Muehlenhoff has submitted this change and it was merged. ( https://gerrit.wikimedia.org/r/340094 )
Change subject: Update to 4.4.51 ...................................................................... Update to 4.4.51 Change-Id: Ib76933ecc4c6866f09ea61eaa8b4859fe90a0edb --- M debian/changelog A debian/patches/bugfix/all/stable-4.4.51.patch M debian/patches/series 3 files changed, 371 insertions(+), 0 deletions(-) Approvals: Muehlenhoff: Looks good to me, approved jenkins-bot: Verified diff --git a/debian/changelog b/debian/changelog index 3474cff..a72758a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -36,6 +36,8 @@ - CVE-2017-5986 [2dcab598484185dea7ec22219c76dcdd59e3cb90] - CVE-2017-5897 [7892032cfe67f4bde6fc2ee967e45a8fbaf33756] - CVE-2017-6214 [ccf7abb93af09ad0868ae9033d1ca8108bdaec82] + * Update to 4.4.51: + https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.51 -- Moritz Muehlenhoff <mmuhlenh...@wikimedia.org> Mon, 16 Jan 2017 11:17:27 +0100 diff --git a/debian/patches/bugfix/all/stable-4.4.51.patch b/debian/patches/bugfix/all/stable-4.4.51.patch new file mode 100644 index 0000000..77732c8 --- /dev/null +++ b/debian/patches/bugfix/all/stable-4.4.51.patch @@ -0,0 +1,368 @@ +diff --git a/Makefile b/Makefile +index 10993715abb8..117357188f01 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 50 ++SUBLEVEL = 51 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index 8ecfd15c3a02..df73914e81c8 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -67,7 +67,7 @@ ENTRY(__get_user_4) + ENDPROC(__get_user_4) + + ENTRY(__get_user_8) +- check_uaccess r0, 8, r1, r2, __get_user_bad ++ check_uaccess r0, 8, r1, r2, __get_user_bad8 + #ifdef CONFIG_THUMB2_KERNEL + 5: TUSER(ldr) r2, [r0] + 6: TUSER(ldr) r3, [r0, #4] +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 7cb2815e815e..a3b96d691ac9 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1812,7 +1812,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) + mgr->payloads[i].num_slots = req_payload.num_slots; + } else if (mgr->payloads[i].num_slots) { + mgr->payloads[i].num_slots = 0; +- drm_dp_destroy_payload_step1(mgr, port, port->vcpi.vcpi, &mgr->payloads[i]); ++ drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]); + req_payload.payload_state = mgr->payloads[i].payload_state; + mgr->payloads[i].start_slot = 0; + } +diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c +index 04cec0da5d1e..8901228b5d5d 100644 +--- a/drivers/gpu/drm/radeon/radeon_cursor.c ++++ b/drivers/gpu/drm/radeon/radeon_cursor.c +@@ -205,8 +205,8 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) + } + + if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) || +- x >= (crtc->x + crtc->mode.crtc_hdisplay) || +- y >= (crtc->y + crtc->mode.crtc_vdisplay)) ++ x >= (crtc->x + crtc->mode.hdisplay) || ++ y >= (crtc->y + crtc->mode.vdisplay)) + goto out_of_bounds; + + x += xorigin; +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index d15b33813021..ed1935f300a7 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1232,6 +1232,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0000", 0 }, + { "ELAN0100", 0 }, + { "ELAN0600", 0 }, ++ { "ELAN0605", 0 }, + { "ELAN1000", 0 }, + { } + }; +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index 6b420a55c745..c3ea03c9a1a8 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -425,7 +425,7 @@ struct cache { + * until a gc finishes - otherwise we could pointlessly burn a ton of + * cpu + */ +- unsigned invalidate_needs_gc:1; ++ unsigned invalidate_needs_gc; + + bool discard; /* Get rid of? */ + +@@ -593,8 +593,8 @@ struct cache_set { + + /* Counts how many sectors bio_insert has added to the cache */ + atomic_t sectors_to_gc; ++ wait_queue_head_t gc_wait; + +- wait_queue_head_t moving_gc_wait; + struct keybuf moving_gc_keys; + /* Number of moving GC bios in flight */ + struct semaphore moving_in_flight; +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 22b9e34ceb75..5b815e64c1c9 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1762,33 +1762,34 @@ static void bch_btree_gc(struct cache_set *c) + bch_moving_gc(c); + } + +-static int bch_gc_thread(void *arg) ++static bool gc_should_run(struct cache_set *c) + { +- struct cache_set *c = arg; + struct cache *ca; + unsigned i; + +- while (1) { +-again: +- bch_btree_gc(c); ++ for_each_cache(ca, c, i) ++ if (ca->invalidate_needs_gc) ++ return true; + +- set_current_state(TASK_INTERRUPTIBLE); +- if (kthread_should_stop()) +- break; ++ if (atomic_read(&c->sectors_to_gc) < 0) ++ return true; + +- mutex_lock(&c->bucket_lock); ++ return false; ++} + +- for_each_cache(ca, c, i) +- if (ca->invalidate_needs_gc) { +- mutex_unlock(&c->bucket_lock); +- set_current_state(TASK_RUNNING); +- goto again; +- } ++static int bch_gc_thread(void *arg) ++{ ++ struct cache_set *c = arg; + +- mutex_unlock(&c->bucket_lock); ++ while (1) { ++ wait_event_interruptible(c->gc_wait, ++ kthread_should_stop() || gc_should_run(c)); + +- try_to_freeze(); +- schedule(); ++ if (kthread_should_stop()) ++ break; ++ ++ set_gc_sectors(c); ++ bch_btree_gc(c); + } + + return 0; +@@ -1796,11 +1797,10 @@ again: + + int bch_gc_thread_start(struct cache_set *c) + { +- c->gc_thread = kthread_create(bch_gc_thread, c, "bcache_gc"); ++ c->gc_thread = kthread_run(bch_gc_thread, c, "bcache_gc"); + if (IS_ERR(c->gc_thread)) + return PTR_ERR(c->gc_thread); + +- set_task_state(c->gc_thread, TASK_INTERRUPTIBLE); + return 0; + } + +diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h +index 5c391fa01bed..9b80417cd547 100644 +--- a/drivers/md/bcache/btree.h ++++ b/drivers/md/bcache/btree.h +@@ -260,8 +260,7 @@ void bch_initial_mark_key(struct cache_set *, int, struct bkey *); + + static inline void wake_up_gc(struct cache_set *c) + { +- if (c->gc_thread) +- wake_up_process(c->gc_thread); ++ wake_up(&c->gc_wait); + } + + #define MAP_DONE 0 +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index 25fa8445bb24..2410df1c2a05 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -196,10 +196,8 @@ static void bch_data_insert_start(struct closure *cl) + struct data_insert_op *op = container_of(cl, struct data_insert_op, cl); + struct bio *bio = op->bio, *n; + +- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) { +- set_gc_sectors(op->c); ++ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) + wake_up_gc(op->c); +- } + + if (op->bypass) + return bch_data_invalidate(cl); +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 3d5c0ba13181..7b5880b8874c 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1489,6 +1489,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) + mutex_init(&c->bucket_lock); + init_waitqueue_head(&c->btree_cache_wait); + init_waitqueue_head(&c->bucket_wait); ++ init_waitqueue_head(&c->gc_wait); + sema_init(&c->uuid_write_mutex, 1); + + spin_lock_init(&c->btree_gc_time.lock); +@@ -1547,6 +1548,7 @@ static void run_cache_set(struct cache_set *c) + + for_each_cache(ca, c, i) + c->nbuckets += ca->sb.nbuckets; ++ set_gc_sectors(c); + + if (CACHE_SYNC(&c->sb)) { + LIST_HEAD(journal); +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index c945e4c2fbd4..ec30a004f319 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -200,22 +200,30 @@ static int smsusb_start_streaming(struct smsusb_device_t *dev) + static int smsusb_sendrequest(void *context, void *buffer, size_t size) + { + struct smsusb_device_t *dev = (struct smsusb_device_t *) context; +- struct sms_msg_hdr *phdr = (struct sms_msg_hdr *) buffer; +- int dummy; ++ struct sms_msg_hdr *phdr; ++ int dummy, ret; + + if (dev->state != SMSUSB_ACTIVE) { + pr_debug("Device not active yet\n"); + return -ENOENT; + } + ++ phdr = kmalloc(size, GFP_KERNEL); ++ if (!phdr) ++ return -ENOMEM; ++ memcpy(phdr, buffer, size); ++ + pr_debug("sending %s(%d) size: %d\n", + smscore_translate_msg(phdr->msg_type), phdr->msg_type, + phdr->msg_length); + + smsendian_handle_tx_message((struct sms_msg_data *) phdr); +- smsendian_handle_message_header((struct sms_msg_hdr *)buffer); +- return usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), +- buffer, size, &dummy, 1000); ++ smsendian_handle_message_header((struct sms_msg_hdr *)phdr); ++ ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), ++ phdr, size, &dummy, 1000); ++ ++ kfree(phdr); ++ return ret; + } + + static char *smsusb1_fw_lkup[] = { +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index 78187699467a..79a0c26e1419 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -1581,10 +1581,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, + err = mmc_select_hs400(card); + if (err) + goto free_card; +- } else if (mmc_card_hs(card)) { ++ } else { + /* Select the desired bus width optionally */ + err = mmc_select_bus_width(card); +- if (!IS_ERR_VALUE(err)) { ++ if (!IS_ERR_VALUE(err) && mmc_card_hs(card)) { + err = mmc_select_hs_ddr(card); + if (err) + goto free_card; +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c +index 60654d524858..ecc6fb9ca92f 100644 +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -1623,7 +1623,7 @@ ntb_transport_create_queue(void *data, struct device *client_dev, + + node = dev_to_node(&ndev->dev); + +- free_queue = ffs(nt->qp_bitmap); ++ free_queue = ffs(nt->qp_bitmap_free); + if (!free_queue) + goto err; + +@@ -2082,9 +2082,8 @@ module_init(ntb_transport_init); + + static void __exit ntb_transport_exit(void) + { +- debugfs_remove_recursive(nt_debugfs_dir); +- + ntb_unregister_client(&ntb_transport_client); + bus_unregister(&ntb_transport_bus); ++ debugfs_remove_recursive(nt_debugfs_dir); + } + module_exit(ntb_transport_exit); +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index cf5b99e1f12b..8558e3886960 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1120,7 +1120,8 @@ int scsi_init_io(struct scsi_cmnd *cmd) + bool is_mq = (rq->mq_ctx != NULL); + int error; + +- BUG_ON(!rq->nr_phys_segments); ++ if (WARN_ON_ONCE(!rq->nr_phys_segments)) ++ return -EINVAL; + + error = scsi_init_sgtable(rq, &cmd->sdb); + if (error) +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index a1c29b0afb22..dedcff9cabb5 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1763,6 +1763,10 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) + return res; + + iov_iter_truncate(&i, hp->dxfer_len); ++ if (!iov_iter_count(&i)) { ++ kfree(iov); ++ return -EINVAL; ++ } + + res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC); + kfree(iov); +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 9096d44eb221..d0cf1f010fbe 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -418,6 +418,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) + { + spin_lock(&fiq->waitq.lock); ++ if (test_bit(FR_FINISHED, &req->flags)) { ++ spin_unlock(&fiq->waitq.lock); ++ return; ++ } + if (list_empty(&req->intr_entry)) { + list_add_tail(&req->intr_entry, &fiq->interrupts); + wake_up_locked(&fiq->waitq); +diff --git a/fs/splice.c b/fs/splice.c +index 0f77e9682857..8398974e1538 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -211,6 +211,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, + buf->len = spd->partial[page_nr].len; + buf->private = spd->partial[page_nr].private; + buf->ops = spd->ops; ++ buf->flags = 0; + if (spd->flags & SPLICE_F_GIFT) + buf->flags |= PIPE_BUF_FLAG_GIFT; + +diff --git a/kernel/futex.c b/kernel/futex.c +index 9d8163afd87c..9d251dc3ec40 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -3199,4 +3199,4 @@ static int __init futex_init(void) + + return 0; + } +-__initcall(futex_init); ++core_initcall(futex_init); +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index c048e34b177f..0b5613554769 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -1436,7 +1436,7 @@ static void call_console_drivers(int level, + { + struct console *con; + +- trace_console(text, len); ++ trace_console_rcuidle(text, len); + + if (level >= console_loglevel && !ignore_loglevel) + return; diff --git a/debian/patches/series b/debian/patches/series index 0f5525c..4541fd4 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -151,3 +151,4 @@ bugfix/all/stable-4.4.48.patch bugfix/all/stable-4.4.49.patch bugfix/all/stable-4.4.50.patch +bugfix/all/stable-4.4.51.patch -- To view, visit https://gerrit.wikimedia.org/r/340094 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: merged Gerrit-Change-Id: Ib76933ecc4c6866f09ea61eaa8b4859fe90a0edb Gerrit-PatchSet: 1 Gerrit-Project: operations/debs/linux44 Gerrit-Branch: master Gerrit-Owner: Muehlenhoff <mmuhlenh...@wikimedia.org> Gerrit-Reviewer: Muehlenhoff <mmuhlenh...@wikimedia.org> Gerrit-Reviewer: jenkins-bot <> _______________________________________________ MediaWiki-commits mailing list MediaWiki-commits@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits