Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1380930 > unrolled thread

[PATCH 3.14 00/37] 3.14.67-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.14 00/37] 3.14.67-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:30 +0200
    [PATCH 3.14 28/37] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:30 +0200
    [PATCH 3.14 09/37] net: jme: fix suspend/resume on JMC260 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 27/37] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 04/37] ALSA: timer: Use mod_timer() for rearming the system timer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 20/37] ipv4: fix broadcast packets reception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 24/37] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 30/37] perf: Cure event->pending_disable race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 11/37] ipv6: re-enable fragment header matching in ipv6_find_hdr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 23/37] ipv4: l2tp: fix a potential issue in l2tp_ip_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 06/37] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    [PATCH 3.14 25/37] ip6_tunnel: set rtnl_link_ops before calling register_netdevice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:50 +0200
    Re: [PATCH 3.14 00/37] 3.14.67-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200
    Re: [PATCH 3.14 00/37] 3.14.67-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-04-18 18:40 +0200

#1380930 — [PATCH 3.14 00/37] 3.14.67-stable review

This is the start of the stable review cycle for the 3.14.67 release.
There are 37 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Wed Apr 20 02:23:24 UTC 2016.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.67-rc1.gz
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.14.67-rc1

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Revert "usb: hub: do not clear BOS field during reset device"

Vladis Dronov <vdronov@redhat.com>
    usbvision: fix crash on detecting device with invalid configuration

Alexey Khoroshilov <khoroshilov@ispras.ru>
    usbvision: fix leak of usb_dev on failure paths in usbvision_probe()

Oliver Neukum <oneukum@suse.com>
    usbvision fix overflow of interfaces array

Nicolai Hähnle <nicolai.haehnle@amd.com>
    drm/radeon: hold reference to fences in radeon_sa_bo_new (3.17 and older)

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Revert bad backport of "drm/radeon: hold reference to fences in radeon_sa_bo_new"

Alan Stern <stern@rowland.harvard.edu>
    HID: usbhid: fix inconsistent reset/resume/reset-resume behavior

Peter Zijlstra <peterz@infradead.org>
    perf: Cure event->pending_disable race

Theodore Ts'o <tytso@mit.edu>
    ext4: add lockdep annotations for i_data_sem

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer

Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
    usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

Michal Kazior <michal.kazior@tieto.com>
    mac80211: fix unnecessary frame drops in mesh fwding

Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
    ip6_tunnel: set rtnl_link_ops before calling register_netdevice

Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
    ipv6: l2tp: fix a potential issue in l2tp_ip6_recv

Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
    ipv4: l2tp: fix a potential issue in l2tp_ip_recv

Bjørn Mork <bjorn@mork.no>
    qmi_wwan: add "D-Link DWM-221 B1" device id

Guillaume Nault <g.nault@alphalink.fr>
    ppp: take reference on channels netns

Paolo Abeni <pabeni@redhat.com>
    ipv4: fix broadcast packets reception

Manish Chopra <manish.chopra@qlogic.com>
    qlge: Fix receive packets drop.

Arnd Bergmann <arnd@arndb.de>
    ath9k: fix buffer overrun for ar9287

Arnd Bergmann <arnd@arndb.de>
    farsync: fix off-by-one bug in fst_add_one

Arnaldo Carvalho de Melo <acme@redhat.com>
    net: Fix use after free in the recvmmsg exit path

Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
    sh_eth: fix NULL pointer dereference in sh_eth_ring_format()

Bill Sommerfeld <wsommerfeld@google.com>
    udp6: fix UDP/IPv6 encap resubmit path

Oliver Neukum <oneukum@suse.com>
    usbnet: cleanup after bind() in probe()

Bjørn Mork <bjorn@mork.no>
    cdc_ncm: toggle altsetting to force reset before setup

Florian Westphal <fw@strlen.de>
    ipv6: re-enable fragment header matching in ipv6_find_hdr

Xin Long <lucien.xin@gmail.com>
    sctp: lack the check for ports in sctp_v6_cmp_addr

Diego Viola <diego.viola@gmail.com>
    net: jme: fix suspend/resume on JMC260

Boris Ostrovsky <boris.ostrovsky@oracle.com>
    xen/events: Mask a moving irq

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: add a dpm quirk for all R7 370 parts

Alex Deucher <alexander.deucher@amd.com>
    drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5

Xishi Qiu <qiuxishi@huawei.com>
    mm: fix invalid node in alloc_migrate_target()

Takashi Iwai <tiwai@suse.de>
    ALSA: timer: Use mod_timer() for rearming the system timer

Helge Deller <deller@gmx.de>
    parisc: Fix kernel crash with reversed copy_from_user()

Helge Deller <deller@gmx.de>
    parisc: Avoid function pointers for kernel exception routines

Guenter Roeck <linux@roeck-us.net>
    hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated


-------------

Diffstat:

 Makefile                                      |  4 +-
 arch/parisc/kernel/parisc_ksyms.c             | 10 ++--
 arch/parisc/kernel/traps.c                    |  3 ++
 drivers/gpu/drm/radeon/radeon_sa.c            |  6 ++-
 drivers/gpu/drm/radeon/si_dpm.c               |  5 ++
 drivers/hid/usbhid/hid-core.c                 | 73 ++++++++++++++-------------
 drivers/hwmon/max1111.c                       |  6 +++
 drivers/media/usb/usbvision/usbvision-video.c | 47 ++++++++++++++---
 drivers/net/ethernet/jme.c                    |  3 +-
 drivers/net/ethernet/qlogic/qlge/qlge_main.c  | 11 ++++
 drivers/net/ethernet/renesas/sh_eth.c         |  3 +-
 drivers/net/ppp/ppp_generic.c                 |  4 +-
 drivers/net/usb/cdc_ncm.c                     |  6 ++-
 drivers/net/usb/qmi_wwan.c                    |  1 +
 drivers/net/usb/usbnet.c                      |  7 +++
 drivers/net/wan/farsync.c                     |  2 +-
 drivers/net/wireless/ath/ath9k/eeprom.c       |  7 ++-
 drivers/usb/core/hub.c                        |  8 ++-
 drivers/usb/renesas_usbhs/fifo.c              |  4 +-
 drivers/xen/events/events_base.c              | 28 ++++++++--
 fs/ext4/ext4.h                                | 23 +++++++++
 fs/ext4/move_extent.c                         | 11 +++-
 fs/ext4/super.c                               | 25 ++++++++-
 kernel/events/core.c                          |  6 +--
 mm/page_isolation.c                           |  8 +--
 net/ipv4/udp.c                                | 12 +++--
 net/ipv6/exthdrs_core.c                       |  6 ++-
 net/ipv6/ip6_tunnel.c                         |  2 +-
 net/ipv6/udp.c                                |  6 +--
 net/l2tp/l2tp_ip.c                            |  8 +--
 net/l2tp/l2tp_ip6.c                           |  8 +--
 net/mac80211/rx.c                             |  5 +-
 net/sctp/ipv6.c                               |  2 +
 net/socket.c                                  | 38 +++++++-------
 sound/core/timer.c                            |  4 +-
 35 files changed, 280 insertions(+), 122 deletions(-)

[toc] | [next] | [standalone]

#1380931 — [PATCH 3.14 28/37] usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

commit 6490865c67825277b29638e839850882600b48ec upstream.

This patch adds a code to surely disable TX IRQ of the pipe before
starting TX DMAC transfer. Otherwise, a lot of unnecessary TX IRQs
may happen in rare cases when DMAC is used.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/renesas_usbhs/fifo.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -934,6 +934,7 @@ static int usbhsf_dma_try_pop(struct usb
 
 	pkt->trans = len;
 
+	usbhsf_tx_irq_ctrl(pipe, 0);
 	INIT_WORK(&pkt->work, xfer_work);
 	schedule_work(&pkt->work);
 

[toc] | [prev] | [next] | [standalone]

#1381202 — [PATCH 3.14 09/37] net: jme: fix suspend/resume on JMC260

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Diego Viola <diego.viola@gmail.com>

[ Upstream commit ee50c130c82175eaa0820c96b6d3763928af2241 ]

The JMC260 network card fails to suspend/resume because the call to
jme_start_irq() was too early, moving the call to jme_start_irq() after
the call to jme_reset_link() makes it work.

Prior this change suspend/resume would fail unless /sys/power/pm_async=0
was explicitly specified.

Relevant bug report: https://bugzilla.kernel.org/show_bug.cgi?id=112351

Signed-off-by: Diego Viola <diego.viola@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/jme.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -3287,13 +3287,14 @@ jme_resume(struct device *dev)
 		jme_reset_phy_processor(jme);
 	jme_phy_calibration(jme);
 	jme_phy_setEA(jme);
-	jme_start_irq(jme);
 	netif_device_attach(netdev);
 
 	atomic_inc(&jme->link_changing);
 
 	jme_reset_link(jme);
 
+	jme_start_irq(jme);
+
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1381203 — [PATCH 3.14 27/37] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>

commit 894f2fc44f2f3f48c36c973b1123f6ab298be160 upstream.

When unexpected situation happened (e.g. tx/rx irq happened while
DMAC is used), the usbhsf_pkt_handler() was possible to cause NULL
pointer dereference like the followings:

Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = c0004000
[00000000] *pgd=00000000
Internal error: Oops: 80000007 [#1] SMP ARM
Modules linked in: usb_f_acm u_serial g_serial libcomposite
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.5.0-rc6-00842-gac57066-dirty #63
Hardware name: Generic R8A7790 (Flattened Device Tree)
task: c0729c00 ti: c0724000 task.ti: c0724000
PC is at 0x0
LR is at usbhsf_pkt_handler+0xac/0x118
pc : [<00000000>]    lr : [<c03257e0>]    psr: 60000193
sp : c0725db8  ip : 00000000  fp : c0725df4
r10: 00000001  r9 : 00000193  r8 : ef3ccab4
r7 : ef3cca10  r6 : eea4586c  r5 : 00000000  r4 : ef19ceb4
r3 : 00000000  r2 : 0000009c  r1 : c0725dc4  r0 : ef19ceb4

This patch adds a condition to avoid the dereference.

Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/renesas_usbhs/fifo.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usb
 		goto __usbhs_pkt_handler_end;
 	}
 
-	ret = func(pkt, &is_done);
+	if (likely(func))
+		ret = func(pkt, &is_done);
 
 	if (is_done)
 		__usbhsf_pkt_del(pkt);

[toc] | [prev] | [next] | [standalone]

#1381205 — [PATCH 3.14 04/37] ALSA: timer: Use mod_timer() for rearming the system timer

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  <IRQ>
  [<ffffffff8239c94e>] snd_timer_s_start+0x13e/0x1a0
  [<ffffffff8239e1f4>] snd_timer_interrupt+0x504/0xec0
  [<ffffffff8122fca0>] ? debug_check_no_locks_freed+0x290/0x290
  [<ffffffff8239ec64>] snd_timer_s_function+0xb4/0x120
  [<ffffffff81296b72>] call_timer_fn+0x162/0x520
  [<ffffffff81296add>] ? call_timer_fn+0xcd/0x520
  [<ffffffff8239ebb0>] ? snd_timer_interrupt+0xec0/0xec0
  ....

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1012,8 +1012,8 @@ static int snd_timer_s_start(struct snd_
 		njiff += timer->sticks - priv->correction;
 		priv->correction = 0;
 	}
-	priv->last_expires = priv->tlist.expires = njiff;
-	add_timer(&priv->tlist);
+	priv->last_expires = njiff;
+	mod_timer(&priv->tlist, njiff);
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1381206 — [PATCH 3.14 20/37] ipv4: fix broadcast packets reception

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Paolo Abeni <pabeni@redhat.com>

[ Upstream commit ad0ea1989cc4d5905941d0a9e62c63ad6d859cef ]

Currently, ingress ipv4 broadcast datagrams are dropped since,
in udp_v4_early_demux(), ip_check_mc_rcu() is invoked even on
bcast packets.

This patch addresses the issue, invoking ip_check_mc_rcu()
only for mcast packets.

Fixes: 6e5403093261 ("ipv4/udp: Verify multicast group is ours in upd_v4_early_demux()")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp.c |   12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1939,10 +1939,14 @@ void udp_v4_early_demux(struct sk_buff *
 		if (!in_dev)
 			return;
 
-		ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-				       iph->protocol);
-		if (!ours)
-			return;
+		/* we are supposed to accept bcast packets */
+		if (skb->pkt_type == PACKET_MULTICAST) {
+			ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+					       iph->protocol);
+			if (!ours)
+				return;
+		}
+
 		sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
 						   uh->source, iph->saddr, dif);
 	} else if (skb->pkt_type == PACKET_HOST) {

[toc] | [prev] | [next] | [standalone]

#1381211 — [PATCH 3.14 24/37] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

[ Upstream commit be447f305494e019dfc37ea4cdf3b0e4200b4eba ]

pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_ip6.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/net/l2tp/l2tp_ip6.c
+++ b/net/l2tp/l2tp_ip6.c
@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff
 	struct l2tp_tunnel *tunnel = NULL;
 	int length;
 
-	/* Point to L2TP header */
-	optr = ptr = skb->data;
-
 	if (!pskb_may_pull(skb, 4))
 		goto discard;
 
+	/* Point to L2TP header */
+	optr = ptr = skb->data;
 	session_id = ntohl(*((__be32 *) ptr));
 	ptr += 4;
 
@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff
 		if (!pskb_may_pull(skb, length))
 			goto discard;
 
+		/* Point to L2TP header */
+		optr = ptr = skb->data;
+		ptr += 4;
 		pr_debug("%s: ip recv\n", tunnel->name);
 		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
 	}

[toc] | [prev] | [next] | [standalone]

#1381215 — [PATCH 3.14 30/37] perf: Cure event->pending_disable race

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 28a967c3a2f99fa3b5f762f25cb2a319d933571b upstream.

Because event_sched_out() checks event->pending_disable _before_
actually disabling the event, it can happen that the event fires after
it checks but before it gets disabled.

This would leave event->pending_disable set and the queued irq_work
will try and process it.

However, if the event trigger was during schedule(), the event might
have been de-scheduled by the time the irq_work runs, and
perf_event_disable_local() will fail.

Fix this by checking event->pending_disable _after_ we call
event->pmu->del(). This depends on the latter being a compiler
barrier, such that the compiler does not lift the load and re-creates
the problem.

Tested-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: dvyukov@google.com
Cc: eranian@google.com
Cc: oleg@redhat.com
Cc: panand@redhat.com
Cc: sasha.levin@oracle.com
Cc: vince@deater.net
Link: http://lkml.kernel.org/r/20160224174948.040469884@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/events/core.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1400,14 +1400,14 @@ event_sched_out(struct perf_event *event
 
 	perf_pmu_disable(event->pmu);
 
+	event->tstamp_stopped = tstamp;
+	event->pmu->del(event, 0);
+	event->oncpu = -1;
 	event->state = PERF_EVENT_STATE_INACTIVE;
 	if (event->pending_disable) {
 		event->pending_disable = 0;
 		event->state = PERF_EVENT_STATE_OFF;
 	}
-	event->tstamp_stopped = tstamp;
-	event->pmu->del(event, 0);
-	event->oncpu = -1;
 
 	if (!is_software_event(event))
 		cpuctx->active_oncpu--;

[toc] | [prev] | [next] | [standalone]

#1381217 — [PATCH 3.14 11/37] ipv6: re-enable fragment header matching in ipv6_find_hdr

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Westphal <fw@strlen.de>

[ Upstream commit 5d150a985520bbe3cb2aa1ceef24a7e32f20c15f ]

When ipv6_find_hdr is used to find a fragment header
(caller specifies target NEXTHDR_FRAGMENT) we erronously return
-ENOENT for all fragments with nonzero offset.

Before commit 9195bb8e381d, when target was specified, we did not
enter the exthdr walk loop as nexthdr == target so this used to work.

Now we do (so we can skip empty route headers). When we then stumble upon
a frag with nonzero frag_off we must return -ENOENT ("header not found")
only if the caller did not specifically request NEXTHDR_FRAGMENT.

This allows nfables exthdr expression to match ipv6 fragments, e.g. via

nft add rule ip6 filter input frag frag-off gt 0

Fixes: 9195bb8e381d ("ipv6: improve ipv6_find_hdr() to skip empty routing headers")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/exthdrs_core.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *
 						*fragoff = _frag_off;
 					return hp->nexthdr;
 				}
-				return -ENOENT;
+				if (!found)
+					return -ENOENT;
+				if (fragoff)
+					*fragoff = _frag_off;
+				break;
 			}
 			hdrlen = 8;
 		} else if (nexthdr == NEXTHDR_AUTH) {

[toc] | [prev] | [next] | [standalone]

#1381218 — [PATCH 3.14 23/37] ipv4: l2tp: fix a potential issue in l2tp_ip_recv

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>

[ Upstream commit 5745b8232e942abd5e16e85fa9b27cc21324acf0 ]

pskb_may_pull() can change skb->data, so we have to load ptr/optr at the
right place.

Signed-off-by: Haishuang Yan <yanhaishuang@cmss.chinamobile.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/l2tp/l2tp_ip.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *
 	struct l2tp_tunnel *tunnel = NULL;
 	int length;
 
-	/* Point to L2TP header */
-	optr = ptr = skb->data;
-
 	if (!pskb_may_pull(skb, 4))
 		goto discard;
 
+	/* Point to L2TP header */
+	optr = ptr = skb->data;
 	session_id = ntohl(*((__be32 *) ptr));
 	ptr += 4;
 
@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *
 		if (!pskb_may_pull(skb, length))
 			goto discard;
 
+		/* Point to L2TP header */
+		optr = ptr = skb->data;
+		ptr += 4;
 		pr_debug("%s: ip recv\n", tunnel->name);
 		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
 	}

[toc] | [prev] | [next] | [standalone]

#1381222 — [PATCH 3.14 06/37] drm/radeon: add a dpm quirk for sapphire Dual-X R7 370 2G D5

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit f971f2263deaa4a441e377b385c11aee0f3b3f9a upstream.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=94692

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/si_dpm.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_
 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
+	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 },
 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
 	{ 0, 0, 0, 0 },
 };

[toc] | [prev] | [next] | [standalone]

#1381224 — [PATCH 3.14 25/37] ip6_tunnel: set rtnl_link_ops before calling register_netdevice

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>

[ Upstream commit b6ee376cb0b7fb4e7e07d6cd248bd40436fb9ba6 ]

When creating an ip6tnl tunnel with ip tunnel, rtnl_link_ops is not set
before ip6_tnl_create2 is called. When register_netdevice is called, there
is no linkinfo attribute in the NEWLINK message because of that.

Setting rtnl_link_ops before calling register_netdevice fixes that.

Fixes: 0b112457229d ("ip6tnl: add support of link creation via rtnl")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv6/ip6_tunnel.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -273,12 +273,12 @@ static int ip6_tnl_create2(struct net_de
 
 	t = netdev_priv(dev);
 
+	dev->rtnl_link_ops = &ip6_link_ops;
 	err = register_netdevice(dev);
 	if (err < 0)
 		goto out;
 
 	strcpy(t->parms.name, dev->name);
-	dev->rtnl_link_ops = &ip6_link_ops;
 
 	dev_hold(dev);
 	ip6_tnl_link(ip6n, t);

[toc] | [prev] | [next] | [standalone]

#1381887

On Mon, Apr 18, 2016 at 11:25:32AM +0900, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.67 release.
> There are 37 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed Apr 20 02:23:24 UTC 2016.
> Anything received after that time might be too late.
> 
Build results:
	total: 129 pass: 129 fail: 0
Qemu test results:
	total: 88 pass: 88 fail: 0

Details are available at http://kerneltests.org/builders.

Guenter

[toc] | [prev] | [next] | [standalone]

#1381888

On 04/17/2016 08:25 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 3.14.67 release.
> There are 37 patches in this series, all will be posted as a response
> to this one.  If anyone has any issues with these being applied, please
> let me know.
> 
> Responses should be made by Wed Apr 20 02:23:24 UTC 2016.
> Anything received after that time might be too late.
> 
> The whole patch series can be found in one patch at:
> 	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.67-rc1.gz
> and the diffstat can be found below.
> 

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web