Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1268321 > unrolled thread

[3.19.y-ckt stable] Linux 3.19.8-ckt10 stable review

Back to article view | Back to linux.kernel

Contents

  [3.19.y-ckt stable] Linux 3.19.8-ckt10 stable review Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:20 +0100
    [PATCH 3.19.y-ckt 029/155] x86/mm: Set NX on gap between __ex_table and rodata Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:20 +0100
    [PATCH 3.19.y-ckt 052/155] ALSA: hda: Add dock support for ThinkPad T550 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:20 +0100
    [PATCH 3.19.y-ckt 088/155] af_unix: Convert the unix_sk macro to an inline function for type safety Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:20 +0100
    [PATCH 3.19.y-ckt 025/155] mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:20 +0100
    [PATCH 3.19.y-ckt 153/155] ipv6: Fix IPsec pre-encap fragmentation check Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 150/155] md/raid5: fix locking in handle_stripe_clean_event() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 135/155] IB/cm: Fix rb-tree duplicate free and use-after-free Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 142/155] md/raid10: submit_bio_wait() returns 0 on success Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 141/155] md/raid1: submit_bio_wait() returns 0 on success Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 154/155] ipv6: gre: support SIT encapsulation Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 144/155] i2c: mv64xxx: really allow I2C offloading Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 146/155] mvsas: Fix NULL pointer dereference in mvs_slot_task_free Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 123/155] drm/nouveau/gem: return only valid domain when there's only one Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 145/155] drm/radeon: don't try to recreate sysfs entries on resume Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 151/155] Revert "md: allow a partially recovered device to be hot-added to an array." Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 126/155] mm: make sendfile(2) killable Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 148/155] Revert "ARM64: unwind: Fix PC calculation" Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 131/155] dm btree remove: fix a bug when rebalancing nodes after removal Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 132/155] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 136/155] module: Fix locking in symbol_put_addr() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 149/155] rbd: require stable pages if message data CRCs are enabled Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 121/155] ASoC: wm8904: Correct number of EQ registers Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 124/155] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 137/155] PCI: Prevent out of bounds access in numa_node override Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 139/155] ovl: fix dentry reference leak Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 127/155] fault-inject: fix inverted interval/probability values in printk Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 143/155] iommu/amd: Don't clear DTE flags when modifying it Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 152/155] net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 122/155] drm: fix mutex leak in drm_dp_get_mst_branch_device Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 134/155] ARM: dts: am57xx-beagle-x15: set VDD_SD to always-on Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 147/155] arm64: compat: fix stxr failure case in SWP emulation Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 116/155] x86/setup: Extend low identity map to cover whole kernel range Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
      Re: [PATCH 3.19.y-ckt 116/155] x86/setup: Extend low identity map to  cover whole kernel range Matt Fleming <matt@codeblueprint.co.uk> - 2015-11-13 10:10 +0100
        Re: [PATCH 3.19.y-ckt 116/155] x86/setup: Extend low identity map  to cover whole kernel range Kamal Mostafa <kamal@canonical.com> - 2015-11-13 17:50 +0100
    [PATCH 3.19.y-ckt 140/155] crypto: api - Only abort operations on fatal signal Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 120/155] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 155/155] ppp: fix pppoe_dev deletion condition in pppoe_release() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 138/155] ovl: use O_LARGEFILE in ovl_copy_up() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 129/155] rbd: don't leak parent_spec in rbd_dev_probe_parent() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 115/155] x86/efi: Fix multiple GOP device support Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 133/155] bpf: fix panic in SO_GET_FILTER with native ebpf programs Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:30 +0100
    [PATCH 3.19.y-ckt 101/155] iwlwifi: mvm: fix D3 firmware PN programming Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 092/155] skbuff: Fix skb checksum partial check. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 118/155] xhci: don't finish a TD if we get a short transfer event mid TD Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 113/155] drm/i915: Deny wrapping an userptr into a framebuffer Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 106/155] ARM: orion: Fix DSA platform device after mvmdio conversion Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 117/155] ASoC: Add info callback for SX_TLV controls Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 105/155] iwlwifi: mvm: init card correctly on ctkill exit check Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 114/155] iommu/vt-d: fix range computation when making room for large pages Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 112/155] drm/i915: Restore lost DPLL register write on gen2-4 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 096/155] ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 108/155] iio: mxs-lradc: Fix temperature offset Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 107/155] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 103/155] iwlwifi: fix firmware filename for 3160 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 090/155] net/unix: fix logic about sk_peek_offset Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 110/155] ALSA: hda - Fix inverted internal mic on Lenovo G50-80 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 098/155] ath9k: declare required extra tx headroom Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 022/155] x86/efi: Fix boot crash by mapping EFI memmap entries bottom-up at runtime, instead of top-down Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 097/155] netlink: Trim skb to alloc size to avoid MSG_TRUNC Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 104/155] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 089/155] af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 111/155] drm/i915: Flush pipecontrol post-sync writes Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 102/155] iwlwifi: mvm: clear csa countdown when AP is stopped Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 125/155] [media] si2168: Bounds check firmware Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 119/155] xhci: handle no ping response error properly Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 093/155] net: add pfmemalloc check in sk_add_backlog() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 100/155] iwlwifi: dvm: fix D3 firmware PN programming Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 128/155] rbd: fix double free on rbd_dev->header_name Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 091/155] skbuff: Fix skb checksum flag on skb pull Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 099/155] iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 109/155] ARM: dts: Fix audio card detection on Peach boards Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 130/155] rbd: prevent kernel stack blow up on rbd map Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:40 +0100
    [PATCH 3.19.y-ckt 095/155] ovs: do not allocate memory from offline numa node Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 083/155] i2c: designware-platdrv: enable RuntimePM before registering to the core Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 087/155] l2tp: protect tunnel->del_work by ref_count Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 085/155] i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 082/155] i2c: s3c2410: enable RuntimePM before registering to the core Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 086/155] pinctrl: imx25: ensure that a pin with id i is at position i in the info array Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 084/155] memcg: convert threshold to bytes Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 080/155] drm/dp/mst: make mst i2c transfer code more robust. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 094/155] ppp: don't override sk->sk_state in pppoe_flush_dev() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 047/155] dm: fix AB-BA deadlock in __dm_destroy() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 028/155] x86/kexec: Fix kexec crash in syscall kexec_file_load() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 081/155] i2c: rcar: enable RuntimePM before registering to the core Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 078/155] btrfs: check unsupported filters in balance arguments Kamal Mostafa <kamal@canonical.com> - 2015-11-13 00:50 +0100
    [PATCH 3.19.y-ckt 060/155] ALSA: synth: Fix conflicting OSS device registration on AWE32 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 071/155] cxl: Fix number of allocated pages in SPA Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 064/155] sched/core: Fix TASK_DEAD race in finish_task_switch() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 055/155] usb: Add device quirk for Logitech PTZ cameras Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 073/155] drm: Fix locking for sysfs dpms file Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 072/155] crypto: sparc - initialize blkcipher.ivsize Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 076/155] crypto: ahash - ensure statesize is non-zero Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 068/155] drm/radeon: add pm sysfs files late Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 075/155] arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 054/155] USB: Add reset-resume quirk for two Plantronics usb headphones. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 063/155] ASoC: tas2552: fix dBscale-min declaration Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 061/155] arm64: readahead: fault retry breaks mmap file read random detection Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 057/155] serial: 8250: add uart_config entry for PORT_RT2880 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 056/155] tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 077/155] dm thin: fix missing pool reference count decrement in pool_ctr error path Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 066/155] 3w-9xxx: don't unmap bounce buffered commands Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 045/155] svcrdma: handle rdma read with a non-zero initial page offset Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 079/155] btrfs: fix use after free iterating extrefs Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 065/155] dm cache: fix NULL pointer when switching from cleaner policy Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 067/155] workqueue: make sure delayed work run in local cpu Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 058/155] drivers/tty: require read access for controlling terminal Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 059/155] staging: speakup: fix speakup-r regression Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 053/155] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 018/155] x86/asm/entry: Create and use a 'TOP_OF_KERNEL_STACK_PADDING' macro Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 070/155] drm/radeon: add quirk for ASUS R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 074/155] drm/nouveau/fbcon: take runpm reference when userspace has an open fd Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 019/155] x86/process: Add proper bound checks in 64bit get_wchan() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 049/155] clk: ti: fix dual-registration of uart4_ick Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 050/155] ASoC: dwc: correct irq clear method Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 069/155] drm/radeon: add quirk for MSI R7 370 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 048/155] [SMB3] Do not fall back to SMBWriteX in set_file_size error cases Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 046/155] ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
      Re: [PATCH 3.19.y-ckt 046/155] ASoC: sgtl5000: fix wrong register  MIC_BIAS_VOLTAGE setup on probe gianluca <gianlucarenzi@eurek.it> - 2015-11-13 10:20 +0100
    [PATCH 3.19.y-ckt 062/155] ASoC: tas2552: Correct the Speaker Driver Playback Volume (PGA_GAIN) Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 051/155] dm raid: fix round up of default region size Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:00 +0100
    [PATCH 3.19.y-ckt 007/155] m68k: Define asmlinkage_protect Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 041/155] ASoC: db1200: Fix DAI link format for db1300 and db1550 Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 020/155] drm/qxl: recreate the primary surface when the bo is not primary Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 035/155] mm/slab: fix unexpected index mapping result of kmalloc_size(INDEX_NODE+1) Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 031/155] md/raid0: apply base queue limits *before* disk_stack_limits Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 013/155] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 015/155] MIPS: CPS: Don't include MT code in non-MT kernels. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 038/155] mtd: nand: sunxi: fix OOB handling in ->write_xxx() functions Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 003/155] [media] media/vivid-osd: fix info leak in ioctl Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 023/155] KVM: nSVM: Check for NRIPS support before updating control field Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 030/155] md/raid0: update queue parameter in a safer location. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 039/155] mtd: nand: sunxi: fix sunxi_nand_chips_cleanup() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 012/155] drm/radeon: fix dpms when driver backlight control is disabled Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 044/155] s390/boot/decompression: disable floating point in decompressor Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 043/155] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 036/155] regmap: debugfs: Ensure we don't underflow when printing access masks Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 027/155] drm/dp/mst: drop cancel work sync in the mstb destroy path (v2) Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 016/155] MIPS: CPS: #ifdef on CONFIG_MIPS_MT_SMP rather than CONFIG_MIPS_MT Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 040/155] ARM: dts: fix usb pin control for imx-rex dts Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 037/155] regmap: debugfs: Don't bother actually printing when calculating max length Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 032/155] arm64: ftrace: fix function_graph tracer panic Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 017/155] Initialize msg/shm IPC objects before doing ipc_addid() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 034/155] dmaengine: dw: properly read DWC_PARAMS register Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 033/155] clocksource: Fix abs() usage w/ 64bit values Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 024/155] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 014/155] MIPS: CPS: Stop dangling delay slot from has_mt. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 008/155] UBI: Validate data_size Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 021/155] genirq: Fix race in register_irq_proc() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 042/155] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
      Re: [PATCH 3.19.y-ckt 042/155] x86/xen: Support kexec/kdump in HVM  guests by doing a soft reset David Vrabel <david.vrabel@citrix.com> - 2015-11-13 11:30 +0100
        Re: [PATCH 3.19.y-ckt 042/155] x86/xen: Support kexec/kdump in HVM  guests by doing a soft reset Kamal Mostafa <kamal@canonical.com> - 2015-11-13 18:00 +0100
    [PATCH 3.19.y-ckt 026/155] drm/dp/mst: fixup handling hotplug on port removal. Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:10 +0100
    [PATCH 3.19.y-ckt 011/155] drm/radeon: move bl encoder assignment into bl init Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 004/155] staging/dgnc: fix info leak in ioctl Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 001/155] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 009/155] UBI: return ENOSPC if no enough space available Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 002/155] ppp, slip: Validate VJ compression slot parameters completely Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 010/155] drm/radeon: Restore LCD backlight level on resume (>= R5xx) Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 006/155] perf tools: Fix copying of /proc/kcore Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100
    [PATCH 3.19.y-ckt 005/155] tools lib traceevent: Fix string handling in heterogeneous arch environments Kamal Mostafa <kamal@canonical.com> - 2015-11-13 01:20 +0100

Page 6 of 9 — ← Prev page 1 2 3 4 5 [6] 7 8 9  Next page →

#1268443 — [PATCH 3.19.y-ckt 077/155] dm thin: fix missing pool reference count decrement in pool_ctr error path

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <snitzer@redhat.com>

commit ba30670f4d5292c4e7f7980bbd5071f7c4794cdd upstream.

Fixes: ac8c3f3df ("dm thin: generate event when metadata threshold passed")
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/md/dm-thin.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index d0a8ee4..734254f 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2958,7 +2958,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
 						metadata_low_callback,
 						pool);
 	if (r)
-		goto out_free_pt;
+		goto out_flags_changed;
 
 	pt->callbacks.congested_fn = pool_is_congested;
 	dm_table_add_target_callbacks(ti->table, &pt->callbacks);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268444 — [PATCH 3.19.y-ckt 066/155] 3w-9xxx: don't unmap bounce buffered commands

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@lst.de>

commit 15e3d5a285ab9283136dba34bbf72886d9146706 upstream.

3w controller don't dma map small single SGL entry commands but instead
bounce buffer them.  Add a helper to identify these commands and don't
call scsi_dma_unmap for them.

Based on an earlier patch from James Bottomley.

Fixes: 118c85 ("3w-9xxx: fix command completion race")
Reported-by: Tóth Attila <atoth@atoth.sote.hu>
Tested-by: Tóth Attila <atoth@atoth.sote.hu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/scsi/3w-9xxx.c | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
index 1f9e8d2..4e8209a 100644
--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -212,6 +212,17 @@ static const struct file_operations twa_fops = {
 	.llseek		= noop_llseek,
 };
 
+/*
+ * The controllers use an inline buffer instead of a mapped SGL for small,
+ * single entry buffers.  Note that we treat a zero-length transfer like
+ * a mapped SGL.
+ */
+static bool twa_command_mapped(struct scsi_cmnd *cmd)
+{
+	return scsi_sg_count(cmd) != 1 ||
+		scsi_bufflen(cmd) >= TW_MIN_SGL_LENGTH;
+}
+
 /* This function will complete an aen request from the isr */
 static int twa_aen_complete(TW_Device_Extension *tw_dev, int request_id)
 {
@@ -1338,7 +1349,8 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
 				}
 
 				/* Now complete the io */
-				scsi_dma_unmap(cmd);
+				if (twa_command_mapped(cmd))
+					scsi_dma_unmap(cmd);
 				cmd->scsi_done(cmd);
 				tw_dev->state[request_id] = TW_S_COMPLETED;
 				twa_free_request_id(tw_dev, request_id);
@@ -1581,7 +1593,8 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
 				struct scsi_cmnd *cmd = tw_dev->srb[i];
 
 				cmd->result = (DID_RESET << 16);
-				scsi_dma_unmap(cmd);
+				if (twa_command_mapped(cmd))
+					scsi_dma_unmap(cmd);
 				cmd->scsi_done(cmd);
 			}
 		}
@@ -1764,12 +1777,14 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
 	retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
 	switch (retval) {
 	case SCSI_MLQUEUE_HOST_BUSY:
-		scsi_dma_unmap(SCpnt);
+		if (twa_command_mapped(SCpnt))
+			scsi_dma_unmap(SCpnt);
 		twa_free_request_id(tw_dev, request_id);
 		break;
 	case 1:
 		SCpnt->result = (DID_ERROR << 16);
-		scsi_dma_unmap(SCpnt);
+		if (twa_command_mapped(SCpnt))
+			scsi_dma_unmap(SCpnt);
 		done(SCpnt);
 		tw_dev->state[request_id] = TW_S_COMPLETED;
 		twa_free_request_id(tw_dev, request_id);
@@ -1830,8 +1845,7 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
 		/* Map sglist from scsi layer to cmd packet */
 
 		if (scsi_sg_count(srb)) {
-			if ((scsi_sg_count(srb) == 1) &&
-			    (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) {
+			if (!twa_command_mapped(srb)) {
 				if (srb->sc_data_direction == DMA_TO_DEVICE ||
 				    srb->sc_data_direction == DMA_BIDIRECTIONAL)
 					scsi_sg_copy_to_buffer(srb,
@@ -1904,7 +1918,7 @@ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int re
 {
 	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
 
-	if (scsi_bufflen(cmd) < TW_MIN_SGL_LENGTH &&
+	if (!twa_command_mapped(cmd) &&
 	    (cmd->sc_data_direction == DMA_FROM_DEVICE ||
 	     cmd->sc_data_direction == DMA_BIDIRECTIONAL)) {
 		if (scsi_sg_count(cmd) == 1) {
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268445 — [PATCH 3.19.y-ckt 045/155] svcrdma: handle rdma read with a non-zero initial page offset

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steve Wise <swise@opengridcomputing.com>

commit c91aed9896946721bb30705ea2904edb3725dd61 upstream.

The server rdma_read_chunk_lcl() and rdma_read_chunk_frmr() functions
were not taking into account the initial page_offset when determining
the rdma read length.  This resulted in a read who's starting address
and length exceeded the base/bounds of the frmr.

The server gets an async error from the rdma device and kills the
connection, and the client then reconnects and resends.  This repeats
indefinitely, and the application hangs.

Most work loads don't tickle this bug apparently, but one test hit it
every time: building the linux kernel on a 16 core node with 'make -j
16 O=/mnt/0' where /mnt/0 is a ramdisk mounted via NFSRDMA.

This bug seems to only be tripped with devices having small fastreg page
list depths.  I didn't see it with mlx4, for instance.

Fixes: 0bf4828983df ('svcrdma: refactor marshalling logic')
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Tested-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>

Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index e011027..a9f8c0c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -157,7 +157,8 @@ static int rdma_read_chunk_lcl(struct svcxprt_rdma *xprt,
 	ctxt->read_hdr = head;
 	pages_needed =
 		min_t(int, pages_needed, rdma_read_max_sge(xprt, pages_needed));
-	read = min_t(int, pages_needed << PAGE_SHIFT, rs_length);
+	read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset,
+		     rs_length);
 
 	for (pno = 0; pno < pages_needed; pno++) {
 		int len = min_t(int, rs_length, PAGE_SIZE - pg_off);
@@ -256,7 +257,8 @@ static int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt,
 	ctxt->direction = DMA_FROM_DEVICE;
 	ctxt->frmr = frmr;
 	pages_needed = min_t(int, pages_needed, xprt->sc_frmr_pg_list_len);
-	read = min_t(int, pages_needed << PAGE_SHIFT, rs_length);
+	read = min_t(int, (pages_needed << PAGE_SHIFT) - *page_offset,
+		     rs_length);
 
 	frmr->kva = page_address(rqstp->rq_arg.pages[pg_no]);
 	frmr->direction = DMA_FROM_DEVICE;
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268446 — [PATCH 3.19.y-ckt 079/155] btrfs: fix use after free iterating extrefs

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Mason <clm@fb.com>

commit dc6c5fb3b514221f2e9d21ee626a9d95d3418dff upstream.

The code for btrfs inode-resolve has never worked properly for
files with enough hard links to trigger extrefs.  It was trying to
get the leaf out of a path after freeing the path:

	btrfs_release_path(path);
	leaf = path->nodes[0];
	item_size = btrfs_item_size_nr(leaf, slot);

The fix here is to use the extent buffer we cloned just a little higher
up to avoid deadlocks caused by using the leaf in the path.

Signed-off-by: Chris Mason <clm@fb.com>
cc: Mark Fasheh <mfasheh@suse.de>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Mark Fasheh <mfasheh@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/btrfs/backref.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 8729cf6..6a659c2 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
@@ -1785,7 +1785,6 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
 	int found = 0;
 	struct extent_buffer *eb;
 	struct btrfs_inode_extref *extref;
-	struct extent_buffer *leaf;
 	u32 item_size;
 	u32 cur_offset;
 	unsigned long ptr;
@@ -1813,9 +1812,8 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
 		btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
 		btrfs_release_path(path);
 
-		leaf = path->nodes[0];
-		item_size = btrfs_item_size_nr(leaf, slot);
-		ptr = btrfs_item_ptr_offset(leaf, slot);
+		item_size = btrfs_item_size_nr(eb, slot);
+		ptr = btrfs_item_ptr_offset(eb, slot);
 		cur_offset = 0;
 
 		while (cur_offset < item_size) {
@@ -1829,7 +1827,7 @@ static int iterate_inode_extrefs(u64 inum, struct btrfs_root *fs_root,
 			if (ret)
 				break;
 
-			cur_offset += btrfs_inode_extref_name_len(leaf, extref);
+			cur_offset += btrfs_inode_extref_name_len(eb, extref);
 			cur_offset += sizeof(*extref);
 		}
 		btrfs_tree_read_unlock_blocking(eb);
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268447 — [PATCH 3.19.y-ckt 065/155] dm cache: fix NULL pointer when switching from cleaner policy

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit 2bffa1503c5c06192eb1459180fac4416575a966 upstream.

The cleaner policy doesn't make use of the per cache block hint space in
the metadata (unlike the other policies).  When switching from the
cleaner policy to mq or smq a NULL pointer crash (in dm_tm_new_block)
was observed.  The crash was caused by bugs in dm-cache-metadata.c
when trying to skip creation of the hint btree.

The minimal fix is to change hint size for the cleaner policy to 4 bytes
(only hint size supported).

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/md/dm-cache-policy-cleaner.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
index 004e463..8308f4b 100644
--- a/drivers/md/dm-cache-policy-cleaner.c
+++ b/drivers/md/dm-cache-policy-cleaner.c
@@ -435,7 +435,7 @@ static struct dm_cache_policy *wb_create(dm_cblock_t cache_size,
 static struct dm_cache_policy_type wb_policy_type = {
 	.name = "cleaner",
 	.version = {1, 0, 0},
-	.hint_size = 0,
+	.hint_size = 4,
 	.owner = THIS_MODULE,
 	.create = wb_create
 };
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268448 — [PATCH 3.19.y-ckt 067/155] workqueue: make sure delayed work run in local cpu

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shaohua Li <shli@fb.com>

commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream.

My system keeps crashing with below message. vmstat_update() schedules a delayed
work in current cpu and expects the work runs in the cpu.
schedule_delayed_work() is expected to make delayed work run in local cpu. The
problem is timer can be migrated with NO_HZ. __queue_work() queues work in
timer handler, which could run in a different cpu other than where the delayed
work is scheduled. The end result is the delayed work runs in different cpu.
The patch makes __queue_delayed_work records local cpu earlier. Where the timer
runs doesn't change where the work runs with the change.

[   28.010131] ------------[ cut here ]------------
[   28.010609] kernel BUG at ../mm/vmstat.c:1392!
[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[   28.011860] Modules linked in:
[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634
[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
[   28.014160] Workqueue: events vmstat_update
[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000
[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80
[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297
[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000
[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d
[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000
[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640
[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000
[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000
[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0
[   28.020071] Stack:
[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88
[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8
[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340
[   28.020071] Call Trace:
[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540
[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540
[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460
[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540
[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70
[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200

Signed-off-by: Shaohua Li <shli@fb.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 kernel/workqueue.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 82d0c8d..e80693f 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1442,13 +1442,13 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq,
 	timer_stats_timer_set_start_info(&dwork->timer);
 
 	dwork->wq = wq;
+	/* timer isn't guaranteed to run in this cpu, record earlier */
+	if (cpu == WORK_CPU_UNBOUND)
+		cpu = raw_smp_processor_id();
 	dwork->cpu = cpu;
 	timer->expires = jiffies + delay;
 
-	if (unlikely(cpu != WORK_CPU_UNBOUND))
-		add_timer_on(timer, cpu);
-	else
-		add_timer(timer);
+	add_timer_on(timer, cpu);
 }
 
 /**
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268449 — [PATCH 3.19.y-ckt 058/155] drivers/tty: require read access for controlling terminal

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jann@thejh.net>

commit 0c55627167870255158db1cde0d28366f91c8872 upstream.

This is mostly a hardening fix, given that write-only access to other
users' ttys is usually only given through setgid tty executables.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/tty/tty_io.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 2bb4dfc..27051e29 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2138,8 +2138,24 @@ retry_open:
 	if (!noctty &&
 	    current->signal->leader &&
 	    !current->signal->tty &&
-	    tty->session == NULL)
-		__proc_set_tty(tty);
+	    tty->session == NULL) {
+		/*
+		 * Don't let a process that only has write access to the tty
+		 * obtain the privileges associated with having a tty as
+		 * controlling terminal (being able to reopen it with full
+		 * access through /dev/tty, being able to perform pushback).
+		 * Many distributions set the group of all ttys to "tty" and
+		 * grant write-only access to all terminals for setgid tty
+		 * binaries, which should not imply full privileges on all ttys.
+		 *
+		 * This could theoretically break old code that performs open()
+		 * on a write-only file descriptor. In that case, it might be
+		 * necessary to also permit this if
+		 * inode_permission(inode, MAY_READ) == 0.
+		 */
+		if (filp->f_mode & FMODE_READ)
+			__proc_set_tty(tty);
+	}
 	spin_unlock_irq(&current->sighand->siglock);
 	read_unlock(&tasklist_lock);
 	tty_unlock(tty);
@@ -2428,7 +2444,7 @@ static int fionbio(struct file *file, int __user *p)
  *		Takes ->siglock() when updating signal->tty
  */
 
-static int tiocsctty(struct tty_struct *tty, int arg)
+static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
 {
 	int ret = 0;
 
@@ -2462,6 +2478,13 @@ static int tiocsctty(struct tty_struct *tty, int arg)
 			goto unlock;
 		}
 	}
+
+	/* See the comment in tty_open(). */
+	if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
+		ret = -EPERM;
+		goto unlock;
+	}
+
 	proc_set_tty(tty);
 unlock:
 	read_unlock(&tasklist_lock);
@@ -2854,7 +2877,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		no_tty();
 		return 0;
 	case TIOCSCTTY:
-		return tiocsctty(tty, arg);
+		return tiocsctty(tty, file, arg);
 	case TIOCGPGRP:
 		return tiocgpgrp(tty, real_tty, p);
 	case TIOCSPGRP:
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268450 — [PATCH 3.19.y-ckt 059/155] staging: speakup: fix speakup-r regression

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: "covici@ccs.covici.com" <covici@ccs.covici.com>

commit b1d562acc78f0af46de0dfe447410bc40bdb7ece upstream.

Here is a patch to make speakup-r work again.

It broke in 3.6 due to commit 4369c64c79a22b98d3b7eff9d089196cd878a10a
"Input: Send events one packet at a time)

The problem was that the fakekey.c routine to fake a down arrow no
longer functioned properly and putting the input_sync fixed it.

Fixes: 4369c64c79a22b98d3b7eff9d089196cd878a10a
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: John Covici <covici@ccs.covici.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/staging/speakup/fakekey.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/staging/speakup/fakekey.c b/drivers/staging/speakup/fakekey.c
index 4299cf4..5e1f16c 100644
--- a/drivers/staging/speakup/fakekey.c
+++ b/drivers/staging/speakup/fakekey.c
@@ -81,6 +81,7 @@ void speakup_fake_down_arrow(void)
 	__this_cpu_write(reporting_keystroke, true);
 	input_report_key(virt_keyboard, KEY_DOWN, PRESSED);
 	input_report_key(virt_keyboard, KEY_DOWN, RELEASED);
+	input_sync(virt_keyboard);
 	__this_cpu_write(reporting_keystroke, false);
 
 	/* reenable preemption */
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268451 — [PATCH 3.19.y-ckt 053/155] ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: John Flatness <john@zerocrates.org>

commit e8ff581f7ac2bc3b8886094b7ca635dcc4d1b0e9 upstream.

The MacBookPro 12,1 has the same setup as the 11 for controlling the
status of the optical audio light. Simply apply the existing workaround
to the subsystem ID for the 12,1.

[sorted the fixup entry by tiwai]

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=105401
Signed-off-by: John Flatness <john@zerocrates.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/pci/hda/patch_cirrus.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
index e5dac8e..1b3b38d 100644
--- a/sound/pci/hda/patch_cirrus.c
+++ b/sound/pci/hda/patch_cirrus.c
@@ -634,6 +634,7 @@ static const struct snd_pci_quirk cs4208_mac_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x106b, 0x5e00, "MacBookPro 11,2", CS4208_MBP11),
 	SND_PCI_QUIRK(0x106b, 0x7100, "MacBookAir 6,1", CS4208_MBA6),
 	SND_PCI_QUIRK(0x106b, 0x7200, "MacBookAir 6,2", CS4208_MBA6),
+	SND_PCI_QUIRK(0x106b, 0x7b00, "MacBookPro 12,1", CS4208_MBP11),
 	{} /* terminator */
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268452 — [PATCH 3.19.y-ckt 018/155] x86/asm/entry: Create and use a 'TOP_OF_KERNEL_STACK_PADDING' macro

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Lutomirski <luto@amacapital.net>

commit 3ee4298f440c81638cbb5ec06f2497fb7a9a9eb4 upstream.

x86_32, unlike x86_64, pads the top of the kernel stack, because the
hardware stack frame formats are variable in size.

Document this padding and give it a name.

This should make no change whatsoever to the compiled kernel
image. It also doesn't fix any of the current bugs in this area.

Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Acked-by: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/02bf2f54b8dcb76a62a142b6dfe07d4ef7fc582e.1426009661.git.luto@amacapital.net
[ Fixed small details, such as a missed magic constant in entry_32.S pointed out by Denys Vlasenko. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[ kamal: 3.19-stable prereq for
  eddd382 x86/process: Add proper bound checks in 64bit get_wchan() ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/include/asm/processor.h   |  3 ++-
 arch/x86/include/asm/thread_info.h | 27 +++++++++++++++++++++++++++
 arch/x86/kernel/entry_32.S         |  2 +-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index a092a0c..401a988 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -886,7 +886,8 @@ extern unsigned long thread_saved_pc(struct task_struct *tsk);
 #define task_pt_regs(task)                                             \
 ({                                                                     \
        struct pt_regs *__regs__;                                       \
-       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
+       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task)) - \
+				     TOP_OF_KERNEL_STACK_PADDING);     \
        __regs__ - 1;                                                   \
 })
 
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 547e344..c4d9694 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -13,6 +13,33 @@
 #include <asm/types.h>
 
 /*
+ * TOP_OF_KERNEL_STACK_PADDING is a number of unused bytes that we
+ * reserve at the top of the kernel stack.  We do it because of a nasty
+ * 32-bit corner case.  On x86_32, the hardware stack frame is
+ * variable-length.  Except for vm86 mode, struct pt_regs assumes a
+ * maximum-length frame.  If we enter from CPL 0, the top 8 bytes of
+ * pt_regs don't actually exist.  Ordinarily this doesn't matter, but it
+ * does in at least one case:
+ *
+ * If we take an NMI early enough in SYSENTER, then we can end up with
+ * pt_regs that extends above sp0.  On the way out, in the espfix code,
+ * we can read the saved SS value, but that value will be above sp0.
+ * Without this offset, that can result in a page fault.  (We are
+ * careful that, in this case, the value we read doesn't matter.)
+ *
+ * In vm86 mode, the hardware frame is much longer still, but we neither
+ * access the extra members from NMI context, nor do we write such a
+ * frame at sp0 at all.
+ *
+ * x86_64 has a fixed-length stack frame.
+ */
+#ifdef CONFIG_X86_32
+# define TOP_OF_KERNEL_STACK_PADDING 8
+#else
+# define TOP_OF_KERNEL_STACK_PADDING 0
+#endif
+
+/*
  * low level task data that entry.S needs immediate access to
  * - this struct should fit entirely inside of one cache line
  * - this struct shares the supervisor stack pages
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 000d419..3890e21 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -398,7 +398,7 @@ sysenter_past_esp:
 	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
 	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
 	 */
-	pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+8+4*4)(%esp)
+	pushl_cfi ((TI_sysenter_return)-THREAD_SIZE+TOP_OF_KERNEL_STACK_PADDING+4*4)(%esp)
 	CFI_REL_OFFSET eip, 0
 
 	pushl_cfi %eax
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268453 — [PATCH 3.19.y-ckt 070/155] drm/radeon: add quirk for ASUS R7 370

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 2b02ec79004388a8c65e227bc289ed891b5ac8c6 upstream.

Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=92260

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/radeon/si_dpm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index c884df8..d67ce4c 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2924,6 +2924,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
+	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
 	{ 0, 0, 0, 0 },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268454 — [PATCH 3.19.y-ckt 074/155] drm/nouveau/fbcon: take runpm reference when userspace has an open fd

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Skeggs <bskeggs@redhat.com>

commit f231976c2e8964ceaa9250e57d27c35ff03825c2 upstream.

We need to do this in order to prevent accesses to the device while it's
powered down.  Userspace may have an mmap of the fb, and there's no good
way (that I know of) to prevent it from touching the device otherwise.

This fixes some nasty races between runpm and plymouth on some systems,
which result in the GPU getting very upset and hanging the boot.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/nouveau/nouveau_fbcon.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 3ed12a8..2d0ba16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info)
 	return 0;
 }
 
+static int
+nouveau_fbcon_open(struct fb_info *info, int user)
+{
+	struct nouveau_fbdev *fbcon = info->par;
+	struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
+	int ret = pm_runtime_get_sync(drm->dev->dev);
+	if (ret < 0 && ret != -EACCES)
+		return ret;
+	return 0;
+}
+
+static int
+nouveau_fbcon_release(struct fb_info *info, int user)
+{
+	struct nouveau_fbdev *fbcon = info->par;
+	struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
+	pm_runtime_put(drm->dev->dev);
+	return 0;
+}
+
 static struct fb_ops nouveau_fbcon_ops = {
 	.owner = THIS_MODULE,
+	.fb_open = nouveau_fbcon_open,
+	.fb_release = nouveau_fbcon_release,
 	.fb_check_var = drm_fb_helper_check_var,
 	.fb_set_par = drm_fb_helper_set_par,
 	.fb_fillrect = nouveau_fbcon_fillrect,
@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops = {
 
 static struct fb_ops nouveau_fbcon_sw_ops = {
 	.owner = THIS_MODULE,
+	.fb_open = nouveau_fbcon_open,
+	.fb_release = nouveau_fbcon_release,
 	.fb_check_var = drm_fb_helper_check_var,
 	.fb_set_par = drm_fb_helper_set_par,
 	.fb_fillrect = cfb_fillrect,
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268455 — [PATCH 3.19.y-ckt 019/155] x86/process: Add proper bound checks in 64bit get_wchan()

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit eddd3826a1a0190e5235703d1e666affa4d13b96 upstream.

Dmitry Vyukov reported the following using trinity and the memory
error detector AddressSanitizer
(https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel).

[ 124.575597] ERROR: AddressSanitizer: heap-buffer-overflow on
address ffff88002e280000
[ 124.576801] ffff88002e280000 is located 131938492886538 bytes to
the left of 28857600-byte region [ffffffff81282e0a, ffffffff82e0830a)
[ 124.578633] Accessed by thread T10915:
[ 124.579295] inlined in describe_heap_address
./arch/x86/mm/asan/report.c:164
[ 124.579295] #0 ffffffff810dd277 in asan_report_error
./arch/x86/mm/asan/report.c:278
[ 124.580137] #1 ffffffff810dc6a0 in asan_check_region
./arch/x86/mm/asan/asan.c:37
[ 124.581050] #2 ffffffff810dd423 in __tsan_read8 ??:0
[ 124.581893] #3 ffffffff8107c093 in get_wchan
./arch/x86/kernel/process_64.c:444

The address checks in the 64bit implementation of get_wchan() are
wrong in several ways:

 - The lower bound of the stack is not the start of the stack
   page. It's the start of the stack page plus sizeof (struct
   thread_info)

 - The upper bound must be:

       top_of_stack - TOP_OF_KERNEL_STACK_PADDING - 2 * sizeof(unsigned long).

   The 2 * sizeof(unsigned long) is required because the stack pointer
   points at the frame pointer. The layout on the stack is: ... IP FP
   ... IP FP. So we need to make sure that both IP and FP are in the
   bounds.

Fix the bound checks and get rid of the mix of numeric constants, u64
and unsigned long. Making all unsigned long allows us to use the same
function for 32bit as well.

Use READ_ONCE() when accessing the stack. This does not prevent a
concurrent wakeup of the task and the stack changing, but at least it
avoids TOCTOU.

Also check task state at the end of the loop. Again that does not
prevent concurrent changes, but it avoids walking for nothing.

Add proper comments while at it.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Based-on-patch-from: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Borislav Petkov <bp@alien8.de>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Kostya Serebryany <kcc@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: kasan-dev <kasan-dev@googlegroups.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Wolfram Gloger <wmglo@dent.med.uni-muenchen.de>
Link: http://lkml.kernel.org/r/20150930083302.694788319@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/x86/kernel/process_64.c | 52 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 42 insertions(+), 10 deletions(-)

diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index ec03938..1165b05 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -476,27 +476,59 @@ void set_personality_ia32(bool x32)
 }
 EXPORT_SYMBOL_GPL(set_personality_ia32);
 
+/*
+ * Called from fs/proc with a reference on @p to find the function
+ * which called into schedule(). This needs to be done carefully
+ * because the task might wake up and we might look at a stack
+ * changing under us.
+ */
 unsigned long get_wchan(struct task_struct *p)
 {
-	unsigned long stack;
-	u64 fp, ip;
+	unsigned long start, bottom, top, sp, fp, ip;
 	int count = 0;
 
 	if (!p || p == current || p->state == TASK_RUNNING)
 		return 0;
-	stack = (unsigned long)task_stack_page(p);
-	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+
+	start = (unsigned long)task_stack_page(p);
+	if (!start)
+		return 0;
+
+	/*
+	 * Layout of the stack page:
+	 *
+	 * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
+	 * PADDING
+	 * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
+	 * stack
+	 * ----------- bottom = start + sizeof(thread_info)
+	 * thread_info
+	 * ----------- start
+	 *
+	 * The tasks stack pointer points at the location where the
+	 * framepointer is stored. The data on the stack is:
+	 * ... IP FP ... IP FP
+	 *
+	 * We need to read FP and IP, so we need to adjust the upper
+	 * bound by another unsigned long.
+	 */
+	top = start + THREAD_SIZE - TOP_OF_KERNEL_STACK_PADDING;
+	top -= 2 * sizeof(unsigned long);
+	bottom = start + sizeof(struct thread_info);
+
+	sp = READ_ONCE(p->thread.sp);
+	if (sp < bottom || sp > top)
 		return 0;
-	fp = *(u64 *)(p->thread.sp);
+
+	fp = READ_ONCE(*(unsigned long *)sp);
 	do {
-		if (fp < (unsigned long)stack ||
-		    fp >= (unsigned long)stack+THREAD_SIZE)
+		if (fp < bottom || fp > top)
 			return 0;
-		ip = *(u64 *)(fp+8);
+		ip = READ_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
 		if (!in_sched_functions(ip))
 			return ip;
-		fp = *(u64 *)fp;
-	} while (count++ < 16);
+		fp = READ_ONCE(*(unsigned long *)fp);
+	} while (count++ < 16 && p->state != TASK_RUNNING);
 	return 0;
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268456 — [PATCH 3.19.y-ckt 049/155] clk: ti: fix dual-registration of uart4_ick

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Dooks <ben.dooks@codethink.co.uk>

commit 19e79687de22f23bcfb5e79cce3daba20af228d1 upstream.

On the OMAP AM3517 platform the uart4_ick gets registered
twice, causing any power management to /dev/ttyO3 to fail
when trying to wake the device up.

This solves the following oops:

[] Unhandled fault: external abort on non-linefetch (0x1028) at 0xfa09e008
[] PC is at serial_omap_pm+0x48/0x15c
[] LR is at _raw_spin_unlock_irqrestore+0x30/0x5c

Fixes: aafd900cab87 ("CLK: TI: add omap3 clock init file")
Cc: mturquette@baylibre.com
Cc: sboyd@codeaurora.org
Cc: linux-clk@vger.kernel.org
Cc: linux-omap@vger.kernel.org
Cc: linux-kernel@lists.codethink.co.uk
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Signed-off-by: Tero Kristo <t-kristo@ti.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/clk/ti/clk-3xxx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clk/ti/clk-3xxx.c b/drivers/clk/ti/clk-3xxx.c
index 0d1750a..088930c 100644
--- a/drivers/clk/ti/clk-3xxx.c
+++ b/drivers/clk/ti/clk-3xxx.c
@@ -170,7 +170,6 @@ static struct ti_dt_clk omap3xxx_clks[] = {
 	DT_CLK(NULL, "gpio2_ick", "gpio2_ick"),
 	DT_CLK(NULL, "wdt3_ick", "wdt3_ick"),
 	DT_CLK(NULL, "uart3_ick", "uart3_ick"),
-	DT_CLK(NULL, "uart4_ick", "uart4_ick"),
 	DT_CLK(NULL, "gpt9_ick", "gpt9_ick"),
 	DT_CLK(NULL, "gpt8_ick", "gpt8_ick"),
 	DT_CLK(NULL, "gpt7_ick", "gpt7_ick"),
@@ -313,6 +312,7 @@ static struct ti_dt_clk am35xx_clks[] = {
 static struct ti_dt_clk omap36xx_clks[] = {
 	DT_CLK(NULL, "omap_192m_alwon_fck", "omap_192m_alwon_fck"),
 	DT_CLK(NULL, "uart4_fck", "uart4_fck"),
+	DT_CLK(NULL, "uart4_ick", "uart4_ick"),
 	{ .node_name = NULL },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268457 — [PATCH 3.19.y-ckt 050/155] ASoC: dwc: correct irq clear method

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yitian Bu <buyitian@gmail.com>

commit 4873867e5f2bd90faad861dd94865099fc3140f3 upstream.

from Designware I2S datasheet, tx/rx XRUN irq is cleared by
reading register TOR/ROR, rather than by writing into them.

Signed-off-by: Yitian Bu <yitian.bu@tangramtek.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/soc/dwc/designware_i2s.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/dwc/designware_i2s.c b/sound/soc/dwc/designware_i2s.c
index 8d18bbd..ee0a392 100644
--- a/sound/soc/dwc/designware_i2s.c
+++ b/sound/soc/dwc/designware_i2s.c
@@ -100,10 +100,10 @@ static inline void i2s_clear_irqs(struct dw_i2s_dev *dev, u32 stream)
 
 	if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
 		for (i = 0; i < 4; i++)
-			i2s_write_reg(dev->i2s_base, TOR(i), 0);
+			i2s_read_reg(dev->i2s_base, TOR(i));
 	} else {
 		for (i = 0; i < 4; i++)
-			i2s_write_reg(dev->i2s_base, ROR(i), 0);
+			i2s_read_reg(dev->i2s_base, ROR(i));
 	}
 }
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268458 — [PATCH 3.19.y-ckt 069/155] drm/radeon: add quirk for MSI R7 370

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maxim Sheviakov <mrader3940@yandex.ru>

commit e78654799135a788a941bacad3452fbd7083e518 upstream.

Just adds the quirk for MSI R7 370 Armor 2X
Bug:
https://bugs.freedesktop.org/show_bug.cgi?id=91294

Signed-off-by: Maxim Sheviakov <mrader3940@yandex.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/gpu/drm/radeon/si_dpm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index fe252b0..c884df8 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2923,6 +2923,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1762, 0x2015, 0, 120000 },
 	{ 0, 0, 0, 0 },
 };
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268459 — [PATCH 3.19.y-ckt 048/155] [SMB3] Do not fall back to SMBWriteX in set_file_size error cases

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Steve French <smfrench@gmail.com>

commit 646200a041203f440fb6fcf9cacd9efeda9de74c upstream.

The error paths in set_file_size for cifs and smb3 are incorrect.

In the unlikely event that a server did not support set file info
of the file size, the code incorrectly falls back to trying SMBWriteX
(note that only the original core SMB Write, used for example by DOS,
can set the file size this way - this actually  does not work for the more
recent SMBWriteX).  The idea was since the old DOS SMB Write could set
the file size if you write zero bytes at that offset then use that if
server rejects the normal set file info call.

Fortunately the SMBWriteX will never be sent on the wire (except when
file size is zero) since the length and offset fields were reversed
in the two places in this function that call SMBWriteX causing
the fall back path to return an error. It is also important to never call
an SMB request from an SMB2/sMB3 session (which theoretically would
be possible, and can cause a brief session drop, although the client
recovers) so this should be fixed.  In practice this path does not happen
with modern servers but the error fall back to SMBWriteX is clearly wrong.

Removing the calls to SMBWriteX in the error paths in cifs_set_file_size

Pointed out by PaX/grsecurity team

Signed-off-by: Steve French <steve.french@primarydata.com>
Reported-by: PaX Team <pageexec@freemail.hu>
CC: Emese Revfy <re.emese@gmail.com>
CC: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/cifs/inode.c | 34 ----------------------------------
 1 file changed, 34 deletions(-)

diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 0c3ce464..c88a827 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -2010,7 +2010,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
 	struct tcon_link *tlink = NULL;
 	struct cifs_tcon *tcon = NULL;
 	struct TCP_Server_Info *server;
-	struct cifs_io_parms io_parms;
 
 	/*
 	 * To avoid spurious oplock breaks from server, in the case of
@@ -2032,18 +2031,6 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
 			rc = -ENOSYS;
 		cifsFileInfo_put(open_file);
 		cifs_dbg(FYI, "SetFSize for attrs rc = %d\n", rc);
-		if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
-			unsigned int bytes_written;
-
-			io_parms.netfid = open_file->fid.netfid;
-			io_parms.pid = open_file->pid;
-			io_parms.tcon = tcon;
-			io_parms.offset = 0;
-			io_parms.length = attrs->ia_size;
-			rc = CIFSSMBWrite(xid, &io_parms, &bytes_written,
-					  NULL, NULL, 1);
-			cifs_dbg(FYI, "Wrt seteof rc %d\n", rc);
-		}
 	} else
 		rc = -EINVAL;
 
@@ -2069,28 +2056,7 @@ cifs_set_file_size(struct inode *inode, struct iattr *attrs,
 	else
 		rc = -ENOSYS;
 	cifs_dbg(FYI, "SetEOF by path (setattrs) rc = %d\n", rc);
-	if ((rc == -EINVAL) || (rc == -EOPNOTSUPP)) {
-		__u16 netfid;
-		int oplock = 0;
 
-		rc = SMBLegacyOpen(xid, tcon, full_path, FILE_OPEN,
-				   GENERIC_WRITE, CREATE_NOT_DIR, &netfid,
-				   &oplock, NULL, cifs_sb->local_nls,
-				   cifs_remap(cifs_sb));
-		if (rc == 0) {
-			unsigned int bytes_written;
-
-			io_parms.netfid = netfid;
-			io_parms.pid = current->tgid;
-			io_parms.tcon = tcon;
-			io_parms.offset = 0;
-			io_parms.length = attrs->ia_size;
-			rc = CIFSSMBWrite(xid, &io_parms, &bytes_written, NULL,
-					  NULL,  1);
-			cifs_dbg(FYI, "wrt seteof rc %d\n", rc);
-			CIFSSMBClose(xid, tcon, netfid);
-		}
-	}
 	if (tlink)
 		cifs_put_tlink(tlink);
 
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268461 — [PATCH 3.19.y-ckt 046/155] ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>

commit e256da84a04ea31c3c215997c847609af224e8f4 upstream.

Signed-off-by: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/soc/codecs/sgtl5000.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index 10d2415..d91790e 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -1337,8 +1337,8 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
 			sgtl5000->micbias_resistor << SGTL5000_BIAS_R_SHIFT);
 
 	snd_soc_update_bits(codec, SGTL5000_CHIP_MIC_CTRL,
-			SGTL5000_BIAS_R_MASK,
-			sgtl5000->micbias_voltage << SGTL5000_BIAS_R_SHIFT);
+			SGTL5000_BIAS_VOLT_MASK,
+			sgtl5000->micbias_voltage << SGTL5000_BIAS_VOLT_SHIFT);
 	/*
 	 * disable DAP
 	 * TODO:
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268712 — Re: [PATCH 3.19.y-ckt 046/155] ASoC: sgtl5000: fix wrong register MIC_BIAS_VOLTAGE setup on probe

On 11/13/2015 12:16 AM, Kamal Mostafa wrote:
> 3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.
>

yes, it should works. Please add the correct message in the device-tree 
probe for the micbias voltage too. Just to have the same behaviour.


> ------------------
>
> From: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
>
> commit e256da84a04ea31c3c215997c847609af224e8f4 upstream.
>
> Signed-off-by: Gianluca Renzi <gianlucarenzi@eurekelettronica.it>
> Signed-off-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Kamal Mostafa <kamal@canonical.com>
> ---
>   sound/soc/codecs/sgtl5000.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
> index 10d2415..d91790e 100644
> --- a/sound/soc/codecs/sgtl5000.c
> +++ b/sound/soc/codecs/sgtl5000.c
> @@ -1337,8 +1337,8 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
>   			sgtl5000->micbias_resistor << SGTL5000_BIAS_R_SHIFT);
>
>   	snd_soc_update_bits(codec, SGTL5000_CHIP_MIC_CTRL,
> -			SGTL5000_BIAS_R_MASK,
> -			sgtl5000->micbias_voltage << SGTL5000_BIAS_R_SHIFT);
> +			SGTL5000_BIAS_VOLT_MASK,
> +			sgtl5000->micbias_voltage << SGTL5000_BIAS_VOLT_SHIFT);
>   	/*
>   	 * disable DAP
>   	 * TODO:
>


-- 
Eurek s.r.l.                          |
Electronic Engineering                | http://www.eurek.it
via Celletta 8/B, 40026 Imola, Italy  | Phone: +39-(0)542-609120
p.iva 00690621206 - c.f. 04020030377  | Fax:   +39-(0)542-609212
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1268462 — [PATCH 3.19.y-ckt 062/155] ASoC: tas2552: Correct the Speaker Driver Playback Volume (PGA_GAIN)

3.19.8-ckt10 -stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Ujfalusi <peter.ujfalusi@ti.com>

commit dd6ae3bcfe0fa9cf1bdb6f952c617f2070c57b37 upstream.

The last parameter for DECLARE_TLV_DB_SCALE() is to tell if the gain will
be muted or not when it is set to raw 0. IN this case it is not muted.
The PGA_GAIN is in 0-4 bits in the register. Fix the offset in the
SOC_SINGLE_TLV() for this.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 sound/soc/codecs/tas2552.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
index 8f9d1e6..6c76015 100644
--- a/sound/soc/codecs/tas2552.c
+++ b/sound/soc/codecs/tas2552.c
@@ -333,11 +333,11 @@ static struct snd_soc_dai_driver tas2552_dai[] = {
 /*
  * DAC digital volumes. From -7 to 24 dB in 1 dB steps
  */
-static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 24);
+static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 0);
 
 static const struct snd_kcontrol_new tas2552_snd_controls[] = {
 	SOC_SINGLE_TLV("Speaker Driver Playback Volume",
-			 TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
+			 TAS2552_PGA_GAIN, 0, 0x1f, 0, dac_tlv),
 };
 
 static const struct reg_default tas2552_init_regs[] = {
-- 
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 6 of 9 — ← Prev page 1 2 3 4 5 [6] 7 8 9  Next page →

Back to top | Article view | linux.kernel

csiph-web