Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1252076 > unrolled thread
| Started by | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| First post | 2015-10-20 23:40 +0200 |
| Last post | 2015-10-21 00:30 +0200 |
| Articles | 20 on this page of 149 — 2 participants |
Back to article view | Back to linux.kernel
[3.19.y-ckt stable] Linux 3.19.8-ckt8 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.19.y-ckt 001/156] USB: whiteheat: fix potential null-deref at probe Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.19.y-ckt 139/156] IB/iser: Fix missing return status check in iser_send_data_out Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 133/156] mmc: sdhci: also get preset value and driver type for MMC_DDR52 Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 126/156] perf hists: Update the column width for the "srcline" sort key Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 148/156] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
RE: [PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow Eli Cohen <eli@mellanox.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 155/156] netlink, mmap: fix edge-case leakages in nf queue zero-copy Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 123/156] clk: versatile: off by one in clk_sp810_timerclken_of_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 110/156] lib/decompressors: use real out buf size for gunzip with kernel Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 145/156] ipv6: fix exthdrs offload registration in out_rt path Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 070/156] sched: Fix cpu_active_mask/cpu_online_mask race Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 144/156] sock, diag: fix panic in sock_diag_put_filterinfo Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 153/156] batman-adv: Make DAT capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 127/156] batman-adv: Fix potentially broken skb network header access Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 141/156] IB/uverbs: Fix race between ib_uverbs_open and remove_one Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 136/156] IB/mlx4: Fix potential deadlock when sending mad to wire Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 142/156] mmc: core: fix race condition in mmc_wait_data_done Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 132/156] ath10k: fix dma_mapping_error() handling Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 156/156] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 154/156] batman-adv: Make NC capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 150/156] net: dsa: bcm_sf2: Fix 64-bits register writes Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 134/156] perf stat: Get correct cpu id for print_aggr Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 151/156] thermal: exynos: Disable the regulator on probe failure Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 135/156] ASoC: spear_pcm: Use devm_snd_dmaengine_pcm_register to fix resource leak Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 140/156] IB/iser: Fix possible bogus DMA unmapping Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 143/156] drm/i915: Preserve SSC earlier Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 108/156] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 131/156] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 146/156] cpufreq: dt: Tolerance applies on both sides of target voltage Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 109/156] hfs: fix B-tree corruption after insertion at position 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 125/156] windfarm: decrement client count when unregistering Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 116/156] x86/mm: Initialize pmd_idx in page_table_range_init_count() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 137/156] IB/mlx4: Forbid using sysfs to change RoCE pkeys Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 138/156] IB/mlx4: Use correct SL on AH query under RoCE Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 149/156] ebpf: fix fd refcount leaks related to maps in bpf syscall Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 124/156] usb: gadget: m66592-udc: forever loop in set_feature() Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 120/156] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 152/156] svcrdma: Fix send_reply() scatter/gather set-up Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:50 +0200
[PATCH 3.19.y-ckt 118/156] net: bcmgenet: Delay PHY initialization to bcmgenet_open() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 103/156] PCI,parisc: Enable 64-bit bus addresses on PA-RISC Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 113/156] PCI: Fix TI816X class code quirk Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 097/156] mm: check if section present during memory block registering Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 112/156] pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 101/156] rtc: s5m: fix to update ctrl register Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 117/156] net: bcmgenet: Use correct dev_id for free_irq Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 121/156] clk: qcom: Set CLK_SET_RATE_PARENT on ce1 clocks Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 106/156] drm/i915: Limit the number of loops for reading a split 64bit register Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 122/156] jbd2: avoid infinite loop when destroying aborted journal Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 105/156] vmscan: fix increasing nr_isolated incurred by putback unevictable pages Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 115/156] PM / clk: don't return int on __pm_clk_enable() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 114/156] pinctrl: single: dra7: remove PCS_QUIRK_SHARED_IRQ Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 130/156] bridge: fix netlink max attr size Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 129/156] mtd: pxa3xx_nand: add a default chunk size Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 100/156] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 119/156] net: dsa: bcm_sf2: Do not override speed settings Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 111/156] drm/qxl: validate monitors config modes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 128/156] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 102/156] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 096/156] crypto: ghash-clmulni: specify context size for ghash async algorithm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 107/156] watchdog: sunxi: fix activation of system reset Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:00 +0200
[PATCH 3.19.y-ckt 086/156] drm/radeon/atom: Send out the full AUX address Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 092/156] Add radeon suspend/resume quirk for HP Compaq dc5750. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 093/156] IB/uverbs: reject invalid or unknown opcodes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 087/156] net: sunrpc: fix tracepoint Warning: unknown op '->' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 091/156] drm/i915: Always mark the object as dirty when used by the GPU Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 095/156] Input: evdev - do not report errors form flush() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 078/156] ALSA: usb-audio: correct the value cache check. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 083/156] spi: sh-msiof: Fix FIFO size to 64 word from 256 word Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 073/156] drivercore: Fix unregistration path of platform devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 077/156] xfs: return errors from partial I/O failures to files Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 069/156] xfs: Fix file type directory corruption for btree directories Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 076/156] clk: s5pv210: add missing call to samsung_clk_of_add_provider() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 074/156] arm64: flush FP/SIMD state correctly after execve() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 067/156] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 104/156] parisc: Use double word condition in 64bit CAS operation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 068/156] PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 081/156] IB/srp: Handle partial connection success correctly Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 080/156] pinctrl: at91: fix null pointer dereference Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 094/156] hpfs: update ctime and mtime on directory modification Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 084/156] drm/i915: Check DP link status on long hpd too Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 071/156] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 075/156] mmc: sdhci-pci: set the clear transfer mode register quirk for O2Micro Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 082/156] IB/srp: Stop the scsi_eh_<n> and scsi_tmf_<n> threads if login fails Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 085/156] drm/i915: apply the PCI_D0/D3 hibernation workaround everywhere on pre GEN6 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 072/156] of/address: Don't loop forever in of_find_matching_node_by_address(). Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 090/156] tg3: Fix temperature reporting Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 066/156] ARM: orion5x: fix legacy orion5x IRQ numbers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 088/156] nfsd: ensure that the ol stateid hash reference is only put once Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 055/156] USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 038/156] x86/mce: Reenable CMCI banks when swiching back to interrupt mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 089/156] nfsd: ensure that delegation stateid hash references are only put once Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:10 +0200
[PATCH 3.19.y-ckt 057/156] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 042/156] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 033/156] iio: industrialio-buffer: Fix iio_buffer_poll return value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 048/156] blk-mq: fix race between timeout and freeing request Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 036/156] unshare: Unsharing a thread does not require unsharing a vm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 040/156] regulator: pbias: Fix broken pbias disable functionality Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 032/156] iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 016/156] staging: comedi: usbduxsigma: don't clobber ao_timer in command test Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 061/156] s390/setup: fix novx parameter Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 044/156] serial: 8250: bind to ALi Fast Infrared Controller (ALI5123) Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 037/156] fs: Set the size of empty dirs to 0. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 050/156] NFS: nfs_set_pgio_error sometimes misses errors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 046/156] ext4: don't manipulate recovery flag when freezing no-journal fs Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 015/156] staging: comedi: usbduxsigma: don't clobber ai_timer in command test Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 051/156] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 035/156] NFSv4: don't set SETATTR for O_RDONLY|O_EXCL Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 002/156] dcache: Handle escaped paths in prepend_path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 031/156] ASoC: rt5640: fix line out no sound issue Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 065/156] ASoC: samsung: Remove redundant arndale_audio_remove Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 049/156] xtensa: fix kernel register spilling Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 056/156] igb: Fix oops caused by missing queue pairing Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 030/156] ideapad-laptop: Add Lenovo Yoga 3 14 to no_hw_rfkill dmi list Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 047/156] blk-mq: fix buffer overflow when reading sysfs file of 'pending' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 041/156] drivers: usb :fsl: Implement Workaround for USB Erratum A007792 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 043/156] serial: 8250: don't bind to SMSC IrCC IR port Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 064/156] Btrfs: check if previous transaction aborted to avoid fs corruption Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 053/156] USB: symbolserial: Use usb_get_serial_port_data Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 034/156] iio: event: Remove negative error code from iio_event_poll Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 063/156] ASoC: arizona: Fix gain settings of FLL in free-run mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 062/156] arm64: kconfig: Move LIST_POISON to a safe value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 039/156] ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 014/156] PCI: Add VPD function 0 quirk for Intel Ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 045/156] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 060/156] xfs: Fix xfs_attr_leafblock definition Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 052/156] usb: host: ehci-sys: delete useless bus_to_hcd conversion Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 059/156] libxfs: readahead of dir3 data blocks should use the read verifier Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:20 +0200
[PATCH 3.19.y-ckt 028/156] iio: Add inverse unit conversion macros Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 017/156] clk: exynos4: Fix wrong clock for Exynos4x12 ADC Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 011/156] mac80211: enable assoc check for mesh interfaces Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 013/156] PCI: Add dev_flags bit to access VPD through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 022/156] Doc: ABI: testing: configfs-usb-gadget-sourcesink Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 009/156] xtensa: fix threadptr reload on return to userspace Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 018/156] USB: pl2303: fix baud-rate divisor calculations Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 027/156] iio: adis16400: Fix adis16448 gyroscope scale Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 010/156] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 020/156] usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 019/156] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 003/156] vfs: Test for and handle paths that are unreachable from their mnt_root Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 021/156] Doc: ABI: testing: configfs-usb-gadget-loopback Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 029/156] iio: adis16480: Fix scale factors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 025/156] auxdisplay: ks0108: fix refcount Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 023/156] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 012/156] rtlwifi: rtl8821ae: Fix an expression that is always false Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 024/156] KVM: MMU: fix validation of mmio page fault Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 006/156] [media] rc-core: fix remove uevent generation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.19.y-ckt 008/156] HID: cp2112: fix byte order in SMBUS operations Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
Page 1 of 8 [1] 2 3 4 5 6 7 8 Next page →
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:40 +0200 |
| Subject | [3.19.y-ckt stable] Linux 3.19.8-ckt8 stable review |
| Message-ID | <qlMNr-7E9-11@gated-at.bofh.it> |
This is the start of the review cycle for the Linux 3.19.8-ckt8 stable kernel.
This version contains 156 new patches, summarized below. The new patches are
posted as replies to this message and also available in this git branch:
http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.19.y-review
git://kernel.ubuntu.com/ubuntu/linux.git linux-3.19.y-review
The review period for version 3.19.8-ckt8 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.
For more information about the Linux 3.19.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
-Kamal
--
.../ABI/testing/configfs-usb-gadget-loopback | 2 +-
.../ABI/testing/configfs-usb-gadget-sourcesink | 2 +-
arch/arm/Kconfig | 1 +
arch/arm/boot/compressed/decompress.c | 2 +-
arch/arm/mach-omap2/clockdomains7xx_data.c | 2 +-
arch/arm/mach-orion5x/include/mach/irqs.h | 64 ++++++++---------
arch/arm/mach-orion5x/irq.c | 4 +-
arch/arm64/Kconfig | 4 ++
arch/arm64/kernel/fpsimd.c | 1 +
arch/m32r/boot/compressed/misc.c | 3 +-
arch/mips/boot/compressed/decompress.c | 4 +-
arch/parisc/kernel/syscall.S | 2 +-
arch/powerpc/include/asm/pgtable-ppc64.h | 14 +++-
arch/powerpc/include/asm/rtas.h | 1 +
arch/powerpc/kernel/rtas.c | 17 +++++
arch/powerpc/kvm/book3s_hv_rm_mmu.c | 18 +++--
arch/powerpc/platforms/pseries/ras.c | 3 +-
arch/s390/boot/compressed/misc.c | 2 +-
arch/s390/kernel/setup.c | 15 ++--
arch/sh/boot/compressed/misc.c | 2 +-
arch/unicore32/boot/compressed/misc.c | 4 +-
arch/x86/boot/compressed/misc.c | 3 +-
arch/x86/crypto/ghash-clmulni-intel_glue.c | 1 +
arch/x86/kernel/cpu/mcheck/mce_intel.c | 41 ++++++-----
arch/x86/kvm/mmu.c | 45 ------------
arch/x86/mm/init_32.c | 1 +
arch/xtensa/include/asm/traps.h | 29 +++++---
arch/xtensa/kernel/entry.S | 7 +-
block/blk-flush.c | 15 +++-
block/blk-mq-sysfs.c | 25 +++++--
block/blk-mq-tag.c | 2 +-
block/blk-mq-tag.h | 12 ++++
block/blk-mq.c | 16 +----
block/blk.h | 6 ++
drivers/acpi/acpi_pnp.c | 1 +
drivers/ata/ahci.c | 13 +---
drivers/ata/pata_jmicron.c | 12 ----
drivers/auxdisplay/ks0108.c | 1 +
drivers/base/devres.c | 4 +-
drivers/base/node.c | 10 +++
drivers/base/platform.c | 8 +--
drivers/base/power/clock_ops.c | 4 +-
drivers/clk/qcom/gcc-apq8084.c | 1 +
drivers/clk/qcom/gcc-msm8974.c | 1 +
drivers/clk/samsung/clk-exynos4.c | 2 +
drivers/clk/samsung/clk-s5pv210.c | 2 +
drivers/clk/versatile/clk-sp810.c | 4 +-
drivers/cpufreq/cpufreq-dt.c | 3 +-
drivers/gpu/drm/i915/i915_drv.c | 15 ++--
drivers/gpu/drm/i915/i915_drv.h | 10 +--
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 2 +-
drivers/gpu/drm/i915/intel_display.c | 29 +++++---
drivers/gpu/drm/i915/intel_dp.c | 11 ++-
drivers/gpu/drm/qxl/qxl_display.c | 66 ++++++++++-------
drivers/gpu/drm/qxl/qxl_drv.h | 2 +
drivers/gpu/drm/radeon/atombios_dp.c | 5 +-
drivers/gpu/drm/radeon/radeon_combios.c | 8 +++
drivers/gpu/drm/radeon/radeon_connectors.c | 5 ++
drivers/hid/hid-cp2112.c | 10 +--
drivers/hid/usbhid/hid-core.c | 2 +-
drivers/iio/gyro/Kconfig | 3 +-
drivers/iio/imu/adis16400_core.c | 2 +-
drivers/iio/imu/adis16480.c | 39 ++++++++--
drivers/iio/industrialio-buffer.c | 2 +-
drivers/iio/industrialio-event.c | 2 +-
drivers/infiniband/core/uverbs.h | 3 +-
drivers/infiniband/core/uverbs_cmd.c | 10 ++-
drivers/infiniband/core/uverbs_main.c | 43 ++++++++----
drivers/infiniband/hw/mlx4/ah.c | 6 +-
drivers/infiniband/hw/mlx4/mcg.c | 7 +-
drivers/infiniband/hw/mlx4/sysfs.c | 5 +-
drivers/infiniband/hw/mlx5/mr.c | 12 ----
drivers/infiniband/hw/qib/qib_keys.c | 4 ++
drivers/infiniband/hw/qib/qib_verbs.c | 14 ++--
drivers/infiniband/hw/qib/qib_verbs.h | 2 +
drivers/infiniband/ulp/iser/iscsi_iser.c | 12 ++--
drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +
drivers/infiniband/ulp/iser/iser_initiator.c | 8 ++-
drivers/infiniband/ulp/srp/ib_srp.c | 12 +++-
drivers/input/evdev.c | 13 ++--
drivers/macintosh/windfarm_core.c | 2 +-
drivers/md/Kconfig | 2 +-
drivers/media/platform/omap3isp/isp.c | 4 +-
drivers/media/rc/rc-main.c | 3 -
drivers/mmc/core/core.c | 6 +-
drivers/mmc/host/sdhci-pci.c | 1 +
drivers/mmc/host/sdhci.c | 4 +-
drivers/mtd/nand/pxa3xx_nand.c | 3 +
drivers/net/dsa/bcm_sf2.c | 18 +----
drivers/net/dsa/bcm_sf2.h | 4 +-
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 14 ++--
drivers/net/ethernet/broadcom/genet/bcmgenet.h | 1 +
drivers/net/ethernet/broadcom/genet/bcmmii.c | 37 ++++------
drivers/net/ethernet/broadcom/tg3.c | 2 +-
drivers/net/ethernet/intel/igb/igb.h | 1 +
drivers/net/ethernet/intel/igb/igb_ethtool.c | 5 +-
drivers/net/ethernet/intel/igb/igb_main.c | 16 ++++-
drivers/net/wireless/ath/ath10k/htc.c | 4 +-
drivers/net/wireless/ath/ath10k/htt_tx.c | 8 ++-
drivers/net/wireless/ath/ath10k/pci.c | 8 ++-
drivers/net/wireless/ath/ath10k/wmi.c | 1 +
drivers/net/wireless/rtlwifi/rtl8192cu/sw.c | 1 +
drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 2 +-
drivers/net/wireless/rtlwifi/rtl8821ae/reg.h | 1 +
drivers/of/address.c | 6 +-
drivers/parisc/lba_pci.c | 7 +-
drivers/pci/Kconfig | 2 +-
drivers/pci/access.c | 61 +++++++++++++++-
drivers/pci/quirks.c | 30 +++++++-
drivers/pcmcia/sa1100_generic.c | 1 -
drivers/pcmcia/sa11xx_base.c | 3 +-
drivers/pinctrl/pinctrl-at91.c | 15 ++++
drivers/pinctrl/pinctrl-single.c | 1 -
drivers/platform/x86/ideapad-laptop.c | 7 ++
drivers/regulator/pbias-regulator.c | 5 ++
drivers/rtc/rtc-s5m.c | 10 +++
drivers/scsi/scsi_error.c | 11 ++-
drivers/spi/spi-sh-msiof.c | 15 ++--
drivers/staging/comedi/drivers/adl_pci7x3x.c | 16 ++++-
drivers/staging/comedi/drivers/usbduxsigma.c | 70 ++++++++----------
drivers/thermal/samsung/exynos_tmu.c | 2 +
drivers/tty/serial/8250/8250_pci.c | 82 ++++++++++++++++------
drivers/tty/serial/8250/8250_pnp.c | 11 +++
drivers/usb/dwc3/ep0.c | 12 +++-
drivers/usb/gadget/function/f_uac2.c | 31 +++++++-
drivers/usb/gadget/udc/m66592-udc.c | 2 +-
drivers/usb/host/ehci-fsl.c | 13 ++++
drivers/usb/host/ehci-hub.c | 7 ++
drivers/usb/host/ehci-sysfs.c | 8 +--
drivers/usb/host/ehci.h | 12 ++++
drivers/usb/host/fsl-mph-dr-of.c | 10 +++
drivers/usb/serial/ftdi_sio.c | 4 ++
drivers/usb/serial/ftdi_sio_ids.h | 8 +++
drivers/usb/serial/pl2303.c | 35 ++++++---
drivers/usb/serial/qcserial.c | 1 +
drivers/usb/serial/symbolserial.c | 6 +-
drivers/usb/serial/whiteheat.c | 31 ++++++++
drivers/watchdog/sunxi_wdt.c | 2 +-
fs/btrfs/transaction.c | 3 +
fs/ceph/super.c | 3 +-
fs/cifs/cifsfs.c | 6 +-
fs/dcache.c | 7 ++
fs/ecryptfs/dentry.c | 16 ++---
fs/ext4/super.c | 16 +++--
fs/gfs2/super.c | 6 +-
fs/hfs/bnode.c | 9 ++-
fs/hfs/brec.c | 20 +++---
fs/hfs/super.c | 4 +-
fs/hfsplus/bnode.c | 3 -
fs/hfsplus/options.c | 4 +-
fs/hostfs/hostfs_kern.c | 2 +-
fs/hpfs/namei.c | 25 ++++++-
fs/jbd2/checkpoint.c | 39 ++++++++--
fs/jbd2/commit.c | 2 +-
fs/jbd2/journal.c | 11 ++-
fs/libfs.c | 2 +-
fs/namei.c | 31 +++++++-
fs/nfs/nfs4proc.c | 3 +-
fs/nfs/pagelist.c | 4 +-
fs/nfsd/nfs4state.c | 82 ++++++++++++++--------
fs/ocfs2/super.c | 4 +-
fs/overlayfs/super.c | 6 +-
fs/reiserfs/super.c | 8 ++-
fs/xfs/libxfs/xfs_da_format.h | 11 ++-
fs/xfs/libxfs/xfs_dir2_data.c | 3 +-
fs/xfs/libxfs/xfs_dir2_node.c | 10 ++-
fs/xfs/xfs_aops.c | 3 +-
fs/xfs/xfs_super.c | 4 +-
include/linux/fsl_devices.h | 2 +
include/linux/iio/iio.h | 17 +++++
include/linux/jbd2.h | 3 +-
include/linux/netlink.h | 13 +++-
include/linux/pci.h | 2 +
include/linux/seq_file.h | 35 +++++++++
include/trace/events/sunrpc.h | 21 ++++--
kernel/bpf/syscall.c | 12 ++--
kernel/cgroup.c | 7 +-
kernel/fork.c | 28 +++++---
kernel/sched/core.c | 8 +++
kernel/task_work.c | 12 +---
lib/decompress_bunzip2.c | 6 +-
lib/decompress_inflate.c | 31 ++++++--
lib/decompress_unlz4.c | 6 +-
lib/decompress_unlzma.c | 7 +-
lib/decompress_unlzo.c | 13 +++-
lib/decompress_unxz.c | 12 +++-
mm/vmscan.c | 2 +-
net/batman-adv/distributed-arp-table.c | 7 +-
net/batman-adv/network-coding.c | 7 +-
net/batman-adv/soft-interface.c | 7 +-
net/batman-adv/types.h | 6 +-
net/bridge/br_netlink.c | 2 +-
net/core/sock_diag.c | 3 +
net/ipv6/exthdrs_offload.c | 2 +-
net/mac80211/tx.c | 3 -
net/netfilter/nfnetlink_queue_core.c | 5 +-
net/netlink/af_netlink.c | 18 +++--
net/sctp/protocol.c | 64 +++++++++++------
net/sunrpc/xprtrdma/svc_rdma_sendto.c | 10 ++-
security/selinux/hooks.c | 2 +-
sound/pci/hda/patch_realtek.c | 6 +-
sound/soc/codecs/adav80x.c | 1 -
sound/soc/codecs/arizona.c | 2 +-
sound/soc/codecs/rt5640.c | 40 ++++++++++-
sound/soc/samsung/arndale_rt5631.c | 10 ---
sound/soc/spear/spear_pcm.c | 2 +-
sound/usb/mixer.c | 2 +-
tools/perf/builtin-stat.c | 5 +-
tools/perf/util/hist.c | 3 +
209 files changed, 1545 insertions(+), 733 deletions(-)
Adam Lee (2):
serial: 8250_pci: Add support for Pericom PI7C9X795[1248]
mmc: sdhci-pci: set the clear transfer mode register quirk for O2Micro
Adrien Schildknecht (1):
rtlwifi: rtl8192cu: Add new device ID
Andrey Ryabinin (1):
crypto: ghash-clmulni: specify context size for ghash async algorithm
Antoine Ténart (1):
mtd: pxa3xx_nand: add a default chunk size
Ard Biesheuvel (1):
arm64: flush FP/SIMD state correctly after execve()
Arnaldo Carvalho de Melo (1):
perf hists: Update the column width for the "srcline" sort key
Axel Lin (2):
ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config
ASoC: spear_pcm: Use devm_snd_dmaengine_pcm_register to fix resource leak
Bart Van Assche (2):
IB/srp: Handle partial connection success correctly
IB/srp: Stop the scsi_eh_<n> and scsi_tmf_<n> threads if login fails
Benjamin Cama (1):
ARM: orion5x: fix legacy orion5x IRQ numbers
Bjorn Helgaas (1):
PCI: Fix TI816X class code quirk
Bob Copeland (1):
mac80211: enable assoc check for mesh interfaces
Chris Wilson (2):
drm/i915: Always mark the object as dirty when used by the GPU
drm/i915: Limit the number of loops for reading a split 64bit register
Christoph Hellwig (2):
IB/uverbs: reject invalid or unknown opcodes
scsi_dh: fix randconfig build error
Chuck Lever (1):
svcrdma: Fix send_reply() scatter/gather set-up
Colin Ian King (1):
PM / clk: don't return int on __pm_clk_enable()
Cristina Opriceana (2):
iio: industrialio-buffer: Fix iio_buffer_poll return value
iio: event: Remove negative error code from iio_event_poll
Dan Carpenter (2):
clk: versatile: off by one in clk_sp810_timerclken_of_get()
usb: gadget: m66592-udc: forever loop in set_feature()
Daniel Borkmann (4):
sock, diag: fix panic in sock_diag_put_filterinfo
ipv6: fix exthdrs offload registration in out_rt path
ebpf: fix fd refcount leaks related to maps in bpf syscall
netlink, mmap: fix edge-case leakages in nf queue zero-copy
Darrick J. Wong (1):
libxfs: readahead of dir3 data blocks should use the read verifier
David Daney (1):
of/address: Don't loop forever in of_find_matching_node_by_address().
David Dueck (1):
pinctrl: at91: fix null pointer dereference
David Härdeman (1):
[media] rc-core: fix remove uevent generation
David Jeffery (1):
xfs: return errors from partial I/O failures to files
David Ward (1):
USB: qcserial: add HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module
Don Zickus (1):
HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error
Ellen Wang (2):
HID: cp2112: fix I2C_SMBUS_BYTE write
HID: cp2112: fix byte order in SMBUS operations
Eric Dumazet (1):
task_work: remove fifo ordering guarantee
Eric Sandeen (1):
ext4: don't manipulate recovery flag when freezing no-journal fs
Eric W. Biederman (4):
dcache: Handle escaped paths in prepend_path
vfs: Test for and handle paths that are unreachable from their mnt_root
unshare: Unsharing a thread does not require unsharing a vm
fs: Set the size of empty dirs to 0.
Filipe Manana (1):
Btrfs: check if previous transaction aborted to avoid fs corruption
Florian Fainelli (4):
net: bcmgenet: Use correct dev_id for free_irq
net: bcmgenet: Delay PHY initialization to bcmgenet_open()
net: dsa: bcm_sf2: Do not override speed settings
net: dsa: bcm_sf2: Fix 64-bits register writes
Francesco Lavra (1):
watchdog: sunxi: fix activation of system reset
Grant Likely (1):
drivercore: Fix unregistration path of platform devices
Grygorii Strashko (1):
pinctrl: single: dra7: remove PCS_QUIRK_SHARED_IRQ
Haggai Eran (1):
IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow
Hans de Goede (1):
ideapad-laptop: Add Lenovo Yoga 3 14 to no_hw_rfkill dmi list
Helge Deller (1):
PCI,parisc: Enable 64-bit bus addresses on PA-RISC
Hin-Tak Leung (2):
hfs,hfsplus: cache pages correctly between bnode_create and bnode_free
hfs: fix B-tree corruption after insertion at position 0
Ian Abbott (3):
staging: comedi: usbduxsigma: don't clobber ai_timer in command test
staging: comedi: usbduxsigma: don't clobber ao_timer in command test
staging: comedi: adl_pci7x3x: fix digital output on PCI-7230
Imre Deak (1):
drm/i915: apply the PCI_D0/D3 hibernation workaround everywhere on pre GEN6
Jack Morgenstein (2):
IB/mlx4: Fix potential deadlock when sending mad to wire
IB/mlx4: Forbid using sysfs to change RoCE pkeys
Jaewon Kim (1):
vmscan: fix increasing nr_isolated incurred by putback unevictable pages
Jan H. Schönherr (1):
sched: Fix cpu_active_mask/cpu_online_mask race
Jan Kara (3):
xfs: Fix xfs_attr_leafblock definition
xfs: Fix file type directory corruption for btree directories
jbd2: avoid infinite loop when destroying aborted journal
Jean Delvare (1):
tg3: Fix temperature reporting
Jeff Layton (2):
nfsd: ensure that the ol stateid hash reference is only put once
nfsd: ensure that delegation stateid hash references are only put once
Jeff Vander Stoep (1):
arm64: kconfig: Move LIST_POISON to a safe value
Jeffery Miller (1):
Add radeon suspend/resume quirk for HP Compaq dc5750.
Jialing Fu (1):
mmc: core: fix race condition in mmc_wait_data_done
Jisheng Zhang (1):
mmc: sdhci: also get preset value and driver type for MMC_DDR52
Johan Hovold (1):
USB: whiteheat: fix potential null-deref at probe
John David Anglin (1):
parisc: Use double word condition in 64bit CAS operation
John Lin (1):
ASoC: rt5640: fix line out no sound issue
Jonathon Jongsma (1):
drm/qxl: validate monitors config modes
Joonyoung Shim (1):
rtc: s5m: fix to update ctrl register
Kan Liang (1):
perf stat: Get correct cpu id for print_aggr
Kees Cook (1):
fs: create and use seq_show_option for escaping
Kinglong Mee (1):
NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client
Kishon Vijay Abraham I (2):
usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes
regulator: pbias: Fix broken pbias disable functionality
Koji Matsuoka (1):
spi: sh-msiof: Fix FIFO size to 64 word from 256 word
Krzysztof Kozlowski (2):
clk: exynos4: Fix wrong clock for Exynos4x12 ADC
thermal: exynos: Disable the regulator on probe failure
Larry Finger (1):
rtlwifi: rtl8821ae: Fix an expression that is always false
Lars-Peter Clausen (3):
iio: adis16400: Fix adis16448 gyroscope scale
iio: Add inverse unit conversion macros
iio: adis16480: Fix scale factors
Linus Lüssing (3):
batman-adv: Fix potentially broken skb network header access
batman-adv: Make DAT capability changes atomic
batman-adv: Make NC capability changes atomic
Lukas Wunner (1):
drm/i915: Preserve SSC earlier
Maciej S. Szmigiero (2):
serial: 8250: don't bind to SMSC IrCC IR port
serial: 8250: bind to ALi Fast Infrared Controller (ALI5123)
Marcelo Ricardo Leitner (1):
sctp: fix race on protocol/netns initialization
Marek Szyprowski (1):
clk: s5pv210: add missing call to samsung_clk_of_add_provider()
Mark Rustad (2):
PCI: Add dev_flags bit to access VPD through function 0
PCI: Add VPD function 0 quirk for Intel Ethernet devices
Markus Pargmann (1):
iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required
Martin Schwidefsky (1):
s390/setup: fix novx parameter
Masahiro Yamada (1):
devres: fix devres_get()
Matthijs Kooijman (1):
USB: ftdi_sio: Added custom PID for CustomWare products
Max Filippov (2):
xtensa: fix threadptr reload on return to userspace
xtensa: fix kernel register spilling
Michael Ellerman (1):
powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash
Michal Hocko (1):
scsi: fix scsi_error_handler vs. scsi_host_dev_release race
Michal Kazior (1):
ath10k: fix dma_mapping_error() handling
Michał Pecio (1):
USB: pl2303: fix baud-rate divisor calculations
Mike Marciniszyn (1):
IB/qib: Change lkey table allocation to support more MRs
Mikulas Patocka (1):
hpfs: update ctime and mtime on directory modification
Minfei Huang (1):
x86/mm: Initialize pmd_idx in page_table_range_init_count()
Ming Lei (2):
blk-mq: fix buffer overflow when reading sysfs file of 'pending'
blk-mq: fix race between timeout and freeing request
NeilBrown (1):
NFSv4: don't set SETATTR for O_RDONLY|O_EXCL
Nikesh Oswal (1):
ASoC: arizona: Fix gain settings of FLL in free-run mode
Nikhil Badola (2):
drivers: usb :fsl: Implement Workaround for USB Erratum A007792
drivers: usb: fsl: Workaround for USB erratum-A005275
Noa Osherovich (1):
IB/mlx4: Use correct SL on AH query under RoCE
Paul Bolle (1):
windfarm: decrement client count when unregistering
Paul Mackerras (1):
KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE
Peter Chen (4):
usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth
Doc: ABI: testing: configfs-usb-gadget-loopback
Doc: ABI: testing: configfs-usb-gadget-sourcesink
usb: host: ehci-sys: delete useless bus_to_hcd conversion
Philipp Hachtmann (1):
USB: symbolserial: Use usb_get_serial_port_data
Pratyush Anand (1):
net: sunrpc: fix tracepoint Warning: unknown op '->'
Russell King (1):
pcmcia: sa11x0: fix missing clk_put() in sa11x0 socket drivers
Sagi Grimberg (2):
IB/iser: Fix missing return status check in iser_send_data_out
IB/iser: Fix possible bogus DMA unmapping
Sakari Ailus (1):
[media] v4l: omap3isp: Fix sub-device power management code
Scott Feldman (1):
bridge: fix netlink max attr size
Shota Suzuki (1):
igb: Fix oops caused by missing queue pairing
Stephen Boyd (1):
clk: qcom: Set CLK_SET_RATE_PARENT on ce1 clocks
Stephen Chandler Paul (1):
DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd
Sudip Mukherjee (1):
auxdisplay: ks0108: fix refcount
Takashi Iwai (3):
Input: evdev - do not report errors form flush()
ALSA: hda - Enable headphone jack detect on old Fujitsu laptops
ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437
Thomas Huth (1):
powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers
Trond Myklebust (1):
NFS: nfs_set_pgio_error sometimes misses errors
Tyler Hicks (1):
eCryptfs: Invalidate dcache entries when lower i_nlink is zero
Vaishali Thakkar (1):
ASoC: samsung: Remove redundant arndale_audio_remove
Vignesh R (1):
ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP
Ville Syrjälä (2):
drm/i915: Check DP link status on long hpd too
drm/radeon/atom: Send out the full AUX address
Viresh Kumar (1):
cpufreq: dt: Tolerance applies on both sides of target voltage
Xiao Guangrong (1):
KVM: MMU: fix validation of mmio page fault
Xie XiuQi (1):
x86/mce: Reenable CMCI banks when swiching back to interrupt mode
Yao-Wen Mao (1):
ALSA: usb-audio: correct the value cache check.
Yinghai Lu (2):
mm: check if section present during memory block registering
lib/decompressors: use real out buf size for gunzip with kernel
Yishai Hadas (1):
IB/uverbs: Fix race between ib_uverbs_open and remove_one
Zhang Rui (1):
PCI: Disable async suspend/resume for JMicron multi-function SATA/AHCI
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:40 +0200 |
| Subject | [PATCH 3.19.y-ckt 001/156] USB: whiteheat: fix potential null-deref at probe |
| Message-ID | <qlMNu-7E9-85@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit cbb4be652d374f64661137756b8f357a1827d6a4 upstream.
Fix potential null-pointer dereference at probe by making sure that the
required endpoints are present.
The whiteheat driver assumes there are at least five pairs of bulk
endpoints, of which the final pair is used for the "command port". An
attempt to bind to an interface with fewer bulk endpoints would
currently lead to an oops.
Fixes CVE-2015-5257.
Reported-by: Moein Ghasemzadeh <moein@istuary.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/serial/whiteheat.c | 31 +++++++++++++++++++++++++++++++
1 file changed, 31 insertions(+)
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 6c3734d..d3ea90b 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -80,6 +80,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial,
static int whiteheat_firmware_attach(struct usb_serial *serial);
/* function prototypes for the Connect Tech WhiteHEAT serial converter */
+static int whiteheat_probe(struct usb_serial *serial,
+ const struct usb_device_id *id);
static int whiteheat_attach(struct usb_serial *serial);
static void whiteheat_release(struct usb_serial *serial);
static int whiteheat_port_probe(struct usb_serial_port *port);
@@ -116,6 +118,7 @@ static struct usb_serial_driver whiteheat_device = {
.description = "Connect Tech - WhiteHEAT",
.id_table = id_table_std,
.num_ports = 4,
+ .probe = whiteheat_probe,
.attach = whiteheat_attach,
.release = whiteheat_release,
.port_probe = whiteheat_port_probe,
@@ -217,6 +220,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
/*****************************************************************************
* Connect Tech's White Heat serial driver functions
*****************************************************************************/
+
+static int whiteheat_probe(struct usb_serial *serial,
+ const struct usb_device_id *id)
+{
+ struct usb_host_interface *iface_desc;
+ struct usb_endpoint_descriptor *endpoint;
+ size_t num_bulk_in = 0;
+ size_t num_bulk_out = 0;
+ size_t min_num_bulk;
+ unsigned int i;
+
+ iface_desc = serial->interface->cur_altsetting;
+
+ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
+ endpoint = &iface_desc->endpoint[i].desc;
+ if (usb_endpoint_is_bulk_in(endpoint))
+ ++num_bulk_in;
+ if (usb_endpoint_is_bulk_out(endpoint))
+ ++num_bulk_out;
+ }
+
+ min_num_bulk = COMMAND_PORT + 1;
+ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
+ return -ENODEV;
+
+ return 0;
+}
+
static int whiteheat_attach(struct usb_serial *serial)
{
struct usb_serial_port *command_port;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 139/156] IB/iser: Fix missing return status check in iser_send_data_out |
| Message-ID | <qlMX8-7PN-1@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagig@mellanox.com>
commit d16739055bd1f562ae4d83e69f7f7f1cefcfbe16 upstream.
Since commit "IB/iser: Fix race between iser connection teardown..."
iser_initialize_task_headers() might fail, so we need to check that.
Fixes: 7414dde0a6c3a958e (IB/iser: Fix race between iser connection ...)
Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/ulp/iser/iser_initiator.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 76eb57b..ef55a29 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -454,7 +454,7 @@ int iser_send_data_out(struct iscsi_conn *conn,
unsigned long buf_offset;
unsigned long data_seg_len;
uint32_t itt;
- int err = 0;
+ int err;
struct ib_sge *tx_dsg;
itt = (__force uint32_t)hdr->itt;
@@ -475,7 +475,9 @@ int iser_send_data_out(struct iscsi_conn *conn,
memcpy(&tx_desc->iscsi_header, hdr, sizeof(struct iscsi_hdr));
/* build the tx desc */
- iser_initialize_task_headers(task, tx_desc);
+ err = iser_initialize_task_headers(task, tx_desc);
+ if (err)
+ goto send_data_out_error;
regd_buf = &iser_task->rdma_regd[ISER_DIR_OUT];
tx_dsg = &tx_desc->tx_sg[1];
@@ -502,7 +504,7 @@ int iser_send_data_out(struct iscsi_conn *conn,
send_data_out_error:
kmem_cache_free(ig.desc_cache, tx_desc);
- iser_err("conn %p failed err %d\n",conn, err);
+ iser_err("conn %p failed err %d\n", conn, err);
return err;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 133/156] mmc: sdhci: also get preset value and driver type for MMC_DDR52 |
| Message-ID | <qlMX8-7PN-5@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <jszhang@marvell.com>
commit 0dafa60eb2506617e6968b97cc5a44914a7fb1a6 upstream.
commit bb8175a8aa42 ("mmc: sdhci: clarify DDR timing mode between
SD-UHS and eMMC") added MMC_DDR52 as eMMC's DDR mode to be
distinguished from SD-UHS, but it missed setting driver type for
MMC_DDR52 timing mode.
So sometimes we get the following error on Marvell BG2Q DMP board:
[ 1.559598] mmcblk0: error -84 transferring data, sector 0, nr 8, cmd
response 0x900, card status 0xb00
[ 1.569314] mmcblk0: retrying using single block read
[ 1.575676] mmcblk0: error -84 transferring data, sector 2, nr 6, cmd
response 0x900, card status 0x0
[ 1.585202] blk_update_request: I/O error, dev mmcblk0, sector 2
[ 1.591818] mmcblk0: error -84 transferring data, sector 3, nr 5, cmd
response 0x900, card status 0x0
[ 1.601341] blk_update_request: I/O error, dev mmcblk0, sector 3
This patches fixes this by adding the missing driver type setting.
Fixes: bb8175a8aa42 ("mmc: sdhci: clarify DDR timing mode ...")
Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/mmc/host/sdhci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index afb477a..f0fe422 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1144,6 +1144,7 @@ static u16 sdhci_get_preset_value(struct sdhci_host *host)
preset = sdhci_readw(host, SDHCI_PRESET_FOR_SDR104);
break;
case MMC_TIMING_UHS_DDR50:
+ case MMC_TIMING_MMC_DDR52:
preset = sdhci_readw(host, SDHCI_PRESET_FOR_DDR50);
break;
case MMC_TIMING_MMC_HS400:
@@ -1611,7 +1612,8 @@ static void sdhci_do_set_ios(struct sdhci_host *host, struct mmc_ios *ios)
(ios->timing == MMC_TIMING_UHS_SDR25) ||
(ios->timing == MMC_TIMING_UHS_SDR50) ||
(ios->timing == MMC_TIMING_UHS_SDR104) ||
- (ios->timing == MMC_TIMING_UHS_DDR50))) {
+ (ios->timing == MMC_TIMING_UHS_DDR50) ||
+ (ios->timing == MMC_TIMING_MMC_DDR52))) {
u16 preset;
sdhci_enable_preset_value(host, true);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 126/156] perf hists: Update the column width for the "srcline" sort key |
| Message-ID | <qlMX8-7PN-3@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
commit e8e6d37e73e6b950c891c780745460b87f4755b6 upstream.
When we introduce a new sort key, we need to update the
hists__calc_col_len() function accordingly, otherwise the width
will be limited to strlen(header).
We can't update it when obtaining a line value for a column (for
instance, in sort__srcline_cmp()), because we reset it all when doing a
resort (see hists__output_recalc_col_len()), so we need to, from what is
in the hist_entry fields, set each of the column widths.
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Fixes: 409a8be61560 ("perf tools: Add sort by src line/number")
Link: http://lkml.kernel.org/n/tip-jgbe0yx8v1gs89cslr93pvz2@git.kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
tools/perf/util/hist.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 1823955..db18023 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -151,6 +151,9 @@ void hists__calc_col_len(struct hists *hists, struct hist_entry *h)
hists__new_col_len(hists, HISTC_LOCAL_WEIGHT, 12);
hists__new_col_len(hists, HISTC_GLOBAL_WEIGHT, 12);
+ if (h->srcline)
+ hists__new_col_len(hists, HISTC_SRCLINE, strlen(h->srcline));
+
if (h->transaction)
hists__new_col_len(hists, HISTC_TRANSACTION,
hist_entry__transaction_len());
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 148/156] task_work: remove fifo ordering guarantee |
| Message-ID | <qlMX8-7PN-7@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit c82199061009d1561e31e17fca5e47a87cb7ff4c upstream.
In commit f341861fb0b ("task_work: add a scheduling point in
task_work_run()") I fixed a latency problem adding a cond_resched()
call.
Later, commit ac3d0da8f329 added yet another loop to reverse a list,
bringing back the latency spike :
I've seen in some cases this loop taking 275 ms, if for example a
process with 2,000,000 files is killed.
We could add yet another cond_resched() in the reverse loop, or we
can simply remove the reversal, as I do not think anything
would depend on order of task_work_add() submitted works.
Fixes: ac3d0da8f329 ("task_work: Make task_work_add() lockless")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Maciej Żenczykowski <maze@google.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/task_work.c | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/kernel/task_work.c b/kernel/task_work.c
index 8727032..53fa971 100644
--- a/kernel/task_work.c
+++ b/kernel/task_work.c
@@ -18,6 +18,8 @@ static struct callback_head work_exited; /* all we need is ->next == NULL */
* This is like the signal handler which runs in kernel mode, but it doesn't
* try to wake up the @task.
*
+ * Note: there is no ordering guarantee on works queued here.
+ *
* RETURNS:
* 0 if succeeds or -ESRCH.
*/
@@ -108,16 +110,6 @@ void task_work_run(void)
raw_spin_unlock_wait(&task->pi_lock);
smp_mb();
- /* Reverse the list to run the works in fifo order */
- head = NULL;
- do {
- next = work->next;
- work->next = head;
- head = work;
- work = next;
- } while (work);
-
- work = head;
do {
next = work->next;
work->func(work);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow |
| Message-ID | <qlMX8-7PN-9@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Haggai Eran <haggaie@mellanox.com>
commit 11d748045c6dadb279d1acdb6d2ea8f3f2ede85b upstream.
The mlx5_ib_reg_user_mr() function will attempt to call clean_mr() in
its error flow even though there is never a case where the error flow
occurs with a valid MR pointer to destroy.
Remove the clean_mr() call and the incorrect comment above it.
Fixes: b4cfe447d47b ("IB/mlx5: Implement on demand paging by adding
support for MMU notifiers")
Cc: Eli Cohen <eli@mellanox.com>
Signed-off-by: Haggai Eran <haggaie@mellanox.com>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/hw/mlx5/mr.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
index 32a28bd..e8b669f 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1118,19 +1118,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
return &mr->ibmr;
error:
- /*
- * Destroy the umem *before* destroying the MR, to ensure we
- * will not have any in-flight notifiers when destroying the
- * MR.
- *
- * As the MR is completely invalid to begin with, and this
- * error path is only taken if we can't push the mr entry into
- * the pagefault tree, this is safe.
- */
-
ib_umem_release(umem);
- /* Kill the MR, and return an error code. */
- clean_mr(mr);
return ERR_PTR(err);
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Eli Cohen <eli@mellanox.com> |
|---|---|
| Date | 2015-10-21 00:30 +0200 |
| Subject | RE: [PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow |
| Message-ID | <qlNzQ-pi-15@gated-at.bofh.it> |
| In reply to | #1252083 |
Acked-by: Eli Cohen <eli@mellanox.com>
-----Original Message-----
From: Kamal Mostafa [mailto:kamal@canonical.com]
Sent: Tuesday, October 20, 2015 4:38 PM
To: linux-kernel@vger.kernel.org; stable@vger.kernel.org; kernel-team@lists.ubuntu.com
Cc: Eli Cohen; Haggai Eran; Doug Ledford; Kamal Mostafa
Subject: [PATCH 3.19.y-ckt 147/156] IB/mlx5: avoid destroying a NULL mr in reg_user_mr error flow
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Haggai Eran <haggaie@mellanox.com>
commit 11d748045c6dadb279d1acdb6d2ea8f3f2ede85b upstream.
The mlx5_ib_reg_user_mr() function will attempt to call clean_mr() in its error flow even though there is never a case where the error flow occurs with a valid MR pointer to destroy.
Remove the clean_mr() call and the incorrect comment above it.
Fixes: b4cfe447d47b ("IB/mlx5: Implement on demand paging by adding support for MMU notifiers")
Cc: Eli Cohen <eli@mellanox.com>
Signed-off-by: Haggai Eran <haggaie@mellanox.com>
Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/hw/mlx5/mr.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 32a28bd..e8b669f 100644
--- a/drivers/infiniband/hw/mlx5/mr.c
+++ b/drivers/infiniband/hw/mlx5/mr.c
@@ -1118,19 +1118,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length,
return &mr->ibmr;
error:
- /*
- * Destroy the umem *before* destroying the MR, to ensure we
- * will not have any in-flight notifiers when destroying the
- * MR.
- *
- * As the MR is completely invalid to begin with, and this
- * error path is only taken if we can't push the mr entry into
- * the pagefault tree, this is safe.
- */
-
ib_umem_release(umem);
- /* Kill the MR, and return an error code. */
- clean_mr(mr);
return ERR_PTR(err);
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 155/156] netlink, mmap: fix edge-case leakages in nf queue zero-copy |
| Message-ID | <qlMX8-7PN-11@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 6bb0fef489f667cf701853054f44579754f00a06 upstream.
When netlink mmap on receive side is the consumer of nf queue data,
it can happen that in some edge cases, we write skb shared info into
the user space mmap buffer:
Assume a possible rx ring frame size of only 4096, and the network skb,
which is being zero-copied into the netlink skb, contains page frags
with an overall skb->len larger than the linear part of the netlink
skb.
skb_zerocopy(), which is generic and thus not aware of the fact that
shared info cannot be accessed for such skbs then tries to write and
fill frags, thus leaking kernel data/pointers and in some corner cases
possibly writing out of bounds of the mmap area (when filling the
last slot in the ring buffer this way).
I.e. the ring buffer slot is then of status NL_MMAP_STATUS_VALID, has
an advertised length larger than 4096, where the linear part is visible
at the slot beginning, and the leaked sizeof(struct skb_shared_info)
has been written to the beginning of the next slot (also corrupting
the struct nl_mmap_hdr slot header incl. status etc), since skb->end
points to skb->data + ring->frame_size - NL_MMAP_HDRLEN.
The fix adds and lets __netlink_alloc_skb() take the actual needed
linear room for the network skb + meta data into account. It's completely
irrelevant for non-mmaped netlink sockets, but in case mmap sockets
are used, it can be decided whether the available skb_tailroom() is
really large enough for the buffer, or whether it needs to internally
fallback to a normal alloc_skb().
>From nf queue side, the information whether the destination port is
an mmap RX ring is not really available without extra port-to-socket
lookup, thus it can only be determined in lower layers i.e. when
__netlink_alloc_skb() is called that checks internally for this. I
chose to add the extra ldiff parameter as mmap will then still work:
We have data_len and hlen in nfqnl_build_packet_message(), data_len
is the full length (capped at queue->copy_range) for skb_zerocopy()
and hlen some possible part of data_len that needs to be copied; the
rem_len variable indicates the needed remaining linear mmap space.
The only other workaround in nf queue internally would be after
allocation time by f.e. cap'ing the data_len to the skb_tailroom()
iff we deal with an mmap skb, but that would 1) expose the fact that
we use a mmap skb to upper layers, and 2) trim the skb where we
otherwise could just have moved the full skb into the normal receive
queue.
After the patch, in my test case the ring slot doesn't fit and therefore
shows NL_MMAP_STATUS_COPY, where a full skb carries all the data and
thus needs to be picked up via recv().
Fixes: 3ab1f683bf8b ("nfnetlink: add support for memory mapped netlink")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
include/linux/netlink.h | 13 +++++++++++--
net/netfilter/nfnetlink_queue_core.c | 5 +++--
net/netlink/af_netlink.c | 18 ++++++++++++------
3 files changed, 26 insertions(+), 10 deletions(-)
diff --git a/include/linux/netlink.h b/include/linux/netlink.h
index 02fc86d..68841a1 100644
--- a/include/linux/netlink.h
+++ b/include/linux/netlink.h
@@ -66,8 +66,17 @@ extern int netlink_change_ngroups(struct sock *sk, unsigned int groups);
extern void __netlink_clear_multicast_users(struct sock *sk, unsigned int group);
extern void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err);
extern int netlink_has_listeners(struct sock *sk, unsigned int group);
-extern struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
- u32 dst_portid, gfp_t gfp_mask);
+
+extern struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ unsigned int ldiff, u32 dst_portid,
+ gfp_t gfp_mask);
+static inline struct sk_buff *
+netlink_alloc_skb(struct sock *ssk, unsigned int size, u32 dst_portid,
+ gfp_t gfp_mask)
+{
+ return __netlink_alloc_skb(ssk, size, 0, dst_portid, gfp_mask);
+}
+
extern int netlink_unicast(struct sock *ssk, struct sk_buff *skb, __u32 portid, int nonblock);
extern int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, __u32 portid,
__u32 group, gfp_t allocation);
diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
index 900cedc..42d402c 100644
--- a/net/netfilter/nfnetlink_queue_core.c
+++ b/net/netfilter/nfnetlink_queue_core.c
@@ -284,7 +284,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
__be32 **packet_id_ptr)
{
size_t size;
- size_t data_len = 0, cap_len = 0;
+ size_t data_len = 0, cap_len = 0, rem_len = 0;
unsigned int hlen = 0;
struct sk_buff *skb;
struct nlattr *nla;
@@ -341,6 +341,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
hlen = min_t(unsigned int, hlen, data_len);
size += sizeof(struct nlattr) + hlen;
cap_len = entskb->len;
+ rem_len = data_len - hlen;
break;
}
@@ -352,7 +353,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
+ nla_total_size(sizeof(u_int32_t))); /* gid */
}
- skb = nfnetlink_alloc_skb(net, size, queue->peer_portid,
+ skb = __netlink_alloc_skb(net->nfnl, size, rem_len, queue->peer_portid,
GFP_ATOMIC);
if (!skb) {
skb_tx_error(entskb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c47affe..8b57d6a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1806,15 +1806,16 @@ retry:
}
EXPORT_SYMBOL(netlink_unicast);
-struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
- u32 dst_portid, gfp_t gfp_mask)
+struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size,
+ unsigned int ldiff, u32 dst_portid,
+ gfp_t gfp_mask)
{
#ifdef CONFIG_NETLINK_MMAP
+ unsigned int maxlen, linear_size;
struct sock *sk = NULL;
struct sk_buff *skb;
struct netlink_ring *ring;
struct nl_mmap_hdr *hdr;
- unsigned int maxlen;
sk = netlink_getsockbyportid(ssk, dst_portid);
if (IS_ERR(sk))
@@ -1825,7 +1826,11 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
if (ring->pg_vec == NULL)
goto out_put;
- if (ring->frame_size - NL_MMAP_HDRLEN < size)
+ /* We need to account the full linear size needed as a ring
+ * slot cannot have non-linear parts.
+ */
+ linear_size = size + ldiff;
+ if (ring->frame_size - NL_MMAP_HDRLEN < linear_size)
goto out_put;
skb = alloc_skb_head(gfp_mask);
@@ -1839,13 +1844,14 @@ struct sk_buff *netlink_alloc_skb(struct sock *ssk, unsigned int size,
/* check again under lock */
maxlen = ring->frame_size - NL_MMAP_HDRLEN;
- if (maxlen < size)
+ if (maxlen < linear_size)
goto out_free;
netlink_forward_ring(ring);
hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED);
if (hdr == NULL)
goto err2;
+
netlink_ring_setup_skb(skb, sk, ring, hdr);
netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
atomic_inc(&ring->pending);
@@ -1871,7 +1877,7 @@ out:
#endif
return alloc_skb(size, gfp_mask);
}
-EXPORT_SYMBOL_GPL(netlink_alloc_skb);
+EXPORT_SYMBOL_GPL(__netlink_alloc_skb);
int netlink_has_listeners(struct sock *sk, unsigned int group)
{
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 123/156] clk: versatile: off by one in clk_sp810_timerclken_of_get() |
| Message-ID | <qlMX8-7PN-13@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 3294bee87091be5f179474f6c39d1d87769635e2 upstream.
The ">" should be ">=" or we end up reading beyond the end of the array.
Fixes: 6e973d2c4385 ('clk: vexpress: Add separate SP810 driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/clk/versatile/clk-sp810.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/versatile/clk-sp810.c b/drivers/clk/versatile/clk-sp810.c
index c6e86a9..5122ef2 100644
--- a/drivers/clk/versatile/clk-sp810.c
+++ b/drivers/clk/versatile/clk-sp810.c
@@ -128,8 +128,8 @@ static struct clk *clk_sp810_timerclken_of_get(struct of_phandle_args *clkspec,
{
struct clk_sp810 *sp810 = data;
- if (WARN_ON(clkspec->args_count != 1 || clkspec->args[0] >
- ARRAY_SIZE(sp810->timerclken)))
+ if (WARN_ON(clkspec->args_count != 1 ||
+ clkspec->args[0] >= ARRAY_SIZE(sp810->timerclken)))
return NULL;
return sp810->timerclken[clkspec->args[0]].clk;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 110/156] lib/decompressors: use real out buf size for gunzip with kernel |
| Message-ID | <qlMX8-7PN-17@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Yinghai Lu <yinghai@kernel.org>
commit 2d3862d26e67a59340ba1cf1748196c76c5787de upstream.
When loading x86 64bit kernel above 4GiB with patched grub2, got kernel
gunzip error.
| early console in decompress_kernel
| decompress_kernel:
| input: [0x807f2143b4-0x807ff61aee]
| output: [0x807cc00000-0x807f3ea29b] 0x027ea29c: output_len
| boot via startup_64
| KASLR using RDTSC...
| new output: [0x46fe000000-0x470138cfff] 0x0338d000: output_run_size
| decompress: [0x46fe000000-0x47007ea29b] <=== [0x807f2143b4-0x807ff61aee]
|
| Decompressing Linux... gz...
|
| uncompression error
|
| -- System halted
the new buffer is at 0x46fe000000ULL, decompressor_gzip is using
0xffffffb901ffffff as out_len. gunzip in lib/zlib_inflate/inflate.c cap
that len to 0x01ffffff and decompress fails later.
We could hit this problem with crashkernel booting that uses kexec loading
kernel above 4GiB.
We have decompress_* support:
1. inbuf[]/outbuf[] for kernel preboot.
2. inbuf[]/flush() for initramfs
3. fill()/flush() for initrd.
This bug only affect kernel preboot path that use outbuf[].
Add __decompress and take real out_buf_len for gunzip instead of guessing
wrong buf size.
Fixes: 1431574a1c4 (lib/decompressors: fix "no limit" output buffer length)
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Alexandre Courbot <acourbot@nvidia.com>
Cc: Jon Medhurst <tixy@linaro.org>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[ kamal: backport to 3.19-stable: no arch/h8300/ ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
arch/arm/boot/compressed/decompress.c | 2 +-
arch/m32r/boot/compressed/misc.c | 3 ++-
arch/mips/boot/compressed/decompress.c | 4 ++--
arch/s390/boot/compressed/misc.c | 2 +-
arch/sh/boot/compressed/misc.c | 2 +-
arch/unicore32/boot/compressed/misc.c | 4 ++--
arch/x86/boot/compressed/misc.c | 3 ++-
lib/decompress_bunzip2.c | 6 +++---
lib/decompress_inflate.c | 31 ++++++++++++++++++++++++++-----
lib/decompress_unlz4.c | 6 +++---
lib/decompress_unlzma.c | 7 +++----
lib/decompress_unlzo.c | 13 ++++++++++++-
lib/decompress_unxz.c | 12 +++++++++++-
13 files changed, 69 insertions(+), 26 deletions(-)
diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
index bd245d3..a0765e7 100644
--- a/arch/arm/boot/compressed/decompress.c
+++ b/arch/arm/boot/compressed/decompress.c
@@ -57,5 +57,5 @@ extern char * strstr(const char * s1, const char *s2);
int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x))
{
- return decompress(input, len, NULL, NULL, output, NULL, error);
+ return __decompress(input, len, NULL, NULL, output, 0, NULL, error);
}
diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
index 28a0952..3a76927 100644
--- a/arch/m32r/boot/compressed/misc.c
+++ b/arch/m32r/boot/compressed/misc.c
@@ -86,6 +86,7 @@ decompress_kernel(int mmu_on, unsigned char *zimage_data,
free_mem_end_ptr = free_mem_ptr + BOOT_HEAP_SIZE;
puts("\nDecompressing Linux... ");
- decompress(input_data, input_len, NULL, NULL, output_data, NULL, error);
+ __decompress(input_data, input_len, NULL, NULL, output_data, 0,
+ NULL, error);
puts("done.\nBooting the kernel.\n");
}
diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
index 31903cf..0c6f024 100644
--- a/arch/mips/boot/compressed/decompress.c
+++ b/arch/mips/boot/compressed/decompress.c
@@ -106,8 +106,8 @@ void decompress_kernel(unsigned long boot_heap_start)
puts("\n");
/* Decompress the kernel with according algorithm */
- decompress((char *)zimage_start, zimage_size, 0, 0,
- (void *)VMLINUX_LOAD_ADDRESS_ULL, 0, error);
+ __decompress((char *)zimage_start, zimage_size, 0, 0,
+ (void *)VMLINUX_LOAD_ADDRESS_ULL, 0, 0, error);
/* FIXME: should we flush cache here? */
puts("Now, booting the kernel...\n");
diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c
index 57cbaff..cca4e1a 100644
--- a/arch/s390/boot/compressed/misc.c
+++ b/arch/s390/boot/compressed/misc.c
@@ -168,7 +168,7 @@ unsigned long decompress_kernel(void)
#endif
puts("Uncompressing Linux... ");
- decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+ __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
puts("Ok, booting the kernel.\n");
return (unsigned long) output;
}
diff --git a/arch/sh/boot/compressed/misc.c b/arch/sh/boot/compressed/misc.c
index 95470a4..208a975 100644
--- a/arch/sh/boot/compressed/misc.c
+++ b/arch/sh/boot/compressed/misc.c
@@ -132,7 +132,7 @@ void decompress_kernel(void)
puts("Uncompressing Linux... ");
cache_control(CACHE_ENABLE);
- decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+ __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error);
cache_control(CACHE_DISABLE);
puts("Ok, booting the kernel.\n");
}
diff --git a/arch/unicore32/boot/compressed/misc.c b/arch/unicore32/boot/compressed/misc.c
index 176d5bd..5c65dfe 100644
--- a/arch/unicore32/boot/compressed/misc.c
+++ b/arch/unicore32/boot/compressed/misc.c
@@ -119,8 +119,8 @@ unsigned long decompress_kernel(unsigned long output_start,
output_ptr = get_unaligned_le32(tmp);
arch_decomp_puts("Uncompressing Linux...");
- decompress(input_data, input_data_end - input_data, NULL, NULL,
- output_data, NULL, error);
+ __decompress(input_data, input_data_end - input_data, NULL, NULL,
+ output_data, 0, NULL, error);
arch_decomp_puts(" done, booting the kernel.\n");
return output_ptr;
}
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index a950864..5cc9593 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -421,7 +421,8 @@ asmlinkage __visible void *decompress_kernel(void *rmode, memptr heap,
#endif
debug_putstr("\nDecompressing Linux... ");
- decompress(input_data, input_len, NULL, NULL, output, NULL, error);
+ __decompress(input_data, input_len, NULL, NULL, output, output_len,
+ NULL, error);
parse_elf(output);
/*
* 32-bit always performs relocations. 64-bit relocations are only
diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
index 6dd0335..0234361 100644
--- a/lib/decompress_bunzip2.c
+++ b/lib/decompress_bunzip2.c
@@ -743,12 +743,12 @@ exit_0:
}
#ifdef PREBOOT
-STATIC int INIT decompress(unsigned char *buf, long len,
+STATIC int INIT __decompress(unsigned char *buf, long len,
long (*fill)(void*, unsigned long),
long (*flush)(void*, unsigned long),
- unsigned char *outbuf,
+ unsigned char *outbuf, long olen,
long *pos,
- void(*error)(char *x))
+ void (*error)(char *x))
{
return bunzip2(buf, len - 4, fill, flush, outbuf, pos, error);
}
diff --git a/lib/decompress_inflate.c b/lib/decompress_inflate.c
index d4c7891..555c06b 100644
--- a/lib/decompress_inflate.c
+++ b/lib/decompress_inflate.c
@@ -1,4 +1,5 @@
#ifdef STATIC
+#define PREBOOT
/* Pre-boot environment: included */
/* prevent inclusion of _LINUX_KERNEL_H in pre-boot environment: lots
@@ -33,23 +34,23 @@ static long INIT nofill(void *buffer, unsigned long len)
}
/* Included from initramfs et al code */
-STATIC int INIT gunzip(unsigned char *buf, long len,
+STATIC int INIT __gunzip(unsigned char *buf, long len,
long (*fill)(void*, unsigned long),
long (*flush)(void*, unsigned long),
- unsigned char *out_buf,
+ unsigned char *out_buf, long out_len,
long *pos,
void(*error)(char *x)) {
u8 *zbuf;
struct z_stream_s *strm;
int rc;
- size_t out_len;
rc = -1;
if (flush) {
out_len = 0x8000; /* 32 K */
out_buf = malloc(out_len);
} else {
- out_len = ((size_t)~0) - (size_t)out_buf; /* no limit */
+ if (!out_len)
+ out_len = ((size_t)~0) - (size_t)out_buf; /* no limit */
}
if (!out_buf) {
error("Out of memory while allocating output buffer");
@@ -181,4 +182,24 @@ gunzip_nomem1:
return rc; /* returns Z_OK (0) if successful */
}
-#define decompress gunzip
+#ifndef PREBOOT
+STATIC int INIT gunzip(unsigned char *buf, long len,
+ long (*fill)(void*, unsigned long),
+ long (*flush)(void*, unsigned long),
+ unsigned char *out_buf,
+ long *pos,
+ void (*error)(char *x))
+{
+ return __gunzip(buf, len, fill, flush, out_buf, 0, pos, error);
+}
+#else
+STATIC int INIT __decompress(unsigned char *buf, long len,
+ long (*fill)(void*, unsigned long),
+ long (*flush)(void*, unsigned long),
+ unsigned char *out_buf, long out_len,
+ long *pos,
+ void (*error)(char *x))
+{
+ return __gunzip(buf, len, fill, flush, out_buf, out_len, pos, error);
+}
+#endif
diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c
index 40f66eb..036fc88 100644
--- a/lib/decompress_unlz4.c
+++ b/lib/decompress_unlz4.c
@@ -196,12 +196,12 @@ exit_0:
}
#ifdef PREBOOT
-STATIC int INIT decompress(unsigned char *buf, long in_len,
+STATIC int INIT __decompress(unsigned char *buf, long in_len,
long (*fill)(void*, unsigned long),
long (*flush)(void*, unsigned long),
- unsigned char *output,
+ unsigned char *output, long out_len,
long *posp,
- void(*error)(char *x)
+ void (*error)(char *x)
)
{
return unlz4(buf, in_len - 4, fill, flush, output, posp, error);
diff --git a/lib/decompress_unlzma.c b/lib/decompress_unlzma.c
index 0be83af..decb646 100644
--- a/lib/decompress_unlzma.c
+++ b/lib/decompress_unlzma.c
@@ -667,13 +667,12 @@ exit_0:
}
#ifdef PREBOOT
-STATIC int INIT decompress(unsigned char *buf, long in_len,
+STATIC int INIT __decompress(unsigned char *buf, long in_len,
long (*fill)(void*, unsigned long),
long (*flush)(void*, unsigned long),
- unsigned char *output,
+ unsigned char *output, long out_len,
long *posp,
- void(*error)(char *x)
- )
+ void (*error)(char *x))
{
return unlzma(buf, in_len - 4, fill, flush, output, posp, error);
}
diff --git a/lib/decompress_unlzo.c b/lib/decompress_unlzo.c
index b94a31b..f4c158e 100644
--- a/lib/decompress_unlzo.c
+++ b/lib/decompress_unlzo.c
@@ -31,6 +31,7 @@
*/
#ifdef STATIC
+#define PREBOOT
#include "lzo/lzo1x_decompress_safe.c"
#else
#include <linux/decompress/unlzo.h>
@@ -287,4 +288,14 @@ exit:
return ret;
}
-#define decompress unlzo
+#ifdef PREBOOT
+STATIC int INIT __decompress(unsigned char *buf, long len,
+ long (*fill)(void*, unsigned long),
+ long (*flush)(void*, unsigned long),
+ unsigned char *out_buf, long olen,
+ long *pos,
+ void (*error)(char *x))
+{
+ return unlzo(buf, len, fill, flush, out_buf, pos, error);
+}
+#endif
diff --git a/lib/decompress_unxz.c b/lib/decompress_unxz.c
index b07a783..25d59a9 100644
--- a/lib/decompress_unxz.c
+++ b/lib/decompress_unxz.c
@@ -394,4 +394,14 @@ error_alloc_state:
* This macro is used by architecture-specific files to decompress
* the kernel image.
*/
-#define decompress unxz
+#ifdef XZ_PREBOOT
+STATIC int INIT __decompress(unsigned char *buf, long len,
+ long (*fill)(void*, unsigned long),
+ long (*flush)(void*, unsigned long),
+ unsigned char *out_buf, long olen,
+ long *pos,
+ void (*error)(char *x))
+{
+ return unxz(buf, len, fill, flush, out_buf, pos, error);
+}
+#endif
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 145/156] ipv6: fix exthdrs offload registration in out_rt path |
| Message-ID | <qlMX8-7PN-15@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit e41b0bedba0293b9e1e8d1e8ed553104b9693656 upstream.
We previously register IPPROTO_ROUTING offload under inet6_add_offload(),
but in error path, we try to unregister it with inet_del_offload(). This
doesn't seem correct, it should actually be inet6_del_offload(), also
ipv6_exthdrs_offload_exit() from that commit seems rather incorrect (it
also uses rthdr_offload twice), but it got removed entirely later on.
Fixes: 3336288a9fea ("ipv6: Switch to using new offload infrastructure.")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/ipv6/exthdrs_offload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/exthdrs_offload.c b/net/ipv6/exthdrs_offload.c
index 447a7fb..f5e2ba1 100644
--- a/net/ipv6/exthdrs_offload.c
+++ b/net/ipv6/exthdrs_offload.c
@@ -36,6 +36,6 @@ out:
return ret;
out_rt:
- inet_del_offload(&rthdr_offload, IPPROTO_ROUTING);
+ inet6_del_offload(&rthdr_offload, IPPROTO_ROUTING);
goto out;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 070/156] sched: Fix cpu_active_mask/cpu_online_mask race |
| Message-ID | <qlMX8-7PN-21@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Jan=20H=2E=20Sch=C3=B6nherr?= <jschoenh@amazon.de>
commit dd9d3843755da95f63dd3a376f62b3e45c011210 upstream.
There is a race condition in SMP bootup code, which may result
in
WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418
workqueue_cpu_up_callback()
or
kernel BUG at kernel/smpboot.c:135!
It can be triggered with a bit of luck in Linux guests running
on busy hosts.
CPU0 CPUn
==== ====
_cpu_up()
__cpu_up()
start_secondary()
set_cpu_online()
cpumask_set_cpu(cpu,
to_cpumask(cpu_online_bits));
cpu_notify(CPU_ONLINE)
<do stuff, see below>
cpumask_set_cpu(cpu,
to_cpumask(cpu_active_bits));
During the various CPU_ONLINE callbacks CPUn is online but not
active. Several things can go wrong at that point, depending on
the scheduling of tasks on CPU0.
Variant 1:
cpu_notify(CPU_ONLINE)
workqueue_cpu_up_callback()
rebind_workers()
set_cpus_allowed_ptr()
This call fails because it requires an active CPU; rebind_workers()
ends with a warning:
WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:4418
workqueue_cpu_up_callback()
Variant 2:
cpu_notify(CPU_ONLINE)
smpboot_thread_call()
smpboot_unpark_threads()
..
__kthread_unpark()
__kthread_bind()
wake_up_state()
..
select_task_rq()
select_fallback_rq()
The ->wake_cpu of the unparked thread is not allowed, making a call
to select_fallback_rq() necessary. Then, select_fallback_rq() cannot
find an allowed, active CPU and promptly resets the allowed CPUs, so
that the task in question ends up on CPU0.
When those unparked tasks are eventually executed, they run
immediately into a BUG:
kernel BUG at kernel/smpboot.c:135!
Just changing the order in which the online/active bits are set
(and adding some memory barriers), would solve the two issues
above. However, it would change the order of operations back to
the one before commit 6acbfb96976f ("sched: Fix hotplug vs.
set_cpus_allowed_ptr()"), thus, reintroducing that particular
problem.
Going further back into history, we have at least the following
commits touching this topic:
- commit 2baab4e90495 ("sched: Fix select_fallback_rq() vs cpu_active/cpu_online")
- commit 5fbd036b552f ("sched: Cleanup cpu_active madness")
Together, these give us the following non-working solutions:
- secondary CPU sets active before online, because active is assumed to
be a subset of online;
- secondary CPU sets online before active, because the primary CPU
assumes that an online CPU is also active;
- secondary CPU sets online and waits for primary CPU to set active,
because it might deadlock.
Commit 875ebe940d77 ("powerpc/smp: Wait until secondaries are
active & online") introduces an arch-specific solution to this
arch-independent problem.
Now, go for a more general solution without explicit waiting and
simply set active twice: once on the secondary CPU after online
was set and once on the primary CPU after online was seen.
set_cpus_allowed_ptr()")
Signed-off-by: Jan H. Schönherr <jschoenh@amazon.de>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Anton Blanchard <anton@samba.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Joerg Roedel <jroedel@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Wilson <msw@amazon.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 6acbfb96976f ("sched: Fix hotplug vs. set_cpus_allowed_ptr()")
Link: http://lkml.kernel.org/r/1439408156-18840-1-git-send-email-jschoenh@amazon.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
kernel/sched/core.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index c90b977..48b14d6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -5370,6 +5370,14 @@ static int sched_cpu_active(struct notifier_block *nfb,
case CPU_STARTING:
set_cpu_rq_start_time();
return NOTIFY_OK;
+ case CPU_ONLINE:
+ /*
+ * At this point a starting CPU has marked itself as online via
+ * set_cpu_online(). But it might not yet have marked itself
+ * as active, which is essential from here on.
+ *
+ * Thus, fall-through and help the starting CPU along.
+ */
case CPU_DOWN_FAILED:
set_cpu_active((long)hcpu, true);
return NOTIFY_OK;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 144/156] sock, diag: fix panic in sock_diag_put_filterinfo |
| Message-ID | <qlMX9-7PN-27@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit b382c08656000c12a146723a153b85b13a855b49 upstream.
diag socket's sock_diag_put_filterinfo() dumps classic BPF programs
upon request to user space (ss -0 -b). However, native eBPF programs
attached to sockets (SO_ATTACH_BPF) cannot be dumped with this method:
Their orig_prog is always NULL. However, sock_diag_put_filterinfo()
unconditionally tries to access its filter length resp. wants to copy
the filter insns from there. Internal cBPF to eBPF transformations
attached to sockets don't have this issue, as orig_prog state is kept.
It's currently only used by packet sockets. If we would want to add
native eBPF support in the future, this needs to be done through
a different attribute than PACKET_DIAG_FILTER to not confuse possible
user space disassemblers that work on diag data.
Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/core/sock_diag.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
index ad704c7..91c2630 100644
--- a/net/core/sock_diag.c
+++ b/net/core/sock_diag.c
@@ -69,6 +69,9 @@ int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk,
goto out;
fprog = filter->prog->orig_prog;
+ if (!fprog)
+ goto out;
+
flen = bpf_classic_proglen(fprog);
attr = nla_reserve(skb, attrtype, flen);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 153/156] batman-adv: Make DAT capability changes atomic |
| Message-ID | <qlMX9-7PN-23@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
commit 65d7d46050704bcdb8121ddbf4110bfbf2b38baa upstream.
Bitwise OR/AND assignments in C aren't guaranteed to be atomic. One
OGM handler might undo the set/clear of a specific bit from another
handler run in between.
Fix this by using the atomic set_bit()/clear_bit()/test_bit() functions.
Fixes: 17cf0ea455f1 ("batman-adv: tvlv - add distributed arp table container")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/distributed-arp-table.c | 7 ++++---
net/batman-adv/types.h | 4 ++--
2 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index b598111..4bbd72e 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -15,6 +15,7 @@
* along with this program; if not, see <http://www.gnu.org/licenses/>.
*/
+#include <linux/bitops.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <linux/if_vlan.h>
@@ -422,7 +423,7 @@ static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
int j;
/* check if orig node candidate is running DAT */
- if (!(candidate->capabilities & BATADV_ORIG_CAPA_HAS_DAT))
+ if (!test_bit(BATADV_ORIG_CAPA_HAS_DAT, &candidate->capabilities))
goto out;
/* Check if this node has already been selected... */
@@ -682,9 +683,9 @@ static void batadv_dat_tvlv_ogm_handler_v1(struct batadv_priv *bat_priv,
uint16_t tvlv_value_len)
{
if (flags & BATADV_TVLV_HANDLER_OGM_CIFNOTFND)
- orig->capabilities &= ~BATADV_ORIG_CAPA_HAS_DAT;
+ clear_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
else
- orig->capabilities |= BATADV_ORIG_CAPA_HAS_DAT;
+ set_bit(BATADV_ORIG_CAPA_HAS_DAT, &orig->capabilities);
}
/**
diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
index 8854c05..3d316c8 100644
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -258,7 +258,7 @@ struct batadv_orig_node {
struct hlist_node mcast_want_all_ipv4_node;
struct hlist_node mcast_want_all_ipv6_node;
#endif
- uint8_t capabilities;
+ unsigned long capabilities;
uint8_t capa_initialized;
atomic_t last_ttvn;
unsigned char *tt_buff;
@@ -298,7 +298,7 @@ struct batadv_orig_node {
* (= orig node announces a tvlv of type BATADV_TVLV_MCAST)
*/
enum batadv_orig_capabilities {
- BATADV_ORIG_CAPA_HAS_DAT = BIT(0),
+ BATADV_ORIG_CAPA_HAS_DAT,
BATADV_ORIG_CAPA_HAS_NC = BIT(1),
BATADV_ORIG_CAPA_HAS_TT = BIT(2),
BATADV_ORIG_CAPA_HAS_MCAST = BIT(3),
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 127/156] batman-adv: Fix potentially broken skb network header access |
| Message-ID | <qlMX9-7PN-25@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
commit 53cf037bf846417fd92dc92ddf97267f69b110f4 upstream.
The two commits noted below added calls to ip_hdr() and ipv6_hdr(). They
need a correctly set skb network header.
Unfortunately we cannot rely on the device drivers to set it for us.
Therefore setting it in the beginning of the according ndo_start_xmit
handler.
Fixes: 1d8ab8d3c176 ("batman-adv: Modified forwarding behaviour for multicast packets")
Fixes: ab49886e3da7 ("batman-adv: Add IPv4 link-local/IPv6-ll-all-nodes multicast support")
Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Antonio Quartulli <antonio@meshcoding.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
net/batman-adv/soft-interface.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 8e66b01..43fdae0 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -173,6 +173,7 @@ static int batadv_interface_tx(struct sk_buff *skb,
int gw_mode;
enum batadv_forw_mode forw_mode;
struct batadv_orig_node *mcast_single_orig = NULL;
+ int network_offset = ETH_HLEN;
if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
goto dropped;
@@ -185,14 +186,18 @@ static int batadv_interface_tx(struct sk_buff *skb,
case ETH_P_8021Q:
vhdr = vlan_eth_hdr(skb);
- if (vhdr->h_vlan_encapsulated_proto != ethertype)
+ if (vhdr->h_vlan_encapsulated_proto != ethertype) {
+ network_offset += VLAN_HLEN;
break;
+ }
/* fall through */
case ETH_P_BATMAN:
goto dropped;
}
+ skb_set_network_header(skb, network_offset);
+
if (batadv_bla_tx(bat_priv, skb, vid))
goto dropped;
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 141/156] IB/uverbs: Fix race between ib_uverbs_open and remove_one |
| Message-ID | <qlMXa-7PN-29@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <yishaih@mellanox.com>
commit 35d4a0b63dc0c6d1177d4f532a9deae958f0662c upstream.
Fixes: 2a72f212263701b927559f6850446421d5906c41 ("IB/uverbs: Remove dev_table")
Before this commit there was a device look-up table that was protected
by a spin_lock used by ib_uverbs_open and by ib_uverbs_remove_one. When
it was dropped and container_of was used instead, it enabled the race
with remove_one as dev might be freed just after:
dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev) but
before the kref_get.
In addition, this buggy patch added some dead code as
container_of(x,y,z) can never be NULL and so dev can never be NULL.
As a result the comment above ib_uverbs_open saying "the open method
will either immediately run -ENXIO" is wrong as it can never happen.
The solution follows Jason Gunthorpe suggestion from below URL:
https://www.mail-archive.com/linux-rdma@vger.kernel.org/msg25692.html
cdev will hold a kref on the parent (the containing structure,
ib_uverbs_device) and only when that kref is released it is
guaranteed that open will never be called again.
In addition, fixes the active count scheme to use an atomic
not a kref to prevent WARN_ON as pointed by above comment
from Jason.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/core/uverbs.h | 3 ++-
drivers/infiniband/core/uverbs_main.c | 43 ++++++++++++++++++++++++-----------
2 files changed, 32 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index 643c08a..1c74d89 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -85,7 +85,7 @@
*/
struct ib_uverbs_device {
- struct kref ref;
+ atomic_t refcount;
int num_comp_vectors;
struct completion comp;
struct device *dev;
@@ -94,6 +94,7 @@ struct ib_uverbs_device {
struct cdev cdev;
struct rb_root xrcd_tree;
struct mutex xrcd_tree_mutex;
+ struct kobject kobj;
};
struct ib_uverbs_event_file {
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 5db1a8c..2eddc4c 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -128,14 +128,18 @@ static int (*uverbs_ex_cmd_table[])(struct ib_uverbs_file *file,
static void ib_uverbs_add_one(struct ib_device *device);
static void ib_uverbs_remove_one(struct ib_device *device);
-static void ib_uverbs_release_dev(struct kref *ref)
+static void ib_uverbs_release_dev(struct kobject *kobj)
{
struct ib_uverbs_device *dev =
- container_of(ref, struct ib_uverbs_device, ref);
+ container_of(kobj, struct ib_uverbs_device, kobj);
- complete(&dev->comp);
+ kfree(dev);
}
+static struct kobj_type ib_uverbs_dev_ktype = {
+ .release = ib_uverbs_release_dev,
+};
+
static void ib_uverbs_release_event_file(struct kref *ref)
{
struct ib_uverbs_event_file *file =
@@ -301,13 +305,19 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
return context->device->dealloc_ucontext(context);
}
+static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev)
+{
+ complete(&dev->comp);
+}
+
static void ib_uverbs_release_file(struct kref *ref)
{
struct ib_uverbs_file *file =
container_of(ref, struct ib_uverbs_file, ref);
module_put(file->device->ib_dev->owner);
- kref_put(&file->device->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&file->device->refcount))
+ ib_uverbs_comp_dev(file->device);
kfree(file);
}
@@ -741,9 +751,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
int ret;
dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
- if (dev)
- kref_get(&dev->ref);
- else
+ if (!atomic_inc_not_zero(&dev->refcount))
return -ENXIO;
if (!try_module_get(dev->ib_dev->owner)) {
@@ -764,6 +772,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
mutex_init(&file->mutex);
filp->private_data = file;
+ kobject_get(&dev->kobj);
return nonseekable_open(inode, filp);
@@ -771,13 +780,16 @@ err_module:
module_put(dev->ib_dev->owner);
err:
- kref_put(&dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&dev->refcount))
+ ib_uverbs_comp_dev(dev);
+
return ret;
}
static int ib_uverbs_close(struct inode *inode, struct file *filp)
{
struct ib_uverbs_file *file = filp->private_data;
+ struct ib_uverbs_device *dev = file->device;
ib_uverbs_cleanup_ucontext(file, file->ucontext);
@@ -785,6 +797,7 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
kref_put(&file->ref, ib_uverbs_release_file);
+ kobject_put(&dev->kobj);
return 0;
}
@@ -880,10 +893,11 @@ static void ib_uverbs_add_one(struct ib_device *device)
if (!uverbs_dev)
return;
- kref_init(&uverbs_dev->ref);
+ atomic_set(&uverbs_dev->refcount, 1);
init_completion(&uverbs_dev->comp);
uverbs_dev->xrcd_tree = RB_ROOT;
mutex_init(&uverbs_dev->xrcd_tree_mutex);
+ kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
spin_lock(&map_lock);
devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -910,6 +924,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
cdev_init(&uverbs_dev->cdev, NULL);
uverbs_dev->cdev.owner = THIS_MODULE;
uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
+ uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj;
kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
if (cdev_add(&uverbs_dev->cdev, base, 1))
goto err_cdev;
@@ -940,9 +955,10 @@ err_cdev:
clear_bit(devnum, overflow_map);
err:
- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&uverbs_dev->refcount))
+ ib_uverbs_comp_dev(uverbs_dev);
wait_for_completion(&uverbs_dev->comp);
- kfree(uverbs_dev);
+ kobject_put(&uverbs_dev->kobj);
return;
}
@@ -962,9 +978,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
else
clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map);
- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&uverbs_dev->refcount))
+ ib_uverbs_comp_dev(uverbs_dev);
wait_for_completion(&uverbs_dev->comp);
- kfree(uverbs_dev);
+ kobject_put(&uverbs_dev->kobj);
}
static char *uverbs_devnode(struct device *dev, umode_t *mode)
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 136/156] IB/mlx4: Fix potential deadlock when sending mad to wire |
| Message-ID | <qlMXa-7PN-35@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <jackm@dev.mellanox.co.il>
commit 90c1d8b6350cca9d8a234f03c77a317a7613bcee upstream.
send_mad_to_wire takes the same spinlock that is taken in
the interrupt context. Therefore, it needs irqsave/restore.
Fixes: b9c5d6a64358 ('IB/mlx4: Add multicast group (MCG) paravirtualization for SR-IOV')
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/infiniband/hw/mlx4/mcg.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index ed327e6..a0559a8 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -206,15 +206,16 @@ static int send_mad_to_wire(struct mlx4_ib_demux_ctx *ctx, struct ib_mad *mad)
{
struct mlx4_ib_dev *dev = ctx->dev;
struct ib_ah_attr ah_attr;
+ unsigned long flags;
- spin_lock(&dev->sm_lock);
+ spin_lock_irqsave(&dev->sm_lock, flags);
if (!dev->sm_ah[ctx->port - 1]) {
/* port is not yet Active, sm_ah not ready */
- spin_unlock(&dev->sm_lock);
+ spin_unlock_irqrestore(&dev->sm_lock, flags);
return -EAGAIN;
}
mlx4_ib_query_ah(dev->sm_ah[ctx->port - 1], &ah_attr);
- spin_unlock(&dev->sm_lock);
+ spin_unlock_irqrestore(&dev->sm_lock, flags);
return mlx4_ib_send_to_wire(dev, mlx4_master_func_num(dev->dev),
ctx->port, IB_QPT_GSI, 0, 1, IB_QP1_QKEY,
&ah_attr, NULL, mad);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 142/156] mmc: core: fix race condition in mmc_wait_data_done |
| Message-ID | <qlMXa-7PN-33@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Jialing Fu <jlfu@marvell.com>
commit 71f8a4b81d040b3d094424197ca2f1bf811b1245 upstream.
The following panic is captured in ker3.14, but the issue still exists
in latest kernel.
---------------------------------------------------------------------
[ 20.738217] c0 3136 (Compiler) Unable to handle kernel NULL pointer dereference
at virtual address 00000578
......
[ 20.738499] c0 3136 (Compiler) PC is at _raw_spin_lock_irqsave+0x24/0x60
[ 20.738527] c0 3136 (Compiler) LR is at _raw_spin_lock_irqsave+0x20/0x60
[ 20.740134] c0 3136 (Compiler) Call trace:
[ 20.740165] c0 3136 (Compiler) [<ffffffc0008ee900>] _raw_spin_lock_irqsave+0x24/0x60
[ 20.740200] c0 3136 (Compiler) [<ffffffc0000dd024>] __wake_up+0x1c/0x54
[ 20.740230] c0 3136 (Compiler) [<ffffffc000639414>] mmc_wait_data_done+0x28/0x34
[ 20.740262] c0 3136 (Compiler) [<ffffffc0006391a0>] mmc_request_done+0xa4/0x220
[ 20.740314] c0 3136 (Compiler) [<ffffffc000656894>] sdhci_tasklet_finish+0xac/0x264
[ 20.740352] c0 3136 (Compiler) [<ffffffc0000a2b58>] tasklet_action+0xa0/0x158
[ 20.740382] c0 3136 (Compiler) [<ffffffc0000a2078>] __do_softirq+0x10c/0x2e4
[ 20.740411] c0 3136 (Compiler) [<ffffffc0000a24bc>] irq_exit+0x8c/0xc0
[ 20.740439] c0 3136 (Compiler) [<ffffffc00008489c>] handle_IRQ+0x48/0xac
[ 20.740469] c0 3136 (Compiler) [<ffffffc000081428>] gic_handle_irq+0x38/0x7c
----------------------------------------------------------------------
Because in SMP, "mrq" has race condition between below two paths:
path1: CPU0: <tasklet context>
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
//
// If CPU0 has just finished "is_done_rcv = true" in path1, and at
// this moment, IRQ or ICache line missing happens in CPU0.
// What happens in CPU1 (path2)?
//
// If the mmcqd thread in CPU1(path2) hasn't entered to sleep mode:
// path2 would have chance to break from wait_event_interruptible
// in mmc_wait_for_data_req_done and continue to run for next
// mmc_request (mmc_blk_rw_rq_prep).
//
// Within mmc_blk_rq_prep, mrq is cleared to 0.
// If below line still gets host from "mrq" as the result of
// compiler, the panic happens as we traced.
wake_up_interruptible(&mrq->host->context_info.wait);
}
path2: CPU1: <The mmcqd thread runs mmc_queue_thread>
static int mmc_wait_for_data_req_done(...
{
...
while (1) {
wait_event_interruptible(context_info->wait,
(context_info->is_done_rcv ||
context_info->is_new_req));
static void mmc_blk_rw_rq_prep(...
{
...
memset(brq, 0, sizeof(struct mmc_blk_request));
This issue happens very coincidentally; however adding mdelay(1) in
mmc_wait_data_done as below could duplicate it easily.
static void mmc_wait_data_done(struct mmc_request *mrq)
{
mrq->host->context_info.is_done_rcv = true;
+ mdelay(1);
wake_up_interruptible(&mrq->host->context_info.wait);
}
At runtime, IRQ or ICache line missing may just happen at the same place
of the mdelay(1).
This patch gets the mmc_context_info at the beginning of function, it can
avoid this race condition.
Signed-off-by: Jialing Fu <jlfu@marvell.com>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Fixes: 2220eedfd7ae ("mmc: fix async request mechanism ....")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/mmc/core/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 113aaec..a633666 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -326,8 +326,10 @@ EXPORT_SYMBOL(mmc_start_bkops);
*/
static void mmc_wait_data_done(struct mmc_request *mrq)
{
- mrq->host->context_info.is_done_rcv = true;
- wake_up_interruptible(&mrq->host->context_info.wait);
+ struct mmc_context_info *context_info = &mrq->host->context_info;
+
+ context_info->is_done_rcv = true;
+ wake_up_interruptible(&context_info->wait);
}
static void mmc_wait_done(struct mmc_request *mrq)
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Date | 2015-10-20 23:50 +0200 |
| Subject | [PATCH 3.19.y-ckt 132/156] ath10k: fix dma_mapping_error() handling |
| Message-ID | <qlMXa-7PN-37@gated-at.bofh.it> |
| In reply to | #1252076 |
3.19.8-ckt8 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Kazior <michal.kazior@tieto.com>
commit 5e55e3cbd1042cffa6249f22c10585e63f8a29bf upstream.
The function returns 1 when DMA mapping fails. The
driver would return bogus values and could
possibly confuse itself if DMA failed.
Fixes: 767d34fc67af ("ath10k: remove DMA mapping wrappers")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Michal Kazior <michal.kazior@tieto.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/net/wireless/ath/ath10k/htc.c | 4 +++-
drivers/net/wireless/ath/ath10k/htt_tx.c | 8 ++++++--
drivers/net/wireless/ath/ath10k/pci.c | 8 ++++++--
drivers/net/wireless/ath/ath10k/wmi.c | 1 +
4 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index f1946a6..c3b71e9 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -163,8 +163,10 @@ int ath10k_htc_send(struct ath10k_htc *htc,
skb_cb->eid = eid;
skb_cb->paddr = dma_map_single(dev, skb->data, skb->len, DMA_TO_DEVICE);
ret = dma_mapping_error(dev, skb_cb->paddr);
- if (ret)
+ if (ret) {
+ ret = -EIO;
goto err_credits;
+ }
sg_item.transfer_id = ep->eid;
sg_item.transfer_context = skb;
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index 4bc51d8..c00cbaf 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -401,8 +401,10 @@ int ath10k_htt_mgmt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
DMA_TO_DEVICE);
res = dma_mapping_error(dev, skb_cb->paddr);
- if (res)
+ if (res) {
+ res = -EIO;
goto err_free_txdesc;
+ }
skb_put(txdesc, len);
cmd = (struct htt_cmd *)txdesc->data;
@@ -487,8 +489,10 @@ int ath10k_htt_tx(struct ath10k_htt *htt, struct sk_buff *msdu)
skb_cb->paddr = dma_map_single(dev, msdu->data, msdu->len,
DMA_TO_DEVICE);
res = dma_mapping_error(dev, skb_cb->paddr);
- if (res)
+ if (res) {
+ res = -EIO;
goto err_free_txbuf;
+ }
if (likely(use_frags)) {
frags = skb_cb->htt.txbuf->frags;
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 7abb836..8ff7aa5 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1363,8 +1363,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
req_paddr = dma_map_single(ar->dev, treq, req_len, DMA_TO_DEVICE);
ret = dma_mapping_error(ar->dev, req_paddr);
- if (ret)
+ if (ret) {
+ ret = -EIO;
goto err_dma;
+ }
if (resp && resp_len) {
tresp = kzalloc(*resp_len, GFP_KERNEL);
@@ -1376,8 +1378,10 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
resp_paddr = dma_map_single(ar->dev, tresp, *resp_len,
DMA_FROM_DEVICE);
ret = dma_mapping_error(ar->dev, resp_paddr);
- if (ret)
+ if (ret) {
+ ret = EIO;
goto err_req;
+ }
xfer.wait_for_resp = true;
xfer.resp_len = 0;
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index c0f3e4d..facd434 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1920,6 +1920,7 @@ static void ath10k_wmi_event_host_swba(struct ath10k *ar, struct sk_buff *skb)
ath10k_warn(ar, "failed to map beacon: %d\n",
ret);
dev_kfree_skb_any(bcn);
+ ret = -EIO;
goto skip;
}
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
Page 1 of 8 [1] 2 3 4 5 6 7 8 Next page →
Back to top | Article view | linux.kernel
csiph-web