Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1312635 > unrolled thread

[3.19.y-ckt stable] Linux 3.19.8-ckt13 stable review

Back to article view | Back to linux.kernel

Contents

  [3.19.y-ckt stable] Linux 3.19.8-ckt13 stable review Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:10 +0100
    [PATCH 3.19.y-ckt 030/160] USB: cdc_acm: Ignore Infineon Flash Loader utility Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:10 +0100
    [PATCH 3.19.y-ckt 026/160] fuse: break infinite loop in fuse_fill_write_pages() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:10 +0100
    [PATCH 3.19.y-ckt 156/160] net: filter: make JITs zero A for SKF_AD_ALU_XOR_X Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 059/160] ALSA: hda - Fixing speaker noise on the two latest thinkpad models Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 024/160] tools: Add a "make all" rule Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 040/160] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 131/160] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 085/160] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 052/160] net: mvpp2: fix refilling BM pools in RX path Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 063/160] radeon: Fix VCE IB test on Big-Endian systems Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 018/160] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 028/160] iio: fix some warning messages Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 037/160] sata_sil: disable trim Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 143/160] pinctrl: bcm2835: Fix initial value for direction_output Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 086/160] mm: hugetlb: call huge_pte_alloc() only if ptep is null Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 048/160] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 134/160] tile: provide CONFIG_PAGE_SIZE_64KB etc for tilepro Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 088/160] ocfs2: fix SGID not inherited issue Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 148/160] qlcnic: fix a timeout loop Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 072/160] rfkill: copy the name into the rfkill struct Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 139/160] vmstat: allocate vmstat_wq before it is used Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 005/160] ip6mr: call del_timer_sync() in ip6mr_free_table() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 159/160] kvm: x86: only channel 0 of the i8254 is linked to the HPET Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 060/160] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 097/160] ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 108/160] xen: Add RING_COPY_REQUEST() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 019/160] bluetooth: Validate socket address length in sco_sock_bind(). Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 074/160] ses: Fix problems with simple enclosures Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 122/160] USB: fix invalid memory access in hub_activate() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 133/160] tracing: Fix setting of start_index in find_next() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 033/160] jbd2: Fix unreclaimed pages after truncate in data=journal mode Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 120/160] [media] airspy: increase USB control message buffer size Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 073/160] dm btree: fix bufio buffer leaks in dm_btree_del() error path Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 035/160] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 101/160] ftrace/scripts: Have recordmcount copy the object file Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 057/160] IB/srp: Fix a memory leak Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 004/160] ARC: Fix silly typo in MAINTAINERS file Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 098/160] spi: fix parent-device reference leak Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 069/160] ipmi: move timer init to before irq is setup Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 127/160] MIPS: uaccess: Fix strlen_user with EVA Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 099/160] scripts: recordmcount: break hardlinks Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 102/160] ARC: dw2 unwind: Reinstante unwinding out of modules Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 119/160] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 003/160] sched/wait: Fix the signal handling fix Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 042/160] USB: whci-hcd: add check for dma mapping error Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 017/160] skbuff: Fix offset error in skb_reorder_vlan_header Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 125/160] parisc: Fix syscall restarts Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 152/160] net/mlx4_en: Fix HW timestamp init issue upon system startup Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 050/160] net: mvpp2: fix missing DMA region unmap in egress processing Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 062/160] radeon: Fix VCE ring test for Big-Endian systems Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 113/160] xen-scsiback: safely copy requests Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 112/160] xen-blkback: read from indirect descriptors only once Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 084/160] vmstat: Reduce time interval to stat update on idle cpu Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 066/160] ALSA: hda - Fix noise problems on Thinkpad T440s Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:20 +0100
    [PATCH 3.19.y-ckt 068/160] dm space map metadata: fix ref counting bug when bootstrapping a new space map Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 124/160] i2c: rcar: disable runtime PM correctly in slave mode Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 034/160] drm/ttm: Fixed a read/write lock imbalance Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 020/160] fou: clean up socket with kfree_rcu Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 039/160] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 016/160] vlan: Fix untag operations of stacked vlans with REORDER_HEADER off Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 014/160] sh_eth: fix kernel oops in skb_put() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 111/160] xen-blkback: only read request operation from shared ring once Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 155/160] ASoC: Use nested lock for snd_soc_dapm_mutex_lock Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 138/160] ftrace/module: Call clean up function when module init fails early Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 144/160] net: phy: mdio-mux: Check return value of mdiobus_alloc() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 121/160] USB: ipaq.c: fix a timeout loop Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 095/160] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 137/160] dts: vt8500: Add SDHC node to DTS file for WM8650 Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 130/160] ocfs2: fix BUG when calculate new backup super Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 031/160] USB: serial: Another Infineon flash loader USB ID Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 045/160] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 071/160] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 082/160] parisc iommu: fix panic due to trying to allocate too large region Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 044/160] xen/events/fifo: Consume unprocessed events when a CPU dies Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 115/160] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 087/160] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 091/160] n_tty: Fix poll() after buffer-limited eof push read Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 015/160] net: fix IP early demux races Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 038/160] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 154/160] ipv6/addrlabel: fix ip6addrlbl_get() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 114/160] xen/pciback: Save xen_pci_op commands before processing it Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 011/160] net: qca_spi: fix transmit queue timeout handling Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 058/160] IB/srp: Fix possible send queue overflow Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 077/160] ARM: dts: vf610: use reset values for L2 cache latencies Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 006/160] gre6: allow to update all parameters via rtnl Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 001/160] [3.19-stable only] Revert "perf symbols: Fix dso lookup by long name and missing buildids" Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 029/160] USB: cp210x: Remove CP2110 ID from compatibility list Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:30 +0100
    [PATCH 3.19.y-ckt 032/160] ext4: Fix handling of extended tv_sec Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 129/160] [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 149/160] ser_gigaset: fix deallocation of platform device structure Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 065/160] crypto: skcipher - Copy iv from desc even for 0-len walks Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 117/160] xen/pciback: Do not install an IRQ handler for MSI interrupts. Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 153/160] include/linux/mmdebug.h: should include linux/bug.h Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 126/160] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 041/160] usb: core : hub: Fix BOS 'NULL pointer' kernel panic Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 022/160] KEYS: Fix race between read and revoke Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 151/160] net/mlx4_en: Remove dependency between timestamping capability and service_task Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 118/160] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 008/160] sctp: use the same clock as if sock source timestamps were on Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 136/160] async_tx: use GFP_NOWAIT rather than GFP_IO Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 100/160] dma-debug: Fix dma_debug_entry offset calculation Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 090/160] ASoC: wm8974: set cache type for regmap Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 047/160] perf: Fix PERF_EVENT_IOC_PERIOD deadlock Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 027/160] usb: gadget: pxa27x: fix suspend callback Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 150/160] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 092/160] tty: Fix GPF in flush_to_ldisc() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 064/160] video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 053/160] dmaengine: at_xdmac: fix macro typo Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 076/160] ASoC: davinci-mcasp: Fix XDATA check in mcasp_start_tx Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 142/160] sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 036/160] AHCI: Fix softreset failed issue of Port Multiplier Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 147/160] amd-xgbe: fix a couple timeout loops Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 141/160] sctp: convert sack_needed and sack_generation to bits Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 093/160] genirq: Prevent chip buslock deadlock Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 104/160] powerpc/powernv: Fix the overflow of OPAL message notifiers head array Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 107/160] s390/dis: Fix handling of format specifiers Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 106/160] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 128/160] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:40 +0100
    [PATCH 3.19.y-ckt 009/160] sctp: update the netstamp_needed counter when copying sockets Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 116/160] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 110/160] xen-netback: use RING_COPY_REQUEST() throughout Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 158/160] net: possible use after free in dst_release Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 051/160] net: mvpp2: fix buffers' DMA handling on RX path Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 055/160] vhost: relax log address alignment Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 067/160] dm thin metadata: fix bug when taking a metadata snapshot Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 160/160] firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 046/160] ARM: 8465/1: mm: keep reserved ASIDs in sync with mm after multiple rollovers Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 010/160] sctp: also copy sk_tsflags when copying the socket Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 103/160] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 002/160] sched/wait: Fix signal handling in bit wait helpers Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 109/160] xen-netback: don't use last request to determine minimum Tx credit Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 105/160] powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 081/160] powercap / RAPL: fix BIOS lock check Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 023/160] KVM: x86: Reload pit counters for all channels when restoring state Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 080/160] USB: add quirk for devices with broken LPM Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 021/160] af_unix: Revert 'lock_interruptible' in stream receive code Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 049/160] ALSA: rme96: Fix unexpected volume reset after rate changes Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 079/160] xhci: fix usb2 resume timing and races. Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 132/160] ftrace/scripts: Fix incorrect use of sprintf in recordmcount Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 056/160] virtio: fix memory leak of virtio ida cache layers Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 007/160] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 140/160] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 083/160] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 094/160] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 157/160] net: sched: fix missing free per cpu on qstats Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 135/160] ARM: versatile: fix MMC/SD interrupt assignment Kamal Mostafa <kamal@canonical.com> - 2016-01-20 02:50 +0100
    [PATCH 3.19.y-ckt 070/160] ASoC: es8328: Fix deemphasis values Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 096/160] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 061/160] radeon/cik: Fix GFX IB test on Big-Endian Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 043/160] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 146/160] mISDN: fix a loop count Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 145/160] sh_eth: fix TX buffer byte-swapping Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 123/160] x86/mce: Ensure offline CPUs don't participate in rendezvous process Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 013/160] net: add validation for the socket syscall protocol argument Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 078/160] ses: fix additional element traversal bug Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 075/160] vgaarb: fix signal handling in vga_get() Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100
    [PATCH 3.19.y-ckt 089/160] sh64: fix __NR_fgetxattr Kamal Mostafa <kamal@canonical.com> - 2016-01-20 03:00 +0100

Page 8 of 8 — ← Prev page 1 2 3 4 5 6 7 [8]

#1312792 — [PATCH 3.19.y-ckt 056/160] virtio: fix memory leak of virtio ida cache layers

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Suman Anna <s-anna@ti.com>

commit c13f99b7e945dad5273a8b7ee230f4d1f22d3354 upstream.

The virtio core uses a static ida named virtio_index_ida for
assigning index numbers to virtio devices during registration.
The ida core may allocate some internal idr cache layers and
an ida bitmap upon any ida allocation, and all these layers are
truely freed only upon the ida destruction. The virtio_index_ida
is not destroyed at present, leading to a memory leak when using
the virtio core as a module and atleast one virtio device is
registered and unregistered.

Fix this by invoking ida_destroy() in the virtio core module
exit.

Signed-off-by: Suman Anna <s-anna@ti.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/virtio/virtio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
index b9f70df..8d34065 100644
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -415,6 +415,7 @@ static int virtio_init(void)
 static void __exit virtio_exit(void)
 {
 	bus_unregister(&virtio_bus);
+	ida_destroy(&virtio_index_ida);
 }
 core_initcall(virtio_init);
 module_exit(virtio_exit);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312793 — [PATCH 3.19.y-ckt 007/160] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Pavel Machek <pavel@ucw.cz>

[ Upstream commit f2a3771ae8aca879c32336c76ad05a017629bae2 ]

atl1c driver is doing order-4 allocation with GFP_ATOMIC
priority. That often breaks  networking after resume. Switch to
GFP_KERNEL. Still not ideal, but should be significantly better.

atl1c_setup_ring_resources() is called from .open() function, and
already uses GFP_KERNEL, so this change is safe.

Signed-off-by: Pavel Machek <pavel@ucw.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index c9946c6..087d8d6 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1014,13 +1014,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
 		sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
 		8 * 4;
 
-	ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
-				&ring_header->dma);
+	ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
+						&ring_header->dma, GFP_KERNEL);
 	if (unlikely(!ring_header->desc)) {
-		dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
+		dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
 		goto err_nomem;
 	}
-	memset(ring_header->desc, 0, ring_header->size);
 	/* init TPD ring */
 
 	tpd_ring[0].dma = roundup(ring_header->dma, 8);
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312794 — [PATCH 3.19.y-ckt 140/160] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 183e53e8ddf4165c3763181682189362d6b403f7 upstream.

The CPPI-4.1 driver selects TI_CPPI41, which is a dmaengine
driver and that may not be available when CONFIG_DMADEVICES
is not set:

warning: (USB_TI_CPPI41_DMA) selects TI_CPPI41 which has unmet direct dependencies (DMADEVICES && ARCH_OMAP)

This adds an extra dependency to avoid generating warnings in randconfig
builds. Ideally we'd remove the 'select' statement, but that has the
potential to break defconfig files.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 411dd19c682d ("usb: musb: Kconfig: Select the DMA driver if DMA mode of MUSB is enabled")
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/musb/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index b005010..3e81e44 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -141,7 +141,7 @@ config USB_TI_CPPI_DMA
 
 config USB_TI_CPPI41_DMA
 	bool 'TI CPPI 4.1 (AM335x)'
-	depends on ARCH_OMAP
+	depends on ARCH_OMAP && DMADEVICES
 	select TI_CPPI41
 
 config USB_TUSB_OMAP_DMA
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312795 — [PATCH 3.19.y-ckt 083/160] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>

commit a88c769548047b21f76fd71e04b6a3300ff17160 upstream.

When dequeue_huge_page_vma() in alloc_huge_page() fails, we fall back on
alloc_buddy_huge_page() to directly create a hugepage from the buddy
allocator.

In that case, however, if alloc_buddy_huge_page() succeeds we don't
decrement h->resv_huge_pages, which means that successful
hugetlb_fault() returns without releasing the reserve count.  As a
result, subsequent hugetlb_fault() might fail despite that there are
still free hugepages.

This patch simply adds decrementing code on that code path.

I reproduced this problem when testing v4.3 kernel in the following situation:
 - the test machine/VM is a NUMA system,
 - hugepage overcommiting is enabled,
 - most of hugepages are allocated and there's only one free hugepage
   which is on node 0 (for example),
 - another program, which calls set_mempolicy(MPOL_BIND) to bind itself to
   node 1, tries to allocate a hugepage,
 - the allocation should fail but the reserve count is still hold.

Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ luis: backported to 3.16:
  - use 'chg' instead of 'gbl_chg'
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 mm/hugetlb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index cf17e90..e7cf586 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1397,7 +1397,10 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma,
 		page = alloc_buddy_huge_page(h, NUMA_NO_NODE);
 		if (!page)
 			goto out_uncharge_cgroup;
-
+		if (!avoid_reserve && vma_has_reserves(vma, chg)) {
+			SetPagePrivate(page);
+			h->resv_huge_pages--;
+		}
 		spin_lock(&hugetlb_lock);
 		list_move(&page->lru, &h->hugepage_activelist);
 		/* Fall through */
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312796 — [PATCH 3.19.y-ckt 094/160] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Anssi Hannula <anssi.hannula@iki.fi>

commit 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa upstream.

AudioQuest DragonFly DAC reports a volume control range of 0..50
(0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which
is obviously incorrect and would cause software using the dB information
in e.g. volume sliders to have a massive volume difference in 100..102%
range.

Commit 2d1cb7f658fb ("ALSA: usb-audio: add dB range mapping for some
devices") added a dB range mapping for it with range 0..50 dB.

However, the actual volume mapping seems to be neither linear volume nor
linear dB scale, but instead quite close to the cubic mapping e.g.
alsamixer uses, with a range of approx. -53...0 dB.

Replace the previous quirk with a custom dB mapping based on some basic
output measurements, using a 10-item range TLV (which will still fit in
alsa-lib MAX_TLV_RANGE_SIZE).

Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the
range is 0..50, so if this gets fixed/changed in later HW revisions it
will no longer be applied.

v2: incorporated Takashi Iwai's suggestion for the quirk application
method

Signed-off-by: Anssi Hannula <anssi.hannula@iki.fi>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/usb/mixer.c        |  2 ++
 sound/usb/mixer_maps.c   | 12 ------------
 sound/usb/mixer_quirks.c | 37 +++++++++++++++++++++++++++++++++++++
 sound/usb/mixer_quirks.h |  4 ++++
 4 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index cd8ed2e..f9a9752 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1336,6 +1336,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
 		}
 	}
 
+	snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
+
 	range = (cval->max - cval->min) / cval->res;
 	/*
 	 * Are there devices with volume range more than 255? I use a bit more
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index 6a803ef..ddca654 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -348,13 +348,6 @@ static struct usbmix_name_map bose_companion5_map[] = {
 	{ 0 }	/* terminator */
 };
 
-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
-static struct usbmix_name_map dragonfly_1_2_map[] = {
-	{ 7, NULL, .dB = &dragonfly_1_2_dB },
-	{ 0 }	/* terminator */
-};
-
 /*
  * Control map entries
  */
@@ -470,11 +463,6 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
 		.id = USB_ID(0x05a7, 0x1020),
 		.map = bose_companion5_map,
 	},
-	{
-		/* Dragonfly DAC 1.2 */
-		.id = USB_ID(0x21b4, 0x0081),
-		.map = dragonfly_1_2_map,
-	},
 	{ 0 } /* terminator */
 };
 
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 337c317..48a7450 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -37,6 +37,7 @@
 #include <sound/control.h>
 #include <sound/hwdep.h>
 #include <sound/info.h>
+#include <sound/tlv.h>
 
 #include "usbaudio.h"
 #include "mixer.h"
@@ -1843,3 +1844,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
 	}
 }
 
+static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
+					 struct snd_kcontrol *kctl)
+{
+	/* Approximation using 10 ranges based on output measurement on hw v1.2.
+	 * This seems close to the cubic mapping e.g. alsamixer uses. */
+	static const DECLARE_TLV_DB_RANGE(scale,
+		 0,  1, TLV_DB_MINMAX_ITEM(-5300, -4970),
+		 2,  5, TLV_DB_MINMAX_ITEM(-4710, -4160),
+		 6,  7, TLV_DB_MINMAX_ITEM(-3884, -3710),
+		 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
+		15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
+		17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
+		20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
+		27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
+		32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
+		41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
+	);
+
+	usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n");
+	kctl->tlv.p = scale;
+	kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
+	kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
+}
+
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+				  struct usb_mixer_elem_info *cval, int unitid,
+				  struct snd_kcontrol *kctl)
+{
+	switch (mixer->chip->usb_id) {
+	case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
+		if (unitid == 7 && cval->min == 0 && cval->max == 50)
+			snd_dragonfly_quirk_db_scale(mixer, kctl);
+		break;
+	}
+}
+
diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h
index bdbfab0..177c329 100644
--- a/sound/usb/mixer_quirks.h
+++ b/sound/usb/mixer_quirks.h
@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
 void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
 				    int unitid);
 
+void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
+				  struct usb_mixer_elem_info *cval, int unitid,
+				  struct snd_kcontrol *kctl);
+
 #endif /* SND_USB_MIXER_QUIRKS_H */
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312797 — [PATCH 3.19.y-ckt 157/160] net: sched: fix missing free per cpu on qstats

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: John Fastabend <john.fastabend@gmail.com>

commit 73c20a8b7245273125cfe92c4b46e6fdb568a801 upstream.

When a qdisc is using per cpu stats (currently just the ingress
qdisc) only the bstats are being freed. This also free's the qstats.

Fixes: b0ab6f92752b9f9d8 ("net: sched: enable per cpu qstats")
Signed-off-by: John Fastabend <john.r.fastabend@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/sched/sch_generic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 6efca30..507edcf 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -666,8 +666,10 @@ static void qdisc_rcu_free(struct rcu_head *head)
 {
 	struct Qdisc *qdisc = container_of(head, struct Qdisc, rcu_head);
 
-	if (qdisc_is_percpu_stats(qdisc))
+	if (qdisc_is_percpu_stats(qdisc)) {
 		free_percpu(qdisc->cpu_bstats);
+		free_percpu(qdisc->cpu_qstats);
+	}
 
 	kfree((char *) qdisc - qdisc->padded);
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312798 — [PATCH 3.19.y-ckt 135/160] ARM: versatile: fix MMC/SD interrupt assignment

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Linus Walleij <linus.walleij@linaro.org>

commit 20f12758c9a837e9cafd7ced59f0b4c7a3961281 upstream.

Commit 0976c946a610d06e907335b7a3afa6db046f8e1b
"arm/versatile: Fix versatile irq specifications"
has an off-by-one error on the Versatile AB that has
been regressing the Versatile AB hardware for some time.

However it seems like the interrupt assignments have
never been correct and I have now adjusted them according
to the specification. The masks for the valid interrupts
made it impossible to assign the right SIC interrupt
for the MMCI, so I went in and fixed these to correspond
to the specifications, and added references if anyone
wants to double-check.

Due to the Versatile PB including the Versatile AB
as a base DTS file, we need to override and correct
some values to correspond to the actual changes in the
hardware.

For the Versatile PB I don't think the IRQ line
assignment for MMCI has ever been correct for either of
the two MMCI blocks. It would be nice if someone with the
physical PB board could test this.

Patch tested on the Versatile AB, QEMU for Versatile AB
and QEMU for Versatile PB.

Cc: Rob Herring <robh@kernel.org>
Cc: Grant Likely <grant.likely@linaro.org>
Fixes: 0976c946a610 ("arm/versatile: Fix versatile irq specifications")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/boot/dts/versatile-ab.dts | 10 +++++++---
 arch/arm/boot/dts/versatile-pb.dts | 20 +++++++++++++++++++-
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/arch/arm/boot/dts/versatile-ab.dts b/arch/arm/boot/dts/versatile-ab.dts
index 27d0d9c..721cc35 100644
--- a/arch/arm/boot/dts/versatile-ab.dts
+++ b/arch/arm/boot/dts/versatile-ab.dts
@@ -110,7 +110,11 @@
 			interrupt-parent = <&vic>;
 			interrupts = <31>; /* Cascaded to vic */
 			clear-mask = <0xffffffff>;
-			valid-mask = <0xffc203f8>;
+			/*
+			 * Valid interrupt lines mask according to
+			 * table 4-36 page 4-50 of ARM DUI 0225D
+			 */
+			valid-mask = <0x0760031b>;
 		};
 
 		dma@10130000 {
@@ -261,8 +265,8 @@
 			};
 			mmc@5000 {
 				compatible = "arm,pl180", "arm,primecell";
-				reg = < 0x5000 0x1000>;
-				interrupts-extended = <&vic 22 &sic 2>;
+				reg = <0x5000 0x1000>;
+				interrupts-extended = <&vic 22 &sic 1>;
 				clocks = <&xtal24mhz>, <&pclk>;
 				clock-names = "mclk", "apb_pclk";
 			};
diff --git a/arch/arm/boot/dts/versatile-pb.dts b/arch/arm/boot/dts/versatile-pb.dts
index e36c1e8..ece4d6d 100644
--- a/arch/arm/boot/dts/versatile-pb.dts
+++ b/arch/arm/boot/dts/versatile-pb.dts
@@ -5,6 +5,16 @@
 	compatible = "arm,versatile-pb";
 
 	amba {
+		/* The Versatile PB is using more SIC IRQ lines than the AB */
+		sic: intc@10003000 {
+			clear-mask = <0xffffffff>;
+			/*
+			 * Valid interrupt lines mask according to
+			 * figure 3-30 page 3-74 of ARM DUI 0224B
+			 */
+			valid-mask = <0x7fe003ff>;
+		};
+
 		gpio2: gpio@101e6000 {
 			compatible = "arm,pl061", "arm,primecell";
 			reg = <0x101e6000 0x1000>;
@@ -30,6 +40,13 @@
 		};
 
 		fpga {
+			mmc@5000 {
+				/*
+				 * Overrides the interrupt assignment from
+				 * the Versatile AB board file.
+				 */
+				interrupts-extended = <&sic 22 &sic 23>;
+			};
 			uart@9000 {
 				compatible = "arm,pl011", "arm,primecell";
 				reg = <0x9000 0x1000>;
@@ -49,7 +66,8 @@
 			mmc@b000 {
 				compatible = "arm,pl180", "arm,primecell";
 				reg = <0xb000 0x1000>;
-				interrupts-extended = <&vic 23 &sic 2>;
+				interrupt-parent = <&sic>;
+				interrupts = <1>, <2>;
 				clocks = <&xtal24mhz>, <&pclk>;
 				clock-names = "mclk", "apb_pclk";
 			};
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312799 — [PATCH 3.19.y-ckt 070/160] ASoC: es8328: Fix deemphasis values

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: John Keeping <john@metanate.com>

commit 84ebac4d04d25ac5c1b1dc3ae621fd465eb38f4e upstream.

This is using completely the wrong mask and value when updating the
register.  Since the correct values are already defined in the header,
switch to using a table with explicit constants rather than shifting the
array index.

Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/soc/codecs/es8328.c | 25 +++++++++++++++++--------
 sound/soc/codecs/es8328.h |  1 +
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
index c5f35a0..3ad7f5b 100644
--- a/sound/soc/codecs/es8328.c
+++ b/sound/soc/codecs/es8328.c
@@ -85,7 +85,15 @@ static const DECLARE_TLV_DB_SCALE(pga_tlv, 0, 300, 0);
 static const DECLARE_TLV_DB_SCALE(bypass_tlv, -1500, 300, 0);
 static const DECLARE_TLV_DB_SCALE(mic_tlv, 0, 300, 0);
 
-static const int deemph_settings[] = { 0, 32000, 44100, 48000 };
+static const struct {
+	int rate;
+	unsigned int val;
+} deemph_settings[] = {
+	{ 0,     ES8328_DACCONTROL6_DEEMPH_OFF },
+	{ 32000, ES8328_DACCONTROL6_DEEMPH_32k },
+	{ 44100, ES8328_DACCONTROL6_DEEMPH_44_1k },
+	{ 48000, ES8328_DACCONTROL6_DEEMPH_48k },
+};
 
 static int es8328_set_deemph(struct snd_soc_codec *codec)
 {
@@ -97,21 +105,22 @@ static int es8328_set_deemph(struct snd_soc_codec *codec)
 	 * rate.
 	 */
 	if (es8328->deemph) {
-		best = 1;
-		for (i = 2; i < ARRAY_SIZE(deemph_settings); i++) {
-			if (abs(deemph_settings[i] - es8328->playback_fs) <
-			    abs(deemph_settings[best] - es8328->playback_fs))
+		best = 0;
+		for (i = 1; i < ARRAY_SIZE(deemph_settings); i++) {
+			if (abs(deemph_settings[i].rate - es8328->playback_fs) <
+			    abs(deemph_settings[best].rate - es8328->playback_fs))
 				best = i;
 		}
 
-		val = best << 1;
+		val = deemph_settings[best].val;
 	} else {
-		val = 0;
+		val = ES8328_DACCONTROL6_DEEMPH_OFF;
 	}
 
 	dev_dbg(codec->dev, "Set deemphasis %d\n", val);
 
-	return snd_soc_update_bits(codec, ES8328_DACCONTROL6, 0x6, val);
+	return snd_soc_update_bits(codec, ES8328_DACCONTROL6,
+			ES8328_DACCONTROL6_DEEMPH_MASK, val);
 }
 
 static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
diff --git a/sound/soc/codecs/es8328.h b/sound/soc/codecs/es8328.h
index cb36afe..156c748 100644
--- a/sound/soc/codecs/es8328.h
+++ b/sound/soc/codecs/es8328.h
@@ -153,6 +153,7 @@ int es8328_probe(struct device *dev, struct regmap *regmap);
 #define ES8328_DACCONTROL6_CLICKFREE (1 << 3)
 #define ES8328_DACCONTROL6_DAC_INVR (1 << 4)
 #define ES8328_DACCONTROL6_DAC_INVL (1 << 5)
+#define ES8328_DACCONTROL6_DEEMPH_MASK (3 << 6)
 #define ES8328_DACCONTROL6_DEEMPH_OFF (0 << 6)
 #define ES8328_DACCONTROL6_DEEMPH_32k (1 << 6)
 #define ES8328_DACCONTROL6_DEEMPH_44_1k (2 << 6)
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312800 — [PATCH 3.19.y-ckt 096/160] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Anson Huang <Anson.Huang@freescale.com>

commit fa0708b320f6da4c1104fe56e01b7abf66fd16ad upstream.

In cpu_v7_do_suspend routine, r11 is used while it is NOT
saved/restored, different compiler may have different usage
of ARM general registers, so it may cause issues during
calling cpu_v7_do_suspend.

We meet kernel fault occurs when using GCC 4.8.3, r11 contains
valid value before calling into cpu_v7_do_suspend, but when returned
from this routine, r11 is corrupted and lead to kernel fault.
Doing save/restore for those corrupted registers is a must in
assemble code.

Signed-off-by: Anson Huang <Anson.Huang@freescale.com>
Reviewed-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/mm/proc-v7.S | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
index 8b4ee5e..c63f226 100644
--- a/arch/arm/mm/proc-v7.S
+++ b/arch/arm/mm/proc-v7.S
@@ -95,7 +95,7 @@ ENDPROC(cpu_v7_dcache_clean_area)
 .equ	cpu_v7_suspend_size, 4 * 9
 #ifdef CONFIG_ARM_CPU_SUSPEND
 ENTRY(cpu_v7_do_suspend)
-	stmfd	sp!, {r4 - r10, lr}
+	stmfd	sp!, {r4 - r11, lr}
 	mrc	p15, 0, r4, c13, c0, 0	@ FCSE/PID
 	mrc	p15, 0, r5, c13, c0, 3	@ User r/o thread ID
 	stmia	r0!, {r4 - r5}
@@ -112,7 +112,7 @@ ENTRY(cpu_v7_do_suspend)
 	mrc	p15, 0, r9, c1, c0, 1	@ Auxiliary control register
 	mrc	p15, 0, r10, c1, c0, 2	@ Co-processor access control
 	stmia	r0, {r5 - r11}
-	ldmfd	sp!, {r4 - r10, pc}
+	ldmfd	sp!, {r4 - r11, pc}
 ENDPROC(cpu_v7_do_suspend)
 
 ENTRY(cpu_v7_do_resume)
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312801 — [PATCH 3.19.y-ckt 061/160] radeon/cik: Fix GFX IB test on Big-Endian

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Oded Gabbay <oded.gabbay@gmail.com>

commit 5f3e226f511ec98d70c970f09cdb4ec46511cc5e upstream.

This patch makes the IB test on the GFX ring pass for CI-based cards
installed in Big-Endian machines.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/radeon/cik.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 3011c7a..852e109 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4112,11 +4112,7 @@ void cik_ring_ib_execute(struct radeon_device *rdev, struct radeon_ib *ib)
 	control |= ib->length_dw | (vm_id << 24);
 
 	radeon_ring_write(ring, header);
-	radeon_ring_write(ring,
-#ifdef __BIG_ENDIAN
-			  (2 << 0) |
-#endif
-			  (ib->gpu_addr & 0xFFFFFFFC));
+	radeon_ring_write(ring, (ib->gpu_addr & 0xFFFFFFFC));
 	radeon_ring_write(ring, upper_32_bits(ib->gpu_addr) & 0xFFFF);
 	radeon_ring_write(ring, control);
 }
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312802 — [PATCH 3.19.y-ckt 043/160] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 5377adb092664d336ac212499961cac5e8728794 upstream.

usb_parse_ss_endpoint_companion() now decodes the burst multiplier
correctly in order to check that it's <= 3, but still uses the wrong
expression if warning that it's > 3.

Fixes: ff30cbc8da42 ("usb: Use the USB_SS_MULT() macro to get the ...")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/usb/core/config.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index b9ddf0c..894894f 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
 		   USB_SS_MULT(desc->bmAttributes) > 3) {
 		dev_warn(ddev, "Isoc endpoint has Mult of %d in "
 				"config %d interface %d altsetting %d ep %d: "
-				"setting to 3\n", desc->bmAttributes + 1,
+				"setting to 3\n",
+				USB_SS_MULT(desc->bmAttributes),
 				cfgno, inum, asnum, ep->desc.bEndpointAddress);
 		ep->ss_ep_comp.bmAttributes = 2;
 	}
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312803 — [PATCH 3.19.y-ckt 146/160] mISDN: fix a loop count

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 40d24c4d8a7430aa4dfd7a665fa3faf3b05b673f upstream.

There are two issue here.
1)  cnt starts as maxloop + 1 so all these loops iterate one more time
    than intended.
2)  At the end of the loop we test for "if (maxloop && !cnt)" but for
    the first two loops, we end with cnt equal to -1.  Changing this to
    a pre-op means we end with cnt set to 0.

Fixes: cae86d4a4e56 ('mISDN: Add driver for Infineon ISDN chipset family')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/isdn/hardware/mISDN/mISDNipac.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
index ccd7d85..92cf6fc 100644
--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
+++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
@@ -1164,7 +1164,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 
 	if (ipac->type & IPAC_TYPE_IPACX) {
 		ista = ReadIPAC(ipac, ISACX_ISTA);
-		while (ista && cnt--) {
+		while (ista && --cnt) {
 			pr_debug("%s: ISTA %02x\n", ipac->name, ista);
 			if (ista & IPACX__ICA)
 				ipac_irq(&ipac->hscx[0], ista);
@@ -1176,7 +1176,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 		}
 	} else if (ipac->type & IPAC_TYPE_IPAC) {
 		ista = ReadIPAC(ipac, IPAC_ISTA);
-		while (ista && cnt--) {
+		while (ista && --cnt) {
 			pr_debug("%s: ISTA %02x\n", ipac->name, ista);
 			if (ista & (IPAC__ICD | IPAC__EXD)) {
 				istad = ReadISAC(isac, ISAC_ISTA);
@@ -1194,7 +1194,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 			ista = ReadIPAC(ipac, IPAC_ISTA);
 		}
 	} else if (ipac->type & IPAC_TYPE_HSCX) {
-		while (cnt) {
+		while (--cnt) {
 			ista = ReadIPAC(ipac, IPAC_ISTAB + ipac->hscx[1].off);
 			pr_debug("%s: B2 ISTA %02x\n", ipac->name, ista);
 			if (ista)
@@ -1205,7 +1205,6 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
 				mISDNisac_irq(isac, istad);
 			if (0 == (ista | istad))
 				break;
-			cnt--;
 		}
 	}
 	if (cnt > maxloop) /* only for ISAC/HSCX without PCI IRQ test */
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312804 — [PATCH 3.19.y-ckt 145/160] sh_eth: fix TX buffer byte-swapping

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

commit 3e2309937f1e5d538ff13da5fb8de41196927c61 upstream.

For the little-endian SH771x kernels the driver has to byte-swap the RX/TX
buffers,  however yet unset physcial address from the TX descriptor is used
to call sh_eth_soft_swap(). Use 'skb->data' instead...

Fixes: 31fcb99d9958 ("net: sh_eth: remove __flush_purge_region")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/ethernet/renesas/sh_eth.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index ff8b04e..8fd0a6b 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2185,8 +2185,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	txdesc = &mdp->tx_ring[entry];
 	/* soft swap. */
 	if (!mdp->cd->hw_swap)
-		sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
-				 skb->len + 2);
+		sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
 	txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
 				      DMA_TO_DEVICE);
 	if (dma_mapping_error(&ndev->dev, txdesc->addr)) {
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312805 — [PATCH 3.19.y-ckt 123/160] x86/mce: Ensure offline CPUs don't participate in rendezvous process

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ashok Raj <ashok.raj@intel.com>

commit d90167a941f62860f35eb960e1012aa2d30e7e94 upstream.

Intel's MCA implementation broadcasts MCEs to all CPUs on the
node. This poses a problem for offlined CPUs which cannot
participate in the rendezvous process:

  Kernel panic - not syncing: Timeout: Not all CPUs entered broadcast exception handler
  Kernel Offset: disabled
  Rebooting in 100 seconds..

More specifically, Linux does a soft offline of a CPU when
writing a 0 to /sys/devices/system/cpu/cpuX/online, which
doesn't prevent the #MC exception from being broadcasted to that
CPU.

Ensure that offline CPUs don't participate in the MCE rendezvous
and clear the RIP valid status bit so that a second MCE won't
cause a shutdown.

Without the patch, mce_start() will increment mce_callin and
wait for all CPUs. Offlined CPUs should avoid participating in
the rendezvous process altogether.

Signed-off-by: Ashok Raj <ashok.raj@intel.com>
[ Massage commit message. ]
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Tony Luck <tony.luck@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/1449742346-21470-2-git-send-email-bp@alien8.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kernel/cpu/mcheck/mce.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index 1596e04..c3f58e9 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1088,6 +1088,17 @@ void do_machine_check(struct pt_regs *regs, long error_code)
 	DECLARE_BITMAP(valid_banks, MAX_NR_BANKS);
 	char *msg = "Unknown";
 
+	/* If this CPU is offline, just bail out. */
+	if (cpu_is_offline(smp_processor_id())) {
+		u64 mcgstatus;
+
+		mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
+		if (mcgstatus & MCG_STATUS_RIPV) {
+			mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
+			return;
+		}
+	}
+
 	this_cpu_inc(mce_exception_count);
 
 	if (!cfg->banks)
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312806 — [PATCH 3.19.y-ckt 013/160] net: add validation for the socket syscall protocol argument

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

[ Upstream commit 79462ad02e861803b3840cc782248c7359451cd9 ]

郭永刚 reported that one could simply crash the kernel as root by
using a simple program:

	int socket_fd;
	struct sockaddr_in addr;
	addr.sin_port = 0;
	addr.sin_addr.s_addr = INADDR_ANY;
	addr.sin_family = 10;

	socket_fd = socket(10,3,0x40000000);
	connect(socket_fd , &addr,16);

AF_INET, AF_INET6 sockets actually only support 8-bit protocol
identifiers. inet_sock's skc_protocol field thus is sized accordingly,
thus larger protocol identifiers simply cut off the higher bits and
store a zero in the protocol fields.

This could lead to e.g. NULL function pointer because as a result of
the cut off inet_num is zero and we call down to inet_autobind, which
is NULL for raw sockets.

kernel: Call Trace:
kernel:  [<ffffffff816db90e>] ? inet_autobind+0x2e/0x70
kernel:  [<ffffffff816db9a4>] inet_dgram_connect+0x54/0x80
kernel:  [<ffffffff81645069>] SYSC_connect+0xd9/0x110
kernel:  [<ffffffff810ac51b>] ? ptrace_notify+0x5b/0x80
kernel:  [<ffffffff810236d8>] ? syscall_trace_enter_phase2+0x108/0x200
kernel:  [<ffffffff81645e0e>] SyS_connect+0xe/0x10
kernel:  [<ffffffff81779515>] tracesys_phase2+0x84/0x89

I found no particular commit which introduced this problem.

CVE: CVE-2015-8543
Cc: Cong Wang <cwang@twopensource.com>
Reported-by: 郭永刚 <guoyonggang@360.cn>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 include/net/sock.h     | 1 +
 net/ax25/af_ax25.c     | 3 +++
 net/decnet/af_decnet.c | 3 +++
 net/ipv4/af_inet.c     | 3 +++
 net/ipv6/af_inet6.c    | 3 +++
 net/irda/af_irda.c     | 3 +++
 6 files changed, 16 insertions(+)

diff --git a/include/net/sock.h b/include/net/sock.h
index 6690502..1333abe 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -385,6 +385,7 @@ struct sock {
 				sk_no_check_rx : 1,
 				sk_userlocks : 4,
 				sk_protocol  : 8,
+#define SK_PROTOCOL_MAX U8_MAX
 				sk_type      : 16;
 	kmemcheck_bitfield_end(flags);
 	int			sk_wmem_queued;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index ca049a7..161dd3c 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -806,6 +806,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
 	struct sock *sk;
 	ax25_cb *ax25;
 
+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+		return -EINVAL;
+
 	if (!net_eq(net, &init_net))
 		return -EAFNOSUPPORT;
 
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 8102286..f058dc7 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
 {
 	struct sock *sk;
 
+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+		return -EINVAL;
+
 	if (!net_eq(net, &init_net))
 		return -EAFNOSUPPORT;
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 515f689..c9c28d7 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -259,6 +259,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
 	int try_loading_module = 0;
 	int err;
 
+	if (protocol < 0 || protocol >= IPPROTO_MAX)
+		return -EINVAL;
+
 	sock->state = SS_UNCONNECTED;
 
 	/* Look for the requested type/protocol pair. */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e8c4400..f16a8cd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
 	int try_loading_module = 0;
 	int err;
 
+	if (protocol < 0 || protocol >= IPPROTO_MAX)
+		return -EINVAL;
+
 	/* Look for the requested type/protocol pair. */
 lookup_protocol:
 	err = -ESOCKTNOSUPPORT;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 568edc7..1143cae 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
 	struct sock *sk;
 	struct irda_sock *self;
 
+	if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
+		return -EINVAL;
+
 	if (net != &init_net)
 		return -EAFNOSUPPORT;
 
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312808 — [PATCH 3.19.y-ckt 078/160] ses: fix additional element traversal bug

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 5e1033561da1152c57b97ee84371dba2b3d64c25 upstream.

KASAN found that our additional element processing scripts drop off
the end of the VPD page into unallocated space.  The reason is that
not every element has additional information but our traversal
routines think they do, leading to them expecting far more additional
information than is present.  Fix this by adding a gate to the
traversal routine so that it only processes elements that are expected
to have additional information (list is in SES-2 section 6.1.13.1:
Additional Element Status diagnostic page overview)

Reported-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Tested-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/scsi/ses.c        | 10 +++++++++-
 include/linux/enclosure.h |  4 ++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
index ddd48b9..b5ca89e 100644
--- a/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -455,7 +455,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
 			if (desc_ptr)
 				desc_ptr += len;
 
-			if (addl_desc_ptr)
+			if (addl_desc_ptr &&
+			    /* only find additional descriptions for specific devices */
+			    (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
+			     /* these elements are optional */
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
+			     type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
 				addl_desc_ptr += addl_desc_ptr[1] + 2;
 
 		}
diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h
index 9a33c5f..f6c229e 100644
--- a/include/linux/enclosure.h
+++ b/include/linux/enclosure.h
@@ -29,7 +29,11 @@
 /* A few generic types ... taken from ses-2 */
 enum enclosure_component_type {
 	ENCLOSURE_COMPONENT_DEVICE = 0x01,
+	ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07,
+	ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14,
+	ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15,
 	ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17,
+	ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18,
 };
 
 /* ses-2 common element status */
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312809 — [PATCH 3.19.y-ckt 075/160] vgaarb: fix signal handling in vga_get()

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Kirill A. Shutemov" <kirill@shutemov.name>

commit 9f5bd30818c42c6c36a51f93b4df75a2ea2bd85e upstream.

There are few defects in vga_get() related to signal hadning:

  - we shouldn't check for pending signals for TASK_UNINTERRUPTIBLE
    case;

  - if we found pending signal we must remove ourself from wait queue
    and change task state back to running;

  - -ERESTARTSYS is more appropriate, I guess.

Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/vga/vgaarb.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 7bcbf86..17cd475 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -394,8 +394,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
 		set_current_state(interruptible ?
 				  TASK_INTERRUPTIBLE :
 				  TASK_UNINTERRUPTIBLE);
-		if (signal_pending(current)) {
-			rc = -EINTR;
+		if (interruptible && signal_pending(current)) {
+			__set_current_state(TASK_RUNNING);
+			remove_wait_queue(&vga_wait_queue, &wait);
+			rc = -ERESTARTSYS;
 			break;
 		}
 		schedule();
-- 
1.9.1

[toc] | [prev] | [next] | [standalone]

#1312810 — [PATCH 3.19.y-ckt 089/160] sh64: fix __NR_fgetxattr

3.19.8-ckt13 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Dmitry V. Levin" <ldv@altlinux.org>

commit 2d33fa1059da4c8e816627a688d950b613ec0474 upstream.

According to arch/sh/kernel/syscalls_64.S and common sense, __NR_fgetxattr
has to be defined to 259, but it doesn't.  Instead, it's defined to 269,
which is of course used by another syscall, __NR_sched_setaffinity in this
case.

This bug was found by strace test suite.

Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/sh/include/uapi/asm/unistd_64.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index e6820c8..47ebd5b 100644
--- a/arch/sh/include/uapi/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -278,7 +278,7 @@
 #define __NR_fsetxattr		256
 #define __NR_getxattr		257
 #define __NR_lgetxattr		258
-#define __NR_fgetxattr		269
+#define __NR_fgetxattr		259
 #define __NR_listxattr		260
 #define __NR_llistxattr		261
 #define __NR_flistxattr		262
-- 
1.9.1

[toc] | [prev] | [standalone]

Page 8 of 8 — ← Prev page 1 2 3 4 5 6 7 [8]

Back to top | Article view | linux.kernel

csiph-web