A few missing fixes from 4.4.2

2016-02-22 17:30:31 -08:00 · 2016-02-22 17:30:31 -08:00 · 339b74a5b2
parent 770ddfba09
commit 339b74a5b2
3 changed files with 133 additions and 1 deletions
--- a/0001-usb-hub-fix-panic-in-usb_reset_and_verify_device.patch
+++ b/0001-usb-hub-fix-panic-in-usb_reset_and_verify_device.patch
@ -0,0 +1,30 @@
+From 07197eb61cfabc153846b1ae9d080a5d6c449d12 Mon Sep 17 00:00:00 2001
+From: "Du, Changbin" <changbin.du@intel.com>
+Date: Mon, 22 Feb 2016 10:08:36 +0800
+Subject: [PATCH] usb: hub: fix panic in usb_reset_and_verify_device
+
+Signed-off-by: Du, Changbin <changbin.du@intel.com>
+---
+ drivers/usb/core/hub.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 350dcd9..045f951 100644
+--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
+@@ -5501,8 +5501,10 @@ done:
+ 	return 0;
+ 
+ re_enumerate:
+-	usb_release_bos_descriptor(udev);
+-	udev->bos = bos;
+	if (udev->bos != bos) {
+		usb_release_bos_descriptor(udev);
+		udev->bos = bos;
+	}
+ re_enumerate_no_bos:
+ 	/* LPM state doesn't matter when we're about to destroy the device. */
+ 	hub_port_logical_disconnect(parent_hub, port1);
+-- 
+2.5.0
+
--- a/iommu-fix.patch
+++ b/iommu-fix.patch
@ -0,0 +1,92 @@
+From b91309eedd77374fdecc379942c44f903e2dedff Mon Sep 17 00:00:00 2001
+From: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
+Date: Tue, 23 Feb 2016 13:03:30 +0100
+Subject: [PATCH] iommu/amd: Fix boot warning when device 00:00.0 is not iommu
+ covered
+
+The setup code for the performance counters in the AMD IOMMU driver
+tests whether the counters can be written. It tests to setup a counter
+for device 00:00.0, which fails on systems where this particular device
+is not covered by the IOMMU.
+
+Fix this by not relying on device 00:00.0 but only on the IOMMU being
+present.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+---
+ drivers/iommu/amd_iommu_init.c | 34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
+index 013bdff..d06a6d9 100644
+--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
+@@ -228,6 +228,10 @@ static int amd_iommu_enable_interrupts(void);
+ static int __init iommu_go_to_state(enum iommu_init_state state);
+ static void init_device_table_dma(void);
+ 
+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
+				    u8 bank, u8 cntr, u8 fxn,
+				    u64 *value, bool is_write);
+
+ static inline void update_last_devid(u16 devid)
+ {
+ 	if (devid > amd_iommu_last_bdf)
+@@ -1142,8 +1146,8 @@ static void init_iommu_perf_ctr(struct amd_iommu *iommu)
+ 	amd_iommu_pc_present = true;
+ 
+ 	/* Check if the performance counters can be written to */
+-	if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) ||
+-	    (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) ||
+	if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) ||
+	    (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) ||
+ 	    (val != val2)) {
+ 		pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n");
+ 		amd_iommu_pc_present = false;
+@@ -2283,22 +2287,15 @@ u8 amd_iommu_pc_get_max_counters(u16 devid)
+ }
+ EXPORT_SYMBOL(amd_iommu_pc_get_max_counters);
+ 
+-int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
+				    u8 bank, u8 cntr, u8 fxn,
+ 				    u64 *value, bool is_write)
+ {
+-	struct amd_iommu *iommu;
+ 	u32 offset;
+ 	u32 max_offset_lim;
+ 
+-	/* Make sure the IOMMU PC resource is available */
+-	if (!amd_iommu_pc_present)
+-		return -ENODEV;
+-
+-	/* Locate the iommu associated with the device ID */
+-	iommu = amd_iommu_rlookup_table[devid];
+-
+ 	/* Check for valid iommu and pc register indexing */
+-	if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7)))
+	if (WARN_ON((fxn > 0x28) || (fxn & 7)))
+ 		return -ENODEV;
+ 
+ 	offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn);
+@@ -2322,3 +2319,16 @@ int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+ 	return 0;
+ }
+ EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val);
+
+int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
+				    u64 *value, bool is_write)
+{
+	struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
+
+	/* Make sure the IOMMU PC resource is available */
+	if (!amd_iommu_pc_present || iommu == NULL)
+		return -ENODEV;
+
+	return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn,
+					value, is_write);
+}
+-- 
+1.8.4.5
--- a/kernel.spec
+++ b/kernel.spec
@ -40,7 +40,7 @@ Summary: The Linux kernel
 # For non-released -rc kernels, this will be appended after the rcX and
 # gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
 #
-%global baserelease 300
+%global baserelease 301
 %global fedora_build %{baserelease}

 # base_sublevel is the kernel version we're starting with and patching
@ -627,6 +627,12 @@ Patch651: Input-elantech-mark-protocols-v2-and-v3-as-semi-mt.patch
 #CVE-2015-8812 rhbz 1303532 1309548
 Patch653: iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch

+#Known use after free, possibly rhbz 1310579
+Patch654: 0001-usb-hub-fix-panic-in-usb_reset_and_verify_device.patch
+
+#rhbz 1310258
+Patch655: iommu-fix.patch
+
 # END OF PATCH DEFINITIONS

 %endif
@ -2070,6 +2076,10 @@ fi
 #
 # 
 %changelog
+* Tue Feb 23 2016 Laura Abbott <labbott@fedoraproject.org> - 4.4.2-301
+- Fix a known use after free issue in the USB hub code
+- Fix AMD IOMMU warning spew on every boot (rhbz 1310258)
+
 * Sat Feb 20 2016 Peter Robinson <pbrobinson@fedoraproject.org>
 - Drop AMD xgbe-a0 driver (fix aarch64 FTBFS)
 - Minor aarch64/ARMv7 config cleanup