Groups > linux.kernel > #1275314 > unrolled thread

[PATCH 3.12 00/72] 3.12.51-stable review

Started by	Jiri Slaby <jslaby@suse.cz>
First post	2015-11-23 14:10 +0100
Last post	2015-11-30 10:10 +0100
Articles	20 on this page of 45 — 5 participants

Back to article view | Back to linux.kernel

  [PATCH 3.12 00/72] 3.12.51-stable review Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:10 +0100
    [PATCH 3.12 48/72] netfilter: xt_NFQUEUE: fix --queue-bypass regression Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 63/72] KEYS: Fix race between key destruction and finding a keyring by name Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 55/72] net: sun4i-emac: fix memory leak on bad packet Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 54/72] ceph: fix kick_requests() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 50/72] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 56/72] macmace: add missing platform_set_drvdata() in mace_probe() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 52/72] ceph: make sure request isn't in any waiting list when kicking request. Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 58/72] r8169: disable L23 Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 66/72] KVM: x86: work around infinite loop in microcode when #AC is delivered Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 57/72] r8169: fix the incorrect tx descriptor version Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 51/72] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland. Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
      [PATCH 3.12 71/72] x86/mm/hotplug: Pass sync_global_pgds() a correct argument in remove_pagetable() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
    [PATCH 3.12 10/72] power: bq24190_charger: suppress build warning Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 15/72] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 35/72] irda: precedence bug in irlmp_seq_hb_idx() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 22/72] md/raid10: submit_bio_wait() returns 0 on success Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 37/72] ppp: fix pppoe_dev deletion condition in pppoe_release() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 20/72] crypto: api - Only abort operations on fatal signal Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 27/72] mfd: wm5110: Add register patch for rev D chip Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 21/72] md/raid1: submit_bio_wait() returns 0 on success Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 25/72] serial: 8250_pci: Add support for 16 port Exar boards Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
        Re: [PATCH 3.12 25/72] serial: 8250_pci: Add support for 16 port Exar  boards Soeren Grunewald <soeren.grunewald@desy.de> - 2015-11-23 15:30 +0100
      [PATCH 3.12 32/72] libahci: Allow drivers to override start_engine Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 24/72] IB/cm: Fix rb-tree duplicate free and use-after-free Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 30/72] audit: correctly record file names with different path name types Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 26/72] serial: 8250_pci: Add support for 12 port Exar boards Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 12/72] drm/nouveau/gem: return only valid domain when there's only one Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 39/72] net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 28/72] mfd: wm5110: Add register patch for rev E and above Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 16/72] xhci: handle no ping response error properly Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 18/72] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 19/72] module: Fix locking in symbol_put_addr() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 11/72] spi: fix pointer-integer size mismatch warning Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 31/72] audit: create private file name copies when auditing inodes Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 17/72] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 23/72] mvsas: Fix NULL pointer dereference in mvs_slot_task_free Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
      [PATCH 3.12 34/72] Fix regression in NFSRDMA server Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
        Re: [PATCH 3.12 34/72] Fix regression in NFSRDMA server Tom Tucker <tom@opengridcomputing.com> - 2015-11-23 16:40 +0100
    Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-23 17:30 +0100
    Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-23 17:30 +0100
    Re: [PATCH 3.12 00/72] 3.12.51-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-11-23 17:40 +0100
    Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-24 04:50 +0100
      Re: [PATCH 3.12 00/72] 3.12.51-stable review Jiri Slaby <jslaby@suse.cz> - 2015-11-30 10:10 +0100

Page 1 of 3 [1] 2 3 Next page →

#1275314 — [PATCH 3.12 00/72] 3.12.51-stable review

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:10 +0100
Subject	[PATCH 3.12 00/72] 3.12.51-stable review
Message-ID	<qxZ2y-29g-11@gated-at.bofh.it>

This is the start of the stable review cycle for the 3.12.51 release.
There are 72 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Nov 25 14:04:50 CET 2015.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	http://kernel.org/pub/linux/kernel/people/jirislaby/stable-review/patch-3.12.51-rc1.xz
and the diffstat can be found below.

thanks,
js

===============


Ani Sinha (2):
  ipmr: fix possible race resulting from improper usage of
    IP_INC_STATS_BH() in preemptible context.
  net:socket: set msg_namelen to 0 if msg_name is passed as NULL in
    msghdr struct from userland.

Anton Blanchard (1):
  powerpc/pseries: Fix dedicated processor partition detection

Bjørn Mork (1):
  qmi_wwan: fix entry for HP lt4112 LTE/HSPA+ Gobi 4G Module

Carol L Soto (1):
  net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes

Cathy Avery (1):
  xen-blkfront: check for null drvdata in blkback_changed
    (XenbusStateClosing)

Charles Keepax (3):
  ASoC: wm8904: Correct number of EQ registers
  mfd: wm5110: Add register patch for rev D chip
  mfd: wm5110: Add register patch for rev E and above

Dan Carpenter (2):
  mptfusion: prevent some memory corruption
  irda: precedence bug in irlmp_seq_hb_idx()

Dan Williams (1):
  ahci: avoton port-disable reset-quirk

David Howells (2):
  KEYS: Fix race between key destruction and finding a keyring by name
  KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring

David S. Miller (1):
  sfc: Fix memcpy() with const destination compiler warning.

Doron Tsur (1):
  IB/cm: Fix rb-tree duplicate free and use-after-free

Dāvis Mosāns (1):
  mvsas: Fix NULL pointer dereference in mvs_slot_task_free

Eric Dumazet (3):
  sit: fix sit0 percpu double allocations
  net: avoid NULL deref in inet_ctl_sock_destroy()
  net: fix a race in dst_release()

Eric Northup (1):
  KVM: x86: work around infinite loop in microcode when #AC is delivered

Florian Fainelli (1):
  ARM: orion: Fix DSA platform device after mvmdio conversion

Guillaume Nault (1):
  ppp: fix pppoe_dev deletion condition in pppoe_release()

Hans de Goede (1):
  libahci: Allow drivers to override start_engine

Herbert Xu (1):
  crypto: api - Only abort operations on fatal signal

Holger Eitzenberger (1):
  netfilter: xt_NFQUEUE: fix --queue-bypass regression

Ilia Mirkin (1):
  drm/nouveau/gem: return only valid domain when there's only one

Ilya Dryomov (2):
  rbd: don't leak parent_spec in rbd_dev_probe_parent()
  rbd: prevent kernel stack blow up on rbd map

Jan Kara (1):
  mm: make sendfile(2) killable

Jason Wang (2):
  macvtap: unbreak receiving of gro skb with frag list
  virtio-net: drop NETIF_F_FRAGLIST

Jes Sorensen (2):
  md/raid1: submit_bio_wait() returns 0 on success
  md/raid10: submit_bio_wait() returns 0 on success

Joe Thornber (1):
  dm btree remove: fix a bug when rebalancing nodes after removal

Joerg Roedel (1):
  iommu/amd: Don't clear DTE flags when modifying it

Johannes Berg (3):
  iwlwifi: dvm: fix D3 firmware PN programming
  iwlwifi: fix firmware filename for 3160
  iwlwifi: mvm: fix D3 firmware PN programming

Lad, Prabhakar (1):
  power: bq24190_charger: suppress build warning

Laura Abbott (1):
  xhci: Add spurious wakeup quirk for LynxPoint-LP controllers

Marc Zyngier (1):
  net: sun4i-emac: fix memory leak on bad packet

Marcelo Leitner (1):
  ipv6: addrconf: validate new MTU before applying it

Mathias Nyman (1):
  xhci: handle no ping response error properly

Mike Snitzer (1):
  dm btree: fix leak of bufio-backed block in btree_split_beneath error
    path

Nadav Amit (3):
  KVM: x86: Defining missing x86 vectors
  KVM: x86: Fix far-jump to non-canonical check
  KVM: x86: Use new is_noncanonical_address in _linearize

Paolo Bonzini (1):
  KVM: svm: unconditionally intercept #DB

Paul Moore (2):
  audit: correctly record file names with different path name types
  audit: create private file name copies when auditing inodes

Peter Hurley (1):
  serial: 8250_dw: Fix deadlock in LCR workaround

Peter Zijlstra (1):
  module: Fix locking in symbol_put_addr()

Phil Reid (1):
  stmmac: Correctly report PTP capabilities.

Ronny Hegewald (1):
  rbd: require stable pages if message data CRCs are enabled

Sasha Levin (1):
  RDS: verify the underlying transport exists before creating a
    connection

SeongJae Park (1):
  spi: fix pointer-integer size mismatch warning

Soeren Grunewald (2):
  serial: 8250_pci: Add support for 16 port Exar boards
  serial: 8250_pci: Add support for 12 port Exar boards

Sowmini Varadhan (1):
  RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in
    rds_tcp_data_recv

Tom Tucker (1):
  Fix regression in NFSRDMA server

Vasant Hegde (1):
  powerpc/rtas: Validate rtas.entry before calling enter_rtas()

Vasily Averin (1):
  bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit

Wei Yongjun (1):
  macmace: add missing platform_set_drvdata() in mace_probe()

Will Deacon (1):
  Revert "ARM64: unwind: Fix PC calculation"

Yan, Zheng (3):
  ceph: make sure request isn't in any waiting list when kicking
    request.
  ceph: protect kick_requests() with mdsc->mutex
  ceph: fix kick_requests()

Yasuaki Ishimatsu (2):
  x86/mm/hotplug: Pass sync_global_pgds() a correct argument in
    remove_pagetable()
  x86/mm/hotplug: Modify PGD entry when removing memory

hayeswang (2):
  r8169: fix the incorrect tx descriptor version
  r8169: disable L23

 arch/arm/plat-orion/common.c                       |   2 +-
 arch/arm64/kernel/stacktrace.c                     |   6 +-
 arch/powerpc/include/asm/lppaca.h                  |  12 +--
 arch/powerpc/kernel/rtas.c                         |   3 +
 arch/x86/include/asm/pgtable_64.h                  |   3 +-
 arch/x86/include/uapi/asm/kvm.h                    |   3 +
 arch/x86/include/uapi/asm/svm.h                    |   1 +
 arch/x86/kvm/emulate.c                             |  10 +-
 arch/x86/kvm/svm.c                                 |  22 ++---
 arch/x86/kvm/vmx.c                                 |   5 +-
 arch/x86/mm/fault.c                                |   2 +-
 arch/x86/mm/init_64.c                              |  36 ++++---
 crypto/ablkcipher.c                                |   2 +-
 crypto/algapi.c                                    |   2 +-
 crypto/api.c                                       |   6 +-
 crypto/crypto_user.c                               |   2 +-
 drivers/ata/ahci.c                                 | 109 +++++++++++++++++++--
 drivers/ata/ahci.h                                 |   6 ++
 drivers/ata/libahci.c                              |  26 +++--
 drivers/ata/sata_highbank.c                        |   3 +-
 drivers/block/rbd.c                                |  67 +++++++------
 drivers/block/xen-blkfront.c                       |   3 +-
 drivers/gpu/drm/nouveau/nouveau_gem.c              |   5 +-
 drivers/infiniband/core/cm.c                       |  10 +-
 drivers/iommu/amd_iommu.c                          |   4 +-
 drivers/iommu/amd_iommu_types.h                    |   1 +
 drivers/md/persistent-data/dm-btree-remove.c       |  17 ++--
 drivers/md/persistent-data/dm-btree.c              |   2 +-
 drivers/md/raid1.c                                 |   2 +-
 drivers/md/raid10.c                                |   2 +-
 drivers/message/fusion/mptctl.c                    |   9 ++
 drivers/mfd/wm5110-tables.c                        |  44 ++++++++-
 drivers/net/ethernet/allwinner/sun4i-emac.c        |   6 +-
 drivers/net/ethernet/apple/macmace.c               |   1 +
 drivers/net/ethernet/mellanox/mlx4/cmd.c           |   2 +-
 drivers/net/ethernet/mellanox/mlx4/eq.c            |   2 +-
 drivers/net/ethernet/realtek/r8169.c               |  27 ++++-
 drivers/net/ethernet/sfc/selftest.c                |   2 +-
 .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c   |   7 +-
 drivers/net/macvtap.c                              |   2 +-
 drivers/net/ppp/pppoe.c                            |   2 +-
 drivers/net/usb/qmi_wwan.c                         |   5 +-
 drivers/net/virtio_net.c                           |   4 +-
 drivers/net/wireless/iwlwifi/dvm/lib.c             |   2 +-
 drivers/net/wireless/iwlwifi/iwl-7000.c            |   2 +-
 drivers/net/wireless/iwlwifi/mvm/d3.c              |  12 +--
 drivers/power/bq24190_charger.c                    |   2 +-
 drivers/scsi/mvsas/mv_sas.c                        |   2 +
 drivers/spi/spi-gpio.c                             |   2 +-
 drivers/tty/serial/8250/8250_dw.c                  |  10 +-
 drivers/tty/serial/8250/8250_pci.c                 |  46 ++++++++-
 drivers/usb/host/xhci-pci.c                        |   1 +
 drivers/usb/host/xhci-ring.c                       |  20 +++-
 fs/ceph/mds_client.c                               |  11 ++-
 include/net/inet_common.h                          |   3 +-
 include/sound/wm8904.h                             |   2 +-
 kernel/auditsc.c                                   |  49 +++++++--
 kernel/module.c                                    |   8 +-
 mm/filemap.c                                       |   9 +-
 net/bridge/br_netfilter.c                          |   4 +-
 net/core/dst.c                                     |   2 +-
 net/ipv4/ipmr.c                                    |   6 +-
 net/ipv6/addrconf.c                                |  17 +++-
 net/ipv6/sit.c                                     |  20 +---
 net/irda/irlmp.c                                   |   2 +-
 net/netfilter/xt_NFQUEUE.c                         |   7 +-
 net/rds/connection.c                               |   6 ++
 net/rds/tcp_recv.c                                 |  11 ++-
 net/socket.c                                       |   3 +
 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c            |  12 +--
 net/sunrpc/xprtrdma/svc_rdma_sendto.c              |   1 +
 security/keys/gc.c                                 |  10 +-
 72 files changed, 569 insertions(+), 200 deletions(-)

-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1275336 — [PATCH 3.12 48/72] netfilter: xt_NFQUEUE: fix --queue-bypass regression

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 48/72] netfilter: xt_NFQUEUE: fix --queue-bypass regression
Message-ID	<qxZcd-2dc-3@gated-at.bofh.it>
In reply to	#1275314

From: Holger Eitzenberger <holger@debian.org>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit d954777324ffcba0b2f8119c102237426c654eeb upstream.

V3 of the NFQUEUE target ignores the --queue-bypass flag,
causing packets to be dropped when the userspace listener
isn't running.

Regression is in since 8746ddcf12bb26 ("netfilter: xt_NFQUEUE:
introduce CPU fanout").

Reported-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Holger Eitzenberger <holger@debian.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/netfilter/xt_NFQUEUE.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 1e2fae32f81b..ed00fef58996 100644
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -147,6 +147,7 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct xt_NFQ_info_v3 *info = par->targinfo;
 	u32 queue = info->queuenum;
+	int ret;
 
 	if (info->queues_total > 1) {
 		if (info->flags & NFQ_FLAG_CPU_FANOUT) {
@@ -157,7 +158,11 @@ nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
 			queue = nfqueue_hash(skb, par);
 	}
 
-	return NF_QUEUE_NR(queue);
+	ret = NF_QUEUE_NR(queue);
+	if (info->flags & NFQ_FLAG_BYPASS)
+		ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
+
+	return ret;
 }
 
 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275337 — [PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
Message-ID	<qxZcf-2dc-45@gated-at.bofh.it>
In reply to	#1275336

From: David Howells <dhowells@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.

The following sequence of commands:

    i=`keyctl add user a a @s`
    keyctl request2 keyring foo bar @t
    keyctl unlink $i @s

tries to invoke an upcall to instantiate a keyring if one doesn't already
exist by that name within the user's keyring set.  However, if the upcall
fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
other error code.  When the key is garbage collected, the key destroy
function is called unconditionally and keyring_destroy() uses list_empty()
on keyring->type_data.link - which is in a union with reject_error.
Subsequently, the kernel tries to unlink the keyring from the keyring names
list - which oopses like this:

	BUG: unable to handle kernel paging request at 00000000ffffff8a
	IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	...
	Workqueue: events key_garbage_collector
	...
	RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
	RSP: 0018:ffff88003e2f3d30  EFLAGS: 00010203
	RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
	RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
	RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
	R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
	R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
	...
	CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
	...
	Call Trace:
	 [<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
	 [<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
	 [<ffffffff8105ec9b>] process_one_work+0x28e/0x547
	 [<ffffffff8105fd17>] worker_thread+0x26e/0x361
	 [<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
	 [<ffffffff810648ad>] kthread+0xf3/0xfb
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
	 [<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
	 [<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2

Note the value in RAX.  This is a 32-bit representation of -ENOKEY.

The solution is to only call ->destroy() if the key was successfully
instantiated.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 security/keys/gc.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 483ebdf9c383..de34c290bd6f 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -187,8 +187,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
-		/* Throw away the key data */
-		if (key->type->destroy)
+		/* Throw away the key data if the key is instantiated */
+		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+		    !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+		    key->type->destroy)
 			key->type->destroy(key);
 
 		security_key_free(key);
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275339 — [PATCH 3.12 63/72] KEYS: Fix race between key destruction and finding a keyring by name

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 63/72] KEYS: Fix race between key destruction and finding a keyring by name
Message-ID	<qxZcf-2dc-49@gated-at.bofh.it>
In reply to	#1275336

From: David Howells <dhowells@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 94c4554ba07adbdde396748ee7ae01e86cf2d8d7 upstream.

There appears to be a race between:

 (1) key_gc_unused_keys() which frees key->security and then calls
     keyring_destroy() to unlink the name from the name list

 (2) find_keyring_by_name() which calls key_permission(), thus accessing
     key->security, on a key before checking to see whether the key usage is 0
     (ie. the key is dead and might be cleaned up).

Fix this by calling ->destroy() before cleaning up the core key data -
including key->security.

Reported-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 security/keys/gc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 797818695c87..483ebdf9c383 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -187,6 +187,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		kdebug("- %u", key->serial);
 		key_check(key);
 
+		/* Throw away the key data */
+		if (key->type->destroy)
+			key->type->destroy(key);
+
 		security_key_free(key);
 
 		/* deal with the user's key tracking and quota */
@@ -201,10 +205,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		/* now throw away the key memory */
-		if (key->type->destroy)
-			key->type->destroy(key);
-
 		key_user_put(key->user);
 
 		kfree(key->description);
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275342 — [PATCH 3.12 55/72] net: sun4i-emac: fix memory leak on bad packet

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 55/72] net: sun4i-emac: fix memory leak on bad packet
Message-ID	<qxZcg-2dc-57@gated-at.bofh.it>
In reply to	#1275336

From: Marc Zyngier <marc.zyngier@arm.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 2670cc699a66c4cf268cb3e3f6dfc325ec14f224 upstream.

Upon reception of a new frame, the emac driver checks for a number
of error conditions, and flag the packet as "bad" if any of these
are present. It then allocates a skb unconditionally, but only uses
it if the packet is "good". On the error path, the skb is just forgotten,
and the system leaks memory.

The piece of junk I have on my desk seems to encounter such error
frequently enough so that the box goes OOM after a couple of days,
which makes me grumpy.

Fix this by moving the allocation on the "good_packet" path (and
convert it to netdev_alloc_skb while we're at it).

Tested on a random Allwinner A20 board.

Cc: Stefan Roese <sr@denx.de>
Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/ethernet/allwinner/sun4i-emac.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c
index 81576c6c31e0..ac735537fe2e 100644
--- a/drivers/net/ethernet/allwinner/sun4i-emac.c
+++ b/drivers/net/ethernet/allwinner/sun4i-emac.c
@@ -623,8 +623,10 @@ static void emac_rx(struct net_device *dev)
 		}
 
 		/* Move data from EMAC */
-		skb = dev_alloc_skb(rxlen + 4);
-		if (good_packet && skb) {
+		if (good_packet) {
+			skb = netdev_alloc_skb(dev, rxlen + 4);
+			if (!skb)
+				continue;
 			skb_reserve(skb, 2);
 			rdptr = (u8 *) skb_put(skb, rxlen - 4);
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275343 — [PATCH 3.12 54/72] ceph: fix kick_requests()

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 54/72] ceph: fix kick_requests()
Message-ID	<qxZcf-2dc-53@gated-at.bofh.it>
In reply to	#1275336

From: "Yan, Zheng" <zheng.z.yan@intel.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 282c105225ec3229f344c5fced795b9e1e634440 upstream.

__do_request() may unregister the request. So we should update
iterator 'p' before calling __do_request()

Signed-off-by: "Yan, Zheng" <zheng.z.yan@intel.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ceph/mds_client.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 16c7e4ab94f0..5ef4c6ca5cb5 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1975,11 +1975,12 @@ static void __wake_requests(struct ceph_mds_client *mdsc,
 static void kick_requests(struct ceph_mds_client *mdsc, int mds)
 {
 	struct ceph_mds_request *req;
-	struct rb_node *p;
+	struct rb_node *p = rb_first(&mdsc->request_tree);
 
 	dout("kick_requests mds%d\n", mds);
-	for (p = rb_first(&mdsc->request_tree); p; p = rb_next(p)) {
+	while (p) {
 		req = rb_entry(p, struct ceph_mds_request, r_node);
+		p = rb_next(p);
 		if (req->r_got_unsafe)
 			continue;
 		if (req->r_session &&
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275344 — [PATCH 3.12 50/72] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 50/72] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit
Message-ID	<qxZcg-2dc-61@gated-at.bofh.it>
In reply to	#1275336

From: Vasily Averin <vvs@parallels.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit aff09ce303f83bd370772349238482ae422a2341 upstream.

Currently bridge can silently drop ipv4 fragments.
If node have loaded nf_defrag_ipv4 module but have no nf_conntrack_ipv4,
br_nf_pre_routing defragments incoming ipv4 fragments
but nfct check in br_nf_dev_queue_xmit does not allow re-fragment combined
packet back, and therefore it is dropped in br_dev_queue_push_xmit without
incrementing of any failcounters

It seems the only way to hit the ip_fragment code in the bridge xmit
path is to have a fragment list whose reassembled fragments go over
the mtu. This only happens if nf_defrag is enabled. Thanks to
Florian Westphal for providing feedback to clarify this.

Defragmentation ipv4 is required not only in conntracks but at least in
TPROXY target and socket match, therefore #ifdef is changed from
NF_CONNTRACK_IPV4 to NF_DEFRAG_IPV4

Signed-off-by: Vasily Averin <vvs@openvz.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/bridge/br_netfilter.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index f87736270eaa..bc9dc3877b1f 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -853,12 +853,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
 	return NF_STOLEN;
 }
 
-#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4)
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
 static int br_nf_dev_queue_xmit(struct sk_buff *skb)
 {
 	int ret;
 
-	if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
+	if (skb->protocol == htons(ETH_P_IP) &&
 	    skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
 	    !skb_is_gso(skb)) {
 		if (br_parse_ip_options(skb))
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275345 — [PATCH 3.12 56/72] macmace: add missing platform_set_drvdata() in mace_probe()

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 56/72] macmace: add missing platform_set_drvdata() in mace_probe()
Message-ID	<qxZcg-2dc-63@gated-at.bofh.it>
In reply to	#1275336

From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 06a2feb9e3bd0d2d555ccb19607ff5583cfa03e8 upstream.

Add missing platform_set_drvdata() in mace_probe(), otherwise
calling platform_get_drvdata() in mac_mace_device_remove() may
returns NULL.

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/ethernet/apple/macmace.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/apple/macmace.c b/drivers/net/ethernet/apple/macmace.c
index 4ce8ceb62205..58a200df4c35 100644
--- a/drivers/net/ethernet/apple/macmace.c
+++ b/drivers/net/ethernet/apple/macmace.c
@@ -211,6 +211,7 @@ static int mace_probe(struct platform_device *pdev)
 	mp = netdev_priv(dev);
 
 	mp->device = &pdev->dev;
+	platform_set_drvdata(pdev, dev);
 	SET_NETDEV_DEV(dev, &pdev->dev);
 
 	dev->base_addr = (u32)MACE_BASE;
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275346 — [PATCH 3.12 52/72] ceph: make sure request isn't in any waiting list when kicking request.

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 52/72] ceph: make sure request isn't in any waiting list when kicking request.
Message-ID	<qxZcg-2dc-65@gated-at.bofh.it>
In reply to	#1275336

From: "Yan, Zheng" <ukernel@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 03974e8177b36d672eb59658f976f03cb77c1129 upstream.

we may corrupt waiting list if a request in the waiting list is kicked.

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 fs/ceph/mds_client.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 6f1161324f91..3e07f82a3c9d 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -1985,6 +1985,7 @@ static void kick_requests(struct ceph_mds_client *mdsc, int mds)
 		if (req->r_session &&
 		    req->r_session->s_mds == mds) {
 			dout(" kicking tid %llu\n", req->r_tid);
+			list_del_init(&req->r_wait);
 			__do_request(mdsc, req);
 		}
 	}
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275348 — [PATCH 3.12 58/72] r8169: disable L23

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 58/72] r8169: disable L23
Message-ID	<qxZcg-2dc-67@gated-at.bofh.it>
In reply to	#1275336

From: hayeswang <hayeswang@realtek.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b51ecea852b712618796d9eab8428a7d5f1f106f upstream.

For RTL8411, RTL8111G, RTL8402, RTL8105, and RTL8106, disable the feature
of entering the L2/L3 link state of the PCIe. When the nic starts the process
of entering the L2/L3 link state and the PCI reset occurs before the work
is finished, the work would be queued and continue after the next the PCI
reset occurs. This causes the device stays in L2/L3 link state, and the system
couldn't find the device.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/ethernet/realtek/r8169.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 48b7d41eced1..208f023d37ac 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -539,6 +539,7 @@ enum rtl_register_content {
 	MagicPacket	= (1 << 5),	/* Wake up when receives a Magic Packet */
 	LinkUp		= (1 << 4),	/* Wake up when the cable connection is re-established */
 	Jumbo_En0	= (1 << 2),	/* 8168 only. Reserved in the 8168b */
+	Rdy_to_L23	= (1 << 1),	/* L23 Enable */
 	Beacon_en	= (1 << 0),	/* 8168 only. Reserved in the 8168b */
 
 	/* Config4 register */
@@ -4898,6 +4899,21 @@ static void rtl_enable_clock_request(struct pci_dev *pdev)
 				 PCI_EXP_LNKCTL_CLKREQ_EN);
 }
 
+static void rtl_pcie_state_l2l3_enable(struct rtl8169_private *tp, bool enable)
+{
+	void __iomem *ioaddr = tp->mmio_addr;
+	u8 data;
+
+	data = RTL_R8(Config3);
+
+	if (enable)
+		data |= Rdy_to_L23;
+	else
+		data &= ~Rdy_to_L23;
+
+	RTL_W8(Config3, data);
+}
+
 #define R8168_CPCMD_QUIRK_MASK (\
 	EnableBist | \
 	Mac_dbgo_oe | \
@@ -5247,6 +5263,7 @@ static void rtl_hw_start_8411(struct rtl8169_private *tp)
 	};
 
 	rtl_hw_start_8168f(tp);
+	rtl_pcie_state_l2l3_enable(tp, false);
 
 	rtl_ephy_init(tp, e_info_8168f_1, ARRAY_SIZE(e_info_8168f_1));
 
@@ -5285,6 +5302,8 @@ static void rtl_hw_start_8168g_1(struct rtl8169_private *tp)
 
 	rtl_w1w0_eri(tp, 0x2fc, ERIAR_MASK_0001, 0x01, 0x06, ERIAR_EXGMAC);
 	rtl_w1w0_eri(tp, 0x1b0, ERIAR_MASK_0011, 0x0000, 0x1000, ERIAR_EXGMAC);
+
+	rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8168g_2(struct rtl8169_private *tp)
@@ -5537,6 +5556,8 @@ static void rtl_hw_start_8105e_1(struct rtl8169_private *tp)
 	RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
 
 	rtl_ephy_init(tp, e_info_8105e_1, ARRAY_SIZE(e_info_8105e_1));
+
+	rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8105e_2(struct rtl8169_private *tp)
@@ -5572,6 +5593,8 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
 	rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
 	rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
 	rtl_w1w0_eri(tp, 0x0d4, ERIAR_MASK_0011, 0x0e00, 0xff00, ERIAR_EXGMAC);
+
+	rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8106(struct rtl8169_private *tp)
@@ -5584,6 +5607,8 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
 	RTL_W32(MISC, (RTL_R32(MISC) | DISABLE_LAN_EN) & ~EARLY_TALLY_EN);
 	RTL_W8(MCU, RTL_R8(MCU) | EN_NDP | EN_OOB_RESET);
 	RTL_W8(DLLPR, RTL_R8(DLLPR) & ~PFM_EN);
+
+	rtl_pcie_state_l2l3_enable(tp, false);
 }
 
 static void rtl_hw_start_8101(struct net_device *dev)
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275350 — [PATCH 3.12 66/72] KVM: x86: work around infinite loop in microcode when #AC is delivered

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 66/72] KVM: x86: work around infinite loop in microcode when #AC is delivered
Message-ID	<qxZcg-2dc-71@gated-at.bofh.it>
In reply to	#1275336

From: Eric Northup <digitaleric@google.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 54a20552e1eae07aa240fa370a0293e006b5faed upstream.

It was found that a guest can DoS a host by triggering an infinite
stream of "alignment check" (#AC) exceptions.  This causes the
microcode to enter an infinite loop where the core never receives
another interrupt.  The host kernel panics pretty quickly due to the
effects (CVE-2015-5307).

Signed-off-by: Eric Northup <digitaleric@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/include/uapi/asm/svm.h | 1 +
 arch/x86/kvm/svm.c              | 8 ++++++++
 arch/x86/kvm/vmx.c              | 5 ++++-
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h
index b5d7640abc5d..8a4add8e4639 100644
--- a/arch/x86/include/uapi/asm/svm.h
+++ b/arch/x86/include/uapi/asm/svm.h
@@ -100,6 +100,7 @@
 	{ SVM_EXIT_EXCP_BASE + UD_VECTOR,       "UD excp" }, \
 	{ SVM_EXIT_EXCP_BASE + PF_VECTOR,       "PF excp" }, \
 	{ SVM_EXIT_EXCP_BASE + NM_VECTOR,       "NM excp" }, \
+	{ SVM_EXIT_EXCP_BASE + AC_VECTOR,       "AC excp" }, \
 	{ SVM_EXIT_EXCP_BASE + MC_VECTOR,       "MC excp" }, \
 	{ SVM_EXIT_INTR,        "interrupt" }, \
 	{ SVM_EXIT_NMI,         "nmi" }, \
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index d1a065ec683f..db4108b82e6b 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1103,6 +1103,7 @@ static void init_vmcb(struct vcpu_svm *svm)
 	set_exception_intercept(svm, PF_VECTOR);
 	set_exception_intercept(svm, UD_VECTOR);
 	set_exception_intercept(svm, MC_VECTOR);
+	set_exception_intercept(svm, AC_VECTOR);
 
 	set_intercept(svm, INTERCEPT_INTR);
 	set_intercept(svm, INTERCEPT_NMI);
@@ -1765,6 +1766,12 @@ static int ud_interception(struct vcpu_svm *svm)
 	return 1;
 }
 
+static int ac_interception(struct vcpu_svm *svm)
+{
+	kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
+	return 1;
+}
+
 static void svm_fpu_activate(struct kvm_vcpu *vcpu)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
@@ -3285,6 +3292,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
 	[SVM_EXIT_EXCP_BASE + PF_VECTOR]	= pf_interception,
 	[SVM_EXIT_EXCP_BASE + NM_VECTOR]	= nm_interception,
 	[SVM_EXIT_EXCP_BASE + MC_VECTOR]	= mc_interception,
+	[SVM_EXIT_EXCP_BASE + AC_VECTOR]	= ac_interception,
 	[SVM_EXIT_INTR]				= intr_interception,
 	[SVM_EXIT_NMI]				= nmi_interception,
 	[SVM_EXIT_SMI]				= nop_on_interception,
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index f5ddacc4c885..53fede68963d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1388,7 +1388,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
 	u32 eb;
 
 	eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
-	     (1u << NM_VECTOR) | (1u << DB_VECTOR);
+	     (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
 	if ((vcpu->guest_debug &
 	     (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
 	    (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
@@ -4812,6 +4812,9 @@ static int handle_exception(struct kvm_vcpu *vcpu)
 		return handle_rmode_exception(vcpu, ex_no, error_code);
 
 	switch (ex_no) {
+	case AC_VECTOR:
+		kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
+		return 1;
 	case DB_VECTOR:
 		dr6 = vmcs_readl(EXIT_QUALIFICATION);
 		if (!(vcpu->guest_debug &
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275351 — [PATCH 3.12 57/72] r8169: fix the incorrect tx descriptor version

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 57/72] r8169: fix the incorrect tx descriptor version
Message-ID	<qxZch-2dc-73@gated-at.bofh.it>
In reply to	#1275336

From: hayeswang <hayeswang@realtek.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit f75761b6b5bf6277296505941d2dd8e11f9b5c35 upstream.

The tx descriptor version of RTL8111B belong to RTL_TD_0.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Francois Romieu <romieu@fr.zoreil.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/ethernet/realtek/r8169.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8808a16eb691..48b7d41eced1 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -210,7 +210,7 @@ static const struct {
 	[RTL_GIGA_MAC_VER_16] =
 		_R("RTL8101e",		RTL_TD_0, NULL, JUMBO_1K, true),
 	[RTL_GIGA_MAC_VER_17] =
-		_R("RTL8168b/8111b",	RTL_TD_1, NULL, JUMBO_4K, false),
+		_R("RTL8168b/8111b",	RTL_TD_0, NULL, JUMBO_4K, false),
 	[RTL_GIGA_MAC_VER_18] =
 		_R("RTL8168cp/8111cp",	RTL_TD_1, NULL, JUMBO_6K, false),
 	[RTL_GIGA_MAC_VER_19] =
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275352 — [PATCH 3.12 51/72] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 51/72] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.
Message-ID	<qxZch-2dc-75@gated-at.bofh.it>
In reply to	#1275336

From: Ani Sinha <ani@arista.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 6a2a2b3ae0759843b22c929881cc184b00cc63ff upstream.

Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
break old binaries and any code for which there is no access to source code.
To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.

Signed-off-by: Ani Sinha <ani@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/socket.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/socket.c b/net/socket.c
index 432b0bddd9e1..00634623573f 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1970,6 +1970,9 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 	if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
 		return -EFAULT;
 
+	if (kmsg->msg_name == NULL)
+		kmsg->msg_namelen = 0;
+
 	if (kmsg->msg_namelen < 0)
 		return -EINVAL;
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275353 — [PATCH 3.12 71/72] x86/mm/hotplug: Pass sync_global_pgds() a correct argument in remove_pagetable()

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:20 +0100
Subject	[PATCH 3.12 71/72] x86/mm/hotplug: Pass sync_global_pgds() a correct argument in remove_pagetable()
Message-ID	<qxZci-2dc-77@gated-at.bofh.it>
In reply to	#1275336

From: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 5255e0a79fcc0ff47b387af92bd9ef5729b1b859 upstream.

When hot-adding memory after hot-removing memory, following call
traces are shown:

  kernel BUG at arch/x86/mm/init_64.c:206!
  ...
 [<ffffffff815e0c80>] kernel_physical_mapping_init+0x1b2/0x1d2
 [<ffffffff815ced94>] init_memory_mapping+0x1d4/0x380
 [<ffffffff8104aebd>] arch_add_memory+0x3d/0xd0
 [<ffffffff815d03d9>] add_memory+0xb9/0x1b0
 [<ffffffff81352415>] acpi_memory_device_add+0x1af/0x28e
 [<ffffffff81325dc4>] acpi_bus_device_attach+0x8c/0xf0
 [<ffffffff813413b9>] acpi_ns_walk_namespace+0xc8/0x17f
 [<ffffffff81325d38>] ? acpi_bus_type_and_status+0xb7/0xb7
 [<ffffffff81325d38>] ? acpi_bus_type_and_status+0xb7/0xb7
 [<ffffffff813418ed>] acpi_walk_namespace+0x95/0xc5
 [<ffffffff81326b4c>] acpi_bus_scan+0x9a/0xc2
 [<ffffffff81326bff>] acpi_scan_bus_device_check+0x8b/0x12e
 [<ffffffff81326cb5>] acpi_scan_device_check+0x13/0x15
 [<ffffffff81320122>] acpi_os_execute_deferred+0x25/0x32
 [<ffffffff8107e02b>] process_one_work+0x17b/0x460
 [<ffffffff8107edfb>] worker_thread+0x11b/0x400
 [<ffffffff8107ece0>] ? rescuer_thread+0x400/0x400
 [<ffffffff81085aef>] kthread+0xcf/0xe0
 [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140
 [<ffffffff815fc76c>] ret_from_fork+0x7c/0xb0
 [<ffffffff81085a20>] ? kthread_create_on_node+0x140/0x140

The patch-set fixes the issue.

This patch (of 2):

remove_pagetable() gets start argument and passes the argument
to sync_global_pgds().  In this case, the argument must not be
modified.  If the argument is modified and passed to
sync_global_pgds(), sync_global_pgds() does not correctly
synchronize PGD to PGD entries of all processes MM since
synchronized range of memory [start, end] is wrong.

Unfortunately the start argument is modified in
remove_pagetable().  So this patch fixes the issue.

Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Acked-by: Toshi Kani <toshi.kani@hp.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Tang Chen <tangchen@cn.fujitsu.com>
Cc: Gu Zheng <guz.fnst@cn.fujitsu.com>
Cc: Zhang Yanfei <zhangyanfei@cn.fujitsu.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 arch/x86/mm/init_64.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index a93e32722ab1..427b536a5fd6 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -975,19 +975,20 @@ static void __meminit
 remove_pagetable(unsigned long start, unsigned long end, bool direct)
 {
 	unsigned long next;
+	unsigned long addr;
 	pgd_t *pgd;
 	pud_t *pud;
 	bool pgd_changed = false;
 
-	for (; start < end; start = next) {
-		next = pgd_addr_end(start, end);
+	for (addr = start; addr < end; addr = next) {
+		next = pgd_addr_end(addr, end);
 
-		pgd = pgd_offset_k(start);
+		pgd = pgd_offset_k(addr);
 		if (!pgd_present(*pgd))
 			continue;
 
 		pud = (pud_t *)pgd_page_vaddr(*pgd);
-		remove_pud_table(pud, start, next, direct);
+		remove_pud_table(pud, addr, next, direct);
 		if (free_pud_table(pud, pgd))
 			pgd_changed = true;
 	}
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275359 — [PATCH 3.12 10/72] power: bq24190_charger: suppress build warning

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 10/72] power: bq24190_charger: suppress build warning
Message-ID	<qxZ2z-29g-35@gated-at.bofh.it>
In reply to	#1275314

From: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 31f50e48e3e4ea9d503285a389d6a1b5349d66c0 upstream.

This patch fixes following build warning:

In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
drivers/power/bq24190_charger.c: In function ‘bq24190_irq_handler_thread’:
include/linux/dynamic_debug.h:86:20: warning: ‘ss_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:5: note: ‘ss_reg’ was declared here
  u8 ss_reg, f_reg;
     ^
In file included from include/linux/printk.h:261:0,
                 from include/linux/kernel.h:13,
                 from include/linux/list.h:8,
                 from include/linux/module.h:9,
                 from drivers/power/bq24190_charger.c:11:
include/linux/dynamic_debug.h:86:20: warning: ‘f_reg’ may be used uninitialized in this function [-Wmaybe-uninitialized]
   __dynamic_dev_dbg(&descriptor, dev, fmt, \
                    ^
drivers/power/bq24190_charger.c:1211:13: note: ‘f_reg’ was declared here
  u8 ss_reg, f_reg;

Signed-off-by: "Lad, Prabhakar" <prabhakar.csengg@gmail.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/power/bq24190_charger.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c
index e4c95e1a6733..d0e8236a6404 100644
--- a/drivers/power/bq24190_charger.c
+++ b/drivers/power/bq24190_charger.c
@@ -1208,7 +1208,7 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data)
 {
 	struct bq24190_dev_info *bdi = data;
 	bool alert_userspace = false;
-	u8 ss_reg, f_reg;
+	u8 ss_reg = 0, f_reg = 0;
 	int ret;
 
 	pm_runtime_get_sync(bdi->dev);
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275360 — [PATCH 3.12 15/72] dm btree: fix leak of bufio-backed block in btree_split_beneath error path

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 15/72] dm btree: fix leak of bufio-backed block in btree_split_beneath error path
Message-ID	<qxZlU-2hK-13@gated-at.bofh.it>
In reply to	#1275359

From: Mike Snitzer <snitzer@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 4dcb8b57df3593dcb20481d9d6cf79d1dc1534be upstream.

btree_split_beneath()'s error path had an outstanding FIXME that speaks
directly to the potential for _not_ cleaning up a previously allocated
bufio-backed block.

Fix this by releasing the previously allocated bufio block using
unlock_block().

Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Joe Thornber <thornber@redhat.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/md/persistent-data/dm-btree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 50cf11119af9..fc3d733aab1c 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -523,7 +523,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
 
 	r = new_block(s->info, &right);
 	if (r < 0) {
-		/* FIXME: put left */
+		unlock_block(s->info, left);
 		return r;
 	}
 
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275363 — [PATCH 3.12 35/72] irda: precedence bug in irlmp_seq_hb_idx()

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 35/72] irda: precedence bug in irlmp_seq_hb_idx()
Message-ID	<qxZlU-2hK-19@gated-at.bofh.it>
In reply to	#1275359

From: Dan Carpenter <dan.carpenter@oracle.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 50010c20597d14667eff0fdb628309986f195230 ]

This is decrementing the pointer, instead of the value stored in the
pointer.  KASan detects it as an out of bounds reference.

Reported-by: "Berry Cheng 程君(成淼)" <chengmiao.cj@alibaba-inc.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 net/irda/irlmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/irda/irlmp.c b/net/irda/irlmp.c
index 98ad6ec4bd3c..8ad149478e19 100644
--- a/net/irda/irlmp.c
+++ b/net/irda/irlmp.c
@@ -1876,7 +1876,7 @@ static void *irlmp_seq_hb_idx(struct irlmp_iter_state *iter, loff_t *off)
 	for (element = hashbin_get_first(iter->hashbin);
 	     element != NULL;
 	     element = hashbin_get_next(iter->hashbin)) {
-		if (!off || *off-- == 0) {
+		if (!off || (*off)-- == 0) {
 			/* NB: hashbin left locked */
 			return element;
 		}
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275364 — [PATCH 3.12 22/72] md/raid10: submit_bio_wait() returns 0 on success

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 22/72] md/raid10: submit_bio_wait() returns 0 on success
Message-ID	<qxZlU-2hK-21@gated-at.bofh.it>
In reply to	#1275359

From: Jes Sorensen <Jes.Sorensen@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 681ab4696062f5aa939c9e04d058732306a97176 upstream.

This was introduced with 9e882242c6193ae6f416f2d8d8db0d9126bd996b
which changed the return value of submit_bio_wait() to return != 0 on
error, but didn't update the caller accordingly.

Fixes: 9e882242c6 ("block: Add submit_bio_wait(), remove from md")
Reported-by: Bill Kuzeja <William.Kuzeja@stratus.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: NeilBrown <neilb@suse.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/md/raid10.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index d525d663bb22..98c856dd8ccc 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -2618,7 +2618,7 @@ static int narrow_write_error(struct r10bio *r10_bio, int i)
 				   choose_data_offset(r10_bio, rdev) +
 				   (sector - r10_bio->sector));
 		wbio->bi_bdev = rdev->bdev;
-		if (submit_bio_wait(WRITE, wbio) == 0)
+		if (submit_bio_wait(WRITE, wbio) < 0)
 			/* Failure! */
 			ok = rdev_set_badblocks(rdev, sector,
 						sectors, 0)
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275366 — [PATCH 3.12 37/72] ppp: fix pppoe_dev deletion condition in pppoe_release()

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 37/72] ppp: fix pppoe_dev deletion condition in pppoe_release()
Message-ID	<qxZlU-2hK-25@gated-at.bofh.it>
In reply to	#1275359

From: Guillaume Nault <g.nault@alphalink.fr>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

[ Upstream commit 1acea4f6ce1b1c0941438aca75dd2e5c6b09db60 ]

We can't rely on PPPOX_ZOMBIE to decide whether to clear po->pppoe_dev.
PPPOX_ZOMBIE can be set by pppoe_disc_rcv() even when po->pppoe_dev is
NULL. So we have no guarantee that (sk->sk_state & PPPOX_ZOMBIE) implies
(po->pppoe_dev != NULL).
Since we're releasing a PPPoE socket, we want to release the pppoe_dev
if it exists and reset sk_state to PPPOX_DEAD, no matter the previous
value of sk_state. So we can just check for po->pppoe_dev and avoid any
assumption on sk->sk_state.

Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/net/ppp/pppoe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index d66cf214e95e..1cfd4e841854 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -569,7 +569,7 @@ static int pppoe_release(struct socket *sock)
 
 	po = pppox_sk(sk);
 
-	if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+	if (po->pppoe_dev) {
 		dev_put(po->pppoe_dev);
 		po->pppoe_dev = NULL;
 	}
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1275367 — [PATCH 3.12 20/72] crypto: api - Only abort operations on fatal signal

From	Jiri Slaby <jslaby@suse.cz>
Date	2015-11-23 14:30 +0100
Subject	[PATCH 3.12 20/72] crypto: api - Only abort operations on fatal signal
Message-ID	<qxZlV-2hK-29@gated-at.bofh.it>
In reply to	#1275359

From: Herbert Xu <herbert@gondor.apana.org.au>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 3fc89adb9fa4beff31374a4bf50b3d099d88ae83 upstream.

Currently a number of Crypto API operations may fail when a signal
occurs.  This causes nasty problems as the caller of those operations
are often not in a good position to restart the operation.

In fact there is currently no need for those operations to be
interrupted by user signals at all.  All we need is for them to
be killable.

This patch replaces the relevant calls of signal_pending with
fatal_signal_pending, and wait_for_completion_interruptible with
wait_for_completion_killable, respectively.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 crypto/ablkcipher.c  | 2 +-
 crypto/algapi.c      | 2 +-
 crypto/api.c         | 6 +++---
 crypto/crypto_user.c | 2 +-
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 7d4a8d28277e..ebcec7439a1a 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -700,7 +700,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name,
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 00d8d939733b..daf2f653b131 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -325,7 +325,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval)
 		crypto_alg_tested(larval->alg.cra_driver_name, 0);
 	}
 
-	err = wait_for_completion_interruptible(&larval->completion);
+	err = wait_for_completion_killable(&larval->completion);
 	WARN_ON(err);
 
 out:
diff --git a/crypto/api.c b/crypto/api.c
index 2a81e98a0021..7db2e89a3114 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -172,7 +172,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)
 	struct crypto_larval *larval = (void *)alg;
 	long timeout;
 
-	timeout = wait_for_completion_interruptible_timeout(
+	timeout = wait_for_completion_killable_timeout(
 		&larval->completion, 60 * HZ);
 
 	alg = larval->adult;
@@ -435,7 +435,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
@@ -552,7 +552,7 @@ void *crypto_alloc_tfm(const char *alg_name,
 err:
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
index 43665d0d0905..c7666f401381 100644
--- a/crypto/crypto_user.c
+++ b/crypto/crypto_user.c
@@ -361,7 +361,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type,
 		err = PTR_ERR(alg);
 		if (err != -EAGAIN)
 			break;
-		if (signal_pending(current)) {
+		if (fatal_signal_pending(current)) {
 			err = -EINTR;
 			break;
 		}
-- 
2.6.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

Page 1 of 3 [1] 2 3 Next page →

csiph-web

[PATCH 3.12 00/72] 3.12.51-stable review

Contents

#1275314 — [PATCH 3.12 00/72] 3.12.51-stable review

#1275336 — [PATCH 3.12 48/72] netfilter: xt_NFQUEUE: fix --queue-bypass regression

#1275337 — [PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring

#1275339 — [PATCH 3.12 63/72] KEYS: Fix race between key destruction and finding a keyring by name

#1275342 — [PATCH 3.12 55/72] net: sun4i-emac: fix memory leak on bad packet

#1275343 — [PATCH 3.12 54/72] ceph: fix kick_requests()

#1275344 — [PATCH 3.12 50/72] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit

#1275345 — [PATCH 3.12 56/72] macmace: add missing platform_set_drvdata() in mace_probe()

#1275346 — [PATCH 3.12 52/72] ceph: make sure request isn't in any waiting list when kicking request.

#1275348 — [PATCH 3.12 58/72] r8169: disable L23

#1275350 — [PATCH 3.12 66/72] KVM: x86: work around infinite loop in microcode when #AC is delivered

#1275351 — [PATCH 3.12 57/72] r8169: fix the incorrect tx descriptor version

#1275352 — [PATCH 3.12 51/72] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.

#1275353 — [PATCH 3.12 71/72] x86/mm/hotplug: Pass sync_global_pgds() a correct argument in remove_pagetable()

#1275359 — [PATCH 3.12 10/72] power: bq24190_charger: suppress build warning

#1275360 — [PATCH 3.12 15/72] dm btree: fix leak of bufio-backed block in btree_split_beneath error path

#1275363 — [PATCH 3.12 35/72] irda: precedence bug in irlmp_seq_hb_idx()

#1275364 — [PATCH 3.12 22/72] md/raid10: submit_bio_wait() returns 0 on success

#1275366 — [PATCH 3.12 37/72] ppp: fix pppoe_dev deletion condition in pppoe_release()

#1275367 — [PATCH 3.12 20/72] crypto: api - Only abort operations on fatal signal