Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1293144 > unrolled thread

[3.19.y-ckt stable] Linux 3.19.8-ckt12 stable review

Back to article view | Back to linux.kernel

Contents

  [3.19.y-ckt stable] Linux 3.19.8-ckt12 stable review Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:40 +0100
    [PATCH 3.19.y-ckt 122/128] net/neighbour: fix crash at dumping device-agnostic proxy entries Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 116/128] remoteproc: avoid stack overflow in debugfs file Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 119/128] net: mvneta: add configuration for MBUS windows access protection Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 094/128] mac80211: mesh: fix call_rcu() usage Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 113/128] tcp: fix potential huge kmalloc() calls in TCP_REPAIR Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 123/128] sched/core: Remove false-positive warning from wake_up_process() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 121/128] net: mvneta: fix bit assignment for RX packet irq enable Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 118/128] bpf, array: fix heap out-of-bounds access when updating elements Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 127/128] ipv4: igmp: Allow removing groups from a removed interface Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 090/128] Bluetooth: Fix l2cap_chan leak in SMP Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 095/128] can: sja1000: clear interrupts on start Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 109/128] x86/signal: Fix restart_syscall number for x32 tasks Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 115/128] isdn: Partially revert debug format string usage clean up Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 126/128] broadcom: fix PHY_ID_BCM5481 entry in the id table Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 124/128] net: ip6mr: fix static mfc/dev leaks on table destruction Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 128/128] sched/wait: Fix signal handling in bit wait helpers Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
      Re: [PATCH 3.19.y-ckt 128/128] sched/wait: Fix signal handling in  bit wait helpers Oleg Nesterov <oleg@redhat.com> - 2015-12-16 19:00 +0100
        Re: [PATCH 3.19.y-ckt 128/128] sched/wait: Fix signal handling in  bit wait helpers Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 003/128] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 111/128] SUNRPC: Fix callback channel Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 117/128] drm/rockchip: unset pgoff when mmap'ing gems Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 108/128] x86/mpx: Fix instruction decoder condition Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 114/128] drm: imx: convert to drm_crtc_send_vblank_event() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 105/128] sched/core: Clear the root_domain cpumasks in init_rootdomain() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 077/128] PCI: Prevent out of bounds access in numa_node override Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 112/128] tcp: md5: fix lockdep annotation Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 125/128] unix: avoid use-after-free in ep_remove_wait_queue Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 107/128] ARM/arm64: KVM: correct PTE uncachedness check Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 104/128] drm: Fix an unwanted master inheritance v2 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 120/128] net: mvneta: fix bit assignment in MVNETA_RXQ_CONFIG_REG Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 110/128] ovl: fix permission checking for setattr Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 088/128] ARM: dts: Kirkwood: Fix QNAP TS219 power-off Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 025/128] usb: chipidea: debug: disable usb irq while role switch Kamal Mostafa <kamal@canonical.com> - 2015-12-16 18:50 +0100
    [PATCH 3.19.y-ckt 106/128] rbd: don't put snap_context twice in rbd_queue_workfn() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 102/128] mac80211: do not actively scan DFS channels Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 085/128] iscsi-target: Fix rx_login_comp hang after login failure Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 103/128] PM / Domains: Fix bad of_node_put() in failure paths of genpd_dev_pm_attach() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 100/128] Fix a memory leak in scsi_host_dev_release() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 091/128] crypto: nx - Fix timing leak in GCM and CCM decryption Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 009/128] x86/mpx: Do proper get_user() when running 32-bit binaries on 64-bit kernels Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 089/128] ath10k: fix invalid NSS for 4x4 devices Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 098/128] drm/i915: Don't override output type for DDI HDMI Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 093/128] ASoC: wm8962: correct addresses for HPF_C_0/1 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 042/128] FS-Cache: Add missing initialization of ret in cachefiles_write_page() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 087/128] target: fix COMPARE_AND_WRITE non zero SGL offset data corruption Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 097/128] RDS: fix race condition when sending a message on unbound socket Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 084/128] xen/gntdev: Grant maps should not be subject to NUMA balancing Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 099/128] block: Always check queue limits for cloned requests Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 086/128] target: Fix race for SCF_COMPARE_AND_WRITE_POST checking Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 092/128] crypto: talitos - Fix timing leak in ESP ICV verification Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 101/128] wan/x25: Fix use-after-free in x25_asy_open_tty() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 010/128] x86/fpu: Fix 32-bit signal frame handling Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 080/128] ARM: dove: Fix legacy get_irqnr_and_base Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 083/128] nfs: if we have no valid attrs, then don't declare the attribute cache valid Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 096/128] ring-buffer: Update read stamp with first real commit on page Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:00 +0100
    [PATCH 3.19.y-ckt 064/128] powerpc/tm: Block signal return setting invalid MSR state Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 079/128] btrfs: fix signed overflows in btrfs_sync_file Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 008/128] x86/mpx: Introduce new 'directory entry' to 'addr' helper function Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 078/128] ALSA: hda - Fix noise on Gigabyte Z170X mobo Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 076/128] drm/radeon: make rv770_set_sw_state failures non-fatal Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 065/128] powerpc/tm: Check for already reclaimed tasks Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 031/128] usblp: do not set TASK_INTERRUPTIBLE before lock Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 066/128] ARC: dw2 unwind: Remove falllback linear search thru FDE entries Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 033/128] kernel/signal.c: unexport sigsuspend() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 073/128] ARM: dts: vfxxx: Fix dspi[01] spi-num-chipselects. Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 057/128] MIPS: KVM: Uninit VCPU in vcpu_create error path Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 074/128] ARM/arm64: KVM: test properly for a PTE's uncachedness Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 056/128] MIPS: KVM: Fix CACHE immediate offset sign extension Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 075/128] arm64: KVM: Fix AArch32 to AArch64 register mapping Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 067/128] fix sysvfs symlinks Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 070/128] nfs4: start callback_ident at idr 1 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 023/128] arm64: kernel: pause/unpause function graph tracer in cpu_suspend() Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 068/128] vfs: Make sendfile(2) killable even better Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 045/128] perf symbols: Fix dso lookup by long name and missing buildids Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 063/128] ALSA: hda - Apply HP headphone fixups more generically Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 062/128] mac: validate mac_partition is within sector Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 006/128] x86/mpx: Add temporary variable to reduce masking Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 071/128] nfs4: limit callback decoding to received bytes Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 055/128] MIPS: KVM: Fix ASID restoration logic Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 007/128] x86: Make is_64bit_mm() widely available Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 072/128] ALSA: hda - Fix headphone noise after Dell XPS 13 resume back from S3 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 069/128] vfs: Avoid softlockups with sendfile(2) Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 082/128] drm/radeon: make some dpm errors debug only Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 032/128] fat: fix fake_offset handling on error path Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 081/128] ARM: orion5x: Fix legacy get_irqnr_and_base Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 035/128] tty: Fix tty_send_xchar() lock order inversion Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 060/128] KVM: s390: fix wrong lookup of VCPUs by array index Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:10 +0100
    [PATCH 3.19.y-ckt 030/128] USB: option: add XS Stick W100-2 from 4G Systems Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 034/128] ocfs2: fix umask ignored issue Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 043/128] ipvlan: fix leak in ipvlan_rcv_frame Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 029/128] arm64: restore bogomips information in /proc/cpuinfo Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 051/128] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 058/128] KVM: Provide function for VCPU lookup by id Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 036/128] parisc: Drop unused MADV_xxxK_PAGES flags from asm/mman.h Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 038/128] tools/net: Use include/uapi with __EXPORTED_HEADERS__ Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 021/128] drm/radeon: unconditionally set sysfs_initialized Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 049/128] macvlan: fix leak in macvlan_handle_frame Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 050/128] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 037/128] mmc: remove bondage between REQ_META and reliable write Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 048/128] net/mlx4_core: Avoid returning success in case of an error flow Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 039/128] packet: do skb_probe_transport_header when we actually have data Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 026/128] xhci: Workaround to get Intel xHCI reset working more reliably Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 053/128] dm thin: restore requested 'error_if_no_space' setting on OODS to WRITE transition Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 054/128] dm: fix ioctl retry termination with signal Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 040/128] sctp: translate host order to network order when setting a hmacid Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 028/128] x86/cpu: Fix SMAP check in PVOPS environments Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 041/128] usb: musb: core: fix order of arguments to ulpi write callback Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 061/128] ALSA: hda - Add fixup for Acer Aspire One Cloudbook 14 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 011/128] crypto: qat - don't use userspace pointer Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 024/128] usb: dwc3: gadget: let us set lower max_speed Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 047/128] packet: fix tpacket_snd max frame len Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 059/128] KVM: s390: avoid memory overwrites on emergency signal injection Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 022/128] USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 044/128] ipvlan: fix use after free of skb Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 052/128] ALSA: usb-audio: work around CH345 input SysEx corruption Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 027/128] xhci: Fix a race in usb2 LPM resume, blocking U3 for usb2 devices Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 020/128] drm/radeon: Disable uncacheable CPU mappings of GTT with RV6xx Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 046/128] packet: only allow extra vlan len on ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:20 +0100
    [PATCH 3.19.y-ckt 013/128] iio: adc: xilinx: Fix VREFN scale Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 004/128] iio: ad5064: Fix ad5629/ad5669 shift Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 018/128] USB: ti_usb_3410_5052: Add Honeywell HGI80 ID Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 016/128] USB: qcserial: Add support for Quectel EC20 Mini PCIe module Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 017/128] USB: serial: option: add support for Novatel MiFi USB620L Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 019/128] drm/i915: get runtime PM reference around GEM set_caching IOCTL Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 005/128] iio:ad7793: Fix ad7785 product ID Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 015/128] drm/i915: quirk backlight present on Macbook 4, 1 Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 012/128] iio: si7020: Swap data byte order Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 001/128] vf610_adc: Fix internal temperature calculation Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 002/128] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100
    [PATCH 3.19.y-ckt 014/128] ipmi: Start the timer and thread on internal msgs Kamal Mostafa <kamal@canonical.com> - 2015-12-16 19:30 +0100

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

#1293189 — [PATCH 3.19.y-ckt 009/128] x86/mpx: Do proper get_user() when running 32-bit binaries on 64-bit kernels

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Hansen <dave.hansen@linux.intel.com>

commit 46561c3959d6307d22139c24cd0bf196162e5681 upstream.

When you call get_user(foo, bar), you effectively do a

	copy_from_user(&foo, bar, sizeof(*bar));

Note that the sizeof() is implicit.

When we reach out to userspace to try to zap an entire "bounds
table" we need to go read a "bounds directory entry" in order to
locate the table's address.  The size of a "directory entry"
depends on the binary being run and is always the size of a
pointer.

But, when we have a 64-bit kernel and a 32-bit application, the
directory entry is still only 32-bits long, but we fetch it with
a 64-bit pointer which makes get_user() does a 64-bit fetch.
Reading 4 extra bytes isn't harmful, unless we are at the end of
and run off the table.  It might also cause the zero page to get
faulted in unnecessarily even if you are not at the end.

Fix it up by doing a special 32-bit get_user() via a cast when
we have 32-bit userspace.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Hansen <dave@sr71.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20151111181931.3ACF6822@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/mm/mpx.c | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 1013f04..3df5f1a 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -579,6 +579,29 @@ static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
 }
 
 /*
+ * We only want to do a 4-byte get_user() on 32-bit.  Otherwise,
+ * we might run off the end of the bounds table if we are on
+ * a 64-bit kernel and try to get 8 bytes.
+ */
+int get_user_bd_entry(struct mm_struct *mm, unsigned long *bd_entry_ret,
+		long __user *bd_entry_ptr)
+{
+	u32 bd_entry_32;
+	int ret;
+
+	if (is_64bit_mm(mm))
+		return get_user(*bd_entry_ret, bd_entry_ptr);
+
+	/*
+	 * Note that get_user() uses the type of the *pointer* to
+	 * establish the size of the get, not the destination.
+	 */
+	ret = get_user(bd_entry_32, (u32 __user *)bd_entry_ptr);
+	*bd_entry_ret = bd_entry_32;
+	return ret;
+}
+
+/*
  * Get the base of bounds tables pointed by specific bounds
  * directory entry.
  */
@@ -598,7 +621,7 @@ static int get_bt_addr(struct mm_struct *mm,
 		int need_write = 0;
 
 		pagefault_disable();
-		ret = get_user(bd_entry, bd_entry_ptr);
+		ret = get_user_bd_entry(mm, &bd_entry, bd_entry_ptr);
 		pagefault_enable();
 		if (!ret)
 			break;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293190 — [PATCH 3.19.y-ckt 089/128] ath10k: fix invalid NSS for 4x4 devices

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>

commit f680f70adbeab28b35f849016b964dd645db6237 upstream.

The number of spatial streams that are derived from chain mask
for 4x4 devices is using wrong bitmask and conditional check.
This is affecting downlink throughput for QCA99x0 devices. Earlier
cfg_tx_chainmask is not filled by default until user configured it
and so get_nss_from_chainmask never be called. This issue is exposed
by recent commit 166de3f1895d ("ath10k: remove supported chain mask").
By default maximum supported chain mask is filled in cfg_tx_chainmask.

Fixes: 5572a95b4b ("ath10k: apply chainmask settings to vdev on creation")
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 05597cb..bbee156 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -2845,7 +2845,7 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
 
 static u32 get_nss_from_chainmask(u16 chain_mask)
 {
-	if ((chain_mask & 0x15) == 0x15)
+	if ((chain_mask & 0xf) == 0xf)
 		return 4;
 	else if ((chain_mask & 0x7) == 0x7)
 		return 3;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293195 — [PATCH 3.19.y-ckt 098/128] drm/i915: Don't override output type for DDI HDMI

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 2540058f7a9d9a843b4d9a28d4f8168dd034d030 upstream.

Currently a DDI port may register the DP hotplug handler even though
it's used with HDMI, and the DP HPD handler overrides the encoder
type forcibly to DP.  This caused the inconsistency on a machine
connected with a HDMI monitor; upon a hotplug event, the DDI port is
suddenly switched to be handled as a DP although the same monitor is
kept connected, and this leads to the erroneous blank output.

This patch papers over the bug by excluding the previous HDMI encoder
type from this override.  This should be fixed more fundamentally,
e.g. by moving the encoder type reset from the HPD or by having
individual encoder objects for HDMI and DP.  But since the bug has
been present for a long time (3.17), it's better to have a
quick-n-dirty fix for now, and keep working on a cleaner fix.

Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=955190
Fixes: 0e32b39ceed6 ('drm/i915: add DP 1.2 MST support (v0.7)')
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1447931396-19147-1-git-send-email-tiwai@suse.de
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/i915/intel_dp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 887f2e4..fec89eb 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -4410,7 +4410,8 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
 	enum intel_display_power_domain power_domain;
 	bool ret = true;
 
-	if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
+	if (intel_dig_port->base.type != INTEL_OUTPUT_EDP &&
+	    intel_dig_port->base.type != INTEL_OUTPUT_HDMI)
 		intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
 	if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) {
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293196 — [PATCH 3.19.y-ckt 093/128] ASoC: wm8962: correct addresses for HPF_C_0/1

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sachin Pandhare <sachinpandhare@gmail.com>

commit e9f96bc53c1b959859599cb30ce6fd4fbb4448c2 upstream.

From datasheet:
R17408 (4400h) HPF_C_1
R17409 (4401h) HPF_C_0
17048 -> 17408 (0x4400)
17049 -> 17409 (0x4401)

Signed-off-by: Sachin Pandhare <sachinpandhare@gmail.com>
Acked-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/soc/codecs/wm8962.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
index d32d554..89bc952 100644
--- a/sound/soc/codecs/wm8962.c
+++ b/sound/soc/codecs/wm8962.c
@@ -365,8 +365,8 @@ static struct reg_default wm8962_reg[] = {
 	{ 16924, 0x0059 },   /* R16924 - HDBASS_PG_1 */
 	{ 16925, 0x999A },   /* R16925 - HDBASS_PG_0 */
 
-	{ 17048, 0x0083 },   /* R17408 - HPF_C_1 */
-	{ 17049, 0x98AD },   /* R17409 - HPF_C_0 */
+	{ 17408, 0x0083 },   /* R17408 - HPF_C_1 */
+	{ 17409, 0x98AD },   /* R17409 - HPF_C_0 */
 
 	{ 17920, 0x007F },   /* R17920 - ADCL_RETUNE_C1_1 */
 	{ 17921, 0xFFFF },   /* R17921 - ADCL_RETUNE_C1_0 */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293197 — [PATCH 3.19.y-ckt 042/128] FS-Cache: Add missing initialization of ret in cachefiles_write_page()

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert@linux-m68k.org>

commit cf89752645e47d86ba8a4157f4b121fcb33434c5 upstream.

fs/cachefiles/rdwr.c: In function ‘cachefiles_write_page’:
fs/cachefiles/rdwr.c:882: warning: ‘ret’ may be used uninitialized in
this function

If the jump to label "error" is taken, "ret" will indeed be
uninitialized, and random stack data may be printed by the debug code.

Fixes: 102f4d900c9c8f5e ("FS-Cache: Handle a write to the page immediately beyond the EOF marker")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/cachefiles/rdwr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index 12e6206..e22584a 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -885,7 +885,7 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
 	loff_t pos, eof;
 	size_t len;
 	void *data;
-	int ret;
+	int ret = -ENOBUFS;
 
 	ASSERT(op != NULL);
 	ASSERT(page != NULL);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293200 — [PATCH 3.19.y-ckt 087/128] target: fix COMPARE_AND_WRITE non zero SGL offset data corruption

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Engelhardt <jengelh@inai.de>

commit d94e5a61357a04938ce14d6033b4d33a3c5fd780 upstream.

target_core_sbc's compare_and_write functionality suffers from taking
data at the wrong memory location when writing a CAW request to disk
when a SGL offset is non-zero.

This can happen with loopback and vhost-scsi fabric drivers when
SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is used to map existing user-space
SGL memory into COMPARE_AND_WRITE READ/WRITE payload buffers.

Given the following sample LIO subtopology,

% targetcli ls /loopback/
o- loopback ................................. [1 Target]
  o- naa.6001405ebb8df14a ....... [naa.60014059143ed2b3]
    o- luns ................................... [2 LUNs]
      o- lun0 ................ [iblock/ram0 (/dev/ram0)]
      o- lun1 ................ [iblock/ram1 (/dev/ram1)]
% lsscsi -g
[3:0:1:0]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdc   /dev/sg3
[3:0:1:1]    disk    LIO-ORG  IBLOCK           4.0   /dev/sdd   /dev/sg4

the following bug can be observed in Linux 4.3 and 4.4~rc1:

% perl -e 'print chr$_ for 0..255,reverse 0..255' >rand
% perl -e 'print "\0" x 512' >zero
% cat rand >/dev/sdd
% sg_compare_and_write -i rand -D zero --lba 0 /dev/sdd
% sg_compare_and_write -i zero -D rand --lba 0 /dev/sdd
Miscompare reported
% hexdump -Cn 512 /dev/sdd
00000000  0f 0e 0d 0c 0b 0a 09 08  07 06 05 04 03 02 01 00
00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
*
00000200

Rather than writing all-zeroes as instructed with the -D file, it
corrupts the data in the sector by splicing some of the original
bytes in. The page of the first entry of cmd->t_data_sg includes the
CDB, and sg->offset is set to a position past the CDB. I presume that
sg->offset is also the right choice to use for subsequent sglist
members.

Signed-off-by: Jan Engelhardt <jengelh@netitwork.de>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/target/target_core_sbc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 384f20c..973fd98 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -487,11 +487,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
 
 		if (block_size < PAGE_SIZE) {
 			sg_set_page(&write_sg[i], m.page, block_size,
-				    block_size);
+				    m.piter.sg->offset + block_size);
 		} else {
 			sg_miter_next(&m);
 			sg_set_page(&write_sg[i], m.page, block_size,
-				    0);
+				    m.piter.sg->offset);
 		}
 		len -= block_size;
 		i++;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293202 — [PATCH 3.19.y-ckt 097/128] RDS: fix race condition when sending a message on unbound socket

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Quentin Casasnovas <quentin.casasnovas@oracle.com>

commit 8c7188b23474cca017b3ef354c4a58456f68303a upstream.

Sasha's found a NULL pointer dereference in the RDS connection code when
sending a message to an apparently unbound socket.  The problem is caused
by the code checking if the socket is bound in rds_sendmsg(), which checks
the rs_bound_addr field without taking a lock on the socket.  This opens a
race where rs_bound_addr is temporarily set but where the transport is not
in rds_bind(), leading to a NULL pointer dereference when trying to
dereference 'trans' in __rds_conn_create().

Vegard wrote a reproducer for this issue, so kindly ask him to share if
you're interested.

I cannot reproduce the NULL pointer dereference using Vegard's reproducer
with this patch, whereas I could without.

Complete earlier incomplete fix to CVE-2015-6937:

  74e98eb08588 ("RDS: verify the underlying transport exists before creating a connection")

Cc: David S. Miller <davem@davemloft.net>

Reviewed-by: Vegard Nossum <vegard.nossum@oracle.com>
Reviewed-by: Sasha Levin <sasha.levin@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: Quentin Casasnovas <quentin.casasnovas@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/rds/connection.c | 6 ------
 net/rds/send.c       | 4 +++-
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/net/rds/connection.c b/net/rds/connection.c
index f5fb7d6..378c3a6 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -183,12 +183,6 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
 		}
 	}
 
-	if (trans == NULL) {
-		kmem_cache_free(rds_conn_slab, conn);
-		conn = ERR_PTR(-ENODEV);
-		goto out;
-	}
-
 	conn->c_trans = trans;
 
 	ret = trans->conn_alloc(conn, gfp);
diff --git a/net/rds/send.c b/net/rds/send.c
index 42f65d4..e1937d35 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -958,11 +958,13 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 		release_sock(sk);
 	}
 
-	/* racing with another thread binding seems ok here */
+	lock_sock(sk);
 	if (daddr == 0 || rs->rs_bound_addr == 0) {
+		release_sock(sk);
 		ret = -ENOTCONN; /* XXX not a great errno */
 		goto out;
 	}
+	release_sock(sk);
 
 	/* size of rm including all sgs */
 	ret = rds_rm_size(msg, payload_len);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293205 — [PATCH 3.19.y-ckt 084/128] xen/gntdev: Grant maps should not be subject to NUMA balancing

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boris Ostrovsky <boris.ostrovsky@oracle.com>

commit 9c17d96500f78d7ecdb71ca6942830158bc75a2b upstream.

Doing so will cause the grant to be unmapped and then, during
fault handling, the fault to be mistakenly treated as NUMA hint
fault.

In addition, even if those maps could partcipate in NUMA
balancing, it wouldn't provide any benefit since we are unable
to determine physical page's node (even if/when VNUMA is
implemented).

Marking grant maps' VMAs as VM_IO will exclude them from being
part of NUMA balancing.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/xen/gntdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 91cc446..7ffbb93 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -765,7 +765,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
 
 	vma->vm_ops = &gntdev_vmops;
 
-	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
+	vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP | VM_IO;
 
 	if (use_ptemod)
 		vma->vm_flags |= VM_DONTCOPY;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293206 — [PATCH 3.19.y-ckt 099/128] block: Always check queue limits for cloned requests

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hannes Reinecke <hare@suse.de>

commit bf4e6b4e757488dee1b6a581f49c7ac34cd217f8 upstream.

When a cloned request is retried on other queues it always needs
to be checked against the queue limits of that queue.
Otherwise the calculations for nr_phys_segments might be wrong,
leading to a crash in scsi_init_sgtable().

To clarify this the patch renames blk_rq_check_limits()
to blk_cloned_rq_check_limits() and removes the symbol
export, as the new function should only be used for
cloned requests and never exported.

Cc: Mike Snitzer <snitzer@redhat.com>
Cc: Ewan Milne <emilne@redhat.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Fixes: e2a60da74 ("block: Clean up special command handling logic")
Acked-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 block/blk-core.c       | 21 +++++++--------------
 include/linux/blkdev.h |  1 -
 2 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/block/blk-core.c b/block/blk-core.c
index 3ad4055..adb49b4 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -1985,7 +1985,8 @@ void submit_bio(int rw, struct bio *bio)
 EXPORT_SYMBOL(submit_bio);
 
 /**
- * blk_rq_check_limits - Helper function to check a request for the queue limit
+ * blk_cloned_rq_check_limits - Helper function to check a cloned request
+ *                              for new the queue limits
  * @q:  the queue
  * @rq: the request being checked
  *
@@ -1996,20 +1997,13 @@ EXPORT_SYMBOL(submit_bio);
  *    after it is inserted to @q, it should be checked against @q before
  *    the insertion using this generic function.
  *
- *    This function should also be useful for request stacking drivers
- *    in some cases below, so export this function.
  *    Request stacking drivers like request-based dm may change the queue
- *    limits while requests are in the queue (e.g. dm's table swapping).
- *    Such request stacking drivers should check those requests against
- *    the new queue limits again when they dispatch those requests,
- *    although such checkings are also done against the old queue limits
- *    when submitting requests.
+ *    limits when retrying requests on other queues. Those requests need
+ *    to be checked against the new queue limits again during dispatch.
  */
-int blk_rq_check_limits(struct request_queue *q, struct request *rq)
+static int blk_cloned_rq_check_limits(struct request_queue *q,
+				      struct request *rq)
 {
-	if (!rq_mergeable(rq))
-		return 0;
-
 	if (blk_rq_sectors(rq) > blk_queue_get_max_sectors(q, rq->cmd_flags)) {
 		printk(KERN_ERR "%s: over max size limit.\n", __func__);
 		return -EIO;
@@ -2029,7 +2023,6 @@ int blk_rq_check_limits(struct request_queue *q, struct request *rq)
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(blk_rq_check_limits);
 
 /**
  * blk_insert_cloned_request - Helper for stacking drivers to submit a request
@@ -2041,7 +2034,7 @@ int blk_insert_cloned_request(struct request_queue *q, struct request *rq)
 	unsigned long flags;
 	int where = ELEVATOR_INSERT_BACK;
 
-	if (blk_rq_check_limits(q, rq))
+	if (blk_cloned_rq_check_limits(q, rq))
 		return -EIO;
 
 	if (rq->rq_disk &&
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 92f4b4b..25ac915 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -797,7 +797,6 @@ extern void blk_rq_set_block_pc(struct request *);
 extern void blk_requeue_request(struct request_queue *, struct request *);
 extern void blk_add_request_payload(struct request *rq, struct page *page,
 		unsigned int len);
-extern int blk_rq_check_limits(struct request_queue *q, struct request *rq);
 extern int blk_lld_busy(struct request_queue *q);
 extern int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
 			     struct bio_set *bs, gfp_t gfp_mask,
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293207 — [PATCH 3.19.y-ckt 086/128] target: Fix race for SCF_COMPARE_AND_WRITE_POST checking

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit 057085e522f8bf94c2e691a5b76880f68060f8ba upstream.

This patch addresses a race + use after free where the first
stage of COMPARE_AND_WRITE in compare_and_write_callback()
is rescheduled after the backend sends the secondary WRITE,
resulting in second stage compare_and_write_post() callback
completing in target_complete_ok_work() before the first
can return.

Because current code depends on checking se_cmd->se_cmd_flags
after return from se_cmd->transport_complete_callback(),
this results in first stage having SCF_COMPARE_AND_WRITE_POST
set, which incorrectly falls through into second stage CAW
processing code, eventually triggering a NULL pointer
dereference due to use after free.

To address this bug, pass in a new *post_ret parameter into
se_cmd->transport_complete_callback(), and depend upon this
value instead of ->se_cmd_flags to determine when to return
or fall through into ->queue_status() code for CAW.

Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/target/target_core_sbc.c       | 13 +++++++++----
 drivers/target/target_core_transport.c | 14 ++++++++------
 include/target/target_core_base.h      |  2 +-
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 48de053..384f20c 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -299,7 +299,8 @@ sbc_setup_write_same(struct se_cmd *cmd, unsigned char *flags, struct sbc_ops *o
 	return 0;
 }
 
-static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t xdreadwrite_callback(struct se_cmd *cmd, bool success,
+					   int *post_ret)
 {
 	unsigned char *buf, *addr;
 	struct scatterlist *sg;
@@ -363,7 +364,8 @@ sbc_execute_rw(struct se_cmd *cmd)
 			       cmd->data_direction);
 }
 
-static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success,
+					     int *post_ret)
 {
 	struct se_device *dev = cmd->se_dev;
 
@@ -373,8 +375,10 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
 	 * sent to the backend driver.
 	 */
 	spin_lock_irq(&cmd->t_state_lock);
-	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status)
+	if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) {
 		cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST;
+		*post_ret = 1;
+	}
 	spin_unlock_irq(&cmd->t_state_lock);
 
 	/*
@@ -386,7 +390,8 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success)
 	return TCM_NO_SENSE;
 }
 
-static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success)
+static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success,
+						 int *post_ret)
 {
 	struct se_device *dev = cmd->se_dev;
 	struct scatterlist *write_sg = NULL, *sg;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index f786de0..a738637 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1596,7 +1596,7 @@ bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
 void transport_generic_request_failure(struct se_cmd *cmd,
 		sense_reason_t sense_reason)
 {
-	int ret = 0;
+	int ret = 0, post_ret = 0;
 
 	pr_debug("-----[ Storage Engine Exception for cmd: %p ITT: 0x%08x"
 		" CDB: 0x%02x\n", cmd, cmd->se_tfo->get_task_tag(cmd),
@@ -1619,7 +1619,7 @@ void transport_generic_request_failure(struct se_cmd *cmd,
 	 */
 	if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
 	     cmd->transport_complete_callback)
-		cmd->transport_complete_callback(cmd, false);
+		cmd->transport_complete_callback(cmd, false, &post_ret);
 
 	switch (sense_reason) {
 	case TCM_NON_EXISTENT_LUN:
@@ -1974,11 +1974,13 @@ static void target_complete_ok_work(struct work_struct *work)
 	 */
 	if (cmd->transport_complete_callback) {
 		sense_reason_t rc;
+		bool caw = (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE);
+		bool zero_dl = !(cmd->data_length);
+		int post_ret = 0;
 
-		rc = cmd->transport_complete_callback(cmd, true);
-		if (!rc && !(cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE_POST)) {
-			if ((cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) &&
-			    !cmd->data_length)
+		rc = cmd->transport_complete_callback(cmd, true, &post_ret);
+		if (!rc && !post_ret) {
+			if (caw && zero_dl)
 				goto queue_rsp;
 
 			return;
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 985ca4c..08f581b 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -524,7 +524,7 @@ struct se_cmd {
 	sense_reason_t		(*execute_cmd)(struct se_cmd *);
 	sense_reason_t		(*execute_rw)(struct se_cmd *, struct scatterlist *,
 					      u32, enum dma_data_direction);
-	sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool);
+	sense_reason_t (*transport_complete_callback)(struct se_cmd *, bool, int *);
 
 	unsigned char		*t_task_cdb;
 	unsigned char		__t_task_cdb[TCM_MAX_COMMAND_SIZE];
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293208 — [PATCH 3.19.y-ckt 092/128] crypto: talitos - Fix timing leak in ESP ICV verification

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Gstir <david@sigma-star.at>

commit 79960943fdc114fd4583c9ab164b5c89da7aa601 upstream.

Using non-constant time memcmp() makes the verification of the authentication
tag in the decrypt path vulnerable to timing attacks. Fix this by using
crypto_memneq() instead.

Signed-off-by: David Gstir <david@sigma-star.at>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
[ kamal: backport to 3.19-stable: context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/crypto/talitos.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
index 0584c4e..181167f 100644
--- a/drivers/crypto/talitos.c
+++ b/drivers/crypto/talitos.c
@@ -870,7 +870,7 @@ static void ipsec_esp_decrypt_swauth_done(struct device *dev,
 			icvdata = &edesc->link_tbl[0];
 
 		sg = sg_last(req->dst, edesc->dst_nents ? : 1);
-		err = memcmp(icvdata, (char *)sg_virt(sg) + sg->length -
+		err = crypto_memneq(icvdata, (char *)sg_virt(sg) + sg->length -
 			     ctx->authsize, ctx->authsize) ? -EBADMSG : 0;
 	}
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293209 — [PATCH 3.19.y-ckt 101/128] wan/x25: Fix use-after-free in x25_asy_open_tty()

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit ee9159ddce14bc1dec9435ae4e3bd3153e783706 upstream.

The N_X25 line discipline may access the previous line discipline's closed
and already-freed private data on open [1].

The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).

[1]
    [  634.336761] ==================================================================
    [  634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
    [  634.339558] Read of size 4 by task syzkaller_execu/8981
    [  634.340359] =============================================================================
    [  634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
    ...
    [  634.405018] Call Trace:
    [  634.405277] dump_stack (lib/dump_stack.c:52)
    [  634.405775] print_trailer (mm/slub.c:655)
    [  634.406361] object_err (mm/slub.c:662)
    [  634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
    [  634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
    [  634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
    [  634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
    [  634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
    [  634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
    [  634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
    [  634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
    [  634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)

Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wan/x25_asy.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 5c47b01..cd39025 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -549,16 +549,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty,
 
 static int x25_asy_open_tty(struct tty_struct *tty)
 {
-	struct x25_asy *sl = tty->disc_data;
+	struct x25_asy *sl;
 	int err;
 
 	if (tty->ops->write == NULL)
 		return -EOPNOTSUPP;
 
-	/* First make sure we're not already connected. */
-	if (sl && sl->magic == X25_ASY_MAGIC)
-		return -EEXIST;
-
 	/* OK.  Find a free X.25 channel to use. */
 	sl = x25_asy_alloc();
 	if (sl == NULL)
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293210 — [PATCH 3.19.y-ckt 010/128] x86/fpu: Fix 32-bit signal frame handling

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Hansen <dave.hansen@linux.intel.com>

commit ab6b52947545a5355154f64f449f97af9d05845f upstream.

(This should have gone to LKML originally. Sorry for the extra
 noise, folks on the cc.)

Background:

Signal frames on x86 have two formats:

  1. For 32-bit executables (whether on a real 32-bit kernel or
     under 32-bit emulation on a 64-bit kernel) we have a
    'fpregset_t' that includes the "FSAVE" registers.

  2. For 64-bit executables (on 64-bit kernels obviously), the
     'fpregset_t' is smaller and does not contain the "FSAVE"
     state.

When creating the signal frame, we have to be aware of whether
we are running a 32 or 64-bit executable so we create the
correct format signal frame.

Problem:

save_xstate_epilog() uses 'fx_sw_reserved_ia32' whenever it is
called for a 32-bit executable.  This is for real 32-bit and
ia32 emulation.

But, fpu__init_prepare_fx_sw_frame() only initializes
'fx_sw_reserved_ia32' when emulation is enabled, *NOT* for real
32-bit kernels.

This leads to really wierd situations where 32-bit programs
lose their extended state when returning from a signal handler.
The kernel copies the uninitialized (zero) 'fx_sw_reserved_ia32'
out to userspace in save_xstate_epilog().  But when returning
from the signal, the kernel errors out in check_for_xstate()
when it does not see FP_XSTATE_MAGIC1 present (because it was
zeroed).  This leads to the FPU/XSAVE state being initialized.

For MPX, this leads to the most permissive state and means we
silently lose bounds violations.  I think this would also mean
that we could lose *ANY* FPU/SSE/AVX state.  I'm not sure why
no one has spotted this bug.

I believe this was broken by:

	72a671ced66d ("x86, fpu: Unify signal handling code paths for x86 and x86_64 kernels")

way back in 2012.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: dave@sr71.net
Cc: fenghua.yu@intel.com
Cc: yu-cheng.yu@intel.com
Link: http://lkml.kernel.org/r/20151111002354.A0799571@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[ kamal: backport to 3.19-stable: applied to kernel/xsave.c; context ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kernel/xsave.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 8be1e17..8c2b709 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -432,20 +432,19 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
  */
 static void prepare_fx_sw_frame(void)
 {
-	int fsave_header_size = sizeof(struct i387_fsave_struct);
 	int size = xstate_size + FP_XSTATE_MAGIC2_SIZE;
 
-	if (config_enabled(CONFIG_X86_32))
-		size += fsave_header_size;
-
 	fx_sw_reserved.magic1 = FP_XSTATE_MAGIC1;
 	fx_sw_reserved.extended_size = size;
 	fx_sw_reserved.xstate_bv = pcntxt_mask;
 	fx_sw_reserved.xstate_size = xstate_size;
 
-	if (config_enabled(CONFIG_IA32_EMULATION)) {
+	if (config_enabled(CONFIG_IA32_EMULATION) ||
+	    config_enabled(CONFIG_X86_32)) {
+		int fsave_header_size = sizeof(struct i387_fsave_struct);
+
 		fx_sw_reserved_ia32 = fx_sw_reserved;
-		fx_sw_reserved_ia32.extended_size += fsave_header_size;
+		fx_sw_reserved_ia32.extended_size = size + fsave_header_size;
 	}
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293211 — [PATCH 3.19.y-ckt 080/128] ARM: dove: Fix legacy get_irqnr_and_base

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Pitre <nicolas.pitre@linaro.org>

commit c1c90728efa49eab81ae816718d84116a22b790e upstream.

Commit 5d6bed2a9c ("ARM: dove: fix legacy dove IRQ numbers") shifted
IRQ numbers by one but didn't update the get_irqnr_and_base macro
accordingly.  This macro is involved when CONFIG_MULTI_IRQ_HANDLER
is not defined.

[jac: 5d6bed2a9c went in to v4.2, but was backported to v3.18]

Signed-off-by: Nicolas Pitre <nico@linaro.org>
Fixes: 5d6bed2a9c ("ARM: dove: fix legacy dove IRQ numbers")
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/mach-dove/include/mach/entry-macro.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-dove/include/mach/entry-macro.S b/arch/arm/mach-dove/include/mach/entry-macro.S
index 72d622b..df1d44b 100644
--- a/arch/arm/mach-dove/include/mach/entry-macro.S
+++ b/arch/arm/mach-dove/include/mach/entry-macro.S
@@ -18,13 +18,13 @@
 	@ check low interrupts
 	ldr	\irqstat, [\base, #IRQ_CAUSE_LOW_OFF]
 	ldr	\tmp, [\base, #IRQ_MASK_LOW_OFF]
-	mov	\irqnr, #31
+	mov	\irqnr, #32
 	ands	\irqstat, \irqstat, \tmp
 
 	@ if no low interrupts set, check high interrupts
 	ldreq	\irqstat, [\base, #IRQ_CAUSE_HIGH_OFF]
 	ldreq	\tmp, [\base, #IRQ_MASK_HIGH_OFF]
-	moveq	\irqnr, #63
+	moveq	\irqnr, #64
 	andeqs	\irqstat, \irqstat, \tmp
 
 	@ find first active interrupt source
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293212 — [PATCH 3.19.y-ckt 083/128] nfs: if we have no valid attrs, then don't declare the attribute cache valid

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jeff Layton <jlayton@poochiereds.net>

commit c812012f9ca7cf89c9e1a1cd512e6c3b5be04b85 upstream.

If we pass in an empty nfs_fattr struct to nfs_update_inode, it will
(correctly) not update any of the attributes, but it then clears the
NFS_INO_INVALID_ATTR flag, which indicates that the attributes are
up to date. Don't clear the flag if the fattr struct has no valid
attrs to apply.

Reviewed-by: Steve French <steve.french@primarydata.com>
Signed-off-by: Jeff Layton <jeff.layton@primarydata.com>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/nfs/inode.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 53e269e..18c22b8 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -1719,7 +1719,11 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
 			nfsi->attrtimeo_timestamp = now;
 		}
 	}
-	invalid &= ~NFS_INO_INVALID_ATTR;
+
+	/* Don't declare attrcache up to date if there were no attrs! */
+	if (fattr->valid != 0)
+		invalid &= ~NFS_INO_INVALID_ATTR;
+
 	/* Don't invalidate the data if we were to blame */
 	if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
 				|| S_ISLNK(inode->i_mode)))
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293213 — [PATCH 3.19.y-ckt 096/128] ring-buffer: Update read stamp with first real commit on page

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit b81f472a208d3e2b4392faa6d17037a89442f4ce upstream.

Do not update the read stamp after swapping out the reader page from the
write buffer. If the reader page is swapped out of the buffer before an
event is written to it, then the read_stamp may get an out of date
timestamp, as the page timestamp is updated on the first commit to that
page.

rb_get_reader_page() only returns a page if it has an event on it, otherwise
it will return NULL. At that point, check if the page being returned has
events and has not been read yet. Then at that point update the read_stamp
to match the time stamp of the reader page.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 kernel/trace/ring_buffer.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index e896a58..3dd43de 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1979,12 +1979,6 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer)
 		goto again;
 }
 
-static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
-{
-	cpu_buffer->read_stamp = cpu_buffer->reader_page->page->time_stamp;
-	cpu_buffer->reader_page->read = 0;
-}
-
 static void rb_inc_iter(struct ring_buffer_iter *iter)
 {
 	struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
@@ -3633,7 +3627,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
 
 	/* Finally update the reader page to the new head */
 	cpu_buffer->reader_page = reader;
-	rb_reset_reader_page(cpu_buffer);
+	cpu_buffer->reader_page->read = 0;
 
 	if (overwrite != cpu_buffer->last_overrun) {
 		cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
@@ -3643,6 +3637,10 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
 	goto again;
 
  out:
+	/* Update the read_stamp on the first event */
+	if (reader && reader->read == 0)
+		cpu_buffer->read_stamp = reader->page->time_stamp;
+
 	arch_spin_unlock(&cpu_buffer->lock);
 	local_irq_restore(flags);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293215 — [PATCH 3.19.y-ckt 064/128] powerpc/tm: Block signal return setting invalid MSR state

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Neuling <mikey@neuling.org>

commit d2b9d2a5ad5ef04ff978c9923d19730cb05efd55 upstream.

Currently we allow both the MSR T and S bits to be set by userspace on
a signal return.  Unfortunately this is a reserved configuration and
will cause a TM Bad Thing exception if attempted (via rfid).

This patch checks for this case in both the 32 and 64 bit signals
code.  If both T and S are set, we mark the context as invalid.

Found using a syscall fuzzer.

Fixes: 2b0a576d15e0 ("powerpc: Add new transactional memory state to the signal context")
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/powerpc/include/asm/reg.h  |  1 +
 arch/powerpc/kernel/signal_32.c | 14 +++++++++-----
 arch/powerpc/kernel/signal_64.c |  4 ++++
 3 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index 1c874fb..f5d03cf 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -108,6 +108,7 @@
 #define MSR_TS_T	__MASK(MSR_TS_T_LG)	/*  Transaction Transactional */
 #define MSR_TS_MASK	(MSR_TS_T | MSR_TS_S)   /* Transaction State bits */
 #define MSR_TM_ACTIVE(x) (((x) & MSR_TS_MASK) != 0) /* Transaction active? */
+#define MSR_TM_RESV(x) (((x) & MSR_TS_MASK) == MSR_TS_MASK) /* Reserved */
 #define MSR_TM_TRANSACTIONAL(x)	(((x) & MSR_TS_MASK) == MSR_TS_T)
 #define MSR_TM_SUSPENDED(x)	(((x) & MSR_TS_MASK) == MSR_TS_S)
 
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index b171001..abad089 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -875,6 +875,15 @@ static long restore_tm_user_regs(struct pt_regs *regs,
 		return 1;
 #endif /* CONFIG_SPE */
 
+	/* Get the top half of the MSR from the user context */
+	if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
+		return 1;
+	msr_hi <<= 32;
+	/* If TM bits are set to the reserved value, it's an invalid context */
+	if (MSR_TM_RESV(msr_hi))
+		return 1;
+	/* Pull in the MSR TM bits from the user context */
+	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr_hi & MSR_TS_MASK);
 	/* Now, recheckpoint.  This loads up all of the checkpointed (older)
 	 * registers, including FP and V[S]Rs.  After recheckpointing, the
 	 * transactional versions should be loaded.
@@ -884,11 +893,6 @@ static long restore_tm_user_regs(struct pt_regs *regs,
 	current->thread.tm_texasr |= TEXASR_FS;
 	/* This loads the checkpointed FP/VEC state, if used */
 	tm_recheckpoint(&current->thread, msr);
-	/* Get the top half of the MSR */
-	if (__get_user(msr_hi, &tm_sr->mc_gregs[PT_MSR]))
-		return 1;
-	/* Pull in MSR TM from user context */
-	regs->msr = (regs->msr & ~MSR_TS_MASK) | ((msr_hi<<32) & MSR_TS_MASK);
 
 	/* This loads the speculative FP/VEC state, if used */
 	if (msr & MSR_FP) {
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 2cb0c94..98131b3 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -427,6 +427,10 @@ static long restore_tm_sigcontexts(struct pt_regs *regs,
 
 	/* get MSR separately, transfer the LE bit if doing signal return */
 	err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
+	/* Don't allow reserved mode. */
+	if (MSR_TM_RESV(msr))
+		return -EINVAL;
+
 	/* pull in MSR TM from user context */
 	regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293216 — [PATCH 3.19.y-ckt 079/128] btrfs: fix signed overflows in btrfs_sync_file

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Sterba <dsterba@suse.com>

commit 9dcbeed4d7e11e1dcf5e55475de3754f0855d1c2 upstream.

The calculation of range length in btrfs_sync_file leads to signed
overflow. This was caught by PaX gcc SIZE_OVERFLOW plugin.

https://forums.grsecurity.net/viewtopic.php?f=1&t=4284

The fsync call passes 0 and LLONG_MAX, the range length does not fit to
loff_t and overflows, but the value is converted to u64 so it silently
works as expected.

The minimal fix is a typecast to u64, switching functions to take
(start, end) instead of (start, len) would be more intrusive.

Coccinelle script found that there's one more opencoded calculation of
the length.

<smpl>
@@
loff_t start, end;
@@
* end - start
</smpl>

Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Chris Mason <clm@fb.com>
[ kamal: backport to 3.19-stable: use len in both btrfs_wait_ordered_range
  calls, like
  b659ef0 Btrfs: avoid syncing log in the fast fsync path when not necessary ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/btrfs/file.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 11ec6e5..1e54adf 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1884,7 +1884,13 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 	struct btrfs_log_ctx ctx;
 	int ret = 0;
 	bool full_sync = 0;
+	u64 len;
 
+	/*
+	 * The range length can be represented by u64, we have to do the typecasts
+	 * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+	 */
+	len = (u64)end - (u64)start + 1;
 	trace_btrfs_sync_file(file, datasync);
 
 	/*
@@ -1912,7 +1918,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 		 * all extents are persisted and the respective file extent
 		 * items are in the fs/subvol btree.
 		 */
-		ret = btrfs_wait_ordered_range(inode, start, end - start + 1);
+		ret = btrfs_wait_ordered_range(inode, start, len);
 	} else {
 		/*
 		 * Start any new ordered operations before starting to log the
@@ -2070,8 +2076,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
 			}
 		}
 		if (!full_sync) {
-			ret = btrfs_wait_ordered_range(inode, start,
-						       end - start + 1);
+			ret = btrfs_wait_ordered_range(inode, start, len);
 			if (ret) {
 				btrfs_end_transaction(trans, root);
 				goto out;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293217 — [PATCH 3.19.y-ckt 008/128] x86/mpx: Introduce new 'directory entry' to 'addr' helper function

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Hansen <dave.hansen@linux.intel.com>

commit 54587653904c552c56b9dec153d7a89063394b09 upstream.

Currently, to get from a bounds directory entry to the virtual
address of a bounds table, we simply mask off a few low bits.
However, the set of bits we mask off is different for 32-bit and
64-bit binaries.

This breaks the operation out in to a helper function and also
adds a temporary variable to store the result until we are
sure we are returning one.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Dave Hansen <dave@sr71.net>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20150607183704.007686CE@viggo.jf.intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[ kamal: 3.19-stable prereq for "46561c3 x86/mpx: Do proper get_user() when
  running 32-bit binaries on 64-bit kernels" ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/include/asm/mpx.h |  1 -
 arch/x86/mm/mpx.c          | 41 ++++++++++++++++++++++++++++++++++-------
 2 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/arch/x86/include/asm/mpx.h b/arch/x86/include/asm/mpx.h
index a952a13d..2857144 100644
--- a/arch/x86/include/asm/mpx.h
+++ b/arch/x86/include/asm/mpx.h
@@ -46,7 +46,6 @@
 #define MPX_BNDCFG_TAIL		12
 #define MPX_BNDSTA_ADDR_MASK	(~((1UL<<MPX_BNDSTA_TAIL)-1))
 #define MPX_BNDCFG_ADDR_MASK	(~((1UL<<MPX_BNDCFG_TAIL)-1))
-#define MPX_BT_ADDR_MASK	(~((1UL<<MPX_BD_ENTRY_TAIL)-1))
 
 #define MPX_BNDCFG_ADDR_MASK	(~((1UL<<MPX_BNDCFG_TAIL)-1))
 #define MPX_BNDSTA_ERROR_CODE	0x3
diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
index 9c208e4..1013f04 100644
--- a/arch/x86/mm/mpx.c
+++ b/arch/x86/mm/mpx.c
@@ -555,29 +555,55 @@ static int mpx_resolve_fault(long __user *addr, int write)
 	return 0;
 }
 
+static unsigned long mpx_bd_entry_to_bt_addr(struct mm_struct *mm,
+					     unsigned long bd_entry)
+{
+	unsigned long bt_addr = bd_entry;
+	int align_to_bytes;
+	/*
+	 * Bit 0 in a bt_entry is always the valid bit.
+	 */
+	bt_addr &= ~MPX_BD_ENTRY_VALID_FLAG;
+	/*
+	 * Tables are naturally aligned at 8-byte boundaries
+	 * on 64-bit and 4-byte boundaries on 32-bit.  The
+	 * documentation makes it appear that the low bits
+	 * are ignored by the hardware, so we do the same.
+	 */
+	if (is_64bit_mm(mm))
+		align_to_bytes = 8;
+	else
+		align_to_bytes = 4;
+	bt_addr &= ~(align_to_bytes-1);
+	return bt_addr;
+}
+
 /*
  * Get the base of bounds tables pointed by specific bounds
  * directory entry.
  */
 static int get_bt_addr(struct mm_struct *mm,
-			long __user *bd_entry, unsigned long *bt_addr)
+			long __user *bd_entry_ptr,
+			unsigned long *bt_addr_result)
 {
 	int ret;
 	int valid_bit;
+	unsigned long bd_entry;
+	unsigned long bt_addr;
 
-	if (!access_ok(VERIFY_READ, (bd_entry), sizeof(*bd_entry)))
+	if (!access_ok(VERIFY_READ, (bd_entry_ptr), sizeof(*bd_entry_ptr)))
 		return -EFAULT;
 
 	while (1) {
 		int need_write = 0;
 
 		pagefault_disable();
-		ret = get_user(*bt_addr, bd_entry);
+		ret = get_user(bd_entry, bd_entry_ptr);
 		pagefault_enable();
 		if (!ret)
 			break;
 		if (ret == -EFAULT)
-			ret = mpx_resolve_fault(bd_entry, need_write);
+			ret = mpx_resolve_fault(bd_entry_ptr, need_write);
 		/*
 		 * If we could not resolve the fault, consider it
 		 * userspace's fault and error out.
@@ -586,8 +612,8 @@ static int get_bt_addr(struct mm_struct *mm,
 			return ret;
 	}
 
-	valid_bit = *bt_addr & MPX_BD_ENTRY_VALID_FLAG;
-	*bt_addr &= MPX_BT_ADDR_MASK;
+	valid_bit = bd_entry & MPX_BD_ENTRY_VALID_FLAG;
+	bt_addr = mpx_bd_entry_to_bt_addr(mm, bd_entry);
 
 	/*
 	 * When the kernel is managing bounds tables, a bounds directory
@@ -596,7 +622,7 @@ static int get_bt_addr(struct mm_struct *mm,
 	 * data in the address field, we know something is wrong. This
 	 * -EINVAL return will cause a SIGSEGV.
 	 */
-	if (!valid_bit && *bt_addr)
+	if (!valid_bit && bt_addr)
 		return -EINVAL;
 	/*
 	 * Do we have an completely zeroed bt entry?  That is OK.  It
@@ -607,6 +633,7 @@ static int get_bt_addr(struct mm_struct *mm,
 	if (!valid_bit)
 		return -ENOENT;
 
+	*bt_addr_result = bt_addr;
 	return 0;
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293218 — [PATCH 3.19.y-ckt 078/128] ALSA: hda - Fix noise on Gigabyte Z170X mobo

3.19.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 0c25ad80408e95e0a4fbaf0056950206e95f726f upstream.

Gigabyte Z710X mobo with ALC1150 codec gets significant noises from
the analog loopback routes even if their inputs are all muted.
Simply kill the aamix for fixing it.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=108301
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/pci/hda/patch_realtek.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 454ada2..d449979 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1768,6 +1768,7 @@ enum {
 	ALC882_FIXUP_NO_PRIMARY_HP,
 	ALC887_FIXUP_ASUS_BASS,
 	ALC887_FIXUP_BASS_CHMAP,
+	ALC882_FIXUP_DISABLE_AAMIX,
 };
 
 static void alc889_fixup_coef(struct hda_codec *codec,
@@ -1929,6 +1930,8 @@ static void alc882_fixup_no_primary_hp(struct hda_codec *codec,
 
 static void alc_fixup_bass_chmap(struct hda_codec *codec,
 				 const struct hda_fixup *fix, int action);
+static void alc_fixup_disable_aamix(struct hda_codec *codec,
+				    const struct hda_fixup *fix, int action);
 
 static const struct hda_fixup alc882_fixups[] = {
 	[ALC882_FIXUP_ABIT_AW9D_MAX] = {
@@ -2160,6 +2163,10 @@ static const struct hda_fixup alc882_fixups[] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_bass_chmap,
 	},
+	[ALC882_FIXUP_DISABLE_AAMIX] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_disable_aamix,
+	},
 };
 
 static const struct snd_pci_quirk alc882_fixup_tbl[] = {
@@ -2227,6 +2234,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
 	SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE),
+	SND_PCI_QUIRK(0x1458, 0xa182, "Gigabyte Z170X-UD3", ALC882_FIXUP_DISABLE_AAMIX),
 	SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
 	SND_PCI_QUIRK_VENDOR(0x1558, "Clevo laptop", ALC882_FIXUP_EAPD),
 	SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_FIXUP_EAPD),
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web