Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1462038 > unrolled thread

[PATCH 3.2 00/94] 3.2.82-rc1 review

Started byBen Hutchings <ben@decadent.org.uk>
First post2016-08-14 13:50 +0200
Last post2016-08-14 20:20 +0200
Articles 20 on this page of 49 — 2 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.2 00/94] 3.2.82-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 13:50 +0200
    [PATCH 3.2 26/94] fs/cifs: correctly to anonymous authentication  for the LANMAN authentication Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 13:50 +0200
    [PATCH 3.2 23/94] x86/PCI: Mark Broadwell-EP Home Agent 1 as  having non-compliant BARs Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 13:50 +0200
    [PATCH 3.2 93/94] tcp: make challenge acks less predictable Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 13:50 +0200
    [PATCH 3.2 62/94] UBIFS: Implement ->migratepage() Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 42/94] x86, build: copy ldlinux.c32 to image.iso Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 54/94] kvm: Fix irq route entries exceeding  KVM_MAX_IRQ_ROUTES Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 13/94] USB: serial: option: add even more ZTE device ids Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 35/94] Input: xpad - prevent spurious input from wired  Xbox 360 controllers Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 43/94] fix d_walk()/non-delayed __d_free() race Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 18/94] powerpc/mm/hash64: Factor out hash preload  psize check Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:00 +0200
    [PATCH 3.2 86/94] proc: prevent stacking filesystems on top Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 34/94] RDMA/cxgb3: device driver frees DMA memory with  different size Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 22/94] net/mlx4_core: Fix access to uninitialized index Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 82/94] xenbus: don't BUG() on user mode induced condition Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 69/94] ALSA: dummy: Fix a use-after-free at closing Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 74/94] NFS: Fix another OPEN_DOWNGRADE bug Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 73/94] ALSA: echoaudio: Fix memory allocation Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 61/94] mm: Export migrate_page_move_mapping and  migrate_page_copy Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    [PATCH 3.2 02/94] ath5k: Change led pin configuration for compaq  c700 laptop Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 14:10 +0200
    Re: [PATCH 3.2 00/94] 3.2.82-rc1 review Guenter Roeck <linux@roeck-us.net> - 2016-08-14 17:10 +0200
    [PATCH 3.2 39/94] ARM: fix PTRACE_SETVFPREGS on SMP systems Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 85/94] fs: limit filesystem stacking depth Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 11/94] tty: vt, return error when con_startup fails Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 91/94] tipc: fix an infoleak in tipc_nl_compat_link_dump Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 15/94] MIPS: Adjust set_pte() SMP fix to handle  R10000_LLSC_WAR Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 60/94] ubi: Make recover_peb power cut aware Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 03/94] crypto: s5p-sss - Fix missed interrupts when  working with 8 kB blocks Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 64/94] xen/pciback: Fix conf_space read/write overlap  check. Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 25/94] fs/cifs: correctly to anonymous authentication  via NTLMSSP Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:00 +0200
    [PATCH 3.2 37/94] Input: pwm-beeper - fix - scheduling while atomic Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 21/94] mmc: mmc: Fix partition switch timeout for some  eMMCs Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 88/94] ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 01/94] regmap: cache: Fix typo in cache_bypass  parameter description Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 63/94] can: fix oops caused by wrong rtnl dellink usage Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 77/94] x86/amd_nb: Fix boot crash on non-AMD systems Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 79/94] bonding: prevent out of bound accesses Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 06/94] crypto: s5p-sss - fix incorrect usage of  scatterlists api Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 59/94] can: at91_can: RX queue could get stuck at high  bus load Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 70/94] fs/nilfs2: fix potential underflow in call to  crc32_le Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 71/94] staging: iio: accel: fix error check Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 84/94] cifs: dynamic allocation of ntlmssp blob Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 52/94] kernel/sysrq, watchdog, sched/core: Reset  watchdog on all CPUs while processing sysrq-w Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 40/94] KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 53/94] base: make module_create_drivers_dir race-free Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:10 +0200
    [PATCH 3.2 87/94] USB: usbfs: fix potential infoleak in devio Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:20 +0200
    [PATCH 3.2 48/94] staging:iio: trigger fixes for repeat request  of same trigger and allocation failure Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:20 +0200
    [PATCH 3.2 09/94] ext4: fix hang when processing corrupted  orphaned inode list Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:20 +0200
    [PATCH 3.2 75/94] batman-adv: Fix use-after-free/double-free of  tt_req_node Ben Hutchings <ben@decadent.org.uk> - 2016-08-14 20:20 +0200

Page 1 of 3  [1] 2 3  Next page →

#1462038 — [PATCH 3.2 00/94] 3.2.82-rc1 review

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 13:50 +0200
Subject[PATCH 3.2 00/94] 3.2.82-rc1 review
Message-ID<s5LnX-4sk-7@gated-at.bofh.it>
This is the start of the stable review cycle for the 3.2.82 release.
There are 94 patches in this series, which will be posted as responses
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Tue Aug 16 00:00:00 UTC 2016.
Anything received after that time might be too late.

A combined patch relative to 3.2.81 will be posted as an additional
response to this.  A shortlog and diffstat can be found below.

Ben.

-------------

Adrian Hunter (1):
      mmc: mmc: Fix partition switch timeout for some eMMCs
         [1c447116d017a98c90f8f71c8c5a611e0aa42178]

Al Viro (1):
      fix d_walk()/non-delayed __d_free() race
         [3d56c25e3bb0726a5c5e16fc2d9e38f8ed763085]

Alex Deucher (1):
      drm/radeon: fix asic initialization for virtualized environments
         [05082b8bbd1a0ffc74235449c4b8930a8c240f85]

Andrew F. Davis (1):
      regmap: cache: Fix typo in cache_bypass parameter description
         [267c85860308d36bc163c5573308cd024f659d7c]

Andrew Goodbody (2):
      usb: musb: Ensure rx reinit occurs for shared_fifo endpoints
         [f3eec0cf784e0d6c47822ca6b66df3d5812af7e6]
      usb: musb: Stop bulk endpoint while queue is rotated
         [7b2c17f829545df27a910e8d82e133c21c9a8c9c]

Andrey Grodzovsky (1):
      xen/pciback: Fix conf_space read/write overlap check.
         [02ef871ecac290919ea0c783d05da7eedeffc10e]

Andrey Ryabinin (1):
      kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w
         [57675cb976eff977aefb428e68e4e0236d48a9ff]

Arnd Bergmann (1):
      gcov: disable tree-loop-im to reduce stack usage
         [c87bf431448b404a6ef5fbabd74c0e3e42157a7f]

Bjorn Helgaas (2):
      PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
         [ca620723d4ff9ea7ed484eab46264c3af871b9ae]
      alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
         [c20e128030caf0537d5e906753eac1c28fefdb75]

Borislav Petkov (1):
      x86/amd_nb: Fix boot crash on non-AMD systems
         [1ead852dd88779eda12cb09cc894a03d9abfe1ec]

Cameron Gutman (1):
      Input: xpad - prevent spurious input from wired Xbox 360 controllers
         [1ff5fa3c6732f08e01ae12f12286d4728c9e4d86]

Christophe JAILLET (1):
      ALSA: echoaudio: Fix memory allocation
         [9c6795a9b3cbb56a9fbfaf43909c5c22999ba317]

Chuck Lever (1):
      sunrpc: Update RPCBIND_MAXNETIDLEN
         [4b9c7f9db9a003f5c342184dc4401c1b7f2efb39]

Crestez Dan Leonard (1):
      iio: Fix error handling in iio_trigger_attach_poll_func
         [99543823357966ac938d9a310947e731b67338e6]

Dan Carpenter (3):
      ACPI / sysfs: fix error code in get_status()
         [f18ebc211e259d4f591e39e74b2aa2de226c9a1d]
      KEYS: potential uninitialized variable
         [38327424b40bcebe2de92d07312c89360ac9229a]
      usb: f_fs: off by one bug in _ffs_func_bind()
         [0015f9156092d07b3ec06d37d014328419d5832e]

Dmitry Torokhov (1):
      Input: elantech - add more IC body types to the list
         [226ba707744a51acb4244724e09caacb1d96aed9]

Duan Jiong (1):
      etherdevice: introduce help function eth_zero_addr()
         [6d57e9078e880a3dd232d579f42ac437a8f1ef7b]

Eric Dumazet (2):
      bonding: prevent out of bound accesses
         [f87fda00b6ed232a817c655b8d179b48bde8fdbe]
      tcp: make challenge acks less predictable
         [75ff39ccc1bd5d3c455b6822ab09e533c551f758]

Geert Uytterhoeven (1):
      char: Drop bogus dependency of DEVPORT on !M68K
         [309124e2648d668a0c23539c5078815660a4a850]

H. Peter Anvin (1):
      x86, build: copy ldlinux.c32 to image.iso
         [9c77679cadb118c0aa99e6f88533d91765a131ba]

Helge Deller (1):
      parisc: Fix pagefault crash in unaligned __get_user() call
         [8b78f260887df532da529f225c49195d18fef36b]

Honggang Li (1):
      RDMA/cxgb3: device driver frees DMA memory with different size
         [0de4cbb3dddca35ecd06b95918f38439c9c6401f]

Jan Beulich (1):
      xenbus: don't BUG() on user mode induced condition
         [0beef634b86a1350c31da5fcc2992f0d7c8a622b]

Jann Horn (1):
      proc: prevent stacking filesystems on top
         [e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9]

Jason Gunthorpe (1):
      IB/mlx4: Properly initialize GRH TClass and FlowLabel in AHs
         [8c5122e45a10a9262f872b53f151a592e870f905]

Jeff Mahoney (1):
      ecryptfs: don't allow mmap when the lower fs doesn't support it
         [f0fe970df3838c202ef6c07a4c2b36838ef0a88b]

Jerome Marchand (1):
      cifs: dynamic allocation of ntlmssp blob
         [b8da344b74c822e966c6d19d6b2321efe82c5d97]

Jiri Slaby (2):
      base: make module_create_drivers_dir race-free
         [7e1b1fc4dabd6ec8e28baa0708866e13fa93c9b3]
      tty: vt, return error when con_startup fails
         [6798df4c5fe0a7e6d2065cf79649a794e5ba7114]

Jonathan Cameron (1):
      staging:iio: trigger fixes for repeat request of same trigger and allocation failure
         [5dd72ecb0166498852705939163f375d693d37f3]

Joseph Salisbury (1):
      ath5k: Change led pin configuration for compaq c700 laptop
         [7b9bc799a445aea95f64f15e0083cb19b5789abe]

Joshua Kinard (1):
      MIPS: Adjust set_pte() SMP fix to handle R10000_LLSC_WAR
         [128639395b2ceacc6a56a0141d0261012bfe04d3]

Kangjie Lu (6):
      ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
         [cec8f96e49d9be372fdb0c3836dcf31ec71e457e]
      ALSA: timer: Fix leak in events via snd_timer_user_ccallback
         [9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6]
      ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt
         [e4ec8cc8039a7063e24204299b462bd1383184a5]
      USB: usbfs: fix potential infoleak in devio
         [681fef8380eb818c0b845fca5d2ab1dcbab114ee]
      rds: fix an infoleak in rds_inc_info_copy
         [4116def2337991b39919f3b448326e21c40e0dbb]
      tipc: fix an infoleak in tipc_nl_compat_link_dump
         [5d2be1422e02ccd697ccfcd45c85b4a26e6178e2]

Kirill A. Shutemov (1):
      UBIFS: Implement ->migratepage()
         [4ac1c17b2044a1b4b2fbed74451947e905fc2992]

Krzysztof Kozlowski (1):
      crypto: s5p-sss - Fix missed interrupts when working with 8 kB blocks
         [79152e8d085fd64484afd473ef6830b45518acba]

Lei Liu (2):
      USB: serial: option: add even more ZTE device ids
         [74d2a91aec97ab832790c9398d320413ad185321]
      USB: serial: option: add more ZTE device ids
         [f0d09463c59c2d764a6c6d492cbe6d2c77f27153]

Linus Walleij (1):
      iio: accel: kxsd9: fix the usage of spi_w8r8()
         [0c1f91b98552da49d9d8eed32b3132a58d2f4598]

Luis de Bethencourt (1):
      staging: iio: accel: fix error check
         [ef3149eb3ddb7f9125e11c90f8330e371b55cffd]

Luke Dashjr (1):
      btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl
         [4c63c2454eff996c5e27991221106eb511f7db38]

Manfred Schlaegl (1):
      Input: pwm-beeper - fix - scheduling while atomic
         [f49cf3b8b4c841457244c461c66186a719e13bcc]

Mans Rullgard (1):
      ata: sata_dwc_460ex: remove incorrect locking
         [55e610cdd28c0ad3dce0652030c0296d549673f3]

Marek Szyprowski (1):
      crypto: s5p-sss - fix incorrect usage of scatterlists api
         [d1497977fecb9acce05988d6322ad415ef93bb39]

Martin Willi (1):
      mac80211_hwsim: Add missing check for HWSIM_ATTR_SIGNAL
         [62397da50bb20a6b812c949ef465d7e69fe54bb6]

Masami Hiramatsu (1):
      kprobes/x86: Clear TF bit in fault on single-stepping
         [dcfc47248d3f7d28df6f531e6426b933de94370d]

Michael Ellerman (2):
      powerpc/mm/hash64: Factor out hash preload psize check
         [8bbc9b7b001eaab8abf7e9e24edf1bb285c8d825]
      powerpc/mm/hash64: Fix subpage protection with 4K HPTE config
         [aac55d7573c5d46ed9a62818d5d3e69dd2060105]

Miklos Szeredi (1):
      fs: limit filesystem stacking depth
         [69c433ed2ecd2d3264efd7afec4439524b319121]

Oleg Nesterov (1):
      wait/ptrace: assume __WALL if the child is traced
         [bf959931ddb88c4e4366e96dd22e68fa0db9527c]

Oliver Hartkopp (1):
      can: fix oops caused by wrong rtnl dellink usage
         [25e1ed6e64f52a692ba3191c4fde650aab3ecc07]

Olivier Sobrie (1):
      Input: pwm-beeper - remove useless call to pwm_config()
         [d1b12075ffa808dce33dd46b7ad035bebf8da215]

Pali Rohár (1):
      hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default
         [7613663cc186f8f3c50279390ddc60286758001c]

Paolo Bonzini (1):
      KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS
         [d14bdb553f9196169f003058ae1cdabe514470e6]

Paul Moore (1):
      audit: fix a double fetch in audit_log_single_execve_arg()
         [43761473c254b45883a64441dd0bc85a42f3645c]

Ping Cheng (1):
      Input: wacom_w8001 - w8001_MAX_LENGTH should be 13
         [12afb34400eb2b301f06b2aa3535497d14faee59]

Prarit Bhargava (2):
      PCI: Disable all BAR sizing for devices with non-compliant BARs
         [ad67b437f187ea818b2860524d10f878fadfdd99]
      x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
         [da77b67195de1c65bef4908fa29967c4d0af2da2]

Prasun Maiti (1):
      wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel
         [3d5fdff46c4b2b9534fa2f9fc78e90a48e0ff724]

Raghava Aditya Renukunta (1):
      aacraid: Fix for aac_command_thread hang
         [fc4bf75ea300a5e62a2419f89dd0e22189dd7ab7]

Richard Weinberger (2):
      mm: Export migrate_page_move_mapping and migrate_page_copy
         [1118dce773d84f39ebd51a9fe7261f9169cb056e]
      ubi: Make recover_peb power cut aware
         [972228d87445dc46c0a01f5f3de673ac017626f7]

Ricky Liang (1):
      Input: uinput - handle compat ioctl for UI_SET_PHYS
         [affa80bd97f7ca282d1faa91667b3ee9e4c590e6]

Ross Lagerwall (1):
      xen/events: Don't move disabled irqs
         [f0f393877c71ad227d36705d61d1e4062bc29cf5]

Russell King (1):
      ARM: fix PTRACE_SETVFPREGS on SMP systems
         [e2dfb4b880146bfd4b6aa8e138c0205407cebbaf]

Scott Bauer (1):
      HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands
         [93a2001bdfd5376c3dc2158653034c20392d15c5]

Stefan Metzmacher (4):
      fs/cifs: correctly to anonymous authentication for the LANMAN authentication
         [fa8f3a354bb775ec586e4475bcb07f7dece97e0c]
      fs/cifs: correctly to anonymous authentication for the NTLM(v1) authentication
         [777f69b8d26bf35ade4a76b08f203c11e048365d]
      fs/cifs: correctly to anonymous authentication for the NTLM(v2) authentication
         [1a967d6c9b39c226be1b45f13acd4d8a5ab3dc44]
      fs/cifs: correctly to anonymous authentication via NTLMSSP
         [cfda35d98298131bf38fbad3ce4cd5ecb3cf18db]

Sven Eckelmann (1):
      batman-adv: Fix use-after-free/double-free of tt_req_node
         [9c4604a298e0a9807eaf2cd912d1ebf24d98fbeb]

Takashi Iwai (3):
      ALSA: au88x0: Fix calculation in vortex_wtdma_bufshift()
         [62db7152c924e4c060e42b34a69cd39658e8a0dc]
      ALSA: dummy: Fix a use-after-free at closing
         [d5dbbe6569481bf12dcbe3e12cff72c5f78d272c]
      ALSA: timer: Fix negative queue usage by racy accesses
         [3fa6993fef634e05d200d141a85df0b044572364]

Tariq Toukan (1):
      net/mlx4_core: Fix access to uninitialized index
         [2bb07e155bb3e0c722c806723f737cf8020961ef]

Theodore Ts'o (1):
      ext4: fix hang when processing corrupted orphaned inode list
         [c9eb13a9105e2e418f72e46a2b6da3f49e696902]

Torsten Hilbrich (1):
      fs/nilfs2: fix potential underflow in call to crc32_le
         [63d2f95d63396059200c391ca87161897b99e74a]

Trond Myklebust (1):
      NFS: Fix another OPEN_DOWNGRADE bug
         [e547f2628327fec6afd2e03b46f113f614cca05b]

Ursula Braun (1):
      qeth: delete napi struct when removing a qeth device
         [7831b4ff0d926e0deeaabef9db8800ed069a2757]

Vik Heyndrickx (1):
      sched/loadavg: Fix loadavg artifacts on fully idle and on fully loaded systems
         [20878232c52329f92423d27a60e48b6a6389e0dd]

William Breathitt Gray (1):
      isa: Call isa_bus_init before dependent ISA bus drivers register
         [32a5a0c047343b11f581f663a2309cf43d13466f]

Wolfgang Grandegger (1):
      can: at91_can: RX queue could get stuck at high bus load
         [43200a4480cbbe660309621817f54cbb93907108]

Xiubo Li (1):
      kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
         [caf1ff26e1aa178133df68ac3d40815fed2187d9]

Xypron.Glpk@Gmx.De (1):
      net: ehea: avoid null pointer dereference
         [1740c29a46b30a2f157afc473156f157e599d4c2]

Yishai Hadas (1):
      IB/mlx4: Fix the SQ size of an RC QP
         [f2940e2c76bb554a7fbdd28ca5b90904117a9e96]

 Makefile                                   |   6 +-
 arch/alpha/kernel/pci-sysfs.c              |   4 +-
 arch/arm/kernel/ptrace.c                   |   2 +-
 arch/mips/include/asm/pgtable.h            |  45 ++--
 arch/parisc/kernel/unaligned.c             |  10 +-
 arch/powerpc/mm/hash_utils_64.c            |  29 ++-
 arch/x86/boot/Makefile                     |   3 +
 arch/x86/kernel/amd_nb.c                   |   4 +-
 arch/x86/kernel/kprobes.c                  |  12 ++
 arch/x86/kvm/x86.c                         |   5 +
 arch/x86/pci/fixup.c                       |   7 +
 drivers/acpi/sysfs.c                       |   7 +-
 drivers/ata/sata_dwc_460ex.c               |   4 +-
 drivers/base/isa.c                         |   2 +-
 drivers/base/module.c                      |   8 +-
 drivers/base/regmap/regcache.c             |   2 +-
 drivers/char/Kconfig                       |   1 -
 drivers/char/i8k.c                         |  18 +-
 drivers/crypto/s5p-sss.c                   |  61 ++++--
 drivers/gpu/drm/radeon/radeon_device.c     |  21 ++
 drivers/hid/usbhid/hiddev.c                |  10 +-
 drivers/infiniband/hw/cxgb3/cxio_hal.c     |   2 +-
 drivers/infiniband/hw/mlx4/ah.c            |   2 +-
 drivers/infiniband/hw/mlx4/qp.c            |   2 +-
 drivers/input/joystick/xpad.c              |   4 +
 drivers/input/misc/pwm-beeper.c            |  70 ++++--
 drivers/input/misc/uinput.c                |   6 +
 drivers/input/mouse/elantech.c             |   8 +-
 drivers/input/touchscreen/wacom_w8001.c    |   2 +-
 drivers/mmc/core/mmc.c                     |   7 +
 drivers/mtd/ubi/eba.c                      |  19 +-
 drivers/net/bonding/bond_3ad.c             |  13 +-
 drivers/net/bonding/bond_alb.c             |   7 +-
 drivers/net/bonding/bonding.h              |   3 +
 drivers/net/can/at91_can.c                 |   5 +-
 drivers/net/can/dev.c                      |   6 +
 drivers/net/ethernet/ibm/ehea/ehea_main.c  |   9 +-
 drivers/net/ethernet/mellanox/mlx4/mcg.c   |   4 +-
 drivers/net/wireless/ath/ath5k/led.c       |   2 +-
 drivers/net/wireless/mac80211_hwsim.c      |   1 +
 drivers/pci/pci-sysfs.c                    |   7 +-
 drivers/pci/probe.c                        |   6 +-
 drivers/s390/net/qeth_l2_main.c            |   1 +
 drivers/s390/net/qeth_l3_main.c            |   1 +
 drivers/scsi/aacraid/commsup.c             |   4 +
 drivers/staging/iio/accel/kxsd9.c          |   4 +-
 drivers/staging/iio/accel/sca3000_core.c   |   2 +-
 drivers/staging/iio/industrialio-trigger.c |  25 ++-
 drivers/tty/vt/vt.c                        |   5 +-
 drivers/usb/core/devio.c                   |   9 +-
 drivers/usb/gadget/f_fs.c                  |   6 +-
 drivers/usb/musb/musb_host.c               |  21 +-
 drivers/usb/serial/option.c                | 129 ++++++++++-
 drivers/xen/events.c                       |   6 +-
 drivers/xen/xen-pciback/conf_space.c       |   6 +-
 drivers/xen/xenfs/xenbus.c                 |  14 +-
 fs/btrfs/ctree.h                           |   1 +
 fs/btrfs/file.c                            |   2 +-
 fs/btrfs/inode.c                           |   2 +-
 fs/btrfs/ioctl.c                           |  21 ++
 fs/cifs/sess.c                             | 207 ++++++++++--------
 fs/dcache.c                                |   5 +-
 fs/ecryptfs/file.c                         |  15 +-
 fs/ecryptfs/main.c                         |   7 +
 fs/ext4/ialloc.c                           |  10 +-
 fs/nfs/nfs4proc.c                          |   5 +-
 fs/nilfs2/the_nilfs.c                      |   2 +-
 fs/proc/root.c                             |   7 +
 fs/ubifs/file.c                            |  24 +++
 include/linux/etherdevice.h                |  11 +
 include/linux/fs.h                         |  11 +
 include/linux/migrate.h                    |   3 +
 include/linux/sunrpc/msg_prot.h            |   4 +-
 kernel/auditsc.c                           | 333 ++++++++++++++---------------
 kernel/exit.c                              |  29 ++-
 kernel/sched.c                             |  17 +-
 mm/migrate.c                               |   4 +-
 net/batman-adv/translation-table.c         |  42 +++-
 net/batman-adv/types.h                     |   1 +
 net/ipv4/tcp_input.c                       |  17 +-
 net/rds/recv.c                             |   2 +
 net/tipc/node.c                            |   3 +-
 net/wireless/wext-core.c                   |  25 ++-
 security/keys/key.c                        |   2 +-
 sound/core/timer.c                         |   5 +-
 sound/drivers/dummy.c                      |   1 +
 sound/pci/au88x0/au88x0_core.c             |   5 +-
 sound/pci/echoaudio/echoaudio.c            |   4 +-
 virt/kvm/assigned-dev.c                    |   2 +-
 89 files changed, 1031 insertions(+), 477 deletions(-)

-- 
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
                                                           - Albert Einstein

[toc] | [next] | [standalone]

#1462041 — [PATCH 3.2 26/94] fs/cifs: correctly to anonymous authentication for the LANMAN authentication

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 13:50 +0200
Subject[PATCH 3.2 26/94] fs/cifs: correctly to anonymous authentication for the LANMAN authentication
Message-ID<s625t-7wK-71@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Stefan Metzmacher <metze@samba.org>

commit fa8f3a354bb775ec586e4475bcb07f7dece97e0c upstream.

Only server which map unknown users to guest will allow
access using a non-null LMChallengeResponse.

For Samba it's the "map to guest = bad user" option.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11913

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Steve French <smfrench@gmail.com>
[bwh: Backported to 3.2:
 - Adjust context, indentation
 - Keep ses->flags assignment out of the new if-statement]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/cifs/sess.c
+++ b/fs/cifs/sess.c
@@ -655,23 +655,25 @@ ssetup_ntlmssp_authenticate:
 
 		pSMB->req.hdr.Flags2 &= ~SMBFLG2_UNICODE;
 
-		/* no capabilities flags in old lanman negotiation */
-
-		pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
-
-		/* Calculate hash with password and copy into bcc_ptr.
-		 * Encryption Key (stored as in cryptkey) gets used if the
-		 * security mode bit in Negottiate Protocol response states
-		 * to use challenge/response method (i.e. Password bit is 1).
-		 */
-
-		rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
-				 ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
-					true : false, lnm_session_key);
-
+		if (ses->user_name != NULL) {
+			/* no capabilities flags in old lanman negotiation */
+			pSMB->old_req.PasswordLength = cpu_to_le16(CIFS_AUTH_RESP_SIZE);
+
+			/* Calculate hash with password and copy into bcc_ptr.
+			 * Encryption Key (stored as in cryptkey) gets used if the
+			 * security mode bit in Negottiate Protocol response states
+			 * to use challenge/response method (i.e. Password bit is 1).
+			 */
+			rc = calc_lanman_hash(ses->password, ses->server->cryptkey,
+					      ses->server->sec_mode & SECMODE_PW_ENCRYPT ?
+					      true : false, lnm_session_key);
+
+			memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
+			bcc_ptr += CIFS_AUTH_RESP_SIZE;
+		} else {
+			pSMB->old_req.PasswordLength = 0;
+		}
 		ses->flags |= CIFS_SES_LANMAN;
-		memcpy(bcc_ptr, (char *)lnm_session_key, CIFS_AUTH_RESP_SIZE);
-		bcc_ptr += CIFS_AUTH_RESP_SIZE;
 
 		/* can not sign if LANMAN negotiated so no need
 		to calculate signing key? but what if server

[toc] | [prev] | [next] | [standalone]

#1462042 — [PATCH 3.2 23/94] x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 13:50 +0200
Subject[PATCH 3.2 23/94] x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs
Message-ID<s625t-7wK-73@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Prarit Bhargava <prarit@redhat.com>

commit da77b67195de1c65bef4908fa29967c4d0af2da2 upstream.

Commit b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having
non-compliant BARs") marked Home Agent 0 & PCU has having non-compliant
BARs.  Home Agent 1 also has non-compliant BARs.

Mark Home Agent 1 as having non-compliant BARs so the PCI core doesn't
touch them.

The problem with these devices is documented in the Xeon v4 specification
update:

  BDF2          PCI BARs in the Home Agent Will Return Non-Zero Values
                During Enumeration

  Problem:      During system initialization the Operating System may access
                the standard PCI BARs (Base Address Registers).  Due to
                this erratum, accesses to the Home Agent BAR registers (Bus
                1; Device 18; Function 0,4; Offsets (0x14-0x24) will return
                non-zero values.

  Implication:  The operating system may issue a warning.  Intel has not
                observed any functional failures due to this erratum.

Link: http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
Fixes: b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs")
Signed-off-by: Prarit Bhargava <prarit@redhat.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
CC: Thomas Gleixner <tglx@linutronix.de>
CC: Ingo Molnar <mingo@redhat.com>
CC: "H. Peter Anvin" <hpa@zytor.com>
CC: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/x86/pci/fixup.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -539,9 +539,16 @@ static void __devinit twinhead_reserve_k
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone);
 
+/*
+ * Broadwell EP Home Agent BARs erroneously return non-zero values when read.
+ *
+ * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html
+ * entry BDF2.
+ */
 static void pci_bdwep_bar(struct pci_dev *dev)
 {
 	dev->non_compliant_bars = 1;
 }
+DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar);
 DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar);

[toc] | [prev] | [next] | [standalone]

#1462043 — [PATCH 3.2 93/94] tcp: make challenge acks less predictable

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 13:50 +0200
Subject[PATCH 3.2 93/94] tcp: make challenge acks less predictable
Message-ID<s625t-7wK-69@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 upstream.

Yue Cao claims that current host rate limiting of challenge ACKS
(RFC 5961) could leak enough information to allow a patient attacker
to hijack TCP sessions. He will soon provide details in an academic
paper.

This patch increases the default limit from 100 to 1000, and adds
some randomization so that the attacker can no longer hijack
sessions without spending a considerable amount of probes.

Based on initial analysis and patch from Linus.

Note that we also have per socket rate limiting, so it is tempting
to remove the host limit in the future.

v2: randomize the count of challenge acks per second, not the period.

Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
Reported-by: Yue Cao <ycao009@ucr.edu>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
 - Adjust context
 - Use ACCESS_ONCE() instead of {READ,WRITE}_ONCE()
 - Open-code prandom_u32_max()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/ipv4/tcp_input.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -87,7 +87,7 @@ int sysctl_tcp_adv_win_scale __read_most
 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
 
 /* rfc5961 challenge ack rate limiting */
-int sysctl_tcp_challenge_ack_limit = 100;
+int sysctl_tcp_challenge_ack_limit = 1000;
 
 int sysctl_tcp_stdurg __read_mostly;
 int sysctl_tcp_rfc1337 __read_mostly;
@@ -3715,13 +3715,20 @@ static void tcp_send_challenge_ack(struc
 	/* unprotected vars, we dont care of overwrites */
 	static u32 challenge_timestamp;
 	static unsigned int challenge_count;
-	u32 now = jiffies / HZ;
+	u32 count, now = jiffies / HZ;
 
 	if (now != challenge_timestamp) {
+		u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
+
 		challenge_timestamp = now;
-		challenge_count = 0;
-	}
-	if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
+		ACCESS_ONCE(challenge_count) =
+			half + (u32)(
+			((u64) random32() * sysctl_tcp_challenge_ack_limit)
+			>> 32);
+	}
+	count = ACCESS_ONCE(challenge_count);
+	if (count > 0) {
+		ACCESS_ONCE(challenge_count) = count - 1;
 		NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
 		tcp_send_ack(sk);
 	}

[toc] | [prev] | [next] | [standalone]

#1462044 — [PATCH 3.2 62/94] UBIFS: Implement ->migratepage()

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 62/94] UBIFS: Implement ->migratepage()
Message-ID<s62f7-7AQ-1@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>

commit 4ac1c17b2044a1b4b2fbed74451947e905fc2992 upstream.

During page migrations UBIFS might get confused
and the following assert triggers:
[  213.480000] UBIFS assert failed in ubifs_set_page_dirty at 1451 (pid 436)
[  213.490000] CPU: 0 PID: 436 Comm: drm-stress-test Not tainted 4.4.4-00176-geaa802524636-dirty #1008
[  213.490000] Hardware name: Allwinner sun4i/sun5i Families
[  213.490000] [<c0015e70>] (unwind_backtrace) from [<c0012cdc>] (show_stack+0x10/0x14)
[  213.490000] [<c0012cdc>] (show_stack) from [<c02ad834>] (dump_stack+0x8c/0xa0)
[  213.490000] [<c02ad834>] (dump_stack) from [<c0236ee8>] (ubifs_set_page_dirty+0x44/0x50)
[  213.490000] [<c0236ee8>] (ubifs_set_page_dirty) from [<c00fa0bc>] (try_to_unmap_one+0x10c/0x3a8)
[  213.490000] [<c00fa0bc>] (try_to_unmap_one) from [<c00fadb4>] (rmap_walk+0xb4/0x290)
[  213.490000] [<c00fadb4>] (rmap_walk) from [<c00fb1bc>] (try_to_unmap+0x64/0x80)
[  213.490000] [<c00fb1bc>] (try_to_unmap) from [<c010dc28>] (migrate_pages+0x328/0x7a0)
[  213.490000] [<c010dc28>] (migrate_pages) from [<c00d0cb0>] (alloc_contig_range+0x168/0x2f4)
[  213.490000] [<c00d0cb0>] (alloc_contig_range) from [<c010ec00>] (cma_alloc+0x170/0x2c0)
[  213.490000] [<c010ec00>] (cma_alloc) from [<c001a958>] (__alloc_from_contiguous+0x38/0xd8)
[  213.490000] [<c001a958>] (__alloc_from_contiguous) from [<c001ad44>] (__dma_alloc+0x23c/0x274)
[  213.490000] [<c001ad44>] (__dma_alloc) from [<c001ae08>] (arm_dma_alloc+0x54/0x5c)
[  213.490000] [<c001ae08>] (arm_dma_alloc) from [<c035cecc>] (drm_gem_cma_create+0xb8/0xf0)
[  213.490000] [<c035cecc>] (drm_gem_cma_create) from [<c035cf20>] (drm_gem_cma_create_with_handle+0x1c/0xe8)
[  213.490000] [<c035cf20>] (drm_gem_cma_create_with_handle) from [<c035d088>] (drm_gem_cma_dumb_create+0x3c/0x48)
[  213.490000] [<c035d088>] (drm_gem_cma_dumb_create) from [<c0341ed8>] (drm_ioctl+0x12c/0x444)
[  213.490000] [<c0341ed8>] (drm_ioctl) from [<c0121adc>] (do_vfs_ioctl+0x3f4/0x614)
[  213.490000] [<c0121adc>] (do_vfs_ioctl) from [<c0121d30>] (SyS_ioctl+0x34/0x5c)
[  213.490000] [<c0121d30>] (SyS_ioctl) from [<c000f2c0>] (ret_fast_syscall+0x0/0x34)

UBIFS is using PagePrivate() which can have different meanings across
filesystems. Therefore the generic page migration code cannot handle this
case correctly.
We have to implement our own migration function which basically does a
plain copy but also duplicates the page private flag.
UBIFS is not a block device filesystem and cannot use buffer_migrate_page().

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[rw: Massaged changelog, build fixes, etc...]
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Christoph Hellwig <hch@lst.de>
[bwh: Backported to 3.2:
 - migrate_page_move_mapping() doesn't take an extra_count parameter
 - Use literal 0 instead of MIGRATEPAGE_SUCCESS]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 fs/ubifs/file.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -53,6 +53,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/slab.h>
+#include <linux/migrate.h>
 
 static int read_block(struct inode *inode, void *addr, unsigned int block,
 		      struct ubifs_data_node *dn)
@@ -1421,6 +1422,26 @@ static int ubifs_set_page_dirty(struct p
 	return ret;
 }
 
+#ifdef CONFIG_MIGRATION
+static int ubifs_migrate_page(struct address_space *mapping,
+		struct page *newpage, struct page *page, enum migrate_mode mode)
+{
+	int rc;
+
+	rc = migrate_page_move_mapping(mapping, newpage, page, NULL, mode);
+	if (rc != 0)
+		return rc;
+
+	if (PagePrivate(page)) {
+		ClearPagePrivate(page);
+		SetPagePrivate(newpage);
+	}
+
+	migrate_page_copy(newpage, page);
+	return 0;
+}
+#endif
+
 static int ubifs_releasepage(struct page *page, gfp_t unused_gfp_flags)
 {
 	/*
@@ -1555,6 +1576,9 @@ const struct address_space_operations ub
 	.write_end      = ubifs_write_end,
 	.invalidatepage = ubifs_invalidatepage,
 	.set_page_dirty = ubifs_set_page_dirty,
+#ifdef CONFIG_MIGRATION
+	.migratepage	= ubifs_migrate_page,
+#endif
 	.releasepage    = ubifs_releasepage,
 };

[toc] | [prev] | [next] | [standalone]

#1462050 — [PATCH 3.2 42/94] x86, build: copy ldlinux.c32 to image.iso

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 42/94] x86, build: copy ldlinux.c32 to image.iso
Message-ID<s62f7-7AQ-11@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "H. Peter Anvin" <hpa@zytor.com>

commit 9c77679cadb118c0aa99e6f88533d91765a131ba upstream.

For newer versions of Syslinux, we need ldlinux.c32 in addition to
isolinux.bin to reside on the boot disk, so if the latter is found,
copy it, too, to the isoimage tree.

Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/x86/boot/Makefile | 3 +++
 1 file changed, 3 insertions(+)

--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -166,6 +166,9 @@ isoimage: $(obj)/bzImage
 	for i in lib lib64 share end ; do \
 		if [ -f /usr/$$i/syslinux/isolinux.bin ] ; then \
 			cp /usr/$$i/syslinux/isolinux.bin $(obj)/isoimage ; \
+			if [ -f /usr/$$i/syslinux/ldlinux.c32 ]; then \
+				cp /usr/$$i/syslinux/ldlinux.c32 $(obj)/isoimage ; \
+			fi ; \
 			break ; \
 		fi ; \
 		if [ $$i = end ] ; then exit 1 ; fi ; \

[toc] | [prev] | [next] | [standalone]

#1462055 — [PATCH 3.2 54/94] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 54/94] kvm: Fix irq route entries exceeding KVM_MAX_IRQ_ROUTES
Message-ID<s62f8-7AQ-25@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Xiubo Li <lixiubo@cmss.chinamobile.com>

commit caf1ff26e1aa178133df68ac3d40815fed2187d9 upstream.

These days, we experienced one guest crash with 8 cores and 3 disks,
with qemu error logs as bellow:

qemu-system-x86_64: /build/qemu-2.0.0/kvm-all.c:984:
kvm_irqchip_commit_routes: Assertion `ret == 0' failed.

And then we found one patch(bdf026317d) in qemu tree, which said
could fix this bug.

Execute the following script will reproduce the BUG quickly:

irq_affinity.sh
========================================================================

vda_irq_num=25
vdb_irq_num=27
while [ 1 ]
do
    for irq in {1,2,4,8,10,20,40,80}
        do
            echo $irq > /proc/irq/$vda_irq_num/smp_affinity
            echo $irq > /proc/irq/$vdb_irq_num/smp_affinity
            dd if=/dev/vda of=/dev/zero bs=4K count=100 iflag=direct
            dd if=/dev/vdb of=/dev/zero bs=4K count=100 iflag=direct
        done
done
========================================================================

The following qemu log is added in the qemu code and is displayed when
this bug reproduced:

kvm_irqchip_commit_routes: max gsi: 1008, nr_allocated_irq_routes: 1024,
irq_routes->nr: 1024, gsi_count: 1024.

That's to say when irq_routes->nr == 1024, there are 1024 routing entries,
but in the kernel code when routes->nr >= 1024, will just return -EINVAL;

The nr is the number of the routing entries which is in of
[1 ~ KVM_MAX_IRQ_ROUTES], not the index in [0 ~ KVM_MAX_IRQ_ROUTES - 1].

This patch fix the BUG above.

Signed-off-by: Xiubo Li <lixiubo@cmss.chinamobile.com>
Signed-off-by: Wei Tang <tangwei@cmss.chinamobile.com>
Signed-off-by: Zhang Zhuoyu <zhangzhuoyu@cmss.chinamobile.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 virt/kvm/assigned-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -826,7 +826,7 @@ long kvm_vm_ioctl_assigned_device(struct
 		if (copy_from_user(&routing, argp, sizeof(routing)))
 			goto out;
 		r = -EINVAL;
-		if (routing.nr >= KVM_MAX_IRQ_ROUTES)
+		if (routing.nr > KVM_MAX_IRQ_ROUTES)
 			goto out;
 		if (routing.flags)
 			goto out;

[toc] | [prev] | [next] | [standalone]

#1462064 — [PATCH 3.2 13/94] USB: serial: option: add even more ZTE device ids

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 13/94] USB: serial: option: add even more ZTE device ids
Message-ID<s62f8-7AQ-43@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Lei Liu <lei35151@163.com>

commit 74d2a91aec97ab832790c9398d320413ad185321 upstream.

Add even more ZTE device ids.

Signed-off-by: lei liu <liu.lei78@zte.com.cn>
[johan: rebase and replace commit message ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/serial/option.c | 54 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1688,6 +1688,60 @@ static const struct usb_device_id option
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) },
 
 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },

[toc] | [prev] | [next] | [standalone]

#1462069 — [PATCH 3.2 35/94] Input: xpad - prevent spurious input from wired Xbox 360 controllers

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 35/94] Input: xpad - prevent spurious input from wired Xbox 360 controllers
Message-ID<s62f8-7AQ-53@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Cameron Gutman <aicommander@gmail.com>

commit 1ff5fa3c6732f08e01ae12f12286d4728c9e4d86 upstream.

After initially connecting a wired Xbox 360 controller or sending it
a command to change LEDs, a status/response packet is interpreted as
controller input. This causes the state of buttons represented in
byte 2 of the controller data packet to be incorrect until the next
valid input packet. Wireless Xbox 360 controllers are not affected.

Writing a new value to the LED device while holding the Start button
and running jstest is sufficient to reproduce this bug. An event will
come through with the Start button released.

Xboxdrv also won't attempt to read controller input from a packet
where byte 0 is non-zero. It also checks that byte 1 is 0x14, but
that value differs between wired and wireless controllers and this
code is shared by both. I think just checking byte 0 is enough to
eliminate unwanted packets.

The following are some examples of 3-byte status packets I saw:
01 03 02
02 03 00
03 03 03
08 03 00

Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Signed-off-by: Pavel Rojtberg <rojtberg@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/input/joystick/xpad.c | 4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -368,6 +368,10 @@ static void xpad360_process_packet(struc
 {
 	struct input_dev *dev = xpad->dev;
 
+	/* valid pad data */
+	if (data[0] != 0x00)
+		return;
+
 	/* digital pad */
 	if (xpad->mapping & MAP_DPAD_TO_BUTTONS) {
 		/* dpad as buttons (left, right, up, down) */

[toc] | [prev] | [next] | [standalone]

#1462071 — [PATCH 3.2 43/94] fix d_walk()/non-delayed __d_free() race

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 43/94] fix d_walk()/non-delayed __d_free() race
Message-ID<s62f9-7AQ-59@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@zeniv.linux.org.uk>

commit 3d56c25e3bb0726a5c5e16fc2d9e38f8ed763085 upstream.

Ascend-to-parent logics in d_walk() depends on all encountered child
dentries not getting freed without an RCU delay.  Unfortunately, in
quite a few cases it is not true, with hard-to-hit oopsable race as
the result.

Fortunately, the fix is simiple; right now the rule is "if it ever
been hashed, freeing must be delayed" and changing it to "if it
ever had a parent, freeing must be delayed" closes that hole and
covers all cases the old rule used to cover.  Moreover, pipes and
sockets remain _not_ covered, so we do not introduce RCU delay in
the cases which are the reason for having that delay conditional
in the first place.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2:
 - Adjust context
 - Also set the flag in __d_materialise_dentry())]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 fs/dcache.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1261,7 +1261,7 @@ struct dentry *d_alloc(struct dentry * p
 	struct dentry *dentry = __d_alloc(parent->d_sb, name);
 	if (!dentry)
 		return NULL;
-
+	dentry->d_flags |= DCACHE_RCUACCESS;
 	spin_lock(&parent->d_lock);
 	/*
 	 * don't need child lock because it is not subject
@@ -2011,7 +2011,6 @@ static void __d_rehash(struct dentry * e
 {
 	BUG_ON(!d_unhashed(entry));
 	hlist_bl_lock(b);
-	entry->d_flags |= DCACHE_RCUACCESS;
 	hlist_bl_add_head_rcu(&entry->d_hash, b);
 	hlist_bl_unlock(b);
 }
@@ -2195,6 +2194,7 @@ static void __d_move(struct dentry * den
 
 	/* ... and switch the parents */
 	if (IS_ROOT(dentry)) {
+		dentry->d_flags |= DCACHE_RCUACCESS;
 		dentry->d_parent = target->d_parent;
 		target->d_parent = target;
 		INIT_LIST_HEAD(&target->d_child);
@@ -2311,6 +2311,7 @@ static void __d_materialise_dentry(struc
 	switch_names(dentry, anon);
 	swap(dentry->d_name.hash, anon->d_name.hash);
 
+	dentry->d_flags |= DCACHE_RCUACCESS;
 	dentry->d_parent = (aparent == anon) ? dentry : aparent;
 	list_del(&dentry->d_child);
 	if (!IS_ROOT(dentry))

[toc] | [prev] | [next] | [standalone]

#1462075 — [PATCH 3.2 18/94] powerpc/mm/hash64: Factor out hash preload psize check

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:00 +0200
Subject[PATCH 3.2 18/94] powerpc/mm/hash64: Factor out hash preload psize check
Message-ID<s62f9-7AQ-67@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <mpe@ellerman.id.au>

commit 8bbc9b7b001eaab8abf7e9e24edf1bb285c8d825 upstream.

Currently we have a check in hash_preload() against the psize, which is
only included when CONFIG_PPC_MM_SLICES is enabled. We want to expand
this check in a subsequent patch, so factor it out to allow that. As a
bonus it removes the #ifdef in the C code.

Unfortunately we can't put this in the existing CONFIG_PPC_MM_SLICES
block because it would require a forward declaration.

Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/powerpc/mm/hash_utils_64.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

--- a/arch/powerpc/mm/hash_utils_64.c
+++ b/arch/powerpc/mm/hash_utils_64.c
@@ -1074,6 +1074,22 @@ int hash_page(unsigned long ea, unsigned
 }
 EXPORT_SYMBOL_GPL(hash_page);
 
+#ifdef CONFIG_PPC_MM_SLICES
+static bool should_hash_preload(struct mm_struct *mm, unsigned long ea)
+{
+	/* We only prefault standard pages for now */
+	if (unlikely(get_slice_psize(mm, ea) != mm->context.user_psize))
+		return false;
+
+	return true;
+}
+#else
+static bool should_hash_preload(struct mm_struct *mm, unsigned long ea)
+{
+	return true;
+}
+#endif
+
 void hash_preload(struct mm_struct *mm, unsigned long ea,
 		  unsigned long access, unsigned long trap)
 {
@@ -1085,11 +1101,8 @@ void hash_preload(struct mm_struct *mm,
 
 	BUG_ON(REGION_ID(ea) != USER_REGION_ID);
 
-#ifdef CONFIG_PPC_MM_SLICES
-	/* We only prefault standard pages for now */
-	if (unlikely(get_slice_psize(mm, ea) != mm->context.user_psize))
+	if (!should_hash_preload(mm, ea))
 		return;
-#endif
 
 	DBG_LOW("hash_preload(mm=%p, mm->pgdir=%p, ea=%016lx, access=%lx,"
 		" trap=%lx\n", mm, mm->pgd, ea, access, trap);

[toc] | [prev] | [next] | [standalone]

#1462083 — [PATCH 3.2 86/94] proc: prevent stacking filesystems on top

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 86/94] proc: prevent stacking filesystems on top
Message-ID<s62oO-7TC-23@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jannh@google.com>

commit e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9 upstream.

This prevents stacking filesystems (ecryptfs and overlayfs) from using
procfs as lower filesystem.  There is too much magic going on inside
procfs, and there is no good reason to stack stuff on top of procfs.

(For example, procfs does access checks in VFS open handlers, and
ecryptfs by design calls open handlers from a kernel thread that doesn't
drop privileges or so.)

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 fs/proc/root.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/fs/proc/root.c
+++ b/fs/proc/root.c
@@ -53,6 +53,13 @@ static struct dentry *proc_mount(struct
 	if (IS_ERR(sb))
 		return ERR_CAST(sb);
 
+	/*
+	 * procfs isn't actually a stacking filesystem; however, there is
+	 * too much magic going on inside it to permit stacking things on
+	 * top of it
+	 */
+	sb->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
+
 	if (!sb->s_root) {
 		sb->s_flags = flags;
 		err = proc_fill_super(sb);

[toc] | [prev] | [next] | [standalone]

#1462090 — [PATCH 3.2 34/94] RDMA/cxgb3: device driver frees DMA memory with different size

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 34/94] RDMA/cxgb3: device driver frees DMA memory with different size
Message-ID<s62oO-7TC-39@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Honggang Li <honli@redhat.com>

commit 0de4cbb3dddca35ecd06b95918f38439c9c6401f upstream.

[  598.852037] ------------[ cut here ]------------
[  598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920()
[  598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes]
[  598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod
[  598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1
[  598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012
[  598.962193]  ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918
[  598.969663]  ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0
[  598.977132]  ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00
[  598.984602] Call Trace:
[  598.987062]  [<ffffffff81700918>] dump_stack+0x19/0x1b
[  598.992224]  [<ffffffff8108b6c0>] warn_slowpath_common+0x70/0xb0
[  598.998254]  [<ffffffff8108b75c>] warn_slowpath_fmt+0x5c/0x80
[  599.004033]  [<ffffffff813903b8>] check_unmap+0xf8/0x920
[  599.009369]  [<ffffffff81025959>] ? sched_clock+0x9/0x10
[  599.014702]  [<ffffffff81390cee>] debug_dma_free_coherent+0x7e/0xa0
[  599.021008]  [<ffffffffa01ece2c>] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3]
[  599.027654]  [<ffffffffa01e8da0>] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3]
[  599.034307]  [<ffffffffa01c4bfe>] ib_destroy_cq+0x1e/0x30 [ib_core]
[  599.040601]  [<ffffffffa04ff2d2>] ib_uverbs_close+0x302/0x4d0 [ib_uverbs]
[  599.047417]  [<ffffffff812335a2>] __fput+0x102/0x310
[  599.052401]  [<ffffffff8123388e>] ____fput+0xe/0x10
[  599.057297]  [<ffffffff810bbde4>] task_work_run+0xb4/0xe0
[  599.062719]  [<ffffffff81092a84>] do_exit+0x304/0xc60
[  599.067789]  [<ffffffff81025905>] ? native_sched_clock+0x35/0x80
[  599.073820]  [<ffffffff81025959>] ? sched_clock+0x9/0x10
[  599.079153]  [<ffffffff8170a49c>] ? _raw_spin_unlock_irq+0x2c/0x50
[  599.085358]  [<ffffffff8109346c>] do_group_exit+0x4c/0xc0
[  599.090779]  [<ffffffff810a8661>] get_signal_to_deliver+0x2e1/0x960
[  599.097071]  [<ffffffff8101c497>] do_signal+0x57/0x6e0
[  599.102229]  [<ffffffff81714bd1>] ? sysret_signal+0x5/0x4e
[  599.107738]  [<ffffffff8101cb7f>] do_notify_resume+0x5f/0xb0
[  599.113418]  [<ffffffff81714e7d>] int_signal+0x12/0x17
[  599.118576] ---[ end trace 1e4653102e7e7019 ]---
[  599.123211] Mapped at:
[  599.125577]  [<ffffffff8138ed8b>] debug_dma_alloc_coherent+0x2b/0x80
[  599.131968]  [<ffffffffa01ec862>] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3]
[  599.139920]  [<ffffffffa01e9c05>] iwch_create_cq+0x105/0x4e0 [iw_cxgb3]
[  599.147895]  [<ffffffffa0500584>] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs]
[  599.156649]  [<ffffffffa05027fb>] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs]

Fixes: b955150ea784 ('RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error')
Signed-off-by: Honggang Li <honli@redhat.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rd
 	kfree(cq->sw_queue);
 	dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
 			  (1UL << (cq->size_log2))
-			  * sizeof(struct t3_cqe), cq->queue,
+			  * sizeof(struct t3_cqe) + 1, cq->queue,
 			  dma_unmap_addr(cq, mapping));
 	cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
 	return err;

[toc] | [prev] | [next] | [standalone]

#1462092 — [PATCH 3.2 22/94] net/mlx4_core: Fix access to uninitialized index

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 22/94] net/mlx4_core: Fix access to uninitialized index
Message-ID<s62oP-7TC-45@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Tariq Toukan <tariqt@mellanox.com>

commit 2bb07e155bb3e0c722c806723f737cf8020961ef upstream.

Prevent using uninitialized or negative index when handling
steering entries.

Fixes: b12d93d63c32 ('mlx4: Add support for promiscuous mode in the new steering model.')
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/ethernet/mellanox/mlx4/mcg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -615,7 +615,7 @@ int mlx4_qp_attach_common(struct mlx4_de
 	struct mlx4_mgm *mgm;
 	u32 members_count;
 	u16 hash;
-	int index, prev;
+	int index = -1, prev;
 	int link = 0;
 	int i;
 	int err;
@@ -693,7 +693,7 @@ int mlx4_qp_attach_common(struct mlx4_de
 		goto out;
 
 out:
-	if (prot == MLX4_PROT_ETH) {
+	if (prot == MLX4_PROT_ETH && index != -1) {
 		/* manage the steering entry for promisc mode */
 		if (new_entry)
 			new_steering_entry(dev, 0, port, steer, index, qp->qpn);

[toc] | [prev] | [next] | [standalone]

#1462098 — [PATCH 3.2 82/94] xenbus: don't BUG() on user mode induced condition

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 82/94] xenbus: don't BUG() on user mode induced condition
Message-ID<s62oP-7TC-63@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Beulich <JBeulich@suse.com>

commit 0beef634b86a1350c31da5fcc2992f0d7c8a622b upstream.

Inability to locate a user mode specified transaction ID should not
lead to a kernel crash. For other than XS_TRANSACTION_START also
don't issue anything to xenbus if the specified ID doesn't match that
of any active transaction.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/xen/xenfs/xenbus.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

--- a/drivers/xen/xenfs/xenbus.c
+++ b/drivers/xen/xenfs/xenbus.c
@@ -310,11 +310,18 @@ static int xenbus_write_transaction(unsi
 			rc = -ENOMEM;
 			goto out;
 		}
+	} else {
+		list_for_each_entry(trans, &u->transactions, list)
+			if (trans->handle.id == u->u.msg.tx_id)
+				break;
+		if (&trans->list == &u->transactions)
+			return -ESRCH;
 	}
 
 	reply = xenbus_dev_request_and_reply(&u->u.msg);
 	if (IS_ERR(reply)) {
-		kfree(trans);
+		if (msg_type == XS_TRANSACTION_START)
+			kfree(trans);
 		rc = PTR_ERR(reply);
 		goto out;
 	}
@@ -324,12 +331,7 @@ static int xenbus_write_transaction(unsi
 
 		list_add(&trans->list, &u->transactions);
 	} else if (msg_type == XS_TRANSACTION_END) {
-		list_for_each_entry(trans, &u->transactions, list)
-			if (trans->handle.id == u->u.msg.tx_id)
-				break;
-		BUG_ON(&trans->list == &u->transactions);
 		list_del(&trans->list);
-
 		kfree(trans);
 	}

[toc] | [prev] | [next] | [standalone]

#1462099 — [PATCH 3.2 69/94] ALSA: dummy: Fix a use-after-free at closing

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 69/94] ALSA: dummy: Fix a use-after-free at closing
Message-ID<s62oP-7TC-71@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Takashi Iwai <tiwai@suse.de>

commit d5dbbe6569481bf12dcbe3e12cff72c5f78d272c upstream.

syzkaller fuzzer spotted a potential use-after-free case in snd-dummy
driver when hrtimer is used as backend:
> ==================================================================
> BUG: KASAN: use-after-free in rb_erase+0x1b17/0x2010 at addr ffff88005e5b6f68
>  Read of size 8 by task syz-executor/8984
> =============================================================================
> BUG kmalloc-192 (Not tainted): kasan: bad access detected
> -----------------------------------------------------------------------------
>
> Disabling lock debugging due to kernel taint
> INFO: Allocated in 0xbbbbbbbbbbbbbbbb age=18446705582212484632
> ....
> [<      none      >] dummy_hrtimer_create+0x49/0x1a0 sound/drivers/dummy.c:464
> ....
> INFO: Freed in 0xfffd8e09 age=18446705496313138713 cpu=2164287125 pid=-1
> [<      none      >] dummy_hrtimer_free+0x68/0x80 sound/drivers/dummy.c:481
> ....
> Call Trace:
>  [<ffffffff8179e59e>] __asan_report_load8_noabort+0x3e/0x40 mm/kasan/report.c:333
>  [<     inline     >] rb_set_parent include/linux/rbtree_augmented.h:111
>  [<     inline     >] __rb_erase_augmented include/linux/rbtree_augmented.h:218
>  [<ffffffff82ca5787>] rb_erase+0x1b17/0x2010 lib/rbtree.c:427
>  [<ffffffff82cb02e8>] timerqueue_del+0x78/0x170 lib/timerqueue.c:86
>  [<ffffffff814d0c80>] __remove_hrtimer+0x90/0x220 kernel/time/hrtimer.c:903
>  [<     inline     >] remove_hrtimer kernel/time/hrtimer.c:945
>  [<ffffffff814d23da>] hrtimer_try_to_cancel+0x22a/0x570 kernel/time/hrtimer.c:1046
>  [<ffffffff814d2742>] hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1066
>  [<ffffffff85420531>] dummy_hrtimer_stop+0x91/0xb0 sound/drivers/dummy.c:417
>  [<ffffffff854228bf>] dummy_pcm_trigger+0x17f/0x1e0 sound/drivers/dummy.c:507
>  [<ffffffff85392170>] snd_pcm_do_stop+0x160/0x1b0 sound/core/pcm_native.c:1106
>  [<ffffffff85391b26>] snd_pcm_action_single+0x76/0x120 sound/core/pcm_native.c:956
>  [<ffffffff85391e01>] snd_pcm_action+0x231/0x290 sound/core/pcm_native.c:974
>  [<     inline     >] snd_pcm_stop sound/core/pcm_native.c:1139
>  [<ffffffff8539754d>] snd_pcm_drop+0x12d/0x1d0 sound/core/pcm_native.c:1784
>  [<ffffffff8539d3be>] snd_pcm_common_ioctl1+0xfae/0x2150 sound/core/pcm_native.c:2805
>  [<ffffffff8539ee91>] snd_pcm_capture_ioctl1+0x2a1/0x5e0 sound/core/pcm_native.c:2976
>  [<ffffffff8539f2ec>] snd_pcm_kernel_ioctl+0x11c/0x160 sound/core/pcm_native.c:3020
>  [<ffffffff853d9a44>] snd_pcm_oss_sync+0x3a4/0xa30 sound/core/oss/pcm_oss.c:1693
>  [<ffffffff853da27d>] snd_pcm_oss_release+0x1ad/0x280 sound/core/oss/pcm_oss.c:2483
>  .....

A workaround is to call hrtimer_cancel() in dummy_hrtimer_sync() which
is called certainly before other blocking ops.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 sound/drivers/dummy.c | 1 +
 1 file changed, 1 insertion(+)

--- a/sound/drivers/dummy.c
+++ b/sound/drivers/dummy.c
@@ -419,6 +419,7 @@ static int dummy_hrtimer_stop(struct snd
 
 static inline void dummy_hrtimer_sync(struct dummy_hrtimer_pcm *dpcm)
 {
+	hrtimer_cancel(&dpcm->timer);
 	tasklet_kill(&dpcm->tasklet);
 }

[toc] | [prev] | [next] | [standalone]

#1462101 — [PATCH 3.2 74/94] NFS: Fix another OPEN_DOWNGRADE bug

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 74/94] NFS: Fix another OPEN_DOWNGRADE bug
Message-ID<s62oQ-7TC-83@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit e547f2628327fec6afd2e03b46f113f614cca05b upstream.

Olga Kornievskaia reports that the following test fails to trigger
an OPEN_DOWNGRADE on the wire, and only triggers the final CLOSE.

	fd0 = open(foo, RDRW)   -- should be open on the wire for "both"
	fd1 = open(foo, RDONLY)  -- should be open on the wire for "read"
	close(fd0) -- should trigger an open_downgrade
	read(fd1)
	close(fd1)

The issue is that we're missing a check for whether or not the current
state transitioned from an O_RDWR state as opposed to having transitioned
from a combination of O_RDONLY and O_WRONLY.

Reported-by: Olga Kornievskaia <aglo@umich.edu>
Fixes: cd9288ffaea4 ("NFSv4: Fix another bug in the close/open_downgrade code")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 fs/nfs/nfs4proc.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2025,12 +2025,11 @@ static void nfs4_close_prepare(struct rp
 			call_close |= is_wronly;
 		else if (is_wronly)
 			calldata->arg.fmode |= FMODE_WRITE;
+		if (calldata->arg.fmode != (FMODE_READ|FMODE_WRITE))
+			call_close |= is_rdwr;
 	} else if (is_rdwr)
 		calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
 
-	if (calldata->arg.fmode == 0)
-		call_close |= is_rdwr;
-
 	spin_unlock(&state->owner->so_lock);
 
 	if (!call_close) {

[toc] | [prev] | [next] | [standalone]

#1462102 — [PATCH 3.2 73/94] ALSA: echoaudio: Fix memory allocation

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 73/94] ALSA: echoaudio: Fix memory allocation
Message-ID<s62oQ-7TC-85@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

commit 9c6795a9b3cbb56a9fbfaf43909c5c22999ba317 upstream.

'commpage_bak' is allocated with 'sizeof(struct echoaudio)' bytes.
We then copy 'sizeof(struct comm_page)' bytes in it.
On my system, smatch complains because one is 2960 and the other is 3072.

This would result in memory corruption or a oops.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 sound/pci/echoaudio/echoaudio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -2251,11 +2251,11 @@ static int snd_echo_resume(struct pci_de
 
 	DE_INIT(("resume start\n"));
 	pci_restore_state(pci);
-	commpage_bak = kmalloc(sizeof(struct echoaudio), GFP_KERNEL);
+	commpage_bak = kmalloc(sizeof(*commpage), GFP_KERNEL);
 	if (commpage_bak == NULL)
 		return -ENOMEM;
 	commpage = chip->comm_page;
-	memcpy(commpage_bak, commpage, sizeof(struct comm_page));
+	memcpy(commpage_bak, commpage, sizeof(*commpage));
 
 	err = init_hw(chip, chip->pci->device, chip->pci->subsystem_device);
 	if (err < 0) {

[toc] | [prev] | [next] | [standalone]

#1462106 — [PATCH 3.2 61/94] mm: Export migrate_page_move_mapping and migrate_page_copy

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 61/94] mm: Export migrate_page_move_mapping and migrate_page_copy
Message-ID<s62oQ-7TC-91@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Richard Weinberger <richard@nod.at>

commit 1118dce773d84f39ebd51a9fe7261f9169cb056e upstream.

Export these symbols such that UBIFS can implement
->migratepage.

Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Christoph Hellwig <hch@lst.de>
[bwh: Backported to 3.2: also change migrate_page_move_mapping() from
 static to extern, done as part of an earlier commit upstream]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 mm/migrate.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -294,7 +294,7 @@ static inline bool buffer_migrate_lock_b
  * 2 for pages with a mapping
  * 3 for pages with a mapping and PagePrivate/PagePrivate2 set.
  */
-static int migrate_page_move_mapping(struct address_space *mapping,
+int migrate_page_move_mapping(struct address_space *mapping,
 		struct page *newpage, struct page *page,
 		struct buffer_head *head, enum migrate_mode mode)
 {
@@ -377,6 +377,7 @@ static int migrate_page_move_mapping(str
 
 	return 0;
 }
+EXPORT_SYMBOL(migrate_page_move_mapping);
 
 /*
  * The expected number of remaining references is the same as that
@@ -476,6 +477,7 @@ void migrate_page_copy(struct page *newp
 	if (PageWriteback(newpage))
 		end_page_writeback(newpage);
 }
+EXPORT_SYMBOL(migrate_page_copy);
 
 /************************************************************
  *                    Migration functions
--- a/include/linux/migrate.h
+++ b/include/linux/migrate.h
@@ -43,6 +43,9 @@ extern int migrate_vmas(struct mm_struct
 extern void migrate_page_copy(struct page *newpage, struct page *page);
 extern int migrate_huge_page_move_mapping(struct address_space *mapping,
 				  struct page *newpage, struct page *page);
+extern int migrate_page_move_mapping(struct address_space *mapping,
+		struct page *newpage, struct page *page,
+		struct buffer_head *head, enum migrate_mode mode);
 #else
 #define PAGE_MIGRATION 0

[toc] | [prev] | [next] | [standalone]

#1462109 — [PATCH 3.2 02/94] ath5k: Change led pin configuration for compaq c700 laptop

FromBen Hutchings <ben@decadent.org.uk>
Date2016-08-14 14:10 +0200
Subject[PATCH 3.2 02/94] ath5k: Change led pin configuration for compaq c700 laptop
Message-ID<s62oQ-7TC-99@gated-at.bofh.it>
In reply to#1462038
3.2.82-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Joseph Salisbury <joseph.salisbury@canonical.com>

commit 7b9bc799a445aea95f64f15e0083cb19b5789abe upstream.

BugLink: http://bugs.launchpad.net/bugs/972604

Commit 09c9bae26b0d3c9472cb6ae45010460a2cee8b8d ("ath5k: add led pin
configuration for compaq c700 laptop") added a pin configuration for the Compaq
c700 laptop.  However, the polarity of the led pin is reversed.  It should be
red for wifi off and blue for wifi on, but it is the opposite.  This bug was
reported in the following bug report:
http://pad.lv/972604

Fixes: 09c9bae26b0d3c9472cb6ae45010460a2cee8b8d ("ath5k: add led pin configuration for compaq c700 laptop")
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/wireless/ath/ath5k/led.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/ath/ath5k/led.c
+++ b/drivers/net/wireless/ath/ath5k/led.c
@@ -75,7 +75,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_led
 	/* HP Compaq CQ60-206US (ddreggors@jumptv.com) */
 	{ ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) },
 	/* HP Compaq C700 (nitrousnrg@gmail.com) */
-	{ ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) },
+	{ ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 0) },
 	/* LiteOn AR5BXB63 (magooz@salug.it) */
 	{ ATH_SDEVICE(PCI_VENDOR_ID_ATHEROS, 0x3067), ATH_LED(3, 0) },
 	/* IBM-specific AR5212 (all others) */

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | linux.kernel

csiph-web