Groups > linux.kernel > #1256068 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review

Started by	Luis Henriques <luis.henriques@canonical.com>
First post	2015-10-26 15:30 +0100
Last post	2015-10-28 18:00 +0100
Articles	14 — 1 participant

Back to article view | Back to linux.kernel

  [3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 005/104] arm64: head.S: initialise mdcr_el2 in el2_setup Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 038/104] usb: xhci: Clear XHCI_STATE_DYING on start Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 006/104] kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 027/104] drm/vmwgfx: Fix up user_dmabuf refcounting Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 001/104] ARM: 8429/1: disable GCC SRA optimization Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 015/104] arm64: errata: add module build workaround for erratum #843419 Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 029/104] Btrfs: fix read corruption of compressed and shared extents Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 15:30 +0100
    [PATCH 3.16.y-ckt 105/107] KEYS: Fix race between key destruction and finding a keyring by name Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 20:10 +0100
    [PATCH 3.16.y-ckt 107/107] KEYS: Don't permit request_key() to construct a new keyring Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 20:10 +0100
    Re: [3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 20:10 +0100
      Re: [3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review Luis Henriques <luis.henriques@canonical.com> - 2015-10-28 18:00 +0100
    [PATCH 3.16.y-ckt 106/107] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Luis Henriques <luis.henriques@canonical.com> - 2015-10-26 20:10 +0100
    [PATCH 3.16.y-ckt 108/108] Btrfs: update fix for read corruption of compressed and shared extents Luis Henriques <luis.henriques@canonical.com> - 2015-10-28 18:00 +0100

#1256068 — [3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review
Message-ID	<qnQjT-qq-3@gated-at.bofh.it>

This is the start of the review cycle for the Linux 3.16.7-ckt19 stable kernel.

This version contains 104 new patches, summarized below.  The new patches are
posted as replies to this message and also available in this git branch:

http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review

git://kernel.ubuntu.com/ubuntu/linux.git  linux-3.16.y-review

The review period for version 3.16.7-ckt19 will be open for the next three days.
To report a problem, please reply to the relevant follow-up patch message.

For more information about the Linux 3.16.y-ckt extended stable kernel version,
see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .

 -Luis

--
 arch/arm/Kconfig                           |   1 -
 arch/arm/Makefile                          |   8 ++
 arch/arm/boot/dts/omap3-beagle.dts         |   2 +-
 arch/arm/boot/dts/omap5-uevm.dts           |   4 +-
 arch/arm/kernel/signal.c                   |  15 ++--
 arch/arm/kvm/interrupts_head.S             |   6 +-
 arch/arm/mach-orion5x/include/mach/irqs.h  |  64 +++++++--------
 arch/arm/mach-orion5x/irq.c                |   4 +-
 arch/arm64/Kconfig                         |  16 ++++
 arch/arm64/Makefile                        |   4 +
 arch/arm64/kernel/head.S                   |   5 ++
 arch/arm64/kernel/module.c                 |   2 +
 arch/arm64/kernel/signal32.c               |  47 ++++++++---
 arch/arm64/kvm/hyp.S                       |   5 +-
 arch/m68k/include/asm/linkage.h            |  30 +++++++
 arch/mips/kernel/cps-vec.S                 |  12 +--
 arch/mips/mm/dma-default.c                 |   2 +-
 arch/powerpc/boot/Makefile                 |   3 +
 arch/powerpc/mm/hugepage-hash64.c          |   3 +-
 arch/x86/include/uapi/asm/msr-index.h      |   1 +
 arch/x86/kernel/apic/apic.c                |   7 ++
 arch/x86/kernel/entry_64.S                 |  16 +++-
 arch/x86/kernel/paravirt.c                 |  16 +++-
 arch/x86/kernel/tsc.c                      |  17 ++--
 arch/x86/kvm/svm.c                         |   2 +-
 arch/x86/kvm/x86.c                         |   2 +
 arch/x86/mm/init_64.c                      |   2 +-
 arch/x86/platform/efi/efi.c                |  67 +++++++++++++++-
 drivers/block/zram/zcomp.c                 |  12 +--
 drivers/cpufreq/intel_pstate.c             |  10 +--
 drivers/dma/dw/core.c                      |   4 +-
 drivers/gpu/drm/i915/intel_bios.c          |  12 ++-
 drivers/gpu/drm/qxl/qxl_display.c          |  14 ++--
 drivers/gpu/drm/radeon/atombios_encoders.c |   8 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h        |   6 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c    |   6 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c    |   2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c   |  29 +++++--
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c     |   2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c    |  12 ++-
 drivers/hwmon/nct6775.c                    |  16 ++--
 drivers/infiniband/ulp/isert/ib_isert.c    |   9 ++-
 drivers/mtd/ubi/io.c                       |   5 ++
 drivers/mtd/ubi/vtbl.c                     |   1 +
 drivers/mtd/ubi/wl.c                       |   1 +
 drivers/net/ethernet/marvell/mvneta.c      |   4 +-
 drivers/net/ppp/pppoe.c                    |   1 -
 drivers/net/usb/asix_devices.c             |  16 +---
 drivers/net/vxlan.c                        |  10 +--
 drivers/net/xen-netfront.c                 |   3 +-
 drivers/pci/access.c                       |  27 +------
 drivers/pci/quirks.c                       |  20 ++++-
 drivers/platform/x86/hp-wmi.c              |  35 +++++---
 drivers/spi/spi-pxa2xx.c                   |   4 +
 drivers/spi/spi-xtensa-xtfpga.c            |   4 +-
 drivers/spi/spi.c                          |   3 +-
 drivers/staging/android/ion/ion.c          |   6 +-
 drivers/usb/chipidea/udc.c                 |  84 +++++++++----------
 drivers/usb/core/config.c                  |   5 +-
 drivers/usb/host/ehci-fsl.c                |  13 +++
 drivers/usb/host/ehci-hub.c                |   7 ++
 drivers/usb/host/ehci.h                    |  12 +++
 drivers/usb/host/fsl-mph-dr-of.c           |  10 +++
 drivers/usb/host/xhci-mem.c                |  23 +++---
 drivers/usb/host/xhci-ring.c               |  13 ++-
 drivers/usb/host/xhci.c                    |   9 +--
 drivers/usb/serial/option.c                |  24 ++++++
 drivers/usb/serial/whiteheat.c             |  31 ++++++++
 fs/btrfs/extent_io.c                       |  65 +++++++++++++--
 fs/btrfs/inode.c                           |   3 +-
 fs/cifs/cifsencrypt.c                      |  53 +++++++++++-
 fs/cifs/ioctl.c                            |   6 ++
 fs/cifs/smb2ops.c                          |   8 +-
 fs/coredump.c                              |  38 +++++++--
 fs/dcache.c                                |   7 ++
 fs/jbd2/checkpoint.c                       |  39 +++++++--
 fs/jbd2/commit.c                           |   2 +-
 fs/jbd2/journal.c                          |  11 ++-
 fs/namei.c                                 |  31 +++++++-
 fs/ocfs2/dlm/dlmmaster.c                   |   9 ++-
 fs/ocfs2/dlm/dlmrecovery.c                 |   8 +-
 include/linux/fsl_devices.h                |   2 +
 include/linux/jbd2.h                       |   3 +-
 include/linux/skbuff.h                     |   5 +-
 include/net/af_unix.h                      |   6 +-
 include/net/sock.h                         |   8 ++
 ipc/msg.c                                  |  14 ++--
 ipc/sem.c                                  |  15 ++--
 ipc/shm.c                                  |  12 +--
 ipc/util.c                                 |   8 +-
 kernel/irq/proc.c                          |  19 ++++-
 kernel/time/clocksource.c                  |   2 +-
 mm/hugetlb.c                               |   8 ++
 mm/slab.c                                  |  13 ++-
 net/core/datagram.c                        |   6 +-
 net/core/ethtool.c                         |   2 +-
 net/core/fib_rules.c                       |   2 +-
 net/core/skbuff.c                          |   9 ++-
 net/ipv4/tcp_input.c                       |   2 +-
 net/ipv4/udp.c                             |   2 +-
 net/ipv6/raw.c                             |   2 +-
 net/ipv6/udp.c                             |   3 +-
 net/l2tp/l2tp_core.c                       |  11 ++-
 net/netfilter/nft_compat.c                 |  24 ++++--
 net/netlink/af_netlink.c                   |  34 +++++---
 net/openvswitch/flow_table.c               |   3 +-
 net/sctp/sm_sideeffect.c                   |   2 +-
 net/unix/af_unix.c                         |  16 +++-
 sound/arm/Kconfig                          |  15 ++--
 sound/soc/pxa/Kconfig                      |   2 -
 sound/soc/pxa/pxa2xx-ac97.c                |   4 +-
 tools/lib/traceevent/event-parse.c         |  23 +++++-
 tools/perf/util/header.c                   |   4 +-
 tools/perf/util/symbol-elf.c               |  35 +++-----
 virt/kvm/eventfd.c                         | 124 +++++++++++++++++------------
 virt/kvm/kvm_main.c                        |  19 ++++-
 116 files changed, 1164 insertions(+), 451 deletions(-)

Aaron Conole (2):
      af_unix: Convert the unix_sk macro to an inline function for type safety
      af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag

Adrian Hunter (1):
      perf tools: Fix copying of /proc/kcore

Alex Williamson (2):
      PCI: Fix devfn for VPD access through function 0
      PCI: Use function 0 VPD for identical functions, regular VPD for others

Alexander Couzens (1):
      l2tp: protect tunnel->del_work by ref_count

Andreas Schwab (1):
      m68k: Define asmlinkage_protect

Andrey Vagin (1):
      net/unix: fix logic about sk_peek_offset

Andy Lutomirski (2):
      x86/paravirt: Replace the paravirt nop with a bona fide empty function
      x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code

Andy Shevchenko (1):
      dmaengine: dw: properly read DWC_PARAMS register

Aneesh Kumar K.V (1):
      powerpc/mm: Recompute hash value after a failed update

Arad, Ronen (1):
      netlink: Trim skb to alloc size to avoid MSG_TRUNC

Ard Biesheuvel (1):
      ARM: 8429/1: disable GCC SRA optimization

Arnaldo Carvalho de Melo (1):
      perf header: Fixup reading of HEADER_NRCPUS feature

Ben Hutchings (1):
      genirq: Fix race in register_irq_proc()

Benjamin Herrenschmidt (1):
      powerpc/boot: Specify ABI v2 when building an LE boot wrapper

Carl Frederik Werner (1):
      ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again

Charles Keepax (1):
      asix: Do full reset during ax88772_bind

Chas Williams (1):
      net/xen-netfront: only napi_synchronize() if running

Dave Airlie (1):
      drm/qxl: only report first monitor as connected if we have no state

David Woodhouse (1):
      x86/platform: Fix Geode LX timekeeping in the generic x86 build

Dirk Müller (1):
      Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS

Eric Dumazet (1):
      net: add pfmemalloc check in sk_add_backlog()

Eric W. Biederman (2):
      dcache: Handle escaped paths in prepend_path
      vfs: Test for and handle paths that are unreachable from their mnt_root

Fabiano Fidêncio (1):
      drm/qxl: recreate the primary surface when the bo is not primary

Filipe Manana (1):
      Btrfs: fix read corruption of compressed and shared extents

Grazvydas Ignotas (1):
      ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets

Guenter Roeck (2):
      hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
      spi: Fix documentation of spi_alloc_master()

Guillaume Nault (1):
      ppp: don't override sk->sk_state in pppoe_flush_dev()

James Hogan (1):
      MIPS: dma-default: Fix 32-bit fall back to GFP_DMA

Jan Kara (1):
      jbd2: avoid infinite loop when destroying aborted journal

Jani Nikula (1):
      drm/i915/bios: handle MIPI Sequence Block v3+ gracefully

Jann Horn (2):
      CIFS: fix type confusion in copy offload ioctl
      fs: if a coredump already exists, unlink and recreate with O_EXCL

Jason Wang (4):
      kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
      kvm: factor out core eventfd assign/deassign logic
      kvm: fix double free for fast mmio eventfd
      kvm: fix zero length mmio searching

Jeff Mahoney (1):
      btrfs: skip waiting on ordered range for special files

Jenny Derzhavetz (1):
      iser-target: remove command with state ISTATE_REMOVE

Jiri Benc (1):
      vxlan: set needed headroom correctly

Joe Perches (1):
      ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings

Johan Hovold (1):
      USB: whiteheat: fix potential null-deref at probe

John Stultz (1):
      clocksource: Fix abs() usage w/ 64bit values

Joonsoo Kim (1):
      mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)

Joseph Qi (1):
      ocfs2/dlm: fix deadlock when dispatch assert master

Julia Lawall (1):
      xhci-mem: Use setup_timer

Kapileshwar Singh (1):
      tools lib traceevent: Fix string handling in heterogeneous arch environments

Konstantin Khlebnikov (1):
      ovs: do not allocate memory from offline numa node

Kyle Evans (1):
      hp-wmi: limit hotkey enable

Linus Torvalds (1):
      Initialize msg/shm IPC objects before doing ipc_addid()

Liu.Zhao (1):
      USB: option: add ZTE PIDs

Luis Henriques (2):
      zram: fix possible use after free in zcomp_create()
      Revert "ARM: orion5x: fix legacy orion5x IRQ numbers"

Manfred Spraul (1):
      ipc/sem.c: fully initialize sem_array before making it visible

Marc Zyngier (2):
      arm64: KVM: Disable virtual timer even if the guest is not using it
      arm: KVM: Disable virtual timer even if the guest is not using it

Mathias Krause (1):
      hp-wmi: Add missing __init annotations to initialization code

Mathias Nyman (4):
      usb: Use the USB_SS_MULT() macro to get the burst multiplier.
      xhci: give command abortion one more chance before killing xhci
      xhci: change xhci 1.0 only restrictions to support xhci 1.1
      xhci: init command timeout timer earlier to avoid deleting it uninitialized

Matt Fleming (1):
      x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down

Max Filippov (1):
      spi: xtensa-xtfpga: fix register endianness

Mel Gorman (1):
      mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault

Michel Dänzer (1):
      drm/radeon: Restore LCD backlight level on resume (>= R5xx)

Michel Stam (1):
      asix: Don't reset PHY on if_up for ASIX 88772

Nikhil Badola (2):
      drivers: usb :fsl: Implement Workaround for USB Erratum A007792
      drivers: usb: fsl: Workaround for USB erratum-A005275

Pablo Neira Ayuso (1):
      netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC

Paolo Bonzini (1):
      KVM: x86: trap AMD MSRs for the TSeg base and mask

Paul Burton (3):
      MIPS: CPS: Stop dangling delay slot from has_mt.
      MIPS: CPS: Don't include MT code in non-MT kernels.
      MIPS: CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT

Peter Chen (1):
      usb: chipidea: udc: using the correct stall implementation

Peter Seiderer (1):
      cifs: use server timestamp for ntlmv2 authentication

Prarit Bhargava (1):
      intel_pstate: Fix overflow in busy_scaled due to long delay

Pravin B Shelar (2):
      skbuff: Fix skb checksum flag on skb pull
      skbuff: Fix skb checksum partial check.

Richard Weinberger (1):
      UBI: Validate data_size

Robert Jarzmik (2):
      ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
      ASoC: fix broken pxa SoC support

Roger Quadros (2):
      usb: xhci: Clear XHCI_STATE_DYING on start
      usb: xhci: Allow usb_add/remove_hcd() to be called repeatedly

Roland Dreier (1):
      fib_rules: Fix dump_rules() not to exit early

Russell King (1):
      ARM: fix Thumb2 signal handling when ARMv6 is enabled

Sabrina Dubroca (1):
      net: add length argument to skb_copy_and_csum_datagram_iovec

Shaohua Li (1):
      x86/apic: Serialize LVTT and TSC_DEADLINE writes

Shawn Lin (1):
      staging: ion: fix corruption of ion_import_dma_buf

Simon Guinot (1):
      net: mvneta: fix DMA buffer unmapping in mvneta_rx()

Stephen Smalley (1):
      x86/mm: Set NX on gap between __ex_table and rodata

Steve French (1):
      disabling oplocks/leases via module parm enable_oplocks broken for SMB3

Stratos Karafotis (1):
      cpufreq: intel_pstate: Remove unnecessary type casting in div_s64() call

Tan, Jui Nee (1):
      spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled

Thomas Hellstrom (2):
      drm/vmwgfx: Fix up user_dmabuf refcounting
      drm/vmwgfx: Fix kernel NULL pointer dereference on older hardware

Will Deacon (3):
      arm64: head.S: initialise mdcr_el2 in el2_setup
      arm64: compat: fix vfp save/restore across signal handlers in big-endian
      arm64: errata: add module build workaround for erratum #843419

lucien (1):
      sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state

shengyong (1):
      UBI: return ENOSPC if no enough space available
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1256069 — [PATCH 3.16.y-ckt 005/104] arm64: head.S: initialise mdcr_el2 in el2_setup

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 005/104] arm64: head.S: initialise mdcr_el2 in el2_setup
Message-ID	<qnQWD-Ui-51@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit d10bcd473301888f957ec4b6b12aa3621be78d59 upstream.

When entering the kernel at EL2, we fail to initialise the MDCR_EL2
register which controls debug access and PMU capabilities at EL1.

This patch ensures that the register is initialised so that all traps
are disabled and all the PMU counters are available to the host. When a
guest is scheduled, KVM takes care to configure trapping appropriately.

Acked-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/arm64/kernel/head.S | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 1cd11e73058f..a089ce8d52b3 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -315,6 +315,11 @@ CPU_LE(	movk	x0, #0x30d0, lsl #16	)	// Clear EE and E0E on LE systems
 	msr	hstr_el2, xzr			// Disable CP15 traps to EL2
 #endif
 
+	/* EL2 debug */
+	mrs	x0, pmcr_el0			// Disable debug access traps
+	ubfx	x0, x0, #11, #5			// to EL2 and allow access to
+	msr	mdcr_el2, x0			// all PMU counters from EL1
+
 	/* Stage-2 translation */
 	msr	vttbr_el2, xzr
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256070 — [PATCH 3.16.y-ckt 038/104] usb: xhci: Clear XHCI_STATE_DYING on start

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 038/104] usb: xhci: Clear XHCI_STATE_DYING on start
Message-ID	<qnQWD-Ui-53@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Roger Quadros <rogerq@ti.com>

commit e5bfeab0ad515b4f6df39fe716603e9dc6d3dfd0 upstream.

For whatever reason if XHCI died in the previous instant
then it will never recover on the next xhci_start unless we
clear the DYING flag.

Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/host/xhci.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 7ce24229e863..4170d913ee6e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -147,7 +147,8 @@ static int xhci_start(struct xhci_hcd *xhci)
 				"waited %u microseconds.\n",
 				XHCI_MAX_HALT_USEC);
 	if (!ret)
-		xhci->xhc_state &= ~XHCI_STATE_HALTED;
+		xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
+
 	return ret;
 }
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256071 — [PATCH 3.16.y-ckt 006/104] kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 006/104] kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
Message-ID	<qnQWD-Ui-55@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason Wang <jasowang@redhat.com>

commit 8453fecbecae26edb3f278627376caab05d9a88d upstream.

We only want zero length mmio eventfd to be registered on
KVM_FAST_MMIO_BUS. So check this explicitly when arg->len is zero to
make sure this.

Cc: Gleb Natapov <gleb@kernel.org>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 virt/kvm/eventfd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
index 20c3af7692c5..47e48e2c7d1a 100644
--- a/virt/kvm/eventfd.c
+++ b/virt/kvm/eventfd.c
@@ -778,7 +778,7 @@ kvm_assign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 	/* When length is ignored, MMIO is also put on a separate bus, for
 	 * faster lookups.
 	 */
-	if (!args->len && !(args->flags & KVM_IOEVENTFD_FLAG_PIO)) {
+	if (!args->len && bus_idx == KVM_MMIO_BUS) {
 		ret = kvm_io_bus_register_dev(kvm, KVM_FAST_MMIO_BUS,
 					      p->addr, 0, &p->dev);
 		if (ret < 0)
@@ -833,7 +833,7 @@ kvm_deassign_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args)
 			continue;
 
 		kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev);
-		if (!p->length) {
+		if (!p->length && p->bus_idx == KVM_MMIO_BUS) {
 			kvm_io_bus_unregister_dev(kvm, KVM_FAST_MMIO_BUS,
 						  &p->dev);
 		}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256072 — [PATCH 3.16.y-ckt 027/104] drm/vmwgfx: Fix up user_dmabuf refcounting

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 027/104] drm/vmwgfx: Fix up user_dmabuf refcounting
Message-ID	<qnQWE-Ui-57@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Hellstrom <thellstrom@vmware.com>

commit 54c12bc374408faddbff75dbf1a6167c19af39c4 upstream.

If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.

Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_drv.h      |  6 ++++--
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c  |  6 ++++--
 drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c  |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c | 29 +++++++++++++++++++++--------
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c   |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c  | 11 ++++++++---
 6 files changed, 39 insertions(+), 17 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 6b252a887ae2..a2cd01e0bbf7 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -610,7 +610,8 @@ extern int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
 				 uint32_t size,
 				 bool shareable,
 				 uint32_t *handle,
-				 struct vmw_dma_buffer **p_dma_buf);
+				 struct vmw_dma_buffer **p_dma_buf,
+				 struct ttm_base_object **p_base);
 extern int vmw_user_dmabuf_reference(struct ttm_object_file *tfile,
 				     struct vmw_dma_buffer *dma_buf,
 				     uint32_t *handle);
@@ -624,7 +625,8 @@ extern uint32_t vmw_dmabuf_validate_node(struct ttm_buffer_object *bo,
 					 uint32_t cur_validate_node);
 extern void vmw_dmabuf_validate_clear(struct ttm_buffer_object *bo);
 extern int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
-				  uint32_t id, struct vmw_dma_buffer **out);
+				  uint32_t id, struct vmw_dma_buffer **out,
+				  struct ttm_base_object **base);
 extern int vmw_stream_claim_ioctl(struct drm_device *dev, void *data,
 				  struct drm_file *file_priv);
 extern int vmw_stream_unref_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 3a21633eba2f..118e2206b792 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -873,7 +873,8 @@ static int vmw_translate_mob_ptr(struct vmw_private *dev_priv,
 	struct vmw_relocation *reloc;
 	int ret;
 
-	ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+	ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+				     NULL);
 	if (unlikely(ret != 0)) {
 		DRM_ERROR("Could not find or use MOB buffer.\n");
 		return -EINVAL;
@@ -934,7 +935,8 @@ static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
 	struct vmw_relocation *reloc;
 	int ret;
 
-	ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo);
+	ret = vmw_user_dmabuf_lookup(sw_context->fp->tfile, handle, &vmw_bo,
+				     NULL);
 	if (unlikely(ret != 0)) {
 		DRM_ERROR("Could not find or use GMR region.\n");
 		return -EINVAL;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
index 87e39f68e9d0..e1898982b44a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c
@@ -484,7 +484,7 @@ int vmw_overlay_ioctl(struct drm_device *dev, void *data,
 		goto out_unlock;
 	}
 
-	ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf);
+	ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf, NULL);
 	if (ret)
 		goto out_unlock;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 01d68f0a69dc..78196a95b0ad 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -355,7 +355,7 @@ int vmw_user_lookup_handle(struct vmw_private *dev_priv,
 	}
 
 	*out_surf = NULL;
-	ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf);
+	ret = vmw_user_dmabuf_lookup(tfile, handle, out_buf, NULL);
 	return ret;
 }
 
@@ -482,7 +482,8 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
 			  uint32_t size,
 			  bool shareable,
 			  uint32_t *handle,
-			  struct vmw_dma_buffer **p_dma_buf)
+			  struct vmw_dma_buffer **p_dma_buf,
+			  struct ttm_base_object **p_base)
 {
 	struct vmw_user_dma_buffer *user_bo;
 	struct ttm_buffer_object *tmp;
@@ -516,6 +517,10 @@ int vmw_user_dmabuf_alloc(struct vmw_private *dev_priv,
 	}
 
 	*p_dma_buf = &user_bo->dma;
+	if (p_base) {
+		*p_base = &user_bo->prime.base;
+		kref_get(&(*p_base)->refcount);
+	}
 	*handle = user_bo->prime.base.hash.key;
 
 out_no_base_object:
@@ -627,6 +632,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
 	struct vmw_dma_buffer *dma_buf;
 	struct vmw_user_dma_buffer *user_bo;
 	struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile;
+	struct ttm_base_object *buffer_base;
 	int ret;
 
 	if ((arg->flags & (drm_vmw_synccpu_read | drm_vmw_synccpu_write)) == 0
@@ -639,7 +645,8 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
 
 	switch (arg->op) {
 	case drm_vmw_synccpu_grab:
-		ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf);
+		ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &dma_buf,
+					     &buffer_base);
 		if (unlikely(ret != 0))
 			return ret;
 
@@ -647,6 +654,7 @@ int vmw_user_dmabuf_synccpu_ioctl(struct drm_device *dev, void *data,
 				       dma);
 		ret = vmw_user_dmabuf_synccpu_grab(user_bo, tfile, arg->flags);
 		vmw_dmabuf_unreference(&dma_buf);
+		ttm_base_object_unref(&buffer_base);
 		if (unlikely(ret != 0 && ret != -ERESTARTSYS &&
 			     ret != -EBUSY)) {
 			DRM_ERROR("Failed synccpu grab on handle 0x%08x.\n",
@@ -688,7 +696,8 @@ int vmw_dmabuf_alloc_ioctl(struct drm_device *dev, void *data,
 		return ret;
 
 	ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
-				    req->size, false, &handle, &dma_buf);
+				    req->size, false, &handle, &dma_buf,
+				    NULL);
 	if (unlikely(ret != 0))
 		goto out_no_dmabuf;
 
@@ -717,7 +726,8 @@ int vmw_dmabuf_unref_ioctl(struct drm_device *dev, void *data,
 }
 
 int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
-			   uint32_t handle, struct vmw_dma_buffer **out)
+			   uint32_t handle, struct vmw_dma_buffer **out,
+			   struct ttm_base_object **p_base)
 {
 	struct vmw_user_dma_buffer *vmw_user_bo;
 	struct ttm_base_object *base;
@@ -739,7 +749,10 @@ int vmw_user_dmabuf_lookup(struct ttm_object_file *tfile,
 	vmw_user_bo = container_of(base, struct vmw_user_dma_buffer,
 				   prime.base);
 	(void)ttm_bo_reference(&vmw_user_bo->dma.base);
-	ttm_base_object_unref(&base);
+	if (p_base)
+		*p_base = base;
+	else
+		ttm_base_object_unref(&base);
 	*out = &vmw_user_bo->dma;
 
 	return 0;
@@ -1000,7 +1013,7 @@ int vmw_dumb_create(struct drm_file *file_priv,
 
 	ret = vmw_user_dmabuf_alloc(dev_priv, vmw_fpriv(file_priv)->tfile,
 				    args->size, false, &args->handle,
-				    &dma_buf);
+				    &dma_buf, NULL);
 	if (unlikely(ret != 0))
 		goto out_no_dmabuf;
 
@@ -1028,7 +1041,7 @@ int vmw_dumb_map_offset(struct drm_file *file_priv,
 	struct vmw_dma_buffer *out_buf;
 	int ret;
 
-	ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf);
+	ret = vmw_user_dmabuf_lookup(tfile, handle, &out_buf, NULL);
 	if (ret != 0)
 		return -EINVAL;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
index c1559eeaffe9..4d7dedddbd97 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_shader.c
@@ -455,7 +455,7 @@ int vmw_shader_define_ioctl(struct drm_device *dev, void *data,
 
 	if (arg->buffer_handle != SVGA3D_INVALID_ID) {
 		ret = vmw_user_dmabuf_lookup(tfile, arg->buffer_handle,
-					     &buffer);
+					     &buffer, NULL);
 		if (unlikely(ret != 0)) {
 			DRM_ERROR("Could not find buffer for shader "
 				  "creation.\n");
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 4ecdbf3e59da..9e190db6cc37 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -43,6 +43,7 @@ struct vmw_user_surface {
 	struct vmw_surface srf;
 	uint32_t size;
 	struct drm_master *master;
+	struct ttm_base_object *backup_base;
 };
 
 /**
@@ -652,6 +653,7 @@ static void vmw_user_surface_base_release(struct ttm_base_object **p_base)
 	struct vmw_resource *res = &user_srf->srf.res;
 
 	*p_base = NULL;
+	ttm_base_object_unref(&user_srf->backup_base);
 	vmw_resource_unreference(&res);
 }
 
@@ -846,7 +848,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 					    res->backup_size,
 					    true,
 					    &backup_handle,
-					    &res->backup);
+					    &res->backup,
+					    &user_srf->backup_base);
 		if (unlikely(ret != 0)) {
 			vmw_resource_unreference(&res);
 			goto out_unlock;
@@ -1309,7 +1312,8 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 
 	if (req->buffer_handle != SVGA3D_INVALID_ID) {
 		ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle,
-					     &res->backup);
+					     &res->backup,
+					     &user_srf->backup_base);
 	} else if (req->drm_surface_flags &
 		   drm_vmw_surface_flag_create_buffer)
 		ret = vmw_user_dmabuf_alloc(dev_priv, tfile,
@@ -1317,7 +1321,8 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data,
 					    req->drm_surface_flags &
 					    drm_vmw_surface_flag_shareable,
 					    &backup_handle,
-					    &res->backup);
+					    &res->backup,
+					    &user_srf->backup_base);
 
 	if (unlikely(ret != 0)) {
 		vmw_resource_unreference(&res);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256073 — [PATCH 3.16.y-ckt 001/104] ARM: 8429/1: disable GCC SRA optimization

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 001/104] ARM: 8429/1: disable GCC SRA optimization
Message-ID	<qnQWE-Ui-59@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

commit a077224fd35b2f7fbc93f14cf67074fc792fbac2 upstream.

While working on the 32-bit ARM port of UEFI, I noticed a strange
corruption in the kernel log. The following snprintf() statement
(in drivers/firmware/efi/efi.c:efi_md_typeattr_format())

	snprintf(pos, size, "|%3s|%2s|%2s|%2s|%3s|%2s|%2s|%2s|%2s]",

was producing the following output in the log:

	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |WB|WT|WC|UC]*
	|    |   |   |   |    |WB|WT|WC|UC]
	|RUN|   |   |   |    |   |   |   |UC]
	|RUN|   |   |   |    |   |   |   |UC]

As it turns out, this is caused by incorrect code being emitted for
the string() function in lib/vsprintf.c. The following code

	if (!(spec.flags & LEFT)) {
		while (len < spec.field_width--) {
			if (buf < end)
				*buf = ' ';
			++buf;
		}
	}
	for (i = 0; i < len; ++i) {
		if (buf < end)
			*buf = *s;
		++buf; ++s;
	}
	while (len < spec.field_width--) {
		if (buf < end)
			*buf = ' ';
		++buf;
	}

when called with len == 0, triggers an issue in the GCC SRA optimization
pass (Scalar Replacement of Aggregates), which handles promotion of signed
struct members incorrectly. This is a known but as yet unresolved issue.
(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932). In this particular
case, it is causing the second while loop to be executed erroneously a
single time, causing the additional space characters to be printed.

So disable the optimization by passing -fno-ipa-sra.

Acked-by: Nicolas Pitre <nico@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/arm/Makefile | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index 6721fab13734..2c359d52f4b4 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -52,6 +52,14 @@ endif
 
 comma = ,
 
+#
+# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
+# later may result in code being generated that handles signed short and signed
+# char struct members incorrectly. So disable it.
+# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
+#
+KBUILD_CFLAGS	+= $(call cc-option,-fno-ipa-sra)
+
 # This selects which instruction set is used.
 # Note that GCC does not numerically define an architecture version
 # macro, but instead defines a whole series of macros which makes
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256074 — [PATCH 3.16.y-ckt 015/104] arm64: errata: add module build workaround for erratum #843419

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 015/104] arm64: errata: add module build workaround for erratum #843419
Message-ID	<qnQWE-Ui-61@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Will Deacon <will.deacon@arm.com>

commit df057cc7b4fa59e9b55f07ffdb6c62bf02e99a00 upstream.

Cortex-A53 processors <= r0p4 are affected by erratum #843419 which can
lead to a memory access using an incorrect address in certain sequences
headed by an ADRP instruction.

There is a linker fix to generate veneers for ADRP instructions, but
this doesn't work for kernel modules which are built as unlinked ELF
objects.

This patch adds a new config option for the erratum which, when enabled,
builds kernel modules with the mcmodel=large flag. This uses absolute
addressing for all kernel symbols, thereby removing the use of ADRP as
a PC-relative form of addressing. The ADRP relocs are removed from the
module loader so that we fail to load any potentially affected modules.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/arm64/Kconfig         | 16 ++++++++++++++++
 arch/arm64/Makefile        |  4 ++++
 arch/arm64/kernel/module.c |  2 ++
 3 files changed, 22 insertions(+)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 316ed8cf5bc0..2e882e5174ab 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -155,6 +155,22 @@ menu "Bus support"
 config ARM_AMBA
 	bool
 
+config ARM64_ERRATUM_843419
+	bool "Cortex-A53: 843419: A load or store might access an incorrect address"
+	depends on MODULES
+	default y
+	help
+	  This option builds kernel modules using the large memory model in
+	  order to avoid the use of the ADRP instruction, which can cause
+	  a subsequent memory access to use an incorrect address on Cortex-A53
+	  parts up to r0p4.
+
+	  Note that the kernel itself must be linked with a version of ld
+	  which fixes potentially affected ADRP instructions through the
+	  use of veneers.
+
+	  If unsure, say Y.
+
 endmenu
 
 menu "Kernel Features"
diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile
index 8185a913c5ed..be8b36304ac1 100644
--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
@@ -34,6 +34,10 @@ comma = ,
 
 CHECKFLAGS	+= -D__aarch64__
 
+ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
+CFLAGS_MODULE	+= -mcmodel=large
+endif
+
 # Default value
 head-y		:= arch/arm64/kernel/head.o
 
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index 1eb1cc955139..e366329d96d8 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -330,12 +330,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 			ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21,
 					     AARCH64_INSN_IMM_ADR);
 			break;
+#ifndef CONFIG_ARM64_ERRATUM_843419
 		case R_AARCH64_ADR_PREL_PG_HI21_NC:
 			overflow_check = false;
 		case R_AARCH64_ADR_PREL_PG_HI21:
 			ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21,
 					     AARCH64_INSN_IMM_ADR);
 			break;
+#endif
 		case R_AARCH64_ADD_ABS_LO12_NC:
 		case R_AARCH64_LDST8_ABS_LO12_NC:
 			overflow_check = false;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256075 — [PATCH 3.16.y-ckt 029/104] Btrfs: fix read corruption of compressed and shared extents

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 15:30 +0100
Subject	[PATCH 3.16.y-ckt 029/104] Btrfs: fix read corruption of compressed and shared extents
Message-ID	<qnQWE-Ui-63@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit 005efedf2c7d0a270ffbe28d8997b03844f3e3e7 upstream.

If a file has a range pointing to a compressed extent, followed by
another range that points to the same compressed extent and a read
operation attempts to read both ranges (either completely or part of
them), the pages that correspond to the second range are incorrectly
filled with zeroes.

Consider the following example:

  File layout
  [0 - 8K]                      [8K - 24K]
      |                             |
      |                             |
   points to extent X,         points to extent X,
   offset 4K, length of 8K     offset 0, length 16K

  [extent X, compressed length = 4K uncompressed length = 16K]

If a readpages() call spans the 2 ranges, a single bio to read the extent
is submitted - extent_io.c:submit_extent_page() would only create a new
bio to cover the second range pointing to the extent if the extent it
points to had a different logical address than the extent associated with
the first range. This has a consequence of the compressed read end io
handler (compression.c:end_compressed_bio_read()) finish once the extent
is decompressed into the pages covering the first range, leaving the
remaining pages (belonging to the second range) filled with zeroes (done
by compression.c:btrfs_clear_biovec_end()).

So fix this by submitting the current bio whenever we find a range
pointing to a compressed extent that was preceded by a range with a
different extent map. This is the simplest solution for this corner
case. Making the end io callback populate both ranges (or more, if we
have multiple pointing to the same extent) is a much more complex
solution since each bio is tightly coupled with a single extent map and
the extent maps associated to the ranges pointing to the shared extent
can have different offsets and lengths.

The following test case for fstests triggers the issue:

  seq=`basename $0`
  seqres=$RESULT_DIR/$seq
  echo "QA output created by $seq"
  tmp=/tmp/$$
  status=1	# failure is the default!
  trap "_cleanup; exit \$status" 0 1 2 3 15

  _cleanup()
  {
      rm -f $tmp.*
  }

  # get standard environment, filters and checks
  . ./common/rc
  . ./common/filter

  # real QA test starts here
  _need_to_be_root
  _supported_fs btrfs
  _supported_os Linux
  _require_scratch
  _require_cloner

  rm -f $seqres.full

  test_clone_and_read_compressed_extent()
  {
      local mount_opts=$1

      _scratch_mkfs >>$seqres.full 2>&1
      _scratch_mount $mount_opts

      # Create a test file with a single extent that is compressed (the
      # data we write into it is highly compressible no matter which
      # compression algorithm is used, zlib or lzo).
      $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 4K"        \
                      -c "pwrite -S 0xbb 4K 8K"        \
                      -c "pwrite -S 0xcc 12K 4K"       \
                      $SCRATCH_MNT/foo | _filter_xfs_io

      # Now clone our extent into an adjacent offset.
      $CLONER_PROG -s $((4 * 1024)) -d $((16 * 1024)) -l $((8 * 1024)) \
          $SCRATCH_MNT/foo $SCRATCH_MNT/foo

      # Same as before but for this file we clone the extent into a lower
      # file offset.
      $XFS_IO_PROG -f -c "pwrite -S 0xaa 8K 4K"         \
                      -c "pwrite -S 0xbb 12K 8K"        \
                      -c "pwrite -S 0xcc 20K 4K"        \
                      $SCRATCH_MNT/bar | _filter_xfs_io

      $CLONER_PROG -s $((12 * 1024)) -d 0 -l $((8 * 1024)) \
          $SCRATCH_MNT/bar $SCRATCH_MNT/bar

      echo "File digests before unmounting filesystem:"
      md5sum $SCRATCH_MNT/foo | _filter_scratch
      md5sum $SCRATCH_MNT/bar | _filter_scratch

      # Evicting the inode or clearing the page cache before reading
      # again the file would also trigger the bug - reads were returning
      # all bytes in the range corresponding to the second reference to
      # the extent with a value of 0, but the correct data was persisted
      # (it was a bug exclusively in the read path). The issue happened
      # only if the same readpages() call targeted pages belonging to the
      # first and second ranges that point to the same compressed extent.
      _scratch_remount

      echo "File digests after mounting filesystem again:"
      # Must match the same digests we got before.
      md5sum $SCRATCH_MNT/foo | _filter_scratch
      md5sum $SCRATCH_MNT/bar | _filter_scratch
  }

  echo -e "\nTesting with zlib compression..."
  test_clone_and_read_compressed_extent "-o compress=zlib"

  _scratch_unmount

  echo -e "\nTesting with lzo compression..."
  test_clone_and_read_compressed_extent "-o compress=lzo"

  status=0
  exit

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo<quwenruo@cn.fujitsu.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/btrfs/extent_io.c | 65 +++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 57 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index a7db105139d2..0c5955b6275d 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -2688,7 +2688,8 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
 			      bio_end_io_t end_io_func,
 			      int mirror_num,
 			      unsigned long prev_bio_flags,
-			      unsigned long bio_flags)
+			      unsigned long bio_flags,
+			      bool force_bio_submit)
 {
 	int ret = 0;
 	struct bio *bio;
@@ -2706,6 +2707,7 @@ static int submit_extent_page(int rw, struct extent_io_tree *tree,
 			contig = bio_end_sector(bio) == sector;
 
 		if (prev_bio_flags != bio_flags || !contig ||
+		    force_bio_submit ||
 		    merge_bio(rw, tree, page, offset, page_size, bio, bio_flags) ||
 		    bio_add_page(bio, page, page_size, offset) < page_size) {
 			ret = submit_one_bio(rw, bio, mirror_num,
@@ -2797,7 +2799,8 @@ static int __do_readpage(struct extent_io_tree *tree,
 			 get_extent_t *get_extent,
 			 struct extent_map **em_cached,
 			 struct bio **bio, int mirror_num,
-			 unsigned long *bio_flags, int rw)
+			 unsigned long *bio_flags, int rw,
+			 u64 *prev_em_start)
 {
 	struct inode *inode = page->mapping->host;
 	u64 start = page_offset(page);
@@ -2845,6 +2848,7 @@ static int __do_readpage(struct extent_io_tree *tree,
 	}
 	while (cur <= end) {
 		unsigned long pnr = (last_byte >> PAGE_CACHE_SHIFT) + 1;
+		bool force_bio_submit = false;
 
 		if (cur >= last_byte) {
 			char *userpage;
@@ -2895,6 +2899,49 @@ static int __do_readpage(struct extent_io_tree *tree,
 		block_start = em->block_start;
 		if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags))
 			block_start = EXTENT_MAP_HOLE;
+
+		/*
+		 * If we have a file range that points to a compressed extent
+		 * and it's followed by a consecutive file range that points to
+		 * to the same compressed extent (possibly with a different
+		 * offset and/or length, so it either points to the whole extent
+		 * or only part of it), we must make sure we do not submit a
+		 * single bio to populate the pages for the 2 ranges because
+		 * this makes the compressed extent read zero out the pages
+		 * belonging to the 2nd range. Imagine the following scenario:
+		 *
+		 *  File layout
+		 *  [0 - 8K]                     [8K - 24K]
+		 *    |                               |
+		 *    |                               |
+		 * points to extent X,         points to extent X,
+		 * offset 4K, length of 8K     offset 0, length 16K
+		 *
+		 * [extent X, compressed length = 4K uncompressed length = 16K]
+		 *
+		 * If the bio to read the compressed extent covers both ranges,
+		 * it will decompress extent X into the pages belonging to the
+		 * first range and then it will stop, zeroing out the remaining
+		 * pages that belong to the other range that points to extent X.
+		 * So here we make sure we submit 2 bios, one for the first
+		 * range and another one for the third range. Both will target
+		 * the same physical extent from disk, but we can't currently
+		 * make the compressed bio endio callback populate the pages
+		 * for both ranges because each compressed bio is tightly
+		 * coupled with a single extent map, and each range can have
+		 * an extent map with a different offset value relative to the
+		 * uncompressed data of our extent and different lengths. This
+		 * is a corner case so we prioritize correctness over
+		 * non-optimal behavior (submitting 2 bios for the same extent).
+		 */
+		if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags) &&
+		    prev_em_start && *prev_em_start != (u64)-1 &&
+		    *prev_em_start != em->orig_start)
+			force_bio_submit = true;
+
+		if (prev_em_start)
+			*prev_em_start = em->orig_start;
+
 		free_extent_map(em);
 		em = NULL;
 
@@ -2944,7 +2991,8 @@ static int __do_readpage(struct extent_io_tree *tree,
 					 bdev, bio, pnr,
 					 end_bio_extent_readpage, mirror_num,
 					 *bio_flags,
-					 this_bio_flag);
+					 this_bio_flag,
+					 force_bio_submit);
 		if (!ret) {
 			nr++;
 			*bio_flags = this_bio_flag;
@@ -2976,6 +3024,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 	struct inode *inode;
 	struct btrfs_ordered_extent *ordered;
 	int index;
+	u64 prev_em_start = (u64)-1;
 
 	inode = pages[0]->mapping->host;
 	while (1) {
@@ -2991,7 +3040,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 
 	for (index = 0; index < nr_pages; index++) {
 		__do_readpage(tree, pages[index], get_extent, em_cached, bio,
-			      mirror_num, bio_flags, rw);
+			      mirror_num, bio_flags, rw, &prev_em_start);
 		page_cache_release(pages[index]);
 	}
 }
@@ -3059,7 +3108,7 @@ static int __extent_read_full_page(struct extent_io_tree *tree,
 	}
 
 	ret = __do_readpage(tree, page, get_extent, NULL, bio, mirror_num,
-			    bio_flags, rw);
+			    bio_flags, rw, NULL);
 	return ret;
 }
 
@@ -3085,7 +3134,7 @@ int extent_read_full_page_nolock(struct extent_io_tree *tree, struct page *page,
 	int ret;
 
 	ret = __do_readpage(tree, page, get_extent, NULL, &bio, mirror_num,
-				      &bio_flags, READ);
+			    &bio_flags, READ, NULL);
 	if (bio)
 		ret = submit_one_bio(READ, bio, mirror_num, bio_flags);
 	return ret;
@@ -3338,7 +3387,7 @@ static noinline_for_stack int __extent_writepage_io(struct inode *inode,
 						 sector, iosize, pg_offset,
 						 bdev, &epd->bio, max_nr,
 						 end_bio_extent_writepage,
-						 0, 0, 0);
+						 0, 0, 0, false);
 			if (ret)
 				SetPageError(page);
 		}
@@ -3585,7 +3634,7 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
 		ret = submit_extent_page(rw, tree, p, offset >> 9,
 					 PAGE_CACHE_SIZE, 0, bdev, &epd->bio,
 					 -1, end_bio_extent_buffer_writepage,
-					 0, epd->bio_flags, bio_flags);
+					 0, epd->bio_flags, bio_flags, false);
 		epd->bio_flags = bio_flags;
 		if (ret) {
 			set_bit(EXTENT_BUFFER_IOERR, &eb->bflags);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256218 — [PATCH 3.16.y-ckt 105/107] KEYS: Fix race between key destruction and finding a keyring by name

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 20:10 +0100
Subject	[PATCH 3.16.y-ckt 105/107] KEYS: Fix race between key destruction and finding a keyring by name
Message-ID	<qnVjA-3Er-1@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit 94c4554ba07adbdde396748ee7ae01e86cf2d8d7 upstream.

There appears to be a race between:

 (1) key_gc_unused_keys() which frees key->security and then calls
     keyring_destroy() to unlink the name from the name list

 (2) find_keyring_by_name() which calls key_permission(), thus accessing
     key->security, on a key before checking to see whether the key usage is 0
     (ie. the key is dead and might be cleaned up).

Fix this by calling ->destroy() before cleaning up the core key data -
including key->security.

Reported-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 security/keys/gc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 009d9370c8fd..38676fac7943 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -143,6 +143,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
+		/* Throw away the key data */
+		if (key->type->destroy)
+			key->type->destroy(key);
+
 		security_key_free(key);
 
 		/* deal with the user's key tracking and quota */
@@ -157,10 +161,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		/* now throw away the key memory */
-		if (key->type->destroy)
-			key->type->destroy(key);
-
 		key_user_put(key->user);
 
 		kfree(key->description);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256219 — [PATCH 3.16.y-ckt 107/107] KEYS: Don't permit request_key() to construct a new keyring

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 20:10 +0100
Subject	[PATCH 3.16.y-ckt 107/107] KEYS: Don't permit request_key() to construct a new keyring
Message-ID	<qnVjA-3Er-7@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit 911b79cde95c7da0ec02f48105358a36636b7a71 upstream.

If request_key() is used to find a keyring, only do the search part - don't
do the construction part if the keyring was not found by the search.  We
don't really want keyrings in the negative instantiated state since the
rejected/negative instantiation error value in the payload is unioned with
keyring metadata.

Now the kernel gives an error:

	request_key("keyring", "#selinux,bdekeyring", "keyring", KEY_SPEC_USER_SESSION_KEYRING) = -1 EPERM (Operation not permitted)

Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 security/keys/request_key.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 381411941cc1..9ea60a7bac78 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -457,6 +457,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx,
 
 	kenter("");
 
+	if (ctx->index_key.type == &key_type_keyring)
+		return ERR_PTR(-EPERM);
+	
 	user = key_user_lookup(current_fsuid());
 	if (!user)
 		return ERR_PTR(-ENOMEM);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256220

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 20:10 +0100
Message-ID	<qnVjA-3Er-21@gated-at.bofh.it>
In reply to	#1256068

On Mon, Oct 26, 2015 at 01:41:42PM +0000, Luis Henriques wrote:
> This is the start of the review cycle for the Linux 3.16.7-ckt19 stable kernel.
> 
> This version contains 104 new patches, summarized below.  The new patches are
> posted as replies to this message and also available in this git branch:
>

I am adding 3 additional patches for this 3.16 stable kernel release,
that fix CVE-2015-7872:

911b79cde95c KEYS: Don't permit request_key() to construct a new keyring
f05819df10d7 KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
94c4554ba07a KEYS: Fix race between key destruction and finding a keyring by name

Cheers,
--
Luís


> http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review
> 
> git://kernel.ubuntu.com/ubuntu/linux.git  linux-3.16.y-review
> 
> The review period for version 3.16.7-ckt19 will be open for the next three days.
> To report a problem, please reply to the relevant follow-up patch message.
> 
> For more information about the Linux 3.16.y-ckt extended stable kernel version,
> see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
> 
>  -Luis
> 
> --
>  arch/arm/Kconfig                           |   1 -
>  arch/arm/Makefile                          |   8 ++
>  arch/arm/boot/dts/omap3-beagle.dts         |   2 +-
>  arch/arm/boot/dts/omap5-uevm.dts           |   4 +-
>  arch/arm/kernel/signal.c                   |  15 ++--
>  arch/arm/kvm/interrupts_head.S             |   6 +-
>  arch/arm/mach-orion5x/include/mach/irqs.h  |  64 +++++++--------
>  arch/arm/mach-orion5x/irq.c                |   4 +-
>  arch/arm64/Kconfig                         |  16 ++++
>  arch/arm64/Makefile                        |   4 +
>  arch/arm64/kernel/head.S                   |   5 ++
>  arch/arm64/kernel/module.c                 |   2 +
>  arch/arm64/kernel/signal32.c               |  47 ++++++++---
>  arch/arm64/kvm/hyp.S                       |   5 +-
>  arch/m68k/include/asm/linkage.h            |  30 +++++++
>  arch/mips/kernel/cps-vec.S                 |  12 +--
>  arch/mips/mm/dma-default.c                 |   2 +-
>  arch/powerpc/boot/Makefile                 |   3 +
>  arch/powerpc/mm/hugepage-hash64.c          |   3 +-
>  arch/x86/include/uapi/asm/msr-index.h      |   1 +
>  arch/x86/kernel/apic/apic.c                |   7 ++
>  arch/x86/kernel/entry_64.S                 |  16 +++-
>  arch/x86/kernel/paravirt.c                 |  16 +++-
>  arch/x86/kernel/tsc.c                      |  17 ++--
>  arch/x86/kvm/svm.c                         |   2 +-
>  arch/x86/kvm/x86.c                         |   2 +
>  arch/x86/mm/init_64.c                      |   2 +-
>  arch/x86/platform/efi/efi.c                |  67 +++++++++++++++-
>  drivers/block/zram/zcomp.c                 |  12 +--
>  drivers/cpufreq/intel_pstate.c             |  10 +--
>  drivers/dma/dw/core.c                      |   4 +-
>  drivers/gpu/drm/i915/intel_bios.c          |  12 ++-
>  drivers/gpu/drm/qxl/qxl_display.c          |  14 ++--
>  drivers/gpu/drm/radeon/atombios_encoders.c |   8 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_drv.h        |   6 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c    |   6 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c    |   2 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_resource.c   |  29 +++++--
>  drivers/gpu/drm/vmwgfx/vmwgfx_shader.c     |   2 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_surface.c    |  12 ++-
>  drivers/hwmon/nct6775.c                    |  16 ++--
>  drivers/infiniband/ulp/isert/ib_isert.c    |   9 ++-
>  drivers/mtd/ubi/io.c                       |   5 ++
>  drivers/mtd/ubi/vtbl.c                     |   1 +
>  drivers/mtd/ubi/wl.c                       |   1 +
>  drivers/net/ethernet/marvell/mvneta.c      |   4 +-
>  drivers/net/ppp/pppoe.c                    |   1 -
>  drivers/net/usb/asix_devices.c             |  16 +---
>  drivers/net/vxlan.c                        |  10 +--
>  drivers/net/xen-netfront.c                 |   3 +-
>  drivers/pci/access.c                       |  27 +------
>  drivers/pci/quirks.c                       |  20 ++++-
>  drivers/platform/x86/hp-wmi.c              |  35 +++++---
>  drivers/spi/spi-pxa2xx.c                   |   4 +
>  drivers/spi/spi-xtensa-xtfpga.c            |   4 +-
>  drivers/spi/spi.c                          |   3 +-
>  drivers/staging/android/ion/ion.c          |   6 +-
>  drivers/usb/chipidea/udc.c                 |  84 +++++++++----------
>  drivers/usb/core/config.c                  |   5 +-
>  drivers/usb/host/ehci-fsl.c                |  13 +++
>  drivers/usb/host/ehci-hub.c                |   7 ++
>  drivers/usb/host/ehci.h                    |  12 +++
>  drivers/usb/host/fsl-mph-dr-of.c           |  10 +++
>  drivers/usb/host/xhci-mem.c                |  23 +++---
>  drivers/usb/host/xhci-ring.c               |  13 ++-
>  drivers/usb/host/xhci.c                    |   9 +--
>  drivers/usb/serial/option.c                |  24 ++++++
>  drivers/usb/serial/whiteheat.c             |  31 ++++++++
>  fs/btrfs/extent_io.c                       |  65 +++++++++++++--
>  fs/btrfs/inode.c                           |   3 +-
>  fs/cifs/cifsencrypt.c                      |  53 +++++++++++-
>  fs/cifs/ioctl.c                            |   6 ++
>  fs/cifs/smb2ops.c                          |   8 +-
>  fs/coredump.c                              |  38 +++++++--
>  fs/dcache.c                                |   7 ++
>  fs/jbd2/checkpoint.c                       |  39 +++++++--
>  fs/jbd2/commit.c                           |   2 +-
>  fs/jbd2/journal.c                          |  11 ++-
>  fs/namei.c                                 |  31 +++++++-
>  fs/ocfs2/dlm/dlmmaster.c                   |   9 ++-
>  fs/ocfs2/dlm/dlmrecovery.c                 |   8 +-
>  include/linux/fsl_devices.h                |   2 +
>  include/linux/jbd2.h                       |   3 +-
>  include/linux/skbuff.h                     |   5 +-
>  include/net/af_unix.h                      |   6 +-
>  include/net/sock.h                         |   8 ++
>  ipc/msg.c                                  |  14 ++--
>  ipc/sem.c                                  |  15 ++--
>  ipc/shm.c                                  |  12 +--
>  ipc/util.c                                 |   8 +-
>  kernel/irq/proc.c                          |  19 ++++-
>  kernel/time/clocksource.c                  |   2 +-
>  mm/hugetlb.c                               |   8 ++
>  mm/slab.c                                  |  13 ++-
>  net/core/datagram.c                        |   6 +-
>  net/core/ethtool.c                         |   2 +-
>  net/core/fib_rules.c                       |   2 +-
>  net/core/skbuff.c                          |   9 ++-
>  net/ipv4/tcp_input.c                       |   2 +-
>  net/ipv4/udp.c                             |   2 +-
>  net/ipv6/raw.c                             |   2 +-
>  net/ipv6/udp.c                             |   3 +-
>  net/l2tp/l2tp_core.c                       |  11 ++-
>  net/netfilter/nft_compat.c                 |  24 ++++--
>  net/netlink/af_netlink.c                   |  34 +++++---
>  net/openvswitch/flow_table.c               |   3 +-
>  net/sctp/sm_sideeffect.c                   |   2 +-
>  net/unix/af_unix.c                         |  16 +++-
>  sound/arm/Kconfig                          |  15 ++--
>  sound/soc/pxa/Kconfig                      |   2 -
>  sound/soc/pxa/pxa2xx-ac97.c                |   4 +-
>  tools/lib/traceevent/event-parse.c         |  23 +++++-
>  tools/perf/util/header.c                   |   4 +-
>  tools/perf/util/symbol-elf.c               |  35 +++-----
>  virt/kvm/eventfd.c                         | 124 +++++++++++++++++------------
>  virt/kvm/kvm_main.c                        |  19 ++++-
>  116 files changed, 1164 insertions(+), 451 deletions(-)
> 
> Aaron Conole (2):
>       af_unix: Convert the unix_sk macro to an inline function for type safety
>       af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
> 
> Adrian Hunter (1):
>       perf tools: Fix copying of /proc/kcore
> 
> Alex Williamson (2):
>       PCI: Fix devfn for VPD access through function 0
>       PCI: Use function 0 VPD for identical functions, regular VPD for others
> 
> Alexander Couzens (1):
>       l2tp: protect tunnel->del_work by ref_count
> 
> Andreas Schwab (1):
>       m68k: Define asmlinkage_protect
> 
> Andrey Vagin (1):
>       net/unix: fix logic about sk_peek_offset
> 
> Andy Lutomirski (2):
>       x86/paravirt: Replace the paravirt nop with a bona fide empty function
>       x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code
> 
> Andy Shevchenko (1):
>       dmaengine: dw: properly read DWC_PARAMS register
> 
> Aneesh Kumar K.V (1):
>       powerpc/mm: Recompute hash value after a failed update
> 
> Arad, Ronen (1):
>       netlink: Trim skb to alloc size to avoid MSG_TRUNC
> 
> Ard Biesheuvel (1):
>       ARM: 8429/1: disable GCC SRA optimization
> 
> Arnaldo Carvalho de Melo (1):
>       perf header: Fixup reading of HEADER_NRCPUS feature
> 
> Ben Hutchings (1):
>       genirq: Fix race in register_irq_proc()
> 
> Benjamin Herrenschmidt (1):
>       powerpc/boot: Specify ABI v2 when building an LE boot wrapper
> 
> Carl Frederik Werner (1):
>       ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again
> 
> Charles Keepax (1):
>       asix: Do full reset during ax88772_bind
> 
> Chas Williams (1):
>       net/xen-netfront: only napi_synchronize() if running
> 
> Dave Airlie (1):
>       drm/qxl: only report first monitor as connected if we have no state
> 
> David Woodhouse (1):
>       x86/platform: Fix Geode LX timekeeping in the generic x86 build
> 
> Dirk Müller (1):
>       Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
> 
> Eric Dumazet (1):
>       net: add pfmemalloc check in sk_add_backlog()
> 
> Eric W. Biederman (2):
>       dcache: Handle escaped paths in prepend_path
>       vfs: Test for and handle paths that are unreachable from their mnt_root
> 
> Fabiano Fidêncio (1):
>       drm/qxl: recreate the primary surface when the bo is not primary
> 
> Filipe Manana (1):
>       Btrfs: fix read corruption of compressed and shared extents
> 
> Grazvydas Ignotas (1):
>       ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
> 
> Guenter Roeck (2):
>       hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
>       spi: Fix documentation of spi_alloc_master()
> 
> Guillaume Nault (1):
>       ppp: don't override sk->sk_state in pppoe_flush_dev()
> 
> James Hogan (1):
>       MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
> 
> Jan Kara (1):
>       jbd2: avoid infinite loop when destroying aborted journal
> 
> Jani Nikula (1):
>       drm/i915/bios: handle MIPI Sequence Block v3+ gracefully
> 
> Jann Horn (2):
>       CIFS: fix type confusion in copy offload ioctl
>       fs: if a coredump already exists, unlink and recreate with O_EXCL
> 
> Jason Wang (4):
>       kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
>       kvm: factor out core eventfd assign/deassign logic
>       kvm: fix double free for fast mmio eventfd
>       kvm: fix zero length mmio searching
> 
> Jeff Mahoney (1):
>       btrfs: skip waiting on ordered range for special files
> 
> Jenny Derzhavetz (1):
>       iser-target: remove command with state ISTATE_REMOVE
> 
> Jiri Benc (1):
>       vxlan: set needed headroom correctly
> 
> Joe Perches (1):
>       ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
> 
> Johan Hovold (1):
>       USB: whiteheat: fix potential null-deref at probe
> 
> John Stultz (1):
>       clocksource: Fix abs() usage w/ 64bit values
> 
> Joonsoo Kim (1):
>       mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
> 
> Joseph Qi (1):
>       ocfs2/dlm: fix deadlock when dispatch assert master
> 
> Julia Lawall (1):
>       xhci-mem: Use setup_timer
> 
> Kapileshwar Singh (1):
>       tools lib traceevent: Fix string handling in heterogeneous arch environments
> 
> Konstantin Khlebnikov (1):
>       ovs: do not allocate memory from offline numa node
> 
> Kyle Evans (1):
>       hp-wmi: limit hotkey enable
> 
> Linus Torvalds (1):
>       Initialize msg/shm IPC objects before doing ipc_addid()
> 
> Liu.Zhao (1):
>       USB: option: add ZTE PIDs
> 
> Luis Henriques (2):
>       zram: fix possible use after free in zcomp_create()
>       Revert "ARM: orion5x: fix legacy orion5x IRQ numbers"
> 
> Manfred Spraul (1):
>       ipc/sem.c: fully initialize sem_array before making it visible
> 
> Marc Zyngier (2):
>       arm64: KVM: Disable virtual timer even if the guest is not using it
>       arm: KVM: Disable virtual timer even if the guest is not using it
> 
> Mathias Krause (1):
>       hp-wmi: Add missing __init annotations to initialization code
> 
> Mathias Nyman (4):
>       usb: Use the USB_SS_MULT() macro to get the burst multiplier.
>       xhci: give command abortion one more chance before killing xhci
>       xhci: change xhci 1.0 only restrictions to support xhci 1.1
>       xhci: init command timeout timer earlier to avoid deleting it uninitialized
> 
> Matt Fleming (1):
>       x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
> 
> Max Filippov (1):
>       spi: xtensa-xtfpga: fix register endianness
> 
> Mel Gorman (1):
>       mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
> 
> Michel Dänzer (1):
>       drm/radeon: Restore LCD backlight level on resume (>= R5xx)
> 
> Michel Stam (1):
>       asix: Don't reset PHY on if_up for ASIX 88772
> 
> Nikhil Badola (2):
>       drivers: usb :fsl: Implement Workaround for USB Erratum A007792
>       drivers: usb: fsl: Workaround for USB erratum-A005275
> 
> Pablo Neira Ayuso (1):
>       netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
> 
> Paolo Bonzini (1):
>       KVM: x86: trap AMD MSRs for the TSeg base and mask
> 
> Paul Burton (3):
>       MIPS: CPS: Stop dangling delay slot from has_mt.
>       MIPS: CPS: Don't include MT code in non-MT kernels.
>       MIPS: CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT
> 
> Peter Chen (1):
>       usb: chipidea: udc: using the correct stall implementation
> 
> Peter Seiderer (1):
>       cifs: use server timestamp for ntlmv2 authentication
> 
> Prarit Bhargava (1):
>       intel_pstate: Fix overflow in busy_scaled due to long delay
> 
> Pravin B Shelar (2):
>       skbuff: Fix skb checksum flag on skb pull
>       skbuff: Fix skb checksum partial check.
> 
> Richard Weinberger (1):
>       UBI: Validate data_size
> 
> Robert Jarzmik (2):
>       ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
>       ASoC: fix broken pxa SoC support
> 
> Roger Quadros (2):
>       usb: xhci: Clear XHCI_STATE_DYING on start
>       usb: xhci: Allow usb_add/remove_hcd() to be called repeatedly
> 
> Roland Dreier (1):
>       fib_rules: Fix dump_rules() not to exit early
> 
> Russell King (1):
>       ARM: fix Thumb2 signal handling when ARMv6 is enabled
> 
> Sabrina Dubroca (1):
>       net: add length argument to skb_copy_and_csum_datagram_iovec
> 
> Shaohua Li (1):
>       x86/apic: Serialize LVTT and TSC_DEADLINE writes
> 
> Shawn Lin (1):
>       staging: ion: fix corruption of ion_import_dma_buf
> 
> Simon Guinot (1):
>       net: mvneta: fix DMA buffer unmapping in mvneta_rx()
> 
> Stephen Smalley (1):
>       x86/mm: Set NX on gap between __ex_table and rodata
> 
> Steve French (1):
>       disabling oplocks/leases via module parm enable_oplocks broken for SMB3
> 
> Stratos Karafotis (1):
>       cpufreq: intel_pstate: Remove unnecessary type casting in div_s64() call
> 
> Tan, Jui Nee (1):
>       spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled
> 
> Thomas Hellstrom (2):
>       drm/vmwgfx: Fix up user_dmabuf refcounting
>       drm/vmwgfx: Fix kernel NULL pointer dereference on older hardware
> 
> Will Deacon (3):
>       arm64: head.S: initialise mdcr_el2 in el2_setup
>       arm64: compat: fix vfp save/restore across signal handlers in big-endian
>       arm64: errata: add module build workaround for erratum #843419
> 
> lucien (1):
>       sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state
> 
> shengyong (1):
>       UBI: return ENOSPC if no enough space available
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1258313

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-28 18:00 +0100
Message-ID	<qoCeU-5cz-45@gated-at.bofh.it>
In reply to	#1256220

On Mon, Oct 26, 2015 at 07:02:01PM +0000, Luis Henriques wrote:
> On Mon, Oct 26, 2015 at 01:41:42PM +0000, Luis Henriques wrote:
> > This is the start of the review cycle for the Linux 3.16.7-ckt19 stable kernel.
> > 
> > This version contains 104 new patches, summarized below.  The new patches are
> > posted as replies to this message and also available in this git branch:
> >
> 
> I am adding 3 additional patches for this 3.16 stable kernel release,
> that fix CVE-2015-7872:
> 
> 911b79cde95c KEYS: Don't permit request_key() to construct a new keyring
> f05819df10d7 KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
> 94c4554ba07a KEYS: Fix race between key destruction and finding a keyring by name
>

Ok, I'm adding yet another patch for 3.16.7-ckt19:

808f80b46790 Btrfs: update fix for read corruption of compressed and shared extents

This fixes an issue that is introduced by 005efedf2c7d ("Btrfs: fix read
corruption of compressed and shared extents"), which is also queued for
this kernel release.

Cheers,
--
Luís

> 
> 
> > http://kernel.ubuntu.com/git/ubuntu/linux.git/log/?h=linux-3.16.y-review
> > 
> > git://kernel.ubuntu.com/ubuntu/linux.git  linux-3.16.y-review
> > 
> > The review period for version 3.16.7-ckt19 will be open for the next three days.
> > To report a problem, please reply to the relevant follow-up patch message.
> > 
> > For more information about the Linux 3.16.y-ckt extended stable kernel version,
> > see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable .
> > 
> >  -Luis
> > 
> > --
> >  arch/arm/Kconfig                           |   1 -
> >  arch/arm/Makefile                          |   8 ++
> >  arch/arm/boot/dts/omap3-beagle.dts         |   2 +-
> >  arch/arm/boot/dts/omap5-uevm.dts           |   4 +-
> >  arch/arm/kernel/signal.c                   |  15 ++--
> >  arch/arm/kvm/interrupts_head.S             |   6 +-
> >  arch/arm/mach-orion5x/include/mach/irqs.h  |  64 +++++++--------
> >  arch/arm/mach-orion5x/irq.c                |   4 +-
> >  arch/arm64/Kconfig                         |  16 ++++
> >  arch/arm64/Makefile                        |   4 +
> >  arch/arm64/kernel/head.S                   |   5 ++
> >  arch/arm64/kernel/module.c                 |   2 +
> >  arch/arm64/kernel/signal32.c               |  47 ++++++++---
> >  arch/arm64/kvm/hyp.S                       |   5 +-
> >  arch/m68k/include/asm/linkage.h            |  30 +++++++
> >  arch/mips/kernel/cps-vec.S                 |  12 +--
> >  arch/mips/mm/dma-default.c                 |   2 +-
> >  arch/powerpc/boot/Makefile                 |   3 +
> >  arch/powerpc/mm/hugepage-hash64.c          |   3 +-
> >  arch/x86/include/uapi/asm/msr-index.h      |   1 +
> >  arch/x86/kernel/apic/apic.c                |   7 ++
> >  arch/x86/kernel/entry_64.S                 |  16 +++-
> >  arch/x86/kernel/paravirt.c                 |  16 +++-
> >  arch/x86/kernel/tsc.c                      |  17 ++--
> >  arch/x86/kvm/svm.c                         |   2 +-
> >  arch/x86/kvm/x86.c                         |   2 +
> >  arch/x86/mm/init_64.c                      |   2 +-
> >  arch/x86/platform/efi/efi.c                |  67 +++++++++++++++-
> >  drivers/block/zram/zcomp.c                 |  12 +--
> >  drivers/cpufreq/intel_pstate.c             |  10 +--
> >  drivers/dma/dw/core.c                      |   4 +-
> >  drivers/gpu/drm/i915/intel_bios.c          |  12 ++-
> >  drivers/gpu/drm/qxl/qxl_display.c          |  14 ++--
> >  drivers/gpu/drm/radeon/atombios_encoders.c |   8 +-
> >  drivers/gpu/drm/vmwgfx/vmwgfx_drv.h        |   6 +-
> >  drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c    |   6 +-
> >  drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c    |   2 +-
> >  drivers/gpu/drm/vmwgfx/vmwgfx_resource.c   |  29 +++++--
> >  drivers/gpu/drm/vmwgfx/vmwgfx_shader.c     |   2 +-
> >  drivers/gpu/drm/vmwgfx/vmwgfx_surface.c    |  12 ++-
> >  drivers/hwmon/nct6775.c                    |  16 ++--
> >  drivers/infiniband/ulp/isert/ib_isert.c    |   9 ++-
> >  drivers/mtd/ubi/io.c                       |   5 ++
> >  drivers/mtd/ubi/vtbl.c                     |   1 +
> >  drivers/mtd/ubi/wl.c                       |   1 +
> >  drivers/net/ethernet/marvell/mvneta.c      |   4 +-
> >  drivers/net/ppp/pppoe.c                    |   1 -
> >  drivers/net/usb/asix_devices.c             |  16 +---
> >  drivers/net/vxlan.c                        |  10 +--
> >  drivers/net/xen-netfront.c                 |   3 +-
> >  drivers/pci/access.c                       |  27 +------
> >  drivers/pci/quirks.c                       |  20 ++++-
> >  drivers/platform/x86/hp-wmi.c              |  35 +++++---
> >  drivers/spi/spi-pxa2xx.c                   |   4 +
> >  drivers/spi/spi-xtensa-xtfpga.c            |   4 +-
> >  drivers/spi/spi.c                          |   3 +-
> >  drivers/staging/android/ion/ion.c          |   6 +-
> >  drivers/usb/chipidea/udc.c                 |  84 +++++++++----------
> >  drivers/usb/core/config.c                  |   5 +-
> >  drivers/usb/host/ehci-fsl.c                |  13 +++
> >  drivers/usb/host/ehci-hub.c                |   7 ++
> >  drivers/usb/host/ehci.h                    |  12 +++
> >  drivers/usb/host/fsl-mph-dr-of.c           |  10 +++
> >  drivers/usb/host/xhci-mem.c                |  23 +++---
> >  drivers/usb/host/xhci-ring.c               |  13 ++-
> >  drivers/usb/host/xhci.c                    |   9 +--
> >  drivers/usb/serial/option.c                |  24 ++++++
> >  drivers/usb/serial/whiteheat.c             |  31 ++++++++
> >  fs/btrfs/extent_io.c                       |  65 +++++++++++++--
> >  fs/btrfs/inode.c                           |   3 +-
> >  fs/cifs/cifsencrypt.c                      |  53 +++++++++++-
> >  fs/cifs/ioctl.c                            |   6 ++
> >  fs/cifs/smb2ops.c                          |   8 +-
> >  fs/coredump.c                              |  38 +++++++--
> >  fs/dcache.c                                |   7 ++
> >  fs/jbd2/checkpoint.c                       |  39 +++++++--
> >  fs/jbd2/commit.c                           |   2 +-
> >  fs/jbd2/journal.c                          |  11 ++-
> >  fs/namei.c                                 |  31 +++++++-
> >  fs/ocfs2/dlm/dlmmaster.c                   |   9 ++-
> >  fs/ocfs2/dlm/dlmrecovery.c                 |   8 +-
> >  include/linux/fsl_devices.h                |   2 +
> >  include/linux/jbd2.h                       |   3 +-
> >  include/linux/skbuff.h                     |   5 +-
> >  include/net/af_unix.h                      |   6 +-
> >  include/net/sock.h                         |   8 ++
> >  ipc/msg.c                                  |  14 ++--
> >  ipc/sem.c                                  |  15 ++--
> >  ipc/shm.c                                  |  12 +--
> >  ipc/util.c                                 |   8 +-
> >  kernel/irq/proc.c                          |  19 ++++-
> >  kernel/time/clocksource.c                  |   2 +-
> >  mm/hugetlb.c                               |   8 ++
> >  mm/slab.c                                  |  13 ++-
> >  net/core/datagram.c                        |   6 +-
> >  net/core/ethtool.c                         |   2 +-
> >  net/core/fib_rules.c                       |   2 +-
> >  net/core/skbuff.c                          |   9 ++-
> >  net/ipv4/tcp_input.c                       |   2 +-
> >  net/ipv4/udp.c                             |   2 +-
> >  net/ipv6/raw.c                             |   2 +-
> >  net/ipv6/udp.c                             |   3 +-
> >  net/l2tp/l2tp_core.c                       |  11 ++-
> >  net/netfilter/nft_compat.c                 |  24 ++++--
> >  net/netlink/af_netlink.c                   |  34 +++++---
> >  net/openvswitch/flow_table.c               |   3 +-
> >  net/sctp/sm_sideeffect.c                   |   2 +-
> >  net/unix/af_unix.c                         |  16 +++-
> >  sound/arm/Kconfig                          |  15 ++--
> >  sound/soc/pxa/Kconfig                      |   2 -
> >  sound/soc/pxa/pxa2xx-ac97.c                |   4 +-
> >  tools/lib/traceevent/event-parse.c         |  23 +++++-
> >  tools/perf/util/header.c                   |   4 +-
> >  tools/perf/util/symbol-elf.c               |  35 +++-----
> >  virt/kvm/eventfd.c                         | 124 +++++++++++++++++------------
> >  virt/kvm/kvm_main.c                        |  19 ++++-
> >  116 files changed, 1164 insertions(+), 451 deletions(-)
> > 
> > Aaron Conole (2):
> >       af_unix: Convert the unix_sk macro to an inline function for type safety
> >       af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
> > 
> > Adrian Hunter (1):
> >       perf tools: Fix copying of /proc/kcore
> > 
> > Alex Williamson (2):
> >       PCI: Fix devfn for VPD access through function 0
> >       PCI: Use function 0 VPD for identical functions, regular VPD for others
> > 
> > Alexander Couzens (1):
> >       l2tp: protect tunnel->del_work by ref_count
> > 
> > Andreas Schwab (1):
> >       m68k: Define asmlinkage_protect
> > 
> > Andrey Vagin (1):
> >       net/unix: fix logic about sk_peek_offset
> > 
> > Andy Lutomirski (2):
> >       x86/paravirt: Replace the paravirt nop with a bona fide empty function
> >       x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code
> > 
> > Andy Shevchenko (1):
> >       dmaengine: dw: properly read DWC_PARAMS register
> > 
> > Aneesh Kumar K.V (1):
> >       powerpc/mm: Recompute hash value after a failed update
> > 
> > Arad, Ronen (1):
> >       netlink: Trim skb to alloc size to avoid MSG_TRUNC
> > 
> > Ard Biesheuvel (1):
> >       ARM: 8429/1: disable GCC SRA optimization
> > 
> > Arnaldo Carvalho de Melo (1):
> >       perf header: Fixup reading of HEADER_NRCPUS feature
> > 
> > Ben Hutchings (1):
> >       genirq: Fix race in register_irq_proc()
> > 
> > Benjamin Herrenschmidt (1):
> >       powerpc/boot: Specify ABI v2 when building an LE boot wrapper
> > 
> > Carl Frederik Werner (1):
> >       ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again
> > 
> > Charles Keepax (1):
> >       asix: Do full reset during ax88772_bind
> > 
> > Chas Williams (1):
> >       net/xen-netfront: only napi_synchronize() if running
> > 
> > Dave Airlie (1):
> >       drm/qxl: only report first monitor as connected if we have no state
> > 
> > David Woodhouse (1):
> >       x86/platform: Fix Geode LX timekeeping in the generic x86 build
> > 
> > Dirk Müller (1):
> >       Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
> > 
> > Eric Dumazet (1):
> >       net: add pfmemalloc check in sk_add_backlog()
> > 
> > Eric W. Biederman (2):
> >       dcache: Handle escaped paths in prepend_path
> >       vfs: Test for and handle paths that are unreachable from their mnt_root
> > 
> > Fabiano Fidêncio (1):
> >       drm/qxl: recreate the primary surface when the bo is not primary
> > 
> > Filipe Manana (1):
> >       Btrfs: fix read corruption of compressed and shared extents
> > 
> > Grazvydas Ignotas (1):
> >       ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets
> > 
> > Guenter Roeck (2):
> >       hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips
> >       spi: Fix documentation of spi_alloc_master()
> > 
> > Guillaume Nault (1):
> >       ppp: don't override sk->sk_state in pppoe_flush_dev()
> > 
> > James Hogan (1):
> >       MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
> > 
> > Jan Kara (1):
> >       jbd2: avoid infinite loop when destroying aborted journal
> > 
> > Jani Nikula (1):
> >       drm/i915/bios: handle MIPI Sequence Block v3+ gracefully
> > 
> > Jann Horn (2):
> >       CIFS: fix type confusion in copy offload ioctl
> >       fs: if a coredump already exists, unlink and recreate with O_EXCL
> > 
> > Jason Wang (4):
> >       kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd
> >       kvm: factor out core eventfd assign/deassign logic
> >       kvm: fix double free for fast mmio eventfd
> >       kvm: fix zero length mmio searching
> > 
> > Jeff Mahoney (1):
> >       btrfs: skip waiting on ordered range for special files
> > 
> > Jenny Derzhavetz (1):
> >       iser-target: remove command with state ISTATE_REMOVE
> > 
> > Jiri Benc (1):
> >       vxlan: set needed headroom correctly
> > 
> > Joe Perches (1):
> >       ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
> > 
> > Johan Hovold (1):
> >       USB: whiteheat: fix potential null-deref at probe
> > 
> > John Stultz (1):
> >       clocksource: Fix abs() usage w/ 64bit values
> > 
> > Joonsoo Kim (1):
> >       mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1)
> > 
> > Joseph Qi (1):
> >       ocfs2/dlm: fix deadlock when dispatch assert master
> > 
> > Julia Lawall (1):
> >       xhci-mem: Use setup_timer
> > 
> > Kapileshwar Singh (1):
> >       tools lib traceevent: Fix string handling in heterogeneous arch environments
> > 
> > Konstantin Khlebnikov (1):
> >       ovs: do not allocate memory from offline numa node
> > 
> > Kyle Evans (1):
> >       hp-wmi: limit hotkey enable
> > 
> > Linus Torvalds (1):
> >       Initialize msg/shm IPC objects before doing ipc_addid()
> > 
> > Liu.Zhao (1):
> >       USB: option: add ZTE PIDs
> > 
> > Luis Henriques (2):
> >       zram: fix possible use after free in zcomp_create()
> >       Revert "ARM: orion5x: fix legacy orion5x IRQ numbers"
> > 
> > Manfred Spraul (1):
> >       ipc/sem.c: fully initialize sem_array before making it visible
> > 
> > Marc Zyngier (2):
> >       arm64: KVM: Disable virtual timer even if the guest is not using it
> >       arm: KVM: Disable virtual timer even if the guest is not using it
> > 
> > Mathias Krause (1):
> >       hp-wmi: Add missing __init annotations to initialization code
> > 
> > Mathias Nyman (4):
> >       usb: Use the USB_SS_MULT() macro to get the burst multiplier.
> >       xhci: give command abortion one more chance before killing xhci
> >       xhci: change xhci 1.0 only restrictions to support xhci 1.1
> >       xhci: init command timeout timer earlier to avoid deleting it uninitialized
> > 
> > Matt Fleming (1):
> >       x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down
> > 
> > Max Filippov (1):
> >       spi: xtensa-xtfpga: fix register endianness
> > 
> > Mel Gorman (1):
> >       mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
> > 
> > Michel Dänzer (1):
> >       drm/radeon: Restore LCD backlight level on resume (>= R5xx)
> > 
> > Michel Stam (1):
> >       asix: Don't reset PHY on if_up for ASIX 88772
> > 
> > Nikhil Badola (2):
> >       drivers: usb :fsl: Implement Workaround for USB Erratum A007792
> >       drivers: usb: fsl: Workaround for USB erratum-A005275
> > 
> > Pablo Neira Ayuso (1):
> >       netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC
> > 
> > Paolo Bonzini (1):
> >       KVM: x86: trap AMD MSRs for the TSeg base and mask
> > 
> > Paul Burton (3):
> >       MIPS: CPS: Stop dangling delay slot from has_mt.
> >       MIPS: CPS: Don't include MT code in non-MT kernels.
> >       MIPS: CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT
> > 
> > Peter Chen (1):
> >       usb: chipidea: udc: using the correct stall implementation
> > 
> > Peter Seiderer (1):
> >       cifs: use server timestamp for ntlmv2 authentication
> > 
> > Prarit Bhargava (1):
> >       intel_pstate: Fix overflow in busy_scaled due to long delay
> > 
> > Pravin B Shelar (2):
> >       skbuff: Fix skb checksum flag on skb pull
> >       skbuff: Fix skb checksum partial check.
> > 
> > Richard Weinberger (1):
> >       UBI: Validate data_size
> > 
> > Robert Jarzmik (2):
> >       ASoC: pxa: pxa2xx-ac97: fix dma requestor lines
> >       ASoC: fix broken pxa SoC support
> > 
> > Roger Quadros (2):
> >       usb: xhci: Clear XHCI_STATE_DYING on start
> >       usb: xhci: Allow usb_add/remove_hcd() to be called repeatedly
> > 
> > Roland Dreier (1):
> >       fib_rules: Fix dump_rules() not to exit early
> > 
> > Russell King (1):
> >       ARM: fix Thumb2 signal handling when ARMv6 is enabled
> > 
> > Sabrina Dubroca (1):
> >       net: add length argument to skb_copy_and_csum_datagram_iovec
> > 
> > Shaohua Li (1):
> >       x86/apic: Serialize LVTT and TSC_DEADLINE writes
> > 
> > Shawn Lin (1):
> >       staging: ion: fix corruption of ion_import_dma_buf
> > 
> > Simon Guinot (1):
> >       net: mvneta: fix DMA buffer unmapping in mvneta_rx()
> > 
> > Stephen Smalley (1):
> >       x86/mm: Set NX on gap between __ex_table and rodata
> > 
> > Steve French (1):
> >       disabling oplocks/leases via module parm enable_oplocks broken for SMB3
> > 
> > Stratos Karafotis (1):
> >       cpufreq: intel_pstate: Remove unnecessary type casting in div_s64() call
> > 
> > Tan, Jui Nee (1):
> >       spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled
> > 
> > Thomas Hellstrom (2):
> >       drm/vmwgfx: Fix up user_dmabuf refcounting
> >       drm/vmwgfx: Fix kernel NULL pointer dereference on older hardware
> > 
> > Will Deacon (3):
> >       arm64: head.S: initialise mdcr_el2 in el2_setup
> >       arm64: compat: fix vfp save/restore across signal handlers in big-endian
> >       arm64: errata: add module build workaround for erratum #843419
> > 
> > lucien (1):
> >       sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state
> > 
> > shengyong (1):
> >       UBI: return ENOSPC if no enough space available
> 
> -- 
> kernel-team mailing list
> kernel-team@lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1256221 — [PATCH 3.16.y-ckt 106/107] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-26 20:10 +0100
Subject	[PATCH 3.16.y-ckt 106/107] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
Message-ID	<qnVjB-3Er-25@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.

The following sequence of commands:

    i=`keyctl add user a a @s`
    keyctl request2 keyring foo bar @t
    keyctl unlink $i @s

tries to invoke an upcall to instantiate a keyring if one doesn't already
exist by that name within the user's keyring set.  However, if the upcall
fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
other error code.  When the key is garbage collected, the key destroy
function is called unconditionally and keyring_destroy() uses list_empty()
on keyring->type_data.link - which is in a union with reject_error.
Subsequently, the kernel tries to unlink the keyring from the keyring names
list - which oopses like this:

	BUG: unable to handle kernel paging request at 00000000ffffff8a
	IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	...
	Workqueue: events key_garbage_collector
	...
	RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	RSP: 0018:ffff88003e2f3d30  EFLAGS: 00010203
	RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
	RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
	RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
	R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
	R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
	...
	CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
	...
	Call Trace:
	 [<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
	 [<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
	 [<ffffffff8105ec9b>] process_one_work+0x28e/0x547
	 [<ffffffff8105fd17>] worker_thread+0x26e/0x361
	 [<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
	 [<ffffffff810648ad>] kthread+0xf3/0xfb
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
	 [<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2

Note the value in RAX.  This is a 32-bit representation of -ENOKEY.

The solution is to only call ->destroy() if the key was successfully
instantiated.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 security/keys/gc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 38676fac7943..4a780333c22c 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -143,8 +143,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
-		/* Throw away the key data */
-		if (key->type->destroy)
+		/* Throw away the key data if the key is instantiated */
+		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+		    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+		    key->type->destroy)
 			key->type->destroy(key);
 
 		security_key_free(key);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1258311 — [PATCH 3.16.y-ckt 108/108] Btrfs: update fix for read corruption of compressed and shared extents

From	Luis Henriques <luis.henriques@canonical.com>
Date	2015-10-28 18:00 +0100
Subject	[PATCH 3.16.y-ckt 108/108] Btrfs: update fix for read corruption of compressed and shared extents
Message-ID	<qoCeU-5cz-37@gated-at.bofh.it>
In reply to	#1256068

3.16.7-ckt19 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Filipe Manana <fdmanana@suse.com>

commit 808f80b46790f27e145c72112189d6a3be2bc884 upstream.

My previous fix in commit 005efedf2c7d ("Btrfs: fix read corruption of
compressed and shared extents") was effective only if the compressed
extents cover a file range with a length that is not a multiple of 16
pages. That's because the detection of when we reached a different range
of the file that shares the same compressed extent as the previously
processed range was done at extent_io.c:__do_contiguous_readpages(),
which covers subranges with a length up to 16 pages, because
extent_readpages() groups the pages in clusters no larger than 16 pages.
So fix this by tracking the start of the previously processed file
range's extent map at extent_readpages().

The following test case for fstests reproduces the issue:

  seq=`basename $0`
  seqres=$RESULT_DIR/$seq
  echo "QA output created by $seq"
  tmp=/tmp/$$
  status=1	# failure is the default!
  trap "_cleanup; exit \$status" 0 1 2 3 15

  _cleanup()
  {
      rm -f $tmp.*
  }

  # get standard environment, filters and checks
  . ./common/rc
  . ./common/filter

  # real QA test starts here
  _need_to_be_root
  _supported_fs btrfs
  _supported_os Linux
  _require_scratch
  _require_cloner

  rm -f $seqres.full

  test_clone_and_read_compressed_extent()
  {
      local mount_opts=$1

      _scratch_mkfs >>$seqres.full 2>&1
      _scratch_mount $mount_opts

      # Create our test file with a single extent of 64Kb that is going to
      # be compressed no matter which compression algo is used (zlib/lzo).
      $XFS_IO_PROG -f -c "pwrite -S 0xaa 0K 64K" \
          $SCRATCH_MNT/foo | _filter_xfs_io

      # Now clone the compressed extent into an adjacent file offset.
      $CLONER_PROG -s 0 -d $((64 * 1024)) -l $((64 * 1024)) \
          $SCRATCH_MNT/foo $SCRATCH_MNT/foo

      echo "File digest before unmount:"
      md5sum $SCRATCH_MNT/foo | _filter_scratch

      # Remount the fs or clear the page cache to trigger the bug in
      # btrfs. Because the extent has an uncompressed length that is a
      # multiple of 16 pages, all the pages belonging to the second range
      # of the file (64K to 128K), which points to the same extent as the
      # first range (0K to 64K), had their contents full of zeroes instead
      # of the byte 0xaa. This was a bug exclusively in the read path of
      # compressed extents, the correct data was stored on disk, btrfs
      # just failed to fill in the pages correctly.
      _scratch_remount

      echo "File digest after remount:"
      # Must match the digest we got before.
      md5sum $SCRATCH_MNT/foo | _filter_scratch
  }

  echo -e "\nTesting with zlib compression..."
  test_clone_and_read_compressed_extent "-o compress=zlib"

  _scratch_unmount

  echo -e "\nTesting with lzo compression..."
  test_clone_and_read_compressed_extent "-o compress=lzo"

  status=0
  exit

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Tested-by: Timofey Titovets <nefelim4ag@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/btrfs/extent_io.c | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 0c5955b6275d..13ee2bb1ed9c 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3019,12 +3019,12 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 					     get_extent_t *get_extent,
 					     struct extent_map **em_cached,
 					     struct bio **bio, int mirror_num,
-					     unsigned long *bio_flags, int rw)
+					     unsigned long *bio_flags, int rw,
+					     u64 *prev_em_start)
 {
 	struct inode *inode;
 	struct btrfs_ordered_extent *ordered;
 	int index;
-	u64 prev_em_start = (u64)-1;
 
 	inode = pages[0]->mapping->host;
 	while (1) {
@@ -3040,7 +3040,7 @@ static inline void __do_contiguous_readpages(struct extent_io_tree *tree,
 
 	for (index = 0; index < nr_pages; index++) {
 		__do_readpage(tree, pages[index], get_extent, em_cached, bio,
-			      mirror_num, bio_flags, rw, &prev_em_start);
+			      mirror_num, bio_flags, rw, prev_em_start);
 		page_cache_release(pages[index]);
 	}
 }
@@ -3050,7 +3050,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
 			       int nr_pages, get_extent_t *get_extent,
 			       struct extent_map **em_cached,
 			       struct bio **bio, int mirror_num,
-			       unsigned long *bio_flags, int rw)
+			       unsigned long *bio_flags, int rw,
+			       u64 *prev_em_start)
 {
 	u64 start = 0;
 	u64 end = 0;
@@ -3071,7 +3072,7 @@ static void __extent_readpages(struct extent_io_tree *tree,
 						  index - first_index, start,
 						  end, get_extent, em_cached,
 						  bio, mirror_num, bio_flags,
-						  rw);
+						  rw, prev_em_start);
 			start = page_start;
 			end = start + PAGE_CACHE_SIZE - 1;
 			first_index = index;
@@ -3082,7 +3083,8 @@ static void __extent_readpages(struct extent_io_tree *tree,
 		__do_contiguous_readpages(tree, &pages[first_index],
 					  index - first_index, start,
 					  end, get_extent, em_cached, bio,
-					  mirror_num, bio_flags, rw);
+					  mirror_num, bio_flags, rw,
+					  prev_em_start);
 }
 
 static int __extent_read_full_page(struct extent_io_tree *tree,
@@ -4037,6 +4039,7 @@ int extent_readpages(struct extent_io_tree *tree,
 	struct page *page;
 	struct extent_map *em_cached = NULL;
 	int nr = 0;
+	u64 prev_em_start = (u64)-1;
 
 	for (page_idx = 0; page_idx < nr_pages; page_idx++) {
 		page = list_entry(pages->prev, struct page, lru);
@@ -4053,12 +4056,12 @@ int extent_readpages(struct extent_io_tree *tree,
 		if (nr < ARRAY_SIZE(pagepool))
 			continue;
 		__extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
-				   &bio, 0, &bio_flags, READ);
+				   &bio, 0, &bio_flags, READ, &prev_em_start);
 		nr = 0;
 	}
 	if (nr)
 		__extent_readpages(tree, pagepool, nr, get_extent, &em_cached,
-				   &bio, 0, &bio_flags, READ);
+				   &bio, 0, &bio_flags, READ, &prev_em_start);
 
 	if (em_cached)
 		free_extent_map(em_cached);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

csiph-web

[3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review

Contents

#1256068 — [3.16.y-ckt stable] Linux 3.16.7-ckt19 stable review

#1256069 — [PATCH 3.16.y-ckt 005/104] arm64: head.S: initialise mdcr_el2 in el2_setup

#1256070 — [PATCH 3.16.y-ckt 038/104] usb: xhci: Clear XHCI_STATE_DYING on start

#1256071 — [PATCH 3.16.y-ckt 006/104] kvm: don't try to register to KVM_FAST_MMIO_BUS for non mmio eventfd

#1256072 — [PATCH 3.16.y-ckt 027/104] drm/vmwgfx: Fix up user_dmabuf refcounting

#1256073 — [PATCH 3.16.y-ckt 001/104] ARM: 8429/1: disable GCC SRA optimization

#1256074 — [PATCH 3.16.y-ckt 015/104] arm64: errata: add module build workaround for erratum #843419

#1256075 — [PATCH 3.16.y-ckt 029/104] Btrfs: fix read corruption of compressed and shared extents

#1256218 — [PATCH 3.16.y-ckt 105/107] KEYS: Fix race between key destruction and finding a keyring by name

#1256219 — [PATCH 3.16.y-ckt 107/107] KEYS: Don't permit request_key() to construct a new keyring

#1256220

#1258313

#1256221 — [PATCH 3.16.y-ckt 106/107] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring

#1258311 — [PATCH 3.16.y-ckt 108/108] Btrfs: update fix for read corruption of compressed and shared extents