Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1358614 > unrolled thread
| Started by | lizf@kernel.org |
|---|---|
| First post | 2016-03-16 09:10 +0100 |
| Last post | 2016-03-17 02:30 +0100 |
| Articles | 20 on this page of 105 — 4 participants |
Back to article view | Back to linux.kernel
[PATCH 3.4 000/107] 3.4.111-rc1 review lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 005/107] ext4: replace open coded nofail allocation in ext4_free_blocks() lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 012/107] dm thin: allocate the cell_sort_array dynamically lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 001/107] Btrfs: use kmem_cache_free when freeing entry in inode cache lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 026/107] libata: add ATA_HORKAGE_NOTRIM lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 017/107] drm: add a check for x/y in drm_mode_setcrtc lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 040/107] xhci: prevent bus_suspend if SS port resuming in phase 1 lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 020/107] net: call rcu_read_lock early in process_backlog lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 015/107] dm btree: silence lockdep lock inversion in dm_btree_del() lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 029/107] net: Clone skb before setting peeked flag lizf@kernel.org - 2016-03-16 09:10 +0100
[PATCH 3.4 089/107] KVM: svm: unconditionally intercept #DB lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 082/107] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one lizf@kernel.org - 2016-03-16 09:20 +0100
Re: [PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one Don Zickus <dzickus@redhat.com> - 2016-03-16 15:20 +0100
Re: [PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one Zefan Li <lizefan@huawei.com> - 2016-03-17 02:30 +0100
[PATCH 3.4 102/107] ALSA: tlv: compute TLV_*_ITEM lengths automatically lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 053/107] drm/radeon/combios: add some validation of lvds values lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 073/107] sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 055/107] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 095/107] atm: deal with setting entry before mkip was called lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 090/107] get rid of s_files and files_lock lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 105/107] usb: dwc3: Fix assignment of EP transfer resources lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 067/107] dm btree: add ref counting ops for the leaves of top level btrees lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 100/107] af_unix: Guard against other == sk in unix_dgram_sendmsg lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 093/107] ipv6: probe routes asynchronous in rt6_probe lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 054/107] target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 096/107] SUNRPC: never enqueue a ->rq_cong request on ->sending lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 066/107] localmodconfig: Use Kbuild files too lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 059/107] xhci: fix off by one error in TRB DMA address boundary check lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 097/107] ipv6: prevent fib6_run_gc() contention lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 088/107] KVM: x86: work around infinite loop in microcode when #AC is delivered lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 107/107] KVM: x86: move steal time initialization to vcpu entry time lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 099/107] net: fix warnings in 'make htmldocs' by moving macro definition out of field declaration lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 104/107] ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest DragonFly lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 103/107] ALSA: tlv: add DECLARE_TLV_DB_RANGE() lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 106/107] dm btree remove: fix a bug when rebalancing nodes after removal lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 075/107] unix: avoid use-after-free in ep_remove_wait_queue lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 087/107] ipv6: addrconf: validate new MTU before applying it lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 094/107] netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 048/107] iscsi-target: Fix use-after-free during TPG session shutdown lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 083/107] ppp, slip: Validate VJ compression slot parameters completely lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 091/107] Initialize msg/shm IPC objects before doing ipc_addid() lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 101/107] x86/LDT: Print the real LDT base address lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 086/107] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 092/107] net: avoid to hang up on sending due to sysctl configuration overflow. lizf@kernel.org - 2016-03-16 09:20 +0100
[PATCH 3.4 060/107] rds: fix an integer overflow test in rds_info_getsockopt() lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 081/107] virtio-net: drop NETIF_F_FRAGLIST lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 078/107] RDS: verify the underlying transport exists before creating a connection lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 063/107] ocfs2: fix BUG in ocfs2_downconvert_thread_do_work() lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 077/107] net: add validation for the socket syscall protocol argument lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 072/107] net: Fix RCU splat in af_key lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 076/107] pptp: verify sockaddr_len in pptp_bind() and pptp_connect() lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 058/107] MIPS: Fix sched_getaffinity with MT FPAFF enabled lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 080/107] sg_start_req(): make sure that there's not too many elements in iovec lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 074/107] Revert "usb: dwc3: Reset the transfer resource index on SET_INTERFACE" lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 061/107] perf: Fix fasync handling on inherited events lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 056/107] x86/ldt: Make modify_ldt synchronous lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 064/107] x86/ldt: Correct LDT access in single stepping logic lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 085/107] KEYS: Fix race between key destruction and finding a keyring by name lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 062/107] MIPS: Make set_pte() SMP safe. lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 071/107] ipc,sem: fix use after free on IPC_RMID after a task using same semaphore set exits lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 065/107] x86/ldt: Correct FPU emulation access to LDT lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 070/107] EDAC, ppc4xx: Access mci->csrows array elements properly lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 084/107] USB: whiteheat: fix potential null-deref at probe lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 068/107] libiscsi: Fix host busy blocking during connection teardown lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 069/107] libfc: Fix fc_fcp_cleanup_each_cmd() lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 079/107] RDS: fix race condition when sending a message on unbound socket lizf@kernel.org - 2016-03-16 09:30 +0100
[PATCH 3.4 036/107] usb: dwc3: Reset the transfer resource index on SET_INTERFACE lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 037/107] usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init() function lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 049/107] niu: don't count tx error twice in case of headroom realloc fails lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 031/107] can: mcp251x: fix resume when device is down lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 051/107] USB: sierra: add 1199:68AB device ID lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 050/107] vhost: actually track log eventfd file lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 052/107] ALSA: usb-audio: add dB range mapping for some devices lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 034/107] md: make sure everything is freed when dm-raid stops an array. lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 046/107] netfilter: nf_conntrack: Support expectations in different zones lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 057/107] md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 024/107] ata: pmp: add quirk for Marvell 4140 SATA PMP lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 028/107] libata: increase the timeout when setting transfer mode lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 043/107] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 039/107] xhci: report U3 when link is in resume state lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 027/107] libata: force disable trim for SuperSSpeed S238 lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 033/107] inet: frags: fix defragmented packet's IP header for af_packet lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 032/107] mac80211: clear subdir_stations when removing debugfs lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 042/107] tile: use free_bootmem_late() for initrd lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 038/107] xhci: Calculate old endpoints correctly on device reset lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 025/107] libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk VB0250EAVER lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 047/107] crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 045/107] mmc: block: Add missing mmc_blk_put() in power_ro_lock_show() lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 021/107] s390/process: fix sfpc inline assembly lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 041/107] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 lizf@kernel.org - 2016-03-16 09:40 +0100
[PATCH 3.4 009/107] 9p: don't leave a half-initialized inode sitting around lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 007/107] hpfs: kstrdup() out of memory handling lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 011/107] dm btree remove: fix bug in redistribute3 lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 022/107] rds: rds_ib_device.refcount overflow lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 016/107] s390/sclp: clear upper register halves in _sclp_print_early lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 002/107] fs/buffer.c: support buffer cache allocations with gfp modifiers lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 010/107] ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4 lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 023/107] st: null pointer dereference panic caused by use after kref_put by st_open lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 004/107] ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 014/107] USB: cp210x: add ID for Aruba Networks controllers lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 013/107] USB: option: add 2020:4000 ID lizf@kernel.org - 2016-03-16 09:50 +0100
[PATCH 3.4 018/107] rtnetlink: verify IFLA_VF_INFO attributes before passing them to driver lizf@kernel.org - 2016-03-16 09:50 +0100
Re: [PATCH 3.4 000/107] 3.4.111-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-03-16 19:00 +0100
Re: [PATCH 3.4 000/107] 3.4.111-rc1 review Zefan Li <lizefan@huawei.com> - 2016-03-17 02:30 +0100
Page 1 of 6 [1] 2 3 4 5 6 Next page →
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 000/107] 3.4.111-rc1 review |
| Message-ID | <rdeGK-6bc-3@gated-at.bofh.it> |
From: Zefan Li <lizefan@huawei.com>
This is the start of the stable review cycle for the 3.4.111 release.
There are 107 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Mar 16 16:04:10 CST 2016.
Anything received after that time might be too late.
A combined patch relative to 3.4.110 will be posted as an additional
response to this. A shortlog and diffstat can be found below.
thanks,
Zefan Li
--------------------
AMAN DEEP (1):
usb: xhci: Bugfix for NULL pointer deference in xhci_endpoint_init()
function
Al Viro (3):
9p: don't leave a half-initialized inode sitting around
sg_start_req(): make sure that there's not too many elements in iovec
get rid of s_files and files_lock
Aleksei Mamlin (1):
libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for HP 250GB SATA disk
VB0250EAVER
Alex Deucher (1):
drm/radeon/combios: add some validation of lvds values
Alexei Potashnik (1):
target/iscsi: Fix double free of a TUR followed by a solicited NOPOUT
Andrey Vagin (1):
netfilter: nf_conntrack: fix RCU race in nf_conntrack_find_get
Andy Lutomirski (2):
x86/xen: Probe target addresses in set_aliased_prot() before the
hypercall
x86/ldt: Make modify_ldt synchronous
Anssi Hannula (1):
ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest
DragonFly
Arne Fitzenreiter (2):
libata: add ATA_HORKAGE_NOTRIM
libata: force disable trim for SuperSSpeed S238
Bart Van Assche (1):
libfc: Fix fc_fcp_cleanup_each_cmd()
Ben Hutchings (2):
isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
ppp, slip: Validate VJ compression slot parameters completely
Ben Zhang (1):
kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not
every one
Bernhard Bender (1):
Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen
Brian Campbell (1):
xhci: Calculate old endpoints correctly on device reset
Chris Metcalf (1):
tile: use free_bootmem_late() for initrd
Claudio Cappelli (1):
USB: option: add 2020:4000 ID
Clemens Ladisch (2):
ALSA: tlv: compute TLV_*_ITEM lengths automatically
ALSA: tlv: add DECLARE_TLV_DB_RANGE()
Dan Carpenter (1):
rds: fix an integer overflow test in rds_info_getsockopt()
Daniel Borkmann (1):
rtnetlink: verify IFLA_VF_INFO attributes before passing them to
driver
David Ahern (1):
net: Fix RCU splat in af_key
David Daney (1):
MIPS: Make set_pte() SMP safe.
David Howells (2):
KEYS: Fix race between key destruction and finding a keyring by name
KEYS: Fix crash when attempt to garbage collect an uninstantiated
keyring
Dennis Yang (1):
dm btree remove: fix bug in redistribute3
Dirk Behme (1):
USB: sierra: add 1199:68AB device ID
Dominic Sacré (1):
ALSA: usb-audio: Add MIDI support for Steinberg MI2/MI4
Edward Hyunkoo Jee (1):
inet: frags: fix defragmented packet's IP header for af_packet
Eric Northup (1):
KVM: x86: work around infinite loop in microcode when #AC is delivered
Felix Fietkau (1):
MIPS: Fix sched_getaffinity with MT FPAFF enabled
Filipe Manana (1):
Btrfs: use kmem_cache_free when freeing entry in inode cache
Gioh Kim (1):
fs/buffer.c: support buffer cache allocations with gfp modifiers
Hannes Frederic Sowa (3):
net: add validation for the socket syscall protocol argument
ipv6: probe routes asynchronous in rt6_probe
net: fix warnings in 'make htmldocs' by moving macro definition out of
field declaration
Heiko Carstens (1):
s390/process: fix sfpc inline assembly
Herbert Xu (2):
net: Clone skb before setting peeked flag
crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer
Herton R. Krzesinski (1):
ipc,sem: fix use after free on IPC_RMID after a task using same
semaphore set exits
Jan Beulich (1):
x86/LDT: Print the real LDT base address
Jason Wang (1):
virtio-net: drop NETIF_F_FRAGLIST
Jiri Pirko (1):
niu: don't count tx error twice in case of headroom realloc fails
Joe Perches (1):
hpfs: hpfs_error: Remove static buffer, use vsprintf extension %pV
instead
Joe Stringer (1):
netfilter: nf_conntrack: Support expectations in different zones
Joe Thornber (4):
dm thin: allocate the cell_sort_array dynamically
dm btree: silence lockdep lock inversion in dm_btree_del()
dm btree: add ref counting ops for the leaves of top level btrees
dm btree remove: fix a bug when rebalancing nodes after removal
Johan Hovold (1):
USB: whiteheat: fix potential null-deref at probe
John Soni Jose (1):
libiscsi: Fix host busy blocking during connection teardown
John Youn (2):
usb: dwc3: Reset the transfer resource index on SET_INTERFACE
usb: dwc3: Fix assignment of EP transfer resources
Joseph Qi (1):
ocfs2: fix BUG in ocfs2_downconvert_thread_do_work()
Juergen Gross (2):
x86/ldt: Correct LDT access in single stepping logic
x86/ldt: Correct FPU emulation access to LDT
Julian Anastasov (2):
net: do not process device backlog during unregistration
net: call rcu_read_lock early in process_backlog
Kirill A. Shutemov (1):
mm: avoid setting up anonymous pages into file mapping
Linus Torvalds (1):
Initialize msg/shm IPC objects before doing ipc_addid()
Lior Amsalem (1):
ata: pmp: add quirk for Marvell 4140 SATA PMP
Marc-André Lureau (1):
vhost: actually track log eventfd file
Marcelo Leitner (1):
ipv6: addrconf: validate new MTU before applying it
Marcelo Tosatti (1):
KVM: x86: move steal time initialization to vcpu entry time
Martin Schwidefsky (1):
s390/sclp: clear upper register halves in _sclp_print_early
Mathias Nyman (1):
xhci: fix off by one error in TRB DMA address boundary check
Michael Walle (1):
EDAC, ppc4xx: Access mci->csrows array elements properly
Michal Hocko (1):
ext4: replace open coded nofail allocation in ext4_free_blocks()
Michal Kubeček (1):
ipv6: prevent fib6_run_gc() contention
Mikulas Patocka (1):
libata: increase the timeout when setting transfer mode
Neil Brown (1):
SUNRPC: never enqueue a ->rq_cong request on ->sending
NeilBrown (4):
md: make sure everything is freed when dm-raid stops an array.
md: flush ->event_work before stopping array.
md/raid1: fix test for 'was read error from last working device'.
md/raid1: extend spinlock to protect raid1_end_read_request against
inconsistencies
Nicholas Bellinger (1):
iscsi-target: Fix use-after-free during TPG session shutdown
Nikolay Borisov (2):
bufferhead: Add _gfp version for sb_getblk()
ext4: avoid deadlocks in the writeback path by using sb_getblk_gfp
Oliver Neukum (1):
usb-storage: ignore ZTE MF 823 card reader in mode 0x1225
Paolo Bonzini (1):
KVM: svm: unconditionally intercept #DB
Peter Sanford (1):
USB: cp210x: add ID for Aruba Networks controllers
Peter Zijlstra (1):
perf: Fix fasync handling on inherited events
Quentin Casasnovas (1):
RDS: fix race condition when sending a message on unbound socket
Rainer Weikusat (2):
unix: avoid use-after-free in ep_remove_wait_queue
af_unix: Guard against other == sk in unix_dgram_sendmsg
Richard Stearn (1):
NET: AX.25: Stop heartbeat timer on disconnect.
Richard Weinberger (1):
localmodconfig: Use Kbuild files too
Sanidhya Kashyap (1):
hpfs: kstrdup() out of memory handling
Sasha Levin (2):
RDS: verify the underlying transport exists before creating a
connection
atm: deal with setting entry before mkip was called
Seymour, Shane M (1):
st: null pointer dereference panic caused by use after kref_put by
st_open
Stefan Agner (1):
can: mcp251x: fix resume when device is down
Tom Hughes (1):
mac80211: clear subdir_stations when removing debugfs
Tomas Winkler (1):
mmc: block: Add missing mmc_blk_put() in power_ro_lock_show()
WANG Cong (1):
pptp: verify sockaddr_len in pptp_bind() and pptp_connect()
Wengang Wang (1):
rds: rds_ib_device.refcount overflow
Yao-Wen Mao (1):
ALSA: usb-audio: add dB range mapping for some devices
Zefan Li (1):
Revert "usb: dwc3: Reset the transfer resource index on SET_INTERFACE"
Zhao Junwang (1):
drm: add a check for x/y in drm_mode_setcrtc
Zhuang Jin Can (2):
xhci: report U3 when link is in resume state
xhci: prevent bus_suspend if SS port resuming in phase 1
bingtian.ly@taobao.com (1):
net: avoid to hang up on sending due to sysctl configuration overflow.
lucien (1):
sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state
arch/mips/include/asm/pgtable.h | 31 +++
arch/mips/kernel/mips-mt-fpaff.c | 5 +-
arch/s390/kernel/process.c | 2 +-
arch/s390/kernel/sclp.S | 4 +
arch/tile/kernel/setup.c | 2 +-
arch/x86/include/asm/desc.h | 15 --
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/include/asm/mmu.h | 3 +-
arch/x86/include/asm/mmu_context.h | 49 ++++-
arch/x86/kernel/cpu/common.c | 4 +-
arch/x86/kernel/ldt.c | 267 ++++++++++++++-----------
arch/x86/kernel/process_64.c | 6 +-
arch/x86/kernel/step.c | 8 +-
arch/x86/kvm/svm.c | 22 +-
arch/x86/kvm/trace.h | 1 +
arch/x86/kvm/vmx.c | 5 +-
arch/x86/kvm/x86.c | 9 +-
arch/x86/math-emu/fpu_entry.c | 3 +-
arch/x86/math-emu/fpu_system.h | 21 +-
arch/x86/math-emu/get_address.c | 3 +-
arch/x86/power/cpu.c | 3 +-
arch/x86/xen/enlighten.c | 40 ++++
drivers/ata/libata-core.c | 9 +-
drivers/ata/libata-pmp.c | 7 +
drivers/ata/libata-scsi.c | 3 +-
drivers/crypto/ixp4xx_crypto.c | 1 -
drivers/edac/ppc4xx_edac.c | 2 +-
drivers/gpu/drm/drm_crtc.c | 7 +-
drivers/gpu/drm/radeon/radeon_combios.c | 7 +-
drivers/input/touchscreen/usbtouchscreen.c | 3 +
drivers/isdn/i4l/isdn_ppp.c | 12 +-
drivers/md/dm-thin.c | 14 +-
drivers/md/md.c | 18 +-
drivers/md/persistent-data/dm-btree-internal.h | 6 +
drivers/md/persistent-data/dm-btree-remove.c | 35 ++--
drivers/md/persistent-data/dm-btree-spine.c | 37 ++++
drivers/md/persistent-data/dm-btree.c | 9 +-
drivers/md/raid1.c | 9 +-
drivers/mmc/card/block.c | 2 +
drivers/net/can/mcp251x.c | 15 +-
drivers/net/ethernet/sun/niu.c | 4 +-
drivers/net/ppp/ppp_generic.c | 6 +-
drivers/net/ppp/pptp.c | 6 +
drivers/net/slip/slhc.c | 12 +-
drivers/net/slip/slip.c | 2 +-
drivers/net/virtio_net.c | 4 +-
drivers/scsi/libfc/fc_fcp.c | 19 +-
drivers/scsi/libiscsi.c | 25 +--
drivers/scsi/sg.c | 3 +
drivers/scsi/st.c | 2 +-
drivers/target/iscsi/iscsi_target.c | 14 +-
drivers/usb/dwc3/core.h | 1 -
drivers/usb/dwc3/ep0.c | 5 -
drivers/usb/dwc3/gadget.c | 70 +++++--
drivers/usb/host/xhci-hub.c | 13 +-
drivers/usb/host/xhci-mem.c | 2 +-
drivers/usb/host/xhci-ring.c | 5 +-
drivers/usb/host/xhci.c | 3 +
drivers/usb/host/xhci.h | 1 +
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/option.c | 1 +
drivers/usb/serial/sierra.c | 1 +
drivers/usb/serial/whiteheat.c | 31 +++
drivers/usb/storage/unusual_devs.h | 12 ++
drivers/vhost/vhost.c | 1 +
fs/9p/vfs_inode.c | 3 +-
fs/9p/vfs_inode_dotl.c | 3 +-
fs/btrfs/inode-map.c | 2 +-
fs/buffer.c | 43 ++--
fs/ext4/extents.c | 7 +-
fs/ext4/mballoc.c | 16 +-
fs/file_table.c | 130 ------------
fs/hpfs/super.c | 19 +-
fs/internal.h | 3 -
fs/ocfs2/dlmglue.c | 10 +-
fs/open.c | 2 -
fs/super.c | 21 +-
include/linux/buffer_head.h | 54 ++++-
include/linux/fs.h | 13 --
include/linux/libata.h | 2 +
include/net/af_unix.h | 1 +
include/net/ip6_fib.h | 2 +-
include/net/sock.h | 1 +
include/sound/tlv.h | 24 ++-
ipc/msg.c | 18 +-
ipc/sem.c | 23 ++-
ipc/shm.c | 13 +-
ipc/util.c | 8 +-
kernel/events/core.c | 12 +-
kernel/watchdog.c | 8 +
mm/memory.c | 17 +-
net/atm/clip.c | 3 +
net/ax25/af_ax25.c | 3 +
net/ax25/ax25_subr.c | 1 +
net/core/datagram.c | 41 +++-
net/core/dev.c | 26 +--
net/core/rtnetlink.c | 106 +++++-----
net/core/sysctl_net_core.c | 14 +-
net/decnet/af_decnet.c | 3 +
net/ipv4/af_inet.c | 3 +
net/ipv4/ip_fragment.c | 6 +-
net/ipv4/sysctl_net_ipv4.c | 11 +-
net/ipv6/addrconf.c | 17 +-
net/ipv6/af_inet6.c | 3 +
net/ipv6/ip6_fib.c | 19 +-
net/ipv6/ndisc.c | 4 +-
net/ipv6/route.c | 41 +++-
net/irda/af_irda.c | 3 +
net/key/af_key.c | 46 ++---
net/mac80211/debugfs_netdev.c | 1 +
net/netfilter/nf_conntrack_core.c | 21 +-
net/netfilter/nf_conntrack_expect.c | 3 +-
net/rds/ib_rdma.c | 4 +-
net/rds/info.c | 2 +-
net/rds/send.c | 4 +-
net/sctp/sm_sideeffect.c | 2 +-
net/sunrpc/xprt.c | 3 +
net/unix/af_unix.c | 188 +++++++++++++++--
scripts/kconfig/streamline_config.pl | 2 +-
security/keys/gc.c | 10 +-
sound/usb/mixer.c | 2 +
sound/usb/mixer_maps.c | 12 ++
sound/usb/mixer_quirks.c | 37 ++++
sound/usb/mixer_quirks.h | 4 +
sound/usb/quirks-table.h | 68 +++++++
125 files changed, 1390 insertions(+), 722 deletions(-)
--
1.9.1
[toc] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 005/107] ext4: replace open coded nofail allocation in ext4_free_blocks() |
| Message-ID | <rdeGL-6bc-19@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Michal Hocko <mhocko@suse.cz>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 7444a072c387a93ebee7066e8aee776954ab0e41 upstream.
ext4_free_blocks is looping around the allocation request and mimics
__GFP_NOFAIL behavior without any allocation fallback strategy. Let's
remove the open coded loop and replace it with __GFP_NOFAIL. Without the
flag the allocator has no way to find out never-fail requirement and
cannot help in any way.
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
fs/ext4/mballoc.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index cdfc763..46e6562 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4643,18 +4643,12 @@ do_more:
/*
* blocks being freed are metadata. these blocks shouldn't
* be used until this transaction is committed
+ *
+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
+ * to fail.
*/
- retry:
- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
- if (!new_entry) {
- /*
- * We use a retry loop because
- * ext4_free_blocks() is not allowed to fail.
- */
- cond_resched();
- congestion_wait(BLK_RW_ASYNC, HZ/50);
- goto retry;
- }
+ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
+ GFP_NOFS|__GFP_NOFAIL);
new_entry->efd_start_cluster = bit;
new_entry->efd_group = block_group;
new_entry->efd_count = count_clusters;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 012/107] dm thin: allocate the cell_sort_array dynamically |
| Message-ID | <rdeGL-6bc-27@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Joe Thornber <ejt@redhat.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit a822c83e47d97cdef38c4352e1ef62d9f46cfe98 upstream.
Given the pool's cell_sort_array holds 8192 pointers it triggers an
order 5 allocation via kmalloc. This order 5 allocation is prone to
failure as system memory gets more fragmented over time.
Fix this by allocating the cell_sort_array using vmalloc.
Signed-off-by: Joe Thornber <ejt@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[lizf: Backported 3.4: it's prinson_{create,destroy}() that need fixing]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/md/dm-thin.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index e811e44..862612e 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -13,6 +13,7 @@
#include <linux/init.h>
#include <linux/module.h>
#include <linux/slab.h>
+#include <linux/vmalloc.h>
#define DM_MSG_PREFIX "thin"
@@ -149,9 +150,7 @@ static struct bio_prison *prison_create(unsigned nr_cells)
{
unsigned i;
uint32_t nr_buckets = calc_nr_buckets(nr_cells);
- size_t len = sizeof(struct bio_prison) +
- (sizeof(struct hlist_head) * nr_buckets);
- struct bio_prison *prison = kmalloc(len, GFP_KERNEL);
+ struct bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL);
if (!prison)
return NULL;
@@ -164,9 +163,15 @@ static struct bio_prison *prison_create(unsigned nr_cells)
return NULL;
}
+ prison->cells = vmalloc(sizeof(*prison->cells) * nr_buckets);
+ if (!prison->cells) {
+ mempool_destroy(prison->cell_pool);
+ kfree(prison);
+ return NULL;
+ }
+
prison->nr_buckets = nr_buckets;
prison->hash_mask = nr_buckets - 1;
- prison->cells = (struct hlist_head *) (prison + 1);
for (i = 0; i < nr_buckets; i++)
INIT_HLIST_HEAD(prison->cells + i);
@@ -175,6 +180,7 @@ static struct bio_prison *prison_create(unsigned nr_cells)
static void prison_destroy(struct bio_prison *prison)
{
+ vfree(prison->cells);
mempool_destroy(prison->cell_pool);
kfree(prison);
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 001/107] Btrfs: use kmem_cache_free when freeing entry in inode cache |
| Message-ID | <rdeGL-6bc-29@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Filipe Manana <fdmanana@suse.com> 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit c3f4a1685bb87e59c886ee68f7967eae07d4dffa upstream. The free space entries are allocated using kmem_cache_zalloc(), through __btrfs_add_free_space(), therefore we should use kmem_cache_free() and not kfree() to avoid any confusion and any potential problem. Looking at the kfree() definition at mm/slab.c it has the following comment: /* * (...) * * Don't free memory not originally allocated by kmalloc() * or you will run into trouble. */ So better be safe and use kmem_cache_free(). Signed-off-by: Filipe Manana <fdmanana@suse.com> Reviewed-by: David Sterba <dsterba@suse.cz> Signed-off-by: Chris Mason <clm@fb.com> Signed-off-by: Zefan Li <lizefan@huawei.com> --- fs/btrfs/inode-map.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c index b1a1c92..47abfd2 100644 --- a/fs/btrfs/inode-map.c +++ b/fs/btrfs/inode-map.c @@ -283,7 +283,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root) __btrfs_add_free_space(ctl, info->offset, count); free: rb_erase(&info->offset_index, rbroot); - kfree(info); + kmem_cache_free(btrfs_free_space_cachep, info); } } -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 026/107] libata: add ATA_HORKAGE_NOTRIM |
| Message-ID | <rdeGL-6bc-25@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Arne Fitzenreiter <arne_f@ipfire.org>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 71d126fd28de2d4d9b7b2088dbccd7ca62fad6e0 upstream.
Some devices lose data on TRIM whether queued or not. This patch adds
a horkage to disable TRIM.
tj: Collapsed unnecessary if() nesting.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Tejun Heo <tj@kernel.org>
[lizf: Backported to 3.4:
- adjust context
- drop changes to show_ata_dev_trim()]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/ata/libata-scsi.c | 3 ++-
include/linux/libata.h | 2 ++
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 15863a4..94ccbc1 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2461,7 +2461,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
rbuf[14] = (lowest_aligned >> 8) & 0x3f;
rbuf[15] = lowest_aligned;
- if (ata_id_has_trim(args->id)) {
+ if (ata_id_has_trim(args->id) &&
+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
rbuf[14] |= 0x80; /* TPE */
if (ata_id_has_zero_after_trim(args->id))
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 35e7f71..9736dbe 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -402,6 +402,8 @@ enum {
ATA_HORKAGE_BROKEN_FPDMA_AA = (1 << 15), /* skip AA */
ATA_HORKAGE_DUMP_ID = (1 << 16), /* dump IDENTIFY data */
ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */
+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
+
/* DMA mask for user DMA control: User visible values; DO NOT
renumber */
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 017/107] drm: add a check for x/y in drm_mode_setcrtc |
| Message-ID | <rdeGL-6bc-31@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Zhao Junwang <zhjwpku@gmail.com> 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 01447e9f04ba1c49a9534ae6a5a6f26c2bb05226 upstream. legacy setcrtc ioctl does take a 32 bit value which might indeed overflow the checks of crtc_req->x > INT_MAX and crtc_req->y > INT_MAX aren't needed any more with this v2: -polish the annotation according to Daniel's comment Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Zhao Junwang <zhjwpku@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Zefan Li <lizefan@huawei.com> --- drivers/gpu/drm/drm_crtc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c index c61e672..ed4b748 100644 --- a/drivers/gpu/drm/drm_crtc.c +++ b/drivers/gpu/drm/drm_crtc.c @@ -1836,8 +1836,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, if (!drm_core_check_feature(dev, DRIVER_MODESET)) return -EINVAL; - /* For some reason crtc x/y offsets are signed internally. */ - if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX) + /* + * Universal plane src offsets are only 16.16, prevent havoc for + * drivers using universal plane code internally. + */ + if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000) return -ERANGE; mutex_lock(&dev->mode_config.mutex); -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 040/107] xhci: prevent bus_suspend if SS port resuming in phase 1 |
| Message-ID | <rdeGL-6bc-35@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Zhuang Jin Can <jin.can.zhuang@intel.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit fac4271d1126c45ceaceb7f4a336317b771eb121 upstream.
When the link is just waken, it's in Resume state, and driver sets PLS to
U0. This refers to Phase 1. Phase 2 refers to when the link has completed
the transition from Resume state to U0.
With the fix of xhci: report U3 when link is in resume state, it also
exposes an issue that usb3 roothub and controller can suspend right
after phase 1, and this causes a hard hang in controller.
To fix the issue, we need to prevent usb3 bus suspend if any port is
resuming in phase 1.
[merge separate USB2 and USB3 port resume checking to one -Mathias]
Signed-off-by: Zhuang Jin Can <jin.can.zhuang@intel.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/usb/host/xhci-hub.c | 6 +++---
drivers/usb/host/xhci-ring.c | 3 +++
drivers/usb/host/xhci.h | 1 +
3 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 9be0c29..fbbb11d 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1011,10 +1011,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
spin_lock_irqsave(&xhci->lock, flags);
if (hcd->self.root_hub->do_remote_wakeup) {
- if (bus_state->resuming_ports) {
+ if (bus_state->resuming_ports || /* USB2 */
+ bus_state->port_remote_wakeup) { /* USB3 */
spin_unlock_irqrestore(&xhci->lock, flags);
- xhci_dbg(xhci, "suspend failed because "
- "a port is resuming\n");
+ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
return -EBUSY;
}
}
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 5e93425..b2afcb8 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1667,6 +1667,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
usb_hcd_resume_root_hub(hcd);
}
+ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
+ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
+
if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
xhci_dbg(xhci, "port resume event for port %d\n", port_id);
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 855f084..f4116fc 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -280,6 +280,7 @@ struct xhci_op_regs {
#define XDEV_U0 (0x0 << 5)
#define XDEV_U2 (0x2 << 5)
#define XDEV_U3 (0x3 << 5)
+#define XDEV_INACTIVE (0x6 << 5)
#define XDEV_RESUME (0xf << 5)
/* true: port has power (see HCC_PPC) */
#define PORT_POWER (1 << 9)
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 020/107] net: call rcu_read_lock early in process_backlog |
| Message-ID | <rdeGL-6bc-37@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Julian Anastasov <ja@ssi.bg>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 2c17d27c36dcce2b6bf689f41a46b9e909877c21 upstream.
Incoming packet should be either in backlog queue or
in RCU read-side section. Otherwise, the final sequence of
flush_backlog() and synchronize_net() may miss packets
that can run without device reference:
CPU 1 CPU 2
skb->dev: no reference
process_backlog:__skb_dequeue
process_backlog:local_irq_enable
on_each_cpu for
flush_backlog => IPI(hardirq): flush_backlog
- packet not found in backlog
CPU delayed ...
synchronize_net
- no ongoing RCU
read-side sections
netdev_run_todo,
rcu_barrier: no
ongoing callbacks
__netif_receive_skb_core:rcu_read_lock
- too late
free dev
process packet for freed dev
Fixes: 6e583ce5242f ("net: eliminate refcounting in backlog queue")
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lizf: Backported to 3.4:
- adjust context
- no need to change "goto unlock" to "goto out"]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
net/core/dev.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/net/core/dev.c b/net/core/dev.c
index 1e363d0..4f679bf 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3191,8 +3191,6 @@ static int __netif_receive_skb(struct sk_buff *skb)
pt_prev = NULL;
- rcu_read_lock();
-
another_round:
__this_cpu_inc(softnet_data.processed);
@@ -3287,7 +3285,6 @@ ncls:
}
out:
- rcu_read_unlock();
return ret;
}
@@ -3308,29 +3305,30 @@ out:
*/
int netif_receive_skb(struct sk_buff *skb)
{
+ int ret;
+
net_timestamp_check(netdev_tstamp_prequeue, skb);
if (skb_defer_rx_timestamp(skb))
return NET_RX_SUCCESS;
+ rcu_read_lock();
+
#ifdef CONFIG_RPS
if (static_key_false(&rps_needed)) {
struct rps_dev_flow voidflow, *rflow = &voidflow;
- int cpu, ret;
-
- rcu_read_lock();
-
- cpu = get_rps_cpu(skb->dev, skb, &rflow);
+ int cpu = get_rps_cpu(skb->dev, skb, &rflow);
if (cpu >= 0) {
ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
rcu_read_unlock();
return ret;
}
- rcu_read_unlock();
}
#endif
- return __netif_receive_skb(skb);
+ ret = __netif_receive_skb(skb);
+ rcu_read_unlock();
+ return ret;
}
EXPORT_SYMBOL(netif_receive_skb);
@@ -3721,8 +3719,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
unsigned int qlen;
while ((skb = __skb_dequeue(&sd->process_queue))) {
+ rcu_read_lock();
local_irq_enable();
__netif_receive_skb(skb);
+ rcu_read_unlock();
local_irq_disable();
input_queue_head_incr(sd);
if (++work >= quota) {
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 015/107] dm btree: silence lockdep lock inversion in dm_btree_del() |
| Message-ID | <rdeGM-6bc-41@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Joe Thornber <ejt@redhat.com> 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 1c7518794a3647eb345d59ee52844e8a40405198 upstream. Allocate memory using GFP_NOIO when deleting a btree. dm_btree_del() can be called via an ioctl and we don't want to recurse into the FS or block layer. Signed-off-by: Joe Thornber <ejt@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Zefan Li <lizefan@huawei.com> --- drivers/md/persistent-data/dm-btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c index 371f3d4..d05cf15 100644 --- a/drivers/md/persistent-data/dm-btree.c +++ b/drivers/md/persistent-data/dm-btree.c @@ -235,7 +235,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root) int r; struct del_stack *s; - s = kmalloc(sizeof(*s), GFP_KERNEL); + s = kmalloc(sizeof(*s), GFP_NOIO); if (!s) return -ENOMEM; s->tm = info->tm; -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:10 +0100 |
| Subject | [PATCH 3.4 029/107] net: Clone skb before setting peeked flag |
| Message-ID | <rdeGL-6bc-39@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Herbert Xu <herbert@gondor.apana.org.au>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec upstream.
Shared skbs must not be modified and this is crucial for broadcast
and/or multicast paths where we use it as an optimisation to avoid
unnecessary cloning.
The function skb_recv_datagram breaks this rule by setting peeked
without cloning the skb first. This causes funky races which leads
to double-free.
This patch fixes this by cloning the skb and replacing the skb
in the list when setting skb->peeked.
Fixes: a59322be07c9 ("[UDP]: Only increment counter on first peek/recv")
Reported-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
[lizf: Backported to 3.4: adjust context]
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
net/core/datagram.c | 41 ++++++++++++++++++++++++++++++++++++++---
1 file changed, 38 insertions(+), 3 deletions(-)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index da7e0c8..ba96ad9 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -127,6 +127,35 @@ out_noerr:
goto out;
}
+static int skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
+ return 0;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
+ goto done;
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
+ return -ENOMEM;
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
+ nskb->prev = skb->prev;
+ nskb->next = skb->next;
+
+ consume_skb(skb);
+ skb = nskb;
+
+done:
+ skb->peeked = 1;
+
+ return 0;
+}
+
/**
* __skb_recv_datagram - Receive a datagram skbuff
* @sk: socket
@@ -161,7 +190,9 @@ out_noerr:
struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
int *peeked, int *off, int *err)
{
+ struct sk_buff_head *queue = &sk->sk_receive_queue;
struct sk_buff *skb;
+ unsigned long cpu_flags;
long timeo;
/*
* Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -180,8 +211,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
* Look at current nfs client by the way...
* However, this function was correct in any case. 8)
*/
- unsigned long cpu_flags;
- struct sk_buff_head *queue = &sk->sk_receive_queue;
spin_lock_irqsave(&queue->lock, cpu_flags);
skb_queue_walk(queue, skb) {
@@ -191,7 +220,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
*off -= skb->len;
continue;
}
- skb->peeked = 1;
+
+ error = skb_set_peeked(skb);
+ if (error)
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
@@ -210,6 +243,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
return NULL;
+unlock_err:
+ spin_unlock_irqrestore(&queue->lock, cpu_flags);
no_packet:
*err = error;
return NULL;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 089/107] KVM: svm: unconditionally intercept #DB |
| Message-ID | <rdeQp-6eY-1@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Paolo Bonzini <pbonzini@redhat.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit cbdb967af3d54993f5814f1cee0ed311a055377d upstream.
This is needed to avoid the possibility that the guest triggers
an infinite stream of #DB exceptions (CVE-2015-8104).
VMX is not affected: because it does not save DR6 in the VMCS,
it already intercepts #DB unconditionally.
Reported-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2, with thanks to Paolo:
- update_db_bp_intercept() was called update_db_intercept()
- The remaining call is in svm_guest_debug() rather than through svm_x86_ops]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
arch/x86/kvm/svm.c | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index 56dd88a..6201ca0 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -1082,6 +1082,7 @@ static void init_vmcb(struct vcpu_svm *svm)
set_exception_intercept(svm, UD_VECTOR);
set_exception_intercept(svm, MC_VECTOR);
set_exception_intercept(svm, AC_VECTOR);
+ set_exception_intercept(svm, DB_VECTOR);
set_intercept(svm, INTERCEPT_INTR);
set_intercept(svm, INTERCEPT_NMI);
@@ -1637,20 +1638,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
mark_dirty(svm->vmcb, VMCB_SEG);
}
-static void update_db_intercept(struct kvm_vcpu *vcpu)
+static void update_bp_intercept(struct kvm_vcpu *vcpu)
{
struct vcpu_svm *svm = to_svm(vcpu);
- clr_exception_intercept(svm, DB_VECTOR);
clr_exception_intercept(svm, BP_VECTOR);
- if (svm->nmi_singlestep)
- set_exception_intercept(svm, DB_VECTOR);
-
if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
- if (vcpu->guest_debug &
- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
- set_exception_intercept(svm, DB_VECTOR);
if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
set_exception_intercept(svm, BP_VECTOR);
} else
@@ -1668,7 +1662,7 @@ static void svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_guest_debug *dbg)
mark_dirty(svm->vmcb, VMCB_DR);
- update_db_intercept(vcpu);
+ update_bp_intercept(vcpu);
}
static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
@@ -1742,7 +1736,6 @@ static int db_interception(struct vcpu_svm *svm)
if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
svm->vmcb->save.rflags &=
~(X86_EFLAGS_TF | X86_EFLAGS_RF);
- update_db_intercept(&svm->vcpu);
}
if (svm->vcpu.guest_debug &
@@ -3661,7 +3654,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
*/
svm->nmi_singlestep = true;
svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
- update_db_intercept(vcpu);
}
static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 082/107] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() |
| Message-ID | <rdeQq-6eY-3@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Ben Hutchings <ben@decadent.org.uk>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 0baa57d8dc32db78369d8b5176ef56c5e2e18ab3 upstream.
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/isdn/i4l/isdn_ppp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index a1e7601..ee41751 100644
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
is->compflags = 0;
is->reset = isdn_ppp_ccp_reset_alloc(is);
+ if (!is->reset)
+ return -ENOMEM;
is->lp = NULL;
is->mp_seqno = 0; /* MP sequence number */
@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
* VJ header compression init
*/
is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
+ if (!is->slcomp) {
+ isdn_ppp_ccp_reset_free(is);
+ return -ENOMEM;
+ }
#endif
#ifdef CONFIG_IPPP_FILTER
is->pass_filter = NULL;
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one |
| Message-ID | <rdeQq-6eY-5@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Ben Zhang <benzh@chromium.org> 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit 62572e29bc530b38921ef6059088b4788a9832a5 upstream. I ran into a scenario where while one cpu was stuck and should have panic'd because of the NMI watchdog, it didn't. The reason was another cpu was spewing stack dumps on to the console. Upon investigation, I noticed that when writing to the console and also when dumping the stack, the watchdog is touched. This causes all the cpus to reset their NMI watchdog flags and the 'stuck' cpu just spins forever. This change causes the semantics of touch_nmi_watchdog to be changed slightly. Previously, I accidentally changed the semantics and we noticed there was a codepath in which touch_nmi_watchdog could be touched from a preemtible area. That caused a BUG() to happen when CONFIG_DEBUG_PREEMPT was enabled. I believe it was the acpi code. My attempt here re-introduces the change to have the touch_nmi_watchdog() code only touch the local cpu instead of all of the cpus. But instead of using __get_cpu_var(), I use the __raw_get_cpu_var() version. This avoids the preemption problem. However my reasoning wasn't because I was trying to be lazy. Instead I rationalized it as, well if preemption is enabled then interrupts should be enabled to and the NMI watchdog will have no reason to trigger. So it won't matter if the wrong cpu is touched because the percpu interrupt counters the NMI watchdog uses should still be incrementing. Don said: : I'm ok with this patch, though it does alter the behaviour of how : touch_nmi_watchdog works. For the most part I don't think most callers : need to touch all of the watchdogs (on each cpu). Perhaps a corner case : will pop up (the scheduler?? to mimic touch_all_softlockup_watchdogs() ). : : But this does address an issue where if a system is locked up and one cpu : is spewing out useful debug messages (or error messages), the hard lockup : will fail to go off. We have seen this on RHEL also. Signed-off-by: Don Zickus <dzickus@redhat.com> Signed-off-by: Ben Zhang <benzh@chromium.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> [lizf: Backported to 3.4: adjust context] Signed-off-by: Zefan Li <lizefan@huawei.com> --- kernel/watchdog.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/watchdog.c b/kernel/watchdog.c index 991aa93..7527c8c 100644 --- a/kernel/watchdog.c +++ b/kernel/watchdog.c @@ -162,6 +162,14 @@ void touch_nmi_watchdog(void) per_cpu(watchdog_nmi_touch, cpu) = true; } } + /* + * Using __raw here because some code paths have + * preemption enabled. If preemption is enabled + * then interrupts should be enabled too, in which + * case we shouldn't have to worry about the watchdog + * going off. + */ + __raw_get_cpu_var(watchdog_nmi_touch) = true; touch_softlockup_watchdog(); } EXPORT_SYMBOL(touch_nmi_watchdog); -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | Don Zickus <dzickus@redhat.com> |
|---|---|
| Date | 2016-03-16 15:20 +0100 |
| Subject | Re: [PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one |
| Message-ID | <rdksO-1C9-9@gated-at.bofh.it> |
| In reply to | #1358628 |
On Wed, Mar 16, 2016 at 04:06:32PM +0800, lizf@kernel.org wrote: > From: Ben Zhang <benzh@chromium.org> > > 3.4.111-rc1 review patch. If anyone has any objections, please let me know. Just an FYI below, this patch won't work the way it was integrated.. comments below > > ------------------ > > > commit 62572e29bc530b38921ef6059088b4788a9832a5 upstream. > > I ran into a scenario where while one cpu was stuck and should have > panic'd because of the NMI watchdog, it didn't. The reason was another > cpu was spewing stack dumps on to the console. Upon investigation, I > noticed that when writing to the console and also when dumping the > stack, the watchdog is touched. > > This causes all the cpus to reset their NMI watchdog flags and the > 'stuck' cpu just spins forever. > > This change causes the semantics of touch_nmi_watchdog to be changed > slightly. Previously, I accidentally changed the semantics and we > noticed there was a codepath in which touch_nmi_watchdog could be > touched from a preemtible area. That caused a BUG() to happen when > CONFIG_DEBUG_PREEMPT was enabled. I believe it was the acpi code. > > My attempt here re-introduces the change to have the > touch_nmi_watchdog() code only touch the local cpu instead of all of the > cpus. But instead of using __get_cpu_var(), I use the > __raw_get_cpu_var() version. > > This avoids the preemption problem. However my reasoning wasn't because > I was trying to be lazy. Instead I rationalized it as, well if > preemption is enabled then interrupts should be enabled to and the NMI > watchdog will have no reason to trigger. So it won't matter if the > wrong cpu is touched because the percpu interrupt counters the NMI > watchdog uses should still be incrementing. > > Don said: > > : I'm ok with this patch, though it does alter the behaviour of how > : touch_nmi_watchdog works. For the most part I don't think most callers > : need to touch all of the watchdogs (on each cpu). Perhaps a corner case > : will pop up (the scheduler?? to mimic touch_all_softlockup_watchdogs() ). > : > : But this does address an issue where if a system is locked up and one cpu > : is spewing out useful debug messages (or error messages), the hard lockup > : will fail to go off. We have seen this on RHEL also. > > Signed-off-by: Don Zickus <dzickus@redhat.com> > Signed-off-by: Ben Zhang <benzh@chromium.org> > Signed-off-by: Andrew Morton <akpm@linux-foundation.org> > Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> > [lizf: Backported to 3.4: adjust context] > Signed-off-by: Zefan Li <lizefan@huawei.com> > --- > kernel/watchdog.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/kernel/watchdog.c b/kernel/watchdog.c > index 991aa93..7527c8c 100644 > --- a/kernel/watchdog.c > +++ b/kernel/watchdog.c > @@ -162,6 +162,14 @@ void touch_nmi_watchdog(void) > per_cpu(watchdog_nmi_touch, cpu) = true; > } > } The above for-loop was to be replaced by the non-for-loop below. The above for-loop is the problem this patch was solving, so keeping it around does not solve anything. :-) > + /* > + * Using __raw here because some code paths have > + * preemption enabled. If preemption is enabled > + * then interrupts should be enabled too, in which > + * case we shouldn't have to worry about the watchdog > + * going off. > + */ > + __raw_get_cpu_var(watchdog_nmi_touch) = true; > touch_softlockup_watchdog(); > } > EXPORT_SYMBOL(touch_nmi_watchdog); Cheers, Don
[toc] | [prev] | [next] | [standalone]
| From | Zefan Li <lizefan@huawei.com> |
|---|---|
| Date | 2016-03-17 02:30 +0100 |
| Subject | Re: [PATCH 3.4 098/107] kernel/watchdog.c: touch_nmi_watchdog should only touch local cpu not every one |
| Message-ID | <rduVc-ne-7@gated-at.bofh.it> |
| In reply to | #1359035 |
>> diff --git a/kernel/watchdog.c b/kernel/watchdog.c >> index 991aa93..7527c8c 100644 >> --- a/kernel/watchdog.c >> +++ b/kernel/watchdog.c >> @@ -162,6 +162,14 @@ void touch_nmi_watchdog(void) >> per_cpu(watchdog_nmi_touch, cpu) = true; >> } >> } > > The above for-loop was to be replaced by the non-for-loop below. > > The above for-loop is the problem this patch was solving, so keeping it > around does not solve anything. :-) > OOps, my fault. I'll remove this for-loop. Thanks for your review! > >> + /* >> + * Using __raw here because some code paths have >> + * preemption enabled. If preemption is enabled >> + * then interrupts should be enabled too, in which >> + * case we shouldn't have to worry about the watchdog >> + * going off. >> + */ >> + __raw_get_cpu_var(watchdog_nmi_touch) = true; >> touch_softlockup_watchdog(); >> } >> EXPORT_SYMBOL(touch_nmi_watchdog); > > Cheers, > Don > . >
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 102/107] ALSA: tlv: compute TLV_*_ITEM lengths automatically |
| Message-ID | <rdeQq-6eY-7@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Clemens Ladisch <clemens@ladisch.de>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit b5b9eb546762c4015c67c31364a6ec6f83fd2ada upstream.
Add helper macros with a little bit of preprocessor magic to
automatically compute the length of a TLV item. This lets us avoid
having to compute this by hand, and will allow to use items that do
not use a fixed length.
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
include/sound/tlv.h | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/include/sound/tlv.h b/include/sound/tlv.h
index 7067e2d..137d165 100644
--- a/include/sound/tlv.h
+++ b/include/sound/tlv.h
@@ -38,21 +38,26 @@
#define SNDRV_CTL_TLVT_DB_MINMAX 4 /* dB scale with min/max */
#define SNDRV_CTL_TLVT_DB_MINMAX_MUTE 5 /* dB scale with min/max with mute */
+#define TLV_ITEM(type, ...) \
+ (type), TLV_LENGTH(__VA_ARGS__), __VA_ARGS__
+#define TLV_LENGTH(...) \
+ ((unsigned int)sizeof((const unsigned int[]) { __VA_ARGS__ }))
+
#define TLV_DB_SCALE_MASK 0xffff
#define TLV_DB_SCALE_MUTE 0x10000
#define TLV_DB_SCALE_ITEM(min, step, mute) \
- SNDRV_CTL_TLVT_DB_SCALE, 2 * sizeof(unsigned int), \
- (min), ((step) & TLV_DB_SCALE_MASK) | ((mute) ? TLV_DB_SCALE_MUTE : 0)
+ TLV_ITEM(SNDRV_CTL_TLVT_DB_SCALE, \
+ (min), \
+ ((step) & TLV_DB_SCALE_MASK) | \
+ ((mute) ? TLV_DB_SCALE_MUTE : 0))
#define DECLARE_TLV_DB_SCALE(name, min, step, mute) \
unsigned int name[] = { TLV_DB_SCALE_ITEM(min, step, mute) }
/* dB scale specified with min/max values instead of step */
#define TLV_DB_MINMAX_ITEM(min_dB, max_dB) \
- SNDRV_CTL_TLVT_DB_MINMAX, 2 * sizeof(unsigned int), \
- (min_dB), (max_dB)
+ TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX, (min_dB), (max_dB))
#define TLV_DB_MINMAX_MUTE_ITEM(min_dB, max_dB) \
- SNDRV_CTL_TLVT_DB_MINMAX_MUTE, 2 * sizeof(unsigned int), \
- (min_dB), (max_dB)
+ TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX_MUTE, (min_dB), (max_dB))
#define DECLARE_TLV_DB_MINMAX(name, min_dB, max_dB) \
unsigned int name[] = { TLV_DB_MINMAX_ITEM(min_dB, max_dB) }
#define DECLARE_TLV_DB_MINMAX_MUTE(name, min_dB, max_dB) \
@@ -60,8 +65,7 @@
/* linear volume between min_dB and max_dB (.01dB unit) */
#define TLV_DB_LINEAR_ITEM(min_dB, max_dB) \
- SNDRV_CTL_TLVT_DB_LINEAR, 2 * sizeof(unsigned int), \
- (min_dB), (max_dB)
+ TLV_ITEM(SNDRV_CTL_TLVT_DB_LINEAR, (min_dB), (max_dB))
#define DECLARE_TLV_DB_LINEAR(name, min_dB, max_dB) \
unsigned int name[] = { TLV_DB_LINEAR_ITEM(min_dB, max_dB) }
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 053/107] drm/radeon/combios: add some validation of lvds values |
| Message-ID | <rdeQq-6eY-9@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Alex Deucher <alexander.deucher@amd.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 0a90a0cff9f429f886f423967ae053150dce9259 upstream.
Fixes a broken hsync start value uncovered by:
abc0b1447d4974963548777a5ba4a4457c82c426
(drm: Perform basic sanity checks on probed modes)
The driver handled the bad hsync start elsewhere, but
the above commit prevented it from getting added.
bug:
https://bugs.freedesktop.org/show_bug.cgi?id=91401
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
drivers/gpu/drm/radeon/radeon_combios.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index cf5dd63..b72eb50 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -1259,10 +1259,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) &&
(RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) {
+ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+
+ if (hss > lvds->native_mode.hdisplay)
+ hss = (10 - 1) * 8;
+
lvds->native_mode.htotal = lvds->native_mode.hdisplay +
(RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8;
lvds->native_mode.hsync_start = lvds->native_mode.hdisplay +
- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
+ hss;
lvds->native_mode.hsync_end = lvds->native_mode.hsync_start +
(RBIOS8(tmp + 23) * 8);
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 073/107] sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state |
| Message-ID | <rdeQq-6eY-11@gated-at.bofh.it> |
| In reply to | #1358614 |
From: lucien <lucien.xin@gmail.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit f648f807f61e64d247d26611e34cc97e4ed03401 upstream.
Commit f8d960524328 ("sctp: Enforce retransmission limit during shutdown")
fixed a problem with excessive retransmissions in the SHUTDOWN_PENDING by not
resetting the association overall_error_count. This allowed the association
to better enforce assoc.max_retrans limit.
However, the same issue still exists when the association is in SHUTDOWN_RECEIVED
state. In this state, HB-ACKs will continue to reset the overall_error_count
for the association would extend the lifetime of association unnecessarily.
This patch solves this by resetting the overall_error_count whenever the current
state is small then SCTP_STATE_SHUTDOWN_PENDING. As a small side-effect, we
end up also handling SCTP_STATE_SHUTDOWN_ACK_SENT and SCTP_STATE_SHUTDOWN_SENT
states, but they are not really impacted because we disable Heartbeats in those
states.
Fixes: Commit f8d960524328 ("sctp: Enforce retransmission limit during shutdown")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Vlad Yasevich <vyasevich@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
net/sctp/sm_sideeffect.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 1ff51c9..5fa033a 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -682,7 +682,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
* outstanding data and rely on the retransmission limit be reached
* to shutdown the association.
*/
- if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
+ if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING)
t->asoc->overall_error_count = 0;
/* Clear the hb_sent flag to signal that we had a good
--
1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 055/107] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall |
| Message-ID | <rdeQq-6eY-13@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Andy Lutomirski <luto@kernel.org> 3.4.111-rc1 review patch. If anyone has any objections, please let me know. ------------------ commit aa1acff356bbedfd03b544051f5b371746735d89 upstream. The update_va_mapping hypercall can fail if the VA isn't present in the guest's page tables. Under certain loads, this can result in an OOPS when the target address is in unpopulated vmap space. While we're at it, add comments to help explain what's going on. This isn't a great long-term fix. This code should probably be changed to use something like set_memory_ro. Signed-off-by: Andy Lutomirski <luto@kernel.org> Cc: Andrew Cooper <andrew.cooper3@citrix.com> Cc: Andy Lutomirski <luto@amacapital.net> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Brian Gerst <brgerst@gmail.com> Cc: David Vrabel <dvrabel@cantab.net> Cc: Denys Vlasenko <dvlasenk@redhat.com> Cc: H. Peter Anvin <hpa@zytor.com> Cc: Jan Beulich <jbeulich@suse.com> Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: security@kernel.org <security@kernel.org> Cc: xen-devel <xen-devel@lists.xen.org> Link: http://lkml.kernel.org/r/0b0e55b995cda11e7829f140b833ef932fcabe3a.1438291540.git.luto@kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Zefan Li <lizefan@huawei.com> --- arch/x86/xen/enlighten.c | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c index 9598038..8ade106 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -413,6 +413,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) pte_t pte; unsigned long pfn; struct page *page; + unsigned char dummy; ptep = lookup_address((unsigned long)v, &level); BUG_ON(ptep == NULL); @@ -422,6 +423,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) pte = pfn_pte(pfn, prot); + /* + * Careful: update_va_mapping() will fail if the virtual address + * we're poking isn't populated in the page tables. We don't + * need to worry about the direct map (that's always in the page + * tables), but we need to be careful about vmap space. In + * particular, the top level page table can lazily propagate + * entries between processes, so if we've switched mms since we + * vmapped the target in the first place, we might not have the + * top-level page table entry populated. + * + * We disable preemption because we want the same mm active when + * we probe the target and when we issue the hypercall. We'll + * have the same nominal mm, but if we're a kernel thread, lazy + * mm dropping could change our pgd. + * + * Out of an abundance of caution, this uses __get_user() to fault + * in the target address just in case there's some obscure case + * in which the target address isn't readable. + */ + + preempt_disable(); + + pagefault_disable(); /* Avoid warnings due to being atomic. */ + __get_user(dummy, (unsigned char __user __force *)v); + pagefault_enable(); + if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) BUG(); @@ -433,6 +460,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) BUG(); } else kmap_flush_unused(); + + preempt_enable(); } static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) @@ -440,6 +469,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; int i; + /* + * We need to mark the all aliases of the LDT pages RO. We + * don't need to call vm_flush_aliases(), though, since that's + * only responsible for flushing aliases out the TLBs, not the + * page tables, and Xen will flush the TLB for us if needed. + * + * To avoid confusing future readers: none of this is necessary + * to load the LDT. The hypervisor only checks this when the + * LDT is faulted in due to subsequent descriptor access. + */ + for(i = 0; i < entries; i += entries_per_page) set_aliased_prot(ldt + i, PAGE_KERNEL_RO); } -- 1.9.1
[toc] | [prev] | [next] | [standalone]
| From | lizf@kernel.org |
|---|---|
| Date | 2016-03-16 09:20 +0100 |
| Subject | [PATCH 3.4 095/107] atm: deal with setting entry before mkip was called |
| Message-ID | <rdeQq-6eY-15@gated-at.bofh.it> |
| In reply to | #1358614 |
From: Sasha Levin <sasha.levin@oracle.com>
3.4.111-rc1 review patch. If anyone has any objections, please let me know.
------------------
commit 34f5b0066435ffb793049b84fafd29fa195bcf90 upstream.
If we didn't call ATMARP_MKIP before ATMARP_ENCAP the VCC descriptor is
non-existant and we'll end up dereferencing a NULL ptr:
[1033173.491930] kasan: GPF could be caused by NULL-ptr deref or user memory accessirq event stamp: 123386
[1033173.493678] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
[1033173.493689] Modules linked in:
[1033173.493697] CPU: 9 PID: 23815 Comm: trinity-c64 Not tainted 4.2.0-next-20150911-sasha-00043-g353d875-dirty #2545
[1033173.493706] task: ffff8800630c4000 ti: ffff880063110000 task.ti: ffff880063110000
[1033173.493823] RIP: clip_ioctl (net/atm/clip.c:320 net/atm/clip.c:689)
[1033173.493826] RSP: 0018:ffff880063117a88 EFLAGS: 00010203
[1033173.493828] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 000000000000000c
[1033173.493830] RDX: 0000000000000002 RSI: ffffffffb3f10720 RDI: 0000000000000014
[1033173.493832] RBP: ffff880063117b80 R08: ffff88047574d9a4 R09: 0000000000000000
[1033173.493834] R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000c622f53
[1033173.493836] R13: ffff8800cb905500 R14: ffff8808d6da2000 R15: 00000000fffffdfd
[1033173.493840] FS: 00007fa56b92d700(0000) GS:ffff880478000000(0000) knlGS:0000000000000000
[1033173.493843] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[1033173.493845] CR2: 0000000000000000 CR3: 00000000630e8000 CR4: 00000000000006a0
[1033173.493855] Stack:
[1033173.493862] ffffffffb0b60444 000000000000eaea 0000000041b58ab3 ffffffffb3c3ce32
[1033173.493867] ffffffffb0b6f3e0 ffffffffb0b60444 ffffffffb5ea2e50 1ffff1000c622f5e
[1033173.493873] ffff8800630c4cd8 00000000000ee09a ffffffffb3ec4888 ffffffffb5ea2de8
[1033173.493874] Call Trace:
[1033173.494108] do_vcc_ioctl (net/atm/ioctl.c:170)
[1033173.494113] vcc_ioctl (net/atm/ioctl.c:189)
[1033173.494116] svc_ioctl (net/atm/svc.c:605)
[1033173.494200] sock_do_ioctl (net/socket.c:874)
[1033173.494204] sock_ioctl (net/socket.c:958)
[1033173.494244] do_vfs_ioctl (fs/ioctl.c:43 fs/ioctl.c:607)
[1033173.494290] SyS_ioctl (fs/ioctl.c:622 fs/ioctl.c:613)
[1033173.494295] entry_SYSCALL_64_fastpath (arch/x86/entry/entry_64.S:186)
[1033173.494362] Code: fa 48 c1 ea 03 80 3c 02 00 0f 85 50 09 00 00 49 8b 9e 60 06 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 14 48 89 fa 48 c1 ea 03 <0f> b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 14 09 00
All code
========
0: fa cli
1: 48 c1 ea 03 shr $0x3,%rdx
5: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
9: 0f 85 50 09 00 00 jne 0x95f
f: 49 8b 9e 60 06 00 00 mov 0x660(%r14),%rbx
16: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1d: fc ff df
20: 48 8d 7b 14 lea 0x14(%rbx),%rdi
24: 48 89 fa mov %rdi,%rdx
27: 48 c1 ea 03 shr $0x3,%rdx
2b:* 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping instruction
2f: 48 89 fa mov %rdi,%rdx
32: 83 e2 07 and $0x7,%edx
35: 38 d0 cmp %dl,%al
37: 7f 08 jg 0x41
39: 84 c0 test %al,%al
3b: 0f 85 14 09 00 00 jne 0x955
Code starting with the faulting instruction
===========================================
0: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
4: 48 89 fa mov %rdi,%rdx
7: 83 e2 07 and $0x7,%edx
a: 38 d0 cmp %dl,%al
c: 7f 08 jg 0x16
e: 84 c0 test %al,%al
10: 0f 85 14 09 00 00 jne 0x92a
[1033173.494366] RIP clip_ioctl (net/atm/clip.c:320 net/atm/clip.c:689)
[1033173.494368] RSP <ffff880063117a88>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Zefan Li <lizefan@huawei.com>
---
net/atm/clip.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 8ae3a78..e55e664 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -317,6 +317,9 @@ static int clip_constructor(struct neighbour *neigh)
static int clip_encap(struct atm_vcc *vcc, int mode)
{
+ if (!CLIP_VCC(vcc))
+ return -EBADFD;
+
CLIP_VCC(vcc)->encap = mode;
return 0;
}
--
1.9.1
[toc] | [prev] | [next] | [standalone]
Page 1 of 6 [1] 2 3 4 5 6 Next page →
Back to top | Article view | linux.kernel
csiph-web