Commit 2c08d751 authored by Ben Hutchings's avatar Ben Hutchings Committed by Lorenzo "Palinuro" Faletra
Browse files

Import Debian changes 4.9.25-1

linux (4.9.25-1) unstable; urgency=medium

  * New upstream stable update:
    - net/openvswitch: Set the ipv6 source tunnel key address attribute
    - net: properly release
    - [arm64] amd-xgbe: Fix jumbo MTU processing on newer hardware
    - openvswitch: Add missing case OVS_TUNNEL_KEY_ATTR_PAD
    - net: unix: properly re-increment inflight counter of GC discarded
    - net: vrf: Reset rt6i_idev in local dst after put
    - net/mlx5: Add missing entries for set/query rate limit commands
    - net/mlx5e: Use the proper UAPI values when offloading TC vlan actions
    - net/mlx5: Increase number of max QPs in default profile
    - net/mlx5e: Count GSO/LRO packets correctly
    - ipv6: make sure to initialize sockc.tsflags before first use
    - ipv4: provide stronger user input validation in nl_fib_input()
    - socket, bpf: fix sk_filter use after free in sk_clone_lock
    - tcp: initialize icsk_ack.lrcvtime at session start time
    - Input: iforce,ims-pcu,hanwang,yealink,cm109,kbtab,sur40 - validate
      number of endpoints before using them
    - ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
    - ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
    - ALSA: hda - Adding a group of pin definition to fix headset problem
    - ACM gadget: fix endianness in notifications
    - usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's
    - USB: uss720,idmouse,wusbcore: fix NULL-deref at probe
    - usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
    - usb: hub: Fix crash after failure to read BOS descriptor
    - USB: usbtmc: add missing endpoint sanity check
    - USB: usbtmc: fix probe error path
    - uwb: i1480-dfu: fix NULL-deref at probe
    - mmc: ushc: fix NULL-deref at probe
    - [armhf[ iio: adc: ti_am335x_adc: fix fifo overrun recovery
    - iio: sw-device: Fix config group initialization
    - iio: hid-sensor-trigger: Change get poll value function order to avoid
      sensor properties losing after resume from S3
    - parport: fix attempt to write duplicate procfiles
    - ext4: mark inode dirty after converting inline directory
    - ext4: lock the xattr block before checksuming it
    - [powerpc*/*64*] Fix idle wakeup potential to clobber registers
    - mmc: sdhci: Do not disable interrupts while waiting for clock
    - mmc: sdhci-pci: Do not disable interrupts in sdhci_intel_set_power
    - [x86] hwrng: amd - Revert managed API changes
    - [x86] hwrng: geode - Revert managed API changes
    - [armhf] clk: sunxi-ng: sun6i: Fix enable bit offset for hdmi-ddc module
    - [armhf] clk: sunxi-ng: mp: Adjust parent rate for pre-dividers
    - mwifiex: pcie: don't leak DMA buffers when removing
    - [x86] crypto: ccp - Assign DMA commands to the channel's CCP
    - xen/acpi: upload PM state from init-domain to Xen
    - [x86] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
    - [arm64] kaslr: Fix up the kernel image alignment
    - cpufreq: Restore policy min/max limits on CPU online
    - cgroup, net_cls: iterate the fds of only the tasks which are being
    - blk-mq: don't complete un-started request in timeout handler
    - [x86] drm/amdgpu: reinstate oland workaround for sclk
    - jbd2: don't leak memory if setting up journal fails
    - [x86] intel_th: Don't leak module refcount on failure to activate
    - [x86] Drivers: hv: vmbus: Don't leak channel ids
    - [x86] Drivers: hv: vmbus: Don't leak memory when a channel is rescinded
    - libceph: don't set weight to IN when OSD is destroyed
    - [x86] device-dax: fix pmd/pte fault fallback handling
    - [armhf] drm/bridge: analogix dp: Fix runtime PM state on driver bind
    - nl80211: fix dumpit error path RTNL deadlocks
    - drm: reference count event->completion
    - fbcon: Fix vc attr at deinit
    - xfrm: policy: init locks early
    - [x86] KVM: cleanup the page tracking SRCU instance
    - virtio_balloon: init 1st buffer in stats vq
    - [mips*] ptrace: Preserve previous registers for short regset write
    - [sparc64] ptrace: Preserve previous registers for short regset write
    - fscrypt: remove broken support for detecting keyring key revocation
    - sched/rt: Add a missing rescheduling point
    - [armhf] usb: musb: fix possible spinlock deadlock
    - libceph: force GFP_NOIO for socket allocations
    - xen/setup: Don't relocate p2m over existing one
    - xfs: only update mount/resv fields on success in __xfs_ag_resv_init
    - xfs: use per-AG reservations for the finobt
    - xfs: pull up iolock from xfs_free_eofblocks()
    - xfs: sync eofblocks scans under iolock are livelock prone
    - xfs: fix eofblocks race with file extending async dio writes
    - xfs: fix toctou race when locking an inode to access the data map
    - xfs: fail _dir_open when readahead fails
    - xfs: filter out obviously bad btree pointers
    - xfs: check for obviously bad level values in the bmbt root
    - xfs: verify free block header fields
    - xfs: allow unwritten extents in the CoW fork
    - xfs: mark speculative prealloc CoW fork extents unwritten
    - xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t
    - xfs: update ctime and mtime on clone destinatation inodes
    - xfs: reject all unaligned direct writes to reflinked files
    - xfs: don't fail xfs_extent_busy allocation
    - xfs: handle indlen shortage on delalloc extent merge
    - xfs: split indlen reservations fairly when under reserved
    - xfs: fix uninitialized variable in _reflink_convert_cow
    - xfs: don't reserve blocks for right shift transactions
    - xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment
    - xfs: tune down agno asserts in the bmap code
    - xfs: only reclaim unwritten COW extents periodically
    - xfs: fix and streamline error handling in xfs_end_io
    - xfs: Use xfs_icluster_size_fsb() to calculate inode alignment mask
    - xfs: use iomap new flag for newly allocated delalloc blocks
    - xfs: try any AG when allocating the first btree block when reflinking
    - scsi: libsas: fix ata xfer length
    - scsi: scsi_dh_alua: Check scsi_device_get() return value
    - scsi: scsi_dh_alua: Ensure that alua_activate() calls the completion
    - ALSA: seq: Fix race during FIFO resize
    - ALSA: hda - fix a problem for lineout on a Dell AIO machine
    - [x86] ASoC: Intel: Skylake: fix invalid memory access due to wrong
      reference of pointer
    - HID: wacom: Don't add ghost interface as shared data
    - mmc: sdhci: Disable runtime pm when the sdio_irq is enabled
    - NFSv4.1 fix infinite loop on IO BAD_STATEID error
    - nfsd: map the ENOKEY to nfserr_perm for avoiding warning
    - [hppa] Clean up fixup routines for get_user()/put_user()
    - [hppa] Avoid stalled CPU warnings after system shutdown
    - [hppa] Fix access fault handling in pa_memcpy()
    - ACPI: Fix incompatibility with mcount-based function graph tracing
    - ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
    - USB: fix linked-list corruption in rh_call_control()
    - [x86] KVM: clear bus pointer when destroyed
    - KVM: kvm_io_bus_unregister_dev() should never fail
    - drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
    - [armhf,arm64] drm/vc4: Allocate the right amount of space for boot-time
      CRTC state.
    - [armhf] drm/etnaviv: (re-)protect fence allocation with GPU mutex
    - [x86] mm/KASLR: Exclude EFI region from KASLR VA space randomization
    - [x86] mce: Fix copy/paste error in exception table entries
    - lib/syscall: Clear return values when no stack
    - mm: rmap: fix huge file mmap accounting in the memcg stats
    - mm, hugetlb: use pte_present() instead of pmd_present() in
    - qla2xxx: Allow vref count to timeout on vport delete.
    - mm: workingset: fix premature shadow node shrinking with cgroups
    - blk: improve order of bio handling in generic_make_request()
    - blk: Ensure users for current->bio_list can see the full list.
    - padata: avoid race in reordering
    - nvme/core: Fix race kicking freed request_queue
    - nvme/pci: Disable on removal when disconnected
    - ppdev: check before attaching port
    - ppdev: fix registering same device name
    - [x86] drm/vmwgfx: Type-check lookups of fence objects
    - [x86] drm/vmwgfx: avoid calling vzalloc with a 0 size in
    - drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
    - [x86] drm/vmwgfx: Remove getparam error message
    - sysfs: be careful of error returns from ops->show()
    - [armhf,arm64] KVM: Take mmap_sem in stage2_unmap_vm
    - [armhf,arm64] KVM: Take mmap_sem in kvm_arch_prepare_memory_region
    - [armhf,arm64] kvm: Fix locking for kvm_free_stage2_pgd
    - [x86] iio: bmg160: reset chip when probing
    - [arm64] mm: unaligned access by user-land should be received as SIGBUS
    - cfg80211: check rdev resume callback only for registered wiphy
    - CIFS: Reset TreeId to zero on SMB2 TREE_CONNECT
    - mm/page_alloc.c: fix print order in show_free_areas()
    - ptrace: fix PTRACE_LISTEN race corrupting task->state
    - dm verity fec: limit error correction recursion
    - dm verity fec: fix bufio leaks
    - ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
    - xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files
    - ring-buffer: Fix return value check in test_ringbuffer()
    - mac80211: unconditionally start new netdev queues with iTXQ support
    - brcmfmac: use local iftype avoiding use-after-free of virtual interface
    - [powerpc*] Disable HFSCR[TM] if TM is not supported
    - [powerpc*] mm: Add missing global TLB invalidate if cxl is active
    - [powerpc*/*64*]: Fix flush_(d|i)cache_range() called from modules
    - [powerpc*] Don't try to fix up misaligned load-with-reservation
    - [powerpc*] crypto/crc32c-vpmsum: Fix missing preempt_disable()
    - dm raid: fix NULL pointer dereference for raid1 without bitmap
    - [s390x] decompressor: fix initrd corruption caused by bss clear
    - [s390x] uaccess: get_user() should zero on failure (again)
    - [mips*el/loongson-3] Check TLB before handle_ri_rdhwr() for Loongson-3
    - [mips*el/loongson-3] Add MIPS_CPU_FTLB for Loongson-3A R2
    - [mips*el/loongson-3] Flush wrong invalid FTLB entry for huge page
    - [mips*el/loongson-3] c-r4k: Fix Loongson-3's vcache/scache waysize
    - mm/mempolicy.c: fix error handling in set_mempolicy and mbind
    - random: use chacha20 for get_random_int/long
    - [armhf] drm/sun4i: tcon: Move SoC specific quirks to a DT matched data
    - [armhf] drm/sun4i: Add compatible strings for A31/A31s display pipelines
    - [armhf] drm/sun4i: Add compatible string for A31/A31s TCON (timing
    - HID: i2c-hid: add a simple quirk to fix device defects
    - usb: dwc3: gadget: delay unmap of bounced requests
    - [x86] ASoC: Intel: bytct_rt5640: change default capture settings
    - [armhf,arm64] clocksource/drivers/arm_arch_timer: Don't assume clock runs
      in suspend
    - scsi: ufs: introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk
    - HID: multitouch: do not retrieve all reports for all devices
    - [arm64] mmc: sdhci-msm: Enable few quirks
    - scsi: ufs: ensure that host pa_tactivate is higher than device
    - svcauth_gss: Close connection when dropping an incoming message
    - scsi: ufs: add quirk to increase host PA_SaveConfigTime
    - [x86] platform: acer-wmi: Only supports AMW0_GUID1 on acer family
    - nvme: simplify stripe quirk
    - ACPI / sysfs: Provide quirk mechanism to prevent GPE flooding
    - HID: usbhid: Add quirk for the Futaba TOSD-5711BB VFD
    - [x86] drm/i915: actually drive the BDW reserved IDs
    - scsi: ufs: issue link starup 2 times if device isn't active
    - [armhf] serial: 8250_omap: Add OMAP_DMA_TX_KICK quirk for AM437x
    - ACPI / button: Change default behavior to lid_init_state=open
    - [x86] ACPI: save NVS memory for Lenovo G50-45
    - HID: wacom: don't apply generic settings to old devices
    - [arm64] firmware: qcom: scm: Fix interrupted SCM calls
    - [armhf] watchdog: s3c2410: Fix infinite interrupt in soft mode
    - [x86] platform: asus-wmi: Set specified XUSB2PR value for X550LB
    - [x86] platform: asus-wmi: Detect quirk_no_rfkill from the DSDT
    - [x86] reboot/quirks: Add ASUS EeeBook X205TA reboot quirk
    - [x86] reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk
    - usb-storage: Add ignore-residue quirk for Initio INIC-3619
    - [x86] reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk
    - [x86] drm/i915/gen9: Increase PCODE request timeout to 50ms
    - [x86] drm/i915: Nuke debug messages from the pipe update critical section
    - [x86] drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
    - [x86] drm/i915: Only enable hotplug interrupts if the display interrupts
      are enabled
    - [x86] drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters.
    - [x86] drm/i915: Stop using RP_DOWN_EI on Baytrail
    - [x86] drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
    - [armhf,arm64] i2c: bcm2835: Fix hang for writing messages larger than 16
    - rt2x00usb: fix anchor initialization
    - rt2x00usb: do not anchor rx and tx urb's
    - [mips*] Introduce irq_stack
    - [mips*] Stack unwinding while on IRQ stack
    - [mips*] Only change $28 to thread_info if coming from user mode
    - [mips*] Switch to the irq_stack in interrupts
    - [mips*] Select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - [mips*] IRQ Stack: Fix erroneous jal to plat_irq_dispatch
    - [x86] Revert "drm/i915/execlists: Reset RING registers upon resume"
    - blk-mq: Avoid memory reclaim when remapping queues
    - usb: hub: Wait for connection to be reestablished after port reset
    - net/mlx4_en: Fix bad WQE issue
    - net/mlx4_core: Fix racy CQ (Completion Queue) free
    - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to
      VGT transitions
    - dma-buf: add support for compat ioctl
    - cgroup, kthread: close race window where new kthreads can be migrated to
      non-root cgroups
    - thp: fix MADV_DONTNEED vs. MADV_FREE race
    - thp: fix MADV_DONTNEED vs clear soft dirty race
    - zsmalloc: expand class bit
    - drm/nouveau/mpeg: mthd returns true on success now
    - drm/nouveau/mmu/nv4a: use nv04 mmu rather than the nv44 one
    - [armhf] drm/etnaviv: fix missing unlock on error in etnaviv_gpu_submit()
    - CIFS: reconnect thread reschedule itself
    - CIFS: store results of cifs_reopen_file to avoid infinite wait
    - Input: xpad - add support for Razer Wildcat gamepad
    - [x86] perf: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()
    - [x86] efi: Don't try to reserve runtime regions
    - [x86] signals: Fix lower/upper bound reporting in compat siginfo
    - [x86] pmem: fix broken __copy_user_nocache cache-bypass assumptions
    - [x86] vdso: Ensure vdso32_enabled gets set to valid values only
    - [x86] vdso: Plug race between mapping and ELF header setup
    - [x86] acpi, nfit, libnvdimm: fix interleave set cookie calculation
      (64-bit comparison)
    - ACPI / scan: Set the visited flag for all enumerated devices
    - [hppa] fix bugs in pa_memcpy
    - efi/libstub: Skip GOP with PIXEL_BLT_ONLY format
    - efi/fb: Avoid reconfiguration of BAR that covers the framebuffer
    - iscsi-target: Fix TMR reference leak during session shutdown
    - iscsi-target: Drop work-around for legacy GlobalSAN initiator
    - scsi: sr: Sanity check returned mode data
    - scsi: sd: Consider max_xfer_blocks if opt_xfer_blocks is unusable
    - scsi: qla2xxx: Add fix to read correct register value for ISP82xx.
    - scsi: sd: Fix capacity calculation with 32-bit sector_t
    - target: Avoid mappedlun symlink creation during lun shutdown
    - xen, fbfront: fix connecting to backend
    - new privimitive: iov_iter_revert()
    - make skb_copy_datagram_msg() preserve ->msg_iter on error
    - [x86] libnvdimm: fix blk free space accounting
    - [x86] libnvdimm: fix reconfig_mutex, mmap_sem, and jbd2_handle lockdep
    - [armhf] pwm: rockchip: State of PWM clock should synchronize with PWM
      enabled state
    - cpufreq: Bring CPUs up even if cpufreq_online() failed
    - [armhf] irqchip/irq-imx-gpcv2: Fix spinlock initialization
    - ftrace: Fix removing of second function probe
    - zram: do not use copy_page with non-page aligned address
    - ftrace: Fix function pid filter on instances
    - crypto: algif_aead - Fix bogus request dereference in completion function
    - crypto: ahash - Fix EINPROGRESS notification callback (CVE-2017-7618)
    - [hppa] Fix get_user() for 64-bit value on 32-bit kernel
    - dvb-usb-v2: avoid use-after-free (CVE-2017-8064)
    - drm/nouveau/disp/mcp7x: disable dptmds workaround (Closes: #850219)
    - [x86] mm: Tighten x86 /dev/mem with zeroing reads (CVE-2017-7889)
    - dvb-usb-firmware: don't do DMA on stack (CVE-2017-8061)
    - cxusb: Use a dma capable buffer also for reading (CVE-2017-8063)
    - virtio-console: avoid DMA from stack (CVE-2017-8067)
    - KEYS: Disallow keyrings beginning with '.' to be joined as session
      keyrings (CVE-2016-9604)
    - KEYS: Change the name of the dead type to ".dead" to prevent user access
    - KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
    - tracing: Allocate the snapshot buffer before enabling probe
    - ring-buffer: Have ring_buffer_iter_empty() return true when empty
    - mm: prevent NR_ISOLATE_* stats from going negative
    - cifs: Do not send echoes before Negotiate is complete (Closes: #856843)
    - CIFS: remove bad_network_name flag
    - [s390x] mm: fix CMMA vs KSM vs others
    - Input: elantech - add Fujitsu Lifebook E547 to force crc_enabled
    - ACPI / power: Avoid maybe-uninitialized warning
    - [armhf] mmc: sdhci-esdhc-imx: increase the pad I/O drive strength for
      DDR50 card
    - ubifs: Fix RENAME_WHITEOUT support
    - ubifs: Fix O_TMPFILE corner case in ubifs_link()
    - mac80211: reject ToDS broadcast data frames
    - mac80211: fix MU-MIMO follow-MAC mode
    - ubi/upd: Always flush after prepared for an update
    - [powerpc*] kprobe: Fix oops when kprobed on 'stdu' instruction
    - [x86] mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs
    - [x86] mce: Make the MCE notifier a blocking one
    - device-dax: switch to srcu, fix rcu_read_lock() vs pte allocation

  [ Ben Hutchings ]
  * w1: Really enable W1_MASTER_GPIO as module (Closes: #858975)
  * debian/rules.real: Undefine $LANGUAGE, which can break debug symbols for
    vDSOs (Closes: #859807)
  * Bump ABI to 3
  * [s390x] Set NR_CPUS=256 (Closes: #858731)
  * [x86] usbip: Increase USBIP_VHCI_NR_HCS to 8 and USBIP_VHCI_HC_PORTS to 31
    (Closes: #859641)
  * [powerpc/powerpc64,ppc64*] target: Enable SCSI_IBMVSCSIS as module
  * cpupower: Fix turbo frequency reporting for pre-Sandy Bridge cores
    (Closes: #859978)
  * udeb: Include all AHCI drivers in sata-modules (Closes: #860335)
  * [powerpc/powerpc64,ppc64] Set NR_CPUS=2048, matching ppc64el
  * [powerpc*/*64*] Enable CPUMASK_OFFSTACK to reduce stack usage
  * [mips*el/loongson-3] Set NR_CPUS=16 to allow for Loongson 3B2000
  * [mips*/octeon] Set NR_CPUS=64 to allow for Cavium CN7890
  * [arm64] Set NR_CPUS=256 to allow for multi-SoC systems (Closes: #861209)
  * [powerpc/powerpc-smp,powerpcspe] Explicitly set NR_CPUS=4
  * Move debug symbols back to the main archive, to avoid problems with the
    current handling in dak
  * linux-image: Disable signing until it's supported in dak
  * [rt] Update to 4.9.20-rt16:
    - rtmutex: Make lock_killable work
    - rtmutex: Provide rt_mutex_lock_state()
    - rtmutex: Provide locked slowpath
    - rwsem/rt: Lift single reader restriction
  * PCI: Enable PCIE_PTM (except on armel/marvell)
  * 6lowpan: Enable Generic Header Compression modules
  * net/sched: Enable NET_ACT_SKBMOD as module
  * ethernet: Enable NFP_NETVF as module
  * net/phy: Enable MICROSEMI_PHY as module
  * input/tablet: Enable TABLET_USB_PEGASUS as module
  * [x86] input/touchscreen: Enable TOUCHSCREEN_SURFACE3_SPI as module
  * serial/8250: Enable SERIAL_8250_MOXA as module
  * [x86] gpio: Enable GPIO_AMDPT as module
  * [x86] thermal: Enable INT3406_THERMAL as module
  * watchdog: Enable WATCHDOG_SYSFS
  * integrity: Enable IMA, IMA_DEFAULT_HASH_SHA256, IMA_APPRAISE,
    (except on armel/marvell) (Closes: #788290)
  * media: Enable VIDEO_TW5864, VIDEO_TW686X as modules
  * [x86] amdgpu,sound/soc: Enable DRM_AMD_ACP; enable SND_SOC_AMD_ACP as module
  * hda: Set SND_HDA_PREALLOC_SIZE=2048 as recommended for PulseAudio
  * HID: Enable HID_SENSOR_CUSTOM_SENSOR as module
  * leds,USB: Enable USB_LEDS_TRIGGER_USBPORT as module
  * usbip: Enable USBIP_VUDC as module
  * USB/misc: Enable UCSI as module
    as modules
  * [amd64] EDAC: Enable EDAC_SKX as module
  * [x86] comedi: Enable COMEDI_ADV_PCI1720, COMEDI_ADV_PCI1760 as modules
  * [x86] platform: Enable INTEL_HID_EVENT as module
  * [x86] hwtracing: Enable INTEL_TH, INTEL_TH_PCI, INTEL_TH_GTH, INTEL_TH_MSU,
    INTEL_TH_PTI as modules
  * [rt] tracing: Enable HWLAT_TRACER
  * [x86] crypto: Enable CRYPTO_DEV_QAT_C3XXX, CRYPTO_DEV_QAT_C62X,
  * crypto: Enable CRYPTO_DEV_CHELSIO as module
    SETEND_EMULATION (Closes: #861384)
  * udeb: Add tifm_7xx1 to mmc-modules (Closes: #861195)
  * leds: Enable LEDS_GPIO as module for all configurations with GPIOs
    (Closes: #860569)
  * selinux: Set SECURITY_SELINUX_CHECKREQPROT_VALUE=0, per default.
    This may break some old applications if SELinux is enabled, and can be
    reverted using the kernel parameter: checkreqprot=1
  * udeb: Move mfd-core to kernel-image, as both input-modules and
    mmc-modules need it
  * crypto: Change CRYPTO_SHA256 from module to built-in, as required by IMA

  [ Salvatore Bonaccorso ]
  * ping: implement proper locking (CVE-2017-2671)
  * macsec: avoid heap overflow in skb_to_sgvec (CVE-2017-7477)
  * macsec: dynamically allocate space for sglist
  * nfsd: check for oversized NFSv2/v3 arguments (CVE-2017-7645)
  * nfsd4: minor NFSv2/v3 write decoding cleanup
  * nfsd: stricter decoding of write-like NFSv2/v3 ops (CVE-2017-7895)

  [ Aurelien Jarno ]
  * [mips*/octeon] Drop obsolete patch adding support for the UBNT E200
  * [mips*el/loongson-3] Disable PAGE_EXTENSION and PAGE_POISONING.

  [ John Paul Adrian Glaubitz ]
  * [m68k] udeb: Enable suffix for kernel-image (Closes: #859366)
parents 1d73db37 cda83edc
......@@ -1558,6 +1558,7 @@ static void probe_vcache(void)
vcache_size = c->vcache.sets * c->vcache.ways * c->vcache.linesz;
c->vcache.waybit = 0;
c->vcache.waysize = vcache_size / c->vcache.ways;
pr_info("Unified victim cache %ldkB %s, linesize %d bytes.\n",
vcache_size >> 10, way_string[c->vcache.ways], c->vcache.linesz);
......@@ -1660,6 +1661,7 @@ static void __init loongson3_sc_init(void)
/* Loongson-3 has 4 cores, 1MB scache for each. scaches are shared */
scache_size *= 4;
c->scache.waybit = 0;
c->scache.waysize = scache_size / c->scache.ways;
pr_info("Unified secondary cache %ldkB %s, linesize %d bytes.\n",
scache_size >> 10, way_string[c->scache.ways], c->scache.linesz);
if (scache_size)
......@@ -762,7 +762,8 @@ static void build_huge_update_entries(u32 **p, unsigned int pte,
static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
struct uasm_label **l,
unsigned int pte,
unsigned int ptr)
unsigned int ptr,
unsigned int flush)
UASM_i_SC(p, pte, 0, ptr);
......@@ -771,6 +772,22 @@ static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r,
UASM_i_SW(p, pte, 0, ptr);
if (cpu_has_ftlb && flush) {
UASM_i_MFC0(p, ptr, C0_ENTRYHI);
uasm_i_ori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
UASM_i_MTC0(p, ptr, C0_ENTRYHI);
build_tlb_write_entry(p, l, r, tlb_indexed);
uasm_i_xori(p, ptr, ptr, MIPS_ENTRYHI_EHINV);
UASM_i_MTC0(p, ptr, C0_ENTRYHI);
build_huge_update_entries(p, pte, ptr);
build_huge_tlb_write_entry(p, l, r, pte, tlb_random, 0);
build_huge_update_entries(p, pte, ptr);
build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0);
......@@ -2197,7 +2214,7 @@ static void build_r4000_tlb_load_handler(void)
uasm_l_tlbl_goaround2(&l, p);
uasm_i_ori(&p, wr.r1, wr.r1, (_PAGE_ACCESSED | _PAGE_VALID));
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
uasm_l_nopage_tlbl(&l, p);
......@@ -2252,7 +2269,7 @@ static void build_r4000_tlb_store_handler(void)
uasm_i_ori(&p, wr.r1, wr.r1,
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1);
uasm_l_nopage_tlbs(&l, p);
......@@ -2308,7 +2325,7 @@ static void build_r4000_tlb_modify_handler(void)
uasm_i_ori(&p, wr.r1, wr.r1,
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2);
build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 0);
uasm_l_nopage_tlbm(&l, p);
......@@ -36,7 +36,7 @@ static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) };
static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) };
static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) };
static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) };
static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) };
static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) };
static struct rt2880_pmx_func pci_func[] = {
FUNC("pci-dev", 0, 40, 32),
FUNC("pci-host2", 1, 40, 32),
......@@ -44,7 +44,7 @@ static struct rt2880_pmx_func pci_func[] = {
FUNC("pci-fnc", 3, 40, 32)
static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) };
static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) };
static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) };
static struct rt2880_pmx_group rt3883_pinmux_data[] = {
GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C),
......@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align)
return alloc_bootmem_align(size, align);
int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size,
bool nomap)
reserve_bootmem(base, size, BOOTMEM_DEFAULT);
return 0;
void __init early_init_devtree(void *params)
__be32 *dtb = (u32 *)__dtb_start;
......@@ -195,6 +195,9 @@ void __init setup_arch(char **cmdline_p)
......@@ -42,10 +42,10 @@ static inline long access_ok(int type, const void __user * addr,
#define get_user __get_user
#if !defined(CONFIG_64BIT)
#define LDD_USER(ptr) __get_user_asm64(ptr)
#define LDD_USER(val, ptr) __get_user_asm64(val, ptr)
#define STD_USER(x, ptr) __put_user_asm64(x, ptr)
#define LDD_USER(ptr) __get_user_asm("ldd", ptr)
#define LDD_USER(val, ptr) __get_user_asm(val, "ldd", ptr)
#define STD_USER(x, ptr) __put_user_asm("std", x, ptr)
......@@ -67,6 +67,15 @@ struct exception_table_entry {
".word (" #fault_addr " - .), (" #except_addr " - .)\n\t" \
* ASM_EXCEPTIONTABLE_ENTRY_EFAULT() creates a special exception table entry
* (with lowest bit set) for which the fault handler in fixup_exception() will
* load -EFAULT into %r8 for a read or write fault, and zeroes the target
* register in case of a read fault in get_user().
#define ASM_EXCEPTIONTABLE_ENTRY_EFAULT( fault_addr, except_addr )\
ASM_EXCEPTIONTABLE_ENTRY( fault_addr, except_addr + 1)
* The page fault handler stores, in a per-cpu area, the following information
* if a fixup routine is available.
......@@ -91,92 +100,116 @@ struct exception_data {
" mtsp %0,%%sr2\n\t" \
: : "r"(get_fs()) : )
#define __get_user(x, ptr) \
({ \
register long __gu_err __asm__ ("r8") = 0; \
register long __gu_val __asm__ ("r9") = 0; \
load_sr2(); \
switch (sizeof(*(ptr))) { \
case 1: __get_user_asm("ldb", ptr); break; \
case 2: __get_user_asm("ldh", ptr); break; \
case 4: __get_user_asm("ldw", ptr); break; \
case 8: LDD_USER(ptr); break; \
default: BUILD_BUG(); break; \
} \
(x) = (__force __typeof__(*(ptr))) __gu_val; \
__gu_err; \
#define __get_user_internal(val, ptr) \
({ \
register long __gu_err __asm__ ("r8") = 0; \
switch (sizeof(*(ptr))) { \
case 1: __get_user_asm(val, "ldb", ptr); break; \
case 2: __get_user_asm(val, "ldh", ptr); break; \
case 4: __get_user_asm(val, "ldw", ptr); break; \
case 8: LDD_USER(val, ptr); break; \
default: BUILD_BUG(); \
} \
__gu_err; \
#define __get_user_asm(ldx, ptr) \
__asm__("\n1:\t" ldx "\t0(%%sr2,%2),%0\n\t" \
ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_1)\
#define __get_user(val, ptr) \
({ \
load_sr2(); \
__get_user_internal(val, ptr); \
#define __get_user_asm(val, ldx, ptr) \
{ \
register long __gu_val; \
__asm__("1: " ldx " 0(%%sr2,%2),%0\n" \
"9:\n" \
: "=r"(__gu_val), "=r"(__gu_err) \
: "r"(ptr), "1"(__gu_err) \
: "r1");
: "r"(ptr), "1"(__gu_err)); \
(val) = (__force __typeof__(*(ptr))) __gu_val; \
#if !defined(CONFIG_64BIT)
#define __get_user_asm64(ptr) \
__asm__("\n1:\tldw 0(%%sr2,%2),%0" \
"\n2:\tldw 4(%%sr2,%2),%R0\n\t" \
ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_get_user_skip_2)\
ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_get_user_skip_1)\
: "=r"(__gu_val), "=r"(__gu_err) \
: "r"(ptr), "1"(__gu_err) \
: "r1");
#define __get_user_asm64(val, ptr) \
{ \
union { \
unsigned long long l; \
__typeof__(*(ptr)) t; \
} __gu_tmp; \
__asm__(" copy %%r0,%R0\n" \
"1: ldw 0(%%sr2,%2),%0\n" \
"2: ldw 4(%%sr2,%2),%R0\n" \
"9:\n" \
: "=&r"(__gu_tmp.l), "=r"(__gu_err) \
: "r"(ptr), "1"(__gu_err)); \
(val) = __gu_tmp.t; \
#endif /* !defined(CONFIG_64BIT) */
#define __put_user(x, ptr) \
#define __put_user_internal(x, ptr) \
({ \
register long __pu_err __asm__ ("r8") = 0; \
__typeof__(*(ptr)) __x = (__typeof__(*(ptr)))(x); \
load_sr2(); \
switch (sizeof(*(ptr))) { \
case 1: __put_user_asm("stb", __x, ptr); break; \
case 2: __put_user_asm("sth", __x, ptr); break; \
case 4: __put_user_asm("stw", __x, ptr); break; \
case 8: STD_USER(__x, ptr); break; \
default: BUILD_BUG(); break; \
} \
case 1: __put_user_asm("stb", __x, ptr); break; \
case 2: __put_user_asm("sth", __x, ptr); break; \
case 4: __put_user_asm("stw", __x, ptr); break; \
case 8: STD_USER(__x, ptr); break; \
default: BUILD_BUG(); \
} \
__pu_err; \
#define __put_user(x, ptr) \
({ \
load_sr2(); \
__put_user_internal(x, ptr); \
* The "__put_user/kernel_asm()" macros tell gcc they read from memory
* instead of writing. This is because they do not write to any memory
* gcc knows about, so there are no aliasing issues. These macros must
* also be aware that "fixup_put_user_skip_[12]" are executed in the
* context of the fault, and any registers used there must be listed
* as clobbers. In this case only "r1" is used by the current routines.
* r8/r9 are already listed as err/val.
* also be aware that fixups are executed in the context of the fault,
* and any registers used there must be listed as clobbers.
* r8 is already listed as err.
#define __put_user_asm(stx, x, ptr) \
__asm__ __volatile__ ( \
"\n1:\t" stx "\t%2,0(%%sr2,%1)\n\t" \
ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_1)\
"1: " stx " %2,0(%%sr2,%1)\n" \
"9:\n" \
: "=r"(__pu_err) \
: "r"(ptr), "r"(x), "0"(__pu_err) \
: "r1")
: "r"(ptr), "r"(x), "0"(__pu_err))
#if !defined(CONFIG_64BIT)
#define __put_user_asm64(__val, ptr) do { \
__asm__ __volatile__ ( \
"\n1:\tstw %2,0(%%sr2,%1)" \
"\n2:\tstw %R2,4(%%sr2,%1)\n\t" \
ASM_EXCEPTIONTABLE_ENTRY(1b, fixup_put_user_skip_2)\
ASM_EXCEPTIONTABLE_ENTRY(2b, fixup_put_user_skip_1)\
"1: stw %2,0(%%sr2,%1)\n" \
"2: stw %R2,4(%%sr2,%1)\n" \
"9:\n" \
: "=r"(__pu_err) \
: "r"(ptr), "r"(__val), "0"(__pu_err) \
: "r1"); \
: "r"(ptr), "r"(__val), "0"(__pu_err)); \
} while (0)
#endif /* !defined(CONFIG_64BIT) */
......@@ -47,16 +47,6 @@ EXPORT_SYMBOL(__cmpxchg_u64);
/* Global fixups - defined as int to avoid creation of function pointers */
extern int fixup_get_user_skip_1;
extern int fixup_get_user_skip_2;
extern int fixup_put_user_skip_1;
extern int fixup_put_user_skip_2;
#ifndef CONFIG_64BIT
/* Needed so insmod can set dp value */
extern int $global$;
......@@ -140,6 +140,8 @@ void machine_power_off(void)
printk(KERN_EMERG "System shut down completed.\n"
"Please power this system off now.");
/* prevent soft lockup/stalled CPU messages for endless loop. */
for (;;);
......@@ -2,7 +2,7 @@
# Makefile for parisc-specific library files
lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
lib-y := lusercopy.o bitops.o checksum.o io.o memset.o memcpy.o \
ucmpdi2.o delay.o
obj-y := iomap.o
* Linux/PA-RISC Project (
* Copyright (C) 2004 Randolph Chung <>
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2, or (at your option)
* any later version.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* GNU General Public License for more details.
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
* Fixup routines for kernel exception handling.
#include <asm/asm-offsets.h>
#include <asm/assembly.h>
#include <asm/errno.h>
#include <linux/linkage.h>
.macro get_fault_ip t1 t2
addil LT%__per_cpu_offset,%r27
LDREG RT%__per_cpu_offset(%r1),\t1
/* t2 = smp_processor_id() */
mfctl 30,\t2
ldw TI_CPU(\t2),\t2
#ifdef CONFIG_64BIT
extrd,u \t2,63,32,\t2
/* t2 = &__per_cpu_offset[smp_processor_id()]; */
LDREGX \t2(\t1),\t2
addil LT%exception_data,%r27
LDREG RT%exception_data(%r1),\t1
/* t1 = this_cpu_ptr(&exception_data) */
add,l \t1,\t2,\t1
/* %r27 = t1->fault_gp - restore gp */
/* t1 = t1->fault_ip */
.macro get_fault_ip t1 t2
/* t1 = this_cpu_ptr(&exception_data) */
addil LT%exception_data,%r27
LDREG RT%exception_data(%r1),\t2
/* %r27 = t2->fault_gp - restore gp */
/* t1 = t2->fault_ip */
.level LEVEL
.section .fixup, "ax"
/* get_user() fixups, store -EFAULT in r8, and 0 in r9 */
get_fault_ip %r1,%r8
ldo 4(%r1), %r1
ldi -EFAULT, %r8
bv %r0(%r1)
copy %r0, %r9
get_fault_ip %r1,%r8
ldo 8(%r1), %r1
ldi -EFAULT, %r8
bv %r0(%r1)
copy %r0, %r9
/* put_user() fixups, store -EFAULT in r8 */
get_fault_ip %r1,%r8
ldo 4(%r1), %r1
bv %r0(%r1)
ldi -EFAULT, %r8
get_fault_ip %r1,%r8
ldo 8(%r1), %r1
bv %r0(%r1)
ldi -EFAULT, %r8
......@@ -5,6 +5,8 @@
* Copyright (C) 2000 Richard Hirst <rhirst with>
* Copyright (C) 2001 Matthieu Delahaye <delahaym at>
* Copyright (C) 2003 Randolph Chung <tausq with>
* Copyright (C) 2017 Helge Deller <>
* Copyright (C) 2017 John David Anglin <>
* This program is free software; you can redistribute it and/or modify
......@@ -132,4 +134,321 @@ ENDPROC_CFI(lstrnlen_user)
* unsigned long pa_memcpy(void *dstp, const void *srcp, unsigned long len)
* Inputs:
* - sr1 already contains space of source region
* - sr2 already contains space of destination region
* Returns:
* - number of bytes that could not be copied.
* On success, this will be zero.
* This code is based on a C-implementation of a copy routine written by
* Randolph Chung, which in turn was derived from the glibc.
* Several strategies are tried to try to get the best performance for various
* conditions. In the optimal case, we copy by loops that copy 32- or 16-bytes
* at a time using general registers. Unaligned copies are handled either by
* aligning the destination and then using shift-and-write method, or in a few
* cases by falling back to a byte-at-a-time copy.
* Testing with various alignments and buffer sizes shows that this code is
* often >10x faster than a simple byte-at-a-time copy, even for strangely
* aligned operands. It is interesting to note that the glibc version of memcpy
* (written in C) is actually quite fast already. This routine is able to beat
* it by 30-40% for aligned copies because of the loop unrolling, but in some
* cases the glibc version is still slightly faster. This lends more
* credibility that gcc can generate very good code as long as we are careful.
* Possible optimizations:
* - add cache prefetching
* - try not to use the post-increment address modifiers; they may create
* additional interlocks. Assumption is that those were only efficient on old
* machines (pre PA8000 processors)
dst = arg0
src = arg1
len = arg2
end = arg3
t1 = r19
t2 = r20
t3 = r21
t4 = r22
srcspc = sr1
dstspc = sr2
t0 = r1
a1 = t1
a2 = t2
a3 = t3
a0 = t4
save_src = ret0
save_dst = ret1
save_len = r31
.callinfo NO_CALLS
/* Last destination address */
add dst,len,end
/* short copy with less than 16 bytes? */
cmpib,COND(>>=),n 15,len,.Lbyte_loop
/* same alignment? */
xor src,dst,t0
extru t0,31,2,t1
cmpib,<>,n 0,t1,.Lunaligned_copy
#ifdef CONFIG_64BIT
/* only do 64-bit copies if we can get aligned. */
extru t0,31,3,t1
cmpib,<>,n 0,t1,.Lalign_loop32
/* loop until we are 64-bit aligned */
extru dst,31,3,t1
cmpib,=,n 0,t1,.Lcopy_loop_16_start
20: ldb,ma 1(srcspc,src),t1
21: stb,ma t1,1(dstspc,dst)
b .Lalign_loop64
ldo -1(len),len
ldi 31,t0
cmpb,COND(>>=),n t0,len,.Lword_loop
10: ldd 0(srcspc,src),t1
11: ldd 8(srcspc,src),t2
ldo 16(src),src
12: std,ma t1,8(dstspc,dst)
13: std,ma t2,8(dstspc,dst)
14: ldd 0(srcspc,src),t1
15: ldd 8(srcspc,src),t2
ldo 16(src),src
16: std,ma t1,8(dstspc,dst)
17: std,ma t2,8(dstspc,dst)
b .Lcopy_loop_16
ldo -32(len),len
cmpib,COND(>>=),n 3,len,.Lbyte_loop
20: ldw,ma 4(srcspc,src),t1
21: stw,ma t1,4(dstspc,dst)
b .Lword_loop
ldo -4(len),len