Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1324372 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2016-02-02 19:20 +0100 |
| Last post | 2016-02-02 20:10 +0100 |
| Articles | 20 on this page of 125 — 1 participant |
Back to article view | Back to linux.kernel
[3.13.y-ckt stable] Linux 3.13.11-ckt34 stable review Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 030/136] posix-clock: Fix return code on the poll method's error path Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 133/136] phonet: properly unshare skbs in phonet_rcv() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 051/136] iwlwifi: update and fix 7265 series PCI IDs Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 084/136] ALSA: timer: Harden slave timer list handling Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 074/136] mmc: mmci: fix an ages old detection error Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 076/136] sparc64: fix incorrect sign extension in sys_sparc64_personality Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 008/136] drm/radeon: call hpd_irq_event on resume Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 059/136] s390: fix normalization bug in exception table sorting Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 107/136] SCSI: initio: remove duplicate module device table Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 128/136] unix: properly account for FDs passed over unix sockets Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 135/136] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 001/136] drm/nv4c/mc: nv4x igp's have a different msi rearm register Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 113/136] kconfig: return 'false' instead of 'no' in bool function Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 021/136] futex: Drop refcount if requeue_pi() acquired the rtmutex Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:20 +0100
[PATCH 3.13.y-ckt 114/136] perf/x86: Fix filter_events() bug with event mappings Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 116/136] firmware: actually return NULL on failed request_firmware_nowait() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 115/136] power: test_power: correctly handle empty writes Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 127/136] connector: bump skb->users before callback invocation Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 121/136] batman-adv: Drop immediate orig_node free function Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 117/136] mmc: sd: limit SD card power limit according to cards capabilities Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 131/136] tcp_yeah: don't set ssthresh below 2 Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 123/136] mmc: debugfs: correct wrong voltage value Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 063/136] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 122/136] printk: help pr_debug and pr_devel to optimize out arguments Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 130/136] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 118/136] Btrfs: clean up an error code in btrfs_init_space_info() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 126/136] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 132/136] bonding: Prevent IPv6 link local address on enslaved devices Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 125/136] veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 119/136] batman-adv: Avoid recursive call_rcu for batadv_bla_claim Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 129/136] bridge: Only call /sbin/bridge-stp for the initial network namespace Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 120/136] batman-adv: Avoid recursive call_rcu for batadv_nc_node Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:30 +0100
[PATCH 3.13.y-ckt 106/136] [media] rc: allow rc modules to be loaded if rc-main is not a module Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 097/136] ALSA: hrtimer: Fix stall by hrtimer_cancel() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 096/136] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 110/136] mtd: nand: fix ONFI parameter page layout Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 101/136] crypto: algif_skcipher - Load TX SG list after waiting Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 109/136] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 100/136] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 112/136] pinctrl: bcm2835: Fix memory leak in error path Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 099/136] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 111/136] ALSA: fm801: propagate TUNER_ONLY bit when autodetected Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 094/136] crypto: hash - Add crypto_ahash_has_setkey Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 104/136] iscsi-target: Fix potential dead-lock during node acl delete Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 098/136] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 087/136] panic: release stale console lock to always get the logbuf printed out Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 108/136] clk: xgene: Fix divider with non-zero shift value Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 102/136] crypto: crc32c - Fix crc32c soft dependency Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 103/136] IB/qib: fix mcast detach when qp not attached Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 095/136] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 085/136] mm: soft-offline: check return value in second __get_any_page() call Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 105/136] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 088/136] kernel/panic.c: turn off locks debug before releasing console lock Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:40 +0100
[PATCH 3.13.y-ckt 081/136] dma-debug: switch check from _text to _stext Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 060/136] xfs: inode recovery readahead can race with inode buffer creation Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 062/136] Input: elantech - mark protocols v2 and v3 as semi-mt Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 055/136] uml: fix hostfs mknod() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 067/136] virtio_balloon: fix race between migration and ballooning Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 083/136] ocfs2/dlm: ignore cleaning the migration mle that is inuse Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 079/136] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 064/136] ALSA: seq: Fix missing NULL check at remove_events ioctl Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 078/136] cifs: fix race between call_async() and reconnect() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 065/136] ALSA: seq: Fix race at timer setup and close Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 072/136] dmaengine: dw: fix cyclic transfer setup Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 093/136] crypto: af_alg - Add nokey compatibility path Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 075/136] ALSA: timer: Fix race among timer ioctls Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 070/136] powerpc/module: Handle R_PPC64_ENTRY relocations Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 086/136] memcg: only free spare array when readers are done Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 092/136] crypto: af_alg - Fix socket double-free when accept fails Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 069/136] scripts/recordmcount.pl: support data in text section on powerpc Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 061/136] clocksource/drivers/vt8500: Increase the minimum delta Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 080/136] m32r: fix m32104ut_defconfig build fail Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 091/136] crypto: af_alg - Disallow bind/setkey/... after accept(2) Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 073/136] dmaengine: dw: fix cyclic transfer callbacks Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 058/136] x86/boot: Double BOOT_HEAP_SIZE to 64KB Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 082/136] scripts/bloat-o-meter: fix python3 syntax error Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 071/136] ALSA: timer: Fix double unlink of active_list Kamal Mostafa <kamal@canonical.com> - 2016-02-02 19:50 +0100
[PATCH 3.13.y-ckt 041/136] bcache: allows use of register in udev to avoid "device_busy" error. Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 056/136] uml: flush stdout before forking Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 046/136] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 050/136] PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 049/136] udf: Check output buffer length when converting name to CS0 Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 031/136] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 037/136] bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 042/136] bcache: prevent crash on changing writeback_running Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 033/136] rtlwifi: rtl8192ce: Fix handling of module parameters Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 038/136] bcache: fix a leak in bch_cached_dev_run() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 036/136] bcache: Add a cond_resched() call to gc Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 048/136] udf: Prevent buffer overrun with multi-byte characters Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 035/136] bcache: fix a livelock when we cause a huge number of cache misses Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 043/136] bcache: Change refill_dirty() to always scan entire disk if necessary Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 032/136] rtlwifi: rtl8192se: Fix module parameter initialization Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 045/136] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 034/136] rtlwifi: rtl8192cu: Add missing parameter setup Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 053/136] ASoC: compress: Fix compress device direction check Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 047/136] x86/xen: don't reset vcpu_info on a cancelled suspend Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 040/136] bcache: add mutex lock for bch_is_open Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 052/136] locks: fix unlock when fcntl_setlk races with a close Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 044/136] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 057/136] drm/nouveau/kms: take mode_config mutex in connector hotplug path Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 039/136] bcache: unregister reboot notifier if bcache fails to unregister device Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 054/136] dm snapshot: fix hung bios when copy error occurs Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:00 +0100
[PATCH 3.13.y-ckt 020/136] dm thin: fix race condition when destroying thin pool workqueue Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 005/136] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 027/136] USB: cp210x: add ID for ELV Marble Sound Board 1 Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 016/136] EDAC: Robustify workqueues destruction Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 015/136] EDAC: Don't try to cancel workqueue when it's never setup Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 011/136] time: Avoid signed overflow in timekeeping_get_ns() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 009/136] xhci: refuse loading if nousb is used Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 024/136] mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 023/136] mmc: sdio: Fix invalid vdd in voltage switch power cycle Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 019/136] dm space map metadata: remove unused variable in brb_pop() Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 014/136] EDAC, mc_sysfs: Fix freeing bus' name Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 025/136] udf: limit the maximum number of indirect extents in a row Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 018/136] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 002/136] drm/nv4c/mc: disable msi Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 007/136] KVM: x86: correctly print #AC in traces Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 029/136] NFS: Fix attribute cache revalidation Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 003/136] drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 013/136] wlcore/wl12xx: spi: fix oops on firmware load Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 028/136] NFSv4: Don't perform cached access checks before we've OPENed the file Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 004/136] [media] gspca: ov534/topro: prevent a division by 0 Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 006/136] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
[PATCH 3.13.y-ckt 010/136] arm64: Clear out any singlestep state on a ptrace detach operation Kamal Mostafa <kamal@canonical.com> - 2016-02-02 20:10 +0100
Page 1 of 7 [1] 2 3 4 5 6 7 Next page →
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [3.13.y-ckt stable] Linux 3.13.11-ckt34 stable review |
| Message-ID | <qXNIu-6Z3-7@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 3.13.11-ckt34 stable
kernel.
This version contains 136 new patches, summarized below. The new patches
are posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.13.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.13.y-review
The review period for version 3.13.11-ckt34 will be open for the next three
days. To report a problem, please reply to the relevant follow-up patch
message.
For more information about the Linux 3.13.y-ckt extended stable kernel
series, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Kamal
--
arch/arm64/kernel/ptrace.c | 6 +++
arch/m32r/kernel/setup.c | 3 ++
arch/parisc/include/uapi/asm/siginfo.h | 4 ++
arch/powerpc/include/asm/cmpxchg.h | 16 +++----
arch/powerpc/include/asm/synch.h | 2 +-
arch/powerpc/include/uapi/asm/elf.h | 4 +-
arch/powerpc/kernel/module_64.c | 27 +++++++++++
arch/s390/mm/extable.c | 8 +++-
arch/sparc/kernel/sys_sparc_64.c | 2 +-
arch/um/os-Linux/start_up.c | 2 +
arch/x86/include/asm/boot.h | 2 +-
arch/x86/kernel/cpu/perf_event.c | 11 ++++-
arch/x86/kernel/reboot.c | 8 ++++
arch/x86/kvm/trace.h | 2 +-
arch/x86/xen/suspend.c | 3 +-
crypto/af_alg.c | 55 +++++++++++++++++++---
crypto/ahash.c | 5 +-
crypto/algif_skcipher.c | 14 +++---
crypto/shash.c | 4 +-
drivers/base/firmware_class.c | 8 ++--
drivers/clk/clk-xgene.c | 3 +-
drivers/clocksource/vt8500_timer.c | 6 ++-
drivers/connector/connector.c | 11 ++---
drivers/dma/dw/core.c | 43 +++++++----------
drivers/edac/edac_device.c | 12 ++---
drivers/edac/edac_mc.c | 14 ++----
drivers/edac/edac_mc_sysfs.c | 18 +++++--
drivers/edac/edac_pci.c | 9 ++--
drivers/gpu/drm/nouveau/Makefile | 1 +
drivers/gpu/drm/nouveau/core/engine/device/nv40.c | 12 ++---
drivers/gpu/drm/nouveau/core/include/subdev/mc.h | 1 +
drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h | 1 +
drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c | 2 +-
drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c | 37 +++++++++++++++
drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +
drivers/gpu/drm/radeon/radeon_atombios.c | 12 ++---
drivers/gpu/drm/radeon/radeon_device.c | 1 +
drivers/infiniband/hw/mlx4/ah.c | 1 +
drivers/infiniband/hw/qib/qib_verbs_mcast.c | 35 ++++++--------
drivers/input/mouse/elantech.c | 2 +-
drivers/input/serio/i8042-x86ia64io.h | 7 +++
drivers/md/bcache/btree.c | 5 +-
drivers/md/bcache/super.c | 18 +++++--
drivers/md/bcache/writeback.c | 37 ++++++++++++---
drivers/md/bcache/writeback.h | 3 +-
drivers/md/dm-exception-store.h | 2 +-
drivers/md/dm-snap-persistent.c | 5 +-
drivers/md/dm-snap-transient.c | 4 +-
drivers/md/dm-snap.c | 20 ++------
drivers/md/dm-thin.c | 2 +-
drivers/md/persistent-data/dm-space-map-metadata.c | 3 --
drivers/media/dvb-core/dvb_frontend.c | 6 +--
drivers/media/rc/rc-main.c | 2 +-
drivers/media/usb/gspca/ov534.c | 9 +++-
drivers/media/usb/gspca/topro.c | 6 ++-
drivers/mmc/core/debugfs.c | 2 +-
drivers/mmc/core/sd.c | 20 ++++++--
drivers/mmc/core/sdio.c | 2 +-
drivers/mmc/host/mmci.c | 2 +-
drivers/mmc/host/sdhci.c | 4 +-
drivers/net/bonding/bond_main.c | 5 +-
drivers/net/team/team.c | 6 +--
drivers/net/veth.c | 6 ---
drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +-
drivers/net/wireless/iwlwifi/pcie/drv.c | 5 +-
drivers/net/wireless/rtlwifi/rtl8192ce/sw.c | 2 +
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 2 +
drivers/net/wireless/rtlwifi/rtl8192de/sw.c | 4 +-
drivers/net/wireless/rtlwifi/rtl8192se/sw.c | 6 ++-
drivers/net/wireless/rtlwifi/usb.c | 2 +
drivers/net/wireless/ti/wlcore/io.h | 10 ++--
drivers/net/wireless/ti/wlcore/spi.c | 10 ++--
drivers/pci/host/pci-exynos.c | 3 +-
drivers/pci/host/pci-tegra.c | 2 +-
drivers/pinctrl/pinctrl-bcm2835.c | 2 +-
drivers/power/test_power.c | 2 +
drivers/scsi/initio.c | 16 -------
drivers/target/iscsi/iscsi_target_configfs.c | 16 ++++++-
drivers/usb/host/xhci.c | 4 ++
drivers/usb/serial/cp210x.c | 1 +
drivers/virtio/virtio_balloon.c | 2 +-
fs/btrfs/extent-tree.c | 2 +-
fs/cifs/cifs_debug.c | 2 +-
fs/cifs/cifs_debug.h | 10 ++--
fs/cifs/connect.c | 2 +-
fs/cifs/readdir.c | 1 +
fs/cifs/transport.c | 6 ++-
fs/hostfs/hostfs_kern.c | 4 +-
fs/locks.c | 51 +++++++++++---------
fs/nfs/dir.c | 3 ++
fs/nfs/inode.c | 54 +++++++++++++++------
fs/nfs/nfs4proc.c | 2 +-
fs/ocfs2/dlm/dlmmaster.c | 26 +++++-----
fs/ocfs2/dlmglue.c | 6 +++
fs/udf/inode.c | 15 ++++++
fs/udf/unicode.c | 21 +++++++--
fs/xfs/xfs_ag.h | 2 +-
fs/xfs/xfs_buf.c | 7 +++
fs/xfs/xfs_inode_buf.c | 12 +++--
include/crypto/hash.h | 7 +++
include/crypto/if_alg.h | 11 +++--
include/linux/console.h | 1 +
include/linux/mtd/nand.h | 4 +-
include/linux/printk.h | 12 ++---
include/linux/sched.h | 1 +
include/net/inet_ecn.h | 19 ++++++--
kernel/futex.c | 5 ++
kernel/panic.c | 12 +++++
kernel/printk/printk.c | 35 +++++++++++++-
kernel/time/posix-clock.c | 4 +-
kernel/time/timekeeping.c | 3 +-
lib/dma-debug.c | 2 +-
lib/libcrc32c.c | 1 +
mm/balloon_compaction.c | 4 +-
mm/memcontrol.c | 11 +++--
mm/memory-failure.c | 2 +-
net/batman-adv/bridge_loop_avoidance.c | 10 ++--
net/batman-adv/network-coding.c | 19 ++++----
net/batman-adv/originator.c | 11 -----
net/batman-adv/originator.h | 1 -
net/batman-adv/translation-table.c | 28 +++++------
net/bridge/br_stp_if.c | 5 +-
net/ipv4/tcp_yeah.c | 2 +-
net/ipv4/xfrm4_policy.c | 46 ++++++++++++++----
net/ipv6/xfrm6_mode_tunnel.c | 2 +-
net/ipv6/xfrm6_policy.c | 53 +++++++++++++++------
net/phonet/af_phonet.c | 4 ++
net/sctp/sm_statefuns.c | 6 ++-
net/sctp/socket.c | 3 +-
net/sctp/sysctl.c | 2 +-
net/unix/af_unix.c | 24 ++++++++--
net/unix/garbage.c | 16 +++++--
net/xfrm/xfrm_policy.c | 38 ---------------
scripts/bloat-o-meter | 8 ++--
scripts/kconfig/menu.c | 2 +-
scripts/recordmcount.pl | 3 +-
sound/core/control.c | 2 +
sound/core/hrtimer.c | 3 +-
sound/core/pcm_compat.c | 13 +++--
sound/core/seq/seq_clientmgr.c | 2 +-
sound/core/seq/seq_compat.c | 9 ++--
sound/core/seq/seq_queue.c | 2 +
sound/core/timer.c | 52 +++++++++++++-------
sound/pci/fm801.c | 4 ++
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/soc-compress.c | 23 +++++++--
tools/lib/traceevent/event-parse.c | 5 +-
147 files changed, 938 insertions(+), 497 deletions(-)
Aaron Conole (1):
printk: help pr_debug and pr_devel to optimize out arguments
Adrian Hunter (2):
mmc: sdio: Fix invalid vdd in voltage switch power cycle
mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off()
Al Viro (1):
bcache: fix a leak in bch_cached_dev_run()
Alex Deucher (2):
drm/radeon: call hpd_irq_event on resume
drm/radeon: clean up fujitsu quirks
Andrew Elble (1):
nfs: Fix race in __update_open_stateid()
Andrew Gabbasov (2):
udf: Prevent buffer overrun with multi-byte characters
udf: Check output buffer length when converting name to CS0
Andy Shevchenko (1):
ALSA: fm801: propagate TUNER_ONLY bit when autodetected
Antonio Ospite (1):
[media] gspca: ov534/topro: prevent a division by 0
Ard Biesheuvel (1):
s390: fix normalization bug in exception table sorting
Arnd Bergmann (1):
SCSI: initio: remove duplicate module device table
Aurélien Francillon (1):
Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
Ben Skeggs (1):
drm/nouveau/kms: take mode_config mutex in connector hotplug path
Benjamin Tissoires (1):
Input: elantech - mark protocols v2 and v3 as semi-mt
Boqun Feng (2):
powerpc: Make value-returning atomics fully ordered
powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered
Boris BREZILLON (1):
mtd: nand: fix ONFI parameter page layout
Borislav Petkov (2):
EDAC, mc_sysfs: Fix freeing bus' name
EDAC: Robustify workqueues destruction
Brian Norris (1):
firmware: actually return NULL on failed request_firmware_nowait()
Chuanxiao Dong (1):
mmc: debugfs: correct wrong voltage value
Dan Carpenter (2):
ath9k_htc: check for underflow in ath9k_htc_rx_msg()
Btrfs: clean up an error code in btrfs_init_space_info()
Dan Streetman (1):
xfrm: dst_entries_init() per-net dst_ops
Darrick J. Wong (1):
libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
Dave Chinner (1):
xfs: inode recovery readahead can race with inode buffer creation
David Gibson (1):
time: Avoid signed overflow in timekeeping_get_ns()
Dmitry V. Levin (1):
sparc64: fix incorrect sign extension in sys_sparc64_personality
Eric Dumazet (2):
phonet: properly unshare skbs in phonet_rcv()
ipv6: update skb->csum when CE mark is propagated
Florian Westphal (1):
connector: bump skb->users before callback invocation
Gabriel de Perthuis (1):
bcache: allows use of register in udev to avoid "device_busy" error.
Grygorii Strashko (1):
PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD
H.J. Lu (1):
x86/boot: Double BOOT_HEAP_SIZE to 64KB
Hannes Frederic Sowa (1):
bridge: Only call /sbin/bridge-stp for the initial network namespace
Hans de Goede (1):
drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c
Helge Deller (1):
parisc: Fix __ARCH_SI_PREAMBLE_SIZE
Herbert Xu (7):
crypto: af_alg - Disallow bind/setkey/... after accept(2)
crypto: af_alg - Fix socket double-free when accept fails
crypto: af_alg - Add nokey compatibility path
crypto: hash - Add crypto_ahash_has_setkey
crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path
crypto: af_alg - Forbid bind(2) when nokey child sockets are present
crypto: algif_skcipher - Load TX SG list after waiting
Ido Schimmel (1):
team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid
Ilia Mirkin (2):
drm/nv4c/mc: nv4x igp's have a different msi rearm register
drm/nv4c/mc: disable msi
Jamie Bainbridge (1):
cifs: Ratelimit kernel log messages
Jean Delvare (1):
crypto: crc32c - Fix crc32c soft dependency
Jeff Layton (1):
locks: fix unlock when fcntl_setlk races with a close
Jianjian Huo (1):
bcache: add mutex lock for bch_is_open
John Blackwood (1):
arm64: Clear out any singlestep state on a ptrace detach operation
Karl Heiss (1):
bonding: Prevent IPv6 link local address on enslaved devices
Kent Overstreet (2):
bcache: Add a cond_resched() call to gc
bcache: Change refill_dirty() to always scan entire disk if necessary
Larry Finger (4):
rtlwifi: rtl8192de: Fix incorrect module parameter descriptions
rtlwifi: rtl8192se: Fix module parameter initialization
rtlwifi: rtl8192ce: Fix handling of module parameters
rtlwifi: rtl8192cu: Add missing parameter setup
Laura Abbott (1):
dma-debug: switch check from _text to _stext
Linus Walleij (1):
mmc: mmci: fix an ages old detection error
Loc Ho (1):
clk: xgene: Fix divider with non-zero shift value
Malcolm Priestley (1):
[media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode
Mans Rullgard (2):
dmaengine: dw: fix cyclic transfer setup
dmaengine: dw: fix cyclic transfer callbacks
Mario Kleiner (1):
x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[]
Martijn Coenen (1):
memcg: only free spare array when readers are done
Matan Barak (1):
IB/mlx4: Initialize hop_limit when creating address handle
Mike Marciniszyn (1):
IB/qib: fix mcast detach when qp not attached
Mike Snitzer (1):
dm space map metadata: remove unused variable in brb_pop()
Mikulas Patocka (1):
dm snapshot: fix hung bios when copy error occurs
Minchan Kim (2):
virtio_balloon: fix race by fill and leak
virtio_balloon: fix race between migration and ballooning
Naoya Horiguchi (1):
mm: soft-offline: check return value in second __get_any_page() call
Neal Cardwell (1):
tcp_yeah: don't set ssthresh below 2
Nicholas Bellinger (1):
iscsi-target: Fix potential dead-lock during node acl delete
Nicolas Boichat (2):
ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode
ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode
Nikolay Borisov (1):
dm thin: fix race condition when destroying thin pool workqueue
Oliver Freyermuth (1):
USB: cp210x: add ID for ELV Marble Sound Board 1
Oliver Neukum (1):
xhci: refuse loading if nousb is used
Oren Givon (1):
iwlwifi: update and fix 7265 series PCI IDs
Ouyang Zhaowei (Charles) (1):
x86/xen: don't reset vcpu_info on a cancelled suspend
Paolo Bonzini (1):
KVM: x86: correctly print #AC in traces
Peter Wu (1):
rtlwifi: fix memory leak for USB device
Rabin Vincent (1):
cifs: fix race between call_async() and reconnect()
Richard Cochran (1):
posix-clock: Fix return code on the poll method's error path
Roman Volkov (1):
clocksource/drivers/vt8500: Increase the minimum delta
Russell King (2):
[media] rc: allow rc modules to be loaded if rc-main is not a module
mmc: sd: limit SD card power limit according to cards capabilities
Sasha Levin (2):
power: test_power: correctly handle empty writes
net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory
Sergey Senozhatsky (1):
scripts/bloat-o-meter: fix python3 syntax error
Stefan Bader (1):
bcache: prevent crash on changing writeback_running
Stefan Wahren (1):
pinctrl: bcm2835: Fix memory leak in error path
Stephane Eranian (1):
perf/x86: Fix filter_events() bug with event mappings
Stephen Boyd (1):
EDAC: Don't try to cancel workqueue when it's never setup
Steven Rostedt (1):
tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines
Sudip Mukherjee (1):
m32r: fix m32104ut_defconfig build fail
Sven Eckelmann (3):
batman-adv: Avoid recursive call_rcu for batadv_bla_claim
batman-adv: Avoid recursive call_rcu for batadv_nc_node
batman-adv: Drop immediate orig_node free function
Takashi Iwai (8):
ALSA: seq: Fix missing NULL check at remove_events ioctl
ALSA: seq: Fix race at timer setup and close
ALSA: timer: Fix double unlink of active_list
ALSA: timer: Fix race among timer ioctls
ALSA: timer: Harden slave timer list handling
ALSA: hda - Fix bass pin fixup for ASUS N550JX
ALSA: hrtimer: Fix stall by hrtimer_cancel()
ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0
Tariq Saeed (1):
ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock
Tejun Heo (1):
printk: do cond_resched() between lines while outputting to consoles
Thomas Gleixner (1):
futex: Drop refcount if requeue_pi() acquired the rtmutex
Trond Myklebust (2):
NFSv4: Don't perform cached access checks before we've OPENed the file
NFS: Fix attribute cache revalidation
Ulrich Weigand (2):
scripts/recordmcount.pl: support data in text section on powerpc
powerpc/module: Handle R_PPC64_ENTRY relocations
Uri Mashiach (2):
wlcore/wl12xx: spi: fix oops on firmware load
wlcore/wl12xx: spi: fix NULL pointer dereference (Oops)
Vasily Averin (1):
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
Vegard Nossum (4):
udf: limit the maximum number of indirect extents in a row
uml: fix hostfs mknod()
uml: flush stdout before forking
kconfig: return 'false' instead of 'no' in bool function
Vijay Pandurangan (1):
veth: don’t modify ip_summed; doing so treats packets with bad checksums as good.
Vinod Koul (1):
ASoC: compress: Fix compress device direction check
Vitaly Kuznetsov (2):
panic: release stale console lock to always get the logbuf printed out
kernel/panic.c: turn off locks debug before releasing console lock
Xin Long (1):
sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close
Zheng Liu (3):
bcache: fix a livelock when we cause a huge number of cache misses
bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device
bcache: unregister reboot notifier if bcache fails to unregister device
willy tarreau (1):
unix: properly account for FDs passed over unix sockets
xuejiufei (1):
ocfs2/dlm: ignore cleaning the migration mle that is inuse
[toc] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 030/136] posix-clock: Fix return code on the poll method's error path |
| Message-ID | <qXNIw-6Z3-55@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Richard Cochran <richardcochran@gmail.com>
commit 1b9f23727abb92c5e58f139e7d180befcaa06fe0 upstream.
The posix_clock_poll function is supposed to return a bit mask of
POLLxxx values. However, in case the hardware has disappeared (due to
hot plugging for example) this code returns -ENODEV in a futile
attempt to throw an error at the file descriptor level. The kernel's
file_operations interface does not accept such error codes from the
poll method. Instead, this function aught to return POLLERR.
The value -ENODEV does, in fact, contain the POLLERR bit (and almost
all the other POLLxxx bits as well), but only by chance. This patch
fixes code to return a proper bit mask.
Credit goes to Markus Elfring for pointing out the suspicious
signed/unsigned mismatch.
Reported-by: Markus Elfring <elfring@users.sourceforge.net>
igned-off-by: Richard Cochran <richardcochran@gmail.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Julia Lawall <julia.lawall@lip6.fr>
Link: http://lkml.kernel.org/r/1450819198-17420-1-git-send-email-richardcochran@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/time/posix-clock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index ce033c7..9cff0ab 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -69,10 +69,10 @@ static ssize_t posix_clock_read(struct file *fp, char __user *buf,
static unsigned int posix_clock_poll(struct file *fp, poll_table *wait)
{
struct posix_clock *clk = get_posix_clock(fp);
- int result = 0;
+ unsigned int result = 0;
if (!clk)
- return -ENODEV;
+ return POLLERR;
if (clk->ops.poll)
result = clk->ops.poll(clk, fp, wait);
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 133/136] phonet: properly unshare skbs in phonet_rcv() |
| Message-ID | <qXNIw-6Z3-53@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 7aaed57c5c2890634cfadf725173c7c68ea4cb4f ]
Ivaylo Dimitrov reported a regression caused by commit 7866a621043f
("dev: add per net_device packet type chains").
skb->dev becomes NULL and we crash in __netif_receive_skb_core().
Before above commit, different kind of bugs or corruptions could happen
without major crash.
But the root cause is that phonet_rcv() can queue skb without checking
if skb is shared or not.
Many thanks to Ivaylo Dimitrov for his help, diagnosis and tests.
Reported-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Remi Denis-Courmont <courmisch@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/phonet/af_phonet.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 5a940db..f022922 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -377,6 +377,10 @@ static int phonet_rcv(struct sk_buff *skb, struct net_device *dev,
struct sockaddr_pn sa;
u16 len;
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (!skb)
+ return NET_RX_DROP;
+
/* check we have at least a full Phonet header */
if (!pskb_pull(skb, sizeof(struct phonethdr)))
goto out;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 051/136] iwlwifi: update and fix 7265 series PCI IDs |
| Message-ID | <qXNIw-6Z3-59@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Oren Givon <oren.givon@intel.com>
commit 006bda75d81fd27a583a3b310e9444fea2aa6ef2 upstream.
Update and fix some 7265 PCI IDs entries.
Signed-off-by: Oren Givon <oren.givon@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/wireless/iwlwifi/pcie/drv.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 998b7bf..f19777c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -364,6 +364,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
{IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095A, 0x5C10, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x5510, iwl7265_2ac_cfg)},
@@ -379,10 +380,10 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
{IWL_PCI_DEVICE(0x095A, 0x9012, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x9112, iwl7265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x9210, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095B, 0x9200, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
- {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
+ {IWL_PCI_DEVICE(0x095B, 0x9310, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
{IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 084/136] ALSA: timer: Harden slave timer list handling |
| Message-ID | <qXNIw-6Z3-67@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Takashi Iwai <tiwai@suse.de>
commit b5a663aa426f4884c71cd8580adae73f33570f0d upstream.
A slave timer instance might be still accessible in a racy way while
operating the master instance as it lacks of locking. Since the
master operation is mostly protected with timer->lock, we should cope
with it while changing the slave instance, too. Also, some linked
lists (active_list and ack_list) of slave instances aren't unlinked
immediately at stopping or closing, and this may lead to unexpected
accesses.
This patch tries to address these issues. It adds spin lock of
timer->lock (either from master or slave, which is equivalent) in a
few places. For avoiding a deadlock, we ensure that the global
slave_active_lock is always locked at first before each timer lock.
Also, ack and active_list of slave instances are properly unlinked at
snd_timer_stop() and snd_timer_close().
Last but not least, remove the superfluous call of _snd_timer_stop()
at removing slave links. This is a noop, and calling it may confuse
readers wrt locking. Further cleanup will follow in a later patch.
Actually we've got reports of use-after-free by syzkaller fuzzer, and
this hopefully fixes these issues.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
sound/core/timer.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/sound/core/timer.c b/sound/core/timer.c
index bc405a3..4e436fe 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -215,11 +215,13 @@ static void snd_timer_check_master(struct snd_timer_instance *master)
slave->slave_id == master->slave_id) {
list_move_tail(&slave->open_list, &master->slave_list_head);
spin_lock_irq(&slave_active_lock);
+ spin_lock(&master->timer->lock);
slave->master = master;
slave->timer = master->timer;
if (slave->flags & SNDRV_TIMER_IFLG_RUNNING)
list_add_tail(&slave->active_list,
&master->slave_active_head);
+ spin_unlock(&master->timer->lock);
spin_unlock_irq(&slave_active_lock);
}
}
@@ -345,15 +347,18 @@ int snd_timer_close(struct snd_timer_instance *timeri)
timer->hw.close)
timer->hw.close(timer);
/* remove slave links */
+ spin_lock_irq(&slave_active_lock);
+ spin_lock(&timer->lock);
list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
open_list) {
- spin_lock_irq(&slave_active_lock);
- _snd_timer_stop(slave, 1, SNDRV_TIMER_EVENT_RESOLUTION);
list_move_tail(&slave->open_list, &snd_timer_slave_list);
slave->master = NULL;
slave->timer = NULL;
- spin_unlock_irq(&slave_active_lock);
+ list_del_init(&slave->ack_list);
+ list_del_init(&slave->active_list);
}
+ spin_unlock(&timer->lock);
+ spin_unlock_irq(&slave_active_lock);
mutex_unlock(®ister_mutex);
}
out:
@@ -440,9 +445,12 @@ static int snd_timer_start_slave(struct snd_timer_instance *timeri)
spin_lock_irqsave(&slave_active_lock, flags);
timeri->flags |= SNDRV_TIMER_IFLG_RUNNING;
- if (timeri->master)
+ if (timeri->master && timeri->timer) {
+ spin_lock(&timeri->timer->lock);
list_add_tail(&timeri->active_list,
&timeri->master->slave_active_head);
+ spin_unlock(&timeri->timer->lock);
+ }
spin_unlock_irqrestore(&slave_active_lock, flags);
return 1; /* delayed start */
}
@@ -488,6 +496,8 @@ static int _snd_timer_stop(struct snd_timer_instance * timeri,
if (!keep_flag) {
spin_lock_irqsave(&slave_active_lock, flags);
timeri->flags &= ~SNDRV_TIMER_IFLG_RUNNING;
+ list_del_init(&timeri->ack_list);
+ list_del_init(&timeri->active_list);
spin_unlock_irqrestore(&slave_active_lock, flags);
}
goto __end;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 074/136] mmc: mmci: fix an ages old detection error |
| Message-ID | <qXNIw-6Z3-71@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 0bcb7efdff63564e80fe84dd36a9fbdfbf6697a4 upstream.
commit 4956e10903fd ("ARM: 6244/1: mmci: add variant data and default
MCICLOCK support") added variant data for ARM, U300 and Ux500 variants.
The Nomadik NHK8815/8820 variant was erroneously labeled as a U300
variant, and when the proper Nomadik variant was later introduced in
commit 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik MMCI
variant") this was not fixes. Let's say this fixes the latter commit as
there was no proper Nomadik support until then.
Fixes: 34fd421349ff ("ARM: 7378/1: mmci: add support for the Nomadik...")
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/mmc/host/mmci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index f320579..45349a9 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -1862,7 +1862,7 @@ static struct amba_id mmci_ids[] = {
{
.id = 0x00280180,
.mask = 0x00ffffff,
- .data = &variant_u300,
+ .data = &variant_nomadik,
},
{
.id = 0x00480180,
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 076/136] sparc64: fix incorrect sign extension in sys_sparc64_personality |
| Message-ID | <qXNIw-6Z3-75@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: "Dmitry V. Levin" <ldv@altlinux.org>
commit 525fd5a94e1be0776fa652df5c687697db508c91 upstream.
The value returned by sys_personality has type "long int".
It is saved to a variable of type "int", which is not a problem
yet because the type of task_struct->pesonality is "unsigned int".
The problem is the sign extension from "int" to "long int"
that happens on return from sys_sparc64_personality.
For example, a userspace call personality((unsigned) -EINVAL) will
result to any subsequent personality call, including absolutely
harmless read-only personality(0xffffffff) call, failing with
errno set to EINVAL.
Signed-off-by: Dmitry V. Levin <ldv@altlinux.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/sparc/kernel/sys_sparc_64.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 25db14a..47ae8d7 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -412,7 +412,7 @@ out:
SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
{
- int ret;
+ long ret;
if (personality(current->personality) == PER_LINUX32 &&
personality(personality) == PER_LINUX)
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 008/136] drm/radeon: call hpd_irq_event on resume |
| Message-ID | <qXNIw-6Z3-77@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know. ---8<------------------------------------------------------------ From: Alex Deucher <alexander.deucher@amd.com> commit dbb17a21c131eca94eb31136eee9a7fe5aff00d9 upstream. Need to call this on resume if displays changes during suspend in order to properly be notified of changes. Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Kamal Mostafa <kamal@canonical.com> --- drivers/gpu/drm/radeon/radeon_device.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c index 74996a3..0e390af 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1570,6 +1570,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon) } drm_kms_helper_poll_enable(dev); + drm_helper_hpd_irq_event(dev); /* set the power state here in case we are a PX system or headless */ if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled) -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 059/136] s390: fix normalization bug in exception table sorting |
| Message-ID | <qXNIx-6Z3-85@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
commit bcb7825a77f41c7dd91da6f7ac10b928156a322e upstream.
The normalization pass in the sorting routine of the relative exception
table serves two purposes:
- it ensures that the address fields of the exception table entries are
fully ordered, so that no ambiguities arise between entries with
identical instruction offsets (i.e., when two instructions that are
exactly 8 bytes apart each have an exception table entry associated with
them)
- it ensures that the offsets of both the instruction and the fixup fields
of each entry are relative to their final location after sorting.
Commit eb608fb366de ("s390/exceptions: switch to relative exception table
entries") ported the relative exception table format from x86, but modified
the sorting routine to only normalize the instruction offset field and not
the fixup offset field. The result is that the fixup offset of each entry
will be relative to the original location of the entry before sorting,
likely leading to crashes when those entries are dereferenced.
Fixes: eb608fb366de ("s390/exceptions: switch to relative exception table entries")
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/s390/mm/extable.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/arch/s390/mm/extable.c b/arch/s390/mm/extable.c
index 4d1ee88..18c8b81 100644
--- a/arch/s390/mm/extable.c
+++ b/arch/s390/mm/extable.c
@@ -52,12 +52,16 @@ void sort_extable(struct exception_table_entry *start,
int i;
/* Normalize entries to being relative to the start of the section */
- for (p = start, i = 0; p < finish; p++, i += 8)
+ for (p = start, i = 0; p < finish; p++, i += 8) {
p->insn += i;
+ p->fixup += i + 4;
+ }
sort(start, finish - start, sizeof(*start), cmp_ex, NULL);
/* Denormalize all entries */
- for (p = start, i = 0; p < finish; p++, i += 8)
+ for (p = start, i = 0; p < finish; p++, i += 8) {
p->insn -= i;
+ p->fixup -= i + 4;
+ }
}
#ifdef CONFIG_MODULES
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 107/136] SCSI: initio: remove duplicate module device table |
| Message-ID | <qXNIx-6Z3-79@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Arnd Bergmann <arnd@arndb.de>
commit d282e2b383e3f41a7758e8cbf3076091ef9d9447 upstream.
The initio driver has for many years had two copies of the
same module device table. One of them is also used for registering
the other driver, the other one is entirely useless after the
large scale cleanup that Alan Cox did back in 2007.
The compiler warns about this whenever the driver is built-in:
drivers/scsi/initio.c:131:29: warning: 'i91u_pci_devices' defined but not used [-Wunused-variable]
This removes the extraneous table and the warning.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 72d39fea901 ("[SCSI] initio: Convert into a real Linux driver and update to modern style")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/scsi/initio.c | 16 ----------------
1 file changed, 16 deletions(-)
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index 280d5af..919df27 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -110,11 +110,6 @@
#define i91u_MAXQUEUE 2
#define i91u_REVID "Initio INI-9X00U/UW SCSI device driver; Revision: 1.04a"
-#define I950_DEVICE_ID 0x9500 /* Initio's inic-950 product ID */
-#define I940_DEVICE_ID 0x9400 /* Initio's inic-940 product ID */
-#define I935_DEVICE_ID 0x9401 /* Initio's inic-935 product ID */
-#define I920_DEVICE_ID 0x0002 /* Initio's other product ID */
-
#ifdef DEBUG_i91u
static unsigned int i91u_debug = DEBUG_DEFAULT;
#endif
@@ -127,17 +122,6 @@ static int setup_debug = 0;
static void i91uSCBPost(u8 * pHcb, u8 * pScb);
-/* PCI Devices supported by this driver */
-static struct pci_device_id i91u_pci_devices[] = {
- { PCI_VENDOR_ID_INIT, I950_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
- { PCI_VENDOR_ID_INIT, I940_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
- { PCI_VENDOR_ID_INIT, I935_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
- { PCI_VENDOR_ID_INIT, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
- { PCI_VENDOR_ID_DOMEX, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0},
- { }
-};
-MODULE_DEVICE_TABLE(pci, i91u_pci_devices);
-
#define DEBUG_INTERRUPT 0
#define DEBUG_QUEUE 0
#define DEBUG_STATE 0
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 128/136] unix: properly account for FDs passed over unix sockets |
| Message-ID | <qXNIx-6Z3-81@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: willy tarreau <w@1wt.eu>
[ Upstream commit 712f4aad406bb1ed67f3f98d04c044191f0ff593 ]
It is possible for a process to allocate and accumulate far more FDs than
the process' limit by sending them over a unix socket then closing them
to keep the process' fd count low.
This change addresses this problem by keeping track of the number of FDs
in flight per user and preventing non-privileged processes from having
more FDs in flight than their configured FD limit.
Reported-by: socketpair@gmail.com
Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Mitigates: CVE-2013-4312 (Linux 2.0+)
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/sched.h | 1 +
net/unix/af_unix.c | 24 ++++++++++++++++++++----
net/unix/garbage.c | 16 ++++++++++++----
3 files changed, 33 insertions(+), 8 deletions(-)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 286e593..3f3128b 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -683,6 +683,7 @@ struct user_struct {
unsigned long mq_bytes; /* How many bytes can be allocated to mqueue? */
#endif
unsigned long locked_shm; /* How many pages of mlocked shm ? */
+ unsigned long unix_inflight; /* How many files in flight in unix sockets */
#ifdef CONFIG_KEYS
struct key *uid_keyring; /* UID specific keyring */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 31b88dc..e6b0213 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1484,6 +1484,21 @@ static void unix_destruct_scm(struct sk_buff *skb)
sock_wfree(skb);
}
+/*
+ * The "user->unix_inflight" variable is protected by the garbage
+ * collection lock, and we just read it locklessly here. If you go
+ * over the limit, there might be a tiny race in actually noticing
+ * it across threads. Tough.
+ */
+static inline bool too_many_unix_fds(struct task_struct *p)
+{
+ struct user_struct *user = current_user();
+
+ if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+ return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
+ return false;
+}
+
#define MAX_RECURSION_LEVEL 4
static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
@@ -1492,6 +1507,9 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
unsigned char max_level = 0;
int unix_sock_count = 0;
+ if (too_many_unix_fds(current))
+ return -ETOOMANYREFS;
+
for (i = scm->fp->count - 1; i >= 0; i--) {
struct sock *sk = unix_get_socket(scm->fp->fp[i]);
@@ -1513,10 +1531,8 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
if (!UNIXCB(skb).fp)
return -ENOMEM;
- if (unix_sock_count) {
- for (i = scm->fp->count - 1; i >= 0; i--)
- unix_inflight(scm->fp->fp[i]);
- }
+ for (i = scm->fp->count - 1; i >= 0; i--)
+ unix_inflight(scm->fp->fp[i]);
return max_level;
}
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 9bc73f8..06730fe 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -125,9 +125,12 @@ struct sock *unix_get_socket(struct file *filp)
void unix_inflight(struct file *fp)
{
struct sock *s = unix_get_socket(fp);
+
+ spin_lock(&unix_gc_lock);
+
if (s) {
struct unix_sock *u = unix_sk(s);
- spin_lock(&unix_gc_lock);
+
if (atomic_long_inc_return(&u->inflight) == 1) {
BUG_ON(!list_empty(&u->link));
list_add_tail(&u->link, &gc_inflight_list);
@@ -135,22 +138,27 @@ void unix_inflight(struct file *fp)
BUG_ON(list_empty(&u->link));
}
unix_tot_inflight++;
- spin_unlock(&unix_gc_lock);
}
+ fp->f_cred->user->unix_inflight++;
+ spin_unlock(&unix_gc_lock);
}
void unix_notinflight(struct file *fp)
{
struct sock *s = unix_get_socket(fp);
+
+ spin_lock(&unix_gc_lock);
+
if (s) {
struct unix_sock *u = unix_sk(s);
- spin_lock(&unix_gc_lock);
+
BUG_ON(list_empty(&u->link));
if (atomic_long_dec_and_test(&u->inflight))
list_del_init(&u->link);
unix_tot_inflight--;
- spin_unlock(&unix_gc_lock);
}
+ fp->f_cred->user->unix_inflight--;
+ spin_unlock(&unix_gc_lock);
}
static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 135/136] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid |
| Message-ID | <qXNIx-6Z3-89@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ido Schimmel <idosch@mellanox.com>
[ Upstream commit 60a6531bfe49555581ccd65f66a350cc5693fcde ]
We can't be within an RCU read-side critical section when deleting
VLANs, as underlying drivers might sleep during the hardware operation.
Therefore, replace the RCU critical section with a mutex. This is
consistent with team_vlan_rx_add_vid.
Fixes: 3d249d4ca7d0 ("net: introduce ethernet teaming device")
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/team/team.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 3320fc2..31c72e4 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1838,10 +1838,10 @@ static int team_vlan_rx_kill_vid(struct net_device *dev, __be16 proto, u16 vid)
struct team *team = netdev_priv(dev);
struct team_port *port;
- rcu_read_lock();
- list_for_each_entry_rcu(port, &team->port_list, list)
+ mutex_lock(&team->lock);
+ list_for_each_entry(port, &team->port_list, list)
vlan_vid_del(port->dev, proto, vid);
- rcu_read_unlock();
+ mutex_unlock(&team->lock);
return 0;
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 001/136] drm/nv4c/mc: nv4x igp's have a different msi rearm register |
| Message-ID | <qXNIx-6Z3-87@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Ilia Mirkin <imirkin@alum.mit.edu>
commit fa8c9ac72fe0bcdf5bc7cc84e85cc2a1af53f9fd upstream.
See https://bugs.freedesktop.org/show_bug.cgi?id=74492
Reported-by: Ronald <ronald645@gmail.com>
Suggested-by: Marcin Kościelnicki <koriakin@0x04.net>
Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/gpu/drm/nouveau/Makefile | 1 +
drivers/gpu/drm/nouveau/core/engine/device/nv40.c | 10 ++---
drivers/gpu/drm/nouveau/core/include/subdev/mc.h | 1 +
drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h | 1 +
drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c | 2 +-
drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c | 45 +++++++++++++++++++++++
6 files changed, 54 insertions(+), 6 deletions(-)
create mode 100644 drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
diff --git a/drivers/gpu/drm/nouveau/Makefile b/drivers/gpu/drm/nouveau/Makefile
index b3fa1ba..44928bc 100644
--- a/drivers/gpu/drm/nouveau/Makefile
+++ b/drivers/gpu/drm/nouveau/Makefile
@@ -137,6 +137,7 @@ nouveau-y += core/subdev/mc/base.o
nouveau-y += core/subdev/mc/nv04.o
nouveau-y += core/subdev/mc/nv40.o
nouveau-y += core/subdev/mc/nv44.o
+nouveau-y += core/subdev/mc/nv4c.o
nouveau-y += core/subdev/mc/nv50.o
nouveau-y += core/subdev/mc/nv94.o
nouveau-y += core/subdev/mc/nv98.o
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
index c8c41e9..95f7c0c 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nv40.c
@@ -311,7 +311,7 @@ nv40_identify(struct nouveau_device *device)
device->oclass[NVDEV_SUBDEV_CLOCK ] = &nv40_clock_oclass;
device->oclass[NVDEV_SUBDEV_THERM ] = &nv40_therm_oclass;
device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv1a_devinit_oclass;
- device->oclass[NVDEV_SUBDEV_MC ] = nv44_mc_oclass;
+ device->oclass[NVDEV_SUBDEV_MC ] = nv4c_mc_oclass;
device->oclass[NVDEV_SUBDEV_BUS ] = nv31_bus_oclass;
device->oclass[NVDEV_SUBDEV_TIMER ] = &nv04_timer_oclass;
device->oclass[NVDEV_SUBDEV_FB ] = nv46_fb_oclass;
@@ -334,7 +334,7 @@ nv40_identify(struct nouveau_device *device)
device->oclass[NVDEV_SUBDEV_CLOCK ] = &nv40_clock_oclass;
device->oclass[NVDEV_SUBDEV_THERM ] = &nv40_therm_oclass;
device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv1a_devinit_oclass;
- device->oclass[NVDEV_SUBDEV_MC ] = nv44_mc_oclass;
+ device->oclass[NVDEV_SUBDEV_MC ] = nv4c_mc_oclass;
device->oclass[NVDEV_SUBDEV_BUS ] = nv31_bus_oclass;
device->oclass[NVDEV_SUBDEV_TIMER ] = &nv04_timer_oclass;
device->oclass[NVDEV_SUBDEV_FB ] = nv4e_fb_oclass;
@@ -357,7 +357,7 @@ nv40_identify(struct nouveau_device *device)
device->oclass[NVDEV_SUBDEV_CLOCK ] = &nv40_clock_oclass;
device->oclass[NVDEV_SUBDEV_THERM ] = &nv40_therm_oclass;
device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv1a_devinit_oclass;
- device->oclass[NVDEV_SUBDEV_MC ] = nv44_mc_oclass;
+ device->oclass[NVDEV_SUBDEV_MC ] = nv4c_mc_oclass;
device->oclass[NVDEV_SUBDEV_BUS ] = nv31_bus_oclass;
device->oclass[NVDEV_SUBDEV_TIMER ] = &nv04_timer_oclass;
device->oclass[NVDEV_SUBDEV_FB ] = nv46_fb_oclass;
@@ -380,7 +380,7 @@ nv40_identify(struct nouveau_device *device)
device->oclass[NVDEV_SUBDEV_CLOCK ] = &nv40_clock_oclass;
device->oclass[NVDEV_SUBDEV_THERM ] = &nv40_therm_oclass;
device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv1a_devinit_oclass;
- device->oclass[NVDEV_SUBDEV_MC ] = nv44_mc_oclass;
+ device->oclass[NVDEV_SUBDEV_MC ] = nv4c_mc_oclass;
device->oclass[NVDEV_SUBDEV_BUS ] = nv31_bus_oclass;
device->oclass[NVDEV_SUBDEV_TIMER ] = &nv04_timer_oclass;
device->oclass[NVDEV_SUBDEV_FB ] = nv46_fb_oclass;
@@ -403,7 +403,7 @@ nv40_identify(struct nouveau_device *device)
device->oclass[NVDEV_SUBDEV_CLOCK ] = &nv40_clock_oclass;
device->oclass[NVDEV_SUBDEV_THERM ] = &nv40_therm_oclass;
device->oclass[NVDEV_SUBDEV_DEVINIT] = &nv1a_devinit_oclass;
- device->oclass[NVDEV_SUBDEV_MC ] = nv44_mc_oclass;
+ device->oclass[NVDEV_SUBDEV_MC ] = nv4c_mc_oclass;
device->oclass[NVDEV_SUBDEV_BUS ] = nv31_bus_oclass;
device->oclass[NVDEV_SUBDEV_TIMER ] = &nv04_timer_oclass;
device->oclass[NVDEV_SUBDEV_FB ] = nv46_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
index adc88b7..3c6738e 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/mc.h
@@ -47,6 +47,7 @@ struct nouveau_mc_oclass {
extern struct nouveau_oclass *nv04_mc_oclass;
extern struct nouveau_oclass *nv40_mc_oclass;
extern struct nouveau_oclass *nv44_mc_oclass;
+extern struct nouveau_oclass *nv4c_mc_oclass;
extern struct nouveau_oclass *nv50_mc_oclass;
extern struct nouveau_oclass *nv94_mc_oclass;
extern struct nouveau_oclass *nv98_mc_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
index b0d5c31..81a408e 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv04.h
@@ -14,6 +14,7 @@ int nv04_mc_ctor(struct nouveau_object *, struct nouveau_object *,
extern const struct nouveau_mc_intr nv04_mc_intr[];
int nv04_mc_init(struct nouveau_object *);
void nv40_mc_msi_rearm(struct nouveau_mc *);
+int nv44_mc_init(struct nouveau_object *object);
int nv50_mc_init(struct nouveau_object *);
extern const struct nouveau_mc_intr nv50_mc_intr[];
extern const struct nouveau_mc_intr nvc0_mc_intr[];
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
index 3bfee5c..cc4d0d2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv44.c
@@ -24,7 +24,7 @@
#include "nv04.h"
-static int
+int
nv44_mc_init(struct nouveau_object *object)
{
struct nv04_mc_priv *priv = (void *)object;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
new file mode 100644
index 0000000..a75c35c
--- /dev/null
+++ b/drivers/gpu/drm/nouveau/core/subdev/mc/nv4c.c
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2014 Ilia Mirkin
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDER(S) OR AUTHOR(S) BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * Authors: Ilia Mirkin
+ */
+
+#include "nv04.h"
+
+static void
+nv4c_mc_msi_rearm(struct nouveau_mc *pmc)
+{
+ struct nv04_mc_priv *priv = (void *)pmc;
+ nv_wr08(priv, 0x088050, 0xff);
+}
+
+struct nouveau_oclass *
+nv4c_mc_oclass = &(struct nouveau_mc_oclass) {
+ .base.handle = NV_SUBDEV(MC, 0x4c),
+ .base.ofuncs = &(struct nouveau_ofuncs) {
+ .ctor = nv04_mc_ctor,
+ .dtor = _nouveau_mc_dtor,
+ .init = nv44_mc_init,
+ .fini = _nouveau_mc_fini,
+ },
+ .intr = nv04_mc_intr,
+ .msi_rearm = nv4c_mc_msi_rearm,
+}.base;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 113/136] kconfig: return 'false' instead of 'no' in bool function |
| Message-ID | <qXNIx-6Z3-95@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit aab24a897cfba9dd371f6aac45dbcdae0b23def6 upstream.
menu_is_visible() is a bool function and should use boolean return
values. "no" is a tristate value which happens to also have a value
of 0, but we should nevertheless use the right symbol for it.
This is a very minor cleanup with no semantic change.
Fixes: 86e187ff9 ("kconfig: add an option to determine a menu's visibility")
Cc: Arnaud Lacombe <lacombar@gmail.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Michal Marek <mmarek@suse.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
scripts/kconfig/menu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index f53542b..3de6919 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -474,7 +474,7 @@ bool menu_is_visible(struct menu *menu)
if (menu->visibility) {
if (expr_calc_value(menu->visibility) == no)
- return no;
+ return false;
}
sym = menu->sym;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:20 +0100 |
| Subject | [PATCH 3.13.y-ckt 021/136] futex: Drop refcount if requeue_pi() acquired the rtmutex |
| Message-ID | <qXNIx-6Z3-97@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit fb75a4282d0d9a3c7c44d940582c2d226cf3acfb upstream.
If the proxy lock in the requeue loop acquires the rtmutex for a
waiter then it acquired also refcount on the pi_state related to the
futex, but the waiter side does not drop the reference count.
Add the missing free_pi_state() call.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Darren Hart <darren@dvhart.com>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Bhuvanesh_Surachari@mentor.com
Cc: Andy Lowe <Andy_Lowe@mentor.com>
Link: http://lkml.kernel.org/r/20151219200607.178132067@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/futex.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/futex.c b/kernel/futex.c
index 7947e4c..6de6bf0 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2499,6 +2499,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
if (q.pi_state && (q.pi_state->owner != current)) {
spin_lock(q.lock_ptr);
ret = fixup_pi_state_owner(uaddr2, &q, current);
+ /*
+ * Drop the reference to the pi state which
+ * the requeue_pi() code acquired for us.
+ */
+ free_pi_state(q.pi_state);
spin_unlock(q.lock_ptr);
}
} else {
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 114/136] perf/x86: Fix filter_events() bug with event mappings |
| Message-ID | <qXNSa-72M-7@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Stephane Eranian <eranian@google.com>
commit 61b87cae6361ea6af161c1ffa549898892707b19 upstream.
This patch fixes a bug in the filter_events() function.
The patch fixes the bug whereby if some mappings did not
exist, e.g., STALLED_CYCLES_FRONTEND, then any event after it
in the attrs array would disappear from the published list of
events in /sys/devices/cpu/events. This could be verified
easily on any system post SNB (which do not publish
STALLED_CYCLES_FRONTEND):
$ ./perf stat -e cycles,ref-cycles true
Performance counter stats for 'true':
1,217,348 cycles
<not supported> ref-cycles
The problem is that in filter_events() there is an assumption
that the argument (attrs) is organized in increasing continuous
event indexes related to the event_map(). But if we remove the
non-supported events by shifing the position in the array, then
the lookup x86_pmu.event_map() needs to compensate for it, otherwise
we are looking up the wrong index. This patch corrects this problem
by compensating for the deleted events and with that ref-cycles
reappears (here shown on Haswell):
$ perf stat -e ref-cycles,cycles true
Performance counter stats for 'true':
4,525,910 ref-cycles
1,064,920 cycles
0.002943888 seconds time elapsed
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: jolsa@kernel.org
Cc: kan.liang@intel.com
Fixes: 8300daa26755 ("perf/x86: Filter out undefined events from sysfs events attribute")
Link: http://lkml.kernel.org/r/1449516805-6637-1-git-send-email-eranian@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/x86/kernel/cpu/perf_event.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index db6cdbe..09411c8 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1364,6 +1364,7 @@ static void __init filter_events(struct attribute **attrs)
{
struct device_attribute *d;
struct perf_pmu_events_attr *pmu_attr;
+ int offset = 0;
int i, j;
for (i = 0; attrs[i]; i++) {
@@ -1372,7 +1373,7 @@ static void __init filter_events(struct attribute **attrs)
/* str trumps id */
if (pmu_attr->event_str)
continue;
- if (x86_pmu.event_map(i))
+ if (x86_pmu.event_map(i + offset))
continue;
for (j = i; attrs[j]; j++)
@@ -1380,6 +1381,14 @@ static void __init filter_events(struct attribute **attrs)
/* Check the shifted attr. */
i--;
+
+ /*
+ * event_map() is index based, the attrs array is organized
+ * by increasing event index. If we shift the events, then
+ * we need to compensate for the event_map(), otherwise
+ * we are looking up the wrong event in the map
+ */
+ offset++;
}
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 116/136] firmware: actually return NULL on failed request_firmware_nowait() |
| Message-ID | <qXNSa-72M-19@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Brian Norris <computersforpeace@gmail.com>
commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream.
The kerneldoc for request_firmware_nowait() says that it may call the
provided cont() callback with @fw == NULL, if the firmware request
fails. However, this is not the case when called with an empty string
(""). This case is short-circuited by the 'name[0] == '\0'' check
introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests
contain a name"), so _request_firmware() never gets to set the fw to
NULL.
Noticed while using the new 'trigger_async_request' testing hook:
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[10553.726178] test_firmware: loading ''
[10553.729859] test_firmware: loaded: 995209091
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[10733.676184] test_firmware: loading ''
[10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[10733.687951] pgd = ec188000
[10733.690655] [00000004] *pgd=00000000
[10733.694240] Internal error: Oops: 5 [#1] SMP ARM
[10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
[10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178
[10733.733137] Hardware name: Rockchip (Device Tree)
[10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000
[10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0
[10733.747831] LR is at _raw_spin_lock+0x18/0x1c
[10733.752180] pc : [<c00653a0>] lr : [<c054c204>] psr: a00d0013
[10733.752180] sp : ee323df8 ip : ee323e20 fp : ee323e1c
[10733.763634] r10: 00000051 r9 : b6f18000 r8 : ee323f80
[10733.768847] r7 : c089cebc r6 : 00000001 r5 : 00000000 r4 : ec0e6000
[10733.775360] r3 : dead4ead r2 : c06bd140 r1 : eef913b4 r0 : 00000000
[10733.781874] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
[10733.788995] Control: 10c5387d Table: 2c18806a DAC: 00000051
[10733.794728] Process bash (pid: 6600, stack limit = 0xee322218)
[10733.800549] Stack: (0xee323df8 to 0xee324000)
[10733.804896] 3de0: ec0e6000 00000000
[10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394
[10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48
[10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac
[10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c
[10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720
[10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00
[10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8
[10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001
[10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28
[10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80
[10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00
[10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24
[10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8
[10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000
[10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84
[10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390
[10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c)
[10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64)
[10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74)
[10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124)
[10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34)
[10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58)
[10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8)
[10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4)
After this patch:
# printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
[ 32.126322] test_firmware: loading ''
[ 32.129995] test_firmware: failed to async load firmware
-bash: printf: write error: No such device
Fixes: 471b095dfe0d ("firmware_class: make sure fw requests contain a name")
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/base/firmware_class.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index 88c4812..2a06d75 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -1063,15 +1063,17 @@ static int
_request_firmware(const struct firmware **firmware_p, const char *name,
struct device *device, bool uevent, bool nowait)
{
- struct firmware *fw;
+ struct firmware *fw = NULL;
long timeout;
int ret;
if (!firmware_p)
return -EINVAL;
- if (!name || name[0] == '\0')
- return -EINVAL;
+ if (!name || name[0] == '\0') {
+ ret = -EINVAL;
+ goto out;
+ }
ret = _request_firmware_prepare(&fw, name, device);
if (ret <= 0) /* error or already assigned */
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 115/136] power: test_power: correctly handle empty writes |
| Message-ID | <qXNSa-72M-23@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sasha Levin <sasha.levin@oracle.com>
commit 6b9140f39c2aaf76791197fbab0839c0e4af56e8 upstream.
Writing 0 length data into test_power makes it access an invalid array
location and kill the system.
Fixes: f17ef9b2d ("power: Make test_power driver more dynamic.")
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/power/test_power.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/power/test_power.c b/drivers/power/test_power.c
index 0152f35..b47bd17 100644
--- a/drivers/power/test_power.c
+++ b/drivers/power/test_power.c
@@ -275,6 +275,8 @@ static int map_get_value(struct battery_property_map *map, const char *key,
buf[MAX_KEYLENGTH-1] = '\0';
cr = strnlen(buf, MAX_KEYLENGTH) - 1;
+ if (cr < 0)
+ return def_val;
if (buf[cr] == '\n')
buf[cr] = '\0';
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 127/136] connector: bump skb->users before callback invocation |
| Message-ID | <qXNSb-72M-29@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 55285bf09427c5abf43ee1d54e892f352092b1f1 ]
Dmitry reports memleak with syskaller program.
Problem is that connector bumps skb usecount but might not invoke callback.
So move skb_get to where we invoke the callback.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/connector/connector.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index a36749f..cc4fee6 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -154,26 +154,21 @@ static int cn_call_callback(struct sk_buff *skb)
*
* It checks skb, netlink header and msg sizes, and calls callback helper.
*/
-static void cn_rx_skb(struct sk_buff *__skb)
+static void cn_rx_skb(struct sk_buff *skb)
{
struct nlmsghdr *nlh;
- struct sk_buff *skb;
int len, err;
- skb = skb_get(__skb);
-
if (skb->len >= NLMSG_HDRLEN) {
nlh = nlmsg_hdr(skb);
len = nlmsg_len(nlh);
if (len < (int)sizeof(struct cn_msg) ||
skb->len < nlh->nlmsg_len ||
- len > CONNECTOR_MAX_MSG_SIZE) {
- kfree_skb(skb);
+ len > CONNECTOR_MAX_MSG_SIZE)
return;
- }
- err = cn_call_callback(skb);
+ err = cn_call_callback(skb_get(skb));
if (err < 0)
kfree_skb(skb);
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2016-02-02 19:30 +0100 |
| Subject | [PATCH 3.13.y-ckt 121/136] batman-adv: Drop immediate orig_node free function |
| Message-ID | <qXNSb-72M-31@gated-at.bofh.it> |
| In reply to | #1324372 |
3.13.11-ckt34 -stable review patch. If anyone has any objections, please let me know.
---8<------------------------------------------------------------
From: Sven Eckelmann <sven@narfation.org>
commit 42eff6a617e23b691f8e4467f4687ed7245a92db upstream.
It is not allowed to free the memory of an object which is part of a list
which is protected by rcu-read-side-critical sections without making sure
that no other context is accessing the object anymore. This usually happens
by removing the references to this object and then waiting until the rcu
grace period is over and no one (allowedly) accesses it anymore.
But the _now functions ignore this completely. They free the object
directly even when a different context still tries to access it. This has
to be avoided and thus these functions must be removed and all functions
have to use batadv_orig_node_free_ref.
Fixes: 72822225bd41 ("batman-adv: Fix rcu_barrier() miss due to double call_rcu() in TT code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/originator.c | 11 -----------
net/batman-adv/originator.h | 1 -
net/batman-adv/translation-table.c | 28 +++++++++++++---------------
3 files changed, 13 insertions(+), 27 deletions(-)
diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 0409221..fa4e9f9 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -259,17 +259,6 @@ void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
}
-/**
- * batadv_orig_node_free_ref_now - decrement the orig node refcounter and
- * possibly free it (without rcu callback)
- * @orig_node: the orig node to free
- */
-void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node)
-{
- if (atomic_dec_and_test(&orig_node->refcount))
- batadv_orig_node_free_rcu(&orig_node->rcu);
-}
-
void batadv_originator_free(struct batadv_priv *bat_priv)
{
struct batadv_hashtable *hash = bat_priv->orig_hash;
diff --git a/net/batman-adv/originator.h b/net/batman-adv/originator.h
index c2f4556..aa3bb88 100644
--- a/net/batman-adv/originator.h
+++ b/net/batman-adv/originator.h
@@ -27,7 +27,6 @@ int batadv_originator_init(struct batadv_priv *bat_priv);
void batadv_originator_free(struct batadv_priv *bat_priv);
void batadv_purge_orig_ref(struct batadv_priv *bat_priv);
void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node);
-void batadv_orig_node_free_ref_now(struct batadv_orig_node *orig_node);
struct batadv_orig_node *batadv_orig_node_new(struct batadv_priv *bat_priv,
const uint8_t *addr);
struct batadv_neigh_node *
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 8badc8c..3b05992 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -194,20 +194,6 @@ batadv_tt_global_entry_free_ref(struct batadv_tt_global_entry *tt_global_entry)
}
}
-static void batadv_tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
-{
- struct batadv_tt_orig_list_entry *orig_entry;
-
- orig_entry = container_of(rcu, struct batadv_tt_orig_list_entry, rcu);
-
- /* We are in an rcu callback here, therefore we cannot use
- * batadv_orig_node_free_ref() and its call_rcu():
- * An rcu_barrier() wouldn't wait for that to finish
- */
- batadv_orig_node_free_ref_now(orig_entry->orig_node);
- kfree(orig_entry);
-}
-
/**
* batadv_tt_local_size_mod - change the size by v of the local table identified
* by vid
@@ -303,13 +289,25 @@ static void batadv_tt_global_size_dec(struct batadv_orig_node *orig_node,
batadv_tt_global_size_mod(orig_node, vid, -1);
}
+/**
+ * batadv_tt_orig_list_entry_release - release tt orig entry from lists and
+ * queue for free after rcu grace period
+ * @orig_entry: tt orig entry to be free'd
+ */
+static void
+batadv_tt_orig_list_entry_release(struct batadv_tt_orig_list_entry *orig_entry)
+{
+ batadv_orig_node_free_ref(orig_entry->orig_node);
+ kfree_rcu(orig_entry, rcu);
+}
+
static void
batadv_tt_orig_list_entry_free_ref(struct batadv_tt_orig_list_entry *orig_entry)
{
if (!atomic_dec_and_test(&orig_entry->refcount))
return;
- call_rcu(&orig_entry->rcu, batadv_tt_orig_list_entry_free_rcu);
+ batadv_tt_orig_list_entry_release(orig_entry);
}
/**
--
1.9.1
[toc] | [prev] | [next] | [standalone]
Page 1 of 7 [1] 2 3 4 5 6 7 Next page →
Back to top | Article view | linux.kernel
csiph-web