Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1326014 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt24 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt24 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 179/180] cifs: Ratelimit kernel log messages Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 017/180] xen-netfront: print correct number of queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 168/180] batman-adv: Drop immediate batadv_neigh_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 159/180] um: Fix build error and kconfig for i386 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 120/180] crypto: af_alg - Disallow bind/setkey/... after accept(2) Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 170/180] batman-adv: Drop immediate batadv_hard_iface free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 057/180] rtlwifi: rtl8192cu: Add missing parameter setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 105/180] cifs: fix race between call_async() and reconnect() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 046/180] arm64: kernel: enforce pmuserenr_el0 initialization and restore Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 050/180] udf: limit the maximum number of indirect extents in a row Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 020/180] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 156/180] power: test_power: correctly handle empty writes Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 160/180] ipv6: tcp: add rcu locking in tcp_v6_send_synack() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 055/180] rtlwifi: rtl8192se: Fix module parameter initialization Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 010/180] bonding: Prevent IPv6 link local address on enslaved devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 071/180] x86/xen: don't reset vcpu_info on a cancelled suspend Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 098/180] x86/mm: Improve switch_mm() barrier comments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 082/180] drm/nouveau/kms: take mode_config mutex in connector hotplug path Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 112/180] zram/zcomp: use GFP_NOIO to allocate streams Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 025/180] [media] media: dvb-core: Don't force CAN_INVERSION_AUTO in oneshot mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 004/180] connector: bump skb->users before callback invocation Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 006/180] bridge: Only call /sbin/bridge-stp for the initial network namespace Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 092/180] ALSA: seq: Fix race at timer setup and close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 171/180] batman-adv: Drop immediate orig_node free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 180/180] HID: usbhid: fix recursive deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 040/180] powerpc: Make value-returning atomics fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 149/180] mtd: nand: remove unused and buggy get_platform_nandchip() helper function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 001/180] drm/nouveau/nv46: Change mc subdev oclass from nv44 to nv4c Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 036/180] EDAC: Fix the leak of mci->bus->name when bus_register fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 014/180] team: Replace rcu_read_lock with a mutex in team_vlan_rx_kill_vid Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 096/180] scripts/recordmcount.pl: support data in text section on powerpc Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 077/180] locks: fix unlock when fcntl_setlk races with a close Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 054/180] rtlwifi: rtl8192de: Fix incorrect module parameter descriptions Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 030/180] xhci: refuse loading if nousb is used Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 143/180] SCSI: initio: remove duplicate module device table Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:40 +0100
    [PATCH 3.16.y-ckt 155/180] perf/x86: Fix filter_events() bug with event mappings Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 162/180] Btrfs: clean up an error code in btrfs_init_space_info() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 164/180] batman-adv: Avoid recursive call_rcu for batadv_bla_claim Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 175/180] net/mlx4: Remove unused macro Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 174/180] IB/mlx4: Initialize hop_limit when creating address handle Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 157/180] firmware: actually return NULL on failed request_firmware_nowait() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 163/180] bridge: fix lockdep addr_list_lock false positive splat Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 165/180] batman-adv: Avoid recursive call_rcu for batadv_nc_node Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 166/180] batman-adv: fix potential TT client + orig-node memory leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 167/180] batman-adv: Drop immediate batadv_orig_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 176/180] arm64: fix building without CONFIG_UID16 Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 173/180] mmc: debugfs: correct wrong voltage value Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 161/180] mmc: sd: limit SD card power limit according to cards capabilities Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 154/180] kconfig: return 'false' instead of 'no' in bool function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 169/180] batman-adv: Drop immediate neigh_ifinfo free function Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 153/180] sysrq: Fix warning in sysrq generated crash. Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 152/180] x86/LDT: Print the real LDT base address Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 172/180] printk: help pr_debug and pr_devel to optimize out arguments Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 158/180] target: Fix a memory leak in target_dev_lba_map_store() Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 177/180] mn10300: Select CONFIG_HAVE_UID16 to fix build failure Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 178/180] openrisc: fix CONFIG_UID16 setting Luis Henriques <luis.henriques@canonical.com> - 2016-02-03 23:50 +0100
    [PATCH 3.16.y-ckt 151/180] pinctrl: bcm2835: Fix memory leak in error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 141/180] drm/i915: On fb alloc failure, unref gem object where it gets refed Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 145/180] clk: st: avoid uninitialized variable use Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 144/180] clk: xgene: Fix divider with non-zero shift value Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 147/180] mtd: nand: fix ONFI parameter page layout Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 146/180] ath9k_htc: check for underflow in ath9k_htc_rx_msg() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 148/180] mtd: nand: denali: add missing nand_release() call in denali_remove() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:00 +0100
    [PATCH 3.16.y-ckt 138/180] MAINTAINERS: return arch/sh to maintained state, with new maintainers Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 142/180] [media] rc: allow rc modules to be loaded if rc-main is not a module Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 134/180] ideapad-laptop: Add Lenovo ideapad Y700-17ISK to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 133/180] IB/qib: Support creating qps with GFP_NOIO flag Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 052/180] USB: cp210x: add ID for ELV Marble Sound Board 1 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 140/180] drm/i915: avoid deadlock on failure paths in __intel_framebuffer_create() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 139/180] ideapad-laptop: Add Lenovo Yoga 700 to no_hw_rfkill dmi list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 137/180] ocfs2: NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 135/180] iscsi-target: Fix potential dead-lock during node acl delete Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 129/180] ALSA: control: Avoid kernel warnings from tlv ioctl with numid 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 136/180] ALSA: timer: Handle disconnection more safely Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:10 +0100
    [PATCH 3.16.y-ckt 115/180] memcg: only free spare array when readers are done Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 127/180] ALSA: pcm: Fix snd_pcm_hw_params struct copy in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 118/180] printk: do cond_resched() between lines while outputting to consoles Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 110/180] ocfs2/dlm: ignore cleaning the migration mle that is inuse Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 107/180] m32r: fix m32104ut_defconfig build fail Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 124/180] crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 111/180] ALSA: timer: Harden slave timer list handling Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 132/180] IB/qib: fix mcast detach when qp not attached Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 117/180] kernel/panic.c: turn off locks debug before releasing console lock Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 114/180] mm: soft-offline: check return value in second __get_any_page() call Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 083/180] x86/mm: Add barriers and document switch_mm()-vs-flush synchronization Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 123/180] crypto: hash - Add crypto_ahash_has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 128/180] ALSA: seq: Fix snd_seq_call_port_info_ioctl in compat mode Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 116/180] panic: release stale console lock to always get the logbuf printed out Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 126/180] ALSA: hrtimer: Fix stall by hrtimer_cancel() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 119/180] ALSA: hda - Fix bass pin fixup for ASUS N550JX Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 122/180] crypto: af_alg - Add nokey compatibility path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 130/180] crypto: algif_skcipher - Load TX SG list after waiting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 131/180] crypto: crc32c - Fix crc32c soft dependency Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 125/180] crypto: af_alg - Forbid bind(2) when nokey child sockets are present Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 113/180] zram: try vmalloc() after kmalloc() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 121/180] crypto: af_alg - Fix socket double-free when accept fails Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 090/180] x86/reboot/quirks: Add iMac10,1 to pci_reboot_dmi_table[] Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:20 +0100
    [PATCH 3.16.y-ckt 093/180] virtio_balloon: fix race by fill and leak Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 084/180] x86/boot: Double BOOT_HEAP_SIZE to 64KB Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 087/180] xfs: handle dquot buffer readahead in log recovery correctly Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 103/180] ALSA: timer: Fix race among timer ioctls Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 075/180] PCI: host: Mark PCIe/PCI (MSI) IRQ cascade handlers as IRQF_NO_THREAD Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 095/180] parisc: Fix __ARCH_SI_PREAMBLE_SIZE Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 094/180] virtio_balloon: fix race between migration and ballooning Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 104/180] sparc64: fix incorrect sign extension in sys_sparc64_personality Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 085/180] s390: fix normalization bug in exception table sorting Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 088/180] clocksource/drivers/vt8500: Increase the minimum delta Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 100/180] dmaengine: dw: fix cyclic transfer setup Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 091/180] ALSA: seq: Fix missing NULL check at remove_events ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 101/180] dmaengine: dw: fix cyclic transfer callbacks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 097/180] powerpc/module: Handle R_PPC64_ENTRY relocations Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 108/180] dma-debug: switch check from _text to _stext Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 106/180] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 089/180] Input: elantech - mark protocols v2 and v3 as semi-mt Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 078/180] ASoC: compress: Fix compress device direction check Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 102/180] mmc: mmci: fix an ages old detection error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 086/180] xfs: inode recovery readahead can race with inode buffer creation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 109/180] scripts/bloat-o-meter: fix python3 syntax error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:30 +0100
    [PATCH 3.16.y-ckt 068/180] wlcore/wl12xx: spi: fix NULL pointer dereference (Oops) Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 079/180] dm snapshot: fix hung bios when copy error occurs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 067/180] bcache: Change refill_dirty() to always scan entire disk if necessary Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 069/180] Input: i8042 - add Fujitsu Lifebook U745 to the nomux list Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 072/180] udf: Prevent buffer overrun with multi-byte characters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 070/180] libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 073/180] udf: Check output buffer length when converting name to CS0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 076/180] iwlwifi: update and fix 7265 series PCI IDs Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 080/180] uml: fix hostfs mknod() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 074/180] PCI: Fix minimum allocation address overwrite Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 081/180] uml: flush stdout before forking Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:40 +0100
    [PATCH 3.16.y-ckt 060/180] bcache: fix a livelock when we cause a huge number of cache misses Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 065/180] bcache: allows use of register in udev to avoid "device_busy" error. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 047/180] drm/radeon: clean up fujitsu quirks Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 064/180] bcache: unregister reboot notifier if bcache fails to unregister device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 056/180] rtlwifi: rtl8192ce: Fix handling of module parameters Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 063/180] bcache: fix a leak in bch_cached_dev_run() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 049/180] mmc: sdhci: Fix sdhci_runtime_pm_bus_on/off() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 058/180] NFSv4: Don't perform cached access checks before we've OPENed the file Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 062/180] bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 044/180] futex: Drop refcount if requeue_pi() acquired the rtmutex Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 066/180] bcache: prevent crash on changing writeback_running Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 053/180] posix-clock: Fix return code on the poll method's error path Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 048/180] mmc: sdio: Fix invalid vdd in voltage switch power cycle Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 042/180] dm space map metadata: remove unused variable in brb_pop() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 061/180] bcache: Add a cond_resched() call to gc Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 059/180] NFS: Fix attribute cache revalidation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 051/180] nfs: Fix race in __update_open_stateid() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 00:50 +0100
    [PATCH 3.16.y-ckt 016/180] xen-netfront: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 028/180] KVM: x86: correctly print #AC in traces Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 022/180] sctp: start t5 timer only when peer rwnd is 0 and local state is SHUTDOWN_PENDING Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 029/180] drm/radeon: call hpd_irq_event on resume Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 021/180] sctp: convert sack_needed and sack_generation to bits Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 039/180] arm64: mm: ensure that the zero page is visible to the page table walker Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 026/180] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 015/180] xen-netback: respect user provided max_queues Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 035/180] wlcore/wl12xx: spi: fix oops on firmware load Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 023/180] nfs: Fix unused variable error Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 041/180] powerpc: Make {cmp}xchg* and their atomic_ versions fully ordered Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 031/180] arm64: Clear out any singlestep state on a ptrace detach operation Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 024/180] [media] gspca: ov534/topro: prevent a division by 0 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 034/180] rtlwifi: fix memory leak for USB device Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 043/180] dm thin: fix race condition when destroying thin pool workqueue Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 045/180] arm64: mdscr_el1: avoid exposing DCC to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 033/180] Bluetooth: Add support of Toshiba Broadcom based devices Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 032/180] time: Avoid signed overflow in timekeeping_get_ns() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 027/180] KVM: x86: expose MSR_TSC_AUX to userspace Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 018/180] xen-netfront: update num_queues to real created Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 038/180] EDAC: Robustify workqueues destruction Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 037/180] EDAC, mc_sysfs: Fix freeing bus' name Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 019/180] xfrm: dst_entries_init() per-net dst_ops Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:00 +0100
    [PATCH 3.16.y-ckt 011/180] phonet: properly unshare skbs in phonet_rcv() Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 009/180] tcp_yeah: don't set ssthresh below 2 Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 012/180] net: bpf: reject invalid shifts Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 003/180] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 007/180] vxlan: fix test which detect duplicate vxlan iface Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 013/180] ipv6: update skb->csum when CE mark is propagated Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 005/180] unix: properly account for FDs passed over unix sockets Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 002/180] veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100
    [PATCH 3.16.y-ckt 008/180] net: sctp: prevent writes to cookie_hmac_alg from accessing invalid memory Luis Henriques <luis.henriques@canonical.com> - 2016-02-04 01:10 +0100

Page 3 of 9 — ← Prev page 1 2 [3] 4 5 6 7 8 9  Next page →

#1326055 — [PATCH 3.16.y-ckt 174/180] IB/mlx4: Initialize hop_limit when creating address handle

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Matan Barak <matanb@mellanox.com>

commit 4e4081673445485aa6bc90383bdb83e7a96cc48a upstream.

Hop limit value wasn't copied from attributes  when ah was created.
This may influence packets for unconnected services to get dropped in
routers when endpoints are not in the same subnet.

Fixes: fa417f7b520e ("IB/mlx4: Add support for IBoE")
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/infiniband/hw/mlx4/ah.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
index e65ee1947279..6dc27ffa1cec 100644
--- a/drivers/infiniband/hw/mlx4/ah.c
+++ b/drivers/infiniband/hw/mlx4/ah.c
@@ -90,6 +90,7 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
 	ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
 	ah->av.eth.gid_index = ah_attr->grh.sgid_index;
 	ah->av.eth.vlan = cpu_to_be16(vlan_tag);
+	ah->av.eth.hop_limit = ah_attr->grh.hop_limit;
 	if (ah_attr->static_rate) {
 		ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
 		while (ah->av.eth.stat_rate > IB_RATE_2_5_GBPS + MLX4_STAT_RATE_OFFSET &&

[toc] | [prev] | [next] | [standalone]

#1326060 — [PATCH 3.16.y-ckt 157/180] firmware: actually return NULL on failed request_firmware_nowait()

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Brian Norris <computersforpeace@gmail.com>

commit 715780ae4bb76d6fd2f20eb78e2a9ba9769a6cdc upstream.

The kerneldoc for request_firmware_nowait() says that it may call the
provided cont() callback with @fw == NULL, if the firmware request
fails. However, this is not the case when called with an empty string
(""). This case is short-circuited by the 'name[0] == '\0'' check
introduced in commit 471b095dfe0d ("firmware_class: make sure fw requests
contain a name"), so _request_firmware() never gets to set the fw to
NULL.

Noticed while using the new 'trigger_async_request' testing hook:

    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [10553.726178] test_firmware: loading ''
    [10553.729859] test_firmware: loaded: 995209091
    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [10733.676184] test_firmware: loading ''
    [10733.679855] Unable to handle kernel NULL pointer dereference at virtual address 00000004
    [10733.687951] pgd = ec188000
    [10733.690655] [00000004] *pgd=00000000
    [10733.694240] Internal error: Oops: 5 [#1] SMP ARM
    [10733.698847] Modules linked in: btmrvl_sdio btmrvl bluetooth sbs_battery nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables asix usbnet mwifiex_sdio mwifiex cfg80211 jitterentropy_rng drbg joydev snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
    [10733.725670] CPU: 0 PID: 6600 Comm: bash Not tainted 4.4.0-rc4-00351-g63d0877 #178
    [10733.733137] Hardware name: Rockchip (Device Tree)
    [10733.737831] task: ed24f6c0 ti: ee322000 task.ti: ee322000
    [10733.743222] PC is at do_raw_spin_lock+0x18/0x1a0
    [10733.747831] LR is at _raw_spin_lock+0x18/0x1c
    [10733.752180] pc : [<c00653a0>]    lr : [<c054c204>]    psr: a00d0013
    [10733.752180] sp : ee323df8  ip : ee323e20  fp : ee323e1c
    [10733.763634] r10: 00000051  r9 : b6f18000  r8 : ee323f80
    [10733.768847] r7 : c089cebc  r6 : 00000001  r5 : 00000000  r4 : ec0e6000
    [10733.775360] r3 : dead4ead  r2 : c06bd140  r1 : eef913b4  r0 : 00000000
    [10733.781874] Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
    [10733.788995] Control: 10c5387d  Table: 2c18806a  DAC: 00000051
    [10733.794728] Process bash (pid: 6600, stack limit = 0xee322218)
    [10733.800549] Stack: (0xee323df8 to 0xee324000)
    [10733.804896] 3de0:                                                       ec0e6000 00000000
    [10733.813059] 3e00: 00000001 c089cebc ee323f80 b6f18000 ee323e2c ee323e20 c054c204 c0065394
    [10733.821221] 3e20: ee323e44 ee323e30 c02fec60 c054c1f8 ec0e7ec0 ec3fcfc0 ee323e5c ee323e48
    [10733.829384] 3e40: c02fed08 c02fec48 c07dbf74 eeb05a00 ee323e8c ee323e60 c0253828 c02fecac
    [10733.837547] 3e60: 00000001 c0116950 ee323eac ee323e78 00000001 ec3fce00 ed2d9700 ed2d970c
    [10733.845710] 3e80: ee323e9c ee323e90 c02e873c c02537d4 ee323eac ee323ea0 c017bd40 c02e8720
    [10733.853873] 3ea0: ee323ee4 ee323eb0 c017b250 c017bd00 00000000 00000000 f3e47a54 ec128b00
    [10733.862035] 3ec0: c017b10c ee323f80 00000001 c000f504 ee322000 00000000 ee323f4c ee323ee8
    [10733.870197] 3ee0: c011b71c c017b118 ee323fb0 c011bc90 becfa8d9 00000001 ec128b00 00000001
    [10733.878359] 3f00: b6f18000 ee323f80 ee323f4c ee323f18 c011bc90 c0063950 ee323f3c ee323f28
    [10733.886522] 3f20: c0063950 c0549138 00000001 ec128b00 00000001 ec128b00 b6f18000 ee323f80
    [10733.894684] 3f40: ee323f7c ee323f50 c011bed8 c011b6ec c0135fb8 c0135f24 ec128b00 ec128b00
    [10733.902847] 3f60: 00000001 b6f18000 c000f504 ee322000 ee323fa4 ee323f80 c011c664 c011be24
    [10733.911009] 3f80: 00000000 00000000 00000001 b6f18000 b6e79be0 00000004 00000000 ee323fa8
    [10733.919172] 3fa0: c000f340 c011c618 00000001 b6f18000 00000001 b6f18000 00000001 00000000
    [10733.927334] 3fc0: 00000001 b6f18000 b6e79be0 00000004 00000001 00000001 8068a3f1 b6e79c84
    [10733.935496] 3fe0: 00000000 becfa7dc b6de194d b6e20246 400d0030 00000001 7a4536e8 49bda390
    [10733.943664] [<c00653a0>] (do_raw_spin_lock) from [<c054c204>] (_raw_spin_lock+0x18/0x1c)
    [10733.951743] [<c054c204>] (_raw_spin_lock) from [<c02fec60>] (fw_free_buf+0x24/0x64)
    [10733.959388] [<c02fec60>] (fw_free_buf) from [<c02fed08>] (release_firmware+0x68/0x74)
    [10733.967207] [<c02fed08>] (release_firmware) from [<c0253828>] (trigger_async_request_store+0x60/0x124)
    [10733.976501] [<c0253828>] (trigger_async_request_store) from [<c02e873c>] (dev_attr_store+0x28/0x34)
    [10733.985533] [<c02e873c>] (dev_attr_store) from [<c017bd40>] (sysfs_kf_write+0x4c/0x58)
    [10733.993437] [<c017bd40>] (sysfs_kf_write) from [<c017b250>] (kernfs_fop_write+0x144/0x1a8)
    [10734.001689] [<c017b250>] (kernfs_fop_write) from [<c011b71c>] (__vfs_write+0x3c/0xe4)

After this patch:

    # printf '\x00' > /sys/devices/virtual/misc/test_firmware/trigger_async_request
    [   32.126322] test_firmware: loading ''
    [   32.129995] test_firmware: failed to async load firmware
    -bash: printf: write error: No such device

Fixes: 471b095dfe0d ("firmware_class: make sure fw requests contain a name")
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Ming Lei <ming.lei@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Shuah Khan <shuahkh@osg.samsung.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/base/firmware_class.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index d8e585a62caa..b519e013208c 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -1089,15 +1089,17 @@ static int
 _request_firmware(const struct firmware **firmware_p, const char *name,
 		  struct device *device, unsigned int opt_flags)
 {
-	struct firmware *fw;
+	struct firmware *fw = NULL;
 	long timeout;
 	int ret;
 
 	if (!firmware_p)
 		return -EINVAL;
 
-	if (!name || name[0] == '\0')
-		return -EINVAL;
+	if (!name || name[0] == '\0') {
+		ret = -EINVAL;
+		goto out;
+	}
 
 	ret = _request_firmware_prepare(&fw, name, device);
 	if (ret <= 0) /* error or already assigned */

[toc] | [prev] | [next] | [standalone]

#1326062 — [PATCH 3.16.y-ckt 163/180] bridge: fix lockdep addr_list_lock false positive splat

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>

commit c6894dec8ea9ae05747124dce98b3b5c2e69b168 upstream.

After promisc mode management was introduced a bridge device could do
dev_set_promiscuity from its ndo_change_rx_flags() callback which in
turn can be called after the bridge's addr_list_lock has been taken
(e.g. by dev_uc_add). This causes a false positive lockdep splat because
the port interfaces' addr_list_lock is taken when br_manage_promisc()
runs after the bridge's addr list lock was already taken.
To remove the false positive introduce a custom bridge addr_list_lock
class and set it on bridge init.
A simple way to reproduce this is with the following:
$ brctl addbr br0
$ ip l add l br0 br0.100 type vlan id 100
$ ip l set br0 up
$ ip l set br0.100 up
$ echo 1 > /sys/class/net/br0/bridge/vlan_filtering
$ brctl addif br0 eth0
Splat:
[   43.684325] =============================================
[   43.684485] [ INFO: possible recursive locking detected ]
[   43.684636] 4.4.0-rc8+ #54 Not tainted
[   43.684755] ---------------------------------------------
[   43.684906] brctl/1187 is trying to acquire lock:
[   43.685047]  (_xmit_ETHER){+.....}, at: [<ffffffff8150169e>] dev_set_rx_mode+0x1e/0x40
[   43.685460]  but task is already holding lock:
[   43.685618]  (_xmit_ETHER){+.....}, at: [<ffffffff815072a7>] dev_uc_add+0x27/0x80
[   43.686015]  other info that might help us debug this:
[   43.686316]  Possible unsafe locking scenario:

[   43.686743]        CPU0
[   43.686967]        ----
[   43.687197]   lock(_xmit_ETHER);
[   43.687544]   lock(_xmit_ETHER);
[   43.687886] *** DEADLOCK ***

[   43.688438]  May be due to missing lock nesting notation

[   43.688882] 2 locks held by brctl/1187:
[   43.689134]  #0:  (rtnl_mutex){+.+.+.}, at: [<ffffffff81510317>] rtnl_lock+0x17/0x20
[   43.689852]  #1:  (_xmit_ETHER){+.....}, at: [<ffffffff815072a7>] dev_uc_add+0x27/0x80
[   43.690575] stack backtrace:
[   43.690970] CPU: 0 PID: 1187 Comm: brctl Not tainted 4.4.0-rc8+ #54
[   43.691270] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
[   43.691770]  ffffffff826a25c0 ffff8800369fb8e0 ffffffff81360ceb ffffffff826a25c0
[   43.692425]  ffff8800369fb9b8 ffffffff810d0466 ffff8800369fb968 ffffffff81537139
[   43.693071]  ffff88003a08c880 0000000000000000 00000000ffffffff 0000000002080020
[   43.693709] Call Trace:
[   43.693931]  [<ffffffff81360ceb>] dump_stack+0x4b/0x70
[   43.694199]  [<ffffffff810d0466>] __lock_acquire+0x1e46/0x1e90
[   43.694483]  [<ffffffff81537139>] ? netlink_broadcast_filtered+0x139/0x3e0
[   43.694789]  [<ffffffff8153b5da>] ? nlmsg_notify+0x5a/0xc0
[   43.695064]  [<ffffffff810d10f5>] lock_acquire+0xe5/0x1f0
[   43.695340]  [<ffffffff8150169e>] ? dev_set_rx_mode+0x1e/0x40
[   43.695623]  [<ffffffff815edea5>] _raw_spin_lock_bh+0x45/0x80
[   43.695901]  [<ffffffff8150169e>] ? dev_set_rx_mode+0x1e/0x40
[   43.696180]  [<ffffffff8150169e>] dev_set_rx_mode+0x1e/0x40
[   43.696460]  [<ffffffff8150189c>] dev_set_promiscuity+0x3c/0x50
[   43.696750]  [<ffffffffa0586845>] br_port_set_promisc+0x25/0x50 [bridge]
[   43.697052]  [<ffffffffa05869aa>] br_manage_promisc+0x8a/0xe0 [bridge]
[   43.697348]  [<ffffffffa05826ee>] br_dev_change_rx_flags+0x1e/0x20 [bridge]
[   43.697655]  [<ffffffff81501532>] __dev_set_promiscuity+0x132/0x1f0
[   43.697943]  [<ffffffff81501672>] __dev_set_rx_mode+0x82/0x90
[   43.698223]  [<ffffffff815072de>] dev_uc_add+0x5e/0x80
[   43.698498]  [<ffffffffa05b3c62>] vlan_device_event+0x542/0x650 [8021q]
[   43.698798]  [<ffffffff8109886d>] notifier_call_chain+0x5d/0x80
[   43.699083]  [<ffffffff810988b6>] raw_notifier_call_chain+0x16/0x20
[   43.699374]  [<ffffffff814f456e>] call_netdevice_notifiers_info+0x6e/0x80
[   43.699678]  [<ffffffff814f4596>] call_netdevice_notifiers+0x16/0x20
[   43.699973]  [<ffffffffa05872be>] br_add_if+0x47e/0x4c0 [bridge]
[   43.700259]  [<ffffffffa058801e>] add_del_if+0x6e/0x80 [bridge]
[   43.700548]  [<ffffffffa0588b5f>] br_dev_ioctl+0xaf/0xc0 [bridge]
[   43.700836]  [<ffffffff8151a7ac>] dev_ifsioc+0x30c/0x3c0
[   43.701106]  [<ffffffff8151aac9>] dev_ioctl+0xf9/0x6f0
[   43.701379]  [<ffffffff81254345>] ? mntput_no_expire+0x5/0x450
[   43.701665]  [<ffffffff812543ee>] ? mntput_no_expire+0xae/0x450
[   43.701947]  [<ffffffff814d7b02>] sock_do_ioctl+0x42/0x50
[   43.702219]  [<ffffffff814d8175>] sock_ioctl+0x1e5/0x290
[   43.702500]  [<ffffffff81242d0b>] do_vfs_ioctl+0x2cb/0x5c0
[   43.702771]  [<ffffffff81243079>] SyS_ioctl+0x79/0x90
[   43.703033]  [<ffffffff815eebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a

CC: Vlad Yasevich <vyasevic@redhat.com>
CC: Stephen Hemminger <stephen@networkplumber.org>
CC: Bridge list <bridge@lists.linux-foundation.org>
CC: Andy Gospodarek <gospo@cumulusnetworks.com>
CC: Roopa Prabhu <roopa@cumulusnetworks.com>
Fixes: 2796d0c648c9 ("bridge: Automatically manage port promiscuous mode.")
Reported-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/bridge/br_device.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 568cccd39a3d..f3526464bded 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -25,6 +25,8 @@
 #define COMMON_FEATURES (NETIF_F_SG | NETIF_F_FRAGLIST | NETIF_F_HIGHDMA | \
 			 NETIF_F_GSO_MASK | NETIF_F_HW_CSUM)
 
+static struct lock_class_key bridge_netdev_addr_lock_key;
+
 /* net device transmit always called with BH disabled */
 netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
 {
@@ -85,6 +87,11 @@ out:
 	return NETDEV_TX_OK;
 }
 
+static void br_set_lockdep_class(struct net_device *dev)
+{
+	lockdep_set_class(&dev->addr_list_lock, &bridge_netdev_addr_lock_key);
+}
+
 static int br_dev_init(struct net_device *dev)
 {
 	struct net_bridge *br = netdev_priv(dev);
@@ -92,6 +99,7 @@ static int br_dev_init(struct net_device *dev)
 	br->stats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
 	if (!br->stats)
 		return -ENOMEM;
+	br_set_lockdep_class(dev);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1326063 — [PATCH 3.16.y-ckt 165/180] batman-adv: Avoid recursive call_rcu for batadv_nc_node

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sven Eckelmann <sven@narfation.org>

commit 44e8e7e91d6c7c7ab19688750f7257292640d1a0 upstream.

The batadv_nc_node_free_ref function uses call_rcu to delay the free of the
batadv_nc_node object until no (already started) rcu_read_lock is enabled
anymore. This makes sure that no context is still trying to access the
object which should be removed. But batadv_nc_node also contains a
reference to orig_node which must be removed.

The reference drop of orig_node was done in the call_rcu function
batadv_nc_node_free_rcu but should actually be done in the
batadv_nc_node_release function to avoid nested call_rcus. This is
important because rcu_barrier (e.g. batadv_softif_free or batadv_exit) will
not detect the inner call_rcu as relevant for its execution. Otherwise this
barrier will most likely be inserted in the queue before the callback of
the first call_rcu was executed. The caller of rcu_barrier will therefore
continue to run before the inner call_rcu callback finished.

Fixes: d56b1705e28c ("batman-adv: network coding - detect coding nodes and remove these after timeout")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/batman-adv/network-coding.c | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 65d19690d8ae..4e718162a26b 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -175,28 +175,25 @@ void batadv_nc_init_orig(struct batadv_orig_node *orig_node)
 }
 
 /**
- * batadv_nc_node_free_rcu - rcu callback to free an nc node and remove
- *  its refcount on the orig_node
- * @rcu: rcu pointer of the nc node
+ * batadv_nc_node_release - release nc_node from lists and queue for free after
+ *  rcu grace period
+ * @nc_node: the nc node to free
  */
-static void batadv_nc_node_free_rcu(struct rcu_head *rcu)
+static void batadv_nc_node_release(struct batadv_nc_node *nc_node)
 {
-	struct batadv_nc_node *nc_node;
-
-	nc_node = container_of(rcu, struct batadv_nc_node, rcu);
 	batadv_orig_node_free_ref(nc_node->orig_node);
-	kfree(nc_node);
+	kfree_rcu(nc_node, rcu);
 }
 
 /**
- * batadv_nc_node_free_ref - decrements the nc node refcounter and possibly
- * frees it
+ * batadv_nc_node_free_ref - decrement the nc node refcounter and possibly
+ *  release it
  * @nc_node: the nc node to free
  */
 static void batadv_nc_node_free_ref(struct batadv_nc_node *nc_node)
 {
 	if (atomic_dec_and_test(&nc_node->refcount))
-		call_rcu(&nc_node->rcu, batadv_nc_node_free_rcu);
+		batadv_nc_node_release(nc_node);
 }
 
 /**

[toc] | [prev] | [next] | [standalone]

#1326064 — [PATCH 3.16.y-ckt 166/180] batman-adv: fix potential TT client + orig-node memory leak

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>

commit 9d31b3ce81683ce3c9fd10afa70892e373b21067 upstream.

This patch fixes a potential memory leak which can occur once an
originator times out. On timeout the according global translation table
entry might not get purged correctly. Furthermore, the non purged TT
entry will cause its orig-node to leak, too. Which additionally can lead
to the new multicast optimization feature not kicking in because of a
therefore bogus counter.

In detail: The batadv_tt_global_entry->orig_list holds the reference to
the orig-node. Usually this reference is released after
BATADV_PURGE_TIMEOUT through: _batadv_purge_orig()->
batadv_purge_orig_node()->batadv_update_route()->_batadv_update_route()->
batadv_tt_global_del_orig() which purges this global tt entry and
releases the reference to the orig-node.

However, if between two batadv_purge_orig_node() calls the orig-node
timeout grew to 2*BATADV_PURGE_TIMEOUT then this call path isn't
reached. Instead the according orig-node is removed from the
originator hash in _batadv_purge_orig(), the batadv_update_route()
part is skipped and won't be reached anymore.

Fixing the issue by moving batadv_tt_global_del_orig() out of the rcu
callback.

Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Acked-by: Antonio Quartulli <antonio@meshcoding.com>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/batman-adv/originator.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 57b30a6b9bbb..e4eeb6342b38 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -570,9 +570,6 @@ static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 
 	batadv_frag_purge_orig(orig_node, NULL);
 
-	batadv_tt_global_del_orig(orig_node->bat_priv, orig_node, -1,
-				  "originator timed out");
-
 	if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
 		orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
 
@@ -982,6 +979,9 @@ static void _batadv_purge_orig(struct batadv_priv *bat_priv)
 			if (batadv_purge_orig_node(bat_priv, orig_node)) {
 				batadv_gw_node_delete(bat_priv, orig_node);
 				hlist_del_rcu(&orig_node->hash_entry);
+				batadv_tt_global_del_orig(orig_node->bat_priv,
+							  orig_node, -1,
+							  "originator timed out");
 				batadv_orig_node_free_ref(orig_node);
 				continue;
 			}

[toc] | [prev] | [next] | [standalone]

#1326065 — [PATCH 3.16.y-ckt 167/180] batman-adv: Drop immediate batadv_orig_ifinfo free function

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sven Eckelmann <sven@narfation.org>

commit deed96605f5695cb945e0b3d79429581857a2b9d upstream.

It is not allowed to free the memory of an object which is part of a list
which is protected by rcu-read-side-critical sections without making sure
that no other context is accessing the object anymore. This usually happens
by removing the references to this object and then waiting until the rcu
grace period is over and no one (allowedly) accesses it anymore.

But the _now functions ignore this completely. They free the object
directly even when a different context still tries to access it. This has
to be avoided and thus these functions must be removed and all functions
have to use batadv_orig_ifinfo_free_ref.

Fixes: 7351a4822d42 ("batman-adv: split out router from orig_node")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/batman-adv/originator.c | 59 ++++++++++++++++++++++++---------------------
 1 file changed, 31 insertions(+), 28 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index e4eeb6342b38..f54a1d030647 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -516,76 +516,79 @@ static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu)
 }
 
 /**
- * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly free
- *  the orig_ifinfo (without rcu callback)
+ * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly release
+ *  the orig_ifinfo
  * @orig_ifinfo: the orig_ifinfo object to release
  */
-static void
-batadv_orig_ifinfo_free_ref_now(struct batadv_orig_ifinfo *orig_ifinfo)
+void batadv_orig_ifinfo_free_ref(struct batadv_orig_ifinfo *orig_ifinfo)
 {
 	if (atomic_dec_and_test(&orig_ifinfo->refcount))
-		batadv_orig_ifinfo_free_rcu(&orig_ifinfo->rcu);
+		call_rcu(&orig_ifinfo->rcu, batadv_orig_ifinfo_free_rcu);
 }
 
 /**
- * batadv_orig_ifinfo_free_ref - decrement the refcounter and possibly free
- *  the orig_ifinfo
- * @orig_ifinfo: the orig_ifinfo object to release
+ * batadv_orig_node_free_rcu - free the orig_node
+ * @rcu: rcu pointer of the orig_node
  */
-void batadv_orig_ifinfo_free_ref(struct batadv_orig_ifinfo *orig_ifinfo)
+static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
 {
-	if (atomic_dec_and_test(&orig_ifinfo->refcount))
-		call_rcu(&orig_ifinfo->rcu, batadv_orig_ifinfo_free_rcu);
+	struct batadv_orig_node *orig_node;
+
+	orig_node = container_of(rcu, struct batadv_orig_node, rcu);
+
+	batadv_mcast_purge_orig(orig_node);
+
+	batadv_frag_purge_orig(orig_node, NULL);
+
+	if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
+		orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
+
+	kfree(orig_node->tt_buff);
+	kfree(orig_node);
 }
 
-static void batadv_orig_node_free_rcu(struct rcu_head *rcu)
+/**
+ * batadv_orig_node_release - release orig_node from lists and queue for
+ *  free after rcu grace period
+ * @orig_node: the orig node to free
+ */
+static void batadv_orig_node_release(struct batadv_orig_node *orig_node)
 {
 	struct hlist_node *node_tmp;
 	struct batadv_neigh_node *neigh_node;
-	struct batadv_orig_node *orig_node;
 	struct batadv_orig_ifinfo *orig_ifinfo;
 
-	orig_node = container_of(rcu, struct batadv_orig_node, rcu);
-
 	spin_lock_bh(&orig_node->neigh_list_lock);
 
 	/* for all neighbors towards this originator ... */
 	hlist_for_each_entry_safe(neigh_node, node_tmp,
 				  &orig_node->neigh_list, list) {
 		hlist_del_rcu(&neigh_node->list);
-		batadv_neigh_node_free_ref_now(neigh_node);
+		batadv_neigh_node_free_ref(neigh_node);
 	}
 
 	hlist_for_each_entry_safe(orig_ifinfo, node_tmp,
 				  &orig_node->ifinfo_list, list) {
 		hlist_del_rcu(&orig_ifinfo->list);
-		batadv_orig_ifinfo_free_ref_now(orig_ifinfo);
+		batadv_orig_ifinfo_free_ref(orig_ifinfo);
 	}
 	spin_unlock_bh(&orig_node->neigh_list_lock);
 
-	batadv_mcast_purge_orig(orig_node);
-
 	/* Free nc_nodes */
 	batadv_nc_purge_orig(orig_node->bat_priv, orig_node, NULL);
 
-	batadv_frag_purge_orig(orig_node, NULL);
-
-	if (orig_node->bat_priv->bat_algo_ops->bat_orig_free)
-		orig_node->bat_priv->bat_algo_ops->bat_orig_free(orig_node);
-
-	kfree(orig_node->tt_buff);
-	kfree(orig_node);
+	call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
 }
 
 /**
  * batadv_orig_node_free_ref - decrement the orig node refcounter and possibly
- * schedule an rcu callback for freeing it
+ *  release it
  * @orig_node: the orig node to free
  */
 void batadv_orig_node_free_ref(struct batadv_orig_node *orig_node)
 {
 	if (atomic_dec_and_test(&orig_node->refcount))
-		call_rcu(&orig_node->rcu, batadv_orig_node_free_rcu);
+		batadv_orig_node_release(orig_node);
 }
 
 /**

[toc] | [prev] | [next] | [standalone]

#1326066 — [PATCH 3.16.y-ckt 176/180] arm64: fix building without CONFIG_UID16

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit fbc416ff86183e2203cdf975e2881d7c164b0271 upstream.

As reported by Michal Simek, building an ARM64 kernel with CONFIG_UID16
disabled currently fails because the system call table still needs to
reference the individual function entry points that are provided by
kernel/sys_ni.c in this case, and the declarations are hidden inside
of #ifdef CONFIG_UID16:

arch/arm64/include/asm/unistd32.h:57:8: error: 'sys_lchown16' undeclared here (not in a function)
 __SYSCALL(__NR_lchown, sys_lchown16)

I believe this problem only exists on ARM64, because older architectures
tend to not need declarations when their system call table is built
in assembly code, while newer architectures tend to not need UID16
support. ARM64 only uses these system calls for compatibility with
32-bit ARM binaries.

This changes the CONFIG_UID16 check into CONFIG_HAVE_UID16, which is
set unconditionally on ARM64 with CONFIG_COMPAT, so we see the
declarations whenever we need them, but otherwise the behavior is
unchanged.

Fixes: af1839eb4bd4 ("Kconfig: clean up the long arch list for the UID16 config option")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/syscalls.h | 2 +-
 include/linux/types.h    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index b0881a0ed322..2b2db0828ffc 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -515,7 +515,7 @@ asmlinkage long sys_chown(const char __user *filename,
 asmlinkage long sys_lchown(const char __user *filename,
 				uid_t user, gid_t group);
 asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group);
-#ifdef CONFIG_UID16
+#ifdef CONFIG_HAVE_UID16
 asmlinkage long sys_chown16(const char __user *filename,
 				old_uid_t user, old_gid_t group);
 asmlinkage long sys_lchown16(const char __user *filename,
diff --git a/include/linux/types.h b/include/linux/types.h
index a0bb7048687f..e6d1694f6e64 100644
--- a/include/linux/types.h
+++ b/include/linux/types.h
@@ -35,7 +35,7 @@ typedef __kernel_gid16_t        gid16_t;
 
 typedef unsigned long		uintptr_t;
 
-#ifdef CONFIG_UID16
+#ifdef CONFIG_HAVE_UID16
 /* This is defined by include/asm-{arch}/posix_types.h */
 typedef __kernel_old_uid_t	old_uid_t;
 typedef __kernel_old_gid_t	old_gid_t;

[toc] | [prev] | [next] | [standalone]

#1326067 — [PATCH 3.16.y-ckt 173/180] mmc: debugfs: correct wrong voltage value

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Chuanxiao Dong <chuanxiao.dong@intel.com>

commit 0036e74686344f1051afc3107740140abfd03616 upstream.

Correct the wrong voltage value shown in debugfs for mmc/sd/sdio.

Signed-off-by: Chuanxiao Dong <chuanxiao.dong@intel.com>
Signed-off-by: Pawel Wodkowski <pawelx.wodkowski@intel.com>
Fixes: 42cd95a0603e ("mmc: core: debugfs: Add signal_voltage to ios dump")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/mmc/core/debugfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/core/debugfs.c b/drivers/mmc/core/debugfs.c
index 91eb16223246..c63d39ff4d1d 100644
--- a/drivers/mmc/core/debugfs.c
+++ b/drivers/mmc/core/debugfs.c
@@ -164,7 +164,7 @@ static int mmc_ios_show(struct seq_file *s, void *data)
 		str = "invalid";
 		break;
 	}
-	seq_printf(s, "signal voltage:\t%u (%s)\n", ios->chip_select, str);
+	seq_printf(s, "signal voltage:\t%u (%s)\n", ios->signal_voltage, str);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1326068 — [PATCH 3.16.y-ckt 161/180] mmc: sd: limit SD card power limit according to cards capabilities

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Russell King <rmk+kernel@arm.linux.org.uk>

commit d9812780a020bcec44565b5950b2a8b31afb5545 upstream.

The SD card specification allows cards to error out a SWITCH command
where the requested function in a group is not supported.  The spec
provides for a set of capabilities which indicate which functions are
supported.

In the case of the power limit, requesting an unsupported power level
via the SWITCH command fails, resulting in the power level remaining at
the power-on default of 0.72W, even though the host and card may support
higher powers levels.

This has been seen with SanDisk 8GB cards, which support the default
0.72W and 1.44W (200mA and 400mA) in combination with an iMX6 host,
supporting up to 2.88W (800mA).  This currently causes us to try to set
a power limit function value of '3' (2.88W) which the card errors out
on, and thereby causes the power level to remain at 0.72W rather than
the desired 1.44W.

Arrange to limit the selected current limit by the capabilities reported
by the card to avoid the SWITCH command failing.  Select the highest
current limit that the host and card combination support.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Fixes: a39ca6ae0a08 ("mmc: core: Simplify and fix for SD switch processing")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/mmc/core/sd.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c
index 0c44510bf717..aff8a7e0edd3 100644
--- a/drivers/mmc/core/sd.c
+++ b/drivers/mmc/core/sd.c
@@ -329,6 +329,7 @@ static int mmc_read_switch(struct mmc_card *card)
 		card->sw_caps.sd3_bus_mode = status[13];
 		/* Driver Strengths supported by the card */
 		card->sw_caps.sd3_drv_type = status[9];
+		card->sw_caps.sd3_curr_limit = status[7] | status[6] << 8;
 	}
 
 out:
@@ -581,14 +582,25 @@ static int sd_set_current_limit(struct mmc_card *card, u8 *status)
 	 * when we set current limit to 200ma, the card will draw 200ma, and
 	 * when we set current limit to 400/600/800ma, the card will draw its
 	 * maximum 300ma from the host.
+	 *
+	 * The above is incorrect: if we try to set a current limit that is
+	 * not supported by the card, the card can rightfully error out the
+	 * attempt, and remain at the default current limit.  This results
+	 * in a 300mA card being limited to 200mA even though the host
+	 * supports 800mA. Failures seen with SanDisk 8GB UHS cards with
+	 * an iMX6 host. --rmk
 	 */
-	if (max_current >= 800)
+	if (max_current >= 800 &&
+	    card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_800)
 		current_limit = SD_SET_CURRENT_LIMIT_800;
-	else if (max_current >= 600)
+	else if (max_current >= 600 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_600)
 		current_limit = SD_SET_CURRENT_LIMIT_600;
-	else if (max_current >= 400)
+	else if (max_current >= 400 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_400)
 		current_limit = SD_SET_CURRENT_LIMIT_400;
-	else if (max_current >= 200)
+	else if (max_current >= 200 &&
+		 card->sw_caps.sd3_curr_limit & SD_MAX_CURRENT_200)
 		current_limit = SD_SET_CURRENT_LIMIT_200;
 
 	if (current_limit != SD_SET_CURRENT_NO_CHANGE) {

[toc] | [prev] | [next] | [standalone]

#1326070 — [PATCH 3.16.y-ckt 154/180] kconfig: return 'false' instead of 'no' in bool function

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Vegard Nossum <vegard.nossum@oracle.com>

commit aab24a897cfba9dd371f6aac45dbcdae0b23def6 upstream.

menu_is_visible() is a bool function and should use boolean return
values. "no" is a tristate value which happens to also have a value
of 0, but we should nevertheless use the right symbol for it.

This is a very minor cleanup with no semantic change.

Fixes: 86e187ff9 ("kconfig: add an option to determine a menu's visibility")
Cc: Arnaud Lacombe <lacombar@gmail.com>
Cc: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Michal Marek <mmarek@suse.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 scripts/kconfig/menu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c
index 72c9dba84c5d..876c45d756d0 100644
--- a/scripts/kconfig/menu.c
+++ b/scripts/kconfig/menu.c
@@ -477,7 +477,7 @@ bool menu_is_visible(struct menu *menu)
 
 	if (menu->visibility) {
 		if (expr_calc_value(menu->visibility) == no)
-			return no;
+			return false;
 	}
 
 	sym = menu->sym;

[toc] | [prev] | [next] | [standalone]

#1326071 — [PATCH 3.16.y-ckt 169/180] batman-adv: Drop immediate neigh_ifinfo free function

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Sven Eckelmann <sven@narfation.org>

commit ae3e1e36e3cb6c686a7a2725af20ca86aa46d62a upstream.

It is not allowed to free the memory of an object which is part of a list
which is protected by rcu-read-side-critical sections without making sure
that no other context is accessing the object anymore. This usually happens
by removing the references to this object and then waiting until the rcu
grace period is over and no one (allowedly) accesses it anymore.

But the _now functions ignore this completely. They free the object
directly even when a different context still tries to access it. This has
to be avoided and thus these functions must be removed and all functions
have to use batadv_neigh_ifinfo_free_ref.

Fixes: 89652331c00f ("batman-adv: split tq information in neigh_node struct")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <a@unstable.cc>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/batman-adv/originator.c | 34 ++++++++++------------------------
 1 file changed, 10 insertions(+), 24 deletions(-)

diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
index 3390419152d3..550f2561f9bf 100644
--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -150,42 +150,28 @@ err:
 }
 
 /**
- * batadv_neigh_ifinfo_free_rcu - free the neigh_ifinfo object
- * @rcu: rcu pointer of the neigh_ifinfo object
- */
-static void batadv_neigh_ifinfo_free_rcu(struct rcu_head *rcu)
-{
-	struct batadv_neigh_ifinfo *neigh_ifinfo;
-
-	neigh_ifinfo = container_of(rcu, struct batadv_neigh_ifinfo, rcu);
-
-	if (neigh_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
-		batadv_hardif_free_ref_now(neigh_ifinfo->if_outgoing);
-
-	kfree(neigh_ifinfo);
-}
-
-/**
- * batadv_neigh_ifinfo_free_now - decrement the refcounter and possibly free
- *  the neigh_ifinfo (without rcu callback)
+ * batadv_neigh_ifinfo_release - release neigh_ifinfo from lists and queue for
+ *  free after rcu grace period
  * @neigh_ifinfo: the neigh_ifinfo object to release
  */
 static void
-batadv_neigh_ifinfo_free_ref_now(struct batadv_neigh_ifinfo *neigh_ifinfo)
+batadv_neigh_ifinfo_release(struct batadv_neigh_ifinfo *neigh_ifinfo)
 {
-	if (atomic_dec_and_test(&neigh_ifinfo->refcount))
-		batadv_neigh_ifinfo_free_rcu(&neigh_ifinfo->rcu);
+	if (neigh_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
+		batadv_hardif_free_ref(neigh_ifinfo->if_outgoing);
+
+	kfree_rcu(neigh_ifinfo, rcu);
 }
 
 /**
- * batadv_neigh_ifinfo_free_ref - decrement the refcounter and possibly free
+ * batadv_neigh_ifinfo_free_ref - decrement the refcounter and possibly release
  *  the neigh_ifinfo
  * @neigh_ifinfo: the neigh_ifinfo object to release
  */
 void batadv_neigh_ifinfo_free_ref(struct batadv_neigh_ifinfo *neigh_ifinfo)
 {
 	if (atomic_dec_and_test(&neigh_ifinfo->refcount))
-		call_rcu(&neigh_ifinfo->rcu, batadv_neigh_ifinfo_free_rcu);
+		batadv_neigh_ifinfo_release(neigh_ifinfo);
 }
 
 /**
@@ -202,7 +188,7 @@ static void batadv_neigh_node_free_rcu(struct rcu_head *rcu)
 
 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
 				  &neigh_node->ifinfo_list, list) {
-		batadv_neigh_ifinfo_free_ref_now(neigh_ifinfo);
+		batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
 	}
 	batadv_hardif_free_ref_now(neigh_node->if_incoming);
 

[toc] | [prev] | [next] | [standalone]

#1326072 — [PATCH 3.16.y-ckt 153/180] sysrq: Fix warning in sysrq generated crash.

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ani Sinha <ani@arista.com>

commit 984cf355aeaa8f2eda3861b50d0e8d3e3f77e83b upstream.

Commit 984d74a72076a1 ("sysrq: rcu-ify __handle_sysrq") replaced
spin_lock_irqsave() calls with rcu_read_lock() calls in sysrq. Since
rcu_read_lock() does not disable preemption, faulthandler_disabled() in
__do_page_fault() in x86/fault.c returns false. When the code later calls
might_sleep() in the pagefault handler, we get the following warning:

BUG: sleeping function called from invalid context at ../arch/x86/mm/fault.c:1187
in_atomic(): 0, irqs_disabled(): 0, pid: 4706, name: bash
Preemption disabled at:[<ffffffff81484339>] printk+0x48/0x4a

To fix this, we release the RCU read lock before we crash.

Tested this patch on linux 3.18 by booting off one of our boards.

Fixes: 984d74a72076a1 ("sysrq: rcu-ify __handle_sysrq")

Signed-off-by: Ani Sinha <ani@arista.com>
Reviewed-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/tty/sysrq.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index b5e98de489dc..0c79f95383c0 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -133,6 +133,12 @@ static void sysrq_handle_crash(int key)
 {
 	char *killer = NULL;
 
+	/* we need to release the RCU read lock here,
+	 * otherwise we get an annoying
+	 * 'BUG: sleeping function called from invalid context'
+	 * complaint from the kernel before the panic.
+	 */
+	rcu_read_unlock();
 	panic_on_oops = 1;	/* force panic */
 	wmb();
 	*killer = 1;

[toc] | [prev] | [next] | [standalone]

#1326073 — [PATCH 3.16.y-ckt 152/180] x86/LDT: Print the real LDT base address

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jan Beulich <JBeulich@suse.com>

commit 0d430e3fb3f7cdc13c0d22078b820f682821b45a upstream.

This was meant to print base address and entry count; make it do so
again.

Fixes: 37868fe113ff "x86/ldt: Make modify_ldt synchronous"
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andy Lutomirski <luto@kernel.org>
Link: http://lkml.kernel.org/r/56797D8402000078000C24F0@prv-mh.provo.novell.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/x86/kernel/process_64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e84487aa2fd2..e2072dc4b67a 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -125,7 +125,7 @@ void release_thread(struct task_struct *dead_task)
 		if (dead_task->mm->context.ldt) {
 			pr_warn("WARNING: dead process %s still has LDT? <%p/%d>\n",
 				dead_task->comm,
-				dead_task->mm->context.ldt,
+				dead_task->mm->context.ldt->entries,
 				dead_task->mm->context.ldt->size);
 			BUG();
 		}

[toc] | [prev] | [next] | [standalone]

#1326075 — [PATCH 3.16.y-ckt 172/180] printk: help pr_debug and pr_devel to optimize out arguments

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Aaron Conole <aconole@redhat.com>

commit fe22cd9b7c980b8b948ec85f034a8668c57ec867 upstream.

Currently, pr_debug and pr_devel will not elide function call arguments
appearing in calls to the no_printk for these macros.  This is because
all side effects must be honored before proceeding to the 0-value
assignment in no_printk.

The behavior is contrary to documentation found in the CodingStyle and
the header file where these functions are declared.

This patch corrects that behavior by shunting out the call to no_printk
completely.  The format string is still checked by gcc for correctness,
but no code seems to be emitted in common cases.

[akpm@linux-foundation.org: remove braces, per Joe]
Fixes: 5264f2f75d86 ("include/linux/printk.h: use and neaten no_printk")
Signed-off-by: Aaron Conole <aconole@redhat.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Joe Perches <joe@perches.com>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/printk.h | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/linux/printk.h b/include/linux/printk.h
index 319ff7e53efb..4b0636bcf268 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -104,13 +104,13 @@ struct va_format {
 
 /*
  * Dummy printk for disabled debugging statements to use whilst maintaining
- * gcc's format and side-effect checking.
+ * gcc's format checking.
  */
-static inline __printf(1, 2)
-int no_printk(const char *fmt, ...)
-{
-	return 0;
-}
+#define no_printk(fmt, ...)			\
+do {						\
+	if (0)					\
+		printk(fmt, ##__VA_ARGS__);	\
+} while (0)
 
 #ifdef CONFIG_EARLY_PRINTK
 extern asmlinkage __printf(1, 2)

[toc] | [prev] | [next] | [standalone]

#1326076 — [PATCH 3.16.y-ckt 158/180] target: Fix a memory leak in target_dev_lba_map_store()

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Bart Van Assche <bart.vanassche@sandisk.com>

commit f0a8afecb29ad0005e7e946228a0ef5422058b85 upstream.

strsep() modifies its first argument. Make the pointer passed to kfree()
match the return value of kmalloc().

Fixes: 229d4f112fd6 (commit "target_core_alua: Referrals configfs integration")
Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Cc: Hannes Reinecke <hare@suse.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/target/target_core_configfs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 756def38c77a..d45fc1d38393 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -1810,14 +1810,14 @@ static ssize_t target_core_store_dev_lba_map(
 	struct se_device *dev = p;
 	struct t10_alua_lba_map *lba_map = NULL;
 	struct list_head lba_list;
-	char *map_entries, *ptr;
+	char *map_entries, *orig, *ptr;
 	char state;
 	int pg_num = -1, pg;
 	int ret = 0, num = 0, pg_id, alua_state;
 	unsigned long start_lba = -1, end_lba = -1;
 	unsigned long segment_size = -1, segment_mult = -1;
 
-	map_entries = kstrdup(page, GFP_KERNEL);
+	orig = map_entries = kstrdup(page, GFP_KERNEL);
 	if (!map_entries)
 		return -ENOMEM;
 
@@ -1915,7 +1915,7 @@ out:
 	} else
 		core_alua_set_lba_map(dev, &lba_list,
 				      segment_size, segment_mult);
-	kfree(map_entries);
+	kfree(orig);
 	return count;
 }
 

[toc] | [prev] | [next] | [standalone]

#1326077 — [PATCH 3.16.y-ckt 177/180] mn10300: Select CONFIG_HAVE_UID16 to fix build failure

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Guenter Roeck <linux@roeck-us.net>

commit c86576ea114a9a881cf7328dc7181052070ca311 upstream.

mn10300 builds fail with

fs/stat.c: In function 'cp_old_stat':
fs/stat.c:163:2: error: 'old_uid_t' undeclared

ipc/util.c: In function 'ipc64_perm_to_ipc_perm':
ipc/util.c:540:2: error: 'old_uid_t' undeclared

Select CONFIG_HAVE_UID16 and remove local definition of CONFIG_UID16
to fix the problem.

Fixes: fbc416ff8618 ("arm64: fix building without CONFIG_UID16")
Cc: Arnd Bergmann <arnd@arndb.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/mn10300/Kconfig | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index a648de1b1096..b78e48fb5f45 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -1,6 +1,7 @@
 config MN10300
 	def_bool y
 	select HAVE_OPROFILE
+	select HAVE_UID16
 	select GENERIC_IRQ_SHOW
 	select ARCH_WANT_IPC_PARSE_VERSION
 	select HAVE_ARCH_TRACEHOOK
@@ -37,9 +38,6 @@ config HIGHMEM
 config NUMA
 	def_bool n
 
-config UID16
-	def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
 	def_bool y
 

[toc] | [prev] | [next] | [standalone]

#1326081 — [PATCH 3.16.y-ckt 178/180] openrisc: fix CONFIG_UID16 setting

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Andrew Morton <akpm@linux-foundation.org>

commit 04ea1e91f85615318ea91ce8ab50cb6a01ee4005 upstream.

openrisc-allnoconfig:

  kernel/uid16.c: In function 'SYSC_setgroups16':
  kernel/uid16.c:184:2: error: implicit declaration of function 'groups_alloc'
  kernel/uid16.c:184:13: warning: assignment makes pointer from integer without a cast

openrisc shouldn't be setting CONFIG_UID16 when CONFIG_MULTIUSER=n.

Fixes: 2813893f8b197a1 ("kernel: conditionally support non-root users, groups and capabilities")
Reported-by: Fengguang Wu <fengguang.wu@gmail.com>
Cc: Iulia Manda <iulia.manda21@gmail.com>
Cc: Josh Triplett <josh@joshtriplett.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/openrisc/Kconfig | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
index e71d712afb79..f56d7ec6ce5e 100644
--- a/arch/openrisc/Kconfig
+++ b/arch/openrisc/Kconfig
@@ -16,6 +16,7 @@ config OPENRISC
 	select GENERIC_IRQ_SHOW
 	select GENERIC_IOMAP
 	select GENERIC_CPU_DEVICES
+	select HAVE_UID16
 	select GENERIC_ATOMIC64
 	select GENERIC_CLOCKEVENTS
 	select GENERIC_STRNCPY_FROM_USER
@@ -29,9 +30,6 @@ config MMU
 config HAVE_DMA_ATTRS
 	def_bool y
 
-config UID16
-	def_bool y
-
 config RWSEM_GENERIC_SPINLOCK
 	def_bool y
 

[toc] | [prev] | [next] | [standalone]

#1326085 — [PATCH 3.16.y-ckt 151/180] pinctrl: bcm2835: Fix memory leak in error path

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

commit 53653c6b91750debba6dc4503003c851257fd340 upstream.

In case of an invalid pin value bcm2835_pctl_dt_node_to_map()
would leak the pull configs of already assigned pins.
So avoid this by calling the free map function in error case.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: e1b2dc70cd5b ("pinctrl: add bcm2835 driver")
Reviewed-by: Eric Anholt <eric@anholt.net>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ luis: backported to 3.16:
  - file rename: drivers/pinctrl/bcm/pinctrl-bcm2835.c ->
    drivers/pinctrl/pinctrl-bcm2835.c ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/pinctrl/pinctrl-bcm2835.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pinctrl/pinctrl-bcm2835.c b/drivers/pinctrl/pinctrl-bcm2835.c
index 1ad7caf08b6c..294c8a9dfe50 100644
--- a/drivers/pinctrl/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/pinctrl-bcm2835.c
@@ -795,7 +795,7 @@ static int bcm2835_pctl_dt_node_to_map(struct pinctrl_dev *pctldev,
 	return 0;
 
 out:
-	kfree(maps);
+	bcm2835_pctl_dt_free_map(pctldev, maps, num_pins * maps_per_pin);
 	return err;
 }
 

[toc] | [prev] | [next] | [standalone]

#1326088 — [PATCH 3.16.y-ckt 141/180] drm/i915: On fb alloc failure, unref gem object where it gets refed

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Lukas Wunner <lukas@wunner.de>

commit dcb1394e74e32e33856e877bca1a0e88c78323d8 upstream.

Currently when allocating a framebuffer fails, the gem object gets
unrefed at the bottom of the call stack in __intel_framebuffer_create,
not where it gets refed, which is in intel_framebuffer_create_for_mode
(via i915_gem_alloc_object) and in intel_user_framebuffer_create
(via drm_gem_object_lookup).

This invites mistakes: __intel_framebuffer_create is also called from
intelfb_alloc, and as discovered by Tvrtko Ursulin, a double unref
was introduced there with a8bb6818270c ("drm/i915: Fix error path leak
in fbdev fb allocation").

As suggested by Ville Syrjälä, fix the double unref and improve code
clarity by moving the unref away from __intel_framebuffer_create to
where the gem object gets refed.

Based on Tvrtko Ursulin's original v2.

v3: On fb alloc failure, unref gem object where it gets refed,
    fix double unref in separate commit (Ville Syrjälä)

v4: Lock struct_mutex on unref (Chris Wilson)

v5: Rebase on drm-intel-nightly 2015y-09m-01d-09h-06m-08s UTC,
    rephrase commit message (Jani Nicula)

Tested-by: Pierre Moreau <pierre.morrow@free.fr>
    [MBP  5,3 2009  nvidia MCP79 + G96        pre-retina]
Tested-by: Paul Hordiienko <pvt.gord@gmail.com>
    [MBP  6,2 2010  intel ILK + nvidia GT216  pre-retina]
Tested-by: William Brown <william@blackhats.net.au>
    [MBP  8,2 2011  intel SNB + amd turks     pre-retina]
Tested-by: Lukas Wunner <lukas@wunner.de>
    [MBP  9,1 2012  intel IVB + nvidia GK107  pre-retina]
Tested-by: Bruno Bierbaumer <bruno@bierbaumer.net>
    [MBP 11,3 2013  intel HSW + nvidia GK107  retina]

Fixes: a8bb6818270c ("drm/i915: Fix error path leak in fbdev fb
    allocation")
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/2161c5062ef5d6458f8ae14d924a26d4d1dba317.1446892879.git.lukas@wunner.de
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/i915/intel_display.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 0d68c70368ff..58563e2574f8 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8219,20 +8219,17 @@ __intel_framebuffer_create(struct drm_device *dev,
 	int ret;
 
 	intel_fb = kzalloc(sizeof(*intel_fb), GFP_KERNEL);
-	if (!intel_fb) {
-		drm_gem_object_unreference(&obj->base);
+	if (!intel_fb)
 		return ERR_PTR(-ENOMEM);
-	}
 
 	ret = intel_framebuffer_init(dev, intel_fb, mode_cmd, obj);
 	if (ret)
 		goto err;
 
 	return &intel_fb->base;
+
 err:
-	drm_gem_object_unreference(&obj->base);
 	kfree(intel_fb);
-
 	return ERR_PTR(ret);
 }
 
@@ -8272,6 +8269,7 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
 				  struct drm_display_mode *mode,
 				  int depth, int bpp)
 {
+	struct drm_framebuffer *fb;
 	struct drm_i915_gem_object *obj;
 	struct drm_mode_fb_cmd2 mode_cmd = { 0 };
 
@@ -8286,7 +8284,11 @@ intel_framebuffer_create_for_mode(struct drm_device *dev,
 								bpp);
 	mode_cmd.pixel_format = drm_mode_legacy_fb_format(bpp, depth);
 
-	return intel_framebuffer_create(dev, &mode_cmd, obj);
+	fb = intel_framebuffer_create(dev, &mode_cmd, obj);
+	if (IS_ERR(fb))
+		drm_gem_object_unreference_unlocked(&obj->base);
+
+	return fb;
 }
 
 static struct drm_framebuffer *
@@ -11421,6 +11423,7 @@ intel_user_framebuffer_create(struct drm_device *dev,
 			      struct drm_file *filp,
 			      struct drm_mode_fb_cmd2 *mode_cmd)
 {
+	struct drm_framebuffer *fb;
 	struct drm_i915_gem_object *obj;
 
 	obj = to_intel_bo(drm_gem_object_lookup(dev, filp,
@@ -11428,7 +11431,11 @@ intel_user_framebuffer_create(struct drm_device *dev,
 	if (&obj->base == NULL)
 		return ERR_PTR(-ENOENT);
 
-	return intel_framebuffer_create(dev, mode_cmd, obj);
+	fb = intel_framebuffer_create(dev, mode_cmd, obj);
+	if (IS_ERR(fb))
+		drm_gem_object_unreference_unlocked(&obj->base);
+
+	return fb;
 }
 
 #ifndef CONFIG_DRM_I915_FBDEV

[toc] | [prev] | [next] | [standalone]

#1326091 — [PATCH 3.16.y-ckt 145/180] clk: st: avoid uninitialized variable use

3.16.7-ckt24 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 2dd52d7f6f9d9d03a82a68040ac3d221dd79af94 upstream.

quadfs_pll_fs660c32_round_rate prints a few structure members
that are never initialized, and also doesn't print the only one
it cares about. We get a gcc warning about the ones that
are printed:

clk/st/clkgen-fsyn.c:560:93: warning: 'params.sdiv' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.mdiv' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.pe' may be used uninitialized in this function
clk/st/clkgen-fsyn.c:560:93: warning: 'params.nsdiv' may be used uninitialized in this function

This changes the code to no longer print uninitialized data, and
for good measure it also prints the ndiv member that is being
set.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 5f7aa9071e93 ("clk: st: Support for QUADFS inside ClockGenB/C/D/E/F")
Acked-by: Gabriel Fernandez <gabriel.fernandez@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/clk/st/clkgen-fsyn.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
index 4f53ee0778d9..bc298dc329d7 100644
--- a/drivers/clk/st/clkgen-fsyn.c
+++ b/drivers/clk/st/clkgen-fsyn.c
@@ -408,19 +408,20 @@ int clk_fs660c32_vco_get_params(unsigned long input,
 	return 0;
 }
 
-static long quadfs_pll_fs660c32_round_rate(struct clk_hw *hw, unsigned long rate
-		, unsigned long *prate)
+static long quadfs_pll_fs660c32_round_rate(struct clk_hw *hw,
+					   unsigned long rate,
+					   unsigned long *prate)
 {
 	struct stm_fs params;
 
-	if (!clk_fs660c32_vco_get_params(*prate, rate, &params))
-		clk_fs660c32_vco_get_rate(*prate, &params, &rate);
+	if (clk_fs660c32_vco_get_params(*prate, rate, &params))
+		return rate;
 
-	pr_debug("%s: %s new rate %ld [sdiv=0x%x,md=0x%x,pe=0x%x,nsdiv3=%u]\n",
+	clk_fs660c32_vco_get_rate(*prate, &params, &rate);
+
+	pr_debug("%s: %s new rate %ld [ndiv=%u]\n",
 		 __func__, __clk_get_name(hw->clk),
-		 rate, (unsigned int)params.sdiv,
-		 (unsigned int)params.mdiv,
-		 (unsigned int)params.pe, (unsigned int)params.nsdiv);
+		 rate, (unsigned int)params.ndiv);
 
 	return rate;
 }

[toc] | [prev] | [next] | [standalone]

Page 3 of 9 — ← Prev page 1 2 [3] 4 5 6 7 8 9  Next page →

Back to top | Article view | linux.kernel

csiph-web