Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1381014 > unrolled thread

[PATCH 4.4 000/137] 4.4.8-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 000/137] 4.4.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 001/137] hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 066/137] ipv4: initialize flowi4_flags before calling fib_lookup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 100/137] mac80211: fix ibss scan parameters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 025/137] tunnel: Clear IPCB(skb)->opt before dst_link_failure called Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 040/137] udp6: fix UDP/IPv6 encap resubmit path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 107/137] iio: accel: bmc150: fix endianness when reading axes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 097/137] virtio: virtio 1.0 cs04 spec compliance for reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 072/137] rtnl: fix msg size calculation in if_nlmsg_size() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 046/137] bpf: avoid copying junk bytes in bpf_get_current_comm() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 094/137] [media] v4l: vsp1: Set the SRU CTRL0 register when starting the stream Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:40 +0200
    [PATCH 4.4 076/137] ipv6: l2tp: fix a potential issue in l2tp_ip6_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 120/137] perf: Cure event->pending_disable race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 128/137] ALSA: usb-audio: Skip volume controls triggers hangup on Dell USB Dock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 134/137] staging: android: ion: Set the length of the DMA sg entries in buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 118/137] arm64: replace read_lock to rcu lock in call_step_hook Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 122/137] ALSA: hda - Fixup speaker pass-through control for nid 0x14 on ALC225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 125/137] ALSA: hda/realtek - Enable the ALC292 dock fixup on the Thinkpad T460s Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 116/137] iommu: Dont overwrite domain pointer when there is no default_domain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 115/137] ext4: ignore quota mount options if the quota feature is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 119/137] perf: Do not double free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 121/137] mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 106/137] iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 105/137] usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 113/137] btrfs: fix crash/invalid memory access on fsync when using overlayfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 123/137] ALSA: hda - Fix headset support and noise on HP EliteBook 755 G2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 114/137] ext4: add lockdep annotations for i_data_sem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 136/137] [media] usbvision: fix crash on detecting device with invalid configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 110/137] sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 083/137] KVM: x86: Inject pending interrupt even if pending nmi exist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 131/137] Revert "x86/PCI: Dont alloc pcibios-irq when MSI is enabled" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 135/137] [media] usbvision fix overflow of interfaces array Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 130/137] HID: usbhid: fix inconsistent reset/resume/reset-resume behavior Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 108/137] iio: gyro: bmg160: fix buffer read values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 126/137] ALSA: usb-audio: Add a sample rate quirk for Phoenix Audio TMX320 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 084/137] KVM: x86: reduce default value of halt_poll_ns parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 127/137] ALSA: usb-audio: Add a quirk for Plantronics BT300 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 129/137] HID: wacom: fix Bamboo ONE oops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 081/137] USB: uas: Add a new NO_REPORT_LUNS quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 099/137] mac80211: avoid excessive stack usage in sta_info Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 124/137] ALSA: hda - fix front mic problem for a HP desktop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 132/137] Revert "PCI: Add helpers to manage pci_dev->irq and pci_dev->irq_managed" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 109/137] iio: gyro: bmg160: fix endianness when reading axes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 111/137] fs: add file_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 112/137] nfs: use file_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 117/137] Btrfs: fix file/data loss caused by fsync after rename and new inode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 04:50 +0200
    [PATCH 4.4 077/137] ip6_tunnel: set rtnl_link_ops before calling register_netdevice Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 096/137] rbd: use GFP_NOIO consistently for request allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 087/137] pinctrl: sh-pfc: only use dummy states for non-DT platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 073/137] tun, bpf: fix suspicious RCU usage in tun_{attach, detach}_filter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 089/137] pinctrl: nomadik: fix pull debug print inversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 086/137] pinctrl: pistachio: fix mfio84-89 function description and pinmux. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 078/137] ipv6: Count in extension headers in skb->network_header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 064/137] bonding: fix bond_get_stats() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 047/137] sh_eth: fix NULL pointer dereference in sh_eth_ring_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 048/137] sh_eth: advance rxdesc later in sh_eth_ring_format() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 102/137] mac80211: fix txq queue related crashes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 074/137] tuntap: restore default qdisc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 071/137] bridge: Allow set bridge ageing time when switchdev disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 095/137] pcmcia: db1xxx_ss: fix last irq_to_gpio user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 067/137] ppp: take reference on channels netns Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 103/137] usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 070/137] ipv6: udp: fix UDP_MIB_IGNOREDMULTI updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 088/137] pinctrl: sunxi: Fix A33 external interrupts not working Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 098/137] mac80211: properly deal with station hashtable insert errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 049/137] qlcnic: Remove unnecessary usage of atomic_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 093/137] [media] coda: fix error path in case of missing pdata on non-DT platform Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 051/137] macvtap: always pass ethernet header in linear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 065/137] ipv4: fix broadcast packets reception Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 091/137] [media] au0828: fix au0828_v4l2_close() dev_state race condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:00 +0200
    [PATCH 4.4 028/137] net: vrf: Remove direct access to skb->data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 045/137] packet: validate variable length ll headers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 056/137] net: Fix use after free in the recvmmsg exit path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 017/137] drm/udl: Use unlocked gem unreferencing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 063/137] net: bcmgenet: fix dma api length mismatch Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 039/137] usbnet: cleanup after bind() in probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 015/137] arm64: opcodes.h: Add arm big-endian config options before including arm header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 060/137] ppp: ensure file->private_data cant be overridden Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 057/137] mlx4: add missing braces in verify_qp_parameters Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 044/137] ax25: add link layer header validation function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 023/137] xen/events: Mask a moving irq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 029/137] net: qca_spi: Dont clear IFF_BROADCAST Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 042/137] ppp: release rtnl mutex when interface creation fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 024/137] tcp: convert cached rtt from usec to jiffies when feeding initial rto Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 055/137] ipv4: Dont do expensive useless work during inetdev destroy. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 013/137] libnvdimm, pfn: fix uuid validation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 062/137] qlge: Fix receive packets drop. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 054/137] bridge: allow zero ageing time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 026/137] ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 034/137] tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 053/137] rocker: set FDB cleanup timer according to lowest ageing time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 032/137] sctp: lack the check for ports in sctp_v6_cmp_addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:10 +0200
    [PATCH 4.4 010/137] mm: fix invalid node in alloc_migrate_target() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 008/137] ALSA: hda - Fix white noise on Asus N750JV headphone Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 002/137] PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 011/137] powerpc/mm: Fixup preempt underflow with huge pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 020/137] drm/radeon: add a dpm quirk for all R7 370 parts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 009/137] ALSA: hda - Apply fix for white noise on Asus N550JV, too Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 006/137] ALSA: timer: Use mod_timer() for rearming the system timer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:20 +0200
    [PATCH 4.4 137/137] Revert "usb: hub: do not clear BOS field during reset device" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-18 05:30 +0200
    Re: [PATCH 4.4 000/137] 4.4.8-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-04-18 18:40 +0200
    Re: [PATCH 4.4 000/137] 4.4.8-stable review Guenter Roeck <linux@roeck-us.net> - 2016-04-18 18:40 +0200
    Re: [PATCH 4.4 000/137] 4.4.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-04-19 08:00 +0200
      Re: [PATCH 4.4 000/137] 4.4.8-stable review Kevin Hilman <khilman@baylibre.com> - 2016-04-19 23:50 +0200

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

#1381107 — [PATCH 4.4 023/137] xen/events: Mask a moving irq

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Boris Ostrovsky <boris.ostrovsky@oracle.com>

commit ff1e22e7a638a0782f54f81a6c9cb139aca2da35 upstream.

Moving an unmasked irq may result in irq handler being invoked on both
source and target CPUs.

With 2-level this can happen as follows:

On source CPU:
        evtchn_2l_handle_events() ->
            generic_handle_irq() ->
                handle_edge_irq() ->
                   eoi_pirq():
                       irq_move_irq(data);

                       /***** WE ARE HERE *****/

                       if (VALID_EVTCHN(evtchn))
                           clear_evtchn(evtchn);

If at this moment target processor is handling an unrelated event in
evtchn_2l_handle_events()'s loop it may pick up our event since target's
cpu_evtchn_mask claims that this event belongs to it *and* the event is
unmasked and still pending. At the same time, source CPU will continue
executing its own handle_edge_irq().

With FIFO interrupt the scenario is similar: irq_move_irq() may result
in a EVTCHNOP_unmask hypercall which, in turn, may make the event
pending on the target CPU.

We can avoid this situation by moving and clearing the event while
keeping event masked.

Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/events/events_base.c |   28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *da
 	struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
 	int rc = 0;
 
-	irq_move_irq(data);
+	if (!VALID_EVTCHN(evtchn))
+		return;
 
-	if (VALID_EVTCHN(evtchn))
+	if (unlikely(irqd_is_setaffinity_pending(data))) {
+		int masked = test_and_set_mask(evtchn);
+
+		clear_evtchn(evtchn);
+
+		irq_move_masked_irq(data);
+
+		if (!masked)
+			unmask_evtchn(evtchn);
+	} else
 		clear_evtchn(evtchn);
 
 	if (pirq_needs_eoi(data->irq)) {
@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *
 {
 	int evtchn = evtchn_from_irq(data->irq);
 
-	irq_move_irq(data);
+	if (!VALID_EVTCHN(evtchn))
+		return;
 
-	if (VALID_EVTCHN(evtchn))
+	if (unlikely(irqd_is_setaffinity_pending(data))) {
+		int masked = test_and_set_mask(evtchn);
+
+		clear_evtchn(evtchn);
+
+		irq_move_masked_irq(data);
+
+		if (!masked)
+			unmask_evtchn(evtchn);
+	} else
 		clear_evtchn(evtchn);
 }
 

[toc] | [prev] | [next] | [standalone]

#1381108 — [PATCH 4.4 029/137] net: qca_spi: Dont clear IFF_BROADCAST

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Wahren <stefan.wahren@i2se.com>

[ Upstream commit 2b70bad23c89b121a3e4a00f8968d14ebb78887d ]

Currently qcaspi_netdev_setup accidentally clears IFF_BROADCAST.
So fix this by keeping the flags from ether_setup.

Reported-by: Michael Heimpold <michael.heimpold@i2se.com>
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000)
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qualcomm/qca_spi.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/net/ethernet/qualcomm/qca_spi.c
+++ b/drivers/net/ethernet/qualcomm/qca_spi.c
@@ -811,7 +811,6 @@ qcaspi_netdev_setup(struct net_device *d
 	dev->netdev_ops = &qcaspi_netdev_ops;
 	qcaspi_set_ethtool_ops(dev);
 	dev->watchdog_timeo = QCASPI_TX_TIMEOUT;
-	dev->flags = IFF_MULTICAST;
 	dev->tx_queue_len = 100;
 
 	qca = netdev_priv(dev);

[toc] | [prev] | [next] | [standalone]

#1381110 — [PATCH 4.4 042/137] ppp: release rtnl mutex when interface creation fails

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Guillaume Nault <g.nault@alphalink.fr>

[ Upstream commit 6faac63a6986f29ef39827f460edd3a5ba64ad5c ]

Add missing rtnl_unlock() in the error path of ppp_create_interface().

Fixes: 58a89ecaca53 ("ppp: fix lockdep splat in ppp_dev_uninit()")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ppp/ppp_generic.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2803,6 +2803,7 @@ static struct ppp *ppp_create_interface(
 
 out2:
 	mutex_unlock(&pn->all_ppp_mutex);
+	rtnl_unlock();
 	free_netdev(dev);
 out1:
 	*retp = ret;

[toc] | [prev] | [next] | [standalone]

#1381111 — [PATCH 4.4 024/137] tcp: convert cached rtt from usec to jiffies when feeding initial rto

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>

[ Upstream commit 9bdfb3b79e61c60e1a3e2dc05ad164528afa6b8a ]

Currently it's converted into msecs, thus HZ=1000 intact.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Fixes: 740b0f1841f6 ("tcp: switch rtt estimations to usec resolution")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/tcp_metrics.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -550,7 +550,7 @@ reset:
 	 */
 	if (crtt > tp->srtt_us) {
 		/* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
-		crtt /= 8 * USEC_PER_MSEC;
+		crtt /= 8 * USEC_PER_SEC / HZ;
 		inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
 	} else if (tp->srtt_us == 0) {
 		/* RFC6298: 5.7 We've failed to get a valid RTT sample from

[toc] | [prev] | [next] | [standalone]

#1381112 — [PATCH 4.4 055/137] ipv4: Dont do expensive useless work during inetdev destroy.

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: "David S. Miller" <davem@davemloft.net>

[ Upstream commit fbd40ea0180a2d328c5adc61414dc8bab9335ce2 ]

When an inetdev is destroyed, every address assigned to the interface
is removed.  And in this scenerio we do two pointless things which can
be very expensive if the number of assigned interfaces is large:

1) Address promotion.  We are deleting all addresses, so there is no
   point in doing this.

2) A full nf conntrack table purge for every address.  We only need to
   do this once, as is already caught by the existing
   masq_dev_notifier so masq_inet_event() can skip this.

Reported-by: Solar Designer <solar@openwall.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/devinet.c                          |    4 ++++
 net/ipv4/fib_frontend.c                     |    4 ++++
 net/ipv4/netfilter/nf_nat_masquerade_ipv4.c |   12 ++++++++++--
 3 files changed, 18 insertions(+), 2 deletions(-)

--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_dev
 
 	ASSERT_RTNL();
 
+	if (in_dev->dead)
+		goto no_promotions;
+
 	/* 1. Deleting primary ifaddr forces deletion all secondaries
 	 * unless alias promotion is set
 	 **/
@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_dev
 			fib_del_ifaddr(ifa, ifa1);
 	}
 
+no_promotions:
 	/* 2. Unlink it */
 
 	*ifap = ifa1->ifa_next;
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *if
 		subnet = 1;
 	}
 
+	if (in_dev->dead)
+		goto no_promotions;
+
 	/* Deletion is more complicated than add.
 	 * We should take care of not to delete too much :-)
 	 *
@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *if
 		}
 	}
 
+no_promotions:
 	if (!(ok & BRD_OK))
 		fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
 	if (subnet && ifa->ifa_prefixlen < 31) {
--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifi
 			   unsigned long event,
 			   void *ptr)
 {
-	struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
+	struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
 	struct netdev_notifier_info info;
 
-	netdev_notifier_info_init(&info, dev);
+	/* The masq_dev_notifier will catch the case of the device going
+	 * down.  So if the inetdev is dead and being destroyed we have
+	 * no work to do.  Otherwise this is an individual address removal
+	 * and we have to perform the flush.
+	 */
+	if (idev->dead)
+		return NOTIFY_DONE;
+
+	netdev_notifier_info_init(&info, idev->dev);
 	return masq_device_event(this, event, &info);
 }
 

[toc] | [prev] | [next] | [standalone]

#1381113 — [PATCH 4.4 013/137] libnvdimm, pfn: fix uuid validation

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Williams <dan.j.williams@intel.com>

commit e5670563f588ed1c0603819350c0f02cec23f5c5 upstream.

If we detect a namespace has a stale info block in the init path, we
should overwrite with the latest configuration.  In fact, we already
return -ENODEV when the parent uuid is invalid, the same should be done
for the 'self' uuid.  Otherwise we can get into a condition where
userspace is unable to reconfigure the pfn-device without directly /
manually invalidating the info block.

Reported-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvdimm/pfn_devs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -275,7 +275,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pf
 	} else {
 		/* from init we validate */
 		if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
-			return -EINVAL;
+			return -ENODEV;
 	}
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1381114 — [PATCH 4.4 062/137] qlge: Fix receive packets drop.

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Manish Chopra <manish.chopra@qlogic.com>

[ Upstream commit 2c9a266afefe137bff06bbe0fc48b4d3b3cb348c ]

When running small packets [length < 256 bytes] traffic, packets were
being dropped due to invalid data in those packets which were
delivered by the driver upto the stack. Using pci_dma_sync_single_for_cpu
ensures copying latest and updated data into skb from the receive buffer.

Signed-off-by: Sony Chacko <sony.chacko@qlogic.com>
Signed-off-by: Manish Chopra <manish.chopra@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlge/qlge_main.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct
 		return;
 	}
 	skb_reserve(new_skb, NET_IP_ALIGN);
+
+	pci_dma_sync_single_for_cpu(qdev->pdev,
+				    dma_unmap_addr(sbq_desc, mapaddr),
+				    dma_unmap_len(sbq_desc, maplen),
+				    PCI_DMA_FROMDEVICE);
+
 	memcpy(skb_put(new_skb, length), skb->data, length);
+
+	pci_dma_sync_single_for_device(qdev->pdev,
+				       dma_unmap_addr(sbq_desc, mapaddr),
+				       dma_unmap_len(sbq_desc, maplen),
+				       PCI_DMA_FROMDEVICE);
 	skb = new_skb;
 
 	/* Frame error, so drop the packet. */

[toc] | [prev] | [next] | [standalone]

#1381115 — [PATCH 4.4 054/137] bridge: allow zero ageing time

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Stephen Hemminger <shemming@brocade.com>

[ Upstream commit 4c656c13b254d598e83e586b7b4d36a2043dad85 ]

This fixes a regression in the bridge ageing time caused by:
commit c62987bbd8a1 ("bridge: push bridge setting ageing_time down to switchdev")

There are users of Linux bridge which use the feature that if ageing time
is set to 0 it causes entries to never expire. See:
  https://www.linuxfoundation.org/collaborate/workgroups/networking/bridge

For a pure software bridge, it is unnecessary for the code to have
arbitrary restrictions on what values are allowable.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/if_bridge.h |    4 ----
 net/bridge/br_stp.c       |   11 ++++++++---
 2 files changed, 8 insertions(+), 7 deletions(-)

--- a/include/linux/if_bridge.h
+++ b/include/linux/if_bridge.h
@@ -46,10 +46,6 @@ struct br_ip_list {
 #define BR_LEARNING_SYNC	BIT(9)
 #define BR_PROXYARP_WIFI	BIT(10)
 
-/* values as per ieee8021QBridgeFdbAgingTime */
-#define BR_MIN_AGEING_TIME	(10 * HZ)
-#define BR_MAX_AGEING_TIME	(1000000 * HZ)
-
 #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
 
 extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
--- a/net/bridge/br_stp.c
+++ b/net/bridge/br_stp.c
@@ -567,6 +567,14 @@ int br_set_max_age(struct net_bridge *br
 
 }
 
+/* Set time interval that dynamic forwarding entries live
+ * For pure software bridge, allow values outside the 802.1
+ * standard specification for special cases:
+ *  0 - entry never ages (all permanant)
+ *  1 - entry disappears (no persistance)
+ *
+ * Offloaded switch entries maybe more restrictive
+ */
 int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
 {
 	struct switchdev_attr attr = {
@@ -577,9 +585,6 @@ int br_set_ageing_time(struct net_bridge
 	unsigned long t = clock_t_to_jiffies(ageing_time);
 	int err;
 
-	if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME)
-		return -ERANGE;
-
 	err = switchdev_port_attr_set(br->dev, &attr);
 	if (err)
 		return err;

[toc] | [prev] | [next] | [standalone]

#1381116 — [PATCH 4.4 026/137] ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

[ Upstream commit a8c4a2522a0808c5c2143612909717d1115c40cf ]

Otherwise we break the contract with GSO to only pass CHECKSUM_PARTIAL
skbs down. This can easily happen with UDP+IPv4 sockets with the first
MSG_MORE write smaller than the MTU, second write is a sendfile.

Returning -EOPNOTSUPP lets the callers fall back into normal sendmsg path,
were we calculate the checksum manually during copying.

Commit d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked
sockets") started to exposes this bug.

Fixes: d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets")
Reported-by: Jiri Benc <jbenc@redhat.com>
Cc: Jiri Benc <jbenc@redhat.com>
Reported-by: Wakko Warner <wakko@animx.eu.org>
Cc: Wakko Warner <wakko@animx.eu.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1237,13 +1237,16 @@ ssize_t	ip_append_page(struct sock *sk,
 	if (!skb)
 		return -EINVAL;
 
-	cork->length += size;
 	if ((size + skb->len > mtu) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO)) {
+		if (skb->ip_summed != CHECKSUM_PARTIAL)
+			return -EOPNOTSUPP;
+
 		skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
 	}
+	cork->length += size;
 
 	while (size > 0) {
 		if (skb_is_gso(skb)) {

[toc] | [prev] | [next] | [standalone]

#1381118 — [PATCH 4.4 034/137] tipc: Revert "tipc: use existing sk_write_queue for outgoing packet chain"

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>

[ Upstream commit f214fc402967e1bc94ad7f39faa03db5813d6849 ]

reverts commit 94153e36e709e ("tipc: use existing sk_write_queue for
outgoing packet chain")

In Commit 94153e36e709e, we assume that we fill & empty the socket's
sk_write_queue within the same lock_sock() session.

This is not true if the link is congested. During congestion, the
socket lock is released while we wait for the congestion to cease.
This implementation causes a nullptr exception, if the user space
program has several threads accessing the same socket descriptor.

Consider two threads of the same program performing the following:
     Thread1                                  Thread2
--------------------                    ----------------------
Enter tipc_sendmsg()                    Enter tipc_sendmsg()
lock_sock()                             lock_sock()
Enter tipc_link_xmit(), ret=ELINKCONG   spin on socket lock..
sk_wait_event()                             :
release_sock()                          grab socket lock
    :                                   Enter tipc_link_xmit(), ret=0
    :                                   release_sock()
Wakeup after congestion
lock_sock()
skb = skb_peek(pktchain);
!! TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong;

In this case, the second thread transmits the buffers belonging to
both thread1 and thread2 successfully. When the first thread wakeup
after the congestion it assumes that the pktchain is intact and
operates on the skb's in it, which leads to the following exception:

[2102.439969] BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0
[2102.440074] IP: [<ffffffffa005f330>] __tipc_link_xmit+0x2b0/0x4d0 [tipc]
[2102.440074] PGD 3fa3f067 PUD 3fa6b067 PMD 0
[2102.440074] Oops: 0000 [#1] SMP
[2102.440074] CPU: 2 PID: 244 Comm: sender Not tainted 3.12.28 #1
[2102.440074] RIP: 0010:[<ffffffffa005f330>]  [<ffffffffa005f330>] __tipc_link_xmit+0x2b0/0x4d0 [tipc]
[...]
[2102.440074] Call Trace:
[2102.440074]  [<ffffffff8163f0b9>] ? schedule+0x29/0x70
[2102.440074]  [<ffffffffa006a756>] ? tipc_node_unlock+0x46/0x170 [tipc]
[2102.440074]  [<ffffffffa005f761>] tipc_link_xmit+0x51/0xf0 [tipc]
[2102.440074]  [<ffffffffa006d8ae>] tipc_send_stream+0x11e/0x4f0 [tipc]
[2102.440074]  [<ffffffff8106b150>] ? __wake_up_sync+0x20/0x20
[2102.440074]  [<ffffffffa006dc9c>] tipc_send_packet+0x1c/0x20 [tipc]
[2102.440074]  [<ffffffff81502478>] sock_sendmsg+0xa8/0xd0
[2102.440074]  [<ffffffff81507895>] ? release_sock+0x145/0x170
[2102.440074]  [<ffffffff815030d8>] ___sys_sendmsg+0x3d8/0x3e0
[2102.440074]  [<ffffffff816426ae>] ? _raw_spin_unlock+0xe/0x10
[2102.440074]  [<ffffffff81115c2a>] ? handle_mm_fault+0x6ca/0x9d0
[2102.440074]  [<ffffffff8107dd65>] ? set_next_entity+0x85/0xa0
[2102.440074]  [<ffffffff816426de>] ? _raw_spin_unlock_irq+0xe/0x20
[2102.440074]  [<ffffffff8107463c>] ? finish_task_switch+0x5c/0xc0
[2102.440074]  [<ffffffff8163ea8c>] ? __schedule+0x34c/0x950
[2102.440074]  [<ffffffff81504e12>] __sys_sendmsg+0x42/0x80
[2102.440074]  [<ffffffff81504e62>] SyS_sendmsg+0x12/0x20
[2102.440074]  [<ffffffff8164aed2>] system_call_fastpath+0x16/0x1b

In this commit, we maintain the skb list always in the stack.

Signed-off-by: Parthasarathy Bhuvaragan <parthasarathy.bhuvaragan@ericsson.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Acked-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/tipc/socket.c |   33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -673,7 +673,7 @@ static int tipc_sendmcast(struct  socket
 	struct tipc_sock *tsk = tipc_sk(sk);
 	struct net *net = sock_net(sk);
 	struct tipc_msg *mhdr = &tsk->phdr;
-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
+	struct sk_buff_head pktchain;
 	struct iov_iter save = msg->msg_iter;
 	uint mtu;
 	int rc;
@@ -687,14 +687,16 @@ static int tipc_sendmcast(struct  socket
 	msg_set_nameupper(mhdr, seq->upper);
 	msg_set_hdr_sz(mhdr, MCAST_H_SIZE);
 
+	skb_queue_head_init(&pktchain);
+
 new_mtu:
 	mtu = tipc_bcast_get_mtu(net);
-	rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, pktchain);
+	rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, &pktchain);
 	if (unlikely(rc < 0))
 		return rc;
 
 	do {
-		rc = tipc_bcast_xmit(net, pktchain);
+		rc = tipc_bcast_xmit(net, &pktchain);
 		if (likely(!rc))
 			return dsz;
 
@@ -704,7 +706,7 @@ new_mtu:
 			if (!rc)
 				continue;
 		}
-		__skb_queue_purge(pktchain);
+		__skb_queue_purge(&pktchain);
 		if (rc == -EMSGSIZE) {
 			msg->msg_iter = save;
 			goto new_mtu;
@@ -863,7 +865,7 @@ static int __tipc_sendmsg(struct socket
 	struct net *net = sock_net(sk);
 	struct tipc_msg *mhdr = &tsk->phdr;
 	u32 dnode, dport;
-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
+	struct sk_buff_head pktchain;
 	struct sk_buff *skb;
 	struct tipc_name_seq *seq;
 	struct iov_iter save;
@@ -924,17 +926,18 @@ static int __tipc_sendmsg(struct socket
 		msg_set_hdr_sz(mhdr, BASIC_H_SIZE);
 	}
 
+	skb_queue_head_init(&pktchain);
 	save = m->msg_iter;
 new_mtu:
 	mtu = tipc_node_get_mtu(net, dnode, tsk->portid);
-	rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, pktchain);
+	rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, &pktchain);
 	if (rc < 0)
 		return rc;
 
 	do {
-		skb = skb_peek(pktchain);
+		skb = skb_peek(&pktchain);
 		TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong;
-		rc = tipc_node_xmit(net, pktchain, dnode, tsk->portid);
+		rc = tipc_node_xmit(net, &pktchain, dnode, tsk->portid);
 		if (likely(!rc)) {
 			if (sock->state != SS_READY)
 				sock->state = SS_CONNECTING;
@@ -946,7 +949,7 @@ new_mtu:
 			if (!rc)
 				continue;
 		}
-		__skb_queue_purge(pktchain);
+		__skb_queue_purge(&pktchain);
 		if (rc == -EMSGSIZE) {
 			m->msg_iter = save;
 			goto new_mtu;
@@ -1016,7 +1019,7 @@ static int __tipc_send_stream(struct soc
 	struct net *net = sock_net(sk);
 	struct tipc_sock *tsk = tipc_sk(sk);
 	struct tipc_msg *mhdr = &tsk->phdr;
-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
+	struct sk_buff_head pktchain;
 	DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
 	u32 portid = tsk->portid;
 	int rc = -EINVAL;
@@ -1044,17 +1047,19 @@ static int __tipc_send_stream(struct soc
 
 	timeo = sock_sndtimeo(sk, m->msg_flags & MSG_DONTWAIT);
 	dnode = tsk_peer_node(tsk);
+	skb_queue_head_init(&pktchain);
 
 next:
 	save = m->msg_iter;
 	mtu = tsk->max_pkt;
 	send = min_t(uint, dsz - sent, TIPC_MAX_USER_MSG_SIZE);
-	rc = tipc_msg_build(mhdr, m, sent, send, mtu, pktchain);
+	rc = tipc_msg_build(mhdr, m, sent, send, mtu, &pktchain);
 	if (unlikely(rc < 0))
 		return rc;
+
 	do {
 		if (likely(!tsk_conn_cong(tsk))) {
-			rc = tipc_node_xmit(net, pktchain, dnode, portid);
+			rc = tipc_node_xmit(net, &pktchain, dnode, portid);
 			if (likely(!rc)) {
 				tsk->sent_unacked++;
 				sent += send;
@@ -1063,7 +1068,7 @@ next:
 				goto next;
 			}
 			if (rc == -EMSGSIZE) {
-				__skb_queue_purge(pktchain);
+				__skb_queue_purge(&pktchain);
 				tsk->max_pkt = tipc_node_get_mtu(net, dnode,
 								 portid);
 				m->msg_iter = save;
@@ -1077,7 +1082,7 @@ next:
 		rc = tipc_wait_for_sndpkt(sock, &timeo);
 	} while (!rc);
 
-	__skb_queue_purge(pktchain);
+	__skb_queue_purge(&pktchain);
 	return sent ? sent : rc;
 }
 

[toc] | [prev] | [next] | [standalone]

#1381119 — [PATCH 4.4 053/137] rocker: set FDB cleanup timer according to lowest ageing time

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ido Schimmel <idosch@mellanox.com>

[ Upstream commit 88de1cd457e5cb664d6d437e2ea4750d089165f5 ]

In rocker, ageing time is a per-port attribute, so the next time the FDB
cleanup timer fires should be set according to the lowest ageing time.

This will later allow us to delete the BR_MIN_AGEING_TIME macro, which was
added to guarantee minimum ageing time in the bridge layer, thereby breaking
existing behavior.

Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Acked-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/rocker/rocker.c |   10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

--- a/drivers/net/ethernet/rocker/rocker.c
+++ b/drivers/net/ethernet/rocker/rocker.c
@@ -239,6 +239,7 @@ struct rocker {
 	struct {
 		u64 id;
 	} hw;
+	unsigned long ageing_time;
 	spinlock_t cmd_ring_lock;		/* for cmd ring accesses */
 	struct rocker_dma_ring_info cmd_ring;
 	struct rocker_dma_ring_info event_ring;
@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned
 	struct rocker_port *rocker_port;
 	struct rocker_fdb_tbl_entry *entry;
 	struct hlist_node *tmp;
-	unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME;
+	unsigned long next_timer = jiffies + rocker->ageing_time;
 	unsigned long expires;
 	unsigned long lock_flags;
 	int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE |
@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_tim
 					  struct switchdev_trans *trans,
 					  u32 ageing_time)
 {
+	struct rocker *rocker = rocker_port->rocker;
+
 	if (!switchdev_trans_ph_prepare(trans)) {
 		rocker_port->ageing_time = clock_t_to_jiffies(ageing_time);
+		if (rocker_port->ageing_time < rocker->ageing_time)
+			rocker->ageing_time = rocker_port->ageing_time;
 		mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies);
 	}
 
@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *
 		goto err_init_tbls;
 	}
 
+	rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
 	setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup,
 		    (unsigned long) rocker);
 	mod_timer(&rocker->fdb_cleanup_timer, jiffies);
 
+	rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
+
 	err = rocker_probe_ports(rocker);
 	if (err) {
 		dev_err(&pdev->dev, "failed to probe ports\n");

[toc] | [prev] | [next] | [standalone]

#1381121 — [PATCH 4.4 032/137] sctp: lack the check for ports in sctp_v6_cmp_addr

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xin Long <lucien.xin@gmail.com>

[ Upstream commit 40b4f0fd74e46c017814618d67ec9127ff20f157 ]

As the member .cmp_addr of sctp_af_inet6, sctp_v6_cmp_addr should also check
the port of addresses, just like sctp_v4_cmp_addr, cause it's invoked by
sctp_cmp_addr_exact().

Now sctp_v6_cmp_addr just check the port when two addresses have different
family, and lack the port check for two ipv6 addresses. that will make
sctp_hash_cmp() cannot work well.

so fix it by adding ports comparison in sctp_v6_cmp_addr().

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/sctp/ipv6.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -526,6 +526,8 @@ static int sctp_v6_cmp_addr(const union
 		}
 		return 0;
 	}
+	if (addr1->v6.sin6_port != addr2->v6.sin6_port)
+		return 0;
 	if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
 		return 0;
 	/* If this is a linklocal address, compare the scope_id. */

[toc] | [prev] | [next] | [standalone]

#1381128 — [PATCH 4.4 010/137] mm: fix invalid node in alloc_migrate_target()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Xishi Qiu <qiuxishi@huawei.com>

commit 6f25a14a7053b69917e2ebea0d31dd444cd31fd5 upstream.

It is incorrect to use next_node to find a target node, it will return
MAX_NUMNODES or invalid node.  This will lead to crash in buddy system
allocation.

Fixes: c8721bbbdd36 ("mm: memory-hotplug: enable memory hotplug to handle hugepage")
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Laura Abbott" <lauraa@codeaurora.org>
Cc: Hui Zhu <zhuhui@xiaomi.com>
Cc: Wang Xiaoqiang <wangxq10@lzu.edu.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/page_isolation.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/mm/page_isolation.c
+++ b/mm/page_isolation.c
@@ -283,11 +283,11 @@ struct page *alloc_migrate_target(struct
 	 * now as a simple work-around, we use the next node for destination.
 	 */
 	if (PageHuge(page)) {
-		nodemask_t src = nodemask_of_node(page_to_nid(page));
-		nodemask_t dst;
-		nodes_complement(dst, src);
+		int node = next_online_node(page_to_nid(page));
+		if (node == MAX_NUMNODES)
+			node = first_online_node;
 		return alloc_huge_page_node(page_hstate(compound_head(page)),
-					    next_node(page_to_nid(page), dst));
+					    node);
 	}
 
 	if (PageHighMem(page))

[toc] | [prev] | [next] | [standalone]

#1381130 — [PATCH 4.4 008/137] ALSA: hda - Fix white noise on Asus N750JV headphone

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bobi Mihalca <bobbymihalca@touchtech.ro>

commit 9d4dc5840f93bcb002fa311693349deae7702bc5 upstream.

For reducing the noise from the headphone output on ASUS N750JV,
call the existing fixup, alc_fixup_auto_mute_via_amp(), additionally.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca <bobbymihalca@touchtech.ro>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6379,6 +6379,7 @@ enum {
 	ALC668_FIXUP_AUTO_MUTE,
 	ALC668_FIXUP_DELL_DISABLE_AAMIX,
 	ALC668_FIXUP_DELL_XPS13,
+	ALC662_FIXUP_ASUS_Nx50,
 };
 
 static const struct hda_fixup alc662_fixups[] = {
@@ -6619,6 +6620,12 @@ static const struct hda_fixup alc662_fix
 		.type = HDA_FIXUP_FUNC,
 		.v.func = alc_fixup_bass_chmap,
 	},
+	[ALC662_FIXUP_ASUS_Nx50] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc_fixup_auto_mute_via_amp,
+		.chained = true,
+		.chain_id = ALC662_FIXUP_BASS_1A
+	},
 };
 
 static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -6643,7 +6650,7 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
 	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
 	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
-	SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_BASS_1A),
+	SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
 	SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
 	SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
 	SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),

[toc] | [prev] | [next] | [standalone]

#1381134 — [PATCH 4.4 002/137] PKCS#7: pkcs7_validate_trust(): initialize the _trusted output argument

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolai Stange <nicstange@gmail.com>

commit e54358915d0a00399c11c2c23ae1be674cba188a upstream.

Despite what the DocBook comment to pkcs7_validate_trust() says, the
*_trusted argument is never set to false.

pkcs7_validate_trust() only positively sets *_trusted upon encountering
a trusted PKCS#7 SignedInfo block.

This is quite unfortunate since its callers, system_verify_data() for
example, depend on pkcs7_validate_trust() clearing *_trusted on non-trust.

Indeed, UBSAN splats when attempting to load the uninitialized local
variable 'trusted' from system_verify_data() in pkcs7_validate_trust():

  UBSAN: Undefined behaviour in crypto/asymmetric_keys/pkcs7_trust.c:194:14
  load of value 82 is not a valid value for type '_Bool'
  [...]
  Call Trace:
    [<ffffffff818c4d35>] dump_stack+0xbc/0x117
    [<ffffffff818c4c79>] ? _atomic_dec_and_lock+0x169/0x169
    [<ffffffff8194113b>] ubsan_epilogue+0xd/0x4e
    [<ffffffff819419fa>] __ubsan_handle_load_invalid_value+0x111/0x158
    [<ffffffff819418e9>] ? val_to_string.constprop.12+0xcf/0xcf
    [<ffffffff818334a4>] ? x509_request_asymmetric_key+0x114/0x370
    [<ffffffff814b83f0>] ? kfree+0x220/0x370
    [<ffffffff818312c2>] ? public_key_verify_signature_2+0x32/0x50
    [<ffffffff81835e04>] pkcs7_validate_trust+0x524/0x5f0
    [<ffffffff813c391a>] system_verify_data+0xca/0x170
    [<ffffffff813c3850>] ? top_trace_array+0x9b/0x9b
    [<ffffffff81510b29>] ? __vfs_read+0x279/0x3d0
    [<ffffffff8129372f>] mod_verify_sig+0x1ff/0x290
    [...]

The implication is that pkcs7_validate_trust() effectively grants trust
when it really shouldn't have.

Fix this by explicitly setting *_trusted to false at the very beginning
of pkcs7_validate_trust().

Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 crypto/asymmetric_keys/pkcs7_trust.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/crypto/asymmetric_keys/pkcs7_trust.c
+++ b/crypto/asymmetric_keys/pkcs7_trust.c
@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_me
 	int cached_ret = -ENOKEY;
 	int ret;
 
+	*_trusted = false;
+
 	for (p = pkcs7->certs; p; p = p->next)
 		p->seen = false;
 

[toc] | [prev] | [next] | [standalone]

#1381136 — [PATCH 4.4 011/137] powerpc/mm: Fixup preempt underflow with huge pages

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sebastian Siewior <bigeasy@linutronix.de>

commit 08a5bb2921e490939f78f38fd0d02858bb709942 upstream.

hugepd_free() used __get_cpu_var() once. Nothing ensured that the code
accessing the variable did not migrate from one CPU to another and soon
this was noticed by Tiejun Chen in 94b09d755462 ("powerpc/hugetlb:
Replace __get_cpu_var with get_cpu_var"). So we had it fixed.

Christoph Lameter was doing his __get_cpu_var() replaces and forgot
PowerPC. Then he noticed this and sent his fixed up batch again which
got applied as 69111bac42f5 ("powerpc: Replace __get_cpu_var uses").

The careful reader will noticed one little detail: get_cpu_var() got
replaced with this_cpu_ptr(). So now we have a put_cpu_var() which does
a preempt_enable() and nothing that does preempt_disable() so we
underflow the preempt counter.

Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Christoph Lameter <cl@linux.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/mm/hugetlbpage.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c
@@ -486,13 +486,13 @@ static void hugepd_free(struct mmu_gathe
 {
 	struct hugepd_freelist **batchp;
 
-	batchp = this_cpu_ptr(&hugepd_freelist_cur);
+	batchp = &get_cpu_var(hugepd_freelist_cur);
 
 	if (atomic_read(&tlb->mm->mm_users) < 2 ||
 	    cpumask_equal(mm_cpumask(tlb->mm),
 			  cpumask_of(smp_processor_id()))) {
 		kmem_cache_free(hugepte_cache, hugepte);
-        put_cpu_var(hugepd_freelist_cur);
+		put_cpu_var(hugepd_freelist_cur);
 		return;
 	}
 

[toc] | [prev] | [next] | [standalone]

#1381139 — [PATCH 4.4 020/137] drm/radeon: add a dpm quirk for all R7 370 parts

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Deucher <alexander.deucher@amd.com>

commit 0e5585dc870af947fab2af96a88c2d8b4270247c upstream.

Higher mclk values are not stable due to a bug somewhere.
Limit them for now.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/radeon/si_dpm.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -3010,6 +3010,10 @@ static void si_apply_state_adjust_rules(
 		}
 		++p;
 	}
+	/* limit mclk on all R7 370 parts for stability */
+	if (rdev->pdev->device == 0x6811 &&
+	    rdev->pdev->revision == 0x81)
+		max_mclk = 120000;
 
 	if (rps->vce_active) {
 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;

[toc] | [prev] | [next] | [standalone]

#1381140 — [PATCH 4.4 009/137] ALSA: hda - Apply fix for white noise on Asus N550JV, too

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bobi Mihalca <bobbymihalca@touchtech.ro>

commit 83a9efb5b8170b7cffef4f62656656e1d8ad2ccd upstream.

Apply the new fixup that is used for ASUS N750JV to another similar
model, N500JV, too, for reducing the headphone noise.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=115181
Signed-off-by: Bobi Mihalca <bobbymihalca@touchtech.ro>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6648,7 +6648,7 @@ static const struct snd_pci_quirk alc662
 	SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
 	SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
-	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
+	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
 	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
 	SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
 	SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),

[toc] | [prev] | [next] | [standalone]

#1381148 — [PATCH 4.4 006/137] ALSA: timer: Use mod_timer() for rearming the system timer

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit 4a07083ed613644c96c34a7dd2853dc5d7c70902 upstream.

ALSA system timer backend stops the timer via del_timer() without sync
and leaves del_timer_sync() at the close instead.  This is because of
the restriction by the design of ALSA timer: namely, the stop callback
may be called from the timer handler, and calling the sync shall lead
to a hangup.  However, this also triggers a kernel BUG() when the
timer is rearmed immediately after stopping without sync:
 kernel BUG at kernel/time/timer.c:966!
 Call Trace:
  <IRQ>
  [<ffffffff8239c94e>] snd_timer_s_start+0x13e/0x1a0
  [<ffffffff8239e1f4>] snd_timer_interrupt+0x504/0xec0
  [<ffffffff8122fca0>] ? debug_check_no_locks_freed+0x290/0x290
  [<ffffffff8239ec64>] snd_timer_s_function+0xb4/0x120
  [<ffffffff81296b72>] call_timer_fn+0x162/0x520
  [<ffffffff81296add>] ? call_timer_fn+0xcd/0x520
  [<ffffffff8239ebb0>] ? snd_timer_interrupt+0xec0/0xec0
  ....

It's the place where add_timer() checks the pending timer.  It's clear
that this may happen after the immediate restart without sync in our
cases.

So, the workaround here is just to use mod_timer() instead of
add_timer().  This looks like a band-aid fix, but it's a right move,
as snd_timer_interrupt() takes care of the continuous rearm of timer.

Reported-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -1051,8 +1051,8 @@ static int snd_timer_s_start(struct snd_
 		njiff += timer->sticks - priv->correction;
 		priv->correction = 0;
 	}
-	priv->last_expires = priv->tlist.expires = njiff;
-	add_timer(&priv->tlist);
+	priv->last_expires = njiff;
+	mod_timer(&priv->tlist, njiff);
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1381159 — [PATCH 4.4 137/137] Revert "usb: hub: do not clear BOS field during reset device"

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e5bdfd50d6f76077bf8441d130c606229e100d40 upstream.

This reverts commit d8f00cd685f5c8e0def8593e520a7fef12c22407.

Tony writes:

This upstream commit is causing an oops:
d8f00cd685f5 ("usb: hub: do not clear BOS field during reset device")

This patch has already been included in several -stable kernels.  Here
are the affected kernels:
4.5.0-rc4 (current git)
4.4.2
4.3.6 (currently in review)
4.1.18
3.18.27
3.14.61

How to reproduce the problem:
Boot kernel with slub debugging enabled (otherwise memory corruption
will cause random oopses later instead of immediately)
Plug in USB 3.0 disk to xhci USB 3.0 port
dd if=/dev/sdc of=/dev/null bs=65536
(where /dev/sdc is the USB 3.0 disk)
Unplug USB cable while dd is still going
Oops is immediate:

Reported-by: Tony Battersby <tonyb@cybernetics.com>
Cc: Du, Changbin <changbin.du@intel.com>
Cc: Roger Quadros <rogerq@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/hub.c |    8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -5392,6 +5392,7 @@ static int usb_reset_and_verify_device(s
 	}
 
 	bos = udev->bos;
+	udev->bos = NULL;
 
 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
 
@@ -5484,11 +5485,8 @@ done:
 	usb_set_usb2_hardware_lpm(udev, 1);
 	usb_unlocked_enable_lpm(udev);
 	usb_enable_ltm(udev);
-	/* release the new BOS descriptor allocated  by hub_port_init() */
-	if (udev->bos != bos) {
-		usb_release_bos_descriptor(udev);
-		udev->bos = bos;
-	}
+	usb_release_bos_descriptor(udev);
+	udev->bos = bos;
 	return 0;
 
 re_enumerate:

[toc] | [prev] | [next] | [standalone]

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

Back to top | Article view | linux.kernel

csiph-web