Groups > linux.kernel > #1269580 > unrolled thread

[PATCH 3.2 00/60] 3.2.73-rc1 review

Started by	Ben Hutchings <ben@decadent.org.uk>
First post	2015-11-15 03:10 +0100
Last post	2015-11-16 12:20 +0100
Articles	20 on this page of 44 — 2 participants

Back to article view | Back to linux.kernel

  [PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing  nodes after removal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 12/60] genirq: Fix race in register_irq_proc() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 31/60] iommu/vt-d: fix range computation when making  room for large pages Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 28/60] xen-blkfront: check for null drvdata in  blkback_changed (XenbusStateClosing) Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 32/60] xhci: don't finish a TD if we get a short  transfer event mid TD Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when  bad-block-list write fails. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing  when calculating max length Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
    [PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772 Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 08/60] UBI: Validate data_size Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 53/60] skbuff: Fix skb checksum partial check. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and  use-after-free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 33/60] xhci: handle no ping response error properly Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics  usb headphones. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in  btree_split_beneath error path Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before  calling enter_rtas() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI  on shutdown. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 07/60] x86/xen: Do not clip xen_e820_map to  xen_e820_map_entries when sanitizing map Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 03/60] regmap: debugfs: Ensure we don't underflow when  printing access masks Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 51/60] net: add length argument to  skb_copy_and_csum_datagram_iovec Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 05/60] ath9k: declare required extra tx headroom Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 39/60] drm/nouveau/gem: return only valid domain when  there's only one Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 06/60] m68k: Define asmlinkage_protect Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 26/60] sched/core: Fix TASK_DEAD race in  finish_task_switch() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 45/60] md/raid1: ensure device failure recorded before  write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 15/60] md/raid0: update queue parameter in a safer  location. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 59/60] KEYS: Fix race between key destruction and  finding a keyring by name Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 23/60] ppp: don't override sk->sk_state in  pppoe_flush_dev() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 49/60] mvsas: Fix NULL pointer dereference in  mvs_slot_task_free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 58/60] KVM: x86: work around infinite loop in  microcode when #AC is delivered Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
    [PATCH 3.2 42/60] ppp: fix pppoe_dev deletion condition in  pppoe_release() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 10/60] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 50/60] sched: declare pid_alive as inline Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 17/60] clocksource: Fix abs() usage w/ 64bit values Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 36/60] crypto: api - Only abort operations on fatal signal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 16/60] md/raid0: apply base queue limits *before*  disk_stack_limits Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 47/60] md/raid10: ensure device failure recorded  before write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 57/60] Failing to send a CLOSE if file is opened  WRONLY and server reboots on a 4.x mount Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    [PATCH 3.2 14/60] [SMB3] Do not fall back to SMBWriteX in  set_file_size error cases Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
    Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-11-15 14:50 +0100
      Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-16 12:20 +0100

Page 1 of 3 [1] 2 3 Next page →

#1269580 — [PATCH 3.2 00/60] 3.2.73-rc1 review

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 00/60] 3.2.73-rc1 review
Message-ID	<quUVr-3GF-3@gated-at.bofh.it>

This is the start of the stable review cycle for the 3.2.73 release.
There are 60 patches in this series, which will be posted as responses
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Tue Nov 17 09:00:00 UTC 2015.
Anything received after that time might be too late.

A combined patch relative to 3.2.72 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

Ben.

-------------

Andreas Schwab (1):
      m68k: Define asmlinkage_protect
         [8474ba74193d302e8340dddd1e16c85cc4b98caf]

Ben Hutchings (2):
      Revert "KVM: MMU: fix validation of mmio page fault"
         [not upstream; the fix was needed in mainline but not in 3.2]
      genirq: Fix race in register_irq_proc()
         [95c2b17534654829db428f11bcf4297c059a2a7e]

Cathy Avery (1):
      xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
         [a54c8f0f2d7df525ff997e2afe71866a1a013064]

Charles Keepax (2):
      ASoC: wm8904: Correct number of EQ registers
         [97aff2c03a1e4d343266adadb52313613efb027f]
      asix: Do full reset during ax88772_bind
         [436c2a5036b6ffe813310df2cf327d3b69be0734]

Christian Zander (1):
      iommu/vt-d: fix range computation when making room for large pages
         [ba2374fd2bf379f933773811fdb06cb6a5445f41]

Christoph Hellwig (1):
      3w-9xxx: don't unmap bounce buffered commands
         [15e3d5a285ab9283136dba34bbf72886d9146706]

Dan Carpenter (1):
      iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
         [eda7d0f38aaf50dbb2a2de15e8db386c4f6f65fc]

David Henningsson (1):
      ALSA: hda - Fix inverted internal mic on Lenovo G50-80
         [e8d65a8d985271a102f07c7456da5b86c19ffe16]

David Howells (2):
      KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
         [f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61]
      KEYS: Fix race between key destruction and finding a keyring by name
         [94c4554ba07adbdde396748ee7ae01e86cf2d8d7]

Denis Turischev (1):
      xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.
         [c09ec25d3684cad74d851c0f028a495999591279,
          0a939993bff117d3657108ca13b011fc0378aedb]

Doron Tsur (1):
      IB/cm: Fix rb-tree duplicate free and use-after-free
         [0ca81a2840f77855bbad1b9f172c545c4dc9e6a4]

Dāvis Mosāns (1):
      mvsas: Fix NULL pointer dereference in mvs_slot_task_free
         [2280521719e81919283b82902ac24058f87dfc1b]

Eric Northup (1):
      KVM: x86: work around infinite loop in microcode when #AC is delivered
         [54a20552e1eae07aa240fa370a0293e006b5faed]

Felix Fietkau (1):
      ath9k: declare required extra tx headroom
         [029cd0370241641eb70235d205aa0b90c84dce44]

Guillaume Nault (2):
      ppp: don't override sk->sk_state in pppoe_flush_dev()
         [e6740165b8f7f06d8caee0fceab3fb9d790a6fed]
      ppp: fix pppoe_dev deletion condition in pppoe_release()
         [1acea4f6ce1b1c0941438aca75dd2e5c6b09db60]

Herbert Xu (1):
      crypto: api - Only abort operations on fatal signal
         [3fc89adb9fa4beff31374a4bf50b3d099d88ae83]

Ilia Mirkin (1):
      drm/nouveau/gem: return only valid domain when there's only one
         [2a6c521bb41ce862e43db46f52e7681d33e8d771]

James Hogan (1):
      MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
         [53960059d56ecef67d4ddd546731623641a3d2d1]

Jan Kara (1):
      mm: make sendfile(2) killable
         [296291cdd1629c308114504b850dc343eabc2782]

Jann Horn (1):
      drivers/tty: require read access for controlling terminal
         [0c55627167870255158db1cde0d28366f91c8872]

Joe Perches (1):
      ethtool: Use kcalloc instead of kmalloc for  ethtool_get_strings
         [077cb37fcf6f00a45f375161200b5ee0cd4e937b]

Joe Thornber (1):
      dm btree remove: fix a bug when rebalancing nodes after removal
         [2871c69e025e8bc507651d5a9cf81a8a7da9d24b]

Johannes Berg (1):
      iwlwifi: dvm: fix D3 firmware PN programming
         [5bd166872d8f99f156fac191299d24f828bb2348]

John Stultz (1):
      clocksource: Fix abs() usage w/ 64bit values
         [67dfae0cd72fec5cd158b6e5fb1647b7dbe0834c]

Kosuke Tatsukawa (1):
      tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
         [e81107d4c6bd098878af9796b24edc8d4a9524fd]

Laura Abbott (1):
      xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
         [fd7cd061adcf5f7503515ba52b6a724642a839c8]

Malcolm Crossley (1):
      x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map
         [64c98e7f49100b637cd20a6c63508caed6bbba7a]

Mark Brown (2):
      regmap: debugfs: Don't bother actually printing when calculating max length
         [176fc2d5770a0990eebff903ba680d2edd32e718]
      regmap: debugfs: Ensure we don't underflow when printing access masks
         [b763ec17ac762470eec5be8ebcc43e4f8b2c2b82]

Mathias Nyman (2):
      xhci: don't finish a TD if we get a short transfer event mid TD
         [e210c422b6fdd2dc123bedc588f399aefd8bf9de]
      xhci: handle no ping response error properly
         [3b4739b8951d650becbcd855d7d6f18ac98a9a85]

Mel Gorman (1):
      mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy a fault
         [2f84a8990ebbe235c59716896e017c6b2ca1200f]

Michel Stam (1):
      asix: Don't reset PHY on if_up for ASIX 88772
         [3cc81d85ee01e5a0b7ea2f4190e2ed1165f53c31]

Mike Snitzer (1):
      dm btree: fix leak of bufio-backed block in btree_split_beneath error path
         [4dcb8b57df3593dcb20481d9d6cf79d1dc1534be]

NeilBrown (6):
      md/raid0: apply base queue limits *before* disk_stack_limits
         [66eefe5de11db1e0d8f2edc3880d50e7c36a9d43]
      md/raid0: update queue parameter in a safer location.
         [199dc6ed5179251fa6158a461499c24bdd99c836]
      md/raid10: don't clear bitmap bit when bad-block-list write fails.
         [c340702ca26a628832fade4f133d8160a55c29cc]
      md/raid10: ensure device failure recorded before write request returns.
         [95af587e95aacb9cfda4a9641069a5244a540dc8]
      md/raid1: don't clear bitmap bit when bad-block-list write fails.
         [bd8688a199b864944bf62eebed0ca13b46249453]
      md/raid1: ensure device failure recorded before write request returns.
         [55ce74d4bfe1b9444436264c637f39a152d1e5ac]

Olga Kornievskaia (1):
      Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount
         [a41cbe86df3afbc82311a1640e20858c0cd7e065]

Peter Zijlstra (2):
      module: Fix locking in symbol_put_addr()
         [275d7d44d802ef271a42dc87ac091a495ba72fc5]
      sched/core: Fix TASK_DEAD race in finish_task_switch()
         [95913d97914f44db2b81271c2e2ebd4d2ac2df83]

Pravin B Shelar (2):
      skbuff: Fix skb checksum flag on skb pull
         [6ae459bdaaeebc632b16e54dcbabb490c6931d61]
      skbuff: Fix skb checksum partial check.
         [31b33dfb0a144469dd805514c9e63f4993729a48]

Richard Guy Briggs (1):
      sched: declare pid_alive as inline
         [80e0b6e8a001361316a2d62b748fe677ec46b860]

Richard Weinberger (1):
      UBI: Validate data_size
         [281fda27673f833a01d516658a64d22a32c8e072]

Russell King (1):
      crypto: ahash - ensure statesize is non-zero
         [8996eafdcbad149ac0f772fb1649fbb75c482a6a]

Sabrina Dubroca (1):
      net: add length argument to  skb_copy_and_csum_datagram_iovec
         [227158db160449b6513d2e31894a135104b90e90,
	  8961749e5f498d91ded20dc797bb77aa366bca2e,
	  f4362a2c9524678f0459cf410403f8595e5cfce5]

Shengyong (1):
      UBI: return ENOSPC if no enough space available
         [7c7feb2ebfc9c0552c51f0c050db1d1a004faac5]

Steve French (1):
      [SMB3] Do not fall back to SMBWriteX in set_file_size error cases
         [646200a041203f440fb6fcf9cacd9efeda9de74c]

Takashi Iwai (1):
      ALSA: synth: Fix conflicting OSS device registration on AWE32
         [225db5762dc1a35b26850477ffa06e5cd0097243]

Thomas Gleixner (1):
      x86/process: Add proper bound checks in 64bit get_wchan()
         [eddd3826a1a0190e5235703d1e666affa4d13b96]

Vasant Hegde (1):
      powerpc/rtas: Validate rtas.entry before calling enter_rtas()
         [8832317f662c06f5c06e638f57bfe89a71c9b266]

Vincent Palatin (1):
      usb: Add device quirk for Logitech PTZ cameras
         [72194739f54607bbf8cfded159627a2015381557]

Yao-Wen Mao (1):
      USB: Add reset-resume quirk for two Plantronics usb headphones.
         [8484bf2981b3d006426ac052a3642c9ce1d8d980]

 Makefile                                     |  4 +--
 arch/m68k/include/asm/linkage.h              | 30 ++++++++++++++++
 arch/mips/mm/dma-default.c                   |  2 +-
 arch/powerpc/kernel/rtas.c                   |  3 ++
 arch/x86/include/asm/kvm_host.h              |  1 +
 arch/x86/kernel/process_64.c                 | 52 ++++++++++++++++++++++------
 arch/x86/kvm/mmu.c                           | 45 ++++++++++++++++++++++++
 arch/x86/kvm/svm.c                           |  8 +++++
 arch/x86/kvm/trace.h                         |  1 +
 arch/x86/kvm/vmx.c                           |  5 ++-
 arch/x86/xen/setup.c                         |  2 +-
 crypto/ablkcipher.c                          |  2 +-
 crypto/ahash.c                               |  3 +-
 crypto/algapi.c                              |  2 +-
 crypto/api.c                                 |  6 ++--
 drivers/base/regmap/regmap-debugfs.c         |  5 ++-
 drivers/block/xen-blkfront.c                 |  3 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c        |  5 +--
 drivers/infiniband/core/cm.c                 | 10 +++++-
 drivers/iommu/intel-iommu.c                  | 19 ++++++----
 drivers/md/md.c                              |  1 +
 drivers/md/persistent-data/dm-btree-remove.c | 17 +++++----
 drivers/md/persistent-data/dm-btree.c        |  2 +-
 drivers/md/raid0.c                           | 46 ++++++++++++++----------
 drivers/md/raid1.c                           | 38 ++++++++++++++++++--
 drivers/md/raid1.h                           |  5 +++
 drivers/md/raid10.c                          | 42 +++++++++++++++++++---
 drivers/md/raid10.h                          |  6 ++++
 drivers/mtd/ubi/io.c                         |  5 +++
 drivers/mtd/ubi/vtbl.c                       |  1 +
 drivers/mtd/ubi/wl.c                         |  1 +
 drivers/net/ppp/pppoe.c                      |  3 +-
 drivers/net/usb/asix.c                       | 16 ++-------
 drivers/net/wireless/ath/ath9k/init.c        |  1 +
 drivers/net/wireless/iwlwifi/iwl-agn.c       |  2 +-
 drivers/scsi/3w-9xxx.c                       | 28 +++++++++++----
 drivers/scsi/mvsas/mv_sas.c                  |  2 ++
 drivers/staging/iio/accel/sca3000_ring.c     |  2 +-
 drivers/tty/n_tty.c                          |  6 ++--
 drivers/tty/tty_io.c                         | 31 ++++++++++++++---
 drivers/usb/core/quirks.c                    | 13 +++++++
 drivers/usb/host/xhci-pci.c                  |  5 +++
 drivers/usb/host/xhci-ring.c                 | 30 +++++++++++++---
 fs/cifs/inode.c                              | 39 +--------------------
 fs/nfs/nfs4state.c                           |  2 +-
 include/linux/sched.h                        |  2 +-
 include/linux/skbuff.h                       |  6 +++-
 include/sound/wm8904.h                       |  2 +-
 kernel/irq/proc.c                            | 19 ++++++++--
 kernel/module.c                              |  8 +++--
 kernel/sched.c                               | 14 ++++----
 kernel/time/clocksource.c                    |  2 +-
 mm/filemap.c                                 |  9 ++---
 mm/hugetlb.c                                 |  8 +++++
 net/core/datagram.c                          |  6 +++-
 net/core/ethtool.c                           |  2 +-
 net/core/skbuff.c                            |  9 ++---
 net/ipv4/tcp_input.c                         |  2 +-
 net/ipv4/udp.c                               |  2 +-
 net/ipv6/raw.c                               |  2 +-
 net/ipv6/udp.c                               |  3 +-
 net/rxrpc/ar-recvmsg.c                       |  3 +-
 security/keys/gc.c                           | 10 +++---
 sound/pci/hda/patch_conexant.c               |  1 +
 sound/synth/emux/emux_oss.c                  |  3 +-
 65 files changed, 488 insertions(+), 177 deletions(-)

-- 
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
                                                           - Albert Einstein

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1269581 — [PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing nodes after removal

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing nodes after removal
Message-ID	<quUVt-3GF-45@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Joe Thornber <ejt@redhat.com>

commit 2871c69e025e8bc507651d5a9cf81a8a7da9d24b upstream.

Commit 4c7e309340ff ("dm btree remove: fix bug in redistribute3") wasn't
a complete fix for redistribute3().

The redistribute3 function takes 3 btree nodes and shares out the entries
evenly between them.  If the three nodes in total contained
(MAX_ENTRIES * 3) - 1 entries between them then this was erroneously getting
rebalanced as (MAX_ENTRIES - 1) on the left and right, and (MAX_ENTRIES + 1) in
the center.

Fix this issue by being more careful about calculating the target number
of entries for the left and right nodes.

Unit tested in userspace using this program:
https://github.com/jthornber/redistribute3-test/blob/master/redistribute3_t.c

Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/md/persistent-data/dm-btree-remove.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

--- a/drivers/md/persistent-data/dm-btree-remove.c
+++ b/drivers/md/persistent-data/dm-btree-remove.c
@@ -301,11 +301,16 @@ static void redistribute3(struct dm_btre
 {
 	int s;
 	uint32_t max_entries = le32_to_cpu(left->header.max_entries);
-	unsigned target = (nr_left + nr_center + nr_right) / 3;
-	BUG_ON(target > max_entries);
+	unsigned total = nr_left + nr_center + nr_right;
+	unsigned target_right = total / 3;
+	unsigned remainder = (target_right * 3) != total;
+	unsigned target_left = target_right + remainder;
+
+	BUG_ON(target_left > max_entries);
+	BUG_ON(target_right > max_entries);
 
 	if (nr_left < nr_right) {
-		s = nr_left - target;
+		s = nr_left - target_left;
 
 		if (s < 0 && nr_center < -s) {
 			/* not enough in central node */
@@ -316,10 +321,10 @@ static void redistribute3(struct dm_btre
 		} else
 			shift(left, center, s);
 
-		shift(center, right, target - nr_right);
+		shift(center, right, target_right - nr_right);
 
 	} else {
-		s = target - nr_right;
+		s = target_right - nr_right;
 		if (s > 0 && nr_center < s) {
 			/* not enough in central node */
 			shift(center, right, nr_center);
@@ -329,7 +334,7 @@ static void redistribute3(struct dm_btre
 		} else
 			shift(center, right, s);
 
-		shift(left, center, nr_left - target);
+		shift(left, center, nr_left - target_left);
 	}
 
 	*key_ptr(parent, c->index) = center->keys[0];

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269582 — [PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands
Message-ID	<quUVt-3GF-41@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Christoph Hellwig <hch@lst.de>

commit 15e3d5a285ab9283136dba34bbf72886d9146706 upstream.

3w controller don't dma map small single SGL entry commands but instead
bounce buffer them.  Add a helper to identify these commands and don't
call scsi_dma_unmap for them.

Based on an earlier patch from James Bottomley.

Fixes: 118c85 ("3w-9xxx: fix command completion race")
Reported-by: Tóth Attila <atoth@atoth.sote.hu>
Tested-by: Tóth Attila <atoth@atoth.sote.hu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/scsi/3w-9xxx.c | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

--- a/drivers/scsi/3w-9xxx.c
+++ b/drivers/scsi/3w-9xxx.c
@@ -225,6 +225,17 @@ static const struct file_operations twa_
 	.llseek		= noop_llseek,
 };
 
+/*
+ * The controllers use an inline buffer instead of a mapped SGL for small,
+ * single entry buffers.  Note that we treat a zero-length transfer like
+ * a mapped SGL.
+ */
+static bool twa_command_mapped(struct scsi_cmnd *cmd)
+{
+	return scsi_sg_count(cmd) != 1 ||
+		scsi_bufflen(cmd) >= TW_MIN_SGL_LENGTH;
+}
+
 /* This function will complete an aen request from the isr */
 static int twa_aen_complete(TW_Device_Extension *tw_dev, int request_id)
 {
@@ -1351,7 +1362,8 @@ static irqreturn_t twa_interrupt(int irq
 				}
 
 				/* Now complete the io */
-				scsi_dma_unmap(cmd);
+				if (twa_command_mapped(cmd))
+					scsi_dma_unmap(cmd);
 				cmd->scsi_done(cmd);
 				tw_dev->state[request_id] = TW_S_COMPLETED;
 				twa_free_request_id(tw_dev, request_id);
@@ -1594,7 +1606,8 @@ static int twa_reset_device_extension(TW
 				struct scsi_cmnd *cmd = tw_dev->srb[i];
 
 				cmd->result = (DID_RESET << 16);
-				scsi_dma_unmap(cmd);
+				if (twa_command_mapped(cmd))
+					scsi_dma_unmap(cmd);
 				cmd->scsi_done(cmd);
 			}
 		}
@@ -1777,12 +1790,14 @@ static int twa_scsi_queue_lck(struct scs
 	retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
 	switch (retval) {
 	case SCSI_MLQUEUE_HOST_BUSY:
-		scsi_dma_unmap(SCpnt);
+		if (twa_command_mapped(SCpnt))
+			scsi_dma_unmap(SCpnt);
 		twa_free_request_id(tw_dev, request_id);
 		break;
 	case 1:
 		SCpnt->result = (DID_ERROR << 16);
-		scsi_dma_unmap(SCpnt);
+		if (twa_command_mapped(SCpnt))
+			scsi_dma_unmap(SCpnt);
 		done(SCpnt);
 		tw_dev->state[request_id] = TW_S_COMPLETED;
 		twa_free_request_id(tw_dev, request_id);
@@ -1843,8 +1858,7 @@ static int twa_scsiop_execute_scsi(TW_De
 		/* Map sglist from scsi layer to cmd packet */
 
 		if (scsi_sg_count(srb)) {
-			if ((scsi_sg_count(srb) == 1) &&
-			    (scsi_bufflen(srb) < TW_MIN_SGL_LENGTH)) {
+			if (!twa_command_mapped(srb)) {
 				if (srb->sc_data_direction == DMA_TO_DEVICE ||
 				    srb->sc_data_direction == DMA_BIDIRECTIONAL)
 					scsi_sg_copy_to_buffer(srb,
@@ -1917,7 +1931,7 @@ static void twa_scsiop_execute_scsi_comp
 {
 	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
 
-	if (scsi_bufflen(cmd) < TW_MIN_SGL_LENGTH &&
+	if (!twa_command_mapped(cmd) &&
 	    (cmd->sc_data_direction == DMA_FROM_DEVICE ||
 	     cmd->sc_data_direction == DMA_BIDIRECTIONAL)) {
 		if (scsi_sg_count(cmd) == 1) {

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269583 — [PATCH 3.2 12/60] genirq: Fix race in register_irq_proc()

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 12/60] genirq: Fix race in register_irq_proc()
Message-ID	<quUVt-3GF-47@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 95c2b17534654829db428f11bcf4297c059a2a7e upstream.

Per-IRQ directories in procfs are created only when a handler is first
added to the irqdesc, not when the irqdesc is created.  In the case of
a shared IRQ, multiple tasks can race to create a directory.  This
race condition seems to have been present forever, but is easier to
hit with async probing.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Link: http://lkml.kernel.org/r/1443266636.2004.2.camel@decadent.org.uk
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
 kernel/irq/proc.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -12,6 +12,7 @@
 #include <linux/seq_file.h>
 #include <linux/interrupt.h>
 #include <linux/kernel_stat.h>
+#include <linux/mutex.h>
 
 #include "internals.h"
 
@@ -326,18 +327,29 @@ void register_handler_proc(unsigned int
 
 void register_irq_proc(unsigned int irq, struct irq_desc *desc)
 {
+	static DEFINE_MUTEX(register_lock);
 	char name [MAX_NAMELEN];
 
-	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
+	if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
 		return;
 
+	/*
+	 * irq directories are registered only when a handler is
+	 * added, not when the descriptor is created, so multiple
+	 * tasks might try to register at the same time.
+	 */
+	mutex_lock(&register_lock);
+
+	if (desc->dir)
+		goto out_unlock;
+
 	memset(name, 0, MAX_NAMELEN);
 	sprintf(name, "%d", irq);
 
 	/* create /proc/irq/1234 */
 	desc->dir = proc_mkdir(name, root_irq_dir);
 	if (!desc->dir)
-		return;
+		goto out_unlock;
 
 #ifdef CONFIG_SMP
 	/* create /proc/irq/<irq>/smp_affinity */
@@ -358,6 +370,9 @@ void register_irq_proc(unsigned int irq,
 
 	proc_create_data("spurious", 0444, desc->dir,
 			 &irq_spurious_proc_fops, (void *)(long)irq);
+
+out_unlock:
+	mutex_unlock(&register_lock);
 }
 
 void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269584 — [PATCH 3.2 31/60] iommu/vt-d: fix range computation when making room for large pages

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 31/60] iommu/vt-d: fix range computation when making room for large pages
Message-ID	<quUVt-3GF-49@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Christian Zander <christian@nervanasys.com>

commit ba2374fd2bf379f933773811fdb06cb6a5445f41 upstream.

In preparation for the installation of a large page, any small page
tables that may still exist in the target IOV address range are
removed.  However, if a scatter/gather list entry is large enough to
fit more than one large page, the address space for any subsequent
large pages is not cleared of conflicting small page tables.

This can cause legitimate mapping requests to fail with errors of the
form below, potentially followed by a series of IOMMU faults:

ERROR: DMA PTE for vPFN 0xfde00 already set (to 7f83a4003 not 7e9e00083)

In this example, a 4MiB scatter/gather list entry resulted in the
successful installation of a large page @ vPFN 0xfdc00, followed by
a failed attempt to install another large page @ vPFN 0xfde00, due to
the presence of a pointer to a small page table @ 0x7f83a4000.

To address this problem, compute the number of large pages that fit
into a given scatter/gather list entry, and use it to derive the
last vPFN covered by the large page(s).

Signed-off-by: Christian Zander <christian@nervanasys.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
[bwh: Backported to 3.2:
 - Add the lvl_pages variable, added by an earlier commit upstream
 - Also change arguments to dma_pte_clear_range(), which is called by
   dma_pte_free_pagetable() upstream]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1798,13 +1798,20 @@ static int __domain_mapping(struct dmar_
 				return -ENOMEM;
 			/* It is large page*/
 			if (largepage_lvl > 1) {
+				unsigned long nr_superpages, end_pfn, lvl_pages;
+
 				pteval |= DMA_PTE_LARGE_PAGE;
-				/* Ensure that old small page tables are removed to make room
-				   for superpage, if they exist. */
-				dma_pte_clear_range(domain, iov_pfn,
-						    iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
-				dma_pte_free_pagetable(domain, iov_pfn,
-						       iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
+				lvl_pages = lvl_to_nr_pages(largepage_lvl);
+
+				nr_superpages = sg_res / lvl_pages;
+				end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
+
+				/*
+				 * Ensure that old small page tables are
+				 * removed to make room for superpage(s).
+				 */
+				dma_pte_clear_range(domain, iov_pfn, end_pfn);
+				dma_pte_free_pagetable(domain, iov_pfn, end_pfn);
 			} else {
 				pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
 			}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269585 — [PATCH 3.2 28/60] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 28/60] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)
Message-ID	<quUVt-3GF-51@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Cathy Avery <cathy.avery@oracle.com>

commit a54c8f0f2d7df525ff997e2afe71866a1a013064 upstream.

xen-blkfront will crash if the check to talk_to_blkback()
in blkback_changed()(XenbusStateInitWait) returns an error.
The driver data is freed and info is set to NULL. Later during
the close process via talk_to_blkback's call to xenbus_dev_fatal()
the null pointer is passed to and dereference in blkfront_closing.

Signed-off-by: Cathy Avery <cathy.avery@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/block/xen-blkfront.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -1292,7 +1292,8 @@ static void blkback_changed(struct xenbu
 			break;
 		/* Missed the backend's Closing state -- fallthrough */
 	case XenbusStateClosing:
-		blkfront_closing(info);
+		if (info)
+			blkfront_closing(info);
 		break;
 	}
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269586 — [PATCH 3.2 32/60] xhci: don't finish a TD if we get a short transfer event mid TD

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 32/60] xhci: don't finish a TD if we get a short transfer event mid TD
Message-ID	<quUVt-3GF-55@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit e210c422b6fdd2dc123bedc588f399aefd8bf9de upstream.

If the difference is big enough between the bytes asked and received
in a bulk transfer we can get a short transfer event pointing to a TRB in
the middle of the TD. We don't want to handle the TD yet as we will anyway
receive a new event for the last TRB in the TD.

Hold off from finishing the TD and removing it from the list until we
receive an event for the last TRB in the TD

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/host/xhci-ring.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2187,6 +2187,10 @@ static int process_bulk_intr_td(struct x
 				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
 	/* Fast path - was this the last TRB in the TD for this URB? */
 	if (event_trb == td->last_trb) {
+		if (td->urb_length_set && trb_comp_code == COMP_SHORT_TX)
+			return finish_td(xhci, td, event_trb, event, ep,
+					 status, false);
+
 		if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
 			td->urb->actual_length =
 				td->urb->transfer_buffer_length -
@@ -2238,6 +2242,12 @@ static int process_bulk_intr_td(struct x
 			td->urb->actual_length +=
 				TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
 				EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+
+		if (trb_comp_code == COMP_SHORT_TX) {
+			xhci_dbg(xhci, "mid bulk/intr SP, wait for last TRB event\n");
+			td->urb_length_set = true;
+			return 0;
+		}
 	}
 
 	return finish_td(xhci, td, event_trb, event, ep, status, false);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269587 — [PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when bad-block-list write fails.

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when bad-block-list write fails.
Message-ID	<quUVt-3GF-53@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: NeilBrown <neilb@suse.com>

commit bd8688a199b864944bf62eebed0ca13b46249453 upstream.

When a write fails and a bad-block-list is present, we can
update the bad-block-list instead of writing the data.  If
this succeeds then it is OK clear the relevant bitmap-bit as
no further 'sync' of the block is needed.

However if writing the bad-block-list fails then we need to
treat the write as failed and particularly must not clear
the bitmap bit.  Otherwise the device can be re-added (after
any hardware connection issues are resolved) and because the
relevant bit in the bitmap is clear, that block will not be
resynced.  This leads to data corruption.

We already delay the final bio_endio() on the write until
the bad-block-list is written so that when the write
returns: either that data is safe, the bad-block record is
safe, or the fact that the device is faulty is safe.
However we *don't* delay the clearing of the bitmap, so the
bitmap bit can be recorded as cleared before we know if the
bad-block-list was written safely.

So: delay that until the write really is safe.
i.e. move the call to close_write() until just before
calling bio_endio(), and recheck the 'is array degraded'
status before making that call.

This bug goes back to v3.1 when bad-block-lists were
introduced, though it only affects arrays created with
mdadm-3.3 or later as only those have bad-block lists.

Backports will require at least
Commit: 55ce74d4bfe1 ("md/raid1: ensure device failure recorded before write request returns.")
as well.  I'll send that to 'stable' separately.

Note that of the two tests of R1BIO_WriteError that this
patch adds, the first is certain to fail and the second is
certain to succeed.  However doing it this way makes the
patch more obviously correct.  I will tidy the code up in a
future merge window.

Reported-and-tested-by: Nate Dailey <nate.dailey@stratus.com>
Cc: Jes Sorensen <Jes.Sorensen@redhat.com>
Fixes: cd5ff9a16f08 ("md/raid1:  Handle write errors by updating badblock log.")
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/md/raid1.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1973,15 +1973,16 @@ static void handle_write_finished(struct
 			rdev_dec_pending(conf->mirrors[m].rdev,
 					 conf->mddev);
 		}
-	if (test_bit(R1BIO_WriteError, &r1_bio->state))
-		close_write(r1_bio);
 	if (fail) {
 		spin_lock_irq(&conf->device_lock);
 		list_add(&r1_bio->retry_list, &conf->bio_end_io_list);
 		spin_unlock_irq(&conf->device_lock);
 		md_wakeup_thread(conf->mddev->thread);
-	} else
+	} else {
+		if (test_bit(R1BIO_WriteError, &r1_bio->state))
+			close_write(r1_bio);
 		raid_end_bio_io(r1_bio);
+	}
 }
 
 static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
@@ -2097,6 +2098,10 @@ static void raid1d(struct mddev *mddev)
 			r1_bio = list_first_entry(&conf->bio_end_io_list,
 						  struct r1bio, retry_list);
 			list_del(&r1_bio->retry_list);
+			if (mddev->degraded)
+				set_bit(R1BIO_Degraded, &r1_bio->state);
+			if (test_bit(R1BIO_WriteError, &r1_bio->state))
+				close_write(r1_bio);
 			raid_end_bio_io(r1_bio);
 		}
 	}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269588 — [PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming
Message-ID	<quUVt-3GF-57@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Berg <johannes.berg@intel.com>

commit 5bd166872d8f99f156fac191299d24f828bb2348 upstream.

The code to send the RX PN data (for each TID) to the firmware
has a devastating bug: it overwrites the data for TID 0 with
all the TID data, leaving the remaining TIDs zeroed. This will
allow replays to actually be accepted by the firmware, which
could allow waking up the system.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/wireless/iwlwifi/iwl-agn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2001,7 +2001,7 @@ static void iwlagn_wowlan_program_keys(s
 			u8 *pn = seq.ccmp.pn;
 
 			ieee80211_get_key_rx_seq(key, i, &seq);
-			aes_sc->pn = cpu_to_le64(
+			aes_sc[i].pn = cpu_to_le64(
 					(u64)pn[5] |
 					((u64)pn[4] << 8) |
 					((u64)pn[3] << 16) |

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269589 — [PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing when calculating max length

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:10 +0100
Subject	[PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing when calculating max length
Message-ID	<quUVt-3GF-59@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Brown <broonie@kernel.org>

commit 176fc2d5770a0990eebff903ba680d2edd32e718 upstream.

The in kernel snprintf() will conveniently return the actual length of
the printed string even if not given an output beffer at all so just do
that rather than relying on the user to pass in a suitable buffer,
ensuring that we don't need to worry if the buffer was truncated due to
the size of the buffer passed in.

Reported-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/base/regmap/regmap-debugfs.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -23,8 +23,7 @@ static struct dentry *regmap_debugfs_roo
 /* Calculate the length of a fixed format  */
 static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
 {
-	snprintf(buf, buf_size, "%x", max_val);
-	return strlen(buf);
+	return snprintf(NULL, 0, "%x", max_val);
 }
 
 static int regmap_open_file(struct inode *inode, struct file *file)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269590 — [PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772
Message-ID	<quV57-3JS-1@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Michel Stam <m.stam@fugro.nl>

[ Upstream commit 3cc81d85ee01e5a0b7ea2f4190e2ed1165f53c31 ]

I've noticed every time the interface is set to 'up,', the kernel
reports that the link speed is set to 100 Mbps/Full Duplex, even
when ethtool is used to set autonegotiation to 'off', half
duplex, 10 Mbps.
It can be tested by:
 ifconfig eth0 down
 ethtool -s eth0 autoneg off speed 10 duplex half
 ifconfig eth0 up

Then checking 'dmesg' for the link speed.

Signed-off-by: Michel Stam <m.stam@fugro.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/usb/asix.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/usb/asix.c
+++ b/drivers/net/usb/asix.c
@@ -1555,7 +1555,7 @@ static const struct driver_info ax88772_
 	.unbind = ax88772_unbind,
 	.status = asix_status,
 	.link_reset = ax88772_link_reset,
-	.reset = ax88772_reset,
+	.reset = ax88772_link_reset,
 	.flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR | FLAG_MULTI_PACKET,
 	.rx_fixup = asix_rx_fixup_common,
 	.tx_fixup = asix_tx_fixup,

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269591 — [PATCH 3.2 08/60] UBI: Validate data_size

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 08/60] UBI: Validate data_size
Message-ID	<quV57-3JS-3@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Weinberger <richard@nod.at>

commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
[bwh: Backported to 3.2: drop first argument to ubi_err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/mtd/ubi/io.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -943,6 +943,11 @@ static int validate_vid_hdr(const struct
 		goto bad;
 	}
 
+	if (data_size > ubi->leb_size) {
+		ubi_err("bad data_size");
+		goto bad;
+	}
+
 	if (vol_type == UBI_VID_STATIC) {
 		/*
 		 * Although from high-level point of view static volumes may

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269592 — [PATCH 3.2 53/60] skbuff: Fix skb checksum partial check.

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 53/60] skbuff: Fix skb checksum partial check.
Message-ID	<quV58-3JS-11@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Pravin B Shelar <pshelar@nicira.com>

[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ]

Earlier patch 6ae459bda tried to detect void ckecksum partial
skb by comparing pull length to checksum offset. But it does
not work for all cases since checksum-offset depends on
updates to skb->data.

Following patch fixes it by validating checksum start offset
after skb-data pointer is updated. Negative value of checksum
offset start means there is no need to checksum.

Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull")
Reported-by: Andrew Vagin <avagin@odin.com>
Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 include/linux/skbuff.h |    2 +-
 net/core/skbuff.c      |    9 +++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2046,7 +2046,7 @@ static inline void skb_postpull_rcsum(st
 	if (skb->ip_summed == CHECKSUM_COMPLETE)
 		skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
 	else if (skb->ip_summed == CHECKSUM_PARTIAL &&
-		 skb_checksum_start_offset(skb) <= len)
+		 skb_checksum_start_offset(skb) < 0)
 		skb->ip_summed = CHECKSUM_NONE;
 }
 
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2579,11 +2579,12 @@ EXPORT_SYMBOL(skb_append_datato_frags);
  */
 unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
 {
+	unsigned char *data = skb->data;
+
 	BUG_ON(len > skb->len);
-	skb->len -= len;
-	BUG_ON(skb->len < skb->data_len);
-	skb_postpull_rcsum(skb, skb->data, len);
-	return skb->data += len;
+	__skb_pull(skb, len);
+	skb_postpull_rcsum(skb, data, len);
+	return skb->data;
 }
 EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269593 — [PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and use-after-free

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and use-after-free
Message-ID	<quV58-3JS-15@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Doron Tsur <doront@mellanox.com>

commit 0ca81a2840f77855bbad1b9f172c545c4dc9e6a4 upstream.

ib_send_cm_sidr_rep could sometimes erase the node from the sidr
(depending on errors in the process). Since ib_send_cm_sidr_rep is
called both from cm_sidr_req_handler and cm_destroy_id, cm_id_priv
could be either erased from the rb_tree twice or not erased at all.
Fixing that by making sure it's erased only once before freeing
cm_id_priv.

Fixes: a977049dacde ('[PATCH] IB: Add the kernel CM implementation')
Signed-off-by: Doron Tsur <doront@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/infiniband/core/cm.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -856,6 +856,11 @@ retest:
 	case IB_CM_SIDR_REQ_RCVD:
 		spin_unlock_irq(&cm_id_priv->lock);
 		cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+		spin_lock_irq(&cm.lock);
+		if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
+			rb_erase(&cm_id_priv->sidr_id_node,
+				 &cm.remote_sidr_table);
+		spin_unlock_irq(&cm.lock);
 		break;
 	case IB_CM_REQ_SENT:
 		ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
@@ -3092,7 +3097,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id
 	spin_unlock_irqrestore(&cm_id_priv->lock, flags);
 
 	spin_lock_irqsave(&cm.lock, flags);
-	rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+	if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
+		rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+		RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
+	}
 	spin_unlock_irqrestore(&cm.lock, flags);
 	return 0;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269594 — [PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras
Message-ID	<quV57-3JS-5@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Vincent Palatin <vpalatin@chromium.org>

commit 72194739f54607bbf8cfded159627a2015381557 upstream.

Add a device quirk for the Logitech PTZ Pro Camera and its sibling the
ConferenceCam CC3000e Camera.
This fixes the failed camera enumeration on some boot, particularly on
machines with fast CPU.

Tested by connecting a Logitech PTZ Pro Camera to a machine with a
Haswell Core i7-4600U CPU @ 2.10GHz, and doing thousands of reboot cycles
while recording the kernel logs and taking camera picture after each boot.
Before the patch, more than 7% of the boots show some enumeration transfer
failures and in a few of them, the kernel is giving up before actually
enumerating the webcam. After the patch, the enumeration has been correct
on every reboot.

Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/core/quirks.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -53,6 +53,13 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT },
 	{ USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT },
 
+	/* Logitech ConferenceCam CC3000e */
+	{ USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
+
+	/* Logitech PTZ Pro Camera */
+	{ USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
+
 	/* Logitech Quickcam Fusion */
 	{ USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269595 — [PATCH 3.2 33/60] xhci: handle no ping response error properly

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 33/60] xhci: handle no ping response error properly
Message-ID	<quV57-3JS-7@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit 3b4739b8951d650becbcd855d7d6f18ac98a9a85 upstream.

If a host fails to wake up a isochronous SuperSpeed device from U1/U2
in time for a isoch transfer it will generate a "No ping response error"
Host will then move to the next transfer descriptor.

Handle this case in the same way as missed service errors, tag the
current TD as skipped and handle it on the next transfer event.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/host/xhci-ring.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -2278,6 +2278,7 @@ static int handle_tx_event(struct xhci_h
 	u32 trb_comp_code;
 	int ret = 0;
 	int td_num = 0;
+	bool handling_skipped_tds = false;
 
 	slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
 	xdev = xhci->devs[slot_id];
@@ -2391,6 +2392,10 @@ static int handle_tx_event(struct xhci_h
 		ep->skip = true;
 		xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
 		goto cleanup;
+	case COMP_PING_ERR:
+		ep->skip = true;
+		xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
+		goto cleanup;
 	default:
 		if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
 			status = 0;
@@ -2522,13 +2527,18 @@ static int handle_tx_event(struct xhci_h
 						 ep, &status);
 
 cleanup:
+
+
+		handling_skipped_tds = ep->skip &&
+			trb_comp_code != COMP_MISSED_INT &&
+			trb_comp_code != COMP_PING_ERR;
+
 		/*
-		 * Do not update event ring dequeue pointer if ep->skip is set.
-		 * Will roll back to continue process missed tds.
+		 * Do not update event ring dequeue pointer if we're in a loop
+		 * processing missed tds.
 		 */
-		if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
+		if (!handling_skipped_tds)
 			inc_deq(xhci, xhci->event_ring, true);
-		}
 
 		if (ret) {
 			urb = td->urb;
@@ -2563,7 +2573,7 @@ cleanup:
 	 * Process them as short transfer until reach the td pointed by
 	 * the event.
 	 */
-	} while (ep->skip && trb_comp_code != COMP_MISSED_INT);
+	} while (handling_skipped_tds);
 
 	return 0;
 }

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269596 — [PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics usb headphones.

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics usb headphones.
Message-ID	<quV58-3JS-13@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Yao-Wen Mao <yaowen@google.com>

commit 8484bf2981b3d006426ac052a3642c9ce1d8d980 upstream.

These two headphones need a reset-resume quirk to properly resume to
original volume level.

Signed-off-by: Yao-Wen Mao <yaowen@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/core/quirks.c | 6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -77,6 +77,12 @@ static const struct usb_device_id usb_qu
 	/* Philips PSC805 audio device */
 	{ USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* Plantronic Audio 655 DSP */
+	{ USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
+
+	/* Plantronic Audio 648 USB */
+	{ USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
+
 	/* Artisman Watchdog Dongle */
 	{ USB_DEVICE(0x04b4, 0x0526), .driver_info =
 			USB_QUIRK_CONFIG_INTF_STRINGS },

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269597 — [PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in btree_split_beneath error path

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in btree_split_beneath error path
Message-ID	<quV58-3JS-17@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <snitzer@redhat.com>

commit 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be upstream.

btree_split_beneath()'s error path had an outstanding FIXME that speaks
directly to the potential for _not_ cleaning up a previously allocated
bufio-backed block.

Fix this by releasing the previously allocated bufio block using
unlock_block().

Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <thornber@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/md/persistent-data/dm-btree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -503,7 +503,7 @@ static int btree_split_beneath(struct sh
 
 	r = new_block(s->info, &right);
 	if (r < 0) {
-		/* FIXME: put left */
+		unlock_block(s->info, left);
 		return r;
 	}
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269598 — [PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before calling enter_rtas()

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before calling enter_rtas()
Message-ID	<quV57-3JS-9@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>

commit 8832317f662c06f5c06e638f57bfe89a71c9b266 upstream.

Currently we do not validate rtas.entry before calling enter_rtas(). This
leads to a kernel oops when user space calls rtas system call on a powernv
platform (see below). This patch adds code to validate rtas.entry before
making enter_rtas() call.

  Oops: Exception in kernel mode, sig: 4 [#1]
  SMP NR_CPUS=1024 NUMA PowerNV
  task: c000000004294b80 ti: c0000007e1a78000 task.ti: c0000007e1a78000
  NIP: 0000000000000000 LR: 0000000000009c14 CTR: c000000000423140
  REGS: c0000007e1a7b920 TRAP: 0e40   Not tainted  (3.18.17-340.el7_1.pkvm3_1_0.2400.1.ppc64le)
  MSR: 1000000000081000 <HV,ME>  CR: 00000000  XER: 00000000
  CFAR: c000000000009c0c SOFTE: 0
  NIP [0000000000000000]           (null)
  LR [0000000000009c14] 0x9c14
  Call Trace:
  [c0000007e1a7bba0] [c00000000041a7f4] avc_has_perm_noaudit+0x54/0x110 (unreliable)
  [c0000007e1a7bd80] [c00000000002ddc0] ppc_rtas+0x150/0x2d0
  [c0000007e1a7be30] [c000000000009358] syscall_exit+0x0/0x98

Fixes: 55190f88789a ("powerpc: Add skeleton PowerNV platform")
Reported-by: NAGESWARA R. SASTRY <nasastry@in.ibm.com>
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Reword change log, trim oops, and add stable + fixes]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/powerpc/kernel/rtas.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -992,6 +992,9 @@ asmlinkage int ppc_rtas(struct rtas_args
 	if (!capable(CAP_SYS_ADMIN))
 		return -EPERM;
 
+	if (!rtas.entry)
+		return -EINVAL;
+
 	if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
 		return -EFAULT;
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1269600 — [PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.

From	Ben Hutchings <ben@decadent.org.uk>
Date	2015-11-15 03:20 +0100
Subject	[PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.
Message-ID	<quV58-3JS-33@gated-at.bofh.it>
In reply to	#1269580

3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Denis Turischev <denis.turischev@compulab.co.il>

commits c09ec25d3684cad74d851c0f028a495999591279 and
0a939993bff117d3657108ca13b011fc0378aedb upstream.

The same issue like with Panther Point chipsets. If the USB ports are
switched to xHCI on shutdown, the xHCI host will send a spurious interrupt,
which will wake the system. Some BIOS have work around for this, but not all.
One example is Compulab's mini-desktop, the Intense-PC2.

The bug can be avoided if the USB ports are switched back to EHCI on
shutdown.

This patch should be backported to stable kernels as old as 3.12,
that contain the commit 638298dc66ea36623dbc2757a24fc2c4ab41b016
"xhci: Fix spurious wakeups after S5 on Haswell"

Signed-off-by: Denis Turischev <denis@compulab.co.il>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Patch "xhci: Switch Intel Lynx Point ports to EHCI on shutdown."
commit c09ec25d3684cad74d851c0f028a495999591279 is not fully correct

It switches both Lynx Point and Lynx Point-LP ports to EHCI on shutdown.
On some Lynx Point machines it causes spurious interrupt,
which wake the system: bugzilla.kernel.org/show_bug.cgi?id=76291

On Lynx Point-LP on the contrary switching ports to EHCI seems to be
necessary to fix these spurious interrupts.

Signed-off-by: Denis Turischev <denis@compulab.co.il>
Reported-by: Wulf Richartz <wulf.richartz@gmail.com>
Cc: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

[bwh: Combined the above commits and backported to 3.2: adjust context to
 apply after "xhci: Limit the spurious wakeup fix only to HP machines" and
 "xhci: no switching back on non-ULT Haswell"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/host/xhci-pci.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -123,6 +123,10 @@ static void xhci_pci_quirks(struct devic
 		xhci->quirks |= XHCI_SPURIOUS_REBOOT;
 	}
 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+		pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
+		xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+	}
+	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
 		(pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
 		 pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
 		 pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 1 of 3 [1] 2 3 Next page →

csiph-web

[PATCH 3.2 00/60] 3.2.73-rc1 review

Contents

#1269580 — [PATCH 3.2 00/60] 3.2.73-rc1 review

#1269581 — [PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing nodes after removal

#1269582 — [PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands

#1269583 — [PATCH 3.2 12/60] genirq: Fix race in register_irq_proc()

#1269584 — [PATCH 3.2 31/60] iommu/vt-d: fix range computation when making room for large pages

#1269585 — [PATCH 3.2 28/60] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing)

#1269586 — [PATCH 3.2 32/60] xhci: don't finish a TD if we get a short transfer event mid TD

#1269587 — [PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when bad-block-list write fails.

#1269588 — [PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming

#1269589 — [PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing when calculating max length

#1269590 — [PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772

#1269591 — [PATCH 3.2 08/60] UBI: Validate data_size

#1269592 — [PATCH 3.2 53/60] skbuff: Fix skb checksum partial check.

#1269593 — [PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and use-after-free

#1269594 — [PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras

#1269595 — [PATCH 3.2 33/60] xhci: handle no ping response error properly

#1269596 — [PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics usb headphones.

#1269597 — [PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in btree_split_beneath error path

#1269598 — [PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before calling enter_rtas()

#1269600 — [PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.