Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1341478 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2016-02-24 06:00 +0100 |
| Last post | 2016-02-25 07:00 +0100 |
| Articles | 20 on this page of 50 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 3.14 00/70] 3.14.62-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 36/70] iio: fix some warning messages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 59/70] m32r: fix m32104ut_defconfig build fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 64/70] radix-tree: fix race in gang lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 39/70] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 04/70] phy: twl4030-usb: Relase usb phy on unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 50/70] fuse: break infinite loop in fuse_fill_write_pages() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 40/70] cifs: fix erroneous return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 05/70] wan/x25: Fix use-after-free in x25_asy_open_tty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 15/70] perf trace: Fix documentation for -i Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 57/70] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 67/70] intel_scu_ipcutil: underflow in scu_reg_access() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 49/70] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 63/70] memcg: only free spare array when readers are done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 58/70] xhci: Fix list corruption in urb dequeue at host removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 66/70] dump_stack: avoid potential deadlocks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 41/70] nfs: Fix race in __update_open_stateid() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 06/70] staging/speakup: Use tty_ldisc_ref() for paste kworker Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 70/70] module: wrapper for symbol name. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 43/70] udf: Prevent buffer overrun with multi-byte characters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 44/70] udf: Check output buffer length when converting name to CS0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:00 +0100
[PATCH 3.14 10/70] AIO: properly check iovec sizes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 37/70] iio: adis_buffer: Fix out-of-bounds memory access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 03/70] ALSA: seq: Fix double port list deletion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 34/70] iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 24/70] SCSI: Fix NULL pointer dereference in runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 29/70] scsi_dh_rdac: always retry MODE SELECT on command lock violation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 31/70] scsi: fix soft lockup in scsi_remove_target() on module removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 23/70] Fix a memory leak in scsi_host_dev_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 30/70] SCSI: Add Marvell Console to VPD blacklist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 28/70] drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 13/70] Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 27/70] SCSI: fix crashes in sd and sr runtime PM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 35/70] iio: ad5064: Fix ad5629/ad5669 shift Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 25/70] Revert "SCSI: Fix NULL pointer dereference in runtime PM" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 32/70] iio:ad7793: Fix ad7785 product ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 26/70] iscsi-target: Fix potential dead-lock during node acl delete Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 38/70] iio: dac: mcp4725: set iio name property in sysfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 11/70] ext4: fix potential integer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 33/70] iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:10 +0100
[PATCH 3.14 22/70] iscsi-target: Fix rx_login_comp hang after login failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:20 +0100
[PATCH 3.14 02/70] drm/i915: get runtime PM reference around GEM set_caching IOCTL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 19/70] klist: fix starting point removed bug in klist iterators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 18/70] tracing: Fix freak link error caused by branch tracer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 16/70] ptrace: use fsuid, fsgid, effective creds for fs access checks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 20/70] scsi: restart list search after unlock in scsi_remove_target Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 17/70] tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
[PATCH 3.14 21/70] scsi_sysfs: Fix queue_ramp_up_period return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-02-24 06:30 +0100
Re: [PATCH 3.14 00/70] 3.14.62-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-02-24 19:30 +0100
Re: [PATCH 3.14 00/70] 3.14.62-stable review Guenter Roeck <linux@roeck-us.net> - 2016-02-25 07:00 +0100
Page 1 of 3 [1] 2 3 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 00/70] 3.14.62-stable review |
| Message-ID | <r5yVY-7pJ-7@gated-at.bofh.it> |
This is the start of the stable review cycle for the 3.14.62 release.
There are 70 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Feb 26 03:33:41 UTC 2016.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.62-rc1.gz
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 3.14.62-rc1
Rusty Russell <rusty@rustcorp.com.au>
module: wrapper for symbol name.
WANG Cong <xiyou.wangcong@gmail.com>
ip6mr: call del_timer_sync() in ip6mr_free_table()
Thomas Gleixner <tglx@linutronix.de>
futex: Drop refcount if requeue_pi() acquired the rtmutex
Dan Carpenter <dan.carpenter@oracle.com>
intel_scu_ipcutil: underflow in scu_reg_access()
Eric Dumazet <edumazet@google.com>
dump_stack: avoid potential deadlocks
Konstantin Khlebnikov <koct9i@gmail.com>
radix-tree: fix oops after radix_tree_iter_retry
Matthew Wilcox <willy@linux.intel.com>
radix-tree: fix race in gang lookup
Martijn Coenen <maco@google.com>
memcg: only free spare array when readers are done
Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
scripts/bloat-o-meter: fix python3 syntax error
Laura Abbott <labbott@fedoraproject.org>
dma-debug: switch check from _text to _stext
Daniel Mentz <danielmentz@google.com>
dma-debug: Fix dma_debug_entry offset calculation
Sudip Mukherjee <sudipm.mukherjee@gmail.com>
m32r: fix m32104ut_defconfig build fail
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: Fix list corruption in urb dequeue at host removal
Andrew Banman <abanman@sgi.com>
mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone()
CQ Tang <cq.tang@intel.com>
iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG
Aurélien Francillon <aurelien@francillon.net>
Input: i8042 - add Fujitsu Lifebook U745 to the nomux list
Benjamin Tissoires <benjamin.tissoires@redhat.com>
Input: elantech - mark protocols v2 and v3 as semi-mt
Takashi Iwai <tiwai@suse.de>
Input: elantech - add Fujitsu Lifebook U745 to force crc_enabled
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
mm: fix mlock accouting
Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
mm: soft-offline: check return value in second __get_any_page() call
Roman Gushchin <klamm@yandex-team.ru>
fuse: break infinite loop in fuse_fill_write_pages()
Thomas Huth <thuth@redhat.com>
KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8
Linus Walleij <linus.walleij@linaro.org>
ARM: 8517/1: ICST: avoid arithmetic overflow in icst_hz()
Linus Walleij <linus.walleij@linaro.org>
ARM: 8519/1: ICST: try other dividends than 1
Anson Huang <Anson.Huang@freescale.com>
ARM: 8471/1: need to save/restore arm register(r11) when it is corrupted
Helmut Klein <hgkr.klein@gmail.com>
ARM: dts: Kirkwood: Fix QNAP TS219 power-off
Andrew Gabbasov <andrew_gabbasov@mentor.com>
udf: Check output buffer length when converting name to CS0
Andrew Gabbasov <andrew_gabbasov@mentor.com>
udf: Prevent buffer overrun with multi-byte characters
Vegard Nossum <vegard.nossum@oracle.com>
udf: limit the maximum number of indirect extents in a row
Andrew Elble <aweits@rit.edu>
nfs: Fix race in __update_open_stateid()
Anton Protopopov <a.s.protopopov@gmail.com>
cifs: fix erroneous return value
Vasily Averin <vvs@virtuozzo.com>
cifs_dbg() outputs an uninitialized buffer in cifs_readdir()
Yong Li <sdliyong@gmail.com>
iio: dac: mcp4725: set iio name property in sysfs
Lars-Peter Clausen <lars@metafoo.de>
iio: adis_buffer: Fix out-of-bounds memory access
Dan Carpenter <dan.carpenter@oracle.com>
iio: fix some warning messages
Lars-Peter Clausen <lars@metafoo.de>
iio: ad5064: Fix ad5629/ad5669 shift
Michael Hennerich <michael.hennerich@analog.com>
iio:ad5064: Make sure ad5064_i2c_write() returns 0 on success
Vladimir Zapolskiy <vz@mleia.com>
iio: lpc32xx_adc: fix warnings caused by enabling unprepared clock
Lars-Peter Clausen <lars@metafoo.de>
iio:ad7793: Fix ad7785 product ID
James Bottomley <James.Bottomley@HansenPartnership.com>
scsi: fix soft lockup in scsi_remove_target() on module removal
Mika Westerberg <mika.westerberg@linux.intel.com>
SCSI: Add Marvell Console to VPD blacklist
Hannes Reinecke <hare@suse.de>
scsi_dh_rdac: always retry MODE SELECT on command lock violation
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
drivers/scsi/sg.c: mark VMA as VM_IO to prevent migration
Alan Stern <stern@rowland.harvard.edu>
SCSI: fix crashes in sd and sr runtime PM
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix potential dead-lock during node acl delete
Ken Xue <ken.xue@amd.com>
Revert "SCSI: Fix NULL pointer dereference in runtime PM"
Ken Xue <ken.xue@amd.com>
SCSI: Fix NULL pointer dereference in runtime PM
Bart Van Assche <bart.vanassche@sandisk.com>
Fix a memory leak in scsi_host_dev_release()
Nicholas Bellinger <nab@linux-iscsi.org>
iscsi-target: Fix rx_login_comp hang after login failure
Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
scsi_sysfs: Fix queue_ramp_up_period return code
Christoph Hellwig <hch@lst.de>
scsi: restart list search after unlock in scsi_remove_target
James Bottomley <James.Bottomley@HansenPartnership.com>
klist: fix starting point removed bug in klist iterators
Arnd Bergmann <arnd@arndb.de>
tracing: Fix freak link error caused by branch tracer
Steven Rostedt <rostedt@goodmis.org>
tools lib traceevent: Fix output of %llu for 64 bit values read on 32 bit machines
Jann Horn <jann@thejh.net>
ptrace: use fsuid, fsgid, effective creds for fs access checks
Peter Feiner <pfeiner@google.com>
perf trace: Fix documentation for -i
Peter Zijlstra <peterz@infradead.org>
perf: Fix inherited events vs. tracepoint filters
Filipe Manana <fdmanana@suse.com>
Btrfs: fix hang on extent buffer lock caused by the inode_paths ioctl
David Sterba <dsterba@suse.com>
btrfs: properly set the termination value of ctx->pos in readdir
Insu Yun <wuninsu@gmail.com>
ext4: fix potential integer overflow
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
AIO: properly check iovec sizes
Soeren Grunewald <soeren.grunewald@desy.de>
serial: 8250_pci: Correct uartclk for xr17v35x expansion chips
Herton R. Krzesinski <herton@redhat.com>
pty: make sure super_block is still valid in final /dev/tty close
Herton R. Krzesinski <herton@redhat.com>
pty: fix possible use after free of tty->driver_data
Peter Hurley <peter@hurleysoftware.com>
staging/speakup: Use tty_ldisc_ref() for paste kworker
Peter Hurley <peter@hurleysoftware.com>
wan/x25: Fix use-after-free in x25_asy_open_tty()
Tony Lindgren <tony@atomide.com>
phy: twl4030-usb: Relase usb phy on unload
Takashi Iwai <tiwai@suse.de>
ALSA: seq: Fix double port list deletion
Imre Deak <imre.deak@intel.com>
drm/i915: get runtime PM reference around GEM set_caching IOCTL
Matt Fleming <matt@codeblueprint.co.uk>
x86/mm/pat: Avoid truncation when converting cpa->numpages to address
-------------
Diffstat:
Makefile | 4 +-
arch/arm/boot/dts/kirkwood-ts219.dtsi | 2 +-
arch/arm/common/icst.c | 9 ++-
arch/arm/mm/proc-v7.S | 4 +-
arch/m32r/kernel/setup.c | 3 +
arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +-
arch/x86/mm/pageattr.c | 4 +-
block/blk-core.c | 12 ++++
drivers/gpu/drm/i915/i915_gem.c | 8 ++-
drivers/iio/adc/ad7793.c | 2 +-
drivers/iio/dac/ad5064.c | 91 +++++++++++++++++++---------
drivers/iio/dac/mcp4725.c | 1 +
drivers/iio/imu/adis_buffer.c | 2 +-
drivers/iio/industrialio-buffer.c | 2 +-
drivers/iio/industrialio-core.c | 2 +-
drivers/input/mouse/elantech.c | 9 ++-
drivers/input/serio/i8042-x86ia64io.h | 7 +++
drivers/iommu/dmar.c | 2 +-
drivers/iommu/intel_irq_remapping.c | 2 +-
drivers/net/wan/x25_asy.c | 6 +-
drivers/phy/phy-twl4030-usb.c | 1 +
drivers/platform/x86/intel_scu_ipcutil.c | 2 +-
drivers/scsi/device_handler/scsi_dh_rdac.c | 4 +-
drivers/scsi/hosts.c | 11 ++++
drivers/scsi/scsi_devinfo.c | 1 +
drivers/scsi/scsi_pm.c | 20 +++---
drivers/scsi/scsi_sysfs.c | 22 +++----
drivers/scsi/sd.c | 7 ++-
drivers/scsi/sg.c | 2 +-
drivers/scsi/sr.c | 4 ++
drivers/staging/iio/adc/lpc32xx_adc.c | 4 +-
drivers/staging/speakup/selection.c | 5 +-
drivers/target/iscsi/iscsi_target.c | 13 +++-
drivers/target/iscsi/iscsi_target_configfs.c | 16 ++++-
drivers/target/iscsi/iscsi_target_nego.c | 1 +
drivers/tty/pty.c | 21 ++++++-
drivers/tty/serial/8250/8250_pci.c | 22 ++++++-
drivers/usb/host/xhci.c | 4 +-
fs/aio.c | 9 ++-
fs/btrfs/backref.c | 10 +--
fs/btrfs/delayed-inode.c | 3 +-
fs/btrfs/delayed-inode.h | 2 +-
fs/btrfs/inode.c | 14 ++++-
fs/cifs/cifsencrypt.c | 2 +-
fs/cifs/readdir.c | 1 +
fs/devpts/inode.c | 20 ++++++
fs/ext4/resize.c | 2 +-
fs/fuse/file.c | 2 +-
fs/nfs/nfs4proc.c | 2 +-
fs/proc/array.c | 2 +-
fs/proc/base.c | 20 +++---
fs/proc/namespaces.c | 4 +-
fs/udf/inode.c | 15 +++++
fs/udf/unicode.c | 21 ++++++-
include/linux/compiler.h | 2 +-
include/linux/devpts_fs.h | 4 ++
include/linux/ptrace.h | 24 +++++++-
include/linux/radix-tree.h | 22 ++++++-
kernel/events/core.c | 6 +-
kernel/futex.c | 7 ++-
kernel/futex_compat.c | 2 +-
kernel/kcmp.c | 4 +-
kernel/module.c | 26 ++++----
kernel/ptrace.c | 39 +++++++++---
lib/dma-debug.c | 6 +-
lib/dump_stack.c | 7 ++-
lib/klist.c | 6 +-
lib/radix-tree.c | 12 +++-
mm/memcontrol.c | 11 ++--
mm/memory-failure.c | 2 +-
mm/memory_hotplug.c | 31 ++++++----
mm/mlock.c | 2 +-
mm/process_vm_access.c | 2 +-
net/ipv6/ip6mr.c | 2 +-
scripts/bloat-o-meter | 8 +--
security/commoncap.c | 7 ++-
sound/core/seq/seq_ports.c | 13 ++--
tools/lib/traceevent/event-parse.c | 5 +-
tools/perf/Documentation/perf-trace.txt | 1 -
79 files changed, 521 insertions(+), 193 deletions(-)
[toc] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 36/70] iio: fix some warning messages |
| Message-ID | <r5zIn-7K8-25@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 231bfe53c57e89857753c940192acba933cba56c upstream.
WARN_ON() only takes a condition argument. I have changed these to
WARN() instead.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-buffer.c | 2 +-
drivers/iio/industrialio-core.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -830,7 +830,7 @@ int iio_scan_mask_set(struct iio_dev *in
if (trialmask == NULL)
return -ENOMEM;
if (!indio_dev->masklength) {
- WARN_ON("Trying to set scanmask prior to registering buffer\n");
+ WARN(1, "Trying to set scanmask prior to registering buffer\n");
goto err_invalid_mask;
}
bitmap_copy(trialmask, buffer->scan_mask, indio_dev->masklength);
--- a/drivers/iio/industrialio-core.c
+++ b/drivers/iio/industrialio-core.c
@@ -589,7 +589,7 @@ int __iio_device_attr_init(struct device
break;
case IIO_SEPARATE:
if (!chan->indexed) {
- WARN_ON("Differential channels must be indexed\n");
+ WARN(1, "Differential channels must be indexed\n");
ret = -EINVAL;
goto error_free_full_postfix;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 59/70] m32r: fix m32104ut_defconfig build fail |
| Message-ID | <r5zIn-7K8-29@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
commit 601f1db653217f205ffa5fb33514b4e1711e56d1 upstream.
The build of m32104ut_defconfig for m32r arch was failing for long long
time with the error:
ERROR: "memory_start" [fs/udf/udf.ko] undefined!
ERROR: "memory_end" [fs/udf/udf.ko] undefined!
ERROR: "memory_end" [drivers/scsi/sg.ko] undefined!
ERROR: "memory_start" [drivers/scsi/sg.ko] undefined!
ERROR: "memory_end" [drivers/i2c/i2c-dev.ko] undefined!
ERROR: "memory_start" [drivers/i2c/i2c-dev.ko] undefined!
As done in other architectures export the symbols to fix the error.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/m32r/kernel/setup.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/m32r/kernel/setup.c
+++ b/arch/m32r/kernel/setup.c
@@ -81,7 +81,10 @@ static struct resource code_resource = {
};
unsigned long memory_start;
+EXPORT_SYMBOL(memory_start);
+
unsigned long memory_end;
+EXPORT_SYMBOL(memory_end);
void __init setup_arch(char **);
int get_cpuinfo(char *);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 64/70] radix-tree: fix race in gang lookup |
| Message-ID | <r5zIn-7K8-31@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <willy@linux.intel.com>
commit 46437f9a554fbe3e110580ca08ab703b59f2f95a upstream.
If the indirect_ptr bit is set on a slot, that indicates we need to redo
the lookup. Introduce a new function radix_tree_iter_retry() which
forces the loop to retry the lookup by setting 'slot' to NULL and
turning the iterator back to point at the problematic entry.
This is a pretty rare problem to hit at the moment; the lookup has to
race with a grow of the radix tree from a height of 0. The consequences
of hitting this race are that gang lookup could return a pointer to a
radix_tree_node instead of a pointer to whatever the user had inserted
in the tree.
Fixes: cebbd29e1c2f ("radix-tree: rewrite gang lookup using iterator")
Signed-off-by: Matthew Wilcox <willy@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ohad Ben-Cohen <ohad@wizery.com>
Cc: Konstantin Khlebnikov <khlebnikov@openvz.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/radix-tree.h | 16 ++++++++++++++++
lib/radix-tree.c | 12 ++++++++++--
2 files changed, 26 insertions(+), 2 deletions(-)
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -320,6 +320,22 @@ void **radix_tree_next_chunk(struct radi
struct radix_tree_iter *iter, unsigned flags);
/**
+ * radix_tree_iter_retry - retry this chunk of the iteration
+ * @iter: iterator state
+ *
+ * If we iterate over a tree protected only by the RCU lock, a race
+ * against deletion or creation may result in seeing a slot for which
+ * radix_tree_deref_retry() returns true. If so, call this function
+ * and continue the iteration.
+ */
+static inline __must_check
+void **radix_tree_iter_retry(struct radix_tree_iter *iter)
+{
+ iter->next_index = iter->index;
+ return NULL;
+}
+
+/**
* radix_tree_chunk_size - get current chunk size
*
* @iter: pointer to radix tree iterator
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -977,9 +977,13 @@ radix_tree_gang_lookup(struct radix_tree
return 0;
radix_tree_for_each_slot(slot, root, &iter, first_index) {
- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
+ results[ret] = rcu_dereference_raw(*slot);
if (!results[ret])
continue;
+ if (radix_tree_is_indirect_ptr(results[ret])) {
+ slot = radix_tree_iter_retry(&iter);
+ continue;
+ }
if (++ret == max_items)
break;
}
@@ -1056,9 +1060,13 @@ radix_tree_gang_lookup_tag(struct radix_
return 0;
radix_tree_for_each_tagged(slot, root, &iter, first_index, tag) {
- results[ret] = indirect_to_ptr(rcu_dereference_raw(*slot));
+ results[ret] = rcu_dereference_raw(*slot);
if (!results[ret])
continue;
+ if (radix_tree_is_indirect_ptr(results[ret])) {
+ slot = radix_tree_iter_retry(&iter);
+ continue;
+ }
if (++ret == max_items)
break;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 39/70] cifs_dbg() outputs an uninitialized buffer in cifs_readdir() |
| Message-ID | <r5zIn-7K8-27@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <vvs@virtuozzo.com>
commit 01b9b0b28626db4a47d7f48744d70abca9914ef1 upstream.
In some cases tmp_bug can be not filled in cifs_filldir and stay uninitialized,
therefore its printk with "%s" modifier can leak content of kernelspace memory.
If old content of this buffer does not contain '\0' access bejond end of
allocated object can crash the host.
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Signed-off-by: Steve French <sfrench@localhost.localdomain>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/readdir.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -849,6 +849,7 @@ int cifs_readdir(struct file *file, stru
* if buggy server returns . and .. late do we want to
* check for that here?
*/
+ *tmp_buf = 0;
rc = cifs_filldir(current_entry, file, ctx,
tmp_buf, max_len);
if (rc) {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 04/70] phy: twl4030-usb: Relase usb phy on unload |
| Message-ID | <r5zIn-7K8-23@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tony Lindgren <tony@atomide.com> commit b241d31ef2f6a289d33dcaa004714b26e06f476f upstream. Otherwise rmmod omap2430; rmmod phy-twl4030-usb; modprobe omap2430 will try to use a non-existing phy and oops: Unable to handle kernel paging request at virtual address b6f7c1f0 ... [<c048a284>] (devm_usb_get_phy_by_node) from [<bf0758ac>] (omap2430_musb_init+0x44/0x2b4 [omap2430]) [<bf0758ac>] (omap2430_musb_init [omap2430]) from [<bf055ec0>] (musb_init_controller+0x194/0x878 [musb_hdrc]) Cc: Bin Liu <b-liu@ti.com> Cc: Felipe Balbi <balbi@ti.com> Cc: Kishon Vijay Abraham I <kishon@ti.com> Cc: NeilBrown <neil@brown.name> Signed-off-by: Tony Lindgren <tony@atomide.com> Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/phy/phy-twl4030-usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/phy/phy-twl4030-usb.c +++ b/drivers/phy/phy-twl4030-usb.c @@ -777,6 +777,7 @@ static int twl4030_usb_remove(struct pla struct twl4030_usb *twl = platform_get_drvdata(pdev); int val; + usb_remove_phy(&twl->phy); pm_runtime_get_sync(twl->dev); cancel_delayed_work(&twl->id_workaround_work); device_remove_file(twl->dev, &dev_attr_vbus);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 50/70] fuse: break infinite loop in fuse_fill_write_pages() |
| Message-ID | <r5zIn-7K8-33@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <klamm@yandex-team.ru>
commit 3ca8138f014a913f98e6ef40e939868e1e9ea876 upstream.
I got a report about unkillable task eating CPU. Further
investigation shows, that the problem is in the fuse_fill_write_pages()
function. If iov's first segment has zero length, we get an infinite
loop, because we never reach iov_iter_advance() call.
Fix this by calling iov_iter_advance() before repeating an attempt to
copy data from userspace.
A similar problem is described in 124d3b7041f ("fix writev regression:
pan hanging unkillable and un-straceable"). If zero-length segmend
is followed by segment with invalid address,
iov_iter_fault_in_readable() checks only first segment (zero-length),
iov_iter_copy_from_user_atomic() skips it, fails at second and
returns zero -> goto again without skipping zero-length segment.
Patch calls iov_iter_advance() before goto again: we'll skip zero-length
segment at second iteraction and iov_iter_fault_in_readable() will detect
invalid address.
Special thanks to Konstantin Khlebnikov, who helped a lot with the commit
description.
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Maxim Patlasov <mpatlasov@parallels.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Roman Gushchin <klamm@yandex-team.ru>
Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Fixes: ea9b9907b82a ("fuse: implement perform_write")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1006,6 +1006,7 @@ static ssize_t fuse_fill_write_pages(str
tmp = iov_iter_copy_from_user_atomic(page, ii, offset, bytes);
flush_dcache_page(page);
+ iov_iter_advance(ii, tmp);
if (!tmp) {
unlock_page(page);
page_cache_release(page);
@@ -1018,7 +1019,6 @@ static ssize_t fuse_fill_write_pages(str
req->page_descs[req->num_pages].length = tmp;
req->num_pages++;
- iov_iter_advance(ii, tmp);
count += tmp;
pos += tmp;
offset += tmp;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 40/70] cifs: fix erroneous return value |
| Message-ID | <r5zIn-7K8-35@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Protopopov <a.s.protopopov@gmail.com>
commit 4b550af519854421dfec9f7732cdddeb057134b2 upstream.
The setup_ntlmv2_rsp() function may return positive value ENOMEM instead
of -ENOMEM in case of kmalloc failure.
Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/cifsencrypt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -710,7 +710,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, c
ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
if (!ses->auth_key.response) {
- rc = ENOMEM;
+ rc = -ENOMEM;
ses->auth_key.len = 0;
goto setup_ntlmv2_rsp_ret;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 05/70] wan/x25: Fix use-after-free in x25_asy_open_tty() |
| Message-ID | <r5zIo-7K8-43@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit ee9159ddce14bc1dec9435ae4e3bd3153e783706 upstream.
The N_X25 line discipline may access the previous line discipline's closed
and already-freed private data on open [1].
The tty->disc_data field _never_ refers to valid data on entry to the
line discipline's open() method. Rather, the ldisc is expected to
initialize that field for its own use for the lifetime of the instance
(ie. from open() to close() only).
[1]
[ 634.336761] ==================================================================
[ 634.338226] BUG: KASAN: use-after-free in x25_asy_open_tty+0x13d/0x490 at addr ffff8800a743efd0
[ 634.339558] Read of size 4 by task syzkaller_execu/8981
[ 634.340359] =============================================================================
[ 634.341598] BUG kmalloc-512 (Not tainted): kasan: bad access detected
...
[ 634.405018] Call Trace:
[ 634.405277] dump_stack (lib/dump_stack.c:52)
[ 634.405775] print_trailer (mm/slub.c:655)
[ 634.406361] object_err (mm/slub.c:662)
[ 634.406824] kasan_report_error (mm/kasan/report.c:138 mm/kasan/report.c:236)
[ 634.409581] __asan_report_load4_noabort (mm/kasan/report.c:279)
[ 634.411355] x25_asy_open_tty (drivers/net/wan/x25_asy.c:559 (discriminator 1))
[ 634.413997] tty_ldisc_open.isra.2 (drivers/tty/tty_ldisc.c:447)
[ 634.414549] tty_set_ldisc (drivers/tty/tty_ldisc.c:567)
[ 634.415057] tty_ioctl (drivers/tty/tty_io.c:2646 drivers/tty/tty_io.c:2879)
[ 634.423524] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
[ 634.427491] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
[ 634.427945] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:188)
Reported-and-tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wan/x25_asy.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -545,16 +545,12 @@ static void x25_asy_receive_buf(struct t
static int x25_asy_open_tty(struct tty_struct *tty)
{
- struct x25_asy *sl = tty->disc_data;
+ struct x25_asy *sl;
int err;
if (tty->ops->write == NULL)
return -EOPNOTSUPP;
- /* First make sure we're not already connected. */
- if (sl && sl->magic == X25_ASY_MAGIC)
- return -EEXIST;
-
/* OK. Find a free X.25 channel to use. */
sl = x25_asy_alloc();
if (sl == NULL)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 15/70] perf trace: Fix documentation for -i |
| Message-ID | <r5zIn-7K8-37@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Feiner <pfeiner@google.com>
commit 956959f6b7a982b2e789a7a8fa1de437074a5eb9 upstream.
The -i flag was incorrectly listed as a short flag for --no-inherit. It
should have only been listed as a short flag for --input.
This documentation error has existed since the --input flag was
introduced in 6810fc915f7a89d8134edb3996dbbf8eac386c26 (perf trace: Add
option to analyze events in a file versus live).
Signed-off-by: Peter Feiner <pfeiner@google.com>
Cc: David Ahern <dsahern@gmail.com>
Link: http://lkml.kernel.org/r/1446657706-14518-1-git-send-email-pfeiner@google.com
Fixes: 6810fc915f7a ("perf trace: Add option to analyze events in a file versus live")
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/Documentation/perf-trace.txt | 1 -
1 file changed, 1 deletion(-)
--- a/tools/perf/Documentation/perf-trace.txt
+++ b/tools/perf/Documentation/perf-trace.txt
@@ -59,7 +59,6 @@ OPTIONS
--verbose=::
Verbosity level.
--i::
--no-inherit::
Child tasks do not inherit counters.
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 57/70] mm/memory_hotplug.c: check for missing sections in test_pages_in_a_zone() |
| Message-ID | <r5zIn-7K8-41@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Banman <abanman@sgi.com>
commit 5f0f2887f4de9508dcf438deab28f1de8070c271 upstream.
test_pages_in_a_zone() does not account for the possibility of missing
sections in the given pfn range. pfn_valid_within always returns 1 when
CONFIG_HOLES_IN_ZONE is not set, allowing invalid pfns from missing
sections to pass the test, leading to a kernel oops.
Wrap an additional pfn loop with PAGES_PER_SECTION granularity to check
for missing sections before proceeding into the zone-check code.
This also prevents a crash from offlining memory devices with missing
sections. Despite this, it may be a good idea to keep the related patch
'[PATCH 3/3] drivers: memory: prohibit offlining of memory blocks with
missing sections' because missing sections in a memory block may lead to
other problems not covered by the scope of this fix.
Signed-off-by: Andrew Banman <abanman@sgi.com>
Acked-by: Alex Thorlton <athorlton@sgi.com>
Cc: Russ Anderson <rja@sgi.com>
Cc: Alex Thorlton <athorlton@sgi.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: Greg KH <greg@kroah.com>
Cc: Seth Jennings <sjennings@variantweb.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory_hotplug.c | 31 +++++++++++++++++++------------
1 file changed, 19 insertions(+), 12 deletions(-)
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1220,23 +1220,30 @@ int is_mem_section_removable(unsigned lo
*/
static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
{
- unsigned long pfn;
+ unsigned long pfn, sec_end_pfn;
struct zone *zone = NULL;
struct page *page;
int i;
- for (pfn = start_pfn;
+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
pfn < end_pfn;
- pfn += MAX_ORDER_NR_PAGES) {
- i = 0;
- /* This is just a CONFIG_HOLES_IN_ZONE check.*/
- while ((i < MAX_ORDER_NR_PAGES) && !pfn_valid_within(pfn + i))
- i++;
- if (i == MAX_ORDER_NR_PAGES)
+ pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
+ /* Make sure the memory section is present first */
+ if (!present_section_nr(pfn_to_section_nr(pfn)))
continue;
- page = pfn_to_page(pfn + i);
- if (zone && page_zone(page) != zone)
- return 0;
- zone = page_zone(page);
+ for (; pfn < sec_end_pfn && pfn < end_pfn;
+ pfn += MAX_ORDER_NR_PAGES) {
+ i = 0;
+ /* This is just a CONFIG_HOLES_IN_ZONE check.*/
+ while ((i < MAX_ORDER_NR_PAGES) &&
+ !pfn_valid_within(pfn + i))
+ i++;
+ if (i == MAX_ORDER_NR_PAGES)
+ continue;
+ page = pfn_to_page(pfn + i);
+ if (zone && page_zone(page) != zone)
+ return 0;
+ zone = page_zone(page);
+ }
}
return 1;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 67/70] intel_scu_ipcutil: underflow in scu_reg_access() |
| Message-ID | <r5zIo-7K8-45@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit b1d353ad3d5835b16724653b33c05124e1b5acf1 upstream.
"count" is controlled by the user and it can be negative. Let's prevent
that by making it unsigned. You have to have CAP_SYS_RAWIO to call this
function so the bug is not as serious as it could be.
Fixes: 5369c02d951a ('intel_scu_ipc: Utility driver for intel scu ipc')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Darren Hart <dvhart@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/intel_scu_ipcutil.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/intel_scu_ipcutil.c
+++ b/drivers/platform/x86/intel_scu_ipcutil.c
@@ -49,7 +49,7 @@ struct scu_ipc_data {
static int scu_reg_access(u32 cmd, struct scu_ipc_data *data)
{
- int count = data->count;
+ unsigned int count = data->count;
if (count == 0 || count == 3 || count > 4)
return -EINVAL;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 49/70] KVM: PPC: Fix emulation of H_SET_DABR/X on POWER8 |
| Message-ID | <r5zIo-7K8-47@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Thomas Huth <thuth@redhat.com> commit 760a7364f27d974d100118d88190e574626e18a6 upstream. In the old DABR register, the BT (Breakpoint Translation) bit is bit number 61. In the new DAWRX register, the WT (Watchpoint Translation) bit is bit number 59. So to move the DABR-BT bit into the position of the DAWRX-WT bit, it has to be shifted by two, not only by one. This fixes hardware watchpoints in gdb of older guests that only use the H_SET_DABR/X interface instead of the new H_SET_MODE interface. Signed-off-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Laurent Vivier <lvivier@redhat.com> Reviewed-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Paul Mackerras <paulus@samba.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S +++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S @@ -1805,7 +1805,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) /* Emulate H_SET_DABR/X on P8 for the sake of compat mode guests */ 2: rlwimi r5, r4, 5, DAWRX_DR | DAWRX_DW - rlwimi r5, r4, 1, DAWRX_WT + rlwimi r5, r4, 2, DAWRX_WT clrrdi r4, r4, 3 std r4, VCPU_DAWR(r3) std r5, VCPU_DAWRX(r3)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 63/70] memcg: only free spare array when readers are done |
| Message-ID | <r5zIo-7K8-49@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martijn Coenen <maco@google.com>
commit 6611d8d76132f86faa501de9451a89bf23fb2371 upstream.
A spare array holding mem cgroup threshold events is kept around to make
sure we can always safely deregister an event and have an array to store
the new set of events in.
In the scenario where we're going from 1 to 0 registered events, the
pointer to the primary array containing 1 event is copied to the spare
slot, and then the spare slot is freed because no events are left.
However, it is freed before calling synchronize_rcu(), which means
readers may still be accessing threshold->primary after it is freed.
Fixed by only freeing after synchronize_rcu().
Signed-off-by: Martijn Coenen <maco@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5858,16 +5858,17 @@ static void __mem_cgroup_usage_unregiste
swap_buffers:
/* Swap primary and spare array */
thresholds->spare = thresholds->primary;
- /* If all events are unregistered, free the spare array */
- if (!new) {
- kfree(thresholds->spare);
- thresholds->spare = NULL;
- }
rcu_assign_pointer(thresholds->primary, new);
/* To be sure that nobody uses thresholds */
synchronize_rcu();
+
+ /* If all events are unregistered, free the spare array */
+ if (!new) {
+ kfree(thresholds->spare);
+ thresholds->spare = NULL;
+ }
unlock:
mutex_unlock(&memcg->thresholds_lock);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 58/70] xhci: Fix list corruption in urb dequeue at host removal |
| Message-ID | <r5zIo-7K8-53@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit 5c82171167adb8e4ac77b91a42cd49fb211a81a0 upstream.
xhci driver frees data for all devices, both usb2 and and usb3 the
first time usb_remove_hcd() is called, including td_list and and xhci_ring
structures.
When usb_remove_hcd() is called a second time for the second xhci bus it
will try to dequeue all pending urbs, and touches td_list which is already
freed for that endpoint.
Reported-by: Joe Lawrence <joe.lawrence@stratus.com>
Tested-by: Joe Lawrence <joe.lawrence@stratus.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1523,7 +1523,9 @@ int xhci_urb_dequeue(struct usb_hcd *hcd
xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb,
"HW died, freeing TD.");
urb_priv = urb->hcpriv;
- for (i = urb_priv->td_cnt; i < urb_priv->length; i++) {
+ for (i = urb_priv->td_cnt;
+ i < urb_priv->length && xhci->devs[urb->dev->slot_id];
+ i++) {
td = urb_priv->td[i];
if (!list_empty(&td->td_list))
list_del_init(&td->td_list);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 66/70] dump_stack: avoid potential deadlocks |
| Message-ID | <r5zIo-7K8-51@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit d7ce36924344ace0dbdc855b1206cacc46b36d45 upstream.
Some servers experienced fatal deadlocks because of a combination of
bugs, leading to multiple cpus calling dump_stack().
The checksumming bug was fixed in commit 34ae6a1aa054 ("ipv6: update
skb->csum when CE mark is propagated").
The second problem is a faulty locking in dump_stack()
CPU1 runs in process context and calls dump_stack(), grabs dump_lock.
CPU2 receives a TCP packet under softirq, grabs socket spinlock, and
call dump_stack() from netdev_rx_csum_fault().
dump_stack() spins on atomic_cmpxchg(&dump_lock, -1, 2), since
dump_lock is owned by CPU1
While dumping its stack, CPU1 is interrupted by a softirq, and happens
to process a packet for the TCP socket locked by CPU2.
CPU1 spins forever in spin_lock() : deadlock
Stack trace on CPU1 looked like :
NMI backtrace for cpu 1
RIP: _raw_spin_lock+0x25/0x30
...
Call Trace:
<IRQ>
tcp_v6_rcv+0x243/0x620
ip6_input_finish+0x11f/0x330
ip6_input+0x38/0x40
ip6_rcv_finish+0x3c/0x90
ipv6_rcv+0x2a9/0x500
process_backlog+0x461/0xaa0
net_rx_action+0x147/0x430
__do_softirq+0x167/0x2d0
call_softirq+0x1c/0x30
do_softirq+0x3f/0x80
irq_exit+0x6e/0xc0
smp_call_function_single_interrupt+0x35/0x40
call_function_single_interrupt+0x6a/0x70
<EOI>
printk+0x4d/0x4f
printk_address+0x31/0x33
print_trace_address+0x33/0x3c
print_context_stack+0x7f/0x119
dump_trace+0x26b/0x28e
show_trace_log_lvl+0x4f/0x5c
show_stack_log_lvl+0x104/0x113
show_stack+0x42/0x44
dump_stack+0x46/0x58
netdev_rx_csum_fault+0x38/0x3c
__skb_checksum_complete_head+0x6e/0x80
__skb_checksum_complete+0x11/0x20
tcp_rcv_established+0x2bd5/0x2fd0
tcp_v6_do_rcv+0x13c/0x620
sk_backlog_rcv+0x15/0x30
release_sock+0xd2/0x150
tcp_recvmsg+0x1c1/0xfc0
inet_recvmsg+0x7d/0x90
sock_recvmsg+0xaf/0xe0
___sys_recvmsg+0x111/0x3b0
SyS_recvmsg+0x5c/0xb0
system_call_fastpath+0x16/0x1b
Fixes: b58d977432c8 ("dump_stack: serialize the output from dump_stack()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Alex Thorlton <athorlton@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/dump_stack.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -25,6 +25,7 @@ static atomic_t dump_lock = ATOMIC_INIT(
asmlinkage void dump_stack(void)
{
+ unsigned long flags;
int was_locked;
int old;
int cpu;
@@ -33,9 +34,8 @@ asmlinkage void dump_stack(void)
* Permit this cpu to perform nested stack dumps while serialising
* against other CPUs
*/
- preempt_disable();
-
retry:
+ local_irq_save(flags);
cpu = smp_processor_id();
old = atomic_cmpxchg(&dump_lock, -1, cpu);
if (old == -1) {
@@ -43,6 +43,7 @@ retry:
} else if (old == cpu) {
was_locked = 1;
} else {
+ local_irq_restore(flags);
cpu_relax();
goto retry;
}
@@ -52,7 +53,7 @@ retry:
if (!was_locked)
atomic_set(&dump_lock, -1);
- preempt_enable();
+ local_irq_restore(flags);
}
#else
asmlinkage void dump_stack(void)
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 41/70] nfs: Fix race in __update_open_stateid() |
| Message-ID | <r5zIo-7K8-57@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Elble <aweits@rit.edu>
commit 361cad3c89070aeb37560860ea8bfc092d545adc upstream.
We've seen this in a packet capture - I've intermixed what I
think was going on. The fix here is to grab the so_lock sooner.
1964379 -> #1 open (for write) reply seqid=1
1964393 -> #2 open (for read) reply seqid=2
__nfs4_close(), state->n_wronly--
nfs4_state_set_mode_locked(), changes state->state = [R]
state->flags is [RW]
state->state is [R], state->n_wronly == 0, state->n_rdonly == 1
1964398 -> #3 open (for write) call -> because close is already running
1964399 -> downgrade (to read) call seqid=2 (close of #1)
1964402 -> #3 open (for write) reply seqid=3
__update_open_stateid()
nfs_set_open_stateid_locked(), changes state->flags
state->flags is [RW]
state->state is [R], state->n_wronly == 0, state->n_rdonly == 1
new sequence number is exposed now via nfs4_stateid_copy()
next step would be update_open_stateflags(), pending so_lock
1964403 -> downgrade reply seqid=2, fails with OLD_STATEID (close of #1)
nfs4_close_prepare() gets so_lock and recalcs flags -> send close
1964405 -> downgrade (to read) call seqid=3 (close of #1 retry)
__update_open_stateid() gets so_lock
* update_open_stateflags() updates state->n_wronly.
nfs4_state_set_mode_locked() updates state->state
state->flags is [RW]
state->state is [RW], state->n_wronly == 1, state->n_rdonly == 1
* should have suppressed the preceding nfs4_close_prepare() from
sending open_downgrade
1964406 -> write call
1964408 -> downgrade (to read) reply seqid=4 (close of #1 retry)
nfs_clear_open_stateid_locked()
state->flags is [R]
state->state is [RW], state->n_wronly == 1, state->n_rdonly == 1
1964409 -> write reply (fails, openmode)
Signed-off-by: Andrew Elble <aweits@rit.edu>
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/nfs4proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1169,6 +1169,7 @@ static void __update_open_stateid(struct
* Protect the call to nfs4_state_set_mode_locked and
* serialise the stateid update
*/
+ spin_lock(&state->owner->so_lock);
write_seqlock(&state->seqlock);
if (deleg_stateid != NULL) {
nfs4_stateid_copy(&state->stateid, deleg_stateid);
@@ -1177,7 +1178,6 @@ static void __update_open_stateid(struct
if (open_stateid != NULL)
nfs_set_open_stateid_locked(state, open_stateid, fmode);
write_sequnlock(&state->seqlock);
- spin_lock(&state->owner->so_lock);
update_open_stateflags(state, fmode);
spin_unlock(&state->owner->so_lock);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 06/70] staging/speakup: Use tty_ldisc_ref() for paste kworker |
| Message-ID | <r5zIo-7K8-59@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Hurley <peter@hurleysoftware.com>
commit f4f9edcf9b5289ed96113e79fa65a7bf27ecb096 upstream.
As the function documentation for tty_ldisc_ref_wait() notes, it is
only callable from a tty file_operations routine; otherwise there
is no guarantee the ref won't be NULL.
The key difference with the VT's paste_selection() is that is an ioctl,
where __speakup_paste_selection() is completely async kworker, kicked
off from interrupt context.
Fixes: 28a821c30688 ("Staging: speakup: Update __speakup_paste_selection()
tty (ab)usage to match vt")
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/speakup/selection.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/staging/speakup/selection.c
+++ b/drivers/staging/speakup/selection.c
@@ -140,7 +140,9 @@ static void __speakup_paste_selection(st
struct tty_ldisc *ld;
DECLARE_WAITQUEUE(wait, current);
- ld = tty_ldisc_ref_wait(tty);
+ ld = tty_ldisc_ref(tty);
+ if (!ld)
+ goto tty_unref;
tty_buffer_lock_exclusive(&vc->port);
add_wait_queue(&vc->paste_wait, &wait);
@@ -160,6 +162,7 @@ static void __speakup_paste_selection(st
tty_buffer_unlock_exclusive(&vc->port);
tty_ldisc_deref(ld);
+tty_unref:
tty_kref_put(tty);
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 70/70] module: wrapper for symbol name. |
| Message-ID | <r5zIo-7K8-55@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rusty Russell <rusty@rustcorp.com.au>
commit 2e7bac536106236104e9e339531ff0fcdb7b8147 upstream.
This trivial wrapper adds clarity and makes the following patch
smaller.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3381,6 +3381,11 @@ static inline int is_arm_mapping_symbol(
&& (str[2] == '\0' || str[2] == '.');
}
+static const char *symname(struct module *mod, unsigned int symnum)
+{
+ return mod->strtab + mod->symtab[symnum].st_name;
+}
+
static const char *get_ksymbol(struct module *mod,
unsigned long addr,
unsigned long *size,
@@ -3403,15 +3408,15 @@ static const char *get_ksymbol(struct mo
/* We ignore unnamed symbols: they're uninformative
* and inserted at a whim. */
+ if (*symname(mod, i) == '\0'
+ || is_arm_mapping_symbol(symname(mod, i)))
+ continue;
+
if (mod->symtab[i].st_value <= addr
- && mod->symtab[i].st_value > mod->symtab[best].st_value
- && *(mod->strtab + mod->symtab[i].st_name) != '\0'
- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
+ && mod->symtab[i].st_value > mod->symtab[best].st_value)
best = i;
if (mod->symtab[i].st_value > addr
- && mod->symtab[i].st_value < nextval
- && *(mod->strtab + mod->symtab[i].st_name) != '\0'
- && !is_arm_mapping_symbol(mod->strtab + mod->symtab[i].st_name))
+ && mod->symtab[i].st_value < nextval)
nextval = mod->symtab[i].st_value;
}
@@ -3422,7 +3427,7 @@ static const char *get_ksymbol(struct mo
*size = nextval - mod->symtab[best].st_value;
if (offset)
*offset = addr - mod->symtab[best].st_value;
- return mod->strtab + mod->symtab[best].st_name;
+ return symname(mod, best);
}
/* For kallsyms to ask for address resolution. NULL means not found. Careful
@@ -3523,8 +3528,7 @@ int module_get_kallsym(unsigned int symn
if (symnum < mod->num_symtab) {
*value = mod->symtab[symnum].st_value;
*type = mod->symtab[symnum].st_info;
- strlcpy(name, mod->strtab + mod->symtab[symnum].st_name,
- KSYM_NAME_LEN);
+ strlcpy(name, symname(mod, symnum), KSYM_NAME_LEN);
strlcpy(module_name, mod->name, MODULE_NAME_LEN);
*exported = is_exported(name, *value, mod);
preempt_enable();
@@ -3541,7 +3545,7 @@ static unsigned long mod_find_symname(st
unsigned int i;
for (i = 0; i < mod->num_symtab; i++)
- if (strcmp(name, mod->strtab+mod->symtab[i].st_name) == 0 &&
+ if (strcmp(name, symname(mod, i)) == 0 &&
mod->symtab[i].st_info != 'U')
return mod->symtab[i].st_value;
return 0;
@@ -3583,7 +3587,7 @@ int module_kallsyms_on_each_symbol(int (
if (mod->state == MODULE_STATE_UNFORMED)
continue;
for (i = 0; i < mod->num_symtab; i++) {
- ret = fn(data, mod->strtab + mod->symtab[i].st_name,
+ ret = fn(data, symname(mod, i),
mod, mod->symtab[i].st_value);
if (ret != 0)
return ret;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-02-24 06:00 +0100 |
| Subject | [PATCH 3.14 43/70] udf: Prevent buffer overrun with multi-byte characters |
| Message-ID | <r5zIo-7K8-63@gated-at.bofh.it> |
| In reply to | #1341478 |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Gabbasov <andrew_gabbasov@mentor.com>
commit ad402b265ecf6fa22d04043b41444cdfcdf4f52d upstream.
udf_CS0toUTF8 function stops the conversion when the output buffer
length reaches UDF_NAME_LEN-2, which is correct maximum name length,
but, when checking, it leaves the space for a single byte only,
while multi-bytes output characters can take more space, causing
buffer overflow.
Similar error exists in udf_CS0toNLS function, that restricts
the output length to UDF_NAME_LEN, while actual maximum allowed
length is UDF_NAME_LEN-2.
In these cases the output can override not only the current buffer
length field, causing corruption of the name buffer itself, but also
following allocation structures, causing kernel crash.
Adjust the output length checks in both functions to prevent buffer
overruns in case of multi-bytes UTF8 or NLS characters.
Signed-off-by: Andrew Gabbasov <andrew_gabbasov@mentor.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/unicode.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/udf/unicode.c
+++ b/fs/udf/unicode.c
@@ -132,11 +132,15 @@ int udf_CS0toUTF8(struct ustr *utf_o, co
if (c < 0x80U)
utf_o->u_name[utf_o->u_len++] = (uint8_t)c;
else if (c < 0x800U) {
+ if (utf_o->u_len > (UDF_NAME_LEN - 4))
+ break;
utf_o->u_name[utf_o->u_len++] =
(uint8_t)(0xc0 | (c >> 6));
utf_o->u_name[utf_o->u_len++] =
(uint8_t)(0x80 | (c & 0x3f));
} else {
+ if (utf_o->u_len > (UDF_NAME_LEN - 5))
+ break;
utf_o->u_name[utf_o->u_len++] =
(uint8_t)(0xe0 | (c >> 12));
utf_o->u_name[utf_o->u_len++] =
@@ -281,7 +285,7 @@ static int udf_CS0toNLS(struct nls_table
c = (c << 8) | ocu[i++];
len = nls->uni2char(c, &utf_o->u_name[utf_o->u_len],
- UDF_NAME_LEN - utf_o->u_len);
+ UDF_NAME_LEN - 2 - utf_o->u_len);
/* Valid character? */
if (len >= 0)
utf_o->u_len += len;
[toc] | [prev] | [next] | [standalone]
Page 1 of 3 [1] 2 3 Next page →
Back to top | Article view | linux.kernel
csiph-web