f72cb9f54f6d244e55f629fe5e2f34ca6f9ed - -We have this: - -ERROR: "__aeabi_ldivmod" [drivers/block/nbd.ko] undefined! -ERROR: "__divdi3" [drivers/block/nbd.ko] undefined! -nbd.c:(.text+0x247c72): undefined reference to `__divdi3' - -due to a recent commit, that did 64-bit division. Use the proper -divider function so that 32-bit compiles don't break. - -Fixes: ef77b515243b ("nbd: use loff_t for blocksize and nbd_set_size args") -Signed-off-by: Jens Axboe ---- - drivers/block/nbd.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index 92f5400edbd3..bc78cbb2d18a 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -729,7 +729,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd, - - case NBD_SET_SIZE: - return nbd_size_set(nbd, bdev, nbd->blksize, -- arg / nbd->blksize); -+ div_s64(arg, nbd->blksize)); - - case NBD_SET_SIZE_BLOCKS: - return nbd_size_set(nbd, bdev, nbd->blksize, arg); diff --git a/debian/patches/bugfix/all/nbd-use-loff_t-for-blocksize-and-nbd_set_size-args.patch b/debian/patches/bugfix/all/nbd-use-loff_t-for-blocksize-and-nbd_set_size-args.patch deleted file mode 100644 index 4dbae8894..000000000 --- a/debian/patches/bugfix/all/nbd-use-loff_t-for-blocksize-and-nbd_set_size-args.patch +++ /dev/null @@ -1,56 +0,0 @@ -From: Josef Bacik -Date: Fri, 2 Dec 2016 16:19:12 -0500 -Subject: nbd: use loff_t for blocksize and nbd_set_size args -Origin: https://git.kernel.org/linus/ef77b515243b3499d62cf446eda6ca7e0a0b079c -Bug-Debian: https://bugs.debian.org/851533 - -If we have large devices (say like the 40t drive I was trying to test with) we -will end up overflowing the int arguments to nbd_set_size and not get the right -size for our device. Fix this by using loff_t everywhere so I don't have to -think about this again. Thanks, - -Signed-off-by: Josef Bacik -Signed-off-by: Jens Axboe -[bwh: Backported to 4.9: adjust context] ---- - drivers/block/nbd.c | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -54,7 +54,7 @@ struct nbd_device { - - struct mutex tx_lock; - struct gendisk *disk; -- int blksize; -+ loff_t blksize; - loff_t bytesize; - - /* protects initialization and shutdown of the socket */ -@@ -126,7 +126,7 @@ static void nbd_size_update(struct nbd_d - } - - static int nbd_size_set(struct nbd_device *nbd, struct block_device *bdev, -- int blocksize, int nr_blocks) -+ loff_t blocksize, loff_t nr_blocks) - { - int ret; - -@@ -135,7 +135,7 @@ static int nbd_size_set(struct nbd_devic - return ret; - - nbd->blksize = blocksize; -- nbd->bytesize = (loff_t)blocksize * (loff_t)nr_blocks; -+ nbd->bytesize = blocksize * nr_blocks; - - nbd_size_update(nbd, bdev); - -@@ -817,7 +817,7 @@ static int nbd_dev_dbg_init(struct nbd_d - debugfs_create_file("tasks", 0444, dir, nbd, &nbd_dbg_tasks_ops); - debugfs_create_u64("size_bytes", 0444, dir, &nbd->bytesize); - debugfs_create_u32("timeout", 0444, dir, &nbd->tag_set.timeout); -- debugfs_create_u32("blocksize", 0444, dir, &nbd->blksize); -+ debugfs_create_u64("blocksize", 0444, dir, &nbd->blksize); - debugfs_create_file("flags", 0444, dir, nbd, &nbd_dbg_flags_ops); - - return 0; diff --git a/debian/patches/bugfix/all/net-ipv6-check-route-protocol-when-deleting-routes.patch b/debian/patches/bugfix/all/net-ipv6-check-route-protocol-when-deleting-routes.patch deleted file mode 100644 index 0682f7a83..000000000 --- a/debian/patches/bugfix/all/net-ipv6-check-route-protocol-when-deleting-routes.patch +++ /dev/null @@ -1,32 +0,0 @@ -From: Mantas M -Date: Fri, 16 Dec 2016 10:30:59 +0200 -Subject: net: ipv6: check route protocol when deleting routes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Origin: https://git.kernel.org/linus/c2ed1880fd61a998e3ce40254a99a2ad000f1a7d -Bug-Debian: https://bugs.debian.org/855153 - -The protocol field is checked when deleting IPv4 routes, but ignored for -IPv6, which causes problems with routing daemons accidentally deleting -externally set routes (observed by multiple bird6 users). - -This can be verified using `ip -6 route del proto something`. - -Signed-off-by: Mantas Mikulėnas -Signed-off-by: David S. Miller ---- - net/ipv6/route.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -2166,6 +2166,8 @@ static int ip6_route_del(struct fib6_con - continue; - if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric) - continue; -+ if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol) -+ continue; - dst_hold(&rt->dst); - read_unlock_bh(&table->tb6_lock); - diff --git a/debian/patches/bugfix/all/net-packet-fix-overflow-in-check-for-priv-area-size.patch b/debian/patches/bugfix/all/net-packet-fix-overflow-in-check-for-priv-area-size.patch deleted file mode 100644 index 2ba2e7c62..000000000 --- a/debian/patches/bugfix/all/net-packet-fix-overflow-in-check-for-priv-area-size.patch +++ /dev/null @@ -1,35 +0,0 @@ -From: Andrey Konovalov -Date: Wed, 29 Mar 2017 16:11:20 +0200 -Subject: net/packet: fix overflow in check for priv area size -Origin: https://git.kernel.org/linus/2b6867c2ce76c596676bec7d2d525af525fdc6e2 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-7308 - -Subtracting tp_sizeof_priv from tp_block_size and casting to int -to check whether one is less then the other doesn't always work -(both of them are unsigned ints). - -Compare them as is instead. - -Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as -it can overflow inside BLK_PLUS_PRIV otherwise. - -Signed-off-by: Andrey Konovalov -Acked-by: Eric Dumazet -Signed-off-by: David S. Miller ---- - net/packet/af_packet.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4235,8 +4235,8 @@ static int packet_set_ring(struct sock * - if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) - goto out; - if (po->tp_version >= TPACKET_V3 && -- (int)(req->tp_block_size - -- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) -+ req->tp_block_size <= -+ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) - goto out; - if (unlikely(req->tp_frame_size < po->tp_hdrlen + - po->tp_reserve)) diff --git a/debian/patches/bugfix/all/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch b/debian/patches/bugfix/all/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch deleted file mode 100644 index 024c12b6a..000000000 --- a/debian/patches/bugfix/all/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch +++ /dev/null @@ -1,61 +0,0 @@ -From: Marcelo Ricardo Leitner -Date: Thu, 23 Feb 2017 09:31:18 -0300 -Subject: sctp: deny peeloff operation on asocs with threads sleeping on it -Origin: https://git.kernel.org/linus/dfcb9f4f99f1e9a49e43398a7bfbf56927544af1 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-6353 - -commit 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf") -attempted to avoid a BUG_ON call when the association being used for a -sendmsg() is blocked waiting for more sndbuf and another thread did a -peeloff operation on such asoc, moving it to another socket. - -As Ben Hutchings noticed, then in such case it would return without -locking back the socket and would cause two unlocks in a row. - -Further analysis also revealed that it could allow a double free if the -application managed to peeloff the asoc that is created during the -sendmsg call, because then sctp_sendmsg() would try to free the asoc -that was created only for that call. - -This patch takes another approach. It will deny the peeloff operation -if there is a thread sleeping on the asoc, so this situation doesn't -exist anymore. This avoids the issues described above and also honors -the syscalls that are already being handled (it can be multiple sendmsg -calls). - -Joint work with Xin Long. - -Fixes: 2dcab5984841 ("sctp: avoid BUG_ON on sctp_wait_for_sndbuf") -Cc: Alexander Popov -Cc: Ben Hutchings -Signed-off-by: Marcelo Ricardo Leitner -Signed-off-by: Xin Long -Signed-off-by: David S. Miller ---- - net/sctp/socket.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4735,6 +4735,12 @@ int sctp_do_peeloff(struct sock *sk, sct - if (!asoc) - return -EINVAL; - -+ /* If there is a thread waiting on more sndbuf space for -+ * sending on this asoc, it cannot be peeled. -+ */ -+ if (waitqueue_active(&asoc->wait)) -+ return -EBUSY; -+ - /* An association cannot be branched off from an already peeled-off - * socket, nor is this supported for tcp style sockets. - */ -@@ -7427,8 +7433,6 @@ static int sctp_wait_for_sndbuf(struct s - */ - release_sock(sk); - current_timeo = schedule_timeout(current_timeo); -- if (sk != asoc->base.sk) -- goto do_error; - lock_sock(sk); - - *timeo_p = current_timeo; diff --git a/debian/patches/bugfix/arm64/rtc-tegra-implement-clock-handling.patch b/debian/patches/bugfix/arm64/rtc-tegra-implement-clock-handling.patch deleted file mode 100644 index 178573f3f..000000000 --- a/debian/patches/bugfix/arm64/rtc-tegra-implement-clock-handling.patch +++ /dev/null @@ -1,120 +0,0 @@ -From: Thierry Reding -Date: Thu, 12 Jan 2017 17:07:43 +0100 -Subject: rtc: tegra: Implement clock handling -Origin: https://git.kernel.org/linus/5fa4086987506b2ab8c92f8f99f2295db9918856 -Bug-Debian: https://bugs.debian.org/858514 - -Accessing the registers of the RTC block on Tegra requires the module -clock to be enabled. This only works because the RTC module clock will -be enabled by default during early boot. However, because the clock is -unused, the CCF will disable it at late_init time. This causes the RTC -to become unusable afterwards. This can easily be reproduced by trying -to use the RTC: - - $ hwclock --rtc /dev/rtc1 - -This will hang the system. I ran into this by following up on a report -by Martin Michlmayr that reboot wasn't working on Tegra210 systems. It -turns out that the rtc-tegra driver's ->shutdown() implementation will -hang the CPU, because of the disabled clock, before the system can be -rebooted. - -What confused me for a while is that the same driver is used on prior -Tegra generations where the hang can not be observed. However, as Peter -De Schrijver pointed out, this is because on 32-bit Tegra chips the RTC -clock is enabled by the tegra20_timer.c clocksource driver, which uses -the RTC to provide a persistent clock. This code is never enabled on -64-bit Tegra because the persistent clock infrastructure does not exist -on 64-bit ARM. - -The proper fix for this is to add proper clock handling to the RTC -driver in order to ensure that the clock is enabled when the driver -requires it. All device trees contain the clock already, therefore -no additional changes are required. - -Reported-by: Martin Michlmayr -Acked-By Peter De Schrijver -Signed-off-by: Thierry Reding -Signed-off-by: Alexandre Belloni -[bwh: Backported to 4.9: adjust context] ---- - drivers/rtc/rtc-tegra.c | 28 ++++++++++++++++++++++++++-- - 1 file changed, 26 insertions(+), 2 deletions(-) - ---- a/drivers/rtc/rtc-tegra.c -+++ b/drivers/rtc/rtc-tegra.c -@@ -18,6 +18,7 @@ - * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - #include -+#include - #include - #include - #include -@@ -59,6 +60,7 @@ struct tegra_rtc_info { - struct platform_device *pdev; - struct rtc_device *rtc_dev; - void __iomem *rtc_base; /* NULL if not initialized. */ -+ struct clk *clk; - int tegra_rtc_irq; /* alarm and periodic irq */ - spinlock_t tegra_rtc_lock; - }; -@@ -326,6 +328,14 @@ static int __init tegra_rtc_probe(struct - if (info->tegra_rtc_irq <= 0) - return -EBUSY; - -+ info->clk = devm_clk_get(&pdev->dev, NULL); -+ if (IS_ERR(info->clk)) -+ return PTR_ERR(info->clk); -+ -+ ret = clk_prepare_enable(info->clk); -+ if (ret < 0) -+ return ret; -+ - /* set context info. */ - info->pdev = pdev; - spin_lock_init(&info->tegra_rtc_lock); -@@ -346,7 +356,7 @@ static int __init tegra_rtc_probe(struct - ret = PTR_ERR(info->rtc_dev); - dev_err(&pdev->dev, "Unable to register device (err=%d).\n", - ret); -- return ret; -+ goto disable_clk; - } - - ret = devm_request_irq(&pdev->dev, info->tegra_rtc_irq, -@@ -356,12 +366,25 @@ static int __init tegra_rtc_probe(struct - dev_err(&pdev->dev, - "Unable to request interrupt for device (err=%d).\n", - ret); -- return ret; -+ goto disable_clk; - } - - dev_notice(&pdev->dev, "Tegra internal Real Time Clock\n"); - - return 0; -+ -+disable_clk: -+ clk_disable_unprepare(info->clk); -+ return ret; -+} -+ -+static int tegra_rtc_remove(struct platform_device *pdev) -+{ -+ struct tegra_rtc_info *info = platform_get_drvdata(pdev); -+ -+ clk_disable_unprepare(info->clk); -+ -+ return 0; - } - - #ifdef CONFIG_PM_SLEEP -@@ -413,6 +436,7 @@ static void tegra_rtc_shutdown(struct pl - - MODULE_ALIAS("platform:tegra_rtc"); - static struct platform_driver tegra_rtc_driver = { -+ .remove = tegra_rtc_remove, - .shutdown = tegra_rtc_shutdown, - .driver = { - .name = "tegra_rtc", diff --git a/debian/patches/bugfix/x86/asoc-intel-select-dw_dmac_core-since-it-s-mandatory.patch b/debian/patches/bugfix/x86/asoc-intel-select-dw_dmac_core-since-it-s-mandatory.patch deleted file mode 100644 index 17c54ad75..000000000 --- a/debian/patches/bugfix/x86/asoc-intel-select-dw_dmac_core-since-it-s-mandatory.patch +++ /dev/null @@ -1,107 +0,0 @@ -From: Andy Shevchenko -Date: Mon, 16 Jan 2017 15:12:26 +0200 -Subject: ASoC: Intel: select DW_DMAC_CORE since it's mandatory -Origin: https://git.kernel.org/linus/ebf79091bf85d9b2270ab29191de9cd3aaf888c5 -Bug-Debian: https://bugs.debian.org/851916 - -Select DW_DMAC_CORE like the rest of glue drivers do, e.g. -drivers/dma/dw/Kconfig. - -While here group selectors under SND_SOC_INTEL_HASWELL and -SND_SOC_INTEL_BAYTRAIL. - -Make platforms, which are using a common SST firmware driver, to be -dependent on DMADEVICES. - -Signed-off-by: Andy Shevchenko -Acked-by: Liam Girdwood -Signed-off-by: Mark Brown ---- - sound/soc/intel/Kconfig | 31 +++++++++++++------------------ - 1 file changed, 13 insertions(+), 18 deletions(-) - ---- a/sound/soc/intel/Kconfig -+++ b/sound/soc/intel/Kconfig -@@ -33,11 +33,9 @@ config SND_SOC_INTEL_SST - select SND_SOC_INTEL_SST_MATCH if ACPI - depends on (X86 || COMPILE_TEST) - --# firmware stuff depends DW_DMAC_CORE; since there is no depends-on from --# the reverse selection, each machine driver needs to select --# SND_SOC_INTEL_SST_FIRMWARE carefully depending on DW_DMAC_CORE - config SND_SOC_INTEL_SST_FIRMWARE - tristate -+ select DW_DMAC_CORE - - config SND_SOC_INTEL_SST_ACPI - tristate -@@ -47,16 +45,18 @@ config SND_SOC_INTEL_SST_MATCH - - config SND_SOC_INTEL_HASWELL - tristate -+ select SND_SOC_INTEL_SST - select SND_SOC_INTEL_SST_FIRMWARE - - config SND_SOC_INTEL_BAYTRAIL - tristate -+ select SND_SOC_INTEL_SST -+ select SND_SOC_INTEL_SST_FIRMWARE - - config SND_SOC_INTEL_HASWELL_MACH - tristate "ASoC Audio DSP support for Intel Haswell Lynxpoint" - depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM -- depends on DW_DMAC_CORE -- select SND_SOC_INTEL_SST -+ depends on DMADEVICES - select SND_SOC_INTEL_HASWELL - select SND_SOC_RT5640 - help -@@ -99,9 +99,8 @@ config SND_SOC_INTEL_BXT_RT298_MACH - config SND_SOC_INTEL_BYT_RT5640_MACH - tristate "ASoC Audio driver for Intel Baytrail with RT5640 codec" - depends on X86_INTEL_LPSS && I2C -- depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n) -- select SND_SOC_INTEL_SST -- select SND_SOC_INTEL_SST_FIRMWARE -+ depends on DMADEVICES -+ depends on SND_SST_IPC_ACPI = n - select SND_SOC_INTEL_BAYTRAIL - select SND_SOC_RT5640 - help -@@ -112,9 +111,8 @@ config SND_SOC_INTEL_BYT_RT5640_MACH - config SND_SOC_INTEL_BYT_MAX98090_MACH - tristate "ASoC Audio driver for Intel Baytrail with MAX98090 codec" - depends on X86_INTEL_LPSS && I2C -- depends on DW_DMAC_CORE && (SND_SST_IPC_ACPI = n) -- select SND_SOC_INTEL_SST -- select SND_SOC_INTEL_SST_FIRMWARE -+ depends on DMADEVICES -+ depends on SND_SST_IPC_ACPI = n - select SND_SOC_INTEL_BAYTRAIL - select SND_SOC_MAX98090 - help -@@ -123,9 +121,8 @@ config SND_SOC_INTEL_BYT_MAX98090_MACH - - config SND_SOC_INTEL_BDW_RT5677_MACH - tristate "ASoC Audio driver for Intel Broadwell with RT5677 codec" -- depends on X86_INTEL_LPSS && GPIOLIB && I2C && DW_DMAC -- depends on DW_DMAC_CORE=y -- select SND_SOC_INTEL_SST -+ depends on X86_INTEL_LPSS && GPIOLIB && I2C -+ depends on DMADEVICES - select SND_SOC_INTEL_HASWELL - select SND_SOC_RT5677 - help -@@ -134,10 +131,8 @@ config SND_SOC_INTEL_BDW_RT5677_MACH - - config SND_SOC_INTEL_BROADWELL_MACH - tristate "ASoC Audio DSP support for Intel Broadwell Wildcatpoint" -- depends on X86_INTEL_LPSS && I2C && DW_DMAC && \ -- I2C_DESIGNWARE_PLATFORM -- depends on DW_DMAC_CORE -- select SND_SOC_INTEL_SST -+ depends on X86_INTEL_LPSS && I2C && I2C_DESIGNWARE_PLATFORM -+ depends on DMADEVICES - select SND_SOC_INTEL_HASWELL - select SND_SOC_RT286 - help diff --git a/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch b/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch deleted file mode 100644 index 0f79e139d..000000000 --- a/debian/patches/bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch +++ /dev/null @@ -1,40 +0,0 @@ -From: Paolo Bonzini -Date: Tue, 24 Jan 2017 11:56:21 +0100 -Subject: kvm: fix page struct leak in handle_vmon -Origin: https://git.kernel.org/linus/06ce521af9558814b8606c0476c54497cf83a653 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-2596 - -handle_vmon gets a reference on VMXON region page, -but does not release it. Release the reference. - -Found by syzkaller; based on a patch by Dmitry. - -Reported-by: Dmitry Vyukov -Signed-off-by: Paolo Bonzini -[bwh: Backported to 4.9: use skip_emulated_instruction()] ---- ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -6925,14 +6925,20 @@ static int nested_vmx_check_vmptr(struct - } - - page = nested_get_page(vcpu, vmptr); -- if (page == NULL || -- *(u32 *)kmap(page) != VMCS12_REVISION) { -+ if (page == NULL) { - nested_vmx_failInvalid(vcpu); -+ skip_emulated_instruction(vcpu); -+ return 1; -+ } -+ if (*(u32 *)kmap(page) != VMCS12_REVISION) { - kunmap(page); -+ nested_release_page_clean(page); -+ nested_vmx_failInvalid(vcpu); - skip_emulated_instruction(vcpu); - return 1; - } - kunmap(page); -+ nested_release_page_clean(page); - vmx->nested.vmxon_ptr = vmptr; - break; - case EXIT_REASON_VMCLEAR: diff --git a/debian/patches/bugfix/x86/platform-x86-acer-wmi-setup-accelerometer-when-machi.patch b/debian/patches/bugfix/x86/platform-x86-acer-wmi-setup-accelerometer-when-machi.patch deleted file mode 100644 index 4c7805c5d..000000000 --- a/debian/patches/bugfix/x86/platform-x86-acer-wmi-setup-accelerometer-when-machi.patch +++ /dev/null @@ -1,79 +0,0 @@ -From: "Lee, Chun-Yi" -Date: Thu, 3 Nov 2016 08:18:52 +0800 -Subject: platform/x86: acer-wmi: setup accelerometer when machine has - appropriate notify event -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit -Origin: https://git.kernel.org/linus/98d610c3739ac354319a6590b915f4624d9151e6 -Bug-Debian: https://bugs.debian.org/853067 - -The accelerometer event relies on the ACERWMID_EVENT_GUID notify. -So, this patch changes the codes to setup accelerometer input device -when detected ACERWMID_EVENT_GUID. It avoids that the accel input -device created on every Acer machines. - -In addition, patch adds a clearly parsing logic of accelerometer hid -to acer_wmi_get_handle_cb callback function. It is positive matching -the "SENR" name with "BST0001" device to avoid non-supported hardware. - -Reported-by: Bjørn Mork -Cc: Darren Hart -Signed-off-by: Lee, Chun-Yi -[andy: slightly massage commit message] -Signed-off-by: Andy Shevchenko ---- - drivers/platform/x86/acer-wmi.c | 22 ++++++++++++++++++---- - 1 file changed, 18 insertions(+), 4 deletions(-) - ---- a/drivers/platform/x86/acer-wmi.c -+++ b/drivers/platform/x86/acer-wmi.c -@@ -1808,11 +1808,24 @@ static int __init acer_wmi_enable_lm(voi - return status; - } - -+#define ACER_WMID_ACCEL_HID "BST0001" -+ - static acpi_status __init acer_wmi_get_handle_cb(acpi_handle ah, u32 level, - void *ctx, void **retval) - { -+ struct acpi_device *dev; -+ -+ if (!strcmp(ctx, "SENR")) { -+ if (acpi_bus_get_device(ah, &dev)) -+ return AE_OK; -+ if (!strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev))) -+ return AE_OK; -+ } else -+ return AE_OK; -+ - *(acpi_handle *)retval = ah; -- return AE_OK; -+ -+ return AE_CTRL_TERMINATE; - } - - static int __init acer_wmi_get_handle(const char *name, const char *prop, -@@ -1839,7 +1852,7 @@ static int __init acer_wmi_accel_setup(v - { - int err; - -- err = acer_wmi_get_handle("SENR", "BST0001", &gsensor_handle); -+ err = acer_wmi_get_handle("SENR", ACER_WMID_ACCEL_HID, &gsensor_handle); - if (err) - return err; - -@@ -2177,10 +2190,11 @@ static int __init acer_wmi_init(void) - err = acer_wmi_input_setup(); - if (err) - return err; -+ err = acer_wmi_accel_setup(); -+ if (err) -+ return err; - } - -- acer_wmi_accel_setup(); -- - err = platform_driver_register(&acer_platform_driver); - if (err) { - pr_err("Unable to register platform driver\n"); diff --git a/debian/patches/bugfix/x86/x86-xen-fix-apic-id-mismatch-warning-on-intel.patch b/debian/patches/bugfix/x86/x86-xen-fix-apic-id-mismatch-warning-on-intel.patch deleted file mode 100644 index 93830d110..000000000 --- a/debian/patches/bugfix/x86/x86-xen-fix-apic-id-mismatch-warning-on-intel.patch +++ /dev/null @@ -1,57 +0,0 @@ -From: Mohit Gambhir -Date: Thu, 26 Jan 2017 13:12:27 -0500 -Subject: x86/xen: Fix APIC id mismatch warning on Intel -Origin: https://git.kernel.org/linus/cc272163ea554a97dac180fa8dd6cd54c2810bd1 -Bug-Debian: https://bugs.debian.org/853193 - -This patch fixes the following warning message seen when booting the -kernel as Dom0 with Xen on Intel machines. - -[0.003000] [Firmware Bug]: CPU1: APIC id mismatch. Firmware: 0 APIC: 1] - -The code generating the warning in validate_apic_and_package_id() matches -cpu_data(cpu).apicid (initialized in init_intel()-> -detect_extended_topology() using cpuid) against the apicid returned from -xen_apic_read(). Now, xen_apic_read() makes a hypercall to retrieve apicid -for the boot cpu but returns 0 otherwise. Hence the warning gets thrown -for all but the boot cpu. - -The idea behind xen_apic_read() returning 0 for apicid is that the -guests (even Dom0) should not need to know what physical processor their -vcpus are running on. This is because we currently do not have topology -information in Xen and also because xen allows more vcpus than physical -processors. However, boot cpu's apicid is required for loading -xen-acpi-processor driver on AMD machines. Look at following patch for -details: - -commit 558daa289a40 ("xen/apic: Return the APIC ID (and version) for CPU -0.") - -So to get rid of the warning, this patch modifies -xen_cpu_present_to_apicid() to return cpu_data(cpu).apicid instead of -calling xen_apic_read(). - -The warning is not seen on AMD machines because init_amd() populates -cpu_data(cpu).apicid by calling hard_smp_processor_id()->xen_apic_read() -as opposed to using apicid from cpuid as is done on Intel machines. - -Signed-off-by: Mohit Gambhir -Reviewed-by: Juergen Gross -Signed-off-by: Boris Ostrovsky ---- - arch/x86/xen/apic.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/arch/x86/xen/apic.c b/arch/x86/xen/apic.c -index 44c88ad1841a..bcea81f36fc5 100644 ---- a/arch/x86/xen/apic.c -+++ b/arch/x86/xen/apic.c -@@ -145,7 +145,7 @@ static void xen_silent_inquire(int apicid) - static int xen_cpu_present_to_apicid(int cpu) - { - if (cpu_present(cpu)) -- return xen_get_apic_id(xen_apic_read(APIC_ID)); -+ return cpu_data(cpu).apicid; - else - return BAD_APICID; - } diff --git a/debian/patches/features/all/rt/drivers-block-zram-Replace-bit-spinlocks-with-rtmute.patch b/debian/patches/features/all/rt/drivers-block-zram-Replace-bit-spinlocks-with-rtmute.patch index 2ee36a29b..738302f6b 100644 --- a/debian/patches/features/all/rt/drivers-block-zram-Replace-bit-spinlocks-with-rtmute.patch +++ b/debian/patches/features/all/rt/drivers-block-zram-Replace-bit-spinlocks-with-rtmute.patch @@ -9,6 +9,7 @@ OTOH, they're a lot less wasteful than an rtmutex per page. Signed-off-by: Mike Galbraith Signed-off-by: Sebastian Andrzej Siewior +[bwh: Adjust context for 4.9.24] --- drivers/block/zram/zram_drv.c | 30 ++++++++++++++++-------------- drivers/block/zram/zram_drv.h | 41 +++++++++++++++++++++++++++++++++++++++++ @@ -37,7 +38,7 @@ Signed-off-by: Sebastian Andrzej Siewior if (!handle || zram_test_flag(meta, index, ZRAM_ZERO)) { - bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value); + zram_unlock_table(&meta->table[index]); - clear_page(mem); + memset(mem, 0, PAGE_SIZE); return 0; } @@ -596,7 +598,7 @@ static int zram_decompress_page(struct z diff --git a/debian/patches/features/all/rt/drivers-zram-Don-t-disable-preemption-in-zcomp_strea.patch b/debian/patches/features/all/rt/drivers-zram-Don-t-disable-preemption-in-zcomp_strea.patch index 5ed0560e7..d1dec6ab6 100644 --- a/debian/patches/features/all/rt/drivers-zram-Don-t-disable-preemption-in-zcomp_strea.patch +++ b/debian/patches/features/all/rt/drivers-zram-Don-t-disable-preemption-in-zcomp_strea.patch @@ -13,6 +13,7 @@ zram_bvec_write(). Signed-off-by: Mike Galbraith [bigeasy: get_locked_var() -> per zcomp_strm lock] Signed-off-by: Sebastian Andrzej Siewior +[bwh: Adjust context for 4.9.24] --- drivers/block/zram/zcomp.c | 12 ++++++++++-- drivers/block/zram/zcomp.h | 1 + @@ -78,7 +79,7 @@ Signed-off-by: Sebastian Andrzej Siewior + zstrm = zcomp_stream_get(zram->comp); cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO); if (size == PAGE_SIZE) { - copy_page(mem, cmem); + memcpy(mem, cmem, PAGE_SIZE); } else { - struct zcomp_strm *zstrm = zcomp_stream_get(zram->comp); - diff --git a/debian/patches/series b/debian/patches/series index f5899de9b..ba301e6c2 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -51,11 +51,7 @@ debian/fanotify-taint-on-use-of-fanotify_access_permissions.patch debian/amd64-don-t-warn-about-expected-w+x-pages-on-xen.patch # Arch bug fixes -bugfix/x86/asoc-intel-select-dw_dmac_core-since-it-s-mandatory.patch -bugfix/x86/platform-x86-acer-wmi-setup-accelerometer-when-machi.patch -bugfix/x86/x86-xen-fix-apic-id-mismatch-warning-on-intel.patch bugfix/arm/arm-dts-kirkwood-fix-sata-pinmux-ing-for-ts419.patch -bugfix/arm64/rtc-tegra-implement-clock-handling.patch # Arch features features/mips/MIPS-increase-MAX-PHYSMEM-BITS-on-Loongson-3-only.patch @@ -75,19 +71,9 @@ bugfix/all/kbuild-use-nostdinc-in-compile-tests.patch bugfix/all/disable-some-marvell-phys.patch bugfix/all/fs-add-module_softdep-declarations-for-hard-coded-cr.patch bugfix/all/kbuild-do-not-use-hyphen-in-exported-variable-name.patch -bugfix/all/ext4-fix-bug-838544.patch -bugfix/all/mm-memcontrol-use-special-workqueue-for-creating-per-memcg-caches.patch bugfix/all/partially-revert-usb-kconfig-using-select-for-usb_co.patch -bugfix/all/nbd-use-loff_t-for-blocksize-and-nbd_set_size-args.patch -bugfix/all/ath9k-fix-null-pointer-dereference.patch -bugfix/all/nbd-fix-64-bit-division.patch -bugfix/all/net-ipv6-check-route-protocol-when-deleting-routes.patch bugfix/all/media-dvb-usb-dibusb-mc-common-add-module_license.patch -bugfix/all/media-dvb-usb-don-t-use-stack-for-firmware-load.patch -bugfix/all/media-dvb-usb-don-t-use-stack-for-reset-either.patch bugfix/all/kbuild-include-addtree-remove-quotes-before-matching-path.patch -bugfix/all/ACPI-EC-Use-busy-polling-mode-when-GPE-is-not-enable.patch -bugfix/all/drm-nouveau-disp-mcp7x-disable-dptmds-workaround.patch # Miscellaneous features features/all/netfilter-nft_ct-add-notrack-support.patch @@ -118,14 +104,10 @@ features/all/securelevel/arm64-add-kernel-config-option-to-set-securelevel-wh.pa # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch -bugfix/x86/kvm-fix-page-struct-leak-in-handle_vmon.patch debian/time-mark-timer_stats-as-broken.patch -bugfix/all/sctp-deny-peeloff-operation-on-asocs-with-threads-sl.patch -bugfix/all/net-packet-fix-overflow-in-check-for-priv-area-size.patch bugfix/all/net-packet-fix-overflow-in-check-for-tp_frame_nr.patch bugfix/all/net-packet-fix-overflow-in-check-for-tp_reserve.patch bugfix/all/ping-implement-proper-locking.patch -bugfix/all/crypto-ahash-fix-einprogress-notification-callback.patch # Fix exported symbol versions bugfix/ia64/revert-ia64-move-exports-to-definitions.patch