Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1392612 > unrolled thread

[PATCH 4.4 000/163] 4.4.9-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 000/163] 4.4.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 122/163] scsi_dh: force modular build if SCSI is a module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 138/163] ext4: fix NULL pointer dereference in ext4_mark_inode_dirty() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 053/163] powerpc: Update TM user feature bits in scan_features() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 100/163] workqueue: fix ghost PENDING flag while doing MQ IO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 048/163] crypto: sha1-mb - use corrcet pointer while completing jobs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 104/163] mm/huge_memory: replace VM_NO_THP VM_BUG_ON with actual VMA check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 054/163] nl80211: check netlink protocol in socket release notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 049/163] crypto: talitos - fix crash in talitos_cra_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 157/163] jme: Fix device PM wakeup API usage Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 126/163] misc: mic/scif: fix wrap around tests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 051/163] powerpc: scan_features() updates incorrect bits for REAL_LE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 099/163] x86/apic: Handle zero vector gracefully in clear_vector_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 039/163] drm/qxl: fix cursor position with non-zero hotspot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 069/163] drm/radeon: fix initial connector audio value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 115/163] regulator: core: Fix nested locking of supplies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 163/163] extcon: max77843: Use correct size for reading the interrupt register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 056/163] Input: gtco - fix crash on detecting device without endpoints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 091/163] ASoC: rt5640: Correct the digital interface data select Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 098/163] efi: Expose non-blocking set_variable() wrapper to efivars Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 052/163] powerpc: Update cpu_user_features2 in scan_features() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 140/163] mtd: spi-nor: remove micron_quad_enable() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 072/163] drm: Loongson-3 doesnt fully support wc memory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 007/163] ARM: mvebu: Correct unit address for linksys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 139/163] serial: sh-sci: Remove cpufreq notifier to fix crash/deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 047/163] crypto: ccp - Prevent information leakage on export Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 102/163] cgroup, cpuset: replace cpuset_post_attach_flush() with cgroup_subsys->post_attach callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 103/163] memcg: relocate charge moving from ->attach to ->post_attach Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 101/163] slub: clean up code for kmem cgroup support to kmem_cache_free_bulk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 105/163] numa: fix /proc/<pid>/numa_maps for THP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 106/163] mm: vmscan: reclaim highmem zone if buffer_heads is over limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 161/163] megaraid_sas: add missing curly braces in ioctl handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:30 +0200
    [PATCH 4.4 148/163] ext4: fix races between buffered IO and collapse / insert range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 149/163] ext4: fix races of writeback with punch hole and zero range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 092/163] [media] vb2-memops: Fix over allocation of frame vectors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 146/163] ext4: fix races between page faults and hole punching Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 137/163] x86/mm/kmmio: Fix mmiotrace for hugepages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 153/163] ARM: dts: armada-375: use armada-370-sata for SATA Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 125/163] misc/bmp085: Enable building as a module Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 123/163] fbdev: da8xx-fb: fix videomodes of lcd panels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 147/163] ext4: move unlocked dio protection from ext4_alloc_file_blocks() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 154/163] ARM: dts: pxa: fix dma engine node to pxa3xx-nand Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 155/163] bus: imx-weim: Take the status property value into account Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 158/163] unbreak allmodconfig KCONFIG_ALLCONFIG=... Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 151/163] ARM: prima2: always enable reset controller Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 145/163] perf stat: Document --detailed option Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 156/163] jme: Do not enable NIC WoL functions on S0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 152/163] ARM: EXYNOS: select THERMAL_OF Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 02:40 +0200
    [PATCH 4.4 032/163] ALSA: hda - add PCI ID for Intel Broxton-T Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:00 +0200
    [PATCH 4.4 143/163] perf hists browser: Only offer symbol scripting when a symbol is under the cursor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 135/163] perf evlist: Reference count the cpu and thread maps at set_maps() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 141/163] mtd: brcmnand: Fix v7.1 register offsets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:30 +0200
    [PATCH 4.4 111/163] [media] videobuf2-v4l2: Verify planes array in buffer dequeueing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 089/163] ASoC: ssm4567: Reset device before regcache_sync() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 046/163] iwlwifi: mvm: fix memory leak in paging Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 128/163] PM / Domains: Fix removal of a subdomain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 127/163] PM / OPP: Initialize u_volt_min/max to a valid value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 044/163] s390/pci: add extra padding to function measurement block Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 090/163] ASoC: dapm: Make sure we have a card when displaying component widgets Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 045/163] iwlwifi: pcie: lower the debug level for RSA semaphore access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 108/163] cgroup: make sure a parent css isnt freed before its children Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 109/163] USB: usbip: fix potential out-of-bounds write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 113/163] regulator: core: fix regulator_lock_supply regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 094/163] cxl: Keep IRQ mappings on context teardown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 116/163] locking/mcs: Fix mcs_spin_lock() ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 096/163] IB/security: Restrict use of the write() interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 087/163] EDAC: i7core, sb_edac: Dont return NOTIFY_BAD from mce_decoder callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 136/163] spi: rockchip: modify DMA max burst to 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 112/163] Revert "regulator: core: Fix nested locking of supplies" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 084/163] i2c: cpm: Fix build break due to incompatible pointer types Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 129/163] rtc: hym8563: fix invalid year calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 110/163] [media] videobuf2-core: Check user space planes array in dqbuf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 132/163] rtc: rx8025: remove rv8803 id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 107/163] mm/hwpoison: fix wrong num_poisoned_pages accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 133/163] rtc: max77686: Properly handle regmap_irq_get_virq() error code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 118/163] irqchip/sunxi-nmi: Fix error check of of_io_request_and_map() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 134/163] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 114/163] regulator: core: Ensure we lock all regulators Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 124/163] lib/mpi: Endianness fix Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 119/163] irqchip/mxs: Fix error check of of_io_request_and_map() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 095/163] IB/mlx5: Expose correct max_sge_rd limit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 093/163] [media] v4l2-dv-timings.h: fix polarity for 4k formats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 117/163] spi/rockchip: Make sure spi clk is on in rockchip_spi_set_cs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 120/163] regulator: s5m8767: fix get_register() error handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 131/163] rtc: ds1685: passing bogus values to irq_restore Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:40 +0200
    [PATCH 4.4 073/163] drm/nouveau/gr/gf100: select a stream master to fixup tfb offset queries Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 075/163] drm/dp/mst: Restore primary hub guid on resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 076/163] drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 010/163] assoc_array: dont call compare_object() on a node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 085/163] i2c: exynos5: Fix possible ABBA deadlock by keeping I2C clock prepared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 086/163] toshiba_acpi: Fix regression caused by hotkey enabling value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 006/163] ARM: dts: AM43x-epos: Fix clk parent for synctimer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 036/163] futex: Handle unlock_pi race gracefully Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 029/163] ALSA: hda - Dont trust the reported actual power state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 080/163] drm/amdkfd: uninitialized variable in dbgdev_wave_control_set_registers() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 071/163] drm/radeon: fix vertical bars appear on monitor (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 083/163] perf intel-pt: Fix segfault tracing transactions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 031/163] ALSA: hda - Keep powering up ADCs on Cirrus codecs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 081/163] drm/i915: Fixup the free space logic in ring_prepare Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 004/163] kvm: x86: do not leak guest xcr0 into host interrupt handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 030/163] ALSA: hda/realtek - Add ALC3234 headset mode for Optiplex 9020m Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 028/163] x86 EDAC, sb_edac.c: Repair damage introduced when "fixing" channel address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 026/163] arm64: Update PTE_RDONLY in set_pte_at() for PROT_NONE permission Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 027/163] x86/mm/xen: Suppress hugetlbfs in PV guests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 038/163] drm/nouveau/core: use vzalloc for allocating ramht Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 009/163] ARM: OMAP2+: hwmod: Fix updating of sysconfig register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 005/163] KVM: arm/arm64: Handle forward time correction gracefully Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 003/163] x86/mce: Avoid using object after free in genpool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 015/163] usb: hcd: out of bounds access in for_each_companion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 024/163] sched/cgroup: Fix/cleanup cgroup teardown/init Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 025/163] arm64: Honour !PTE_WRITE in set_pte_at() for kernel mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 037/163] futex: Acknowledge a new waiter in counter before plist Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 077/163] pwm: brcmstb: Fix check of devm_ioremap_resource() return code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 035/163] asm-generic/futex: Re-enable preemption in futex_atomic_cmpxchg_inatomic() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 043/163] cpufreq: intel_pstate: Fix processing for turbo activation ratio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 03:50 +0200
    [PATCH 4.4 017/163] dm cache metadata: fix READ_LOCK macros and cleanup WRITE_LOCK macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 022/163] dmaengine: hsu: correct use of channel status register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 019/163] lib: lz4: fixed zram with lz4 on big endian machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 014/163] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 011/163] usb: xhci: applying XHCI_PME_STUCK_QUIRK to Intel BXT B0 host Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 023/163] dmaengine: pxa_dma: fix the maximum requestor line Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 016/163] usb: gadget: f_fs: Fix use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 020/163] debugfs: Make automount point inodes permanently empty Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 018/163] dm cache metadata: fix cmd_read_lock() acquiring write lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 002/163] block: loop: fix filesystem corruption in case of aio/dio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 012/163] xhci: resume USB 3 roothub first Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 021/163] dmaengine: dw: fix master selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    [PATCH 4.4 013/163] usb: xhci: fix wild pointers in xhci_mem_cleanup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 04:00 +0200
    Re: [PATCH 4.4 000/163] 4.4.9-stable review Guenter Roeck <linux@roeck-us.net> - 2016-05-03 09:30 +0200
      Re: [PATCH 4.4 000/163] 4.4.9-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-05-03 20:30 +0200
    Re: [PATCH 4.4 000/163] 4.4.9-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-05-03 17:10 +0200

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7  Next page →

#1392879 — [PATCH 4.4 108/163] cgroup: make sure a parent css isnt freed before its children

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tejun Heo <tj@kernel.org>

commit 8bb5ef79bc0f4016ecf79e8dce6096a3c63603e4 upstream.

There are three subsystem callbacks in css shutdown path -
css_offline(), css_released() and css_free().  Except for
css_released(), cgroup core didn't guarantee the order of invocation.
css_offline() or css_free() could be called on a parent css before its
children.  This behavior is unexpected and led to bugs in cpu and
memory controller.

The previous patch updated ordering for css_offline() which fixes the
cpu controller issue.  While there currently isn't a known bug caused
by misordering of css_free() invocations, let's fix it too for
consistency.

css_free() ordering can be trivially fixed by moving putting of the
parent css below css_free() invocation.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/cgroup.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -4692,14 +4692,15 @@ static void css_free_work_fn(struct work
 
 	if (ss) {
 		/* css free path */
+		struct cgroup_subsys_state *parent = css->parent;
 		int id = css->id;
 
-		if (css->parent)
-			css_put(css->parent);
-
 		ss->css_free(css);
 		cgroup_idr_remove(&ss->css_idr, id);
 		cgroup_put(cgrp);
+
+		if (parent)
+			css_put(parent);
 	} else {
 		/* cgroup free path */
 		atomic_dec(&cgrp->root->nr_cgrps);

[toc] | [prev] | [next] | [standalone]

#1392880 — [PATCH 4.4 109/163] USB: usbip: fix potential out-of-bounds write

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ignat Korchagin <ignat.korchagin@gmail.com>

commit b348d7dddb6c4fbfc810b7a0626e8ec9e29f7cbb upstream.

Fix potential out-of-bounds write to urb->transfer_buffer
usbip handles network communication directly in the kernel. When receiving a
packet from its peer, usbip code parses headers according to protocol. As
part of this parsing urb->actual_length is filled. Since the input for
urb->actual_length comes from the network, it should be treated as untrusted.
Any entity controlling the network may put any value in the input and the
preallocated urb->transfer_buffer may not be large enough to hold the data.
Thus, the malicious entity is able to write arbitrary data to kernel memory.

Signed-off-by: Ignat Korchagin <ignat.korchagin@gmail.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/usbip/usbip_common.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

--- a/drivers/usb/usbip/usbip_common.c
+++ b/drivers/usb/usbip/usbip_common.c
@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device
 	if (!(size > 0))
 		return 0;
 
+	if (size > urb->transfer_buffer_length) {
+		/* should not happen, probably malicious packet */
+		if (ud->side == USBIP_STUB) {
+			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
+			return 0;
+		} else {
+			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+			return -EPIPE;
+		}
+	}
+
 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
 	if (ret != size) {
 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);

[toc] | [prev] | [next] | [standalone]

#1392881 — [PATCH 4.4 113/163] regulator: core: fix regulator_lock_supply regression

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit bb41897e38c53458a88b271f2fbcd905ee1f9584 upstream.

As noticed by Geert Uytterhoeven, my patch to avoid a harmless build warning
in regulator_lock_supply() was total crap and introduced a real bug:

> [ BUG: bad unlock balance detected! ]
> kworker/u4:0/6 is trying to release lock (&rdev->mutex) at:
> [<c0247b84>] regulator_set_voltage+0x38/0x50

we still lock the regulator supplies, but not the actual regulators,
so we are missing a lock, and the unlock is unbalanced.

This rectifies it by first locking the regulator device itself before
using the same loop as before to lock its supplies.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 716fec9d1965 ("[SUBMITTED] regulator: core: avoid unused variable warning")
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -140,7 +140,8 @@ static void regulator_lock_supply(struct
 {
 	int i;
 
-	for (i = 0; rdev->supply; rdev = rdev->supply->rdev, i++)
+	mutex_lock(&rdev->mutex);
+	for (i = 1; rdev->supply; rdev = rdev->supply->rdev, i++)
 		mutex_lock_nested(&rdev->mutex, i);
 }
 

[toc] | [prev] | [next] | [standalone]

#1392882 — [PATCH 4.4 094/163] cxl: Keep IRQ mappings on context teardown

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Neuling <mikey@neuling.org>

commit d6776bba44d9752f6cdf640046070e71ee4bba7b upstream.

Keep IRQ mappings on context teardown.  This won't leak IRQs as if we
allocate the mapping again, the generic code will give the same
mapping used last time.

Doing this works around a race in the generic code. Masking the
interrupt introduces a race which can crash the kernel or result in
IRQ that is never EOIed. The lost of EOI results in all subsequent
mappings to the same HW IRQ never receiving an interrupt.

We've seen this race with cxl test cases which are doing heavy context
startup and teardown at the same time as heavy interrupt load.

A fix to the generic code is being investigated also.

Signed-off-by: Michael Neuling <mikey@neuling.org>
Tested-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Tested-by: Vaibhav Jain <vaibhav@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/cxl/irq.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/misc/cxl/irq.c
+++ b/drivers/misc/cxl/irq.c
@@ -288,7 +288,6 @@ unsigned int cxl_map_irq(struct cxl *ada
 void cxl_unmap_irq(unsigned int virq, void *cookie)
 {
 	free_irq(virq, cookie);
-	irq_dispose_mapping(virq);
 }
 
 static int cxl_register_one_irq(struct cxl *adapter,

[toc] | [prev] | [next] | [standalone]

#1392883 — [PATCH 4.4 116/163] locking/mcs: Fix mcs_spin_lock() ordering

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Peter Zijlstra <peterz@infradead.org>

commit 920c720aa5aa3900a7f1689228fdfc2580a91e7e upstream.

Similar to commit b4b29f94856a ("locking/osq: Fix ordering of node
initialisation in osq_lock") the use of xchg_acquire() is
fundamentally broken with MCS like constructs.

Furthermore, it turns out we rely on the global transitivity of this
operation because the unlock path observes the pointer with a
READ_ONCE(), not an smp_load_acquire().

This is non-critical because the MCS code isn't actually used and
mostly serves as documentation, a stepping stone to the more complex
things we've build on top of the idea.

Reported-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Fixes: 3552a07a9c4a ("locking/mcs: Use acquire/release semantics")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/locking/mcs_spinlock.h |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/kernel/locking/mcs_spinlock.h
+++ b/kernel/locking/mcs_spinlock.h
@@ -67,7 +67,13 @@ void mcs_spin_lock(struct mcs_spinlock *
 	node->locked = 0;
 	node->next   = NULL;
 
-	prev = xchg_acquire(lock, node);
+	/*
+	 * We rely on the full barrier with global transitivity implied by the
+	 * below xchg() to order the initialization stores above against any
+	 * observation of @node. And to provide the ACQUIRE ordering associated
+	 * with a LOCK primitive.
+	 */
+	prev = xchg(lock, node);
 	if (likely(prev == NULL)) {
 		/*
 		 * Lock acquired, don't need to set node->locked to 1. Threads

[toc] | [prev] | [next] | [standalone]

#1392884 — [PATCH 4.4 096/163] IB/security: Restrict use of the write() interface

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>

commit e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 upstream.

The drivers/infiniband stack uses write() as a replacement for
bi-directional ioctl().  This is not safe. There are ways to
trigger write calls that result in the return structure that
is normally written to user space being shunted off to user
specified kernel memory instead.

For the immediate repair, detect and deny suspicious accesses to
the write API.

For long term, update the user space libraries and the kernel API
to something that doesn't present the same security vulnerabilities
(likely a structured ioctl() interface).

The impacted uAPI interfaces are generally only available if
hardware from drivers/infiniband is installed in the system.

Reported-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
[ Expanded check to all known write() entry points ]
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/ucm.c            |    4 ++++
 drivers/infiniband/core/ucma.c           |    3 +++
 drivers/infiniband/core/uverbs_main.c    |    5 +++++
 drivers/infiniband/hw/qib/qib_file_ops.c |    5 +++++
 drivers/staging/rdma/hfi1/TODO           |    2 +-
 drivers/staging/rdma/hfi1/file_ops.c     |    6 ++++++
 include/rdma/ib.h                        |   16 ++++++++++++++++
 7 files changed, 40 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/core/ucm.c
+++ b/drivers/infiniband/core/ucm.c
@@ -48,6 +48,7 @@
 
 #include <asm/uaccess.h>
 
+#include <rdma/ib.h>
 #include <rdma/ib_cm.h>
 #include <rdma/ib_user_cm.h>
 #include <rdma/ib_marshall.h>
@@ -1103,6 +1104,9 @@ static ssize_t ib_ucm_write(struct file
 	struct ib_ucm_cmd_hdr hdr;
 	ssize_t result;
 
+	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+		return -EACCES;
+
 	if (len < sizeof(hdr))
 		return -EINVAL;
 
--- a/drivers/infiniband/core/ucma.c
+++ b/drivers/infiniband/core/ucma.c
@@ -1574,6 +1574,9 @@ static ssize_t ucma_write(struct file *f
 	struct rdma_ucm_cmd_hdr hdr;
 	ssize_t ret;
 
+	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+		return -EACCES;
+
 	if (len < sizeof(hdr))
 		return -EINVAL;
 
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -48,6 +48,8 @@
 
 #include <asm/uaccess.h>
 
+#include <rdma/ib.h>
+
 #include "uverbs.h"
 
 MODULE_AUTHOR("Roland Dreier");
@@ -682,6 +684,9 @@ static ssize_t ib_uverbs_write(struct fi
 	int srcu_key;
 	ssize_t ret;
 
+	if (WARN_ON_ONCE(!ib_safe_file_access(filp)))
+		return -EACCES;
+
 	if (count < sizeof hdr)
 		return -EINVAL;
 
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -45,6 +45,8 @@
 #include <linux/export.h>
 #include <linux/uio.h>
 
+#include <rdma/ib.h>
+
 #include "qib.h"
 #include "qib_common.h"
 #include "qib_user_sdma.h"
@@ -2067,6 +2069,9 @@ static ssize_t qib_write(struct file *fp
 	ssize_t ret = 0;
 	void *dest;
 
+	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
+		return -EACCES;
+
 	if (count < sizeof(cmd.type)) {
 		ret = -EINVAL;
 		goto bail;
--- a/drivers/staging/rdma/hfi1/TODO
+++ b/drivers/staging/rdma/hfi1/TODO
@@ -3,4 +3,4 @@ July, 2015
 - Remove unneeded file entries in sysfs
 - Remove software processing of IB protocol and place in library for use
   by qib, ipath (if still present), hfi1, and eventually soft-roce
-
+- Replace incorrect uAPI
--- a/drivers/staging/rdma/hfi1/file_ops.c
+++ b/drivers/staging/rdma/hfi1/file_ops.c
@@ -62,6 +62,8 @@
 #include <linux/cred.h>
 #include <linux/uio.h>
 
+#include <rdma/ib.h>
+
 #include "hfi.h"
 #include "pio.h"
 #include "device.h"
@@ -214,6 +216,10 @@ static ssize_t hfi1_file_write(struct fi
 	int uctxt_required = 1;
 	int must_be_root = 0;
 
+	/* FIXME: This interface cannot continue out of staging */
+	if (WARN_ON_ONCE(!ib_safe_file_access(fp)))
+		return -EACCES;
+
 	if (count < sizeof(cmd)) {
 		ret = -EINVAL;
 		goto bail;
--- a/include/rdma/ib.h
+++ b/include/rdma/ib.h
@@ -34,6 +34,7 @@
 #define _RDMA_IB_H
 
 #include <linux/types.h>
+#include <linux/sched.h>
 
 struct ib_addr {
 	union {
@@ -86,4 +87,19 @@ struct sockaddr_ib {
 	__u64			sib_scope_id;
 };
 
+/*
+ * The IB interfaces that use write() as bi-directional ioctl() are
+ * fundamentally unsafe, since there are lots of ways to trigger "write()"
+ * calls from various contexts with elevated privileges. That includes the
+ * traditional suid executable error message writes, but also various kernel
+ * interfaces that can write to file descriptors.
+ *
+ * This function provides protection for the legacy API by restricting the
+ * calling context.
+ */
+static inline bool ib_safe_file_access(struct file *filp)
+{
+	return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS);
+}
+
 #endif /* _RDMA_IB_H */

[toc] | [prev] | [next] | [standalone]

#1392885 — [PATCH 4.4 087/163] EDAC: i7core, sb_edac: Dont return NOTIFY_BAD from mce_decoder callback

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Luck <tony.luck@intel.com>

commit c4fc1956fa31003bfbe4f597e359d751568e2954 upstream.

Both of these drivers can return NOTIFY_BAD, but this terminates
processing other callbacks that were registered later on the chain.
Since the driver did nothing to log the error it seems wrong to prevent
other interested parties from seeing it. E.g. neither of them had even
bothered to check the type of the error to see if it was a memory error
before the return NOTIFY_BAD.

Signed-off-by: Tony Luck <tony.luck@intel.com>
Acked-by: Aristeu Rozanski <aris@redhat.com>
Acked-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Cc: linux-edac <linux-edac@vger.kernel.org>
Link: http://lkml.kernel.org/r/72937355dd92318d2630979666063f8a2853495b.1461864507.git.tony.luck@intel.com
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/edac/i7core_edac.c |    2 +-
 drivers/edac/sb_edac.c     |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1866,7 +1866,7 @@ static int i7core_mce_check_error(struct
 
 	i7_dev = get_i7core_dev(mce->socketid);
 	if (!i7_dev)
-		return NOTIFY_BAD;
+		return NOTIFY_DONE;
 
 	mci = i7_dev->mci;
 	pvt = mci->pvt_info;
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -2254,7 +2254,7 @@ static int sbridge_mce_check_error(struc
 
 	mci = get_mci_for_node_id(mce->socketid);
 	if (!mci)
-		return NOTIFY_BAD;
+		return NOTIFY_DONE;
 	pvt = mci->pvt_info;
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1392886 — [PATCH 4.4 136/163] spi: rockchip: modify DMA max burst to 1

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Addy Ke <addy.ke@rock-chips.com>

commit 80abf8880cc6e1594c11b7c417f22dde60e25312 upstream.

Generic dma controller on Rockchips' platform cannot support
DMAFLUSHP instruction which make dma to flush the req of non-aligned
or non-multiple of what we need. That will cause an unrecoverable
dma bus error. The saftest way is to set dma max burst to 1.

Signed-off-by: Addy ke <addy.ke@rock-chips.com>
Fixes: 64e36824b32b06 ("spi/rockchip: add driver for Rockchip...")
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
cc: Heiko Stuebner <heiko@sntech.de>
cc: Olof Johansson <olof@lixom.net>
cc: Doug Anderson <dianders@chromium.org>
cc: Sonny Rao <sonnyrao@chromium.org>
Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Caesar Wang <wxt@rock-chips.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/spi/spi-rockchip.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -199,6 +199,7 @@ struct rockchip_spi {
 	struct sg_table rx_sg;
 	struct rockchip_spi_dma_data dma_rx;
 	struct rockchip_spi_dma_data dma_tx;
+	struct dma_slave_caps dma_caps;
 };
 
 static inline void spi_enable_chip(struct rockchip_spi *rs, int enable)
@@ -454,7 +455,10 @@ static void rockchip_spi_prepare_dma(str
 		rxconf.direction = rs->dma_rx.direction;
 		rxconf.src_addr = rs->dma_rx.addr;
 		rxconf.src_addr_width = rs->n_bytes;
-		rxconf.src_maxburst = rs->n_bytes;
+		if (rs->dma_caps.max_burst > 4)
+			rxconf.src_maxburst = 4;
+		else
+			rxconf.src_maxburst = 1;
 		dmaengine_slave_config(rs->dma_rx.ch, &rxconf);
 
 		rxdesc = dmaengine_prep_slave_sg(
@@ -471,7 +475,10 @@ static void rockchip_spi_prepare_dma(str
 		txconf.direction = rs->dma_tx.direction;
 		txconf.dst_addr = rs->dma_tx.addr;
 		txconf.dst_addr_width = rs->n_bytes;
-		txconf.dst_maxburst = rs->n_bytes;
+		if (rs->dma_caps.max_burst > 4)
+			txconf.dst_maxburst = 4;
+		else
+			txconf.dst_maxburst = 1;
 		dmaengine_slave_config(rs->dma_tx.ch, &txconf);
 
 		txdesc = dmaengine_prep_slave_sg(
@@ -735,6 +742,7 @@ static int rockchip_spi_probe(struct pla
 	}
 
 	if (rs->dma_tx.ch && rs->dma_rx.ch) {
+		dma_get_slave_caps(rs->dma_rx.ch, &(rs->dma_caps));
 		rs->dma_tx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_TXDR);
 		rs->dma_rx.addr = (dma_addr_t)(mem->start + ROCKCHIP_SPI_RXDR);
 		rs->dma_tx.direction = DMA_MEM_TO_DEV;

[toc] | [prev] | [next] | [standalone]

#1392887 — [PATCH 4.4 112/163] Revert "regulator: core: Fix nested locking of supplies"

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

This reverts commit b1999fa6e8145305a6c8bda30ea20783717708e6 which was
commit 70a7fb80e85ae7f78f8e90cec3fbd862ea6a4d4b upstream.

It causes run-time breakage in the 4.4-stable tree and more patches are
needed to be applied first before this one in order to resolve the
issue.

Reported-by: Guenter Roeck <linux@roeck-us.net>
Cc: Mark Brown <broonie@kernel.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Thierry Reding <treding@nvidia.com>
Cc: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |   10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -132,14 +132,6 @@ static bool have_full_constraints(void)
 	return has_full_constraints || of_have_populated_dt();
 }
 
-static inline struct regulator_dev *rdev_get_supply(struct regulator_dev *rdev)
-{
-	if (rdev && rdev->supply)
-		return rdev->supply->rdev;
-
-	return NULL;
-}
-
 /**
  * regulator_lock_supply - lock a regulator and its supplies
  * @rdev:         regulator source
@@ -148,7 +140,7 @@ static void regulator_lock_supply(struct
 {
 	int i;
 
-	for (i = 0; rdev->supply; rdev = rdev_get_supply(rdev), i++)
+	for (i = 0; rdev->supply; rdev = rdev->supply->rdev, i++)
 		mutex_lock_nested(&rdev->mutex, i);
 }
 

[toc] | [prev] | [next] | [standalone]

#1392888 — [PATCH 4.4 084/163] i2c: cpm: Fix build break due to incompatible pointer types

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <mpe@ellerman.id.au>

commit 609d5a1b2b35bb62b4b3750396e55453160c2a17 upstream.

Since commit ea8daa7b9784 ("kbuild: Add option to turn incompatible
pointer check into error"), assignments from an incompatible pointer
types have become a hard error, eg:

  drivers/i2c/busses/i2c-cpm.c:545:91: error: passing argument 3 of
  'dma_alloc_coherent' from incompatible pointer type

Fix the build break by converting txdma & rxdma to dma_addr_t.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Fixes: ea8daa7b9784
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/i2c/busses/i2c-cpm.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -116,8 +116,8 @@ struct cpm_i2c {
 	cbd_t __iomem *rbase;
 	u_char *txbuf[CPM_MAXBD];
 	u_char *rxbuf[CPM_MAXBD];
-	u32 txdma[CPM_MAXBD];
-	u32 rxdma[CPM_MAXBD];
+	dma_addr_t txdma[CPM_MAXBD];
+	dma_addr_t rxdma[CPM_MAXBD];
 };
 
 static irqreturn_t cpm_i2c_interrupt(int irq, void *dev_id)

[toc] | [prev] | [next] | [standalone]

#1392889 — [PATCH 4.4 129/163] rtc: hym8563: fix invalid year calculation

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Kochetkov <al.kochet@gmail.com>

commit d5861262210067fc01b2fb4f7af2fd85a3453f15 upstream.

Year field must be in BCD format, according to
hym8563 datasheet.

Due to the bug year 2016 became 2010.

Fixes: dcaf03849352 ("rtc: add hym8563 rtc-driver")
Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-hym8563.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/rtc/rtc-hym8563.c
+++ b/drivers/rtc/rtc-hym8563.c
@@ -144,7 +144,7 @@ static int hym8563_rtc_set_time(struct d
 	 * it does not seem to carry it over a subsequent write/read.
 	 * So we'll limit ourself to 100 years, starting at 2000 for now.
 	 */
-	buf[6] = tm->tm_year - 100;
+	buf[6] = bin2bcd(tm->tm_year - 100);
 
 	/*
 	 * CTL1 only contains TEST-mode bits apart from stop,

[toc] | [prev] | [next] | [standalone]

#1392890 — [PATCH 4.4 110/163] [media] videobuf2-core: Check user space planes array in dqbuf

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sakari Ailus <sakari.ailus@linux.intel.com>

commit e7e0c3e26587749b62d17b9dd0532874186c77f7 upstream.

The number of planes in videobuf2 is specific to a buffer. In order to
verify that the planes array provided by the user is long enough, a new
vb2_buf_op is required.

Call __verify_planes_array() when the dequeued buffer is known. Return an
error to the caller if there was one, otherwise remove the buffer from the
done list.

Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Acked-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/v4l2-core/videobuf2-core.c |   10 +++++-----
 include/media/videobuf2-core.h           |    1 +
 2 files changed, 6 insertions(+), 5 deletions(-)

--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -1502,7 +1502,7 @@ static int __vb2_wait_for_done_vb(struct
  * Will sleep if required for nonblocking == false.
  */
 static int __vb2_get_done_vb(struct vb2_queue *q, struct vb2_buffer **vb,
-				int nonblocking)
+			     void *pb, int nonblocking)
 {
 	unsigned long flags;
 	int ret;
@@ -1523,10 +1523,10 @@ static int __vb2_get_done_vb(struct vb2_
 	/*
 	 * Only remove the buffer from done_list if v4l2_buffer can handle all
 	 * the planes.
-	 * Verifying planes is NOT necessary since it already has been checked
-	 * before the buffer is queued/prepared. So it can never fail.
 	 */
-	list_del(&(*vb)->done_entry);
+	ret = call_bufop(q, verify_planes_array, *vb, pb);
+	if (!ret)
+		list_del(&(*vb)->done_entry);
 	spin_unlock_irqrestore(&q->done_lock, flags);
 
 	return ret;
@@ -1604,7 +1604,7 @@ int vb2_core_dqbuf(struct vb2_queue *q,
 	struct vb2_buffer *vb = NULL;
 	int ret;
 
-	ret = __vb2_get_done_vb(q, &vb, nonblocking);
+	ret = __vb2_get_done_vb(q, &vb, pb, nonblocking);
 	if (ret < 0)
 		return ret;
 
--- a/include/media/videobuf2-core.h
+++ b/include/media/videobuf2-core.h
@@ -363,6 +363,7 @@ struct vb2_ops {
 };
 
 struct vb2_buf_ops {
+	int (*verify_planes_array)(struct vb2_buffer *vb, const void *pb);
 	int (*fill_user_buffer)(struct vb2_buffer *vb, void *pb);
 	int (*fill_vb2_buffer)(struct vb2_buffer *vb, const void *pb,
 				struct vb2_plane *planes);

[toc] | [prev] | [next] | [standalone]

#1392891 — [PATCH 4.4 132/163] rtc: rx8025: remove rv8803 id

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexandre Belloni <alexandre.belloni@free-electrons.com>

commit aaa3cee5deffa28415a6e1852c5afae0f5d210e2 upstream.

The rv8803 has its own driver that should be used. Remove its id from
the rx8025 driver.

Fixes: b1f9d790b59dc04f8813a49a92ddd8651770ffee
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-rx8025.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/rtc/rtc-rx8025.c
+++ b/drivers/rtc/rtc-rx8025.c
@@ -65,7 +65,6 @@
 
 static const struct i2c_device_id rx8025_id[] = {
 	{ "rx8025", 0 },
-	{ "rv8803", 1 },
 	{ }
 };
 MODULE_DEVICE_TABLE(i2c, rx8025_id);

[toc] | [prev] | [next] | [standalone]

#1392892 — [PATCH 4.4 107/163] mm/hwpoison: fix wrong num_poisoned_pages accounting

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Minchan Kim <minchan@kernel.org>

commit d7e69488bd04de165667f6bc741c1c0ec6042ab9 upstream.

Currently, migration code increses num_poisoned_pages on *failed*
migration page as well as successfully migrated one at the trial of
memory-failure.  It will make the stat wrong.  As well, it marks the
page as PG_HWPoison even if the migration trial failed.  It would mean
we cannot recover the corrupted page using memory-failure facility.

This patches fixes it.

Signed-off-by: Minchan Kim <minchan@kernel.org>
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 mm/migrate.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -963,7 +963,13 @@ out:
 		dec_zone_page_state(page, NR_ISOLATED_ANON +
 				page_is_file_cache(page));
 		/* Soft-offlined page shouldn't go through lru cache list */
-		if (reason == MR_MEMORY_FAILURE) {
+		if (reason == MR_MEMORY_FAILURE && rc == MIGRATEPAGE_SUCCESS) {
+			/*
+			 * With this release, we free successfully migrated
+			 * page and set PG_HWPoison on just freed page
+			 * intentionally. Although it's rather weird, it's how
+			 * HWPoison flag works at the moment.
+			 */
 			put_page(page);
 			if (!test_set_page_hwpoison(page))
 				num_poisoned_pages_inc();

[toc] | [prev] | [next] | [standalone]

#1392893 — [PATCH 4.4 133/163] rtc: max77686: Properly handle regmap_irq_get_virq() error code

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Krzysztof Kozlowski <k.kozlowski@samsung.com>

commit fb166ba1d7f0a662f7332f4ff660a0d6f4d76915 upstream.

The regmap_irq_get_virq() can return 0 or -EINVAL in error conditions
but driver checked only for value of 0.

This could lead to a cast of -EINVAL to an unsigned int used as a
interrupt number for devm_request_threaded_irq(). Although this is not
yet fatal (devm_request_threaded_irq() will just fail with -EINVAL) but
might be a misleading when diagnosing errors.

Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Fixes: 6f1c1e71d933 ("mfd: max77686: Convert to use regmap_irq")
Reviewed-by: Javier Martinez Canillas <javier@osg.samsung.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/rtc/rtc-max77686.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/rtc/rtc-max77686.c
+++ b/drivers/rtc/rtc-max77686.c
@@ -465,7 +465,7 @@ static int max77686_rtc_probe(struct pla
 
 	info->virq = regmap_irq_get_virq(max77686->rtc_irq_data,
 					 MAX77686_RTCIRQ_RTCA1);
-	if (!info->virq) {
+	if (info->virq <= 0) {
 		ret = -ENXIO;
 		goto err_rtc;
 	}

[toc] | [prev] | [next] | [standalone]

#1392894 — [PATCH 4.4 118/163] irqchip/sunxi-nmi: Fix error check of of_io_request_and_map()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vladimir Zapolskiy <vz@mleia.com>

commit cfe199afefe6201e998ddc07102fc1fdb55f196c upstream.

The of_io_request_and_map() returns a valid pointer in iomem region or
ERR_PTR(), check for NULL always fails and may cause a NULL pointer
dereference on error path.

Fixes: 0e841b04c829 ("irqchip/sunxi-nmi: Switch to of_io_request_and_map() from of_iomap()")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Chen-Yu Tsai <wens@csie.org>
Cc: Maxime Ripard <maxime.ripard@free-electrons.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1457486489-10189-1-git-send-email-vz@mleia.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/irqchip/irq-sunxi-nmi.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/irqchip/irq-sunxi-nmi.c
+++ b/drivers/irqchip/irq-sunxi-nmi.c
@@ -154,9 +154,9 @@ static int __init sunxi_sc_nmi_irq_init(
 
 	gc = irq_get_domain_generic_chip(domain, 0);
 	gc->reg_base = of_io_request_and_map(node, 0, of_node_full_name(node));
-	if (!gc->reg_base) {
+	if (IS_ERR(gc->reg_base)) {
 		pr_err("unable to map resource\n");
-		ret = -ENOMEM;
+		ret = PTR_ERR(gc->reg_base);
 		goto fail_irqd_remove;
 	}
 

[toc] | [prev] | [next] | [standalone]

#1392895 — [PATCH 4.4 134/163] drivers/misc/ad525x_dpot: AD5274 fix RDAC read back errors

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Hennerich <michael.hennerich@analog.com>

commit f3df53e4d70b5736368a8fe8aa1bb70c1cb1f577 upstream.

Fix RDAC read back errors caused by a typo. Value must shift by 2.

Fixes: a4bd394956f2 ("drivers/misc/ad525x_dpot.c: new features")
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/misc/ad525x_dpot.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -216,7 +216,7 @@ static s32 dpot_read_i2c(struct dpot_dat
 			 */
 			value = swab16(value);
 
-			if (dpot->uid == DPOT_UID(AD5271_ID))
+			if (dpot->uid == DPOT_UID(AD5274_ID))
 				value = value >> 2;
 		return value;
 	default:

[toc] | [prev] | [next] | [standalone]

#1392897 — [PATCH 4.4 114/163] regulator: core: Ensure we lock all regulators

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Brown <broonie@kernel.org>

commit 49a6bb7a1c0963f260e4b0dcc2c0e56ec65a28b2 upstream.

The latest workaround for the lockdep interface's not using the second
argument of mutex_lock_nested() changed the loop missed locking the last
regulator due to a thinko with the loop termination condition exiting
one regulator too soon.

Reported-by: Tyler Baker <tyler.baker@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/regulator/core.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -141,7 +141,7 @@ static void regulator_lock_supply(struct
 	int i;
 
 	mutex_lock(&rdev->mutex);
-	for (i = 1; rdev->supply; rdev = rdev->supply->rdev, i++)
+	for (i = 1; rdev; rdev = rdev->supply->rdev, i++)
 		mutex_lock_nested(&rdev->mutex, i);
 }
 

[toc] | [prev] | [next] | [standalone]

#1392898 — [PATCH 4.4 124/163] lib/mpi: Endianness fix

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Marek <mmarek@suse.com>

commit 3ee0cb5fb5eea2110db1b5cb7f67029b7be8a376 upstream.

The limbs are integers in the host endianness, so we can't simply
iterate over the individual bytes. The current code happens to work on
little-endian, because the order of the limbs in the MPI array is the
same as the order of the bytes in each limb, but it breaks on
big-endian.

Fixes: 0f74fbf77d45 ("MPI: Fix mpi_read_buffer")
Signed-off-by: Michal Marek <mmarek@suse.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/mpi/mpicoder.c |   39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -128,6 +128,23 @@ leave:
 }
 EXPORT_SYMBOL_GPL(mpi_read_from_buffer);
 
+static int count_lzeros(MPI a)
+{
+	mpi_limb_t alimb;
+	int i, lzeros = 0;
+
+	for (i = a->nlimbs - 1; i >= 0; i--) {
+		alimb = a->d[i];
+		if (alimb == 0) {
+			lzeros += sizeof(mpi_limb_t);
+		} else {
+			lzeros += count_leading_zeros(alimb) / 8;
+			break;
+		}
+	}
+	return lzeros;
+}
+
 /**
  * mpi_read_buffer() - read MPI to a bufer provided by user (msb first)
  *
@@ -146,7 +163,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf,
 	uint8_t *p;
 	mpi_limb_t alimb;
 	unsigned int n = mpi_get_size(a);
-	int i, lzeros = 0;
+	int i, lzeros;
 
 	if (buf_len < n || !buf || !nbytes)
 		return -EINVAL;
@@ -154,14 +171,7 @@ int mpi_read_buffer(MPI a, uint8_t *buf,
 	if (sign)
 		*sign = a->sign;
 
-	p = (void *)&a->d[a->nlimbs] - 1;
-
-	for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
-		if (!*p)
-			lzeros++;
-		else
-			break;
-	}
+	lzeros = count_lzeros(a);
 
 	p = buf;
 	*nbytes = n - lzeros;
@@ -343,7 +353,7 @@ int mpi_write_to_sgl(MPI a, struct scatt
 	u8 *p, *p2;
 	mpi_limb_t alimb, alimb2;
 	unsigned int n = mpi_get_size(a);
-	int i, x, y = 0, lzeros = 0, buf_len;
+	int i, x, y = 0, lzeros, buf_len;
 
 	if (!nbytes || *nbytes < n)
 		return -EINVAL;
@@ -351,14 +361,7 @@ int mpi_write_to_sgl(MPI a, struct scatt
 	if (sign)
 		*sign = a->sign;
 
-	p = (void *)&a->d[a->nlimbs] - 1;
-
-	for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
-		if (!*p)
-			lzeros++;
-		else
-			break;
-	}
+	lzeros = count_lzeros(a);
 
 	*nbytes = n - lzeros;
 	buf_len = sgl->length;

[toc] | [prev] | [next] | [standalone]

#1392899 — [PATCH 4.4 119/163] irqchip/mxs: Fix error check of of_io_request_and_map()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vladimir Zapolskiy <vz@mleia.com>

commit edf8fcdc6b254236be005851af35ea5e826e7e09 upstream.

The of_io_request_and_map() returns a valid pointer in iomem region or
ERR_PTR(), check for NULL always fails and may cause a NULL pointer
dereference on error path.

Fixes: 25e34b44313b ("irqchip/mxs: Prepare driver for hardware with different offsets")
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Oleksij Rempel <linux@rempel-privat.de>
Cc: Sascha Hauer <kernel@pengutronix.de>
Cc: Shawn Guo <shawnguo@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1457486500-10237-1-git-send-email-vz@mleia.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/irqchip/irq-mxs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/irqchip/irq-mxs.c
+++ b/drivers/irqchip/irq-mxs.c
@@ -183,7 +183,7 @@ static void __iomem * __init icoll_init_
 	void __iomem *icoll_base;
 
 	icoll_base = of_io_request_and_map(np, 0, np->name);
-	if (!icoll_base)
+	if (IS_ERR(icoll_base))
 		panic("%s: unable to map resource", np->full_name);
 	return icoll_base;
 }

[toc] | [prev] | [next] | [standalone]

Page 4 of 7 — ← Prev page 1 2 3 [4] 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web