Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1362479 > unrolled thread

[3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review

Back to article view | Back to linux.kernel

Contents

  [3.16.y-ckt stable] Linux 3.16.7-ckt26 stable review Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 137/142] efi: Do variable name validation tests in utf8 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 138/142] efi: Make our variable validation list include the guid Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 094/142] ALSA: hdspm: Fix wrong boolean ctl value accesses Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 100/142] USB: serial: option: add support for Quectel UC20 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 132/142] AIO: properly check iovec sizes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 009/142] s390/dasd: fix refcount for PAV reassignment Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 135/142] lib/ucs2_string: Add ucs2 -> utf8 helper functions Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 142/142] tracing: Fix check for cpu online when event is disabled Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 065/142] ipv4: fix memory leaks in ip_cmsg_send() callers Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 023/142] ext4: fix crashes in dioread_nolock mode Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 022/142] ext4: fix bh->b_state corruption Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 027/142] nfs: fix nfs_size_to_loff_t Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 098/142] USB: cp210x: Add ID for Parrot NMEA GPS Flight Recorder Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 136/142] efi: Use ucs2_as_utf8 in efivarfs instead of open coding a bad version Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 067/142] pppoe: fix reference counting in PPPoE proxy Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 128/142] net: moxa: fix an error code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 095/142] ALSA: hdspm: Fix zero-division Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 066/142] qmi_wwan: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 063/142] net:Add sysctl_max_skb_frags Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 001/142] Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 139/142] efi: Make efivarfs entries immutable by default Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 024/142] kernel/resource.c: fix muxed resource handling in __request_region() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 026/142] crypto: {blk,giv}cipher: Set has_setkey Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 11:50 +0100
    [PATCH 3.16.y-ckt 115/142] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 084/142] libata: Align ata_device's id on a cacheline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 107/142] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp' Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 124/142] tcp: convert cached rtt from usec to jiffies when feeding initial rto Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 125/142] net/mlx4_core: Allow resetting VF admin mac to zero Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 120/142] Revert "drm/radeon: call hpd_irq_event on resume" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 114/142] mac80211: minstrel_ht: set default tx aggregation timeout to 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 119/142] target: Drop incorrect ABORT_TASK put for completed commands Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 108/142] ubi: Fix out of bounds write in volume update code Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 118/142] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 105/142] PM / sleep / x86: Fix crash on graph trace through x86 suspend Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 122/142] KVM: VMX: disable PEBS before a guest entry Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 109/142] gpio: rcar: Add Runtime PM handling for interrupts Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 130/142] ext4: iterate over buffer heads correctly in move_extent_per_page() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 101/142] ALSA: seq: oss: Don't drain at closing a client Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 092/142] Fix cifs_uniqueid_to_ino_t() function for s390x Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 110/142] IB/core: Use GRH when the path hop-limit > 0 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 104/142] drm/radeon/pm: update current crtc info after setting the powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 102/142] drm/ast: Fix incorrect register check for DRAM width Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 103/142] USB: qcserial: add Sierra Wireless EM74xx device ID Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 129/142] cdc_ncm: do not call usbnet_link_change from cdc_ncm_bind Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 106/142] ALSA: hda - Fix mic issues on Acer Aspire E1-472 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 127/142] ipv6: re-enable fragment header matching in ipv6_find_hdr Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 126/142] mld, igmp: Fix reserved tailroom calculation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 112/142] cfg80211/wext: fix message ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 116/142] ASoC: wm8958: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 090/142] cifs: fix out-of-bounds access in lease parsing Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 123/142] Revert "drm/radeon/pm: adjust display configuration after powerstate" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 121/142] KVM: PPC: Book3S HV: Sanitize special-purpose register values on guest exit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 113/142] mac80211: fix use of uninitialised values in RX aggregation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 117/142] ASoC: wm8994: Fix enum ctl accesses in a wrong type Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 111/142] wext: fix message delay/ordering Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 099/142] USB: serial: option: add support for Telit LE922 PID 0x1045 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:00 +0100
    [PATCH 3.16.y-ckt 071/142] target: Fix LUN_RESET active TMR descriptor handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 070/142] sctp: Fix port hash table size computation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 079/142] usb: chipidea: otg: change workqueue ci_otg as freezable Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 077/142] libata: fix HDIO_GET_32BIT ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 072/142] target: Fix LUN_RESET active I/O handling for ACK_KREF Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 083/142] iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 082/142] Fix directory hardlinks from deleted directories Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 081/142] jffs2: Fix page lock / f->sem deadlock Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 087/142] ALSA: rawmidi: Fix ioctls X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 089/142] ALSA: timer: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 091/142] CIFS: Fix SMB2+ interim response processing for read requests Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 073/142] target: Fix TAS handling for multi-session se_node_acls Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 069/142] rtnl: RTM_GETNETCONF: fix wrong return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 085/142] vfio: fix ioctl error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 080/142] Revert "jffs2: Fix lock acquisition order bug in jffs2_write_begin" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 068/142] route: check and remove route cache when we get route Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 086/142] ALSA: ctl: Fix ioctls for X32 ABI Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 025/142] x86/entry/compat: Add missing CLAC to entry_INT80_32 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 076/142] Revert "drm/radeon: hold reference to fences in radeon_sa_bo_new" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 078/142] [media] adv7604: fix tx 5v detect regression Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 074/142] target: Fix remote-port TMR ABORT + se_cmd fabric stop Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 075/142] target: Fix race with SCF_SEND_DELAYED_TAS handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 088/142] ALSA: timer: Fix broken compat timer user status ioctl Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:10 +0100
    [PATCH 3.16.y-ckt 064/142] tg3: Fix for tg3 transmit queue 0 timed out when too many gso_segs Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 046/142] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 054/142] net/mlx4_en: Count HW buffer overrun only once Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 045/142] KVM: x86: MMU: fix ubsan index-out-of-range warning Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 055/142] net/mlx4_en: Choose time-stamping shift value according to HW frequency Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 060/142] tcp: fix NULL deref in tcp_v4_send_ack() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 040/142] sunrpc/cache: fix off-by-one in qword_get() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 059/142] net: dp83640: Fix tx timestamp overflow handling. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 033/142] USB: option: add support for SIM7100E Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 049/142] ARM: dts: kirkwood: use unique machine name for ds112 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 058/142] af_iucv: Validate socket address length in iucv_sock_bind() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 056/142] net/mlx4_en: Avoid changing dev->features directly in run-time Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 044/142] ALSA: hda - Fixing background noise on Dell Inspiron 3162 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 050/142] bonding: Fix ARP monitor validation Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 032/142] NFSv4: Fix a dentry leak on alias use Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 057/142] unix_diag: fix incorrect sign extension in unix_lookup_by_ino Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 035/142] USB: option: add "4G LTE usb-modem U901" Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
      Re: [PATCH 3.16.y-ckt 062/142] net/ipv6: add sysctl option  accept_ra_min_hop_limit Luis Henriques <luis.henriques@canonical.com> - 2016-03-24 11:20 +0100
    [PATCH 3.16.y-ckt 034/142] USB: cp210x: add IDs for GE B650V3 and B850V3 boards Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 048/142] do_last(): don't let a bogus return value from ->open() et.al. to confuse us Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 047/142] hpfs: don't truncate the file when delete fails Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 052/142] af_unix: Guard against other == sk in unix_dgram_sendmsg Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 028/142] xen/pciback: Check PF instead of VF for PCI_COMMAND_MEMORY Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 038/142] can: ems_usb: Fix possible tx overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 043/142] libceph: don't bail early from try_read() when skipping a message Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 042/142] tracing: Fix showing function event in available_events Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 051/142] af_unix: Don't set err in unix_stream_read_generic unless there was an error Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 036/142] hwmon: (ads1015) Handle negative conversion values correctly Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 053/142] net: phy: bcm7xxx: Fix shadow mode 2 disabling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 041/142] KVM: async_pf: do not warn on page allocation failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 061/142] ipv6/udp: use sticky pktinfo egress ifindex on connect() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 039/142] drm/radeon/pm: adjust display configuration after powerstate Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 021/142] drm/qxl: use kmalloc_array to alloc reloc_info in qxl_process_single_command Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 037/142] drivers: android: correct the size of struct binder_uintptr_t for BC_DEAD_BINDER_DONE Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:20 +0100
    [PATCH 3.16.y-ckt 014/142] ALSA: seq: Drop superfluous error/debug messages after malloc failures Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 006/142] drm/i915: fix error path in intel_setup_gmbus() Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 030/142] xen/pcifront: Fix mysterious crashes when NUMA locality information was extracted. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 004/142] drm/i915/dsi: don't pass arbitrary data to sideband Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 005/142] powerpc: Fix dedotify for binutils >= 2.26 Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 031/142] usb: dwc3: Fix assignment of EP transfer resources Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 012/142] ext4: don't read blocks from disk after extents being swapped Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 013/142] bio: return EINTR if copying to user space got interrupted Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 017/142] tracepoints: Do not trace when cpu is offline Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 019/142] ALSA: seq: Fix double port list deletion Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 003/142] drm/i915/dsi: defend gpio table against out of bounds access Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 002/142] iommu/vt-d: Fix 64-bit accesses to 32-bit DMAR_GSTS_REG Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 018/142] tracing: Fix freak link error caused by branch tracer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 029/142] xen/pciback: Save the number of MSI-X entries to be copied later. Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 020/142] drm/radeon: use post-decrement in error handling Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 007/142] cifs: fix erroneous return value Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 016/142] dmaengine: dw: disable BLOCK IRQs for non-cyclic xfer Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 011/142] ext4: fix potential integer overflow Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 010/142] scsi: fix soft lockup in scsi_remove_target() on module removal Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100
    [PATCH 3.16.y-ckt 015/142] ALSA: seq: Fix leak of pool buffer at concurrent writes Luis Henriques <luis.henriques@canonical.com> - 2016-03-22 12:30 +0100

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

#1362501 — [PATCH 3.16.y-ckt 001/142] Revert "firmware: dmi_scan: Fix UUID endianness for SMBIOS >= 2.6"

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Luis Henriques <luis.henriques@canonical.com>

This reverts commit 0f7b4f7914e450b1bcffdbd26bbf35ee304cbfea, which was
commit ff4319dc7cd58c92b389960e375038335d157a60 upstream.

This commit introduced a regression in this kernel.  Commit 95be58df74a5
("firmware: dmi_scan: Use full dmi version for SMBIOS3") added support for
SMBIOS3.  However, this was not backport to this kernel version, and thus
commit ff4319dc7cd5 should have not been applied.

BugLink: https://bugs.launchpad.net/bugs/1551419
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/firmware/dmi_scan.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index 48142b88e672..35286fe52823 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -493,7 +493,6 @@ static int __init dmi_present(const u8 *buf)
 			dmi_ver = smbios_ver;
 		else
 			dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
-		dmi_ver <<= 8;
 		dmi_num = (buf[13] << 8) | buf[12];
 		dmi_len = (buf[7] << 8) | buf[6];
 		dmi_base = (buf[11] << 24) | (buf[10] << 16) |
@@ -502,10 +501,10 @@ static int __init dmi_present(const u8 *buf)
 		if (dmi_walk_early(dmi_decode) == 0) {
 			if (smbios_ver) {
 				pr_info("SMBIOS %d.%d present.\n",
-					dmi_ver >> 16, (dmi_ver >> 8) & 0xFF);
+				       dmi_ver >> 8, dmi_ver & 0xFF);
 			} else {
 				pr_info("Legacy DMI %d.%d present.\n",
-					dmi_ver >> 16, (dmi_ver >> 8) & 0xFF);
+				       dmi_ver >> 8, dmi_ver & 0xFF);
 			}
 			dmi_format_ids(dmi_ids_string, sizeof(dmi_ids_string));
 			printk(KERN_DEBUG "DMI: %s\n", dmi_ids_string);

[toc] | [prev] | [next] | [standalone]

#1362503 — [PATCH 3.16.y-ckt 139/142] efi: Make efivarfs entries immutable by default

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Peter Jones <pjones@redhat.com>

commit ed8b0de5a33d2a2557dce7f9429dca8cb5bc5879 upstream.

"rm -rf" is bricking some peoples' laptops because of variables being
used to store non-reinitializable firmware driver data that's required
to POST the hardware.

These are 100% bugs, and they need to be fixed, but in the mean time it
shouldn't be easy to *accidentally* brick machines.

We have to have delete working, and picking which variables do and don't
work for deletion is quite intractable, so instead make everything
immutable by default (except for a whitelist), and make tools that
aren't quite so broad-spectrum unset the immutable flag.

Signed-off-by: Peter Jones <pjones@redhat.com>
Tested-by: Lee, Chun-Yi <jlee@suse.com>
Acked-by: Matthew Garrett <mjg59@coreos.com>
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
[ luis: backported to 3.16:
  - use mutex_lock/unlock() instead of inode_lock/unlock()
  - use root->d_inode instead of d_inode()  ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 Documentation/filesystems/efivarfs.txt         |  7 +++
 drivers/firmware/efi/vars.c                    | 87 +++++++++++++++++++-------
 fs/efivarfs/file.c                             | 70 +++++++++++++++++++++
 fs/efivarfs/inode.c                            | 30 +++++----
 fs/efivarfs/internal.h                         |  3 +-
 fs/efivarfs/super.c                            |  9 ++-
 include/linux/efi.h                            |  2 +
 tools/testing/selftests/efivarfs/efivarfs.sh   | 19 +++++-
 tools/testing/selftests/efivarfs/open-unlink.c | 72 ++++++++++++++++++++-
 9 files changed, 258 insertions(+), 41 deletions(-)

diff --git a/Documentation/filesystems/efivarfs.txt b/Documentation/filesystems/efivarfs.txt
index c477af086e65..686a64bba775 100644
--- a/Documentation/filesystems/efivarfs.txt
+++ b/Documentation/filesystems/efivarfs.txt
@@ -14,3 +14,10 @@ filesystem.
 efivarfs is typically mounted like this,
 
 	mount -t efivarfs none /sys/firmware/efi/efivars
+
+Due to the presence of numerous firmware bugs where removing non-standard
+UEFI variables causes the system firmware to fail to POST, efivarfs
+files that are not well-known standardized variables are created
+as immutable files.  This doesn't prevent removal - "chattr -i" will work -
+but it does prevent this kind of failure from being accomplished
+accidentally.
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c
index ce0ead43f7e1..ab68e57172aa 100644
--- a/drivers/firmware/efi/vars.c
+++ b/drivers/firmware/efi/vars.c
@@ -172,10 +172,12 @@ struct variable_validate {
 };
 
 /*
- * This is the list of variables we need to validate.
+ * This is the list of variables we need to validate, as well as the
+ * whitelist for what we think is safe not to default to immutable.
  *
  * If it has a validate() method that's not NULL, it'll go into the
- * validation routine.  If not, it is assumed valid.
+ * validation routine.  If not, it is assumed valid, but still used for
+ * whitelisting.
  *
  * Note that it's sorted by {vendor,name}, but globbed names must come after
  * any other name with the same prefix.
@@ -193,11 +195,37 @@ static const struct variable_validate variable_validate[] = {
 	{ EFI_GLOBAL_VARIABLE_GUID, "ErrOut", validate_device_path },
 	{ EFI_GLOBAL_VARIABLE_GUID, "ErrOutDev", validate_device_path },
 	{ EFI_GLOBAL_VARIABLE_GUID, "Lang", validate_ascii_string },
+	{ EFI_GLOBAL_VARIABLE_GUID, "OsIndications", NULL },
 	{ EFI_GLOBAL_VARIABLE_GUID, "PlatformLang", validate_ascii_string },
 	{ EFI_GLOBAL_VARIABLE_GUID, "Timeout", validate_uint16 },
 	{ NULL_GUID, "", NULL },
 };
 
+static bool
+variable_matches(const char *var_name, size_t len, const char *match_name,
+		 int *match)
+{
+	for (*match = 0; ; (*match)++) {
+		char c = match_name[*match];
+		char u = var_name[*match];
+
+		/* Wildcard in the matching name means we've matched */
+		if (c == '*')
+			return true;
+
+		/* Case sensitive match */
+		if (!c && *match == len)
+			return true;
+
+		if (c != u)
+			return false;
+
+		if (!c)
+			return true;
+	}
+	return true;
+}
+
 bool
 efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
 		unsigned long data_size)
@@ -221,35 +249,48 @@ efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
 		if (efi_guidcmp(vendor, variable_validate[i].vendor))
 			continue;
 
-		for (match = 0; ; match++) {
-			char c = name[match];
-			char u = utf8_name[match];
-
-			/* Wildcard in the matching name means we've matched */
-			if (c == '*') {
-				kfree(utf8_name);
-				return variable_validate[i].validate(var_name,
-							match, data, data_size);
-			}
-
-			/* Case sensitive match */
-			if (c != u)
+		if (variable_matches(utf8_name, utf8_size+1, name, &match)) {
+			if (variable_validate[i].validate == NULL)
 				break;
-
-			/* Reached the end of the string while matching */
-			if (!c) {
-				kfree(utf8_name);
-				return variable_validate[i].validate(var_name,
-							match, data, data_size);
-			}
+			kfree(utf8_name);
+			return variable_validate[i].validate(var_name, match,
+							     data, data_size);
 		}
 	}
-
 	kfree(utf8_name);
 	return true;
 }
 EXPORT_SYMBOL_GPL(efivar_validate);
 
+bool
+efivar_variable_is_removable(efi_guid_t vendor, const char *var_name,
+			     size_t len)
+{
+	int i;
+	bool found = false;
+	int match = 0;
+
+	/*
+	 * Check if our variable is in the validated variables list
+	 */
+	for (i = 0; variable_validate[i].name[0] != '\0'; i++) {
+		if (efi_guidcmp(variable_validate[i].vendor, vendor))
+			continue;
+
+		if (variable_matches(var_name, len,
+				     variable_validate[i].name, &match)) {
+			found = true;
+			break;
+		}
+	}
+
+	/*
+	 * If it's in our list, it is removable.
+	 */
+	return found;
+}
+EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
+
 static efi_status_t
 check_var_size(u32 attributes, unsigned long size)
 {
diff --git a/fs/efivarfs/file.c b/fs/efivarfs/file.c
index cdb2971192a5..2a36e916d239 100644
--- a/fs/efivarfs/file.c
+++ b/fs/efivarfs/file.c
@@ -10,6 +10,7 @@
 #include <linux/efi.h>
 #include <linux/fs.h>
 #include <linux/slab.h>
+#include <linux/mount.h>
 
 #include "internal.h"
 
@@ -103,9 +104,78 @@ out_free:
 	return size;
 }
 
+static int
+efivarfs_ioc_getxflags(struct file *file, void __user *arg)
+{
+	struct inode *inode = file->f_mapping->host;
+	unsigned int i_flags;
+	unsigned int flags = 0;
+
+	i_flags = inode->i_flags;
+	if (i_flags & S_IMMUTABLE)
+		flags |= FS_IMMUTABLE_FL;
+
+	if (copy_to_user(arg, &flags, sizeof(flags)))
+		return -EFAULT;
+	return 0;
+}
+
+static int
+efivarfs_ioc_setxflags(struct file *file, void __user *arg)
+{
+	struct inode *inode = file->f_mapping->host;
+	unsigned int flags;
+	unsigned int i_flags = 0;
+	int error;
+
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
+	if (copy_from_user(&flags, arg, sizeof(flags)))
+		return -EFAULT;
+
+	if (flags & ~FS_IMMUTABLE_FL)
+		return -EOPNOTSUPP;
+
+	if (!capable(CAP_LINUX_IMMUTABLE))
+		return -EPERM;
+
+	if (flags & FS_IMMUTABLE_FL)
+		i_flags |= S_IMMUTABLE;
+
+
+	error = mnt_want_write_file(file);
+	if (error)
+		return error;
+
+	mutex_lock(&inode->i_mutex);
+	inode_set_flags(inode, i_flags, S_IMMUTABLE);
+	mutex_unlock(&inode->i_mutex);
+
+	mnt_drop_write_file(file);
+
+	return 0;
+}
+
+long
+efivarfs_file_ioctl(struct file *file, unsigned int cmd, unsigned long p)
+{
+	void __user *arg = (void __user *)p;
+
+	switch (cmd) {
+	case FS_IOC_GETFLAGS:
+		return efivarfs_ioc_getxflags(file, arg);
+	case FS_IOC_SETFLAGS:
+		return efivarfs_ioc_setxflags(file, arg);
+	}
+
+	return -ENOTTY;
+}
+
 const struct file_operations efivarfs_file_operations = {
 	.open	= simple_open,
 	.read	= efivarfs_file_read,
 	.write	= efivarfs_file_write,
 	.llseek	= no_llseek,
+	.unlocked_ioctl = efivarfs_file_ioctl,
 };
diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
index 07ab49745e31..7e7318f10575 100644
--- a/fs/efivarfs/inode.c
+++ b/fs/efivarfs/inode.c
@@ -15,7 +15,8 @@
 #include "internal.h"
 
 struct inode *efivarfs_get_inode(struct super_block *sb,
-				const struct inode *dir, int mode, dev_t dev)
+				const struct inode *dir, int mode,
+				dev_t dev, bool is_removable)
 {
 	struct inode *inode = new_inode(sb);
 
@@ -23,6 +24,7 @@ struct inode *efivarfs_get_inode(struct super_block *sb,
 		inode->i_ino = get_next_ino();
 		inode->i_mode = mode;
 		inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+		inode->i_flags = is_removable ? 0 : S_IMMUTABLE;
 		switch (mode & S_IFMT) {
 		case S_IFREG:
 			inode->i_fop = &efivarfs_file_operations;
@@ -102,22 +104,17 @@ static void efivarfs_hex_to_guid(const char *str, efi_guid_t *guid)
 static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 			  umode_t mode, bool excl)
 {
-	struct inode *inode;
+	struct inode *inode = NULL;
 	struct efivar_entry *var;
 	int namelen, i = 0, err = 0;
+	bool is_removable = false;
 
 	if (!efivarfs_valid_name(dentry->d_name.name, dentry->d_name.len))
 		return -EINVAL;
 
-	inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0);
-	if (!inode)
-		return -ENOMEM;
-
 	var = kzalloc(sizeof(struct efivar_entry), GFP_KERNEL);
-	if (!var) {
-		err = -ENOMEM;
-		goto out;
-	}
+	if (!var)
+		return -ENOMEM;
 
 	/* length of the variable name itself: remove GUID and separator */
 	namelen = dentry->d_name.len - EFI_VARIABLE_GUID_LEN - 1;
@@ -125,6 +122,16 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 	efivarfs_hex_to_guid(dentry->d_name.name + namelen + 1,
 			&var->var.VendorGuid);
 
+	if (efivar_variable_is_removable(var->var.VendorGuid,
+					 dentry->d_name.name, namelen))
+		is_removable = true;
+
+	inode = efivarfs_get_inode(dir->i_sb, dir, mode, 0, is_removable);
+	if (!inode) {
+		err = -ENOMEM;
+		goto out;
+	}
+
 	for (i = 0; i < namelen; i++)
 		var->var.VariableName[i] = dentry->d_name.name[i];
 
@@ -138,7 +145,8 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
 out:
 	if (err) {
 		kfree(var);
-		iput(inode);
+		if (inode)
+			iput(inode);
 	}
 	return err;
 }
diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h
index b5ff16addb7c..b4505188e799 100644
--- a/fs/efivarfs/internal.h
+++ b/fs/efivarfs/internal.h
@@ -15,7 +15,8 @@ extern const struct file_operations efivarfs_file_operations;
 extern const struct inode_operations efivarfs_dir_inode_operations;
 extern bool efivarfs_valid_name(const char *str, int len);
 extern struct inode *efivarfs_get_inode(struct super_block *sb,
-			const struct inode *dir, int mode, dev_t dev);
+			const struct inode *dir, int mode, dev_t dev,
+			bool is_removable);
 
 extern struct list_head efivarfs_list;
 
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 3a7778d1bddc..b57db0c6c2af 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -120,6 +120,7 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 	char *name;
 	int len;
 	int err = -ENOMEM;
+	bool is_removable = false;
 
 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 	if (!entry)
@@ -137,13 +138,17 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
 
 	ucs2_as_utf8(name, entry->var.VariableName, len);
 
+	if (efivar_variable_is_removable(entry->var.VendorGuid, name, len))
+		is_removable = true;
+
 	name[len] = '-';
 
 	efi_guid_unparse(&entry->var.VendorGuid, name + len + 1);
 
 	name[len + EFI_VARIABLE_GUID_LEN+1] = '\0';
 
-	inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0);
+	inode = efivarfs_get_inode(sb, root->d_inode, S_IFREG | 0644, 0,
+				   is_removable);
 	if (!inode)
 		goto fail_name;
 
@@ -199,7 +204,7 @@ static int efivarfs_fill_super(struct super_block *sb, void *data, int silent)
 	sb->s_d_op		= &efivarfs_d_ops;
 	sb->s_time_gran         = 1;
 
-	inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0);
+	inode = efivarfs_get_inode(sb, NULL, S_IFDIR | 0755, 0, true);
 	if (!inode)
 		return -ENOMEM;
 	inode->i_op = &efivarfs_dir_inode_operations;
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 971a69d3641d..8cb09c9d81ef 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1145,6 +1145,8 @@ struct efivar_entry *efivar_entry_find(efi_char16_t *name, efi_guid_t guid,
 
 bool efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data,
 		     unsigned long data_size);
+bool efivar_variable_is_removable(efi_guid_t vendor, const char *name,
+				  size_t len);
 
 extern struct work_struct efivar_work;
 void efivar_run_worker(void);
diff --git a/tools/testing/selftests/efivarfs/efivarfs.sh b/tools/testing/selftests/efivarfs/efivarfs.sh
index 77edcdcc016b..057278448515 100644
--- a/tools/testing/selftests/efivarfs/efivarfs.sh
+++ b/tools/testing/selftests/efivarfs/efivarfs.sh
@@ -88,7 +88,11 @@ test_delete()
 		exit 1
 	fi
 
-	rm $file
+	rm $file 2>/dev/null
+	if [ $? -ne 0 ]; then
+		chattr -i $file
+		rm $file
+	fi
 
 	if [ -e $file ]; then
 		echo "$file couldn't be deleted" >&2
@@ -111,6 +115,7 @@ test_zero_size_delete()
 		exit 1
 	fi
 
+	chattr -i $file
 	printf "$attrs" > $file
 
 	if [ -e $file ]; then
@@ -141,7 +146,11 @@ test_valid_filenames()
 			echo "$file could not be created" >&2
 			ret=1
 		else
-			rm $file
+			rm $file 2>/dev/null
+			if [ $? -ne 0 ]; then
+				chattr -i $file
+				rm $file
+			fi
 		fi
 	done
 
@@ -174,7 +183,11 @@ test_invalid_filenames()
 
 		if [ -e $file ]; then
 			echo "Creating $file should have failed" >&2
-			rm $file
+			rm $file 2>/dev/null
+			if [ $? -ne 0 ]; then
+				chattr -i $file
+				rm $file
+			fi
 			ret=1
 		fi
 	done
diff --git a/tools/testing/selftests/efivarfs/open-unlink.c b/tools/testing/selftests/efivarfs/open-unlink.c
index 8c0764407b3c..4af74f733036 100644
--- a/tools/testing/selftests/efivarfs/open-unlink.c
+++ b/tools/testing/selftests/efivarfs/open-unlink.c
@@ -1,10 +1,68 @@
+#include <errno.h>
 #include <stdio.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <unistd.h>
+#include <sys/ioctl.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <linux/fs.h>
+
+static int set_immutable(const char *path, int immutable)
+{
+	unsigned int flags;
+	int fd;
+	int rc;
+	int error;
+
+	fd = open(path, O_RDONLY);
+	if (fd < 0)
+		return fd;
+
+	rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
+	if (rc < 0) {
+		error = errno;
+		close(fd);
+		errno = error;
+		return rc;
+	}
+
+	if (immutable)
+		flags |= FS_IMMUTABLE_FL;
+	else
+		flags &= ~FS_IMMUTABLE_FL;
+
+	rc = ioctl(fd, FS_IOC_SETFLAGS, &flags);
+	error = errno;
+	close(fd);
+	errno = error;
+	return rc;
+}
+
+static int get_immutable(const char *path)
+{
+	unsigned int flags;
+	int fd;
+	int rc;
+	int error;
+
+	fd = open(path, O_RDONLY);
+	if (fd < 0)
+		return fd;
+
+	rc = ioctl(fd, FS_IOC_GETFLAGS, &flags);
+	if (rc < 0) {
+		error = errno;
+		close(fd);
+		errno = error;
+		return rc;
+	}
+	close(fd);
+	if (flags & FS_IMMUTABLE_FL)
+		return 1;
+	return 0;
+}
 
 int main(int argc, char **argv)
 {
@@ -27,7 +85,7 @@ int main(int argc, char **argv)
 	buf[4] = 0;
 
 	/* create a test variable */
-	fd = open(path, O_WRONLY | O_CREAT);
+	fd = open(path, O_WRONLY | O_CREAT, 0600);
 	if (fd < 0) {
 		perror("open(O_WRONLY)");
 		return EXIT_FAILURE;
@@ -41,6 +99,18 @@ int main(int argc, char **argv)
 
 	close(fd);
 
+	rc = get_immutable(path);
+	if (rc < 0) {
+		perror("ioctl(FS_IOC_GETFLAGS)");
+		return EXIT_FAILURE;
+	} else if (rc) {
+		rc = set_immutable(path, 0);
+		if (rc < 0) {
+			perror("ioctl(FS_IOC_SETFLAGS)");
+			return EXIT_FAILURE;
+		}
+	}
+
 	fd = open(path, O_RDONLY);
 	if (fd < 0) {
 		perror("open");

[toc] | [prev] | [next] | [standalone]

#1362504 — [PATCH 3.16.y-ckt 024/142] kernel/resource.c: fix muxed resource handling in __request_region()

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Simon Guinot <simon.guinot@sequanux.org>

commit 59ceeaaf355fa0fb16558ef7c24413c804932ada upstream.

In __request_region, if a conflict with a BUSY and MUXED resource is
detected, then the caller goes to sleep and waits for the resource to be
released.  A pointer on the conflicting resource is kept.  At wake-up
this pointer is used as a parent to retry to request the region.

A first problem is that this pointer might well be invalid (if for
example the conflicting resource have already been freed).  Another
problem is that the next call to __request_region() fails to detect a
remaining conflict.  The previously conflicting resource is passed as a
parameter and __request_region() will look for a conflict among the
children of this resource and not at the resource itself.  It is likely
to succeed anyway, even if there is still a conflict.

Instead, the parent of the conflicting resource should be passed to
__request_region().

As a fix, this patch doesn't update the parent resource pointer in the
case we have to wait for a muxed region right after.

Reported-and-tested-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Simon Guinot <simon.guinot@sequanux.org>
Tested-by: Vincent Donnefort <vdonnefort@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 kernel/resource.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/resource.c b/kernel/resource.c
index 3c2237ac32db..db48bab5ea18 100644
--- a/kernel/resource.c
+++ b/kernel/resource.c
@@ -957,9 +957,10 @@ struct resource * __request_region(struct resource *parent,
 		if (!conflict)
 			break;
 		if (conflict != parent) {
-			parent = conflict;
-			if (!(conflict->flags & IORESOURCE_BUSY))
+			if (!(conflict->flags & IORESOURCE_BUSY)) {
+				parent = conflict;
 				continue;
+			}
 		}
 		if (conflict->flags & flags & IORESOURCE_MUXED) {
 			add_wait_queue(&muxed_resource_wait, &wait);

[toc] | [prev] | [next] | [standalone]

#1362505 — [PATCH 3.16.y-ckt 026/142] crypto: {blk,giv}cipher: Set has_setkey

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Ben Hutchings <ben@decadent.org.uk>

Commit a1383cd86a06 ("crypto: skcipher - Add crypto_skcipher_has_setkey")
was incorrectly backported to the 3.2.y and 3.16.y stable branches.
We need to set ablkcipher_tfm::has_setkey in the
crypto_init_blkcipher_ops_async() and crypto_init_givcipher_ops()
functions as well as crypto_init_ablkcipher_ops().

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 crypto/ablkcipher.c | 1 +
 crypto/blkcipher.c  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
index 5da16526c890..970b48e70624 100644
--- a/crypto/ablkcipher.c
+++ b/crypto/ablkcipher.c
@@ -457,6 +457,7 @@ static int crypto_init_givcipher_ops(struct crypto_tfm *tfm, u32 type,
 	crt->givdecrypt = alg->givdecrypt ?: no_givdecrypt;
 	crt->base = __crypto_ablkcipher_cast(tfm);
 	crt->ivsize = alg->ivsize;
+	crt->has_setkey = alg->max_keysize;
 
 	return 0;
 }
diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
index 7180cb2fe026..3c551d46aa3b 100644
--- a/crypto/blkcipher.c
+++ b/crypto/blkcipher.c
@@ -471,6 +471,7 @@ static int crypto_init_blkcipher_ops_async(struct crypto_tfm *tfm)
 	}
 	crt->base = __crypto_ablkcipher_cast(tfm);
 	crt->ivsize = alg->ivsize;
+	crt->has_setkey = alg->max_keysize;
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1362506 — [PATCH 3.16.y-ckt 115/142] can: gs_usb: fixed disconnect bug by removing erroneous use of kfree()

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Maximilain Schneider <max@schneidersoft.net>

commit e9a2d81b1761093386a0bb8a4f51642ac785ef63 upstream.

gs_destroy_candev() erroneously calls kfree() on a struct gs_can *, which is
allocated through alloc_candev() and should instead be freed using
free_candev() alone.

The inappropriate use of kfree() causes the kernel to hang when
gs_destroy_candev() is called.

Only the struct gs_usb * which is allocated through kzalloc() should be freed
using kfree() when the device is disconnected.

Signed-off-by: Maximilian Schneider <max@schneidersoft.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/can/usb/gs_usb.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 04b0f84612f0..047b63caa3b7 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -825,9 +825,8 @@ static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface
 static void gs_destroy_candev(struct gs_can *dev)
 {
 	unregister_candev(dev->netdev);
-	free_candev(dev->netdev);
 	usb_kill_anchored_urbs(&dev->tx_submitted);
-	kfree(dev);
+	free_candev(dev->netdev);
 }
 
 static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
@@ -910,12 +909,15 @@ static int gs_usb_probe(struct usb_interface *intf, const struct usb_device_id *
 	for (i = 0; i < icount; i++) {
 		dev->canch[i] = gs_make_candev(i, intf);
 		if (IS_ERR_OR_NULL(dev->canch[i])) {
+			/* save error code to return later */
+			rc = PTR_ERR(dev->canch[i]);
+
 			/* on failure destroy previously created candevs */
 			icount = i;
-			for (i = 0; i < icount; i++) {
+			for (i = 0; i < icount; i++)
 				gs_destroy_candev(dev->canch[i]);
-				dev->canch[i] = NULL;
-			}
+
+			usb_kill_anchored_urbs(&dev->rx_submitted);
 			kfree(dev);
 			return rc;
 		}
@@ -936,16 +938,12 @@ static void gs_usb_disconnect(struct usb_interface *intf)
 		return;
 	}
 
-	for (i = 0; i < GS_MAX_INTF; i++) {
-		struct gs_can *can = dev->canch[i];
-
-		if (!can)
-			continue;
-
-		gs_destroy_candev(can);
-	}
+	for (i = 0; i < GS_MAX_INTF; i++)
+		if (dev->canch[i])
+			gs_destroy_candev(dev->canch[i]);
 
 	usb_kill_anchored_urbs(&dev->rx_submitted);
+	kfree(dev);
 }
 
 static const struct usb_device_id gs_usb_table[] = {

[toc] | [prev] | [next] | [standalone]

#1362507 — [PATCH 3.16.y-ckt 084/142] libata: Align ata_device's id on a cacheline

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Harvey Hunt <harvey.hunt@imgtec.com>

commit 4ee34ea3a12396f35b26d90a094c75db95080baa upstream.

The id buffer in ata_device is a DMA target, but it isn't explicitly
cacheline aligned. Due to this, adjacent fields can be overwritten with
stale data from memory on non coherent architectures. As a result, the
kernel is sometimes unable to communicate with an ATA device.

Fix this by ensuring that the id buffer is cacheline aligned.

This issue is similar to that fixed by Commit 84bda12af31f
("libata: align ap->sector_buf").

Signed-off-by: Harvey Hunt <harvey.hunt@imgtec.com>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 include/linux/libata.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/libata.h b/include/linux/libata.h
index 714274450c07..bd83b8e83cfe 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -714,7 +714,7 @@ struct ata_device {
 	union {
 		u16		id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
 		u32		gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
-	};
+	} ____cacheline_aligned;
 
 	/* DEVSLP Timing Variables from Identify Device Data Log */
 	u8			devslp_timing[ATA_LOG_DEVSLP_SIZE];

[toc] | [prev] | [next] | [standalone]

#1362508 — [PATCH 3.16.y-ckt 107/142] MIPS: traps: Fix SIGFPE information leak from `do_ov' and `do_trap_or_bp'

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: "Maciej W. Rozycki" <macro@imgtec.com>

commit e723e3f7f9591b79e8c56b3d7c5a204a9c571b55 upstream.

Avoid sending a partially initialised `siginfo_t' structure along SIGFPE
signals issued from `do_ov' and `do_trap_or_bp', leading to information
leaking from the kernel stack.

Signed-off-by: Maciej W. Rozycki <macro@imgtec.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/mips/kernel/traps.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 027fefba8b96..bdf9139fd92b 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -691,15 +691,15 @@ static int simulate_sync(struct pt_regs *regs, unsigned int opcode)
 asmlinkage void do_ov(struct pt_regs *regs)
 {
 	enum ctx_state prev_state;
-	siginfo_t info;
+	siginfo_t info = {
+		.si_signo = SIGFPE,
+		.si_code = FPE_INTOVF,
+		.si_addr = (void __user *)regs->cp0_epc,
+	};
 
 	prev_state = exception_enter();
 	die_if_kernel("Integer overflow", regs);
 
-	info.si_code = FPE_INTOVF;
-	info.si_signo = SIGFPE;
-	info.si_errno = 0;
-	info.si_addr = (void __user *) regs->cp0_epc;
 	force_sig_info(SIGFPE, &info, current);
 	exception_exit(prev_state);
 }
@@ -802,7 +802,7 @@ out:
 static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
 	const char *str)
 {
-	siginfo_t info;
+	siginfo_t info = { 0 };
 	char b[40];
 
 #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP
@@ -830,7 +830,6 @@ static void do_trap_or_bp(struct pt_regs *regs, unsigned int code,
 		else
 			info.si_code = FPE_INTOVF;
 		info.si_signo = SIGFPE;
-		info.si_errno = 0;
 		info.si_addr = (void __user *) regs->cp0_epc;
 		force_sig_info(SIGFPE, &info, current);
 		break;

[toc] | [prev] | [next] | [standalone]

#1362509 — [PATCH 3.16.y-ckt 124/142] tcp: convert cached rtt from usec to jiffies when feeding initial rto

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>

commit 9bdfb3b79e61c60e1a3e2dc05ad164528afa6b8a upstream.

Currently it's converted into msecs, thus HZ=1000 intact.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 740b0f1841f6 ("tcp: switch rtt estimations to usec resolution")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/ipv4/tcp_metrics.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 4fe041805989..600add256464 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -550,7 +550,7 @@ reset:
 	 */
 	if (crtt > tp->srtt_us) {
 		/* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
-		crtt /= 8 * USEC_PER_MSEC;
+		crtt /= 8 * USEC_PER_SEC / HZ;
 		inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
 	} else if (tp->srtt_us == 0) {
 		/* RFC6298: 5.7 We've failed to get a valid RTT sample from

[toc] | [prev] | [next] | [standalone]

#1362510 — [PATCH 3.16.y-ckt 125/142] net/mlx4_core: Allow resetting VF admin mac to zero

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit 6e5224224faa50ec4c8949dcefadf895e565f0d1 upstream.

The VF administrative mac addresses (stored in the PF driver) are
initialized to zero when the PF driver starts up.

These addresses may be modified in the PF driver through ndo calls
initiated by iproute2 or libvirt.

While we allow the PF/host to change the VF admin mac address from zero
to a valid unicast mac, we do not allow restoring the VF admin mac to
zero. We currently only allow changing this mac to a different unicast mac.

This leads to problems when libvirt scripts are used to deal with
VF mac addresses, and libvirt attempts to revoke the mac so this
host will not use it anymore.

Fix this by allowing resetting a VF administrative MAC back to zero.

Fixes: 8f7ba3ca12f6 ('net/mlx4: Add set VF mac address support')
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Reported-by: Moshe Levi <moshele@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 1f588195fe9f..50b1f909ce0d 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -2244,7 +2244,7 @@ static int mlx4_en_set_vf_mac(struct net_device *dev, int queue, u8 *mac)
 	struct mlx4_en_dev *mdev = en_priv->mdev;
 	u64 mac_u64 = mlx4_mac_to_u64(mac);
 
-	if (!is_valid_ether_addr(mac))
+	if (is_multicast_ether_addr(mac))
 		return -EINVAL;
 
 	return mlx4_set_vf_mac(mdev->dev, en_priv->port, queue, mac_u64);

[toc] | [prev] | [next] | [standalone]

#1362511 — [PATCH 3.16.y-ckt 120/142] Revert "drm/radeon: call hpd_irq_event on resume"

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Linus Torvalds <torvalds@linux-foundation.org>

commit 256faedcfd646161477d47a1a78c32a562d2e845 upstream.

This reverts commit dbb17a21c131eca94eb31136eee9a7fe5aff00d9.

It turns out that commit can cause problems for systems with multiple
GPUs, and causes X to hang on at least a HP Pavilion dv7 with hybrid
graphics.

This got noticed originally in 4.4.4, where this patch had already
gotten back-ported, but 4.5-rc7 was verified to have the same problem.

Alexander Deucher says:
 "It looks like you have a muxed system so I suspect what's happening is
  that one of the display is being reported as connected for both the
  IGP and the dGPU and then the desktop environment gets confused or
  there some sort problem in the detect functions since the mux is not
  switched to the dGPU.  I don't see an easy fix unless Dave has any
  ideas.  I'd say just revert for now"

Reported-by: Jörg-Volker Peetz <jvpeetz@web.de>
Acked-by: Alexander Deucher <Alexander.Deucher@amd.com>
Cc: Dave Airlie <airlied@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpu/drm/radeon/radeon_device.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index f7296ca6510c..ca470fb17aa4 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -1649,7 +1649,6 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
 	}
 
 	drm_kms_helper_poll_enable(dev);
-	drm_helper_hpd_irq_event(dev);
 
 	/* set the power state here in case we are a PX system or headless */
 	if ((rdev->pm.pm_method == PM_METHOD_DPM) && rdev->pm.dpm_enabled)

[toc] | [prev] | [next] | [standalone]

#1362512 — [PATCH 3.16.y-ckt 114/142] mac80211: minstrel_ht: set default tx aggregation timeout to 0

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Felix Fietkau <nbd@openwrt.org>

commit 7a36b930e6ed4702c866dc74a5ad07318a57c688 upstream.

The value 5000 was put here with the addition of the timeout field to
ieee80211_start_tx_ba_session. It was originally added in mac80211 to
save resources for drivers like iwlwifi, which only supports a limited
number of concurrent aggregation sessions.

Since iwlwifi does not use minstrel_ht and other drivers don't need
this, 0 is a better default - especially since there have been
recent reports of aggregation setup related issues reproduced with
ath9k. This should improve stability without causing any adverse
effects.

Acked-by: Avery Pennarun <apenwarr@gmail.com>
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 net/mac80211/rc80211_minstrel_ht.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 85c1e74b7714..d4144f8630ef 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -464,7 +464,7 @@ minstrel_aggr_check(struct ieee80211_sta *pubsta, struct sk_buff *skb)
 	if (skb_get_queue_mapping(skb) == IEEE80211_AC_VO)
 		return;
 
-	ieee80211_start_tx_ba_session(pubsta, tid, 5000);
+	ieee80211_start_tx_ba_session(pubsta, tid, 0);
 }
 
 static void

[toc] | [prev] | [next] | [standalone]

#1362516 — [PATCH 3.16.y-ckt 119/142] target: Drop incorrect ABORT_TASK put for completed commands

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit 7f54ab5ff52fb0b91569bc69c4a6bc5cac1b768d upstream.

This patch fixes a recent ABORT_TASK regression associated
with commit febe562c, where a left-over target_put_sess_cmd()
would still be called when __target_check_io_state() detected
a command has already been completed, and explicit ABORT must
be avoided.

Note commit febe562c dropped the local kref_get_unless_zero()
check in core_tmr_abort_task(), but did not drop this extra
corresponding target_put_sess_cmd() in the failure path.

So go ahead and drop this now bogus target_put_sess_cmd(),
and avoid this potential use-after-free.

Reported-by: Dan Lane <dracodan@gmail.com>
Cc: Quinn Tran <quinn.tran@qlogic.com>
Cc: Himanshu Madhani <himanshu.madhani@qlogic.com>
Cc: Sagi Grimberg <sagig@mellanox.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: Mike Christie <mchristi@redhat.com>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/target/target_core_tmr.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index ebdbaaf6111d..033a59cd6c70 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -186,7 +186,6 @@ void core_tmr_abort_task(
 
 		if (!__target_check_io_state(se_cmd, se_sess, 0)) {
 			spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-			target_put_sess_cmd(se_sess, se_cmd);
 			goto out;
 		}
 

[toc] | [prev] | [next] | [standalone]

#1362518 — [PATCH 3.16.y-ckt 108/142] ubi: Fix out of bounds write in volume update code

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Richard Weinberger <richard@nod.at>

commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/mtd/ubi/upd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 2a1b6e037e1a..0134ba32a057 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -193,7 +193,7 @@ int ubi_start_leb_change(struct ubi_device *ubi, struct ubi_volume *vol,
 	vol->changing_leb = 1;
 	vol->ch_lnum = req->lnum;
 
-	vol->upd_buf = vmalloc(req->bytes);
+	vol->upd_buf = vmalloc(ALIGN((int)req->bytes, ubi->min_io_size));
 	if (!vol->upd_buf)
 		return -ENOMEM;
 

[toc] | [prev] | [next] | [standalone]

#1362519 — [PATCH 3.16.y-ckt 118/142] ASoC: wm_adsp: Fix enum ctl accesses in a wrong type

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 15c665700bf6f4543f003ac0fbb1e9ec692e93f2 upstream.

The firmware ctls like "DSP1 Firmware" in wm_adsp codec driver are
enum, while the current driver accesses wrongly via
value.integer.value[].  They have to be via value.enumerated.item[]
instead.

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mark Brown <broonie@kernel.org>
[ luis: backported to 3.16: adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/soc/codecs/wm_adsp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index 051350052d62..51bdb4765b41 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -246,7 +246,7 @@ static int wm_adsp_fw_get(struct snd_kcontrol *kcontrol,
 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
 	struct wm_adsp *adsp = snd_soc_codec_get_drvdata(codec);
 
-	ucontrol->value.integer.value[0] = adsp[e->shift_l].fw;
+	ucontrol->value.enumerated.item[0] = adsp[e->shift_l].fw;
 
 	return 0;
 }
@@ -258,16 +258,16 @@ static int wm_adsp_fw_put(struct snd_kcontrol *kcontrol,
 	struct soc_enum *e = (struct soc_enum *)kcontrol->private_value;
 	struct wm_adsp *adsp = snd_soc_codec_get_drvdata(codec);
 
-	if (ucontrol->value.integer.value[0] == adsp[e->shift_l].fw)
+	if (ucontrol->value.enumerated.item[0] == adsp[e->shift_l].fw)
 		return 0;
 
-	if (ucontrol->value.integer.value[0] >= WM_ADSP_NUM_FW)
+	if (ucontrol->value.enumerated.item[0] >= WM_ADSP_NUM_FW)
 		return -EINVAL;
 
 	if (adsp[e->shift_l].running)
 		return -EBUSY;
 
-	adsp[e->shift_l].fw = ucontrol->value.integer.value[0];
+	adsp[e->shift_l].fw = ucontrol->value.enumerated.item[0];
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1362520 — [PATCH 3.16.y-ckt 105/142] PM / sleep / x86: Fix crash on graph trace through x86 suspend

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Todd E Brandt <todd.e.brandt@linux.intel.com>

commit 92f9e179a702a6adbc11e2fedc76ecd6ffc9e3f7 upstream.

Pause/unpause graph tracing around do_suspend_lowlevel as it has
inconsistent call/return info after it jumps to the wakeup vector.
The graph trace buffer will otherwise become misaligned and
may eventually crash and hang on suspend.

To reproduce the issue and test the fix:
Run a function_graph trace over suspend/resume and set the graph
function to suspend_devices_and_enter. This consistently hangs the
system without this fix.

Signed-off-by: Todd Brandt <todd.e.brandt@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/x86/kernel/acpi/sleep.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 31368207837c..8255d2fe8cfa 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -16,6 +16,7 @@
 #include <asm/cacheflush.h>
 #include <asm/realmode.h>
 
+#include <linux/ftrace.h>
 #include "../../realmode/rm/wakeup.h"
 #include "sleep.h"
 
@@ -107,7 +108,13 @@ int x86_acpi_suspend_lowlevel(void)
        saved_magic = 0x123456789abcdef0L;
 #endif /* CONFIG_64BIT */
 
+	/*
+	 * Pause/unpause graph tracing around do_suspend_lowlevel as it has
+	 * inconsistent call/return info after it jumps to the wakeup vector.
+	 */
+	pause_graph_tracing();
 	do_suspend_lowlevel();
+	unpause_graph_tracing();
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1362521 — [PATCH 3.16.y-ckt 122/142] KVM: VMX: disable PEBS before a guest entry

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= <rkrcmar@redhat.com>

commit 7099e2e1f4d9051f31bbfa5803adf954bb5d76ef upstream.

Linux guests on Haswell (and also SandyBridge and Broadwell, at least)
would crash if you decided to run a host command that uses PEBS, like
  perf record -e 'cpu/mem-stores/pp' -a

This happens because KVM is using VMX MSR switching to disable PEBS, but
SDM [2015-12] 18.4.4.4 Re-configuring PEBS Facilities explains why it
isn't safe:
  When software needs to reconfigure PEBS facilities, it should allow a
  quiescent period between stopping the prior event counting and setting
  up a new PEBS event. The quiescent period is to allow any latent
  residual PEBS records to complete its capture at their previously
  specified buffer address (provided by IA32_DS_AREA).

There might not be a quiescent period after the MSR switch, so a CPU
ends up using host's MSR_IA32_DS_AREA to access an area in guest's
memory.  (Or MSR switching is just buggy on some models.)

The guest can learn something about the host this way:
If the guest doesn't map address pointed by MSR_IA32_DS_AREA, it results
in #PF where we leak host's MSR_IA32_DS_AREA through CR2.

After that, a malicious guest can map and configure memory where
MSR_IA32_DS_AREA is pointing and can therefore get an output from
host's tracing.

This is not a critical leak as the host must initiate with PEBS tracing
and I have not been able to get a record from more than one instruction
before vmentry in vmx_vcpu_run() (that place has most registers already
overwritten with guest's).

We could disable PEBS just few instructions before vmentry, but
disabling it earlier shouldn't affect host tracing too much.
We also don't need to switch MSR_IA32_PEBS_ENABLE on VMENTRY, but that
optimization isn't worth its code, IMO.

(If you are implementing PEBS for guests, be sure to handle the case
 where both host and guest enable PEBS, because this patch doesn't.)

Fixes: 26a4f3c08de4 ("perf/x86: disable PEBS on a guest entry.")
Reported-by: Jiří Olša <jolsa@redhat.com>
Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 arch/x86/kvm/vmx.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index d1d7086f0e9b..e7cd4c833c40 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1574,6 +1574,13 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr,
 			return;
 		}
 		break;
+	case MSR_IA32_PEBS_ENABLE:
+		/* PEBS needs a quiescent period after being disabled (to write
+		 * a record).  Disabling PEBS through VMX MSR swapping doesn't
+		 * provide that period, so a CPU could write host's record into
+		 * guest's memory.
+		 */
+		wrmsrl(MSR_IA32_PEBS_ENABLE, 0);
 	}
 
 	for (i = 0; i < m->nr; ++i)

[toc] | [prev] | [next] | [standalone]

#1362523 — [PATCH 3.16.y-ckt 109/142] gpio: rcar: Add Runtime PM handling for interrupts

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Geert Uytterhoeven <geert+renesas@glider.be>

commit b26a719bdba9aa926ceaadecc66e07623d2b8a53 upstream.

The R-Car GPIO driver handles Runtime PM for requested GPIOs only.

When using a GPIO purely as an interrupt source, no Runtime PM handling
is done, and the GPIO module's clock may not be enabled.

To fix this:
  - Add .irq_request_resources() and .irq_release_resources() callbacks
    to handle Runtime PM when an interrupt is requested,
  - Add irq_bus_lock() and sync_unlock() callbacks to handle Runtime PM
    when e.g. disabling/enabling an interrupt, or configuring the
    interrupt type.

Fixes: d5c3d84657db57bd "net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS"
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ luis: backported to 3.16:
  - use gpio_to_priv() instead of gpiochip_get_data()
  - adjusted context ]
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 drivers/gpio/gpio-rcar.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/drivers/gpio/gpio-rcar.c b/drivers/gpio/gpio-rcar.c
index c3ea3e9e3d14..b97094ce448f 100644
--- a/drivers/gpio/gpio-rcar.c
+++ b/drivers/gpio/gpio-rcar.c
@@ -186,6 +186,44 @@ static inline struct gpio_rcar_priv *gpio_to_priv(struct gpio_chip *chip)
 	return container_of(chip, struct gpio_rcar_priv, gpio_chip);
 }
 
+static void gpio_rcar_irq_bus_lock(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct gpio_rcar_priv *p = gpio_to_priv(gc);
+
+	pm_runtime_get_sync(&p->pdev->dev);
+}
+
+static void gpio_rcar_irq_bus_sync_unlock(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct gpio_rcar_priv *p = gpio_to_priv(gc);
+
+	pm_runtime_put(&p->pdev->dev);
+}
+
+
+static int gpio_rcar_irq_request_resources(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct gpio_rcar_priv *p = gpio_to_priv(gc);
+	int error;
+
+	error = pm_runtime_get_sync(&p->pdev->dev);
+	if (error < 0)
+		return error;
+
+	return 0;
+}
+
+static void gpio_rcar_irq_release_resources(struct irq_data *d)
+{
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+	struct gpio_rcar_priv *p = gpio_to_priv(gc);
+
+	pm_runtime_put(&p->pdev->dev);
+}
+
 static void gpio_rcar_config_general_input_output_mode(struct gpio_chip *chip,
 						       unsigned int gpio,
 						       bool output)
@@ -414,6 +452,10 @@ static int gpio_rcar_probe(struct platform_device *pdev)
 	irq_chip->irq_mask = gpio_rcar_irq_disable;
 	irq_chip->irq_unmask = gpio_rcar_irq_enable;
 	irq_chip->irq_set_type = gpio_rcar_irq_set_type;
+	irq_chip->irq_bus_lock = gpio_rcar_irq_bus_lock;
+	irq_chip->irq_bus_sync_unlock = gpio_rcar_irq_bus_sync_unlock;
+	irq_chip->irq_request_resources = gpio_rcar_irq_request_resources;
+	irq_chip->irq_release_resources = gpio_rcar_irq_release_resources;
 	irq_chip->flags	= IRQCHIP_SKIP_SET_WAKE | IRQCHIP_SET_TYPE_MASKED
 			 | IRQCHIP_MASK_ON_SUSPEND;
 

[toc] | [prev] | [next] | [standalone]

#1362524 — [PATCH 3.16.y-ckt 130/142] ext4: iterate over buffer heads correctly in move_extent_per_page()

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Eryu Guan <guaneryu@gmail.com>

commit 6ffe77bad545f4a7c8edd2a4ee797ccfcd894ab4 upstream.

In commit bcff24887d00 ("ext4: don't read blocks from disk after extents
being swapped") bh is not updated correctly in the for loop and wrong
data has been written to disk. generic/324 catches this on sub-page
block size ext4.

Fixes: bcff24887d00 ("ext4: don't read blocks from disk after extentsbeing swapped")
Signed-off-by: Eryu Guan <guaneryu@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/ext4/move_extent.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
index 146f8cd627b2..2423b0068183 100644
--- a/fs/ext4/move_extent.c
+++ b/fs/ext4/move_extent.c
@@ -1037,6 +1037,7 @@ data_copy:
 		*err = ext4_get_block(orig_inode, orig_blk_offset + i, bh, 0);
 		if (*err < 0)
 			break;
+		bh = bh->b_this_page;
 	}
 	if (!*err)
 		*err = block_commit_write(pagep[0], from, from + replaced_size);

[toc] | [prev] | [next] | [standalone]

#1362525 — [PATCH 3.16.y-ckt 101/142] ALSA: seq: oss: Don't drain at closing a client

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Takashi Iwai <tiwai@suse.de>

commit 197b958c1e76a575d77038cc98b4bebc2134279f upstream.

The OSS sequencer client tries to drain the pending events at
releasing.  Unfortunately, as spotted by syzkaller fuzzer, this may
lead to an unkillable process state when the event has been queued at
the far future.  Since the process being released can't be signaled
any longer, it remains and waits for the echo-back event in that far
future.

Back to history, the draining feature was implemented at the time we
misinterpreted POSIX definition for blocking file operation.
Actually, such a behavior is superfluous at release, and we should
just release the device as is instead of keeping it up forever.

This patch just removes the draining call that may block the release
for too long time unexpectedly.

BugLink: http://lkml.kernel.org/r/CACT4Y+Y4kD-aBGj37rf-xBw9bH3GMU6P+MYg4W1e-s-paVD2pg@mail.gmail.com
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 sound/core/seq/oss/seq_oss.c        |  2 --
 sound/core/seq/oss/seq_oss_device.h |  1 -
 sound/core/seq/oss/seq_oss_init.c   | 16 ----------------
 3 files changed, 19 deletions(-)

diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
index 16d42679e43f..bb032d7593e3 100644
--- a/sound/core/seq/oss/seq_oss.c
+++ b/sound/core/seq/oss/seq_oss.c
@@ -144,8 +144,6 @@ odev_release(struct inode *inode, struct file *file)
 	if ((dp = file->private_data) == NULL)
 		return 0;
 
-	snd_seq_oss_drain_write(dp);
-
 	mutex_lock(&register_mutex);
 	snd_seq_oss_release(dp);
 	mutex_unlock(&register_mutex);
diff --git a/sound/core/seq/oss/seq_oss_device.h b/sound/core/seq/oss/seq_oss_device.h
index b43924325249..d7b4d016b547 100644
--- a/sound/core/seq/oss/seq_oss_device.h
+++ b/sound/core/seq/oss/seq_oss_device.h
@@ -127,7 +127,6 @@ int snd_seq_oss_write(struct seq_oss_devinfo *dp, const char __user *buf, int co
 unsigned int snd_seq_oss_poll(struct seq_oss_devinfo *dp, struct file *file, poll_table * wait);
 
 void snd_seq_oss_reset(struct seq_oss_devinfo *dp);
-void snd_seq_oss_drain_write(struct seq_oss_devinfo *dp);
 
 /* */
 void snd_seq_oss_process_queue(struct seq_oss_devinfo *dp, abstime_t time);
diff --git a/sound/core/seq/oss/seq_oss_init.c b/sound/core/seq/oss/seq_oss_init.c
index beea8c861f49..acefecb1a47a 100644
--- a/sound/core/seq/oss/seq_oss_init.c
+++ b/sound/core/seq/oss/seq_oss_init.c
@@ -441,22 +441,6 @@ snd_seq_oss_release(struct seq_oss_devinfo *dp)
 
 
 /*
- * Wait until the queue is empty (if we don't have nonblock)
- */
-void
-snd_seq_oss_drain_write(struct seq_oss_devinfo *dp)
-{
-	if (! dp->timer->running)
-		return;
-	if (is_write_mode(dp->file_mode) && !is_nonblock_mode(dp->file_mode) &&
-	    dp->writeq) {
-		while (snd_seq_oss_writeq_sync(dp->writeq))
-			;
-	}
-}
-
-
-/*
  * reset sequencer devices
  */
 void

[toc] | [prev] | [next] | [standalone]

#1362526 — [PATCH 3.16.y-ckt 092/142] Fix cifs_uniqueid_to_ino_t() function for s390x

3.16.7-ckt26 -stable review patch.  If anyone has any objections, please let me know.

---8<------------------------------------------------------------

From: Yadan Fan <ydfan@novell.com>

commit 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 upstream.

This issue is caused by commit 02323db17e3a7 ("cifs: fix
cifs_uniqueid_to_ino_t not to ever return 0"), when BITS_PER_LONG
is 64 on s390x, the corresponding cifs_uniqueid_to_ino_t()
function will cast 64-bit fileid to 32-bit by using (ino_t)fileid,
because ino_t (typdefed __kernel_ino_t) is int type.

It's defined in arch/s390/include/uapi/asm/posix_types.h

    #ifndef __s390x__

    typedef unsigned long   __kernel_ino_t;
    ...
    #else /* __s390x__ */

    typedef unsigned int    __kernel_ino_t;

So the #ifdef condition is wrong for s390x, we can just still use
one cifs_uniqueid_to_ino_t() function with comparing sizeof(ino_t)
and sizeof(u64) to choose the correct execution accordingly.

Signed-off-by: Yadan Fan <ydfan@suse.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
---
 fs/cifs/cifsfs.h | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
index 70f178a7c759..e48d496c43c7 100644
--- a/fs/cifs/cifsfs.h
+++ b/fs/cifs/cifsfs.h
@@ -31,19 +31,15 @@
  * so that it will fit. We use hash_64 to convert the value to 31 bits, and
  * then add 1, to ensure that we don't end up with a 0 as the value.
  */
-#if BITS_PER_LONG == 64
 static inline ino_t
 cifs_uniqueid_to_ino_t(u64 fileid)
 {
+	if ((sizeof(ino_t)) < (sizeof(u64)))
+		return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
+
 	return (ino_t)fileid;
+
 }
-#else
-static inline ino_t
-cifs_uniqueid_to_ino_t(u64 fileid)
-{
-	return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
-}
-#endif
 
 extern struct file_system_type cifs_fs_type;
 extern const struct address_space_operations cifs_addr_ops;

[toc] | [prev] | [next] | [standalone]

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web