Linux v4.5-12596-g11caf57f6a4b
- asm-generic, pm+acpi, rtc, hwmon, block, mtd, ubifs, nfsd, kbuild, parisc, h8, arm64, armsoc
This commit is contained in:
Josh Boyer
parent
7acc192a3c
commit
846bc92b91
@ -356,6 +356,7 @@ CONFIG_QCOM_WCNSS_CTRL=m
|
||||
CONFIG_QCOM_SMSM=y
|
||||
CONFIG_QCOM_SMP2P=m
|
||||
CONFIG_PCIE_QCOM=y
|
||||
CONFIG_MTD_NAND_QCOM=m
|
||||
|
||||
# i.MX
|
||||
# CONFIG_MXC_DEBUG_BOARD is not set
|
||||
|
||||
@ -4685,6 +4685,8 @@ CONFIG_NFSD_V3=y
|
||||
CONFIG_NFSD_V3_ACL=y
|
||||
CONFIG_NFSD_V4=y
|
||||
CONFIG_NFSD_PNFS=y
|
||||
CONFIG_NFSD_BLOCKLAYOUT=y
|
||||
CONFIG_NFSD_SCSILAYOUT=y
|
||||
CONFIG_NFSD_V4_SECURITY_LABEL=y
|
||||
CONFIG_NFS_FSCACHE=y
|
||||
# CONFIG_NFS_USE_LEGACY_DNS is not set
|
||||
|
||||
2
gitrev
2
gitrev
@ -1 +1 @@
|
||||
e46b4e2b46e173889b19999b8bd033d5e8b3acf0
|
||||
11caf57f6a4b8e380001548b8af0a3ae3f7b4354
|
||||
|
||||
@ -1,241 +0,0 @@
|
||||
From c517e903c4dbc9271b3cfb43b27d303dd6f03cd7 Mon Sep 17 00:00:00 2001
|
||||
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
|
||||
Date: Fri, 18 Mar 2016 15:36:25 +0100
|
||||
Subject: [PATCH] intel_pstate: Do not call wrmsrl_on_cpu() with disabled
|
||||
interrupts
|
||||
|
||||
After commit a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with
|
||||
utilization update callbacks) wrmsrl_on_cpu() cannot be called in the
|
||||
intel_pstate_adjust_busy_pstate() path as that is executed with
|
||||
disabled interrupts. However, atom_set_pstate() called from there
|
||||
via intel_pstate_set_pstate() uses wrmsrl_on_cpu() to update the
|
||||
IA32_PERF_CTL MSR which triggers the WARN_ON_ONCE() in
|
||||
smp_call_function_single().
|
||||
|
||||
The reason why wrmsrl_on_cpu() is used by atom_set_pstate() is
|
||||
because intel_pstate_set_pstate() calling it is also invoked during
|
||||
the initialization and cleanup of the driver and in those cases it is
|
||||
not guaranteed to be run on the CPU that is being updated. However,
|
||||
in the case when intel_pstate_set_pstate() is called by
|
||||
intel_pstate_adjust_busy_pstate(), wrmsrl() can be used to update
|
||||
the register safely. Moreover, intel_pstate_set_pstate() already
|
||||
contains code that only is executed if the function is called by
|
||||
intel_pstate_adjust_busy_pstate() and there is a special argument
|
||||
passed to it because of that.
|
||||
|
||||
To fix the problem at hand, rearrange the code taking the above
|
||||
observations into account.
|
||||
|
||||
First, replace the ->set() callback in struct pstate_funcs with a
|
||||
->get_val() one that will return the value to be written to the
|
||||
IA32_PERF_CTL MSR without updating the register.
|
||||
|
||||
Second, split intel_pstate_set_pstate() into two functions,
|
||||
intel_pstate_update_pstate() to be called by
|
||||
intel_pstate_adjust_busy_pstate() that will contain all of the
|
||||
intel_pstate_set_pstate() code which only needs to be executed in
|
||||
that case and will use wrmsrl() to update the MSR (after obtaining
|
||||
the value to write to it from the ->get_val() callback), and
|
||||
intel_pstate_set_min_pstate() to be invoked during the
|
||||
initialization and cleanup that will set the P-state to the
|
||||
minimum one and will update the MSR using wrmsrl_on_cpu().
|
||||
|
||||
Finally, move the code shared between intel_pstate_update_pstate()
|
||||
and intel_pstate_set_min_pstate() to a new static inline function
|
||||
intel_pstate_record_pstate() and make them both call it.
|
||||
|
||||
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
|
||||
Fixes: a4675fbc4a7a (cpufreq: intel_pstate: Replace timers with utilization update callbacks)
|
||||
---
|
||||
drivers/cpufreq/intel_pstate.c | 73 +++++++++++++++++++++++++-----------------
|
||||
1 file changed, 43 insertions(+), 30 deletions(-)
|
||||
|
||||
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
|
||||
index cb5607495816..4b644526fd59 100644
|
||||
--- a/drivers/cpufreq/intel_pstate.c
|
||||
+++ b/drivers/cpufreq/intel_pstate.c
|
||||
@@ -134,7 +134,7 @@ struct pstate_funcs {
|
||||
int (*get_min)(void);
|
||||
int (*get_turbo)(void);
|
||||
int (*get_scaling)(void);
|
||||
- void (*set)(struct cpudata*, int pstate);
|
||||
+ u64 (*get_val)(struct cpudata*, int pstate);
|
||||
void (*get_vid)(struct cpudata *);
|
||||
int32_t (*get_target_pstate)(struct cpudata *);
|
||||
};
|
||||
@@ -565,7 +565,7 @@ static int atom_get_turbo_pstate(void)
|
||||
return value & 0x7F;
|
||||
}
|
||||
|
||||
-static void atom_set_pstate(struct cpudata *cpudata, int pstate)
|
||||
+static u64 atom_get_val(struct cpudata *cpudata, int pstate)
|
||||
{
|
||||
u64 val;
|
||||
int32_t vid_fp;
|
||||
@@ -585,9 +585,7 @@ static void atom_set_pstate(struct cpudata *cpudata, int pstate)
|
||||
if (pstate > cpudata->pstate.max_pstate)
|
||||
vid = cpudata->vid.turbo;
|
||||
|
||||
- val |= vid;
|
||||
-
|
||||
- wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
|
||||
+ return val | vid;
|
||||
}
|
||||
|
||||
static int silvermont_get_scaling(void)
|
||||
@@ -711,7 +709,7 @@ static inline int core_get_scaling(void)
|
||||
return 100000;
|
||||
}
|
||||
|
||||
-static void core_set_pstate(struct cpudata *cpudata, int pstate)
|
||||
+static u64 core_get_val(struct cpudata *cpudata, int pstate)
|
||||
{
|
||||
u64 val;
|
||||
|
||||
@@ -719,7 +717,7 @@ static void core_set_pstate(struct cpudata *cpudata, int pstate)
|
||||
if (limits->no_turbo && !limits->turbo_disabled)
|
||||
val |= (u64)1 << 32;
|
||||
|
||||
- wrmsrl(MSR_IA32_PERF_CTL, val);
|
||||
+ return val;
|
||||
}
|
||||
|
||||
static int knl_get_turbo_pstate(void)
|
||||
@@ -750,7 +748,7 @@ static struct cpu_defaults core_params = {
|
||||
.get_min = core_get_min_pstate,
|
||||
.get_turbo = core_get_turbo_pstate,
|
||||
.get_scaling = core_get_scaling,
|
||||
- .set = core_set_pstate,
|
||||
+ .get_val = core_get_val,
|
||||
.get_target_pstate = get_target_pstate_use_performance,
|
||||
},
|
||||
};
|
||||
@@ -769,7 +767,7 @@ static struct cpu_defaults silvermont_params = {
|
||||
.get_max_physical = atom_get_max_pstate,
|
||||
.get_min = atom_get_min_pstate,
|
||||
.get_turbo = atom_get_turbo_pstate,
|
||||
- .set = atom_set_pstate,
|
||||
+ .get_val = atom_get_val,
|
||||
.get_scaling = silvermont_get_scaling,
|
||||
.get_vid = atom_get_vid,
|
||||
.get_target_pstate = get_target_pstate_use_cpu_load,
|
||||
@@ -790,7 +788,7 @@ static struct cpu_defaults airmont_params = {
|
||||
.get_max_physical = atom_get_max_pstate,
|
||||
.get_min = atom_get_min_pstate,
|
||||
.get_turbo = atom_get_turbo_pstate,
|
||||
- .set = atom_set_pstate,
|
||||
+ .get_val = atom_get_val,
|
||||
.get_scaling = airmont_get_scaling,
|
||||
.get_vid = atom_get_vid,
|
||||
.get_target_pstate = get_target_pstate_use_cpu_load,
|
||||
@@ -812,7 +810,7 @@ static struct cpu_defaults knl_params = {
|
||||
.get_min = core_get_min_pstate,
|
||||
.get_turbo = knl_get_turbo_pstate,
|
||||
.get_scaling = core_get_scaling,
|
||||
- .set = core_set_pstate,
|
||||
+ .get_val = core_get_val,
|
||||
.get_target_pstate = get_target_pstate_use_performance,
|
||||
},
|
||||
};
|
||||
@@ -839,25 +837,24 @@ static void intel_pstate_get_min_max(struct cpudata *cpu, int *min, int *max)
|
||||
*min = clamp_t(int, min_perf, cpu->pstate.min_pstate, max_perf);
|
||||
}
|
||||
|
||||
-static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate, bool force)
|
||||
+static inline void intel_pstate_record_pstate(struct cpudata *cpu, int pstate)
|
||||
{
|
||||
- int max_perf, min_perf;
|
||||
-
|
||||
- if (force) {
|
||||
- update_turbo_state();
|
||||
-
|
||||
- intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
|
||||
-
|
||||
- pstate = clamp_t(int, pstate, min_perf, max_perf);
|
||||
-
|
||||
- if (pstate == cpu->pstate.current_pstate)
|
||||
- return;
|
||||
- }
|
||||
trace_cpu_frequency(pstate * cpu->pstate.scaling, cpu->cpu);
|
||||
-
|
||||
cpu->pstate.current_pstate = pstate;
|
||||
+}
|
||||
|
||||
- pstate_funcs.set(cpu, pstate);
|
||||
+static void intel_pstate_set_min_pstate(struct cpudata *cpu)
|
||||
+{
|
||||
+ int pstate = cpu->pstate.min_pstate;
|
||||
+
|
||||
+ intel_pstate_record_pstate(cpu, pstate);
|
||||
+ /*
|
||||
+ * Generally, there is no guarantee that this code will always run on
|
||||
+ * the CPU being updated, so force the register update to run on the
|
||||
+ * right CPU.
|
||||
+ */
|
||||
+ wrmsrl_on_cpu(cpu->cpu, MSR_IA32_PERF_CTL,
|
||||
+ pstate_funcs.get_val(cpu, pstate));
|
||||
}
|
||||
|
||||
static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
|
||||
@@ -870,7 +867,8 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu)
|
||||
|
||||
if (pstate_funcs.get_vid)
|
||||
pstate_funcs.get_vid(cpu);
|
||||
- intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false);
|
||||
+
|
||||
+ intel_pstate_set_min_pstate(cpu);
|
||||
}
|
||||
|
||||
static inline void intel_pstate_calc_busy(struct cpudata *cpu)
|
||||
@@ -997,6 +995,21 @@ static inline int32_t get_target_pstate_use_performance(struct cpudata *cpu)
|
||||
return cpu->pstate.current_pstate - pid_calc(&cpu->pid, core_busy);
|
||||
}
|
||||
|
||||
+static inline void intel_pstate_update_pstate(struct cpudata *cpu, int pstate)
|
||||
+{
|
||||
+ int max_perf, min_perf;
|
||||
+
|
||||
+ update_turbo_state();
|
||||
+
|
||||
+ intel_pstate_get_min_max(cpu, &min_perf, &max_perf);
|
||||
+ pstate = clamp_t(int, pstate, min_perf, max_perf);
|
||||
+ if (pstate == cpu->pstate.current_pstate)
|
||||
+ return;
|
||||
+
|
||||
+ intel_pstate_record_pstate(cpu, pstate);
|
||||
+ wrmsrl(MSR_IA32_PERF_CTL, pstate_funcs.get_val(cpu, pstate));
|
||||
+}
|
||||
+
|
||||
static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
|
||||
{
|
||||
int from, target_pstate;
|
||||
@@ -1006,7 +1019,7 @@ static inline void intel_pstate_adjust_busy_pstate(struct cpudata *cpu)
|
||||
|
||||
target_pstate = pstate_funcs.get_target_pstate(cpu);
|
||||
|
||||
- intel_pstate_set_pstate(cpu, target_pstate, true);
|
||||
+ intel_pstate_update_pstate(cpu, target_pstate);
|
||||
|
||||
sample = &cpu->sample;
|
||||
trace_pstate_sample(fp_toint(sample->core_pct_busy),
|
||||
@@ -1180,7 +1193,7 @@ static void intel_pstate_stop_cpu(struct cpufreq_policy *policy)
|
||||
if (hwp_active)
|
||||
return;
|
||||
|
||||
- intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate, false);
|
||||
+ intel_pstate_set_min_pstate(cpu);
|
||||
}
|
||||
|
||||
static int intel_pstate_cpu_init(struct cpufreq_policy *policy)
|
||||
@@ -1255,7 +1268,7 @@ static void copy_cpu_funcs(struct pstate_funcs *funcs)
|
||||
pstate_funcs.get_min = funcs->get_min;
|
||||
pstate_funcs.get_turbo = funcs->get_turbo;
|
||||
pstate_funcs.get_scaling = funcs->get_scaling;
|
||||
- pstate_funcs.set = funcs->set;
|
||||
+ pstate_funcs.get_val = funcs->get_val;
|
||||
pstate_funcs.get_vid = funcs->get_vid;
|
||||
pstate_funcs.get_target_pstate = funcs->get_target_pstate;
|
||||
|
||||
--
|
||||
2.5.0
|
||||
|
||||
11
kernel.spec
11
kernel.spec
@ -69,7 +69,7 @@ Summary: The Linux kernel
|
||||
# The rc snapshot level
|
||||
%define rcrev 0
|
||||
# The git snapshot level
|
||||
%define gitrev 25
|
||||
%define gitrev 26
|
||||
# Set rpm version accordingly
|
||||
%define rpmversion 4.%{upstream_sublevel}.0
|
||||
%endif
|
||||
@ -612,8 +612,6 @@ Patch663: USB-serial-ftdi_sio-Add-support-for-ICP-DAS-I-756xU-.patch
|
||||
#CVE-2016-3134 rhbz 1317383 1317384
|
||||
Patch665: netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
|
||||
|
||||
Patch667: intel_pstate-Do-not-call-wrmsrl_on_cpu-with-disabled.patch
|
||||
|
||||
#CVE-2016-3137 rhbz 1317010 1316996
|
||||
Patch672: cypress_m8-add-sanity-checking.patch
|
||||
|
||||
@ -637,6 +635,8 @@ Patch686: input-gtco-fix-crash-on-detecting-device-without-end.patch
|
||||
#CVE-2016-3136 rhbz 1317007 1317010
|
||||
Patch687: mct_u232-sanity-checking-in-probe.patch
|
||||
|
||||
Patch688: sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
@ -2159,6 +2159,11 @@ fi
|
||||
#
|
||||
#
|
||||
%changelog
|
||||
* Fri Mar 25 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git26.1
|
||||
- Linux v4.5-12596-g11caf57f6a4b
|
||||
- asm-generic, pm+acpi, rtc, hwmon, block, mtd, ubifs, nfsd, kbuild, parisc,
|
||||
h8, arm64, armsoc
|
||||
|
||||
* Thu Mar 24 2016 Josh Boyer <jwboyer@fedoraproject.org> - 4.6.0-0.rc0.git25.1
|
||||
- Linux v4.5-12330-ge46b4e2b46e1
|
||||
- trace, thermal, nfsd merges
|
||||
|
||||
80
sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
Normal file
80
sound-usb-fix-NULL-dereference-in-usb_audio_probe.patch
Normal file
@ -0,0 +1,80 @@
|
||||
From cef7f62d5881e886cd514436bc386a7202af25f1 Mon Sep 17 00:00:00 2001
|
||||
From: Nicolai Stange <nicstange@gmail.com>
|
||||
Date: Tue, 15 Mar 2016 13:35:06 +0100
|
||||
Subject: [PATCH] sound/usb: fix NULL dereference in usb_audio_probe()
|
||||
|
||||
With commit
|
||||
|
||||
aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
|
||||
media resources")
|
||||
|
||||
an access to quirk->media_device without checking for quirk != NULL has
|
||||
been introduced in usb_audio_probe().
|
||||
|
||||
With a Plantronics USB headset (device ID 0x047f:0xc010) attached,
|
||||
this results in the following splat at boot time:
|
||||
|
||||
BUG: unable to handle kernel NULL pointer dereference at 0000000000000014
|
||||
IP: [<ffffffffa089aa6c>] usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
|
||||
Oops: 0000 [#1] SMP
|
||||
[...]
|
||||
CPU: 2 PID: 696 Comm: systemd-udevd Not tainted 4.5.0-next-20160315 #13
|
||||
Hardware name: Dell Inc. Latitude E6540/0725FP, BIOS A10 06/26/2014
|
||||
task: ffff88021c88d7c0 ti: ffff88003d5b0000 task.ti: ffff88003d5b0000
|
||||
RIP: 0010:[<ffffffffa089aa6c>] [<ffffffffa089aa6c>]
|
||||
usb_audio_probe+0x2cc/0x9a0 [snd_usb_audio]
|
||||
[...]
|
||||
Call Trace:
|
||||
[<ffffffff815a8e16>] usb_probe_interface+0x136/0x2d0
|
||||
[<ffffffff81509edc>] driver_probe_device+0x22c/0x440
|
||||
[<ffffffff8150a1c1>] __driver_attach+0xd1/0xf0
|
||||
[<ffffffff8150a0f0>] ? driver_probe_device+0x440/0x440
|
||||
[<ffffffff815077ec>] bus_for_each_dev+0x6c/0xc0
|
||||
[<ffffffff815095ce>] driver_attach+0x1e/0x20
|
||||
[<ffffffff81509013>] bus_add_driver+0x1c3/0x280
|
||||
[<ffffffff8150ab10>] driver_register+0x60/0xe0
|
||||
[<ffffffff815a7711>] usb_register_driver+0x81/0x140
|
||||
[<ffffffffa08c7000>] ? 0xffffffffa08c7000
|
||||
[<ffffffffa08c701e>] usb_audio_driver_init+0x1e/0x1000 [snd_usb_audio]
|
||||
[<ffffffff81002123>] do_one_initcall+0xb3/0x1f0
|
||||
[<ffffffff811fb091>] ? __vunmap+0x81/0xd0
|
||||
[<ffffffff8121b8d2>] ? kmem_cache_alloc_trace+0x182/0x1d0
|
||||
[<ffffffff811b0267>] ? do_init_module+0x27/0x1d8
|
||||
[<ffffffff811b029f>] do_init_module+0x5f/0x1d8
|
||||
[<ffffffff8112ce35>] load_module+0x1fe5/0x27a0
|
||||
[<ffffffff81129870>] ? __symbol_put+0x60/0x60
|
||||
[<ffffffff81241690>] ? vfs_read+0x110/0x130
|
||||
[<ffffffff8112d866>] SYSC_finit_module+0xe6/0x120
|
||||
[<ffffffff8112d8be>] SyS_finit_module+0xe/0x10
|
||||
[<ffffffff81003d94>] do_syscall_64+0x64/0x110
|
||||
[<ffffffff817c0b61>] entry_SYSCALL64_slow_path+0x25/0x25
|
||||
|
||||
After encountering this, the system-udevd process seems to be blocked
|
||||
until it is killed when hitting its timeout of 3min.
|
||||
|
||||
In analogy to the other accesses to members of quirk in usb_audio_probe(),
|
||||
check for quirk != NULL before accessing its ->media_device.
|
||||
|
||||
Fixes: aebb2b89bff0 ("[media] sound/usb: Use Media Controller API to share
|
||||
media resources")
|
||||
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
|
||||
---
|
||||
sound/usb/card.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/sound/usb/card.c b/sound/usb/card.c
|
||||
index 63244bbba8c7..479621e775bc 100644
|
||||
--- a/sound/usb/card.c
|
||||
+++ b/sound/usb/card.c
|
||||
@@ -612,7 +612,7 @@ static int usb_audio_probe(struct usb_interface *intf,
|
||||
if (err < 0)
|
||||
goto __error;
|
||||
|
||||
- if (quirk->media_device) {
|
||||
+ if (quirk && quirk->media_device) {
|
||||
/* don't want to fail when media_snd_device_create() fails */
|
||||
media_snd_device_create(chip, intf);
|
||||
}
|
||||
--
|
||||
2.5.5
|
||||
|
||||
Loading…
Reference in New Issue
Block a user