Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1418691 > unrolled thread

[4.2.y-ckt stable] Linux 4.2.8-ckt12 stable review

Back to article view | Back to linux.kernel

Contents

  [4.2.y-ckt stable] Linux 4.2.8-ckt12 stable review Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:20 +0200
    [PATCH 4.2.y-ckt 018/206] [media] media: v4l2-compat-ioctl32: fix missing reserved field copy in put_v4l2_create32 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:20 +0200
    [PATCH 4.2.y-ckt 007/206] ath5k: Change led pin configuration for compaq c700 laptop Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:20 +0200
    [PATCH 4.2.y-ckt 012/206] drm/gma500: Fix possible out of bounds read Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:20 +0200
    [PATCH 4.2.y-ckt 205/206] drivers/hwspinlock: use correct radix tree API Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 196/206] netlink: Fix dump skb leak/double free Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 185/206] MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 199/206] tipc: fix nametable publication field in nl compat Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 195/206] x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 181/206] s390/vmem: fix identity mapping Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 147/206] affs: fix remount failure when there are no options changed Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 176/206] ACPI / sysfs: fix error code in get_status() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 190/206] MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 193/206] i40e: fix an uninitialized variable bug Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 192/206] IB/IWPM: Fix a potential skb leak Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 204/206] uapi glibc compat: fix compilation when !__USE_MISC in glibc Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 173/206] metag: Fix atomic_*_return inline asm constraints Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 186/206] MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 202/206] net: ehea: avoid null pointer dereference Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 183/206] powerpc/sstep: Fix sstep.c compile on powerpcspe Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 201/206] batman-adv: fix skb deref after free Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 180/206] ata: sata_dwc_460ex: remove incorrect locking Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 178/206] MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 188/206] MIPS: math-emu: Fix BC1{EQ,NE}Z emulation Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 194/206] blk-mq: fix undefined behaviour in order_to_size() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 177/206] clk: qcom: msm8916: Fix crypto clock flags Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 189/206] MIPS: Fix BC1{EQ,NE}Z return offset calculation Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 206/206] RDMA/cxgb3: device driver frees DMA memory with different size Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 169/206] cxl: Fix DAR check & use REGION_ID instead of opencoding Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 191/206] IB/srp: Print "ib_srp: " prefix once Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 184/206] MIPS: BMIPS: BMIPS5000 has I cache filing from D cache Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 187/206] MIPS: BMIPS: Pretty print BMIPS5200 processor name Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 200/206] sunrpc: Update RPCBIND_MAXNETIDLEN Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 198/206] sched/preempt: Fix preempt_count manipulations Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 179/206] NFS: Fix an LOCK/OPEN race when unlinking an open file Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 203/206] tuntap: correctly wake up process during uninit Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 151/206] serial: doc: Un-document non-existing uart_write_console() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 197/206] MIPS: ath79: fix regression in PCI window initialization Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 182/206] perf tools: Fix perf regs mask generation Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:30 +0200
    [PATCH 4.2.y-ckt 146/206] hpfs: fix remount failure when there are no options changed Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 170/206] taskstats: fix nl parsing in accounting/getdelays.c Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 148/206] hpfs: implement the show_options method Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 136/206] wait/ptrace: assume __WALL if the child is traced Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 150/206] ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 174/206] tty: vt, return error when con_startup fails Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 144/206] Input: pwm-beeper - fix - scheduling while atomic Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 165/206] EDAC: Increment correct counter in edac_inc_ue_error() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 149/206] regmap: cache: Fix typo in cache_bypass parameter description Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 143/206] Input: xpad - prevent spurious input from wired Xbox 360 controllers Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 161/206] cx23885: uninitialized variable in cx23885_av_work_handler() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 168/206] ARM: debug: remove extraneous DEBUG_HI3716_UART option Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 145/206] MIPS: lib: Mark intrinsics notrace Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 154/206] iommu/vt-d: Improve fault handler error messages Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 160/206] am437x-vpfe: fix an uninitialized variable bug Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 164/206] perf test: Ignore kcore files in the "vmlinux matches kallsyms" test Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 156/206] ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 162/206] ipv6, token: allow for clearing the current device token Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 166/206] PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 171/206] char: Drop bogus dependency of DEVPORT on !M68K Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 157/206] security: drop the unused hook skb_owned_by Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 163/206] usb: gadget: f_fs: Fix EFAULT generation for async read operations Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 172/206] driver-core: use 'dev' argument in dev_dbg_ratelimited stub Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 159/206] am437x-vfpe: fix typo in vpfe_get_app_input_index Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 153/206] iommu/vt-d: Ratelimit fault handler Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 155/206] power: ipaq-micro-battery: freeing the wrong variable Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 167/206] alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 175/206] cpufreq: Fix GOV_LIMITS handling for the userspace governor Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 158/206] mfd: lp8788-irq: Uninitialized variable in irq handler Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 152/206] iio: buffer: add missing descriptions in iio_buffer_access_funcs Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 142/206] dell-rbtn: Ignore ACPI notifications if device is suspended Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:40 +0200
    [PATCH 4.2.y-ckt 127/206] Input: uinput - handle compat ioctl for UI_SET_PHYS Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 113/206] fs/cifs: correctly to anonymous authentication via NTLMSSP Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 124/206] cifs: Create dedicated keyring for spnego operations Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 114/206] fs/cifs: correctly to anonymous authentication for the LANMAN authentication Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 112/206] drm/fb_helper: Fix references to dev->mode_config.num_connector Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 094/206] powerpc/eeh: Don't report error in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 123/206] ASoC: ak4642: Enable cache usage to fix crashes on resume Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 117/206] remove directory incorrectly tries to set delete on close on non-empty directories Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 104/206] MIPS: Disable preemption during prctl(PR_SET_FP_MODE, ...) Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 116/206] fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 133/206] mmc: sdhci-pci: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 134/206] mmc: sdhci-acpi: Remove MMC_CAP_BUS_WIDTH_TEST for Intel controllers Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 131/206] drm/i915: Don't leave old junk in ilk active watermarks on readout Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 121/206] xfs: skip stale inodes in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 109/206] PCI: Disable all BAR sizing for devices with non-compliant BARs Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 122/206] KVM: MTRR: remove MSR 0x2f8 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 140/206] drm/amdgpu: Fix hdmi deep color support. Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 132/206] mmc: longer timeout for long read time quirk Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 118/206] cpuidle: Fix cpuidle_state_is_coupled() argument in cpuidle_enter() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 106/206] ring-buffer: Use long for nr_pages to avoid overflow failures Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 128/206] PM / sleep: Handle failures in device_suspend_late() consistently Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 137/206] xen/x86: actually allocate legacy interrupts on PV guests Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 105/206] MIPS: Force CPUs to lose FP context during mode switches Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 119/206] xfs: xfs_iflush_cluster fails to abort on error Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 110/206] MIPS: MSA: Fix a link error on `_init_msa_upper' with older GCC Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 107/206] ring-buffer: Prevent overflow of size in ring_buffer_resize() Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 126/206] kvm: arm64: Fix EC field in inject_abt64 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 120/206] xfs: fix inode validity check in xfs_iflush_cluster Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 125/206] ALSA: hda - Fix headphone noise on Dell XPS 13 9360 Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 135/206] sunrpc: fix stripping of padded MIC tokens Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 139/206] UBI: Fix static volume checks when Fastmap is used Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 129/206] mm: use phys_addr_t for reserve_bootmem_region() arguments Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 115/206] fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 098/206] MIPS: Sync icache & dcache in set_pte_at Kamal Mostafa <kamal@canonical.com> - 2016-06-09 23:50 +0200
    [PATCH 4.2.y-ckt 073/206] MIPS: Reserve nosave data for hibernation Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 065/206] ext4: silence UBSAN in ext4_mb_init() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 095/206] powerpc/eeh: Restore initial state in eeh_pe_reset_and_recover() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 102/206] MIPS: ptrace: Fix FP context restoration FCSR regression Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 081/206] USB: serial: mxuport: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 085/206] MIPS: KVM: Fix timer IRQ race when writing CP0_Compare Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 079/206] USB: serial: io_edgeport: fix memory leaks in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 084/206] MIPS: KVM: Fix timer IRQ race when freezing timer Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 088/206] irqchip/gic-v3: Configure all interrupts as non-secure Group-1 Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 072/206] MIPS: Avoid using unwind_stack() with usermode Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 093/206] sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 089/206] arm64: cpuinfo: Missing NULL terminator in compat_hwcap_str Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 092/206] rtlwifi: pci: use dev_kfree_skb_irq instead of kfree_skb in rtl_pci_reset_trx_ring Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 071/206] MIPS: Don't unwind to user mode with EVA Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 096/206] Revert "powerpc/eeh: Fix crash in eeh_add_device_early() on Cell" Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 078/206] USB: serial: io_edgeport: fix memory leaks in attach error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 100/206] MIPS: Fix uapi include in exported asm/siginfo.h Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 082/206] USB: serial: quatech2: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 063/206] ext4: fix oops on corrupted filesystem Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 076/206] usb: host: xhci-rcar: Avoid long wait in xhci_reset() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 097/206] MIPS: Handle highmem pages in __update_cache Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 101/206] MIPS: math-emu: Fix jalr emulation when rd == $0 Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 077/206] mfd: omap-usb-tll: Fix scheduling while atomic BUG Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 103/206] MIPS: ptrace: Prevent writes to read-only FCSR bits Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 091/206] rtlwifi: Fix logic error in enter/exit power-save mode Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 080/206] USB: serial: keyspan: fix use-after-free in probe error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 090/206] kbuild: move -Wunused-const-variable to W=1 warning level Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 083/206] crypto: caam - fix caam_jr_alloc() ret code Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 087/206] irqchip/gic: Ensure ordering between read of INTACK and shared data Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:00 +0200
    [PATCH 4.2.y-ckt 044/206] Drivers: hv_vmbus: Fix signal to host condition Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 066/206] arm64: Ensure pmd_present() returns false after pmd_mknotpresent() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 040/206] aacraid: Fix for aac_command_thread hang Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 058/206] USB: serial: option: add more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 069/206] can: fix handling of unmodifiable configuration options Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 043/206] MIPS: ath79: make bootconsole wait for both THRE and TEMT Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 070/206] MIPS: Fix siginfo.h to use strict posix types Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 057/206] mcb: Fixed bar number assignment for the gdd Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 052/206] thunderbolt: Fix double free of drom buffer Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 064/206] ext4: address UBSAN warning in mb_find_order_for_block() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 042/206] ext4: fix hang when processing corrupted orphaned inode list Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 047/206] mei: fix NULL dereferencing during FW initiated disconnection Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 050/206] Fix OpenSSH pty regression on close Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 053/206] USB: serial: option: add support for Cinterion PH8 and AHxx Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 049/206] tty: Abstract tty buffer work Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 068/206] ath10k: fix kernel panic, move arvifs list head init before htt init Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 067/206] ARM: dts: exynos: Add interrupt line to MAX8997 PMIC on exynos4210-trats Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 045/206] Drivers: hv: ring_buffer.c: fix comment style Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 051/206] QE-UART: add "fsl,t1040-ucc-uart" to of_device_id Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 033/206] usb: core: hub: hub_port_init lock controller instead of bus Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 055/206] usb: misc: usbtest: format the data pattern according to max packet size Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 048/206] mei: amthif: discard not read messages Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 059/206] USB: serial: option: add even more ZTE device ids Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 054/206] USB: leave LPM alone if possible when binding/unbinding interface drivers Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 041/206] aacraid: Fix for KDUMP driver hang Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 062/206] USB: serial: cp210x: fix hardware flow-control disable Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:10 +0200
    [PATCH 4.2.y-ckt 028/206] crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 031/206] pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 039/206] aacraid: Relinquish CPU during timeout wait Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 017/206] mfd: intel_quark_i2c_gpio: Remove clock tree on error path Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 037/206] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 032/206] btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 016/206] mfd: intel_quark_i2c_gpio: Use clkdev_create() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 026/206] powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 023/206] hwmon: (ads7828) Enable internal reference Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 003/206] ath10k: fix debugfs pktlog_filter write Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 034/206] serial: 8250_pci: fix divide error bug if baud rate is 0 Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 024/206] ath10k: fix rx_channel during hw reconfigure Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 030/206] ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards. Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 020/206] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal" Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 036/206] staging: comedi: das1800: fix possible NULL dereference Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 001/206] ath10k: fix firmware assert in monitor mode Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 022/206] usb: f_mass_storage: test whether thread is running before starting another Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 015/206] cpuidle: Indicate when a device has been unregistered Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 014/206] Bluetooth: vhci: purge unhandled skbs Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 013/206] Bluetooth: vhci: fix open_timeout vs. hdev race Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 010/206] rtlwifi: rtl8723be: Add antenna select module parameter Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 029/206] ath9k: Add a module parameter to invert LED polarity. Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 027/206] PM / Runtime: Fix error path in pm_runtime_force_resume() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 025/206] Bluetooth: vhci: Fix race at creating hci device Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:20 +0200
    [PATCH 4.2.y-ckt 009/206] xfs: Don't wrap growfs AGFL indexes Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
    [PATCH 4.2.y-ckt 004/206] drm/i915: Call intel_dp_mst_resume() before resuming displays Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
    [PATCH 4.2.y-ckt 008/206] xfs: disallow rw remount on fs with unknown ro-compat features Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
    [PATCH 4.2.y-ckt 002/206] drm/i915: Fix race condition in intel_dp_destroy_mst_connector() Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
    [PATCH 4.2.y-ckt 011/206] rtlwifi: btcoexist: Implement antenna selection Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
    [PATCH 4.2.y-ckt 006/206] drm/i915: Exit cherryview_irq_handler() after one pass Kamal Mostafa <kamal@canonical.com> - 2016-06-10 00:30 +0200
      RE: [PATCH 4.2.y-ckt 006/206] drm/i915: Exit  cherryview_irq_handler() after one pass "Ursulin, Tvrtko" <tvrtko.ursulin@intel.com> - 2016-06-10 10:50 +0200

Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10  Next page →

#1418874 — [PATCH 4.2.y-ckt 031/206] pinctrl: exynos5440: Use off-stack memory for pinctrl_gpio_range

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Andrew Jeffery <andrew@aj.id.au>

commit 71324fdc72ef0163e57631aa814a9a81e9e4770b upstream.

The range is registered into a linked list which can be referenced
throughout the lifetime of the driver. Ensure the range's memory is useful
for the same lifetime by adding it to the driver's private data structure.

The bug was introduced in the driver's initial commit, which was present in
v3.10.

Fixes: f0b9a7e521fa ("pinctrl: exynos5440: add pinctrl driver for Samsung EXYNOS5440 SoC")
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
Acked-by: Tomasz Figa <tomasz.figa@gmail.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/pinctrl/samsung/pinctrl-exynos5440.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/drivers/pinctrl/samsung/pinctrl-exynos5440.c b/drivers/pinctrl/samsung/pinctrl-exynos5440.c
index f5619fb..1882353 100644
--- a/drivers/pinctrl/samsung/pinctrl-exynos5440.c
+++ b/drivers/pinctrl/samsung/pinctrl-exynos5440.c
@@ -109,6 +109,7 @@ struct exynos5440_pmx_func {
  * @nr_groups: number of pin groups available.
  * @pmx_functions: list of pin functions parsed from device tree.
  * @nr_functions: number of pin functions available.
+ * @range: gpio range to register with pinctrl
  */
 struct exynos5440_pinctrl_priv_data {
 	void __iomem			*reg_base;
@@ -119,6 +120,7 @@ struct exynos5440_pinctrl_priv_data {
 	unsigned int			nr_groups;
 	const struct exynos5440_pmx_func	*pmx_functions;
 	unsigned int			nr_functions;
+	struct pinctrl_gpio_range	range;
 };
 
 /**
@@ -769,7 +771,6 @@ static int exynos5440_pinctrl_register(struct platform_device *pdev,
 	struct pinctrl_desc *ctrldesc;
 	struct pinctrl_dev *pctl_dev;
 	struct pinctrl_pin_desc *pindesc, *pdesc;
-	struct pinctrl_gpio_range grange;
 	char *pin_names;
 	int pin, ret;
 
@@ -827,12 +828,12 @@ static int exynos5440_pinctrl_register(struct platform_device *pdev,
 		return PTR_ERR(pctl_dev);
 	}
 
-	grange.name = "exynos5440-pctrl-gpio-range";
-	grange.id = 0;
-	grange.base = 0;
-	grange.npins = EXYNOS5440_MAX_PINS;
-	grange.gc = priv->gc;
-	pinctrl_add_gpio_range(pctl_dev, &grange);
+	priv->range.name = "exynos5440-pctrl-gpio-range";
+	priv->range.id = 0;
+	priv->range.base = 0;
+	priv->range.npins = EXYNOS5440_MAX_PINS;
+	priv->range.gc = priv->gc;
+	pinctrl_add_gpio_range(pctl_dev, &priv->range);
 	return 0;
 }
 
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418875 — [PATCH 4.2.y-ckt 039/206] aacraid: Relinquish CPU during timeout wait

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>

commit 07beca2be24cc710461c0b131832524c9ee08910 upstream.

aac_fib_send has a special function case for initial commands during
driver initialization using wait < 0(pseudo sync mode). In this case,
the command does not sleep but rather spins checking for timeout.This
loop is calls cpu_relax() in an attempt to allow other processes/threads
to use the CPU, but this function does not relinquish the CPU and so the
command will hog the processor. This was observed in a KDUMP
"crashkernel" and that prevented the "command thread" (which is
responsible for completing the command from being timed out) from
starting because it could not get the CPU.

Fixed by replacing "cpu_relax()" call with "schedule()"
Signed-off-by: Raghava Aditya Renukunta <RaghavaAditya.Renukunta@microsemi.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/scsi/aacraid/commsup.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 4b79d95..e7344ae 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -611,10 +611,10 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
 					}
 					return -EFAULT;
 				}
-				/* We used to udelay() here but that absorbed
-				 * a CPU when a timeout occured. Not very
-				 * useful. */
-				cpu_relax();
+				/*
+				 * Allow other processes / CPUS to use core
+				 */
+				schedule();
 			}
 		} else if (down_interruptible(&fibptr->event_wait)) {
 			/* Do nothing ... satisfy
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418877 — [PATCH 4.2.y-ckt 017/206] mfd: intel_quark_i2c_gpio: Remove clock tree on error path

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit 7f0c5ae18d649ed2f4978cbf07c02a0ff732f23e upstream.

There is a potential resource leak in case when ->probe() fails. We have to
unregister and remove clock tree which is done here.

This is a follow up to previously pushed commit c4726abce63b ("mfd:
intel_quark_i2c_gpio: Use clkdev_create()") that prevents double free() when
clkdev_drop() followed by kfree() in devm_kcalloc() release stage.

I leave Fixes tag here, but the backporting will require to backport the commit
c4726abce63b ("mfd: intel_quark_i2c_gpio: Use clkdev_create()") first.

Fixes: 60ae5b9f5cdd (mfd: intel_quark_i2c_gpio: Add Intel Quark X1000 I2C-GPIO MFD Driver)
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/mfd/intel_quark_i2c_gpio.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/drivers/mfd/intel_quark_i2c_gpio.c b/drivers/mfd/intel_quark_i2c_gpio.c
index cbbf84b..340ff40 100644
--- a/drivers/mfd/intel_quark_i2c_gpio.c
+++ b/drivers/mfd/intel_quark_i2c_gpio.c
@@ -125,6 +125,7 @@ static int intel_quark_register_i2c_clk(struct intel_quark_mfd *quark_mfd)
 						INTEL_QUARK_I2C_CONTROLLER_CLK);
 
 	if (!quark_mfd->i2c_clk_lookup) {
+		clk_unregister(quark_mfd->i2c_clk);
 		dev_err(&pdev->dev, "Fixed clk register failed\n");
 		return -ENOMEM;
 	}
@@ -136,7 +137,7 @@ static void intel_quark_unregister_i2c_clk(struct pci_dev *pdev)
 {
 	struct intel_quark_mfd *quark_mfd = dev_get_drvdata(&pdev->dev);
 
-	if (!quark_mfd->i2c_clk || !quark_mfd->i2c_clk_lookup)
+	if (!quark_mfd->i2c_clk_lookup)
 		return;
 
 	clkdev_drop(quark_mfd->i2c_clk_lookup);
@@ -232,26 +233,34 @@ static int intel_quark_mfd_probe(struct pci_dev *pdev,
 	quark_mfd = devm_kzalloc(&pdev->dev, sizeof(*quark_mfd), GFP_KERNEL);
 	if (!quark_mfd)
 		return -ENOMEM;
+
 	quark_mfd->pdev = pdev;
+	dev_set_drvdata(&pdev->dev, quark_mfd);
 
 	ret = intel_quark_register_i2c_clk(quark_mfd);
 	if (ret)
 		return ret;
 
-	dev_set_drvdata(&pdev->dev, quark_mfd);
-
 	ret = intel_quark_i2c_setup(pdev, &intel_quark_mfd_cells[MFD_I2C_BAR]);
 	if (ret)
-		return ret;
+		goto err_unregister_i2c_clk;
 
 	ret = intel_quark_gpio_setup(pdev,
 				     &intel_quark_mfd_cells[MFD_GPIO_BAR]);
 	if (ret)
-		return ret;
+		goto err_unregister_i2c_clk;
 
-	return mfd_add_devices(&pdev->dev, 0, intel_quark_mfd_cells,
-			       ARRAY_SIZE(intel_quark_mfd_cells), NULL, 0,
-			       NULL);
+	ret = mfd_add_devices(&pdev->dev, 0, intel_quark_mfd_cells,
+			      ARRAY_SIZE(intel_quark_mfd_cells), NULL, 0,
+			      NULL);
+	if (ret)
+		goto err_unregister_i2c_clk;
+
+	return 0;
+
+err_unregister_i2c_clk:
+	intel_quark_unregister_i2c_clk(pdev);
+	return ret;
 }
 
 static void intel_quark_mfd_remove(struct pci_dev *pdev)
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418878 — [PATCH 4.2.y-ckt 037/206] arm/arm64: KVM: Enforce Break-Before-Make on Stage-2 page tables

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit d4b9e0790aa764c0b01e18d4e8d33e93ba36d51f upstream.

The ARM architecture mandates that when changing a page table entry
from a valid entry to another valid entry, an invalid entry is first
written, TLB invalidated, and only then the new entry being written.

The current code doesn't respect this, directly writing the new
entry and only then invalidating TLBs. Let's fix it up.

Reported-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/arm/kvm/mmu.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index 61d96a6..12d727fa 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -886,11 +886,14 @@ static int stage2_set_pmd_huge(struct kvm *kvm, struct kvm_mmu_memory_cache
 	VM_BUG_ON(pmd_present(*pmd) && pmd_pfn(*pmd) != pmd_pfn(*new_pmd));
 
 	old_pmd = *pmd;
-	kvm_set_pmd(pmd, *new_pmd);
-	if (pmd_present(old_pmd))
+	if (pmd_present(old_pmd)) {
+		pmd_clear(pmd);
 		kvm_tlb_flush_vmid_ipa(kvm, addr);
-	else
+	} else {
 		get_page(virt_to_page(pmd));
+	}
+
+	kvm_set_pmd(pmd, *new_pmd);
 	return 0;
 }
 
@@ -939,12 +942,14 @@ static int stage2_set_pte(struct kvm *kvm, struct kvm_mmu_memory_cache *cache,
 
 	/* Create 2nd stage page table mapping - Level 3 */
 	old_pte = *pte;
-	kvm_set_pte(pte, *new_pte);
-	if (pte_present(old_pte))
+	if (pte_present(old_pte)) {
+		kvm_set_pte(pte, __pte(0));
 		kvm_tlb_flush_vmid_ipa(kvm, addr);
-	else
+	} else {
 		get_page(virt_to_page(pte));
+	}
 
+	kvm_set_pte(pte, *new_pte);
 	return 0;
 }
 
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418879 — [PATCH 4.2.y-ckt 032/206] btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Luke Dashjr <luke@dashjr.org>

commit 4c63c2454eff996c5e27991221106eb511f7db38 upstream.

32-bit ioctl uses these rather than the regular FS_IOC_* versions. They can
be handled in btrfs using the same code. Without this, 32-bit {ch,ls}attr
fail.

Signed-off-by: Luke Dashjr <luke-jr+git@utopios.org>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 fs/btrfs/ctree.h |  1 +
 fs/btrfs/file.c  |  2 +-
 fs/btrfs/inode.c |  2 +-
 fs/btrfs/ioctl.c | 21 +++++++++++++++++++++
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 6bd8ea5..293d340 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -3959,6 +3959,7 @@ void btrfs_test_inode_set_ops(struct inode *inode);
 
 /* ioctl.c */
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 void btrfs_update_iflags(struct inode *inode);
 void btrfs_inherit_iflags(struct inode *inode, struct inode *dir);
 int btrfs_is_empty_uuid(u8 *uuid);
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index dfb6609..f95fe3d 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -2826,7 +2826,7 @@ const struct file_operations btrfs_file_operations = {
 	.fallocate	= btrfs_fallocate,
 	.unlocked_ioctl	= btrfs_ioctl,
 #ifdef CONFIG_COMPAT
-	.compat_ioctl	= btrfs_ioctl,
+	.compat_ioctl	= btrfs_compat_ioctl,
 #endif
 };
 
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 504eddf..c8b6b3f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9933,7 +9933,7 @@ static const struct file_operations btrfs_dir_file_operations = {
 	.iterate	= btrfs_real_readdir,
 	.unlocked_ioctl	= btrfs_ioctl,
 #ifdef CONFIG_COMPAT
-	.compat_ioctl	= btrfs_ioctl,
+	.compat_ioctl	= btrfs_compat_ioctl,
 #endif
 	.release        = btrfs_release_file,
 	.fsync		= btrfs_sync_file,
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index fc784e9..51e896f 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -5640,3 +5640,24 @@ long btrfs_ioctl(struct file *file, unsigned int
 
 	return -ENOTTY;
 }
+
+#ifdef CONFIG_COMPAT
+long btrfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+	switch (cmd) {
+	case FS_IOC32_GETFLAGS:
+		cmd = FS_IOC_GETFLAGS;
+		break;
+	case FS_IOC32_SETFLAGS:
+		cmd = FS_IOC_SETFLAGS;
+		break;
+	case FS_IOC32_GETVERSION:
+		cmd = FS_IOC_GETVERSION;
+		break;
+	default:
+		return -ENOIOCTLCMD;
+	}
+
+	return btrfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
+}
+#endif
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418880 — [PATCH 4.2.y-ckt 016/206] mfd: intel_quark_i2c_gpio: Use clkdev_create()

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Stephen Boyd <sboyd@codeaurora.org>

commit c4726abce63bf9b1887ce68fdf012a823bd94ec3 upstream.

Convert this driver to use clkdev_create() instead of
clk_register_clkdevs(). The latter API is only used by this driver,
although this driver only allocates one clk to add anyway.
Furthermore, this driver allocates the clk_lookup structure with
devm, but clkdev_drop() will free that structure when passed,
leading to a double free when this driver is removed. Clean it
all up and pave the way for the removal of clk_register_clkdevs().

Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Russell King <linux@arm.linux.org.uk>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/mfd/intel_quark_i2c_gpio.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/drivers/mfd/intel_quark_i2c_gpio.c b/drivers/mfd/intel_quark_i2c_gpio.c
index 1ce1603..cbbf84b 100644
--- a/drivers/mfd/intel_quark_i2c_gpio.c
+++ b/drivers/mfd/intel_quark_i2c_gpio.c
@@ -48,8 +48,6 @@
 /* The Quark I2C controller source clock */
 #define INTEL_QUARK_I2C_CLK_HZ	33000000
 
-#define INTEL_QUARK_I2C_NCLK	1
-
 struct intel_quark_mfd {
 	struct pci_dev		*pdev;
 	struct clk		*i2c_clk;
@@ -114,30 +112,24 @@ MODULE_DEVICE_TABLE(pci, intel_quark_mfd_ids);
 static int intel_quark_register_i2c_clk(struct intel_quark_mfd *quark_mfd)
 {
 	struct pci_dev *pdev = quark_mfd->pdev;
-	struct clk_lookup *i2c_clk_lookup;
 	struct clk *i2c_clk;
-	int ret;
-
-	i2c_clk_lookup = devm_kcalloc(&pdev->dev, INTEL_QUARK_I2C_NCLK,
-				      sizeof(*i2c_clk_lookup), GFP_KERNEL);
-	if (!i2c_clk_lookup)
-		return -ENOMEM;
-
-	i2c_clk_lookup[0].dev_id = INTEL_QUARK_I2C_CONTROLLER_CLK;
 
 	i2c_clk = clk_register_fixed_rate(&pdev->dev,
 					  INTEL_QUARK_I2C_CONTROLLER_CLK, NULL,
 					  CLK_IS_ROOT, INTEL_QUARK_I2C_CLK_HZ);
+	if (IS_ERR(i2c_clk))
+		return PTR_ERR(i2c_clk);
 
-	quark_mfd->i2c_clk_lookup = i2c_clk_lookup;
 	quark_mfd->i2c_clk = i2c_clk;
+	quark_mfd->i2c_clk_lookup = clkdev_create(i2c_clk, NULL,
+						INTEL_QUARK_I2C_CONTROLLER_CLK);
 
-	ret = clk_register_clkdevs(i2c_clk, i2c_clk_lookup,
-				   INTEL_QUARK_I2C_NCLK);
-	if (ret)
-		dev_err(&pdev->dev, "Fixed clk register failed: %d\n", ret);
+	if (!quark_mfd->i2c_clk_lookup) {
+		dev_err(&pdev->dev, "Fixed clk register failed\n");
+		return -ENOMEM;
+	}
 
-	return ret;
+	return 0;
 }
 
 static void intel_quark_unregister_i2c_clk(struct pci_dev *pdev)
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418881 — [PATCH 4.2.y-ckt 026/206] powerpc/book3s64: Fix branching to OOL handlers in relocatable kernel

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Hari Bathini <hbathini@linux.vnet.ibm.com>

commit 8ed8ab40047a570fdd8043a40c104a57248dd3fd upstream.

Some of the interrupt vectors on 64-bit POWER server processors are only
32 bytes long (8 instructions), which is not enough for the full
first-level interrupt handler. For these we need to branch to an
out-of-line (OOL) handler. But when we are running a relocatable kernel,
interrupt vectors till __end_interrupts marker are copied down to real
address 0x100. So, branching to labels (ie. OOL handlers) outside this
section must be handled differently (see LOAD_HANDLER()), considering
relocatable kernel, which would need at least 4 instructions.

However, branching from interrupt vector means that we corrupt the
CFAR (come-from address register) on POWER7 and later processors as
mentioned in commit 1707dd16. So, EXCEPTION_PROLOG_0 (6 instructions)
that contains the part up to the point where the CFAR is saved in the
PACA should be part of the short interrupt vectors before we branch out
to OOL handlers.

But as mentioned already, there are interrupt vectors on 64-bit POWER
server processors that are only 32 bytes long (like vectors 0x4f00,
0x4f20, etc.), which cannot accomodate the above two cases at the same
time owing to space constraint. Currently, in these interrupt vectors,
we simply branch out to OOL handlers, without using LOAD_HANDLER(),
which leaves us vulnerable when running a relocatable kernel (eg. kdump
case). While this has been the case for sometime now and kdump is used
widely, we were fortunate not to see any problems so far, for three
reasons:

  1. In almost all cases, production kernel (relocatable) is used for
     kdump as well, which would mean that crashed kernel's OOL handler
     would be at the same place where we end up branching to, from short
     interrupt vector of kdump kernel.
  2. Also, OOL handler was unlikely the reason for crash in almost all
     the kdump scenarios, which meant we had a sane OOL handler from
     crashed kernel that we branched to.
  3. On most 64-bit POWER server processors, page size is large enough
     that marking interrupt vector code as executable (see commit
     429d2e83) leads to marking OOL handler code from crashed kernel,
     that sits right below interrupt vector code from kdump kernel, as
     executable as well.

Let us fix this by moving the __end_interrupts marker down past OOL
handlers to make sure that we also copy OOL handlers to real address
0x100 when running a relocatable kernel.

This fix has been tested successfully in kdump scenario, on an LPAR with
4K page size by using different default/production kernel and kdump
kernel.

Also tested by manually corrupting the OOL handlers in the first kernel
and then kdump'ing, and then causing the OOL handlers to fire - mpe.

Fixes: c1fb6816fb1b ("powerpc: Add relocation on exception vector handlers")
Signed-off-by: Hari Bathini <hbathini@linux.vnet.ibm.com>
Signed-off-by: Mahesh Salgaonkar <mahesh@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 arch/powerpc/kernel/exceptions-64s.S | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 0a0399c2..b81ccc5 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -962,11 +962,6 @@ hv_facility_unavailable_relon_trampoline:
 #endif
 	STD_RELON_EXCEPTION_PSERIES(0x5700, 0x1700, altivec_assist)
 
-	/* Other future vectors */
-	.align	7
-	.globl	__end_interrupts
-__end_interrupts:
-
 	.align	7
 system_call_entry:
 	b	system_call_common
@@ -1253,6 +1248,17 @@ __end_handlers:
 	STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable)
 	STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable)
 
+	/*
+	 * The __end_interrupts marker must be past the out-of-line (OOL)
+	 * handlers, so that they are copied to real address 0x100 when running
+	 * a relocatable kernel. This ensures they can be reached from the short
+	 * trampoline handlers (like 0x4f00, 0x4f20, etc.) which branch
+	 * directly, without using LOAD_HANDLER().
+	 */
+	.align	7
+	.globl	__end_interrupts
+__end_interrupts:
+
 #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV)
 /*
  * Data area reserved for FWNMI option.
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418882 — [PATCH 4.2.y-ckt 023/206] hwmon: (ads7828) Enable internal reference

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Akshay Bhat <akshay.bhat@timesys.com>

commit 7a18afe8097731b8ffb6cb5b2b3b418ded77c105 upstream.

On ads7828 the internal reference defaults to off upon power up. When
using internal reference, it needs to be turned on and the voltage needs
to settle before normal conversion cycle can be started. Hence perform a
dummy read in the probe to enable the internal reference allowing the
voltage to settle before performing a normal read.

Without this fix, the first read from the ADC when using internal
reference always returns incorrect data.

Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/hwmon/ads7828.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/hwmon/ads7828.c b/drivers/hwmon/ads7828.c
index 6c99ee7..ee396ff 100644
--- a/drivers/hwmon/ads7828.c
+++ b/drivers/hwmon/ads7828.c
@@ -120,6 +120,7 @@ static int ads7828_probe(struct i2c_client *client,
 	unsigned int vref_mv = ADS7828_INT_VREF_MV;
 	bool diff_input = false;
 	bool ext_vref = false;
+	unsigned int regval;
 
 	data = devm_kzalloc(dev, sizeof(struct ads7828_data), GFP_KERNEL);
 	if (!data)
@@ -154,6 +155,15 @@ static int ads7828_probe(struct i2c_client *client,
 	if (!diff_input)
 		data->cmd_byte |= ADS7828_CMD_SD_SE;
 
+	/*
+	 * Datasheet specifies internal reference voltage is disabled by
+	 * default. The internal reference voltage needs to be enabled and
+	 * voltage needs to settle before getting valid ADC data. So perform a
+	 * dummy read to enable the internal reference voltage.
+	 */
+	if (!ext_vref)
+		regmap_read(data->regmap, data->cmd_byte, &regval);
+
 	hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name,
 							   data,
 							   ads7828_groups);
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418883 — [PATCH 4.2.y-ckt 003/206] ath10k: fix debugfs pktlog_filter write

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Anilkumar Kolli <akolli@qti.qualcomm.com>

commit 9ddc486aa09a3413a6c492fcf160ce61bfccb7b1 upstream.

It is observed that, we are disabling the packet log if we write same
value to the pktlog_filter for the second time. Always enable pktlogs
on non zero filter.

Fixes: 90174455ae05 ("ath10k: add support to configure pktlog filter")
Signed-off-by: Anilkumar Kolli <akolli@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/ath/ath10k/debug.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 8fa606a..bfb605b 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -2004,7 +2004,12 @@ static ssize_t ath10k_write_pktlog_filter(struct file *file,
 		goto out;
 	}
 
-	if (filter && (filter != ar->debug.pktlog_filter)) {
+	if (filter == ar->debug.pktlog_filter) {
+		ret = count;
+		goto out;
+	}
+
+	if (filter) {
 		ret = ath10k_wmi_pdev_pktlog_enable(ar, filter);
 		if (ret) {
 			ath10k_warn(ar, "failed to enable pktlog filter %x: %d\n",
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418884 — [PATCH 4.2.y-ckt 034/206] serial: 8250_pci: fix divide error bug if baud rate is 0

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?David=20M=C3=BCller?= <d.mueller@elsoft.ch>

commit 6f210c18c1c0f016772c8cd51ae12a02bfb9e7ef upstream.

Since commit 21947ba654a6 ("serial: 8250_pci: replace switch-case by
formula"), the 8250 driver crashes in the byt_set_termios() function
with a divide error. This is caused by the fact that a baud rate of 0 (B0)
is not handled properly. Fix it by falling back to B9600 in this case.

Signed-off-by: David Müller <d.mueller@elsoft.ch>
Fixes: 21947ba654a6 ("serial: 8250_pci: replace switch-case by formula")
Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/tty/serial/8250/8250_pci.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 78aeb11..9850bbf 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1402,6 +1402,9 @@ byt_set_termios(struct uart_port *p, struct ktermios *termios,
 	unsigned long m, n;
 	u32 reg;
 
+	/* Gracefully handle the B0 case: fall back to B9600 */
+	fuart = fuart ? fuart : 9600 * 16;
+
 	/* Get Fuart closer to Fref */
 	fuart *= rounddown_pow_of_two(fref / fuart);
 
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418886 — [PATCH 4.2.y-ckt 024/206] ath10k: fix rx_channel during hw reconfigure

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>

commit 1ce8c1484e80010a6e4b9611c65668ff77556f45 upstream.

Upon firmware assert, restart work will be triggered so that mac80211
will reconfigure the driver. An issue is reported that after restart
work, survey dump data do not contain in-use (SURVEY_INFO_IN_USE) info
for operating channel. During reconfigure, since mac80211 already has
valid channel context for given radio, channel context iteration return
num_chanctx > 0. Hence rx_channel is always NULL. Fix this by assigning
channel context to rx_channel when driver restart is in progress.

Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 9301716..fb84cf0 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -6123,7 +6123,13 @@ ath10k_mac_update_rx_channel(struct ath10k *ar,
 			def = &vifs[0].new_ctx->def;
 
 		ar->rx_channel = def->chan;
-	} else if (ctx && ath10k_mac_num_chanctxs(ar) == 0) {
+	} else if ((ctx && ath10k_mac_num_chanctxs(ar) == 0) ||
+		   (ctx && (ar->state == ATH10K_STATE_RESTARTED))) {
+		/* During driver restart due to firmware assert, since mac80211
+		 * already has valid channel context for given radio, channel
+		 * context iteration return num_chanctx > 0. So fix rx_channel
+		 * when restart is in progress.
+		 */
 		ar->rx_channel = ctx->def.chan;
 	} else {
 		ar->rx_channel = NULL;
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418887 — [PATCH 4.2.y-ckt 030/206] ath9k: Fix LED polarity for some Mini PCI AR9220 MB92 cards.

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Vittorio Gambaletta (VittGam)" <linux-wireless@vittgam.net>

commit 0f9edcdd88a993914fa1d1dc369b35dc503979db upstream.

The Wistron DNMA-92 and Compex WLM200NX have inverted LED polarity
(active high instead of active low).

The same PCI Subsystem ID is used by both cards, which are based on
the same Atheros MB92 design.

Cc: <linux-wireless@vger.kernel.org>
Cc: <ath9k-devel@qca.qualcomm.com>
Cc: <ath9k-devel@lists.ath9k.org>
Signed-off-by: Vittorio Gambaletta <linuxbugs@vittgam.net>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/ath/ath9k/pci.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index e6fef1b..7cdaf40 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -28,6 +28,16 @@ static const struct pci_device_id ath_pci_id_table[] = {
 	{ PCI_VDEVICE(ATHEROS, 0x0024) }, /* PCI-E */
 	{ PCI_VDEVICE(ATHEROS, 0x0027) }, /* PCI   */
 	{ PCI_VDEVICE(ATHEROS, 0x0029) }, /* PCI   */
+
+#ifdef CONFIG_ATH9K_PCOEM
+	/* Mini PCI AR9220 MB92 cards: Compex WLM200NX, Wistron DNMA-92 */
+	{ PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+			 0x0029,
+			 PCI_VENDOR_ID_ATHEROS,
+			 0x2096),
+	  .driver_data = ATH9K_PCI_LED_ACT_HI },
+#endif
+
 	{ PCI_VDEVICE(ATHEROS, 0x002A) }, /* PCI-E */
 
 #ifdef CONFIG_ATH9K_PCOEM
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418890 — [PATCH 4.2.y-ckt 020/206] Revert "scsi: fix soft lockup in scsi_remove_target() on module removal"

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Johannes Thumshirn <jthumshirn@suse.de>

commit 305c2e71b3d733ec065cb716c76af7d554bd5571 upstream.

Now that we've done a more comprehensive fix with the intermediate
target state we can remove the previous hack introduced with commit
90a88d6ef88e ("scsi: fix soft lockup in scsi_remove_target() on module
removal").

Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/scsi/scsi_sysfs.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index c6126e0..64f11fa 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1148,19 +1148,17 @@ static void __scsi_remove_target(struct scsi_target *starget)
 void scsi_remove_target(struct device *dev)
 {
 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
-	struct scsi_target *starget, *last_target = NULL;
+	struct scsi_target *starget;
 	unsigned long flags;
 
 restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
 		if (starget->state == STARGET_DEL ||
-		    starget->state == STARGET_REMOVE ||
-		    starget == last_target)
+		    starget->state == STARGET_REMOVE)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
 			kref_get(&starget->reap_ref);
-			last_target = starget;
 			starget->state = STARGET_REMOVE;
 			spin_unlock_irqrestore(shost->host_lock, flags);
 			__scsi_remove_target(starget);
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418891 — [PATCH 4.2.y-ckt 036/206] staging: comedi: das1800: fix possible NULL dereference

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: H Hartley Sweeten <hsweeten@visionengravers.com>

commit d375278d666760e195693b57415ba0a125cadd55 upstream.

DMA is optional with this driver. If it was not enabled the devpriv->dma
pointer will be NULL.

Fix the possible NULL pointer dereference when trying to disable the DMA
channels in das1800_ai_cancel() and tidy up the comments to fix the
checkpatch.pl issues:
WARNING: line over 80 characters

It's probably harmless in das1800_ai_setup_dma() because the 'desc' pointer
will not be used if DMA is disabled but fix it there also.

Fixes: 99dfc3357e98 ("staging: comedi: das1800: remove depends on ISA_DMA_API limitation")
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/staging/comedi/drivers/das1800.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/comedi/drivers/das1800.c b/drivers/staging/comedi/drivers/das1800.c
index 94078118..3be1096 100644
--- a/drivers/staging/comedi/drivers/das1800.c
+++ b/drivers/staging/comedi/drivers/das1800.c
@@ -567,14 +567,17 @@ static int das1800_cancel(struct comedi_device *dev, struct comedi_subdevice *s)
 	struct comedi_isadma_desc *desc;
 	int i;
 
-	outb(0x0, dev->iobase + DAS1800_STATUS);	/* disable conversions */
-	outb(0x0, dev->iobase + DAS1800_CONTROL_B);	/* disable interrupts and dma */
-	outb(0x0, dev->iobase + DAS1800_CONTROL_A);	/* disable and clear fifo and stop triggering */
-
-	for (i = 0; i < 2; i++) {
-		desc = &dma->desc[i];
-		if (desc->chan)
-			comedi_isadma_disable(desc->chan);
+	/* disable and stop conversions */
+	outb(0x0, dev->iobase + DAS1800_STATUS);
+	outb(0x0, dev->iobase + DAS1800_CONTROL_B);
+	outb(0x0, dev->iobase + DAS1800_CONTROL_A);
+
+	if (dma) {
+		for (i = 0; i < 2; i++) {
+			desc = &dma->desc[i];
+			if (desc->chan)
+				comedi_isadma_disable(desc->chan);
+		}
 	}
 
 	return 0;
@@ -934,13 +937,14 @@ static void das1800_ai_setup_dma(struct comedi_device *dev,
 {
 	struct das1800_private *devpriv = dev->private;
 	struct comedi_isadma *dma = devpriv->dma;
-	struct comedi_isadma_desc *desc = &dma->desc[0];
+	struct comedi_isadma_desc *desc;
 	unsigned int bytes;
 
 	if ((devpriv->irq_dma_bits & DMA_ENABLED) == 0)
 		return;
 
 	dma->cur_dma = 0;
+	desc = &dma->desc[0];
 
 	/* determine a dma transfer size to fill buffer in 0.3 sec */
 	bytes = das1800_ai_transfer_size(dev, s, desc->maxsize, 300000000);
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418892 — [PATCH 4.2.y-ckt 001/206] ath10k: fix firmware assert in monitor mode

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>

commit 8a75fc54745fd3ce9062ab1cc6429a9da9ac2a68 upstream.

commit 166de3f1895d ("ath10k: remove supported chain mask") had revealed
an issue on monitor mode. Configuring NSS upon monitor interface
creation is causing target assert in all qca9888x and qca6174 firmware.
Firmware assert issue can be reproduced by below sequence even after
reverting commit 166de3f1895d ("ath10k: remove supported chain mask").

ip link set wlan0 down
iw wlan0 set type monitor
iw phy0 set antenna 7
ip link set wlan0 up

This issue is originally reported on qca9888 with 10.1 firmware.

Fixes: 5572a95b4b ("ath10k: apply chainmask settings to vdev on creation")
Reported-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
Signed-off-by: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/ath/ath10k/mac.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index a5ea8a9..9301716 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -4194,7 +4194,10 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
 		goto err_vdev_delete;
 	}
 
-	if (ar->cfg_tx_chainmask) {
+	/* Configuring number of spatial stream for monitor interface is causing
+	 * target assert in qca9888 and qca6174.
+	 */
+	if (ar->cfg_tx_chainmask && (vif->type != NL80211_IFTYPE_MONITOR)) {
 		u16 nss = get_nss_from_chainmask(ar->cfg_tx_chainmask);
 
 		vdev_param = ar->wmi.vdev_param->nss;
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418893 — [PATCH 4.2.y-ckt 022/206] usb: f_mass_storage: test whether thread is running before starting another

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Michal Nazarewicz <mina86@mina86.com>

commit f78bbcae86e676fad9e6c6bb6cd9d9868ba23696 upstream.

When binding the function to usb_configuration, check whether the thread
is running before starting another one.  Without that, when function
instance is added to multiple configurations, fsg_bing starts multiple
threads with all but the latest one being forgotten by the driver.  This
leads to obvious thread leaks, possible lockups when trying to halt the
machine and possible more issues.

This fixes issues with legacy/multi¹ gadget as well as configfs gadgets
when mass_storage function is added to multiple configurations.

This change also simplifies API since the legacy gadgets no longer need
to worry about starting the thread by themselves (which was where bug
in legacy/multi was in the first place).

N.B., this patch doesn’t address adding single mass_storage function
instance to a single configuration twice.  Thankfully, there’s no
legitimate reason for such setup plus, if I’m not mistaken, configfs
gadget doesn’t even allow it to be expressed.

¹ I have no example failure though.  Conclusion that legacy/multi has
  a bug is based purely on me reading the code.

Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Tested-by: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
[ kamal: backport to 4.2-stable: fsg_bind() decl 'common';
  no change to nokia.c (no fsg_opts) ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>

squash! 334f47b
---
 drivers/usb/gadget/function/f_mass_storage.c | 37 ++++++++++++----------------
 drivers/usb/gadget/function/f_mass_storage.h |  2 --
 drivers/usb/gadget/legacy/acm_ms.c           |  4 ---
 drivers/usb/gadget/legacy/mass_storage.c     |  4 ---
 drivers/usb/gadget/legacy/multi.c            | 12 ---------
 5 files changed, 16 insertions(+), 43 deletions(-)

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index f936268..99ae086 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -2998,25 +2998,6 @@ void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
 }
 EXPORT_SYMBOL_GPL(fsg_common_set_inquiry_string);
 
-int fsg_common_run_thread(struct fsg_common *common)
-{
-	common->state = FSG_STATE_IDLE;
-	/* Tell the thread to start working */
-	common->thread_task =
-		kthread_create(fsg_main_thread, common, "file-storage");
-	if (IS_ERR(common->thread_task)) {
-		common->state = FSG_STATE_TERMINATED;
-		return PTR_ERR(common->thread_task);
-	}
-
-	DBG(common, "I/O thread pid: %d\n", task_pid_nr(common->thread_task));
-
-	wake_up_process(common->thread_task);
-
-	return 0;
-}
-EXPORT_SYMBOL_GPL(fsg_common_run_thread);
-
 static void fsg_common_release(struct kref *ref)
 {
 	struct fsg_common *common = container_of(ref, struct fsg_common, ref);
@@ -3025,6 +3006,7 @@ static void fsg_common_release(struct kref *ref)
 	if (common->state != FSG_STATE_TERMINATED) {
 		raise_exception(common, FSG_STATE_EXIT);
 		wait_for_completion(&common->thread_notifier);
+		common->thread_task = NULL;
 	}
 
 	if (likely(common->luns)) {
@@ -3056,6 +3038,7 @@ static void fsg_common_release(struct kref *ref)
 static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 {
 	struct fsg_dev		*fsg = fsg_from_func(f);
+	struct fsg_common       *common = fsg->common;
 	struct usb_gadget	*gadget = c->cdev->gadget;
 	int			i;
 	struct usb_ep		*ep;
@@ -3070,9 +3053,21 @@ static int fsg_bind(struct usb_configuration *c, struct usb_function *f)
 		if (ret)
 			return ret;
 		fsg_common_set_inquiry_string(fsg->common, NULL, NULL);
-		ret = fsg_common_run_thread(fsg->common);
-		if (ret)
+	}
+
+	if (!common->thread_task) {
+		common->state = FSG_STATE_IDLE;
+		common->thread_task =
+			kthread_create(fsg_main_thread, common, "file-storage");
+		if (IS_ERR(common->thread_task)) {
+			int ret = PTR_ERR(common->thread_task);
+			common->thread_task = NULL;
+			common->state = FSG_STATE_TERMINATED;
 			return ret;
+		}
+		DBG(common, "I/O thread pid: %d\n",
+		    task_pid_nr(common->thread_task));
+		wake_up_process(common->thread_task);
 	}
 
 	fsg->gadget = gadget;
diff --git a/drivers/usb/gadget/function/f_mass_storage.h b/drivers/usb/gadget/function/f_mass_storage.h
index b4866fc..44f2337 100644
--- a/drivers/usb/gadget/function/f_mass_storage.h
+++ b/drivers/usb/gadget/function/f_mass_storage.h
@@ -157,8 +157,6 @@ int fsg_common_create_luns(struct fsg_common *common, struct fsg_config *cfg);
 void fsg_common_set_inquiry_string(struct fsg_common *common, const char *vn,
 				   const char *pn);
 
-int fsg_common_run_thread(struct fsg_common *common);
-
 void fsg_config_from_params(struct fsg_config *cfg,
 			    const struct fsg_module_parameters *params,
 			    unsigned int fsg_num_buffers);
diff --git a/drivers/usb/gadget/legacy/acm_ms.c b/drivers/usb/gadget/legacy/acm_ms.c
index 1194b09..5c72379 100644
--- a/drivers/usb/gadget/legacy/acm_ms.c
+++ b/drivers/usb/gadget/legacy/acm_ms.c
@@ -147,10 +147,6 @@ static int acm_ms_do_config(struct usb_configuration *c)
 	if (status < 0)
 		goto put_msg;
 
-	status = fsg_common_run_thread(opts->common);
-	if (status)
-		goto remove_acm;
-
 	status = usb_add_function(c, f_msg);
 	if (status)
 		goto remove_acm;
diff --git a/drivers/usb/gadget/legacy/mass_storage.c b/drivers/usb/gadget/legacy/mass_storage.c
index e7bfb08..5038475 100644
--- a/drivers/usb/gadget/legacy/mass_storage.c
+++ b/drivers/usb/gadget/legacy/mass_storage.c
@@ -146,10 +146,6 @@ static int msg_do_config(struct usb_configuration *c)
 	if (IS_ERR(f_msg))
 		return PTR_ERR(f_msg);
 
-	ret = fsg_common_run_thread(opts->common);
-	if (ret)
-		goto put_func;
-
 	ret = usb_add_function(c, f_msg);
 	if (ret)
 		goto put_func;
diff --git a/drivers/usb/gadget/legacy/multi.c b/drivers/usb/gadget/legacy/multi.c
index b21b51f..163a700 100644
--- a/drivers/usb/gadget/legacy/multi.c
+++ b/drivers/usb/gadget/legacy/multi.c
@@ -151,7 +151,6 @@ static struct usb_function *f_msg_rndis;
 
 static int rndis_do_config(struct usb_configuration *c)
 {
-	struct fsg_opts *fsg_opts;
 	int ret;
 
 	if (gadget_is_otg(c->cdev->gadget)) {
@@ -183,11 +182,6 @@ static int rndis_do_config(struct usb_configuration *c)
 		goto err_fsg;
 	}
 
-	fsg_opts = fsg_opts_from_func_inst(fi_msg);
-	ret = fsg_common_run_thread(fsg_opts->common);
-	if (ret)
-		goto err_run;
-
 	ret = usb_add_function(c, f_msg_rndis);
 	if (ret)
 		goto err_run;
@@ -239,7 +233,6 @@ static struct usb_function *f_msg_multi;
 
 static int cdc_do_config(struct usb_configuration *c)
 {
-	struct fsg_opts *fsg_opts;
 	int ret;
 
 	if (gadget_is_otg(c->cdev->gadget)) {
@@ -272,11 +265,6 @@ static int cdc_do_config(struct usb_configuration *c)
 		goto err_fsg;
 	}
 
-	fsg_opts = fsg_opts_from_func_inst(fi_msg);
-	ret = fsg_common_run_thread(fsg_opts->common);
-	if (ret)
-		goto err_run;
-
 	ret = usb_add_function(c, f_msg_multi);
 	if (ret)
 		goto err_run;
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418894 — [PATCH 4.2.y-ckt 015/206] cpuidle: Indicate when a device has been unregistered

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Dave Gerlach <d-gerlach@ti.com>

commit c998c07836f985b24361629dc98506ec7893e7a0 upstream.

Currently the 'registered' member of the cpuidle_device struct is set
to 1 during cpuidle_register_device. In this same function there are
checks to see if the device is already registered to prevent duplicate
calls to register the device, but this value is never set to 0 even on
unregister of the device. Because of this, any attempt to call
cpuidle_register_device after a call to cpuidle_unregister_device will
fail which shouldn't be the case.

To prevent this, set registered to 0 when the device is unregistered.

Fixes: c878a52d3c7c (cpuidle: Check if device is already registered)
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/cpuidle/cpuidle.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 48b7228..f4db470 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -429,6 +429,8 @@ static void __cpuidle_unregister_device(struct cpuidle_device *dev)
 	list_del(&dev->device_list);
 	per_cpu(cpuidle_devices, dev->cpu) = NULL;
 	module_put(drv->owner);
+
+	dev->registered = 0;
 }
 
 static void __cpuidle_device_init(struct cpuidle_device *dev)
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418895 — [PATCH 4.2.y-ckt 014/206] Bluetooth: vhci: purge unhandled skbs

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jiri Slaby <jslaby@suse.cz>

commit 13407376b255325fa817798800117a839f3aa055 upstream.

The write handler allocates skbs and queues them into data->readq.
Read side should read them, if there is any. If there is none, skbs
should be dropped by hdev->flush. But this happens only if the device
is HCI_UP, i.e. hdev->power_on work was triggered already. When it was
not, skbs stay allocated in the queue when /dev/vhci is closed. So
purge the queue in ->release.

Program to reproduce:
	#include <err.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <unistd.h>

	#include <sys/stat.h>
	#include <sys/types.h>
	#include <sys/uio.h>

	int main()
	{
		char buf[] = { 0xff, 0 };
		struct iovec iov = {
			.iov_base = buf,
			.iov_len = sizeof(buf),
		};
		int fd;

		while (1) {
			fd = open("/dev/vhci", O_RDWR);
			if (fd < 0)
				err(1, "open");

			usleep(50);

			if (writev(fd, &iov, 1) < 0)
				err(1, "writev");

			usleep(50);

			close(fd);
		}

		return 0;
	}

Result:
kmemleak: 4609 new suspected memory leaks
unreferenced object 0xffff88059f4d5440 (size 232):
  comm "vhci", pid 1084, jiffies 4294912542 (age 37569.296s)
  hex dump (first 32 bytes):
    20 f0 23 87 05 88 ff ff 20 f0 23 87 05 88 ff ff   .#..... .#.....
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
...
    [<ffffffff81ece010>] __alloc_skb+0x0/0x5a0
    [<ffffffffa021886c>] vhci_create_device+0x5c/0x580 [hci_vhci]
    [<ffffffffa0219436>] vhci_write+0x306/0x4c8 [hci_vhci]

Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/bluetooth/hci_vhci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index e1974a6..a269b34 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -352,6 +352,7 @@ static int vhci_release(struct inode *inode, struct file *file)
 		hci_free_dev(hdev);
 	}
 
+	skb_queue_purge(&data->readq);
 	file->private_data = NULL;
 	kfree(data);
 
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418896 — [PATCH 4.2.y-ckt 013/206] Bluetooth: vhci: fix open_timeout vs. hdev race

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jiri Slaby <jslaby@suse.cz>

commit 373a32c848ae3a1c03618517cce85f9211a6facf upstream.

Both vhci_get_user and vhci_release race with open_timeout work. They
both contain cancel_delayed_work_sync, but do not test whether the
work actually created hdev or not. Since the work can be in progress
and _sync will wait for finishing it, we can have data->hdev allocated
when cancel_delayed_work_sync returns. But the call sites do 'if
(data->hdev)' *before* cancel_delayed_work_sync.

As a result:
* vhci_get_user allocates a second hdev and puts it into
  data->hdev. The former is leaked.
* vhci_release does not release data->hdev properly as it thinks there
  is none.

Fix both cases by moving the actual test *after* the call to
cancel_delayed_work_sync.

This can be hit by this program:
	#include <err.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <time.h>
	#include <unistd.h>

	#include <sys/stat.h>
	#include <sys/types.h>

	int main(int argc, char **argv)
	{
		int fd;

		srand(time(NULL));

		while (1) {
			const int delta = (rand() % 200 - 100) * 100;

			fd = open("/dev/vhci", O_RDWR);
			if (fd < 0)
				err(1, "open");

			usleep(1000000 + delta);

			close(fd);
		}

		return 0;
	}

And the result is:
BUG: KASAN: use-after-free in skb_queue_tail+0x13e/0x150 at addr ffff88006b0c1228
Read of size 8 by task kworker/u13:1/32068
=============================================================================
BUG kmalloc-192 (Tainted: G            E     ): kasan: bad access detected
-----------------------------------------------------------------------------

Disabling lock debugging due to kernel taint
INFO: Allocated in vhci_open+0x50/0x330 [hci_vhci] age=260 cpu=3 pid=32040
...
	kmem_cache_alloc_trace+0x150/0x190
	vhci_open+0x50/0x330 [hci_vhci]
	misc_open+0x35b/0x4e0
	chrdev_open+0x23b/0x510
...
INFO: Freed in vhci_release+0xa4/0xd0 [hci_vhci] age=9 cpu=2 pid=32040
...
	__slab_free+0x204/0x310
	vhci_release+0xa4/0xd0 [hci_vhci]
...
INFO: Slab 0xffffea0001ac3000 objects=16 used=13 fp=0xffff88006b0c1e00 flags=0x5fffff80004080
INFO: Object 0xffff88006b0c1200 @offset=4608 fp=0xffff88006b0c0600
Bytes b4 ffff88006b0c11f0: 09 df 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff88006b0c1200: 00 06 0c 6b 00 88 ff ff 00 00 00 00 00 00 00 00  ...k............
Object ffff88006b0c1210: 10 12 0c 6b 00 88 ff ff 10 12 0c 6b 00 88 ff ff  ...k.......k....
Object ffff88006b0c1220: c0 46 c2 6b 00 88 ff ff c0 46 c2 6b 00 88 ff ff  .F.k.....F.k....
Object ffff88006b0c1230: 01 00 00 00 01 00 00 00 e0 ff ff ff 0f 00 00 00  ................
Object ffff88006b0c1240: 40 12 0c 6b 00 88 ff ff 40 12 0c 6b 00 88 ff ff  @..k....@..k....
Object ffff88006b0c1250: 50 0d 6e a0 ff ff ff ff 00 02 00 00 00 00 ad de  P.n.............
Object ffff88006b0c1260: 00 00 00 00 00 00 00 00 ab 62 02 00 01 00 00 00  .........b......
Object ffff88006b0c1270: 90 b9 19 81 ff ff ff ff 38 12 0c 6b 00 88 ff ff  ........8..k....
Object ffff88006b0c1280: 03 00 20 00 ff ff ff ff ff ff ff ff 00 00 00 00  .. .............
Object ffff88006b0c1290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
Object ffff88006b0c12a0: 00 00 00 00 00 00 00 00 00 80 cd 3d 00 88 ff ff  ...........=....
Object ffff88006b0c12b0: 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00  . ..............
Redzone ffff88006b0c12c0: bb bb bb bb bb bb bb bb                          ........
Padding ffff88006b0c13f8: 00 00 00 00 00 00 00 00                          ........
CPU: 3 PID: 32068 Comm: kworker/u13:1 Tainted: G    B       E      4.4.6-0-default #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.8.1-0-g4adadbd-20151112_172657-sheep25 04/01/2014
Workqueue: hci0 hci_cmd_work [bluetooth]
 00000000ffffffff ffffffff81926cfa ffff88006be37c68 ffff88006bc27180
 ffff88006b0c1200 ffff88006b0c1234 ffffffff81577993 ffffffff82489320
 ffff88006bc24240 0000000000000046 ffff88006a100000 000000026e51eb80
Call Trace:
...
 [<ffffffff81ec8ebe>] ? skb_queue_tail+0x13e/0x150
 [<ffffffffa06e027c>] ? vhci_send_frame+0xac/0x100 [hci_vhci]
 [<ffffffffa0c61268>] ? hci_send_frame+0x188/0x320 [bluetooth]
 [<ffffffffa0c61515>] ? hci_cmd_work+0x115/0x310 [bluetooth]
 [<ffffffff811a1375>] ? process_one_work+0x815/0x1340
 [<ffffffff811a1f85>] ? worker_thread+0xe5/0x11f0
 [<ffffffff811a1ea0>] ? process_one_work+0x1340/0x1340
 [<ffffffff811b3c68>] ? kthread+0x1c8/0x230
...
Memory state around the buggy address:
 ffff88006b0c1100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88006b0c1180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88006b0c1200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff88006b0c1280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88006b0c1300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Fixes: 23424c0d31 (Bluetooth: Add support creating virtual AMP controllers)
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/bluetooth/hci_vhci.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index 78653db..e1974a6 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -197,13 +197,13 @@ static inline ssize_t vhci_get_user(struct vhci_data *data,
 		break;
 
 	case HCI_VENDOR_PKT:
+		cancel_delayed_work_sync(&data->open_timeout);
+
 		if (data->hdev) {
 			kfree_skb(skb);
 			return -EBADFD;
 		}
 
-		cancel_delayed_work_sync(&data->open_timeout);
-
 		opcode = *((__u8 *) skb->data);
 		skb_pull(skb, 1);
 
@@ -341,10 +341,12 @@ static int vhci_open(struct inode *inode, struct file *file)
 static int vhci_release(struct inode *inode, struct file *file)
 {
 	struct vhci_data *data = file->private_data;
-	struct hci_dev *hdev = data->hdev;
+	struct hci_dev *hdev;
 
 	cancel_delayed_work_sync(&data->open_timeout);
 
+	hdev = data->hdev;
+
 	if (hdev) {
 		hci_unregister_dev(hdev);
 		hci_free_dev(hdev);
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

#1418897 — [PATCH 4.2.y-ckt 010/206] rtlwifi: rtl8723be: Add antenna select module parameter

4.2.8-ckt12 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Larry Finger <Larry.Finger@lwfinger.net>

commit c18d8f5095715c56bb3cd9cba64242542632054b upstream.

A number of new laptops have been delivered with only a single antenna.
In principle, this is OK; however, a problem arises when the on-board
EEPROM is programmed to use the other antenna connection. The option
of opening the computer and moving the connector is not always possible
as it will void the warranty in some cases. In addition, this solution
breaks the Windows driver when the box dual boots Linux and Windows.

A fix involving a new module parameter has been developed.  This commit
adds the new parameter and implements the changes needed for the driver.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[ kamal: backport to 4.2-stable: files moved ]
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
 drivers/net/wireless/rtlwifi/rtl8723be/hw.c | 5 +++++
 drivers/net/wireless/rtlwifi/rtl8723be/sw.c | 3 +++
 drivers/net/wireless/rtlwifi/wifi.h         | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
index c983d2f..5a3df91 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
@@ -2684,6 +2684,7 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
 					      bool auto_load_fail, u8 *hwinfo)
 {
 	struct rtl_priv *rtlpriv = rtl_priv(hw);
+	struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params;
 	u8 value;
 	u32 tmpu_32;
 
@@ -2702,6 +2703,10 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw,
 		rtlpriv->btcoexist.btc_info.ant_num = ANT_X2;
 	}
 
+	/* override ant_num / ant_path */
+	if (mod_params->ant_sel)
+		rtlpriv->btcoexist.btc_info.ant_num =
+			(mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1);
 }
 
 void rtl8723be_bt_reg_init(struct ieee80211_hw *hw)
diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
index 9df94b2..8de5626 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723be/sw.c
@@ -273,6 +273,7 @@ static struct rtl_mod_params rtl8723be_mod_params = {
 	.msi_support = false,
 	.disable_watchdog = false,
 	.debug = DBG_EMERG,
+	.ant_sel = 0,
 };
 
 static struct rtl_hal_cfg rtl8723be_hal_cfg = {
@@ -394,6 +395,7 @@ module_param_named(fwlps, rtl8723be_mod_params.fwctrl_lps, bool, 0444);
 module_param_named(msi, rtl8723be_mod_params.msi_support, bool, 0444);
 module_param_named(disable_watchdog, rtl8723be_mod_params.disable_watchdog,
 		   bool, 0444);
+module_param_named(ant_sel, rtl8723be_mod_params.ant_sel, int, 0444);
 MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n");
 MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n");
 MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n");
@@ -402,6 +404,7 @@ MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 0)\n");
 MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)");
 MODULE_PARM_DESC(disable_watchdog,
 		 "Set to 1 to disable the watchdog (default 0)\n");
+MODULE_PARM_DESC(ant_sel, "Set to 1 or 2 to force antenna number (default 0)\n");
 
 static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume);
 
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 0a3570a..d593474 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2237,6 +2237,9 @@ struct rtl_mod_params {
 
 	/* default 0: 1 means do not disable interrupts */
 	bool int_clear;
+
+	/* select antenna */
+	int ant_sel;
 };
 
 struct rtl_hal_usbint_cfg {
-- 
2.7.4

[toc] | [prev] | [next] | [standalone]

Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10  Next page →

Back to top | Article view | linux.kernel

csiph-web