Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1315999 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt23 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 118/128] x86/mce: Ensure offline CPUs don't participate in rendezvous process Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 002/128] usb: gadget: pxa27x: fix suspend callback Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 008/128] jbd2: Fix unreclaimed pages after truncate in data=journal mode Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 077/128] xen-blkback: read from indirect descriptors only once Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 085/128] USB: fix invalid memory access in hub_activate() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 126/128] firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 125/128] kvm: x86: only channel 0 of the i8254 is linked to the HPET Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 104/128] parisc: Fix syscall restarts Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 034/128] dm thin metadata: fix bug when taking a metadata snapshot Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 123/128] net: filter: make JITs zero A for SKF_AD_ALU_XOR_X Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 098/128] ASoC: wm8974: set cache type for regmap Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 122/128] ASoC: Use nested lock for snd_soc_dapm_mutex_lock Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 062/128] n_tty: Fix poll() after buffer-limited eof push read Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 095/128] drm/i915: Fix SRC_COPY width on 830/845g Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 102/128] ALSA: hda - Set SKL+ hda controller power at freeze() and thaw() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 013/128] staging: lustre: echo_copy.._lsm() dereferences userland pointers directly Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with truncated buffers Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
      Re: [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with  truncated buffers Ben Hutchings <ben@decadent.org.uk> - 2016-01-25 02:50 +0100
        Re: [PATCH 3.16.y-ckt 127/128] udp: properly support MSG_PEEK with  truncated buffers Luis Henriques <luis.henriques@canonical.com> - 2016-01-25 12:00 +0100
    [PATCH 3.16.y-ckt 124/128] net: possible use after free in dst_release Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 111/128] net/mlx4_en: Fix HW timestamp init issue upon system startup Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 120/128] async_tx: use GFP_NOWAIT rather than GFP_IO Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 023/128] ALSA: hda - Add inverted dmic for Packard Bell DOTS Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 109/128] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 119/128] ASoC: arizona: Fix bclk for sample rates that are multiple of 4kHz Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 071/128] powerpc/powernv: Fix the overflow of OPAL message notifiers head array Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 067/128] spi: fix parent-device reference leak Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 011/128] sata_sil: disable trim Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:10 +0100
    [PATCH 3.16.y-ckt 114/128] genirq: Prevent chip buslock deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 093/128] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 112/128] ipv6/addrlabel: fix ip6addrlbl_get() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 091/128] qlcnic: fix a timeout loop Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 097/128] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 107/128] [PATCH] arm: fix handling of F_OFD_... in oabi_fcntl64() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 087/128] net: phy: mdio-mux: Check return value of mdiobus_alloc() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 092/128] ser_gigaset: fix deallocation of platform device structure Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 103/128] s390/dis: Fix handling of format specifiers Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 108/128] ocfs2: fix BUG when calculate new backup super Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 084/128] USB: ipaq.c: fix a timeout loop Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 094/128] include/linux/mmdebug.h: should include linux/bug.h Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 099/128] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 096/128] vmstat: allocate vmstat_wq before it is used Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 100/128] scripts: recordmcount: break hardlinks Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 106/128] MIPS: uaccess: Fix strlen_user with EVA Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 105/128] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2) Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 113/128] qlcnic: fix a loop exit condition better Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 080/128] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 110/128] net/mlx4_en: Remove dependency between timestamping capability and service_task Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 090/128] amd-xgbe: fix a couple timeout loops Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 101/128] ftrace/scripts: Have recordmcount copy the object file Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 086/128] pinctrl: bcm2835: Fix initial value for direction_output Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 082/128] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled. Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 088/128] sh_eth: fix TX buffer byte-swapping Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to  discover memory reclaim doesn't make any progress Ben Hutchings <ben@decadent.org.uk> - 2016-01-24 23:20 +0100
      Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to  discover memory reclaim doesn't make any progress Luis Henriques <luis.henriques@canonical.com> - 2016-01-25 12:00 +0100
    [PATCH 3.16.y-ckt 081/128] xen/pciback: Do not install an IRQ handler for MSI interrupts. Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 083/128] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set. Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:20 +0100
    [PATCH 3.16.y-ckt 063/128] tty: Fix GPF in flush_to_ldisc() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 059/128] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 074/128] xen-netback: don't use last request to determine minimum Tx credit Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 030/128] radeon/cik: Fix GFX IB test on Big-Endian Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 070/128] ARC: dw2 unwind: Ignore CIE version !=1 gracefully instead of bailing Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 075/128] xen-netback: use RING_COPY_REQUEST() throughout Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 057/128] rfkill: copy the name into the rfkill struct Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 060/128] ses: fix additional element traversal bug Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 079/128] xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI or MSI-X enabled Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 064/128] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 073/128] xen: Add RING_COPY_REQUEST() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 055/128] video: fbdev: fsl: Fix kernel crash when diu_ops is not implemented Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 019/128] SCSI: Fix NULL pointer dereference in runtime PM Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 027/128] IB/srp: Fix possible send queue overflow Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 068/128] dma-debug: Fix dma_debug_entry offset calculation Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 022/128] ALSA: rme96: Fix unexpected volume reset after rate changes Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 014/128] irqchip/versatile-fpga: Fix PCI IRQ mapping on Versatile PB Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 052/128] tools: Add a "make all" rule Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 056/128] crypto: skcipher - Copy iv from desc even for 0-len walks Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 069/128] ARC: dw2 unwind: Reinstante unwinding out of modules Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 054/128] xen/events/fifo: Consume unprocessed events when a CPU dies Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 016/128] USB: whci-hcd: add check for dma mapping error Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 017/128] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 040/128] USB: add quirk for devices with broken LPM Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 018/128] dm btree: fix leak of bufio-backed block in btree_split_sibling error path Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 061/128] powercap / RAPL: fix BIOS lock check Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 058/128] ses: Fix problems with simple enclosures Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 076/128] xen-blkback: only read request operation from shared ring once Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 066/128] ALSA: hda - Add a fixup for Thinkpad X1 Carbon 2nd Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 072/128] powerpc/powernv: pr_warn_once on unsupported OPAL_MSG type Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 065/128] ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 053/128] i2c: mv64xxx: The n clockdiv factor is 0 based on sunxi SoCs Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:30 +0100
    [PATCH 3.16.y-ckt 042/128] mm: hugetlb: fix hugepage memory leak caused by wrong reserve count Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 033/128] ALSA: hda - Fix noise problems on Thinkpad T440s Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 049/128] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 039/128] xhci: fix usb2 resume timing and races. Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 046/128] ocfs2: fix SGID not inherited issue Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 045/128] drivers/base/memory.c: prohibit offlining of memory blocks with missing sections Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 005/128] USB: cdc_acm: Ignore Infineon Flash Loader utility Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 010/128] AHCI: Fix softreset failed issue of Port Multiplier Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 031/128] radeon: Fix VCE ring test for Big-Endian systems Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 004/128] USB: cp210x: Remove CP2110 ID from compatibility list Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 006/128] USB: serial: Another Infineon flash loader USB ID Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 050/128] MIPS: uaccess: Take EVA into account in __copy_from_user() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 037/128] dm btree: fix bufio buffer leaks in dm_btree_del() error path Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 051/128] MIPS: uaccess: Take EVA into account in [__]clear_user Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 007/128] ext4: Fix handling of extended tv_sec Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 036/128] ipmi: move timer init to before irq is setup Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 035/128] dm space map metadata: fix ref counting bug when bootstrapping a new space map Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 032/128] radeon: Fix VCE IB test on Big-Endian systems Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 041/128] parisc iommu: fix panic due to trying to allocate too large region Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 048/128] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 047/128] sh64: fix __NR_fgetxattr Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 038/128] vgaarb: fix signal handling in vga_get() Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 044/128] mm: hugetlb: call huge_pte_alloc() only if ptep is null Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 029/128] 9p: ->evict_inode() should kick out ->i_data, not ->i_mapping Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:40 +0100
    [PATCH 3.16.y-ckt 028/128] ALSA: hda - Fixing speaker noise on the two latest thinkpad models Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 025/128] nfs4: limit callback decoding to received bytes Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 021/128] usb: xhci: fix config fail of FS hub behind a HS hub with MTT Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 026/128] SUNRPC: Fix callback channel Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 020/128] perf: Fix PERF_EVENT_IOC_PERIOD deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 024/128] virtio: fix memory leak of virtio ida cache layers Luis Henriques <luis.henriques@canonical.com> - 2016-01-24 23:50 +0100
    [PATCH 3.16.y-ckt 129/129] Revert "[stable-only] net: add length argument to skb_copy_and_csum_datagram_iovec" Luis Henriques <luis.henriques@canonical.com> - 2016-01-25 12:00 +0100

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

#1316039 — [PATCH 3.16.y-ckt 094/128] include/linux/mmdebug.h: should include linux/bug.h

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: James Morse <james.morse@arm.com>

commit 1d5cda4076d930d6d52088ed2c7753f7c564cbd7 upstream.

mmdebug.h uses BUILD_BUG_ON_INVALID(), assuming someone else included
linux/bug.h.  Include it ourselves.

This saves build-failures such as:

  arch/arm64/include/asm/pgtable.h: In function 'set_pte_at':
  arch/arm64/include/asm/pgtable.h:281:3: error: implicit declaration of function 'BUILD_BUG_ON_INVALID' [-Werror=implicit-function-declaration]
   VM_WARN_ONCE(!pte_young(pte),

Fixes: 02602a18c32d7 ("bug: completely remove code generated by disabled VM_BUG_ON()")
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/mmdebug.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/linux/mmdebug.h b/include/linux/mmdebug.h
index edd82a105220..e23860eb29c1 100644
--- a/include/linux/mmdebug.h
+++ b/include/linux/mmdebug.h
@@ -1,6 +1,7 @@
 #ifndef LINUX_MM_DEBUG_H
 #define LINUX_MM_DEBUG_H 1
 
+#include <linux/bug.h>
 #include <linux/stringify.h>
 
 struct page;

[toc] | [prev] | [next] | [standalone]

#1316040 — [PATCH 3.16.y-ckt 099/128] ARM: dts: imx6: Fix Ethernet PHY mode on Ventana boards

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Krzysztof=20Ha=C5=82asa?= <khalasa@piap.pl>

commit 3a35e470bc6bc4ce34c19c410ebbe4e3bbf0bafe upstream.

Gateworks Ventana boards seem to need "RGMII-ID" (internal delay)
PHY mode, instead of simple "RGMII", for their Marvell 88E1510
transceiver. Otherwise, the Ethernet MAC doesn't work with Marvell PHY
driver (TX doesn't seem to work correctly).

Tested on GW5400 rev. C.

This bug affects ARM Fedora 23.

Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
Acked-by: Tim Harvey <tharvey@gateworks.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/arm/boot/dts/imx6q-gw5400-a.dts  | 2 +-
 arch/arm/boot/dts/imx6qdl-gw51xx.dtsi | 2 +-
 arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +-
 arch/arm/boot/dts/imx6qdl-gw53xx.dtsi | 2 +-
 arch/arm/boot/dts/imx6qdl-gw54xx.dtsi | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/imx6q-gw5400-a.dts b/arch/arm/boot/dts/imx6q-gw5400-a.dts
index 3689eaa58826..5e59ed27513d 100644
--- a/arch/arm/boot/dts/imx6q-gw5400-a.dts
+++ b/arch/arm/boot/dts/imx6q-gw5400-a.dts
@@ -152,7 +152,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 30 0>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
index 0db15af41cb1..1ad3d9ec799b 100644
--- a/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw51xx.dtsi
@@ -90,7 +90,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 30 0>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
index 744c8a2d81f6..1c8c333bd1fb 100644
--- a/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw52xx.dtsi
@@ -144,7 +144,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 30 0>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
index adf150c1be90..1000d1403255 100644
--- a/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw53xx.dtsi
@@ -153,7 +153,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 30 0>;
 	status = "okay";
 };
diff --git a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
index 698d3063b295..f993f5194135 100644
--- a/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
+++ b/arch/arm/boot/dts/imx6qdl-gw54xx.dtsi
@@ -143,7 +143,7 @@
 &fec {
 	pinctrl-names = "default";
 	pinctrl-0 = <&pinctrl_enet>;
-	phy-mode = "rgmii";
+	phy-mode = "rgmii-id";
 	phy-reset-gpios = <&gpio1 30 0>;
 	status = "okay";
 };

[toc] | [prev] | [next] | [standalone]

#1316041 — [PATCH 3.16.y-ckt 096/128] vmstat: allocate vmstat_wq before it is used

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Michal Hocko <mhocko@suse.com>

commit 751e5f5c753e8d447bcf89f9e96b9616ac081628 upstream.

kernel test robot has reported the following crash:

  BUG: unable to handle kernel NULL pointer dereference at 00000100
  IP: [<c1074df6>] __queue_work+0x26/0x390
  *pdpt = 0000000000000000 *pde = f000ff53f000ff53 *pde = f000ff53f000ff53
  Oops: 0000 [#1] PREEMPT PREEMPT SMP SMP
  CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.4.0-rc4-00139-g373ccbe #1
  Workqueue: events vmstat_shepherd
  task: cb684600 ti: cb7ba000 task.ti: cb7ba000
  EIP: 0060:[<c1074df6>] EFLAGS: 00010046 CPU: 0
  EIP is at __queue_work+0x26/0x390
  EAX: 00000046 EBX: cbb37800 ECX: cbb37800 EDX: 00000000
  ESI: 00000000 EDI: 00000000 EBP: cb7bbe68 ESP: cb7bbe38
   DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
  CR0: 8005003b CR2: 00000100 CR3: 01fd5000 CR4: 000006b0
  Stack:
  Call Trace:
    __queue_delayed_work+0xa1/0x160
    queue_delayed_work_on+0x36/0x60
    vmstat_shepherd+0xad/0xf0
    process_one_work+0x1aa/0x4c0
    worker_thread+0x41/0x440
    kthread+0xb0/0xd0
    ret_from_kernel_thread+0x21/0x40

The reason is that start_shepherd_timer schedules the shepherd work item
which uses vmstat_wq (vmstat_shepherd) before setup_vmstat allocates
that workqueue so if the further initialization takes more than HZ we
might end up scheduling on a NULL vmstat_wq.  This is really unlikely
but not impossible.

Fixes: 373ccbe59270 ("mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress")
Reported-by: kernel test robot <ying.huang@linux.intel.com>
Signed-off-by: Michal Hocko <mhocko@suse.com>
Tested-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
[ luis: backported to 3.16: based on Ben's backport to 3.2:
  - as with 3.2, there's a similar race but with the CPU hotplug code ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 mm/vmstat.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/vmstat.c b/mm/vmstat.c
index 7e913ba2b9e0..038f9418b234 100644
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1305,6 +1305,8 @@ static int __init setup_vmstat(void)
 #ifdef CONFIG_SMP
 	int cpu;
 
+	vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+
 	cpu_notifier_register_begin();
 	__register_cpu_notifier(&vmstat_notifier);
 
@@ -1313,7 +1315,6 @@ static int __init setup_vmstat(void)
 		node_set_state(cpu_to_node(cpu), N_CPU);
 	}
 	cpu_notifier_register_done();
-	vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
 #endif
 #ifdef CONFIG_PROC_FS
 	proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);

[toc] | [prev] | [next] | [standalone]

#1316042 — [PATCH 3.16.y-ckt 100/128] scripts: recordmcount: break hardlinks

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit dd39a26538e37f6c6131e829a4a510787e43c783 upstream.

recordmcount edits the file in-place, which can cause problems when
using ccache in hardlink mode.  Arrange for recordmcount to break a
hardlinked object.

Link: http://lkml.kernel.org/r/E1a7MVT-0000et-62@rmk-PC.arm.linux.org.uk

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 scripts/recordmcount.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 650ecc83d7d7..26f0cd2c8e9a 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -194,6 +194,20 @@ static void *mmap_file(char const *fname)
 		addr = umalloc(sb.st_size);
 		uread(fd_map, addr, sb.st_size);
 	}
+	if (sb.st_nlink != 1) {
+		/* file is hard-linked, break the hard link */
+		close(fd_map);
+		if (unlink(fname) < 0) {
+			perror(fname);
+			fail_file();
+		}
+		fd_map = open(fname, O_RDWR | O_CREAT, sb.st_mode);
+		if (fd_map < 0) {
+			perror(fname);
+			fail_file();
+		}
+		uwrite(fd_map, addr, sb.st_size);
+	}
 	return addr;
 }
 

[toc] | [prev] | [next] | [standalone]

#1316043 — [PATCH 3.16.y-ckt 106/128] MIPS: uaccess: Fix strlen_user with EVA

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: James Hogan <james.hogan@imgtec.com>

commit 5dc62fdd8383afbd2faca6b6e6ea1052b45b0124 upstream.

The strlen_user() function calls __strlen_kernel_asm in both branches of
the eva_kernel_access() conditional. For EVA it should be calling
__strlen_user_eva for user accesses, otherwise it will load from the
kernel address space instead of the user address space, and the access
checking will likely be ineffective at preventing it due to EVA's
overlapping user and kernel address spaces.

This was found after extending the test_user_copy module to cover user
string access functions, which gave the following error with EVA:

test_user_copy: illegal strlen_user passed

Fortunately the use of strlen_user() has been all but eradicated from
the mainline kernel, so only out of tree modules could be affected.

Fixes: e3a9b07a9caf ("MIPS: asm: uaccess: Add EVA support for str*_user operations")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Markos Chandras <markos.chandras@imgtec.com>
Cc: Paul Burton <paul.burton@imgtec.com>
Cc: Leonid Yegoshin <leonid.yegoshin@imgtec.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/10842/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/mips/include/asm/uaccess.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h
index 681331257bac..16e0ea6b99d8 100644
--- a/arch/mips/include/asm/uaccess.h
+++ b/arch/mips/include/asm/uaccess.h
@@ -1397,7 +1397,7 @@ static inline long strlen_user(const char __user *s)
 		might_fault();
 		__asm__ __volatile__(
 			"move\t$4, %1\n\t"
-			__MODULE_JAL(__strlen_kernel_asm)
+			__MODULE_JAL(__strlen_user_asm)
 			"move\t%0, $2"
 			: "=r" (res)
 			: "r" (s)

[toc] | [prev] | [next] | [standalone]

#1316044 — [PATCH 3.16.y-ckt 105/128] ALSA: hda/realtek - Fix silent headphone output on MacPro 4,1 (v2)

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Mario Kleiner <mario.kleiner.de@gmail.com>

commit 9f660a1c43890c2cdd1f423fd73654e7ca08fe56 upstream.

Without this patch, internal speaker and line-out work,
but front headphone output jack stays silent on the
Mac Pro 4,1.

This code path also gets executed on the MacPro 5,1 due
to identical codec SSID, but i don't know if it has any
positive or adverse effects there or not.

(v2) Implement feedback from Takashi Iwai: Reuse
     alc889_fixup_mbp_vref and just add a new nid
     0x19 for the MacPro 4,1.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/pci/hda/patch_realtek.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 34806487e54f..9131899af1d8 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1844,6 +1844,7 @@ enum {
 	ALC889_FIXUP_MBA11_VREF,
 	ALC889_FIXUP_MBA21_VREF,
 	ALC889_FIXUP_MP11_VREF,
+	ALC889_FIXUP_MP41_VREF,
 	ALC882_FIXUP_INV_DMIC,
 	ALC882_FIXUP_NO_PRIMARY_HP,
 	ALC887_FIXUP_ASUS_BASS,
@@ -1932,7 +1933,7 @@ static void alc889_fixup_mbp_vref(struct hda_codec *codec,
 				  const struct hda_fixup *fix, int action)
 {
 	struct alc_spec *spec = codec->spec;
-	static hda_nid_t nids[2] = { 0x14, 0x15 };
+	static hda_nid_t nids[3] = { 0x14, 0x15, 0x19 };
 	int i;
 
 	if (action != HDA_FIXUP_ACT_INIT)
@@ -2222,6 +2223,12 @@ static const struct hda_fixup alc882_fixups[] = {
 		.chained = true,
 		.chain_id = ALC885_FIXUP_MACPRO_GPIO,
 	},
+	[ALC889_FIXUP_MP41_VREF] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc889_fixup_mbp_vref,
+		.chained = true,
+		.chain_id = ALC885_FIXUP_MACPRO_GPIO,
+	},
 	[ALC882_FIXUP_INV_DMIC] = {
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_inv_dmic_0x12,
@@ -2304,7 +2311,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x106b, 0x3f00, "Macbook 5,1", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4000, "MacbookPro 5,1", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4100, "Macmini 3,1", ALC889_FIXUP_IMAC91_VREF),
-	SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 5,1", ALC885_FIXUP_MACPRO_GPIO),
+	SND_PCI_QUIRK(0x106b, 0x4200, "Mac Pro 4,1/5,1", ALC889_FIXUP_MP41_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),

[toc] | [prev] | [next] | [standalone]

#1316045 — [PATCH 3.16.y-ckt 113/128] qlcnic: fix a loop exit condition better

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 3358a5c0c1578fa215f90a0e750579cd6258ddd9 upstream.

In the original code, if we succeeded on the last iteration through the
loop then we still returned failure.

Fixes: 389e4e04ad2d ('qlcnic: fix a timeout loop')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
index b1a452f291ee..34906750b7e7 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_vnic.c
@@ -252,7 +252,7 @@ int qlcnic_83xx_check_vnic_state(struct qlcnic_adapter *adapter)
 		state = QLCRDX(ahw, QLC_83XX_VNIC_STATE);
 	}
 
-	if (!idc->vnic_wait_limit) {
+	if (state != QLCNIC_DEV_NPAR_OPER) {
 		dev_err(&adapter->pdev->dev,
 			"vNIC mode not operational, state check timed out.\n");
 		return -EIO;

[toc] | [prev] | [next] | [standalone]

#1316046 — [PATCH 3.16.y-ckt 080/128] xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has MSI or MSI-X enabled

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9 upstream.

The guest sequence of:

  a) XEN_PCI_OP_enable_msix
  b) XEN_PCI_OP_enable_msix

results in hitting an NULL pointer due to using freed pointers.

The device passed in the guest MUST have MSI-X capability.

The a) constructs and SysFS representation of MSI and MSI groups.
The b) adds a second set of them but adding in to SysFS fails (duplicate entry).
'populate_msi_sysfs' frees the newly allocated msi_irq_groups (note that
in a) pdev->msi_irq_groups is still set) and also free's ALL of the
MSI-X entries of the device (the ones allocated in step a) and b)).

The unwind code: 'free_msi_irqs' deletes all the entries and tries to
delete the pdev->msi_irq_groups (which hasn't been set to NULL).
However the pointers in the SysFS are already freed and we hit an
NULL pointer further on when 'strlen' is attempted on a freed pointer.

The patch adds a simple check in the XEN_PCI_OP_enable_msix to guard
against that. The check for msi_enabled is not stricly neccessary.

This is part of XSA-157

Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 8bfb87c1a9f3..029f33ddb8bf 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -206,9 +206,16 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
 		       pci_name(dev));
+
 	if (op->value > SH_INFO_MAX_VEC)
 		return -EINVAL;
 
+	if (dev->msix_enabled)
+		return -EALREADY;
+
+	if (dev->msi_enabled)
+		return -ENXIO;
+
 	entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
 	if (entries == NULL)
 		return -ENOMEM;

[toc] | [prev] | [next] | [standalone]

#1316047 — [PATCH 3.16.y-ckt 110/128] net/mlx4_en: Remove dependency between timestamping capability and service_task

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eugenia Emantayev <eugenia@mellanox.com>

commit fc9f5ea9b4ecbe9b7839c92f0a54261809c723d3 upstream.

Service task is responsible for other tasks in addition to timestamping
overflow check. Launch it even if timestamping is not supported by device.

Fixes: 07841f9d94c1 ('net/mlx4_en: Schedule napi when RX buffers allocation fails')
Signed-off-by: Eugenia Emantayev <eugenia@mellanox.com>
Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 8be0c179e25d..3e663928b51e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2655,9 +2655,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
 	}
 	queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY);
 
-	if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS)
-		queue_delayed_work(mdev->workqueue, &priv->service_task,
-				   SERVICE_TASK_DELAY);
+	queue_delayed_work(mdev->workqueue, &priv->service_task,
+			   SERVICE_TASK_DELAY);
 
 	err = register_netdev(dev);
 	if (err) {

[toc] | [prev] | [next] | [standalone]

#1316048 — [PATCH 3.16.y-ckt 090/128] amd-xgbe: fix a couple timeout loops

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit c7557e6a56510ff6636d40ad4ff64a3ef7d9e197 upstream.

At the end of the loop we test "if (!count)" but because "count--" is
a post-op then the loop will end with count set to -1.  I have fixed
this by changing it to --count.

Fixes: c5aa9e3b8156 ('amd-xgbe: Initial AMD 10GbE platform driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
index 002293b0819d..7038ff66807b 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c
@@ -1296,7 +1296,7 @@ static int xgbe_exit(struct xgbe_prv_data *pdata)
 	usleep_range(10, 15);
 
 	/* Poll Until Poll Condition */
-	while (count-- && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
+	while (--count && XGMAC_IOREAD_BITS(pdata, DMA_MR, SWR))
 		usleep_range(500, 600);
 
 	if (!count)
@@ -1317,7 +1317,7 @@ static int xgbe_flush_tx_queues(struct xgbe_prv_data *pdata)
 	/* Poll Until Poll Condition */
 	for (i = 0; i < pdata->hw_feat.tx_q_cnt; i++) {
 		count = 2000;
-		while (count-- && XGMAC_MTL_IOREAD_BITS(pdata, i,
+		while (--count && XGMAC_MTL_IOREAD_BITS(pdata, i,
 							MTL_Q_TQOMR, FTQ))
 			usleep_range(500, 600);
 

[toc] | [prev] | [next] | [standalone]

#1316049 — [PATCH 3.16.y-ckt 101/128] ftrace/scripts: Have recordmcount copy the object file

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit a50bd43935586420fb75f4558369eb08566fac5e upstream.

Russell King found that he had weird side effects when compiling the kernel
with hard linked ccache. The reason was that recordmcount modified the
kernel in place via mmap, and when a file gets modified twice by
recordmcount, it will complain about it. To fix this issue, Russell wrote a
patch that checked if the file was hard linked more than once and would
unlink it if it was.

Linus Torvalds was not happy with the fact that recordmcount does this in
place modification. Instead of doing the unlink only if the file has two or
more hard links, it does the unlink all the time. In otherwords, it always
does a copy if it changed something. That is, it does the write out if a
change was made.

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 scripts/recordmcount.c | 145 +++++++++++++++++++++++++++++++++++++------------
 1 file changed, 110 insertions(+), 35 deletions(-)

diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 26f0cd2c8e9a..d6e6cc43d8af 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -47,12 +47,17 @@
 
 static int fd_map;	/* File descriptor for file being modified. */
 static int mmap_failed; /* Boolean flag. */
-static void *ehdr_curr; /* current ElfXX_Ehdr *  for resource cleanup */
 static char gpfx;	/* prefix for global symbol name (sometimes '_') */
 static struct stat sb;	/* Remember .st_size, etc. */
 static jmp_buf jmpenv;	/* setjmp/longjmp per-file error escape */
 static const char *altmcount;	/* alternate mcount symbol name */
 static int warn_on_notrace_sect; /* warn when section has mcount not being recorded */
+static void *file_map;	/* pointer of the mapped file */
+static void *file_end;	/* pointer to the end of the mapped file */
+static int file_updated; /* flag to state file was changed */
+static void *file_ptr;	/* current file pointer location */
+static void *file_append; /* added to the end of the file */
+static size_t file_append_size; /* how much is added to end of file */
 
 /* setjmp() return values */
 enum {
@@ -66,10 +71,14 @@ static void
 cleanup(void)
 {
 	if (!mmap_failed)
-		munmap(ehdr_curr, sb.st_size);
+		munmap(file_map, sb.st_size);
 	else
-		free(ehdr_curr);
-	close(fd_map);
+		free(file_map);
+	file_map = NULL;
+	free(file_append);
+	file_append = NULL;
+	file_append_size = 0;
+	file_updated = 0;
 }
 
 static void __attribute__((noreturn))
@@ -91,12 +100,22 @@ succeed_file(void)
 static off_t
 ulseek(int const fd, off_t const offset, int const whence)
 {
-	off_t const w = lseek(fd, offset, whence);
-	if (w == (off_t)-1) {
-		perror("lseek");
+	switch (whence) {
+	case SEEK_SET:
+		file_ptr = file_map + offset;
+		break;
+	case SEEK_CUR:
+		file_ptr += offset;
+		break;
+	case SEEK_END:
+		file_ptr = file_map + (sb.st_size - offset);
+		break;
+	}
+	if (file_ptr < file_map) {
+		fprintf(stderr, "lseek: seek before file\n");
 		fail_file();
 	}
-	return w;
+	return file_ptr - file_map;
 }
 
 static size_t
@@ -113,12 +132,38 @@ uread(int const fd, void *const buf, size_t const count)
 static size_t
 uwrite(int const fd, void const *const buf, size_t const count)
 {
-	size_t const n = write(fd, buf, count);
-	if (n != count) {
-		perror("write");
-		fail_file();
+	size_t cnt = count;
+	off_t idx = 0;
+
+	file_updated = 1;
+
+	if (file_ptr + count >= file_end) {
+		off_t aoffset = (file_ptr + count) - file_end;
+
+		if (aoffset > file_append_size) {
+			file_append = realloc(file_append, aoffset);
+			file_append_size = aoffset;
+		}
+		if (!file_append) {
+			perror("write");
+			fail_file();
+		}
+		if (file_ptr < file_end) {
+			cnt = file_end - file_ptr;
+		} else {
+			cnt = 0;
+			idx = aoffset - count;
+		}
 	}
-	return n;
+
+	if (cnt)
+		memcpy(file_ptr, buf, cnt);
+
+	if (cnt < count)
+		memcpy(file_append + idx, buf + cnt, count - cnt);
+
+	file_ptr += count;
+	return count;
 }
 
 static void *
@@ -175,9 +220,7 @@ static int make_nop_x86(void *map, size_t const offset)
  */
 static void *mmap_file(char const *fname)
 {
-	void *addr;
-
-	fd_map = open(fname, O_RDWR);
+	fd_map = open(fname, O_RDONLY);
 	if (fd_map < 0 || fstat(fd_map, &sb) < 0) {
 		perror(fname);
 		fail_file();
@@ -186,29 +229,58 @@ static void *mmap_file(char const *fname)
 		fprintf(stderr, "not a regular file: %s\n", fname);
 		fail_file();
 	}
-	addr = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
-		    fd_map, 0);
+	file_map = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
+			fd_map, 0);
 	mmap_failed = 0;
-	if (addr == MAP_FAILED) {
+	if (file_map == MAP_FAILED) {
 		mmap_failed = 1;
-		addr = umalloc(sb.st_size);
-		uread(fd_map, addr, sb.st_size);
+		file_map = umalloc(sb.st_size);
+		uread(fd_map, file_map, sb.st_size);
 	}
-	if (sb.st_nlink != 1) {
-		/* file is hard-linked, break the hard link */
-		close(fd_map);
-		if (unlink(fname) < 0) {
-			perror(fname);
-			fail_file();
-		}
-		fd_map = open(fname, O_RDWR | O_CREAT, sb.st_mode);
-		if (fd_map < 0) {
-			perror(fname);
+	close(fd_map);
+
+	file_end = file_map + sb.st_size;
+
+	return file_map;
+}
+
+static void write_file(const char *fname)
+{
+	char tmp_file[strlen(fname) + 4];
+	size_t n;
+
+	if (!file_updated)
+		return;
+
+	sprintf(tmp_file, "%s.rc", fname);
+
+	/*
+	 * After reading the entire file into memory, delete it
+	 * and write it back, to prevent weird side effects of modifying
+	 * an object file in place.
+	 */
+	fd_map = open(tmp_file, O_WRONLY | O_TRUNC | O_CREAT, sb.st_mode);
+	if (fd_map < 0) {
+		perror(fname);
+		fail_file();
+	}
+	n = write(fd_map, file_map, sb.st_size);
+	if (n != sb.st_size) {
+		perror("write");
+		fail_file();
+	}
+	if (file_append_size) {
+		n = write(fd_map, file_append, file_append_size);
+		if (n != file_append_size) {
+			perror("write");
 			fail_file();
 		}
-		uwrite(fd_map, addr, sb.st_size);
 	}
-	return addr;
+	close(fd_map);
+	if (rename(tmp_file, fname) < 0) {
+		perror(fname);
+		fail_file();
+	}
 }
 
 /* w8rev, w8nat, ...: Handle endianness. */
@@ -315,7 +387,6 @@ do_file(char const *const fname)
 	Elf32_Ehdr *const ehdr = mmap_file(fname);
 	unsigned int reltype = 0;
 
-	ehdr_curr = ehdr;
 	w = w4nat;
 	w2 = w2nat;
 	w8 = w8nat;
@@ -435,6 +506,7 @@ do_file(char const *const fname)
 	}
 	}  /* end switch */
 
+	write_file(fname);
 	cleanup();
 }
 
@@ -487,11 +559,14 @@ main(int argc, char *argv[])
 		case SJ_SETJMP:    /* normal sequence */
 			/* Avoid problems if early cleanup() */
 			fd_map = -1;
-			ehdr_curr = NULL;
 			mmap_failed = 1;
+			file_map = NULL;
+			file_ptr = NULL;
+			file_updated = 0;
 			do_file(file);
 			break;
 		case SJ_FAIL:    /* error in do_file or below */
+			sprintf("%s: failed\n", file);
 			++n_error;
 			break;
 		case SJ_SUCCEED:    /* premature success */

[toc] | [prev] | [next] | [standalone]

#1316050 — [PATCH 3.16.y-ckt 086/128] pinctrl: bcm2835: Fix initial value for direction_output

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

commit 4c02cba18cc9de672a554ddda4f23dec8cb4b48e upstream.

Currently the provided initial value for bcm2835_gpio_direction_output
has no effect. So fix this issue by changing the value before
changing the GPIO direction. As a result we need to move the function below
bcm2835_gpio_set.

Suggested-by: Martin Sperl <kernel@martin.sperl.org>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Acked-by: Eric Anholt <eric@anholt.net>
Acked-by: Stephen Warren <swarren@wwwdotorg.org>
Fixes: e1b2dc70cd5b ("pinctrl: add bcm2835 driver")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ luis: backported to 3.16:
  - file rename: drivers/pinctrl/bcm/pinctrl-bcm2835.c ->
    drivers/pinctrl/pinctrl-bcm2835.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/pinctrl/pinctrl-bcm2835.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/drivers/pinctrl/pinctrl-bcm2835.c b/drivers/pinctrl/pinctrl-bcm2835.c
index 3d907de9bc91..1ad7caf08b6c 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -352,12 +352,6 @@ static int bcm2835_gpio_get(struct gpio_chip *chip, unsigned offset)
 	return bcm2835_gpio_get_bit(pc, GPLEV0, offset);
 }
 
-static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
-		unsigned offset, int value)
-{
-	return pinctrl_gpio_direction_output(chip->base + offset);
-}
-
 static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 {
 	struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);
@@ -365,6 +359,13 @@ static void bcm2835_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 	bcm2835_gpio_set_bit(pc, value ? GPSET0 : GPCLR0, offset);
 }
 
+static int bcm2835_gpio_direction_output(struct gpio_chip *chip,
+		unsigned offset, int value)
+{
+	bcm2835_gpio_set(chip, offset, value);
+	return pinctrl_gpio_direction_output(chip->base + offset);
+}
+
 static int bcm2835_gpio_to_irq(struct gpio_chip *chip, unsigned offset)
 {
 	struct bcm2835_pinctrl *pc = dev_get_drvdata(chip->dev);

[toc] | [prev] | [next] | [standalone]

#1316051 — [PATCH 3.16.y-ckt 082/128] xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has MSI(X) enabled.

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 7cfb905b9638982862f0331b36ccaaca5d383b49 upstream.

Otherwise just continue on, returning the same values as
previously (return of 0, and op->result has the PIRQ value).

This does not change the behavior of XEN_PCI_OP_disable_msi[|x].

The pci_disable_msi or pci_disable_msix have the checks for
msi_enabled or msix_enabled so they will error out immediately.

However the guest can still call these operations and cause
us to disable the 'ack_intr'. That means the backend IRQ handler
for the legacy interrupt will not respond to interrupts anymore.

This will lead to (if the device is causing an interrupt storm)
for the Linux generic code to disable the interrupt line.

Naturally this will only happen if the device in question
is plugged in on the motherboard on shared level interrupt GSI.

This is part of XSA-157

Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index d0696ce31e9b..4ee5fc080483 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -185,20 +185,23 @@ static
 int xen_pcibk_disable_msi(struct xen_pcibk_device *pdev,
 			  struct pci_dev *dev, struct xen_pci_op *op)
 {
-	struct xen_pcibk_dev_data *dev_data;
-
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: disable MSI\n",
 		       pci_name(dev));
-	pci_disable_msi(dev);
 
+	if (dev->msi_enabled) {
+		struct xen_pcibk_dev_data *dev_data;
+
+		pci_disable_msi(dev);
+
+		dev_data = pci_get_drvdata(dev);
+		if (dev_data)
+			dev_data->ack_intr = 1;
+	}
 	op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: MSI: %d\n", pci_name(dev),
 			op->value);
-	dev_data = pci_get_drvdata(dev);
-	if (dev_data)
-		dev_data->ack_intr = 1;
 	return 0;
 }
 
@@ -264,23 +267,27 @@ static
 int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
 			   struct pci_dev *dev, struct xen_pci_op *op)
 {
-	struct xen_pcibk_dev_data *dev_data;
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: disable MSI-X\n",
 			pci_name(dev));
-	pci_disable_msix(dev);
 
+	if (dev->msix_enabled) {
+		struct xen_pcibk_dev_data *dev_data;
+
+		pci_disable_msix(dev);
+
+		dev_data = pci_get_drvdata(dev);
+		if (dev_data)
+			dev_data->ack_intr = 1;
+	}
 	/*
 	 * SR-IOV devices (which don't have any legacy IRQ) have
 	 * an undefined IRQ value of zero.
 	 */
 	op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
 	if (unlikely(verbose_request))
-		printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n", pci_name(dev),
-			op->value);
-	dev_data = pci_get_drvdata(dev);
-	if (dev_data)
-		dev_data->ack_intr = 1;
+		printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n",
+		       pci_name(dev), op->value);
 	return 0;
 }
 #endif

[toc] | [prev] | [next] | [standalone]

#1316052 — [PATCH 3.16.y-ckt 088/128] sh_eth: fix TX buffer byte-swapping

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>

commit 3e2309937f1e5d538ff13da5fb8de41196927c61 upstream.

For the little-endian SH771x kernels the driver has to byte-swap the RX/TX
buffers,  however yet unset physcial address from the TX descriptor is used
to call sh_eth_soft_swap(). Use 'skb->data' instead...

Fixes: 31fcb99d9958 ("net: sh_eth: remove __flush_purge_region")
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/ethernet/renesas/sh_eth.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index d11546c2e902..64bb1edb5ef7 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2115,8 +2115,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 	txdesc = &mdp->tx_ring[entry];
 	/* soft swap. */
 	if (!mdp->cd->hw_swap)
-		sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
-				 skb->len + 2);
+		sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
 	txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
 				      DMA_TO_DEVICE);
 	if (skb->len < ETH_ZLEN)

[toc] | [prev] | [next] | [standalone]

#1316053 — Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress

[Multipart message — attachments visible in raw view] — view raw

On Sun, 2016-01-24 at 21:59 +0000, Luis Henriques wrote:
> 3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.
> 
> ---8<------------------------------------------------------------
> 
> From: Michal Hocko <mhocko@suse.com>
> 
> commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
[...]
> [ luis: backported to 3.16, based on Ben's backport to 3.2:
>   - use schedule_delayed_work instead of queue_delayed_work_on function
>     vmstat_update()
[...]

You're (correctly) changing it to use queue_delayed_work(), not
schedule_delayed_work() as it previously did.

Ben.

-- 
Ben Hutchings
Time is nature's way of making sure that everything doesn't happen at once.

[toc] | [prev] | [next] | [standalone]

#1316474 — Re: [PATCH 3.16.y-ckt 043/128] mm, vmstat: allow WQ concurrency to discover memory reclaim doesn't make any progress

On Sun, Jan 24, 2016 at 10:14:37PM +0000, Ben Hutchings wrote:
> On Sun, 2016-01-24 at 21:59 +0000, Luis Henriques wrote:
> > 3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.
> > 
> > ---8<------------------------------------------------------------
> > 
> > From: Michal Hocko <mhocko@suse.com>
> > 
> > commit 373ccbe5927034b55bdc80b0f8b54d6e13fe8d12 upstream.
> [...]
> > [ luis: backported to 3.16, based on Ben's backport to 3.2:
> >   - use schedule_delayed_work instead of queue_delayed_work_on function
> >     vmstat_update()
> [...]
> 
> You're (correctly) changing it to use queue_delayed_work(), not
> schedule_delayed_work() as it previously did.
>

Ups, that's correct.  I'll fix this note.  Thanks Ben.

Cheers,
--
Luís


> Ben.
> 
> -- 
> Ben Hutchings
> Time is nature's way of making sure that everything doesn't happen at once.

[toc] | [prev] | [next] | [standalone]

#1316054 — [PATCH 3.16.y-ckt 081/128] xen/pciback: Do not install an IRQ handler for MSI interrupts.

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit a396f3a210c3a61e94d6b87ec05a75d0be2a60d0 upstream.

Otherwise an guest can subvert the generic MSI code to trigger
an BUG_ON condition during MSI interrupt freeing:

 for (i = 0; i < entry->nvec_used; i++)
        BUG_ON(irq_has_action(entry->irq + i));

Xen PCI backed installs an IRQ handler (request_irq) for
the dev->irq whenever the guest writes PCI_COMMAND_MEMORY
(or PCI_COMMAND_IO) to the PCI_COMMAND register. This is
done in case the device has legacy interrupts the GSI line
is shared by the backend devices.

To subvert the backend the guest needs to make the backend
to change the dev->irq from the GSI to the MSI interrupt line,
make the backend allocate an interrupt handler, and then command
the backend to free the MSI interrupt and hit the BUG_ON.

Since the backend only calls 'request_irq' when the guest
writes to the PCI_COMMAND register the guest needs to call
XEN_PCI_OP_enable_msi before any other operation. This will
cause the generic MSI code to setup an MSI entry and
populate dev->irq with the new PIRQ value.

Then the guest can write to PCI_COMMAND PCI_COMMAND_MEMORY
and cause the backend to setup an IRQ handler for dev->irq
(which instead of the GSI value has the MSI pirq). See
'xen_pcibk_control_isr'.

Then the guest disables the MSI: XEN_PCI_OP_disable_msi
which ends up triggering the BUG_ON condition in 'free_msi_irqs'
as there is an IRQ handler for the entry->irq (dev->irq).

Note that this cannot be done using MSI-X as the generic
code does not over-write dev->irq with the MSI-X PIRQ values.

The patch inhibits setting up the IRQ handler if MSI or
MSI-X (for symmetry reasons) code had been called successfully.

P.S.
Xen PCIBack when it sets up the device for the guest consumption
ends up writting 0 to the PCI_COMMAND (see xen_pcibk_reset_device).
XSA-120 addendum patch removed that - however when upstreaming said
addendum we found that it caused issues with qemu upstream. That
has now been fixed in qemu upstream.

This is part of XSA-157

Reviewed-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 029f33ddb8bf..d0696ce31e9b 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -70,6 +70,13 @@ static void xen_pcibk_control_isr(struct pci_dev *dev, int reset)
 		enable ? "enable" : "disable");
 
 	if (enable) {
+		/*
+		 * The MSI or MSI-X should not have an IRQ handler. Otherwise
+		 * if the guest terminates we BUG_ON in free_msi_irqs.
+		 */
+		if (dev->msi_enabled || dev->msix_enabled)
+			goto out;
+
 		rc = request_irq(dev_data->irq,
 				xen_pcibk_guest_interrupt, IRQF_SHARED,
 				dev_data->irq_name, dev);

[toc] | [prev] | [next] | [standalone]

#1316055 — [PATCH 3.16.y-ckt 083/128] xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit 408fb0e5aa7fda0059db282ff58c3b2a4278baa0 upstream.

commit f598282f51 ("PCI: Fix the NIU MSI-X problem in a better way")
teaches us that dealing with MSI-X can be troublesome.

Further checks in the MSI-X architecture shows that if the
PCI_COMMAND_MEMORY bit is turned of in the PCI_COMMAND we
may not be able to access the BAR (since they are memory regions).

Since the MSI-X tables are located in there.. that can lead
to us causing PCIe errors. Inhibit us performing any
operation on the MSI-X unless the MEMORY bit is set.

Note that Xen hypervisor with:
"x86/MSI-X: access MSI-X table only after having enabled MSI-X"
will return:
xen_pciback: 0000:0a:00.1: error -6 enabling MSI-X for guest 3!

When the generic MSI code tries to setup the PIRQ without
MEMORY bit set. Which means with later versions of Xen
(4.6) this patch is not neccessary.

This is part of XSA-157

Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 4ee5fc080483..73dafdc494aa 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -212,6 +212,7 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
 	struct xen_pcibk_dev_data *dev_data;
 	int i, result;
 	struct msix_entry *entries;
+	u16 cmd;
 
 	if (unlikely(verbose_request))
 		printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
@@ -223,7 +224,12 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
 	if (dev->msix_enabled)
 		return -EALREADY;
 
-	if (dev->msi_enabled)
+	/*
+	 * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
+	 * to access the BARs where the MSI-X entries reside.
+	 */
+	pci_read_config_word(dev, PCI_COMMAND, &cmd);
+	if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
 		return -ENXIO;
 
 	entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);

[toc] | [prev] | [next] | [standalone]

#1316056 — [PATCH 3.16.y-ckt 063/128] tty: Fix GPF in flush_to_ldisc()

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Peter Hurley <peter@hurleysoftware.com>

commit 9ce119f318ba1a07c29149301f1544b6c4bea52a upstream.

A line discipline which does not define a receive_buf() method can
can cause a GPF if data is ever received [1]. Oddly, this was known
to the author of n_tracesink in 2011, but never fixed.

[1] GPF report
    BUG: unable to handle kernel NULL pointer dereference at           (null)
    IP: [<          (null)>]           (null)
    PGD 3752d067 PUD 37a7b067 PMD 0
    Oops: 0010 [#1] SMP KASAN
    Modules linked in:
    CPU: 2 PID: 148 Comm: kworker/u10:2 Not tainted 4.4.0-rc2+ #51
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
    Workqueue: events_unbound flush_to_ldisc
    task: ffff88006da94440 ti: ffff88006db60000 task.ti: ffff88006db60000
    RIP: 0010:[<0000000000000000>]  [<          (null)>]           (null)
    RSP: 0018:ffff88006db67b50  EFLAGS: 00010246
    RAX: 0000000000000102 RBX: ffff88003ab32f88 RCX: 0000000000000102
    RDX: 0000000000000000 RSI: ffff88003ab330a6 RDI: ffff88003aabd388
    RBP: ffff88006db67c48 R08: ffff88003ab32f9c R09: ffff88003ab31fb0
    R10: ffff88003ab32fa8 R11: 0000000000000000 R12: dffffc0000000000
    R13: ffff88006db67c20 R14: ffffffff863df820 R15: ffff88003ab31fb8
    FS:  0000000000000000(0000) GS:ffff88006dc00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    CR2: 0000000000000000 CR3: 0000000037938000 CR4: 00000000000006e0
    Stack:
     ffffffff829f46f1 ffff88006da94bf8 ffff88006da94bf8 0000000000000000
     ffff88003ab31fb0 ffff88003aabd438 ffff88003ab31ff8 ffff88006430fd90
     ffff88003ab32f9c ffffed0007557a87 1ffff1000db6cf78 ffff88003ab32078
    Call Trace:
     [<ffffffff8127cf91>] process_one_work+0x8f1/0x17a0 kernel/workqueue.c:2030
     [<ffffffff8127df14>] worker_thread+0xd4/0x1180 kernel/workqueue.c:2162
     [<ffffffff8128faaf>] kthread+0x1cf/0x270 drivers/block/aoe/aoecmd.c:1302
     [<ffffffff852a7c2f>] ret_from_fork+0x3f/0x70 arch/x86/entry/entry_64.S:468
    Code:  Bad RIP value.
    RIP  [<          (null)>]           (null)
     RSP <ffff88006db67b50>
    CR2: 0000000000000000
    ---[ end trace a587f8947e54d6ea ]---

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/tty/tty_buffer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 143deb62467d..12446e9a4435 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -411,7 +411,7 @@ receive_buf(struct tty_struct *tty, struct tty_buffer *head, int count)
 		count = disc->ops->receive_buf2(tty, p, f, count);
 	else {
 		count = min_t(int, count, tty->receive_room);
-		if (count)
+		if (count && disc->ops->receive_buf)
 			disc->ops->receive_buf(tty, p, f, count);
 	}
 	head->read += count;

[toc] | [prev] | [next] | [standalone]

#1316057 — [PATCH 3.16.y-ckt 059/128] Revert "SCSI: Fix NULL pointer dereference in runtime PM"

3.16.7-ckt23 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ken Xue <ken.xue@amd.com>

commit 1c69d3b6eb73e466ecbb8edaf1bc7fd585b288da upstream.

This reverts commit 49718f0fb8c9 ("SCSI: Fix NULL pointer dereference in
runtime PM")

The old commit may lead to a issue that blk_{pre|post}_runtime_suspend and
blk_{pre|post}_runtime_resume may not be called in pairs.

Take sr device as example, when sr device goes to runtime suspend,
blk_{pre|post}_runtime_suspend will be called since sr device defined
pm->runtime_suspend. But blk_{pre|post}_runtime_resume will not be called
since sr device doesn't have pm->runtime_resume. so, sr device can not
resume correctly anymore.

More discussion can be found from below link.
http://marc.info/?l=linux-scsi&m=144163730531875&w=2

Signed-off-by: Ken Xue <Ken.Xue@amd.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Xiangliang Yu <Xiangliang.Yu@amd.com>
Cc: James E.J. Bottomley <JBottomley@odin.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Michael Terry <Michael.terry@canonical.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/scsi/scsi_pm.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c
index a2dcf6a54ec6..75320dad9677 100644
--- a/drivers/scsi/scsi_pm.c
+++ b/drivers/scsi/scsi_pm.c
@@ -221,13 +221,13 @@ static int sdev_runtime_suspend(struct device *dev)
 	struct scsi_device *sdev = to_scsi_device(dev);
 	int err = 0;
 
-	if (pm && pm->runtime_suspend) {
-		err = blk_pre_runtime_suspend(sdev->request_queue);
-		if (err)
-			return err;
+	err = blk_pre_runtime_suspend(sdev->request_queue);
+	if (err)
+		return err;
+	if (pm && pm->runtime_suspend)
 		err = pm->runtime_suspend(dev);
-		blk_post_runtime_suspend(sdev->request_queue, err);
-	}
+	blk_post_runtime_suspend(sdev->request_queue, err);
+
 	return err;
 }
 
@@ -250,11 +250,11 @@ static int sdev_runtime_resume(struct device *dev)
 	const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 	int err = 0;
 
-	if (pm && pm->runtime_resume) {
-		blk_pre_runtime_resume(sdev->request_queue);
+	blk_pre_runtime_resume(sdev->request_queue);
+	if (pm && pm->runtime_resume)
 		err = pm->runtime_resume(dev);
-		blk_post_runtime_resume(sdev->request_queue, err);
-	}
+	blk_post_runtime_resume(sdev->request_queue, err);
+
 	return err;
 }
 

[toc] | [prev] | [next] | [standalone]

Page 3 of 7 — ← Prev page 1 2 [3] 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web