Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1362479 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 137/142] efi: Do variable name validation tests in utf8 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 138/142] efi: Make our variable validation list include the guid Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 094/142] ALSA: hdspm: Fix wrong boolean ctl value accesses Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 100/142] USB: serial: option: add support for Quectel UC20 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 132/142] AIO: properly check iovec sizes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 009/142] s390/dasd: fix refcount for PAV reassignment Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 135/142] lib/ucs2_string: Add ucs2 -> utf8 helper functions Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 142/142] tracing: Fix check for cpu online when event is disabled Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 065/142] ipv4: fix memory leaks in ip_cmsg_send() callers Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 023/142] ext4: fix crashes in dioread_nolock mode Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 022/142] ext4: fix bh->b_state corruption Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 027/142] nfs: fix nfs_size_to_loff_t Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 098/142] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 136/142] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 067/142] pppoe: fix reference counting in PPPoE proxy Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 128/142] net: moxa: fix an error code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 095/142] ALSA: hdspm: Fix zero-division Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 066/142] qmi_wwan: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 063/142] net:Add sysctl_max_skb_frags Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 001/142] Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 139/142] efi: Make efivarfs entries immutable by default Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 024/142] kernel/resource.c: fix muxed resource handling in __request_region() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 026/142] crypto: {blk,giv}cipher: Set has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 115/142] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 084/142] libata: Align ata_device's id on a cacheline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 107/142] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 124/142] tcp: convert cached rtt from usec to jiffies when feeding initial rto Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 125/142] net/mlx4_core: Allow resetting VF admin mac to zero Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 120/142] Revert "drm/radeon: call hpd_irq_event on resume" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 114/142] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 119/142] target: Drop incorrect ABORT_TASK put for completed commands Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 108/142] ubi: Fix out of bounds write in volume update code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 118/142] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 105/142] PM / sleep / x86: Fix crash on graph trace through x86 suspend Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 122/142] KVM: VMX: disable PEBS before a guest entry Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 109/142] gpio: rcar: Add Runtime PM handling for interrupts Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 130/142] ext4: iterate over buffer heads correctly in move_extent_per_page() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 101/142] ALSA: seq: oss: Don't drain at closing a client Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 092/142] Fix cifs_uniqueid_to_ino_t() function for s390x Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 110/142] IB/core: Use GRH when the path hop-limit > 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 104/142] drm/radeon/pm: update current crtc info after setting the powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 102/142] drm/ast: Fix incorrect register check for DRAM width Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 103/142] USB: qcserial: add Sierra Wireless EM74xx device ID Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 129/142] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 106/142] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 127/142] ipv6: re-enable fragment header matching in ipv6_find_hdr Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 126/142] mld, igmp: Fix reserved tailroom calculation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 112/142] cfg80211/wext: fix message ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 116/142] ASoC: wm8958: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 090/142] cifs: fix out-of-bounds access in lease parsing Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 123/142] Revert "drm/radeon/pm: adjust display configuration after powerstate" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 121/142] KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 113/142] mac80211: fix use of uninitialised values in RX aggregation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 117/142] ASoC: wm8994: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 111/142] wext: fix message delay/ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 099/142] USB: serial: option: add support for Telit LE922 PID 0x1045 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 071/142] target: Fix LUN_RESET active TMR descriptor handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 070/142] sctp: Fix port hash table size computation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 079/142] usb: chipidea: otg: change workqueue ci_otg as freezable Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 077/142] libata: fix HDIO_GET_32BIT ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 072/142] target: Fix LUN_RESET active I/O handling for ACK_KREF Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 083/142] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 082/142] Fix directory hardlinks from deleted directories Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 081/142] jffs2: Fix page lock / f->sem deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 087/142] ALSA: rawmidi: Fix ioctls X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 089/142] ALSA: timer: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 091/142] CIFS: Fix SMB2+ interim response processing for read requests Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 073/142] target: Fix TAS handling for multi-session se_node_acls Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 069/142] rtnl: RTM_GETNETCONF: fix wrong return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 085/142] vfio: fix ioctl error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 080/142] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 068/142] route: check and remove route cache when we get route Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 086/142] ALSA: ctl: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 025/142] x86/entry/compat: Add missing CLAC to entry_INT80_32 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 076/142] Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 078/142] [media] adv7604: fix tx 5v detect regression Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 074/142] target: Fix remote-port TMR ABORT + se_cmd fabric stop Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 075/142] target: Fix race with SCF_SEND_DELAYED_TAS handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 088/142] ALSA: timer: Fix broken compat timer user status ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 064/142] tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 046/142] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 054/142] net/mlx4_en: Count HW buffer overrun only once Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 045/142] KVM: x86: MMU: fix ubsan index-out-of-range warning Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 055/142] net/mlx4_en: Choose time-stamping shift value according to HW frequency Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 060/142] tcp: fix NULL deref in tcp_v4_send_ack() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 040/142] sunrpc/cache: fix off-by-one in qword_get() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 059/142] net: dp83640: Fix tx timestamp overflow handling. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 033/142] USB: option: add support for SIM7100E Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 049/142] ARM: dts: kirkwood: use unique machine name for ds112 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 058/142] af_iucv: Validate socket address length in iucv_sock_bind() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 056/142] net/mlx4_en: Avoid changing dev->features directly in run-time Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 044/142] ALSA: hda - Fixing background noise on Dell Inspiron 3162 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 050/142] bonding: Fix ARP monitor validation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 032/142] NFSv4: Fix a dentry leak on alias use Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 057/142] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 035/142] USB: option: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
      Re: [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option  accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-24 11:20 +0100
    [PATCH 3.16.y-ckt 034/142] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 048/142] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 047/142] hpfs: don't truncate the file when delete fails Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 052/142] af_unix: Guard against other == sk in unix_dgram_sendmsg Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 028/142] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 038/142] can: ems_usb: Fix possible tx overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 043/142] libceph: don't bail early from try_read() when skipping a message Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 042/142] tracing: Fix showing function event in available_events Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 051/142] af_unix: Don't set err in unix_stream_read_generic unless there was an error Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 036/142] hwmon: (ads1015) Handle negative conversion values correctly Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 053/142] net: phy: bcm7xxx: Fix shadow mode 2 disabling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 041/142] KVM: async_pf: do not warn on page allocation failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 061/142] ipv6/udp: use sticky pktinfo egress ifindex on connect() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 039/142] drm/radeon/pm: adjust display configuration after powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 021/142] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 037/142] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 014/142] ALSA: seq: Drop superfluous error/debug messages after malloc failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 006/142] drm/i915: fix error path in intel_setup_gmbus() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 030/142] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 004/142] drm/i915/dsi: don't pass arbitrary data to sideband Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 005/142] powerpc: Fix dedotify for binutils >= 2.26 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 031/142] usb: dwc3: Fix assignment of EP transfer resources Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 012/142] ext4: don't read blocks from disk after extents being swapped Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 013/142] bio: return EINTR if copying to user space got interrupted Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 017/142] tracepoints: Do not trace when cpu is offline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 019/142] ALSA: seq: Fix double port list deletion Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 003/142] drm/i915/dsi: defend gpio table against out of bounds access Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 002/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 018/142] tracing: Fix freak link error caused by branch tracer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 029/142] xen/pciback: Save the number of MSI-X entries to be copied later. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 020/142] drm/radeon: use post-decrement in error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 007/142] cifs: fix erroneous return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 016/142] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 011/142] ext4: fix potential integer overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 010/142] scsi: fix soft lockup in scsi_remove_target() on module removal Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 015/142] ALSA: seq: Fix leak of pool buffer at concurrent writes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

#1362635 — [PATCH 3.16.y-ckt 031/142] usb: dwc3: Fix assignment of EP transfer resources

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: John Youn <John.Youn@synopsys.com>

commit c450960187f45d4260db87c7dd4fc0bceb5565d8 upstream.

The assignement of EP transfer resources was not handled properly in the
dwc3 driver. Commit aebda6187181 ("usb: dwc3: Reset the transfer
resource index on SET_INTERFACE") previously fixed one aspect of this
where resources may be exhausted with multiple calls to SET_INTERFACE.
However, it introduced an issue where composite devices with multiple
interfaces can be assigned the same transfer resources for different
endpoints. This patch solves both issues.

The assignment of transfer resources cannot perfectly follow the data
book due to the fact that the controller driver does not have all
knowledge of the configuration in advance. It is given this information
piecemeal by the composite gadget framework after every
SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
programming model in this scenario can cause errors. For two reasons:

1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION and
SET_INTERFACE (8.1.5). This is incorrect in the scenario of multiple
interfaces.

2) The databook does not mention doing more DEPXFERCFG for new endpoint
on alt setting (8.1.6).

The following simplified method is used instead:

All hardware endpoints can be assigned a transfer resource and this
setting will stay persistent until either a core reset or hibernation.
So whenever we do a DEPSTARTCFG(0) we can go ahead and do DEPXFERCFG for
every hardware endpoint as well. We are guaranteed that there are as
many transfer resources as endpoints.

This patch triggers off of the calling dwc3_gadget_start_config() for
EP0-out, which always happens first, and which should only happen in one
of the above conditions.

Fixes: aebda6187181 ("usb: dwc3: Reset the transfer resource index on SET_INTERFACE")
Reported-by: Ravi Babu <ravibabu@ti.com>
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/usb/dwc3/core.h   |  1 -
 drivers/usb/dwc3/ep0.c    |  5 ----
 drivers/usb/dwc3/gadget.c | 70 +++++++++++++++++++++++++++++++++++------------
 3 files changed, 52 insertions(+), 24 deletions(-)

diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 1ba964de9c3b..fd91c10a21a9 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -754,7 +754,6 @@ struct dwc3 {
 	unsigned		pullups_connected:1;
 	unsigned		resize_fifos:1;
 	unsigned		setup_packet_pending:1;
-	unsigned		start_config_issued:1;
 	unsigned		three_stage_setup:1;
 };
 
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index 312bc0542562..ba35201e19fe 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -524,7 +524,6 @@ static int dwc3_ep0_set_config(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
 	int ret;
 	u32 reg;
 
-	dwc->start_config_issued = false;
 	cfg = le16_to_cpu(ctrl->wValue);
 
 	switch (state) {
@@ -707,10 +706,6 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
 		dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n");
 		ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
 		break;
-	case USB_REQ_SET_INTERFACE:
-		dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE");
-		dwc->start_config_issued = false;
-		/* Fall through */
 	default:
 		dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 186a79d43250..4a279bb9092a 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -472,24 +472,66 @@ static void dwc3_free_trb_pool(struct dwc3_ep *dep)
 	dep->trb_pool_dma = 0;
 }
 
+static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
+
+/**
+ * dwc3_gadget_start_config - Configure EP resources
+ * @dwc: pointer to our controller context structure
+ * @dep: endpoint that is being enabled
+ *
+ * The assignment of transfer resources cannot perfectly follow the
+ * data book due to the fact that the controller driver does not have
+ * all knowledge of the configuration in advance. It is given this
+ * information piecemeal by the composite gadget framework after every
+ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
+ * programming model in this scenario can cause errors. For two
+ * reasons:
+ *
+ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
+ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
+ * multiple interfaces.
+ *
+ * 2) The databook does not mention doing more DEPXFERCFG for new
+ * endpoint on alt setting (8.1.6).
+ *
+ * The following simplified method is used instead:
+ *
+ * All hardware endpoints can be assigned a transfer resource and this
+ * setting will stay persistent until either a core reset or
+ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
+ * do DEPXFERCFG for every hardware endpoint as well. We are
+ * guaranteed that there are as many transfer resources as endpoints.
+ *
+ * This function is called for each endpoint when it is being enabled
+ * but is triggered only when called for EP0-out, which always happens
+ * first, and which should only happen in one of the above conditions.
+ */
 static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
 {
 	struct dwc3_gadget_ep_cmd_params params;
 	u32			cmd;
+	int			i;
+	int			ret;
+
+	if (dep->number)
+		return 0;
 
 	memset(&params, 0x00, sizeof(params));
+	cmd = DWC3_DEPCMD_DEPSTARTCFG;
 
-	if (dep->number != 1) {
-		cmd = DWC3_DEPCMD_DEPSTARTCFG;
-		/* XferRscIdx == 0 for ep0 and 2 for the remaining */
-		if (dep->number > 1) {
-			if (dwc->start_config_issued)
-				return 0;
-			dwc->start_config_issued = true;
-			cmd |= DWC3_DEPCMD_PARAM(2);
-		}
+	ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
+	if (ret)
+		return ret;
 
-		return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, &params);
+	for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
+		struct dwc3_ep *dep = dwc->eps[i];
+
+		if (!dep)
+			continue;
+
+		ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+		if (ret)
+			return ret;
 	}
 
 	return 0;
@@ -603,10 +645,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
 		struct dwc3_trb	*trb_st_hw;
 		struct dwc3_trb	*trb_link;
 
-		ret = dwc3_gadget_set_xfer_resource(dwc, dep);
-		if (ret)
-			return ret;
-
 		dep->endpoint.desc = desc;
 		dep->comp_desc = comp_desc;
 		dep->type = usb_endpoint_type(desc);
@@ -1666,8 +1704,6 @@ static int dwc3_gadget_start(struct usb_gadget *g,
 	}
 	dwc3_writel(dwc->regs, DWC3_DCFG, reg);
 
-	dwc->start_config_issued = false;
-
 	/* Start with SuperSpeed Default */
 	dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
 
@@ -2237,7 +2273,6 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
 	dwc3_writel(dwc->regs, DWC3_DCTL, reg);
 
 	dwc3_disconnect_gadget(dwc);
-	dwc->start_config_issued = false;
 
 	dwc->gadget.speed = USB_SPEED_UNKNOWN;
 	dwc->setup_packet_pending = false;
@@ -2293,7 +2328,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
 
 	dwc3_stop_active_transfers(dwc);
 	dwc3_clear_stall_all_ep(dwc);
-	dwc->start_config_issued = false;
 
 	/* Reset device address to zero */
 	reg = dwc3_readl(dwc->regs, DWC3_DCFG);

[toc] | [prev] | [next] | [standalone]

#1362637 — [PATCH 3.16.y-ckt 012/142] ext4: don't read blocks from disk after extents being swapped

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eryu Guan <guaneryu@gmail.com>

commit bcff24887d00bce102e0857d7b0a8c44a40f53d1 upstream.

I notice ext4/307 fails occasionally on ppc64 host, reporting md5
checksum mismatch after moving data from original file to donor file.

The reason is that move_extent_per_page() calls __block_write_begin()
and block_commit_write() to write saved data from original inode blocks
to donor inode blocks, but __block_write_begin() not only maps buffer
heads but also reads block content from disk if the size is not block
size aligned.  At this time the physical block number in mapped buffer
head is pointing to the donor file not the original file, and that
results in reading wrong data to page, which get written to disk in
following block_commit_write call.

This also can be reproduced by the following script on 1k block size ext4
on x86_64 host:

    mnt=/mnt/ext4
    donorfile=$mnt/donor
    testfile=$mnt/testfile
    e4compact=~/xfstests/src/e4compact

    rm -f $donorfile $testfile

    # reserve space for donor file, written by 0xaa and sync to disk to
    # avoid EBUSY on EXT4_IOC_MOVE_EXT
    xfs_io -fc "pwrite -S 0xaa 0 1m" -c "fsync" $donorfile

    # create test file written by 0xbb
    xfs_io -fc "pwrite -S 0xbb 0 1023" -c "fsync" $testfile

    # compute initial md5sum
    md5sum $testfile | tee md5sum.txt
    # drop cache, force e4compact to read data from disk
    echo 3 > /proc/sys/vm/drop_caches

    # test defrag
    echo "$testfile" | $e4compact -i -v -f $donorfile
    # check md5sum
    md5sum -c md5sum.txt

Fix it by creating & mapping buffer heads only but not reading blocks
from disk, because all the data in page is guaranteed to be up-to-date
in mext_page_mkuptodate().

Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/ext4/move_extent.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 2484c7ec6a72..146f8cd627b2 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -915,10 +915,11 @@ move_extent_per_page(struct file *o_filp, struct inode *donor_inode,
 	unsigned long blocksize = orig_inode->i_sb->s_blocksize;
 	unsigned int w_flags = 0;
 	unsigned int tmp_data_size, data_size, replaced_size;
-	int err2, jblocks, retries = 0;
+	int i, err2, jblocks, retries = 0;
 	int replaced_count = 0;
 	int from = data_offset_in_page << orig_inode->i_blkbits;
 	int blocks_per_page = PAGE_CACHE_SIZE >> orig_inode->i_blkbits;
+	struct buffer_head *bh = NULL;
 
 	/*
 	 * It needs twice the amount of ordinary journal buffers because
@@ -1027,8 +1028,16 @@ data_copy:
 	}
 	/* Perform all necessary steps similar write_begin()/write_end()
 	 * but keeping in mind that i_size will not change */
-	*err = __block_write_begin(pagep[0], from, replaced_size,
-				   ext4_get_block);
+	if (!page_has_buffers(pagep[0]))
+		create_empty_buffers(pagep[0], 1 << orig_inode->i_blkbits, 0);
+	bh = page_buffers(pagep[0]);
+	for (i = 0; i < data_offset_in_page; i++)
+		bh = bh->b_this_page;
+	for (i = 0; i < block_len_in_page; i++) {
+		*err = ext4_get_block(orig_inode, orig_blk_offset + i, bh, 0);
+		if (*err < 0)
+			break;
+	}
 	if (!*err)
 		*err = block_commit_write(pagep[0], from, from + replaced_size);
 

[toc] | [prev] | [next] | [standalone]

#1362638 — [PATCH 3.16.y-ckt 013/142] bio: return EINTR if copying to user space got interrupted

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Hannes Reinecke <hare@suse.de>

commit 2d99b55d378c996b9692a0c93dd25f4ed5d58934 upstream.

Commit 35dc248383bbab0a7203fca4d722875bc81ef091 introduced a check for
current->mm to see if we have a user space context and only copies data
if we do. Now if an IO gets interrupted by a signal data isn't copied
into user space any more (as we don't have a user space context) but
user space isn't notified about it.

This patch modifies the behaviour to return -EINTR from bio_uncopy_user()
to notify userland that a signal has interrupted the syscall, otherwise
it could lead to a situation where the caller may get a buffer with
no data returned.

This can be reproduced by issuing SG_IO ioctl()s in one thread while
constantly sending signals to it.

Fixes: 35dc248 [SCSI] sg: Fix user memory corruption when SG_IO is interrupted by a signal
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
[ luis: backported to 3.16: based on Johannes' backport to 3.14 ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 block/bio.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/block/bio.c b/block/bio.c
index 6467e6afdcd9..529e4195724e 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1110,9 +1110,12 @@ int bio_uncopy_user(struct bio *bio)
 			ret = __bio_copy_iov(bio, bmd->sgvecs, bmd->nr_sgvecs,
 					     bio_data_dir(bio) == READ,
 					     0, bmd->is_our_pages);
-		else if (bmd->is_our_pages)
-			bio_for_each_segment_all(bvec, bio, i)
-				__free_page(bvec->bv_page);
+		else {
+			ret = -EINTR;
+			if (bmd->is_our_pages)
+				bio_for_each_segment_all(bvec, bio, i)
+					__free_page(bvec->bv_page);
+		}
 	}
 	kfree(bmd);
 	bio_put(bio);

[toc] | [prev] | [next] | [standalone]

#1362639 — [PATCH 3.16.y-ckt 017/142] tracepoints: Do not trace when cpu is offline

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Steven Rostedt (Red Hat)" <rostedt@goodmis.org>

commit f37755490fe9bf76f6ba1d8c6591745d3574a6a6 upstream.

The tracepoint infrastructure uses RCU sched protection to enable and
disable tracepoints safely. There are some instances where tracepoints are
used in infrastructure code (like kfree()) that get called after a CPU is
going offline, and perhaps when it is coming back online but hasn't been
registered yet.

This can probuce the following warning:

 [ INFO: suspicious RCU usage. ]
 4.4.0-00006-g0fe53e8-dirty #34 Tainted: G S
 -------------------------------
 include/trace/events/kmem.h:141 suspicious rcu_dereference_check() usage!

 other info that might help us debug this:

 RCU used illegally from offline CPU!  rcu_scheduler_active = 1, debug_locks = 1
 no locks held by swapper/8/0.

 stack backtrace:
  CPU: 8 PID: 0 Comm: swapper/8 Tainted: G S              4.4.0-00006-g0fe53e8-dirty #34
  Call Trace:
  [c0000005b76c78d0] [c0000000008b9540] .dump_stack+0x98/0xd4 (unreliable)
  [c0000005b76c7950] [c00000000010c898] .lockdep_rcu_suspicious+0x108/0x170
  [c0000005b76c79e0] [c00000000029adc0] .kfree+0x390/0x440
  [c0000005b76c7a80] [c000000000055f74] .destroy_context+0x44/0x100
  [c0000005b76c7b00] [c0000000000934a0] .__mmdrop+0x60/0x150
  [c0000005b76c7b90] [c0000000000e3ff0] .idle_task_exit+0x130/0x140
  [c0000005b76c7c20] [c000000000075804] .pseries_mach_cpu_die+0x64/0x310
  [c0000005b76c7cd0] [c000000000043e7c] .cpu_die+0x3c/0x60
  [c0000005b76c7d40] [c0000000000188d8] .arch_cpu_idle_dead+0x28/0x40
  [c0000005b76c7db0] [c000000000101e6c] .cpu_startup_entry+0x50c/0x560
  [c0000005b76c7ed0] [c000000000043bd8] .start_secondary+0x328/0x360
  [c0000005b76c7f90] [c000000000008a6c] start_secondary_prolog+0x10/0x14

This warning is not a false positive either. RCU is not protecting code that
is being executed while the CPU is offline.

Instead of playing "whack-a-mole(TM)" and adding conditional statements to
the tracepoints we find that are used in this instance, simply add a
cpu_online() test to the tracepoint code where the tracepoint will be
ignored if the CPU is offline.

Use of raw_smp_processor_id() is fine, as there should never be a case where
the tracepoint code goes from running on a CPU that is online and suddenly
gets migrated to a CPU that is offline.

Link: http://lkml.kernel.org/r/1455387773-4245-1-git-send-email-kda@linux-powerpc.org

Reported-by: Denis Kirjanov <kda@linux-powerpc.org>
Fixes: 97e1c18e8d17b ("tracing: Kernel Tracepoints")
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
[ luis: backported to 3.16:
  - included linux/percpu.h as suggested by Steven for other stable kernels ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/tracepoint.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 2e2a5f7717e5..30e788953524 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -14,8 +14,11 @@
  * See the file COPYING for more details.
  */
 
+#include <linux/smp.h>
 #include <linux/errno.h>
 #include <linux/types.h>
+#include <linux/percpu.h>
+#include <linux/cpumask.h>
 #include <linux/rcupdate.h>
 #include <linux/static_key.h>
 
@@ -121,6 +124,9 @@ extern void syscall_unregfunc(void);
 		void *it_func;						\
 		void *__data;						\
 									\
+		if (!cpu_online(raw_smp_processor_id()))		\
+			return;						\
+									\
 		if (!(cond))						\
 			return;						\
 		prercu;							\

[toc] | [prev] | [next] | [standalone]

#1362640 — [PATCH 3.16.y-ckt 019/142] ALSA: seq: Fix double port list deletion

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 13d5e5d4725c64ec06040d636832e78453f477b7 upstream.

The commit [7f0973e973cd: ALSA: seq: Fix lockdep warnings due to
double mutex locks] split the management of two linked lists (source
and destination) into two individual calls for avoiding the AB/BA
deadlock.  However, this may leave the possible double deletion of one
of two lists when the counterpart is being deleted concurrently.
It ends up with a list corruption, as revealed by syzkaller fuzzer.

This patch fixes it by checking the list emptiness and skipping the
deletion and the following process.

BugLink: http://lkml.kernel.org/r/CACT4Y+bay9qsrz6dQu31EcGaH9XwfW7o3oBzSQUG9fMszoh=Sg@mail.gmail.com
Fixes: 7f0973e973cd ('ALSA: seq: Fix lockdep warnings due to 'double mutex locks)
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/core/seq/seq_ports.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 3c8630ff36af..9c1c8d50f593 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -538,19 +538,22 @@ static void delete_and_unsubscribe_port(struct snd_seq_client *client,
 					bool is_src, bool ack)
 {
 	struct snd_seq_port_subs_info *grp;
+	struct list_head *list;
+	bool empty;
 
 	grp = is_src ? &port->c_src : &port->c_dest;
+	list = is_src ? &subs->src_list : &subs->dest_list;
 	down_write(&grp->list_mutex);
 	write_lock_irq(&grp->list_lock);
-	if (is_src)
-		list_del(&subs->src_list);
-	else
-		list_del(&subs->dest_list);
+	empty = list_empty(list);
+	if (!empty)
+		list_del_init(list);
 	grp->exclusive = 0;
 	write_unlock_irq(&grp->list_lock);
 	up_write(&grp->list_mutex);
 
-	unsubscribe_port(client, port, grp, &subs->info, ack);
+	if (!empty)
+		unsubscribe_port(client, port, grp, &subs->info, ack);
 }
 
 /* connect two ports */

[toc] | [prev] | [next] | [standalone]

#1362641 — [PATCH 3.16.y-ckt 003/142] drm/i915/dsi: defend gpio table against out of bounds access

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jani Nikula <jani.nikula@intel.com>

commit 4db3a2448ec8902310acb78de39b6227a9a56ac8 upstream.

Do not blindly trust the VBT data used for indexing.

Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/cc32d40c2b47f2d2151811855ac2c3dabab1d57d.1454582914.git.jani.nikula@intel.com
(cherry picked from commit 5d2d0a12d3d08bf50434f0b5947bb73bac04b941)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/i915/intel_dsi_panel_vbt.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
index 21a0d348cedc..9db5dc8f4521 100644
--- a/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
+++ b/drivers/gpu/drm/i915/intel_dsi_panel_vbt.c
@@ -173,6 +173,11 @@ static u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, u8 *data)
 	/* pull up/down */
 	action = *data++;
 
+	if (gpio >= ARRAY_SIZE(gtable)) {
+		DRM_DEBUG_KMS("unknown gpio %u\n", gpio);
+		goto out;
+	}
+
 	function = gtable[gpio].function_reg;
 	pad = gtable[gpio].pad_reg;
 
@@ -190,6 +195,7 @@ static u8 *mipi_exec_gpio(struct intel_dsi *intel_dsi, u8 *data)
 	vlv_gpio_nc_write(dev_priv, pad, val);
 	mutex_unlock(&dev_priv->dpio_lock);
 
+out:
 	return data;
 }
 

[toc] | [prev] | [next] | [standalone]

#1362642 — [PATCH 3.16.y-ckt 002/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: CQ Tang <cq.tang@intel.com>

commit fda3bec12d0979aae3f02ee645913d66fbc8a26e upstream.

This is a 32-bit register. Apparently harmless on real hardware, but
causing justified warnings in simulation.

Signed-off-by: CQ Tang <cq.tang@intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/iommu/dmar.c                | 2 +-
 drivers/iommu/intel_irq_remapping.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 55f1515d54c9..04a5e5366ac0 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -1246,7 +1246,7 @@ void dmar_disable_qi(struct intel_iommu *iommu)
 
 	raw_spin_lock_irqsave(&iommu->register_lock, flags);
 
-	sts =  dmar_readq(iommu->reg + DMAR_GSTS_REG);
+	sts =  readl(iommu->reg + DMAR_GSTS_REG);
 	if (!(sts & DMA_GSTS_QIES))
 		goto end;
 
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index 9b174893f0f5..c21e80461d2d 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -504,7 +504,7 @@ static void iommu_disable_irq_remapping(struct intel_iommu *iommu)
 
 	raw_spin_lock_irqsave(&iommu->register_lock, flags);
 
-	sts = dmar_readq(iommu->reg + DMAR_GSTS_REG);
+	sts = readl(iommu->reg + DMAR_GSTS_REG);
 	if (!(sts & DMA_GSTS_IRES))
 		goto end;
 

[toc] | [prev] | [next] | [standalone]

#1362643 — [PATCH 3.16.y-ckt 018/142] tracing: Fix freak link error caused by branch tracer

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Arnd Bergmann <arnd@arndb.de>

commit b33c8ff4431a343561e2319f17c14286f2aa52e2 upstream.

In my randconfig tests, I came across a bug that involves several
components:

* gcc-4.9 through at least 5.3
* CONFIG_GCOV_PROFILE_ALL enabling -fprofile-arcs for all files
* CONFIG_PROFILE_ALL_BRANCHES overriding every if()
* The optimized implementation of do_div() that tries to
  replace a library call with an division by multiplication
* code in drivers/media/dvb-frontends/zl10353.c doing

        u32 adc_clock = 450560; /* 45.056 MHz */
        if (state->config.adc_clock)
                adc_clock = state->config.adc_clock;
        do_div(value, adc_clock);

In this case, gcc fails to determine whether the divisor
in do_div() is __builtin_constant_p(). In particular, it
concludes that __builtin_constant_p(adc_clock) is false, while
__builtin_constant_p(!!adc_clock) is true.

That in turn throws off the logic in do_div() that also uses
__builtin_constant_p(), and instead of picking either the
constant- optimized division, and the code in ilog2() that uses
__builtin_constant_p() to figure out whether it knows the answer at
compile time. The result is a link error from failing to find
multiple symbols that should never have been called based on
the __builtin_constant_p():

dvb-frontends/zl10353.c:138: undefined reference to `____ilog2_NaN'
dvb-frontends/zl10353.c:138: undefined reference to `__aeabi_uldivmod'
ERROR: "____ilog2_NaN" [drivers/media/dvb-frontends/zl10353.ko] undefined!
ERROR: "__aeabi_uldivmod" [drivers/media/dvb-frontends/zl10353.ko] undefined!

This patch avoids the problem by changing __trace_if() to check
whether the condition is known at compile-time to be nonzero, rather
than checking whether it is actually a constant.

I see this one link error in roughly one out of 1600 randconfig builds
on ARM, and the patch fixes all known instances.

Link: http://lkml.kernel.org/r/1455312410-1058841-1-git-send-email-arnd@arndb.de

Acked-by: Nicolas Pitre <nico@linaro.org>
Fixes: ab3c9c686e22 ("branch tracer, intel-iommu: fix build with CONFIG_BRANCH_TRACER=y")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/compiler.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index da293bf86575..8f6e7b2d667f 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -138,7 +138,7 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
  */
 #define if(cond, ...) __trace_if( (cond , ## __VA_ARGS__) )
 #define __trace_if(cond) \
-	if (__builtin_constant_p((cond)) ? !!(cond) :			\
+	if (__builtin_constant_p(!!(cond)) ? !!(cond) :			\
 	({								\
 		int ______r;						\
 		static struct ftrace_branch_data			\

[toc] | [prev] | [next] | [standalone]

#1362645 — [PATCH 3.16.y-ckt 029/142] xen/pciback: Save the number of MSI-X entries to be copied later.

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

commit d159457b84395927b5a52adb72f748dd089ad5e5 upstream.

Commit 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5 (xen/pciback: Save
xen_pci_op commands before processing it) broke enabling MSI-X because
it would never copy the resulting vectors into the response.  The
number of vectors requested was being overwritten by the return value
(typically zero for success).

Save the number of vectors before processing the op, so the correct
number of vectors are copied afterwards.

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/xen/xen-pciback/pciback_ops.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 1078e8d631c9..fb0221434f81 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -333,6 +333,9 @@ void xen_pcibk_do_op(struct work_struct *data)
 	struct xen_pcibk_dev_data *dev_data = NULL;
 	struct xen_pci_op *op = &pdev->op;
 	int test_intx = 0;
+#ifdef CONFIG_PCI_MSI
+	unsigned int nr = 0;
+#endif
 
 	*op = pdev->sh_info->op;
 	barrier();
@@ -361,6 +364,7 @@ void xen_pcibk_do_op(struct work_struct *data)
 			op->err = xen_pcibk_disable_msi(pdev, dev, op);
 			break;
 		case XEN_PCI_OP_enable_msix:
+			nr = op->value;
 			op->err = xen_pcibk_enable_msix(pdev, dev, op);
 			break;
 		case XEN_PCI_OP_disable_msix:
@@ -383,7 +387,7 @@ void xen_pcibk_do_op(struct work_struct *data)
 	if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
 		unsigned int i;
 
-		for (i = 0; i < op->value; i++)
+		for (i = 0; i < nr; i++)
 			pdev->sh_info->op.msix_entries[i].vector =
 				op->msix_entries[i].vector;
 	}

[toc] | [prev] | [next] | [standalone]

#1362648 — [PATCH 3.16.y-ckt 020/142] drm/radeon: use post-decrement in error handling

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Rasmus Villemoes <linux@rasmusvillemoes.dk>

commit bc3f5d8c4ca01555820617eb3b6c0857e4df710d upstream.

We need to use post-decrement to get the pci_map_page undone also for
i==0, and to avoid some very unpleasant behaviour if pci_map_page
failed already at i==0.

Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/radeon/radeon_ttm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 7555349e30da..c4675b9729c9 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -629,7 +629,7 @@ static int radeon_ttm_tt_populate(struct ttm_tt *ttm)
 						       0, PAGE_SIZE,
 						       PCI_DMA_BIDIRECTIONAL);
 		if (pci_dma_mapping_error(rdev->pdev, gtt->ttm.dma_address[i])) {
-			while (--i) {
+			while (i--) {
 				pci_unmap_page(rdev->pdev, gtt->ttm.dma_address[i],
 					       PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
 				gtt->ttm.dma_address[i] = 0;

[toc] | [prev] | [next] | [standalone]

#1362649 — [PATCH 3.16.y-ckt 007/142] cifs: fix erroneous return value

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Anton Protopopov <a.s.protopopov@gmail.com>

commit 4b550af519854421dfec9f7732cdddeb057134b2 upstream.

The setup_ntlmv2_rsp() function may return positive value ENOMEM instead
of -ENOMEM in case of kmalloc failure.

Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/cifs/cifsencrypt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
index 3299778391fd..0bd335a393f8 100644
--- a/fs/cifs/cifsencrypt.c
+++ b/fs/cifs/cifsencrypt.c
@@ -710,7 +710,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
 
 	ses->auth_key.response = kmalloc(baselen + tilen, GFP_KERNEL);
 	if (!ses->auth_key.response) {
-		rc = ENOMEM;
+		rc = -ENOMEM;
 		ses->auth_key.len = 0;
 		goto setup_ntlmv2_rsp_ret;
 	}

[toc] | [prev] | [next] | [standalone]

#1362650 — [PATCH 3.16.y-ckt 016/142] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

commit ee1cdcdae59563535485a5f56ee72c894ab7d7ad upstream.

The commit 2895b2cad6e7 ("dmaengine: dw: fix cyclic transfer callbacks")
re-enabled BLOCK interrupts with regard to make cyclic transfers work. However,
this change becomes a regression for non-cyclic transfers as interrupt counters
under stress test had been grown enormously (approximately per 4-5 bytes in the
UART loop back test).

Taking into consideration above enable BLOCK interrupts if and only if channel
is programmed to perform cyclic transfer.

Fixes: 2895b2cad6e7 ("dmaengine: dw: fix cyclic transfer callbacks")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Mans Rullgard <mans@mansr.com>
Tested-by: Mans Rullgard <mans@mansr.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/dma/dw/core.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c
index e968366e6cdd..43c8de0f00f4 100644
--- a/drivers/dma/dw/core.c
+++ b/drivers/dma/dw/core.c
@@ -169,7 +169,6 @@ static void dwc_initialize(struct dw_dma_chan *dwc)
 
 	/* Enable interrupts */
 	channel_set_bit(dw, MASK.XFER, dwc->mask);
-	channel_set_bit(dw, MASK.BLOCK, dwc->mask);
 	channel_set_bit(dw, MASK.ERROR, dwc->mask);
 
 	dwc->initialized = true;
@@ -596,6 +595,9 @@ static void dwc_handle_cyclic(struct dw_dma *dw, struct dw_dma_chan *dwc,
 
 		spin_unlock_irqrestore(&dwc->lock, flags);
 	}
+
+	/* Re-enable interrupts */
+	channel_set_bit(dw, MASK.BLOCK, dwc->mask);
 }
 
 /* ------------------------------------------------------------------------- */
@@ -626,11 +628,8 @@ static void dw_dma_tasklet(unsigned long data)
 			dwc_scan_descriptors(dw, dwc);
 	}
 
-	/*
-	 * Re-enable interrupts.
-	 */
+	/* Re-enable interrupts */
 	channel_set_bit(dw, MASK.XFER, dw->all_chan_mask);
-	channel_set_bit(dw, MASK.BLOCK, dw->all_chan_mask);
 	channel_set_bit(dw, MASK.ERROR, dw->all_chan_mask);
 }
 
@@ -1216,6 +1215,7 @@ static void dwc_free_chan_resources(struct dma_chan *chan)
 int dw_dma_cyclic_start(struct dma_chan *chan)
 {
 	struct dw_dma_chan	*dwc = to_dw_dma_chan(chan);
+	struct dw_dma		*dw = to_dw_dma(chan->device);
 	unsigned long		flags;
 
 	if (!test_bit(DW_DMA_IS_CYCLIC, &dwc->flags)) {
@@ -1224,7 +1224,12 @@ int dw_dma_cyclic_start(struct dma_chan *chan)
 	}
 
 	spin_lock_irqsave(&dwc->lock, flags);
+
+	/* Enable interrupts to perform cyclic transfer */
+	channel_set_bit(dw, MASK.BLOCK, dwc->mask);
+
 	dwc_dostart(dwc, dwc->cdesc->desc[0]);
+
 	spin_unlock_irqrestore(&dwc->lock, flags);
 
 	return 0;

[toc] | [prev] | [next] | [standalone]

#1362651 — [PATCH 3.16.y-ckt 011/142] ext4: fix potential integer overflow

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Insu Yun <wuninsu@gmail.com>

commit 46901760b46064964b41015d00c140c83aa05bcf upstream.

Since sizeof(ext_new_group_data) > sizeof(ext_new_flex_group_data),
integer overflow could be happened.
Therefore, need to fix integer overflow sanitization.

Signed-off-by: Insu Yun <wuninsu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/ext4/resize.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index dd4f37e2f18f..d534e589949b 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -186,7 +186,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
 	if (flex_gd == NULL)
 		goto out3;
 
-	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data))
+	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data))
 		goto out2;
 	flex_gd->count = flexbg_size;
 

[toc] | [prev] | [next] | [standalone]

#1362652 — [PATCH 3.16.y-ckt 010/142] scsi: fix soft lockup in scsi_remove_target() on module removal

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 90a88d6ef88edcfc4f644dddc7eef4ea41bccf8b upstream.

This softlockup is currently happening:

[  444.088002] NMI watchdog: BUG: soft lockup - CPU#1 stuck for 22s! [kworker/1:1:29]
[  444.088002] Modules linked in: lpfc(-) qla2x00tgt(O) qla2xxx_scst(O) scst_vdisk(O) scsi_transport_fc libcrc32c scst(O) dlm configfs nfsd lockd grace nfs_acl auth_rpcgss sunrpc ed
d snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device dm_mod iTCO_wdt snd_hda_codec_realtek snd_hda_codec_generic gpio_ich iTCO_vendor_support ppdev snd_hda_intel snd_hda_codec snd_hda
_core snd_hwdep tg3 snd_pcm snd_timer libphy lpc_ich parport_pc ptp acpi_cpufreq snd pps_core fjes parport i2c_i801 ehci_pci tpm_tis tpm sr_mod cdrom soundcore floppy hwmon sg 8250_
fintek pcspkr i915 drm_kms_helper uhci_hcd ehci_hcd drm fb_sys_fops sysimgblt sysfillrect syscopyarea i2c_algo_bit usbcore button video usb_common fan ata_generic ata_piix libata th
ermal
[  444.088002] CPU: 1 PID: 29 Comm: kworker/1:1 Tainted: G           O    4.4.0-rc5-2.g1e923a3-default #1
[  444.088002] Hardware name: FUJITSU SIEMENS ESPRIMO E           /D2164-A1, BIOS 5.00 R1.10.2164.A1               05/08/2006
[  444.088002] Workqueue: fc_wq_4 fc_rport_final_delete [scsi_transport_fc]
[  444.088002] task: f6266ec0 ti: f6268000 task.ti: f6268000
[  444.088002] EIP: 0060:[<c07e7044>] EFLAGS: 00000286 CPU: 1
[  444.088002] EIP is at _raw_spin_unlock_irqrestore+0x14/0x20
[  444.088002] EAX: 00000286 EBX: f20d3800 ECX: 00000002 EDX: 00000286
[  444.088002] ESI: f50ba800 EDI: f2146848 EBP: f6269ec8 ESP: f6269ec8
[  444.088002]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[  444.088002] CR0: 8005003b CR2: 08f96600 CR3: 363ae000 CR4: 000006d0
[  444.088002] Stack:
[  444.088002]  f6269eec c066b0f7 00000286 f2146848 f50ba808 f50ba800 f50ba800 f2146a90
[  444.088002]  f2146848 f6269f08 f8f0a4ed f3141000 f2146800 f2146a90 f619fa00 00000040
[  444.088002]  f6269f40 c026cb25 00000001 166c6392 00000061 f6757140 f6136340 00000004
[  444.088002] Call Trace:
[  444.088002]  [<c066b0f7>] scsi_remove_target+0x167/0x1c0
[  444.088002]  [<f8f0a4ed>] fc_rport_final_delete+0x9d/0x1e0 [scsi_transport_fc]
[  444.088002]  [<c026cb25>] process_one_work+0x155/0x3e0
[  444.088002]  [<c026cde7>] worker_thread+0x37/0x490
[  444.088002]  [<c027214b>] kthread+0x9b/0xb0
[  444.088002]  [<c07e72c1>] ret_from_kernel_thread+0x21/0x40

What appears to be happening is that something has pinned the target
so it can't go into STARGET_DEL via final release and the loop in
scsi_remove_target spins endlessly until that happens.

The fix for this soft lockup is to not keep looping over a device that
we've called remove on but which hasn't gone into DEL state.  This
patch will retain a simplistic memory of the last target and not keep
looping over it.

Reported-by: Sebastian Herbszt <herbszt@gmx.de>
Tested-by: Sebastian Herbszt <herbszt@gmx.de>
Fixes: 40998193560dab6c3ce8d25f4fa58a23e252ef38
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/scsi/scsi_sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 7e78015d6ab7..6c26b9743c52 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1148,16 +1148,18 @@ static void __scsi_remove_target(struct scsi_target *starget)
 void scsi_remove_target(struct device *dev)
 {
 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
-	struct scsi_target *starget;
+	struct scsi_target *starget, *last_target = NULL;
 	unsigned long flags;
 
 restart:
 	spin_lock_irqsave(shost->host_lock, flags);
 	list_for_each_entry(starget, &shost->__targets, siblings) {
-		if (starget->state == STARGET_DEL)
+		if (starget->state == STARGET_DEL ||
+		    starget == last_target)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
 			kref_get(&starget->reap_ref);
+			last_target = starget;
 			spin_unlock_irqrestore(shost->host_lock, flags);
 			__scsi_remove_target(starget);
 			scsi_target_reap(starget);

[toc] | [prev] | [next] | [standalone]

#1362654 — [PATCH 3.16.y-ckt 015/142] ALSA: seq: Fix leak of pool buffer at concurrent writes

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit d99a36f4728fcbcc501b78447f625bdcce15b842 upstream.

When multiple concurrent writes happen on the ALSA sequencer device
right after the open, it may try to allocate vmalloc buffer for each
write and leak some of them.  It's because the presence check and the
assignment of the buffer is done outside the spinlock for the pool.

The fix is to move the check and the assignment into the spinlock.

(The current implementation is suboptimal, as there can be multiple
 unnecessary vmallocs because the allocation is done before the check
 in the spinlock.  But the pool size is already checked beforehand, so
 this isn't a big problem; that is, the only possible path is the
 multiple writes before any pool assignment, and practically seen, the
 current coverage should be "good enough".)

The issue was triggered by syzkaller fuzzer.

BugLink: http://lkml.kernel.org/r/CACT4Y+bSzazpXNvtAr=WXaL8hptqjHwqEyFA+VN2AWEx=aurkg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/core/seq/seq_memory.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c
index 07002abdd9c7..04ef9b5351f9 100644
--- a/sound/core/seq/seq_memory.c
+++ b/sound/core/seq/seq_memory.c
@@ -383,15 +383,20 @@ int snd_seq_pool_init(struct snd_seq_pool *pool)
 
 	if (snd_BUG_ON(!pool))
 		return -EINVAL;
-	if (pool->ptr)			/* should be atomic? */
-		return 0;
 
-	pool->ptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
-	if (!pool->ptr)
+	cellptr = vmalloc(sizeof(struct snd_seq_event_cell) * pool->size);
+	if (!cellptr)
 		return -ENOMEM;
 
 	/* add new cells to the free cell list */
 	spin_lock_irqsave(&pool->lock, flags);
+	if (pool->ptr) {
+		spin_unlock_irqrestore(&pool->lock, flags);
+		vfree(cellptr);
+		return 0;
+	}
+
+	pool->ptr = cellptr;
 	pool->free = NULL;
 
 	for (cell = 0; cell < pool->size; cell++) {

[toc] | [prev] | [standalone]

Page 7 of 7 — ← Prev page 1 2 3 4 5 6 [7]

Back to top | Article view | linux.kernel

csiph-web