Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1481599 > unrolled thread

[PATCH 4.4 000/192] 4.4.21-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.4 000/192] 4.4.21-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 049/192] [PATCH 050/135] lpfc: Fix the FLOGI discovery logic to comply with T11 standards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 033/192] [PATCH 034/135] Drivers: hv: util: Increase the timeout for util services Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 059/192] [PATCH 061/135] s390/cio: update measurement characteristics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 077/192] [PATCH 080/135] qla2xxx: Use ATIO type to send correct tmr response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 041/192] [PATCH 042/135] cxl: Fix possible idr warning when contexts are released Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
    [PATCH 4.4 112/192] [PATCH 116/135] blk-mq: End unstarted requests on dying queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 098/192] [PATCH 102/135] proc: revert /proc/<pid>/maps [stack:TID] annotation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 116/192] [PATCH 120/135] block: fix blk_rq_get_max_sectors for driver private requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 105/192] [PATCH 109/135] time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 111/192] [PATCH 115/135] cxlflash: Fix to resolve dead-lock during EEH recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 070/192] [PATCH 073/135] mpt3sas: Fix for Asynchronous completion of timedout IO and task abort of timedout IO. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 130/192] [PATCH 134/135] tipc: fix an infoleak in tipc_nl_compat_link_dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 148/192] ext4: fix xattr shifting when expanding inodes part 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 183/192] ALSA: hda - Enable subwoofer on Dell Inspiron 7559 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 093/192] [PATCH 097/135] Drivers: hv: vmbus: avoid infinite loop in init_vp_index() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 184/192] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 141/192] [PATCH 4.4 12/16] cxlflash: Move to exponential back-off when cmd_room is not available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 101/192] [PATCH 105/135] perf/x86/cqm: Fix CQM memory leak and notifier leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 160/192] drm: Reject page_flip for !DRIVER_MODESET Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 117/192] [PATCH 121/135] lpfc: Fix DMA faults observed upon plugging loopback connector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 144/192] kernel: Add noaudit variant of ns_capable() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 187/192] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 069/192] [PATCH 072/135] mpt3sas: A correction in unmap_resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 182/192] ALSA: hda - Add headset mic quirk for Dell Inspiron 5468 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 189/192] cpufreq: Fix GOV_LIMITS handling for the userspace governor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 174/192] vhost/scsi: fix reuse of &vq->iov[out] in response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 188/192] metag: Fix atomic_*_return inline asm constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 158/192] s390/sclp_ctl: fix potential information leak with /dev/sclp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 186/192] ALSA: timer: fix NULL pointer dereference on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 125/192] [PATCH 129/135] Input: xpad - move pending clear to the correct location Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 142/192] [PATCH 4.4 13/16] drivers:hv: Lock access to hyperv_mmio resource tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 118/192] [PATCH 122/135] HID: core: prevent out-of-bound readings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 138/192] [PATCH 4.4 08/16] cred: Reject inodes with invalid ids in set_create_file_as() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 176/192] uprobes: Fix the memcg accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 150/192] ext4: avoid deadlock when expanding inode size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 185/192] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 106/192] [PATCH 110/135] ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 192/192] lib/mpi: mpi_write_sgl(): fix skipping of leading zero limbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 091/192] [PATCH 095/135] arcmsr: fixed getting wrong configuration data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 128/192] [PATCH 132/135] Bluetooth: Add support for Intel Bluetooth device 8265 [8087:0a2b] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 190/192] hwrng: exynos - Disable runtime PM on probe failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 165/192] timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 140/192] [PATCH 4.4 11/16] netfilter: x_tables: check for size overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 133/192] [PATCH 4.4 02/16] cxlflash: Fix to avoid virtual LUN failover failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 163/192] xfs: fix superblock inprogress check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 178/192] ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 164/192] timekeeping: Cap array access in timekeeping_debug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 122/192] [PATCH 126/135] crypto: vmx - IV size failing on skcipher API Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 068/192] [PATCH 071/135] net: cavium: liquidio: fix check for in progress flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 170/192] ovl: listxattr: use strnlen() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 073/192] [PATCH 076/135] drm/i915/bxt: update list of PCIIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 180/192] ALSA: fireworks: accessing to user space outside spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 147/192] ext4: fix xattr shifting when expanding inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 137/192] [PATCH 4.4 07/16] fs: Check for invalid i_uid in may_follow_link() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 071/192] [PATCH 074/135] i40e/i40evf: Fix RSS rx-flow-hash configuration through ethtool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 152/192] block: Fix race triggered by blk_set_queue_dying() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 096/192] [PATCH 100/135] cxlflash: Fix to avoid unnecessary scan with internal LUNs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 132/192] [PATCH 4.4 01/16] cxlflash: Fix to escalate LINK_RESET also on port 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 102/192] [PATCH 106/135] net: thunderx: Fix for multiqset not configured upon interface toggle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 135/192] [PATCH 4.4 05/16] udp: properly support MSG_PEEK with truncated buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 169/192] ovl: remove posix_acl_default from workdir Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 181/192] ALSA: rawmidi: Fix possible deadlock with virmidi registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 154/192] cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 173/192] bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 161/192] drm/msm: fix use of copy_from_user() while holding spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 156/192] powerpc/tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 109/192] [PATCH 113/135] ecryptfs: fix handling of directory opening Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
    [PATCH 4.4 168/192] ovl: dont copy up opaqueness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 149/192] ext4: properly align shifted xattrs when expanding inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 155/192] nvme: Call pci_disable_device on the error path. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 131/192] [PATCH 135/135] tipc: fix nl compat regression for link statistics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 146/192] ext4: validate that metadata blocks do not overlap superblock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 162/192] ASoC: atmel_ssc_dai: Dont unconditionally reset SSC on stream startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 104/192] [PATCH 108/135] Input: xpad - correctly handle concurrent LED and FF requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 175/192] x86/apic: Do not init irq remapping if ioapic is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 129/192] [PATCH 133/135] netfilter: x_tables: check for size overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 153/192] block: make sure a big bio is split into at most 256 bvecs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 145/192] net: Use ns_capable_noaudit() when determining net sysctl permissions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 179/192] ALSA: firewire-tascam: accessing to user space outside spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 134/192] [PATCH 4.4 04/16] crypto: nx-842 - Mask XERS0 bit in return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 171/192] ovl: fix workdir creation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 166/192] lustre: remove unused declaration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 167/192] [PATCH] wrappers for ->i_mutex access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 157/192] rds: fix an infoleak in rds_inc_info_copy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 143/192] [PATCH 4.4 14/16] KEYS: Fix ASN.1 indefinite length object parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 136/192] [PATCH 4.4 06/16] IB/IPoIB: Do not set skb truesize since using one linearskb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 124/192] [PATCH 128/135] net: thunderx: Fix link status reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 113/192] [PATCH 117/135] btrfs: Continue write in case of can_not_nocow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
    [PATCH 4.4 123/192] [PATCH 127/135] x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 088/192] [PATCH 092/135] net/mlx5e: Dont try to modify CQ moderation if it is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 115/192] [PATCH 119/135] irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum 23144 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 092/192] [PATCH 096/135] arcmsr: fixes not release allocated resource Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 065/192] [PATCH 068/135] pwm: lpc32xx: fix and simplify duty cycle and period calculations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 082/192] [PATCH 086/135] tipc: fix nullptr crash during subscription cancel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 119/192] [PATCH 123/135] crypto: vmx - comply with ABIs that specify vrsave as reserved. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 100/192] [PATCH 104/135] perf/x86/cqm: Fix CQM handling of grouping events into a cache_group Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 081/192] [PATCH 085/135] arm64: Add workaround for Cavium erratum 27456 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 114/192] [PATCH 118/135] clocksource: Allow unregistering the watchdog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 078/192] [PATCH 081/135] drm/amdgpu: fix dp link rate selection (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 097/192] [PATCH 101/135] intel_idle: Support for Intel Xeon Phi Processor x200 Product Family Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 066/192] [PATCH 069/135] irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 099/192] [PATCH 103/135] s390/crypto: provide correct file mode at device register. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 120/192] [PATCH 124/135] crypto: vmx - Fix ABI detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 121/192] [PATCH 125/135] tda10071: Fix dependency to REGMAP_I2C Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 086/192] [PATCH 090/135] UVC: Add support for R200 depth camera Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 103/192] [PATCH 107/135] net: thunderx: Fix receive packet stats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 072/192] [PATCH 075/135] hrtimer: Catch illegal clockids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 094/192] [PATCH 098/135] Drivers: hv: vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 095/192] [PATCH 099/135] Drivers: hv: vmbus: dont manipulate with clocksources on crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 067/192] [PATCH 070/135] arm64: KVM: Configure TCR_EL2.PS at runtime Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 089/192] [PATCH 093/135] net/mlx5e: Dont modify CQ before it was created Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 076/192] [PATCH 079/135] mmc: sdhci: 64-bit DMA actually has 4-byte alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
    [PATCH 4.4 054/192] [PATCH 056/135] lpfc: Fix mbox reuse in PLOGI completion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 026/192] [PATCH 026/135] cxlflash: a couple off by one bugs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 024/192] [PATCH 024/135] fm10k: Cleanup MSI-X interrupts in case of failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 064/192] [PATCH 067/135] pwm: lpc32xx: correct number of PWM channels from 2 to 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 038/192] [PATCH 039/135] Drivers: hv: vss: run only on supported host versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 044/192] [PATCH 045/135] cxlflash: Resolve oops in wait_port_offline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 061/192] [PATCH 064/135] megaraid_sas: Fix SMAP issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 050/192] [PATCH 051/135] lpfc: Fix RegLogin failed error seen on Lancer FC during port bounce Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 056/192] [PATCH 058/135] qeth: initialize net_device with carrier off Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 035/192] [PATCH 036/135] tools: hv: report ENOSPC errors in hv_fcopy_daemon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
      Re: [PATCH 4.4 035/192] [PATCH 036/135] tools: hv: report ENOSPC  errors in hv_fcopy_daemon Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 14:40 +0200
    [PATCH 4.4 037/192] [PATCH 038/135] drivers/hv: cleanup synic msrs if vmbus connect failed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 010/192] [PATCH 010/135] i40e: Fix Rx hash reported to the stack by our driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 046/192] [PATCH 047/135] cxl: fix build for GCC 4.6.x Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 012/192] [PATCH 012/135] igb: use the correct i210 register for EEMNGCTL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 043/192] [PATCH 044/135] cxlflash: Fix to resolve cmd leak after host reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 048/192] [PATCH 049/135] lpfc: Fix FCF Infinite loop in lpfc_sli4_fcf_rr_next_index_get. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 008/192] [PATCH 008/135] i40evf: check rings before freeing resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 042/192] [PATCH 043/135] cxl: Fix DSI misses when the context owning task exits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 040/192] [PATCH 041/135] Drivers: hv: vmbus: fix rescind-offer handling for device without a driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
    [PATCH 4.4 018/192] [PATCH 018/135] fm10k: do not assume VF always has 1 queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
    [PATCH 4.4 022/192] [PATCH 022/135] fm10k: always check init_hw for errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
    [PATCH 4.4 023/192] [PATCH 023/135] fm10k: reinitialize queuing scheme after calling init_hw Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
    [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
      Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider  with non-zero shift value Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 13:50 +0200
        Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with  non-zero shift value Loc Ho <lho@apm.com> - 2016-09-20 18:10 +0200
          Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider  with non-zero shift value Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 18:30 +0200
            Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with  non-zero shift value Loc Ho <lho@apm.com> - 2016-09-20 18:40 +0200
    [PATCH 4.4 019/192] [PATCH 019/135] fm10k: Correct MTU for jumbo frames Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
    [PATCH 4.4 110/192] [PATCH 114/135] drm/radeon/mst: fix regression in lane/link handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 21:10 +0200
    Re: [PATCH 4.4 000/192] 4.4.21-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-13 05:10 +0200
    Re: [PATCH 4.4 000/192] 4.4.21-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-09-13 20:40 +0200
    Re: [PATCH 4.4 000/192] 4.4.21-stable review Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-15 00:30 +0200
      Re: [PATCH 4.4 000/192] 4.4.21-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-15 08:20 +0200

Page 2 of 8 — ← Prev page 1 [2] 3 4 5 6 7 8  Next page →

#1481619 — [PATCH 4.4 117/192] [PATCH 121/135] lpfc: Fix DMA faults observed upon plugging loopback connector

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit ae09c765109293b600ba9169aa3d632e1ac1a843 ]

Driver didn't program the REG_VFI mailbox correctly, giving the adapter
bad addresses.

Signed-off-by: Dick Kennedy <dick.kennedy@avagotech.com>
Signed-off-by: James Smart <james.smart@avagotech.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/lpfc/lpfc_mbox.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

--- a/drivers/scsi/lpfc/lpfc_mbox.c
+++ b/drivers/scsi/lpfc/lpfc_mbox.c
@@ -2145,10 +2145,12 @@ lpfc_reg_vfi(struct lpfcMboxq *mbox, str
 	reg_vfi->wwn[1] = cpu_to_le32(reg_vfi->wwn[1]);
 	reg_vfi->e_d_tov = phba->fc_edtov;
 	reg_vfi->r_a_tov = phba->fc_ratov;
-	reg_vfi->bde.addrHigh = putPaddrHigh(phys);
-	reg_vfi->bde.addrLow = putPaddrLow(phys);
-	reg_vfi->bde.tus.f.bdeSize = sizeof(vport->fc_sparam);
-	reg_vfi->bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64;
+	if (phys) {
+		reg_vfi->bde.addrHigh = putPaddrHigh(phys);
+		reg_vfi->bde.addrLow = putPaddrLow(phys);
+		reg_vfi->bde.tus.f.bdeSize = sizeof(vport->fc_sparam);
+		reg_vfi->bde.tus.f.bdeFlags = BUFF_TYPE_BDE_64;
+	}
 	bf_set(lpfc_reg_vfi_nport_id, reg_vfi, vport->fc_myDID);
 
 	/* Only FC supports upd bit */

[toc] | [prev] | [next] | [standalone]

#1481620 — [PATCH 4.4 144/192] kernel: Add noaudit variant of ns_capable()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tyler Hicks <tyhicks@canonical.com>

commit 98f368e9e2630a3ce3e80fb10fb2e02038cf9578 upstream.

When checking the current cred for a capability in a specific user
namespace, it isn't always desirable to have the LSMs audit the check.
This patch adds a noaudit variant of ns_capable() for when those
situations arise.

The common logic between ns_capable() and the new ns_capable_noaudit()
is moved into a single, shared function to keep duplicated code to a
minimum and ease maintainability.

Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/capability.h |    5 ++++
 kernel/capability.c        |   46 +++++++++++++++++++++++++++++++++++----------
 2 files changed, 41 insertions(+), 10 deletions(-)

--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -214,6 +214,7 @@ extern bool has_ns_capability_noaudit(st
 				      struct user_namespace *ns, int cap);
 extern bool capable(int cap);
 extern bool ns_capable(struct user_namespace *ns, int cap);
+extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
 #else
 static inline bool has_capability(struct task_struct *t, int cap)
 {
@@ -241,6 +242,10 @@ static inline bool ns_capable(struct use
 {
 	return true;
 }
+static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
+{
+	return true;
+}
 #endif /* CONFIG_MULTIUSER */
 extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
 extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -361,6 +361,24 @@ bool has_capability_noaudit(struct task_
 	return has_ns_capability_noaudit(t, &init_user_ns, cap);
 }
 
+static bool ns_capable_common(struct user_namespace *ns, int cap, bool audit)
+{
+	int capable;
+
+	if (unlikely(!cap_valid(cap))) {
+		pr_crit("capable() called with invalid cap=%u\n", cap);
+		BUG();
+	}
+
+	capable = audit ? security_capable(current_cred(), ns, cap) :
+			  security_capable_noaudit(current_cred(), ns, cap);
+	if (capable == 0) {
+		current->flags |= PF_SUPERPRIV;
+		return true;
+	}
+	return false;
+}
+
 /**
  * ns_capable - Determine if the current task has a superior capability in effect
  * @ns:  The usernamespace we want the capability in
@@ -374,19 +392,27 @@ bool has_capability_noaudit(struct task_
  */
 bool ns_capable(struct user_namespace *ns, int cap)
 {
-	if (unlikely(!cap_valid(cap))) {
-		pr_crit("capable() called with invalid cap=%u\n", cap);
-		BUG();
-	}
-
-	if (security_capable(current_cred(), ns, cap) == 0) {
-		current->flags |= PF_SUPERPRIV;
-		return true;
-	}
-	return false;
+	return ns_capable_common(ns, cap, true);
 }
 EXPORT_SYMBOL(ns_capable);
 
+/**
+ * ns_capable_noaudit - Determine if the current task has a superior capability
+ * (unaudited) in effect
+ * @ns:  The usernamespace we want the capability in
+ * @cap: The capability to be tested for
+ *
+ * Return true if the current task has the given superior capability currently
+ * available for use, false if not.
+ *
+ * This sets PF_SUPERPRIV on the task if the capability is available on the
+ * assumption that it's about to be used.
+ */
+bool ns_capable_noaudit(struct user_namespace *ns, int cap)
+{
+	return ns_capable_common(ns, cap, false);
+}
+EXPORT_SYMBOL(ns_capable_noaudit);
 
 /**
  * capable - Determine if the current task has a superior capability in effect

[toc] | [prev] | [next] | [standalone]

#1481621 — [PATCH 4.4 187/192] scsi: fix upper bounds check of sense key in scsi_sense_key_string()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>

commit a87eeb900dbb9f8202f96604d56e47e67c936b9d upstream.

Commit 655ee63cf371 ("scsi constants: command, sense key + additional
sense string") added a "Completed" sense string with key 0xF to
snstext[], but failed to updated the upper bounds check of the sense key
in scsi_sense_key_string().

Fixes: 655ee63cf371 ("[SCSI] scsi constants: command, sense key + additional sense strings")
Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Reviewed-by: Bart Van Assche <bart.vanassche@sandisk.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/constants.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/drivers/scsi/constants.c
+++ b/drivers/scsi/constants.c
@@ -1181,8 +1181,9 @@ static const char * const snstext[] = {
 
 /* Get sense key string or NULL if not available */
 const char *
-scsi_sense_key_string(unsigned char key) {
-	if (key <= 0xE)
+scsi_sense_key_string(unsigned char key)
+{
+	if (key < ARRAY_SIZE(snstext))
 		return snstext[key];
 	return NULL;
 }

[toc] | [prev] | [next] | [standalone]

#1481622 — [PATCH 4.4 069/192] [PATCH 072/135] mpt3sas: A correction in unmap_resources

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 5f985d88bac34e7f3b4403118eab072902a0b392 ]

It might happen that we try to free an already freed pointer.

Reported-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Tomas Henzl <thenzl@redhat.com>
Acked-by: Chaitra P B <chaitra.basappa@avagotech.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/mpt3sas/mpt3sas_base.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -2020,8 +2020,10 @@ mpt3sas_base_unmap_resources(struct MPT3
 	_base_free_irq(ioc);
 	_base_disable_msix(ioc);
 
-	if (ioc->msix96_vector)
+	if (ioc->msix96_vector) {
 		kfree(ioc->replyPostRegisterIndex);
+		ioc->replyPostRegisterIndex = NULL;
+	}
 
 	if (ioc->chip_phys) {
 		iounmap(ioc->chip);

[toc] | [prev] | [next] | [standalone]

#1481623 — [PATCH 4.4 182/192] ALSA: hda - Add headset mic quirk for Dell Inspiron 5468

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Shrirang Bagul <shrirang.bagul@canonical.com>

commit 311042d1b67d9a1856a8e1294e7729fb86f64014 upstream.

This patch enables headset microphone on some variants of
Dell Inspiron 5468. (Dell SSID 0x07ad)

BugLink: https://bugs.launchpad.net/bugs/1617900
Signed-off-by: Shrirang Bagul <shrirang.bagul@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5879,6 +5879,10 @@ static const struct snd_hda_pin_quirk al
 		{0x12, 0x90a60170},
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell Inspiron 5468", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x12, 0x90a60180},
+		{0x14, 0x90170120},
+		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC256_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,

[toc] | [prev] | [next] | [standalone]

#1481624 — [PATCH 4.4 189/192] cpufreq: Fix GOV_LIMITS handling for the userspace governor

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sai Gurrappadi <sgurrappadi@nvidia.com>

commit e43e94c1eda76dabd686ddf6f7825f54d747b310 upstream.

Currently, the userspace governor only updates frequency on GOV_LIMITS
if policy->cur falls outside policy->{min/max}. However, it is also
necessary to update current frequency on GOV_LIMITS to match the user
requested value if it can be achieved within the new policy->{max/min}.

This was previously the behaviour in the governor until commit d1922f0
("cpufreq: Simplify userspace governor") which incorrectly assumed that
policy->cur == user requested frequency via scaling_setspeed. This won't
be true if the user requested frequency falls outside policy->{min/max}.
Ex: a temporary thermal cap throttled the user requested frequency.

Fix this by storing the user requested frequency in a seperate variable.
The governor will then try to achieve this request on every GOV_LIMITS
change.

Fixes: d1922f02562f (cpufreq: Simplify userspace governor)
Signed-off-by: Sai Gurrappadi <sgurrappadi@nvidia.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpufreq/cpufreq_userspace.c |   43 +++++++++++++++++++++++++++++++-----
 1 file changed, 38 insertions(+), 5 deletions(-)

--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 
 static DEFINE_PER_CPU(unsigned int, cpu_is_managed);
 static DEFINE_MUTEX(userspace_mutex);
@@ -31,6 +32,7 @@ static DEFINE_MUTEX(userspace_mutex);
 static int cpufreq_set(struct cpufreq_policy *policy, unsigned int freq)
 {
 	int ret = -EINVAL;
+	unsigned int *setspeed = policy->governor_data;
 
 	pr_debug("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
@@ -38,6 +40,8 @@ static int cpufreq_set(struct cpufreq_po
 	if (!per_cpu(cpu_is_managed, policy->cpu))
 		goto err;
 
+	*setspeed = freq;
+
 	ret = __cpufreq_driver_target(policy, freq, CPUFREQ_RELATION_L);
  err:
 	mutex_unlock(&userspace_mutex);
@@ -49,19 +53,45 @@ static ssize_t show_speed(struct cpufreq
 	return sprintf(buf, "%u\n", policy->cur);
 }
 
+static int cpufreq_userspace_policy_init(struct cpufreq_policy *policy)
+{
+	unsigned int *setspeed;
+
+	setspeed = kzalloc(sizeof(*setspeed), GFP_KERNEL);
+	if (!setspeed)
+		return -ENOMEM;
+
+	policy->governor_data = setspeed;
+	return 0;
+}
+
 static int cpufreq_governor_userspace(struct cpufreq_policy *policy,
 				   unsigned int event)
 {
+	unsigned int *setspeed = policy->governor_data;
 	unsigned int cpu = policy->cpu;
 	int rc = 0;
 
+	if (event == CPUFREQ_GOV_POLICY_INIT)
+		return cpufreq_userspace_policy_init(policy);
+
+	if (!setspeed)
+		return -EINVAL;
+
 	switch (event) {
+	case CPUFREQ_GOV_POLICY_EXIT:
+		mutex_lock(&userspace_mutex);
+		policy->governor_data = NULL;
+		kfree(setspeed);
+		mutex_unlock(&userspace_mutex);
+		break;
 	case CPUFREQ_GOV_START:
 		BUG_ON(!policy->cur);
 		pr_debug("started managing cpu %u\n", cpu);
 
 		mutex_lock(&userspace_mutex);
 		per_cpu(cpu_is_managed, cpu) = 1;
+		*setspeed = policy->cur;
 		mutex_unlock(&userspace_mutex);
 		break;
 	case CPUFREQ_GOV_STOP:
@@ -69,20 +99,23 @@ static int cpufreq_governor_userspace(st
 
 		mutex_lock(&userspace_mutex);
 		per_cpu(cpu_is_managed, cpu) = 0;
+		*setspeed = 0;
 		mutex_unlock(&userspace_mutex);
 		break;
 	case CPUFREQ_GOV_LIMITS:
 		mutex_lock(&userspace_mutex);
-		pr_debug("limit event for cpu %u: %u - %u kHz, currently %u kHz\n",
-			cpu, policy->min, policy->max,
-			policy->cur);
+		pr_debug("limit event for cpu %u: %u - %u kHz, currently %u kHz, last set to %u kHz\n",
+			cpu, policy->min, policy->max, policy->cur, *setspeed);
 
-		if (policy->max < policy->cur)
+		if (policy->max < *setspeed)
 			__cpufreq_driver_target(policy, policy->max,
 						CPUFREQ_RELATION_H);
-		else if (policy->min > policy->cur)
+		else if (policy->min > *setspeed)
 			__cpufreq_driver_target(policy, policy->min,
 						CPUFREQ_RELATION_L);
+		else
+			__cpufreq_driver_target(policy, *setspeed,
+						CPUFREQ_RELATION_L);
 		mutex_unlock(&userspace_mutex);
 		break;
 	}

[toc] | [prev] | [next] | [standalone]

#1481625 — [PATCH 4.4 174/192] vhost/scsi: fix reuse of &vq->iov[out] in response

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Benjamin Coddington <bcodding@redhat.com>

commit a77ec83a57890240c546df00ca5df1cdeedb1cc3 upstream.

The address of the iovec &vq->iov[out] is not guaranteed to contain the scsi
command's response iovec throughout the lifetime of the command.  Rather, it
is more likely to contain an iovec from an immediately following command
after looping back around to vhost_get_vq_desc().  Pass along the iovec
entirely instead.

Fixes: 79c14141a487 ("vhost/scsi: Convert completion path to use copy_to_iter")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/vhost/scsi.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -88,7 +88,7 @@ struct vhost_scsi_cmd {
 	struct scatterlist *tvc_prot_sgl;
 	struct page **tvc_upages;
 	/* Pointer to response header iovec */
-	struct iovec *tvc_resp_iov;
+	struct iovec tvc_resp_iov;
 	/* Pointer to vhost_scsi for our device */
 	struct vhost_scsi *tvc_vhost;
 	/* Pointer to vhost_virtqueue for the cmd */
@@ -557,7 +557,7 @@ static void vhost_scsi_complete_cmd_work
 		memcpy(v_rsp.sense, cmd->tvc_sense_buf,
 		       se_cmd->scsi_sense_length);
 
-		iov_iter_init(&iov_iter, READ, cmd->tvc_resp_iov,
+		iov_iter_init(&iov_iter, READ, &cmd->tvc_resp_iov,
 			      cmd->tvc_in_iovs, sizeof(v_rsp));
 		ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
 		if (likely(ret == sizeof(v_rsp))) {
@@ -1054,7 +1054,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *
 		}
 		cmd->tvc_vhost = vs;
 		cmd->tvc_vq = vq;
-		cmd->tvc_resp_iov = &vq->iov[out];
+		cmd->tvc_resp_iov = vq->iov[out];
 		cmd->tvc_in_iovs = in;
 
 		pr_debug("vhost_scsi got command opcode: %#02x, lun: %d\n",

[toc] | [prev] | [next] | [standalone]

#1481626 — [PATCH 4.4 188/192] metag: Fix atomic_*_return inline asm constraints

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hogan <james.hogan@imgtec.com>

commit 096a8b6d5e7ab9f8ca3d2474b3ca6a1fe79e0371 upstream.

The argument i of atomic_*_return() operations is given to inline asm
with the "bd" constraint, which means "An Op2 register where Op1 is a
data unit register and the instruction supports O2R", however Op1 is
constrained by "da" which allows an address unit register to be used.

Fix the constraint to use "br", meaning "An Op2 register and the
instruction supports O2R", i.e. not requiring Op1 to be a data unit
register.

Fixes: d6dfe2509da9 ("locking,arch,metag: Fold atomic_ops")
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/include/asm/atomic_lnkget.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/metag/include/asm/atomic_lnkget.h
+++ b/arch/metag/include/asm/atomic_lnkget.h
@@ -61,7 +61,7 @@ static inline int atomic_##op##_return(i
 		"	CMPT	%0, #HI(0x02000000)\n"			\
 		"	BNZ 1b\n"					\
 		: "=&d" (temp), "=&da" (result)				\
-		: "da" (&v->counter), "bd" (i)				\
+		: "da" (&v->counter), "br" (i)				\
 		: "cc");						\
 									\
 	smp_mb();							\

[toc] | [prev] | [next] | [standalone]

#1481627 — [PATCH 4.4 158/192] s390/sclp_ctl: fix potential information leak with /dev/sclp

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6 upstream.

The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to
retrieve the sclp request from user space. The first copy_from_user
fetches the length of the request which is stored in the first two
bytes of the request. The second copy_from_user gets the complete
sclp request, but this copies the length field a second time.
A malicious user may have changed the length in the meantime.

Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Reviewed-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/s390/char/sclp_ctl.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/s390/char/sclp_ctl.c
+++ b/drivers/s390/char/sclp_ctl.c
@@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __us
 {
 	struct sclp_ctl_sccb ctl_sccb;
 	struct sccb_header *sccb;
+	unsigned long copied;
 	int rc;
 
 	if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb)))
@@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __us
 	sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
 	if (!sccb)
 		return -ENOMEM;
-	if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) {
+	copied = PAGE_SIZE -
+		copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE);
+	if (offsetof(struct sccb_header, length) +
+	    sizeof(sccb->length) > copied || sccb->length > copied) {
 		rc = -EFAULT;
 		goto out_free;
 	}
-	if (sccb->length > PAGE_SIZE || sccb->length < 8)
-		return -EINVAL;
-	if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) {
-		rc = -EFAULT;
+	if (sccb->length < 8) {
+		rc = -EINVAL;
 		goto out_free;
 	}
 	rc = sclp_sync_request(ctl_sccb.cmdw, sccb);

[toc] | [prev] | [next] | [standalone]

#1481628 — [PATCH 4.4 186/192] ALSA: timer: fix NULL pointer dereference on memory allocation failure

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vegard Nossum <vegard.nossum@oracle.com>

commit 8ddc05638ee42b18ba4fe99b5fb647fa3ad20456 upstream.

I hit this with syzkaller:

    kasan: CONFIG_KASAN_INLINE enabled
    kasan: GPF could be caused by NULL-ptr deref or user memory access
    general protection fault: 0000 [#1] PREEMPT SMP KASAN
    CPU: 0 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #190
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
    task: ffff88011278d600 task.stack: ffff8801120c0000
    RIP: 0010:[<ffffffff82c8ba07>]  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100
    RSP: 0018:ffff8801120c7a60  EFLAGS: 00010006
    RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000007
    RDX: 0000000000000009 RSI: 1ffff10023483091 RDI: 0000000000000048
    RBP: ffff8801120c7a78 R08: ffff88011a5cf768 R09: ffff88011a5ba790
    R10: 0000000000000002 R11: ffffed00234b9ef1 R12: ffff880114843980
    R13: ffffffff84213c00 R14: ffff880114843ab0 R15: 0000000000000286
    FS:  00007f72958f3700(0000) GS:ffff88011aa00000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000603001 CR3: 00000001126ab000 CR4: 00000000000006f0
    Stack:
     ffff880114843980 ffff880111eb2dc0 ffff880114843a34 ffff8801120c7ad0
     ffffffff82c81ab1 0000000000000000 ffffffff842138e0 0000000100000000
     ffff880111eb2dd0 ffff880111eb2dc0 0000000000000001 ffff880111eb2dc0
    Call Trace:
     [<ffffffff82c81ab1>] snd_timer_start1+0x331/0x670
     [<ffffffff82c85bfd>] snd_timer_start+0x5d/0xa0
     [<ffffffff82c8795e>] snd_timer_user_ioctl+0x88e/0x2830
     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430
     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90
     [<ffffffff8132762f>] ? put_prev_entity+0x108f/0x21a0
     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050
     [<ffffffff813510af>] ? cpuacct_account_field+0x12f/0x1a0
     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200
     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0
     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0
     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190
     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0
     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0
     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0
     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050
     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: c7 c7 c4 b9 c8 82 48 89 d9 4c 89 ee e8 63 88 7f fe e8 7e 46 7b fe 48 8d 7b 48 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 04 84 c0 7e 65 80 7b 48 00 74 0e e8 52 46
    RIP  [<ffffffff82c8ba07>] snd_hrtimer_start+0x77/0x100
     RSP <ffff8801120c7a60>
    ---[ end trace 5955b08db7f2b029 ]---

This can happen if snd_hrtimer_open() fails to allocate memory and
returns an error, which is currently not checked by snd_timer_open():

    ioctl(SNDRV_TIMER_IOCTL_SELECT)
     - snd_timer_user_tselect()
	- snd_timer_close()
	   - snd_hrtimer_close()
	      - (struct snd_timer *) t->private_data = NULL
        - snd_timer_open()
           - snd_hrtimer_open()
              - kzalloc() fails; t->private_data is still NULL

    ioctl(SNDRV_TIMER_IOCTL_START)
     - snd_timer_user_start()
	- snd_timer_start()
	   - snd_timer_start1()
	      - snd_hrtimer_start()
		- t->private_data == NULL // boom

Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -296,8 +296,21 @@ int snd_timer_open(struct snd_timer_inst
 		get_device(&timer->card->card_dev);
 	timeri->slave_class = tid->dev_sclass;
 	timeri->slave_id = slave_id;
-	if (list_empty(&timer->open_list_head) && timer->hw.open)
-		timer->hw.open(timer);
+
+	if (list_empty(&timer->open_list_head) && timer->hw.open) {
+		int err = timer->hw.open(timer);
+		if (err) {
+			kfree(timeri->owner);
+			kfree(timeri);
+
+			if (timer->card)
+				put_device(&timer->card->card_dev);
+			module_put(timer->module);
+			mutex_unlock(&register_mutex);
+			return err;
+		}
+	}
+
 	list_add_tail(&timeri->open_list, &timer->open_list_head);
 	snd_timer_check_master(timeri);
 	mutex_unlock(&register_mutex);

[toc] | [prev] | [next] | [standalone]

#1481630 — [PATCH 4.4 125/192] [PATCH 129/135] Input: xpad - move pending clear to the correct location

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 4efc6939a83c54fb3417541be48991afd0290ba3 ]

otherwise we lose ff commands: https://github.com/paroj/xpad/issues/27

Signed-off-by: Pavel Rojtberg <rojtberg@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/input/joystick/xpad.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -718,6 +718,7 @@ static bool xpad_prepare_next_out_packet
 	if (packet) {
 		memcpy(xpad->odata, packet->data, packet->len);
 		xpad->irq_out->transfer_buffer_length = packet->len;
+		packet->pending = false;
 		return true;
 	}
 
@@ -757,7 +758,6 @@ static void xpad_irq_out(struct urb *urb
 	switch (status) {
 	case 0:
 		/* success */
-		xpad->out_packets[xpad->last_out_packet].pending = false;
 		xpad->irq_out_active = xpad_prepare_next_out_packet(xpad);
 		break;
 

[toc] | [prev] | [next] | [standalone]

#1481631 — [PATCH 4.4 142/192] [PATCH 4.4 13/16] drivers:hv: Lock access to hyperv_mmio resource tree

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Jake Oshins <jakeo@microsoft.com>

[ Upstream commit e16dad6bfe1437aaee565f875a6713ca7ce81bdf ]

In existing code, this tree of resources is created
in single-threaded code and never modified after it is
created, and thus needs no locking.  This patch introduces
a semaphore for tree access, as other patches in this
series introduce run-time modifications of this resource
tree which can happen on multiple threads.

Signed-off-by: Jake Oshins <jakeo@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/hv/vmbus_drv.c |   16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -105,6 +105,7 @@ static struct notifier_block hyperv_pani
 };
 
 struct resource *hyperv_mmio;
+DEFINE_SEMAPHORE(hyperv_mmio_lock);
 
 static int vmbus_exists(void)
 {
@@ -1140,7 +1141,10 @@ int vmbus_allocate_mmio(struct resource
 	resource_size_t range_min, range_max, start, local_min, local_max;
 	const char *dev_n = dev_name(&device_obj->device);
 	u32 fb_end = screen_info.lfb_base + (screen_info.lfb_size << 1);
-	int i;
+	int i, retval;
+
+	retval = -ENXIO;
+	down(&hyperv_mmio_lock);
 
 	for (iter = hyperv_mmio; iter; iter = iter->sibling) {
 		if ((iter->start >= max) || (iter->end <= min))
@@ -1177,13 +1181,17 @@ int vmbus_allocate_mmio(struct resource
 			for (; start + size - 1 <= local_max; start += align) {
 				*new = request_mem_region_exclusive(start, size,
 								    dev_n);
-				if (*new)
-					return 0;
+				if (*new) {
+					retval = 0;
+					goto exit;
+				}
 			}
 		}
 	}
 
-	return -ENXIO;
+exit:
+	up(&hyperv_mmio_lock);
+	return retval;
 }
 EXPORT_SYMBOL_GPL(vmbus_allocate_mmio);
 

[toc] | [prev] | [next] | [standalone]

#1481632 — [PATCH 4.4 118/192] [PATCH 122/135] HID: core: prevent out-of-bound readings

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 50220dead1650609206efe91f0cc116132d59b3f ]

Plugging a Logitech DJ receiver with KASAN activated raises a bunch of
out-of-bound readings.

The fields are allocated up to MAX_USAGE, meaning that potentially, we do
not have enough fields to fit the incoming values.
Add checks and silence KASAN.

Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hid/hid-core.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1251,6 +1251,7 @@ static void hid_input_field(struct hid_d
 		/* Ignore report if ErrorRollOver */
 		if (!(field->flags & HID_MAIN_ITEM_VARIABLE) &&
 		    value[n] >= min && value[n] <= max &&
+		    value[n] - min < field->maxusage &&
 		    field->usage[value[n] - min].hid == HID_UP_KEYBOARD + 1)
 			goto exit;
 	}
@@ -1263,11 +1264,13 @@ static void hid_input_field(struct hid_d
 		}
 
 		if (field->value[n] >= min && field->value[n] <= max
+			&& field->value[n] - min < field->maxusage
 			&& field->usage[field->value[n] - min].hid
 			&& search(value, field->value[n], count))
 				hid_process_event(hid, field, &field->usage[field->value[n] - min], 0, interrupt);
 
 		if (value[n] >= min && value[n] <= max
+			&& value[n] - min < field->maxusage
 			&& field->usage[value[n] - min].hid
 			&& search(field->value, value[n], count))
 				hid_process_event(hid, field, &field->usage[value[n] - min], 1, interrupt);

[toc] | [prev] | [next] | [standalone]

#1481633 — [PATCH 4.4 138/192] [PATCH 4.4 08/16] cred: Reject inodes with invalid ids in set_create_file_as()

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------


From: Seth Forshee <seth.forshee@canonical.com>

[ Upstream commit 5f65e5ca286126a60f62c8421b77c2018a482b8a ]

Using INVALID_[UG]ID for the LSM file creation context doesn't
make sense, so return an error if the inode passed to
set_create_file_as() has an invalid id.

Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/cred.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/kernel/cred.c
+++ b/kernel/cred.c
@@ -689,6 +689,8 @@ EXPORT_SYMBOL(set_security_override_from
  */
 int set_create_files_as(struct cred *new, struct inode *inode)
 {
+	if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
+		return -EINVAL;
 	new->fsuid = inode->i_uid;
 	new->fsgid = inode->i_gid;
 	return security_kernel_create_files_as(new, inode);

[toc] | [prev] | [next] | [standalone]

#1481634 — [PATCH 4.4 176/192] uprobes: Fix the memcg accounting

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oleg Nesterov <oleg@redhat.com>

commit 6c4687cc17a788a6dd8de3e27dbeabb7cbd3e066 upstream.

__replace_page() wronlgy calls mem_cgroup_cancel_charge() in "success" path,
it should only do this if page_check_address() fails.

This means that every enable/disable leads to unbalanced mem_cgroup_uncharge()
from put_page(old_page), it is trivial to underflow the page_counter->count
and trigger OOM.

Reported-and-tested-by: Brenden Blanco <bblanco@plumgrid.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@kernel.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vladimir Davydov <vdavydov@virtuozzo.com>
Fixes: 00501b531c47 ("mm: memcontrol: rewrite charge API")
Link: http://lkml.kernel.org/r/20160817153629.GB29724@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/uprobes.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -171,8 +171,10 @@ static int __replace_page(struct vm_area
 	mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end);
 	err = -EAGAIN;
 	ptep = page_check_address(page, mm, addr, &ptl, 0);
-	if (!ptep)
+	if (!ptep) {
+		mem_cgroup_cancel_charge(kpage, memcg);
 		goto unlock;
+	}
 
 	get_page(kpage);
 	page_add_new_anon_rmap(kpage, vma, addr);
@@ -199,7 +201,6 @@ static int __replace_page(struct vm_area
 
 	err = 0;
  unlock:
-	mem_cgroup_cancel_charge(kpage, memcg);
 	mmu_notifier_invalidate_range_end(mm, mmun_start, mmun_end);
 	unlock_page(page);
 	return err;

[toc] | [prev] | [next] | [standalone]

#1481635 — [PATCH 4.4 150/192] ext4: avoid deadlock when expanding inode size

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jan Kara <jack@suse.cz>

commit 2e81a4eeedcaa66e35f58b81e0755b87057ce392 upstream.

When we need to move xattrs into external xattr block, we call
ext4_xattr_block_set() from ext4_expand_extra_isize_ea(). That may end
up calling ext4_mark_inode_dirty() again which will recurse back into
the inode expansion code leading to deadlocks.

Protect from recursion using EXT4_STATE_NO_EXPAND inode flag and move
its management into ext4_expand_extra_isize_ea() since its manipulation
is safe there (due to xattr_sem) from possible races with
ext4_xattr_set_handle() which plays with it as well.

Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ext4/inode.c |    2 --
 fs/ext4/xattr.c |   19 +++++++++++++------
 2 files changed, 13 insertions(+), 8 deletions(-)

--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5186,8 +5186,6 @@ int ext4_mark_inode_dirty(handle_t *hand
 						      sbi->s_want_extra_isize,
 						      iloc, handle);
 			if (ret) {
-				ext4_set_inode_state(inode,
-						     EXT4_STATE_NO_EXPAND);
 				if (mnt_count !=
 					le16_to_cpu(sbi->s_es->s_mnt_count)) {
 					ext4_warning(inode->i_sb,
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1269,12 +1269,14 @@ int ext4_expand_extra_isize_ea(struct in
 	int isize_diff;	/* How much do we need to grow i_extra_isize */
 
 	down_write(&EXT4_I(inode)->xattr_sem);
+	/*
+	 * Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty
+	 */
+	ext4_set_inode_state(inode, EXT4_STATE_NO_EXPAND);
 retry:
 	isize_diff = new_extra_isize - EXT4_I(inode)->i_extra_isize;
-	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize) {
-		up_write(&EXT4_I(inode)->xattr_sem);
-		return 0;
-	}
+	if (EXT4_I(inode)->i_extra_isize >= new_extra_isize)
+		goto out;
 
 	header = IHDR(inode, raw_inode);
 	entry = IFIRST(header);
@@ -1299,8 +1301,7 @@ retry:
 				(void *)header, total_ino,
 				inode->i_sb->s_blocksize);
 		EXT4_I(inode)->i_extra_isize = new_extra_isize;
-		error = 0;
-		goto cleanup;
+		goto out;
 	}
 
 	/*
@@ -1460,6 +1461,8 @@ retry:
 		kfree(bs);
 	}
 	brelse(bh);
+out:
+	ext4_clear_inode_state(inode, EXT4_STATE_NO_EXPAND);
 	up_write(&EXT4_I(inode)->xattr_sem);
 	return 0;
 
@@ -1471,6 +1474,10 @@ cleanup:
 	kfree(is);
 	kfree(bs);
 	brelse(bh);
+	/*
+	 * We deliberately leave EXT4_STATE_NO_EXPAND set here since inode
+	 * size expansion failed.
+	 */
 	up_write(&EXT4_I(inode)->xattr_sem);
 	return error;
 }

[toc] | [prev] | [next] | [standalone]

#1481636 — [PATCH 4.4 185/192] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vegard Nossum <vegard.nossum@oracle.com>

commit 6b760bb2c63a9e322c0e4a0b5daf335ad93d5a33 upstream.

I got this:

    divide error: 0000 [#1] PREEMPT SMP KASAN
    CPU: 1 PID: 1327 Comm: a.out Not tainted 4.8.0-rc2+ #189
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
    task: ffff8801120a9580 task.stack: ffff8801120b0000
    RIP: 0010:[<ffffffff82c8bd9a>]  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0
    RSP: 0018:ffff88011aa87da8  EFLAGS: 00010006
    RAX: 0000000000004f76 RBX: ffff880112655e88 RCX: 0000000000000000
    RDX: 0000000000000000 RSI: ffff880112655ea0 RDI: 0000000000000001
    RBP: ffff88011aa87e00 R08: ffff88013fff905c R09: ffff88013fff9048
    R10: ffff88013fff9050 R11: 00000001050a7b8c R12: ffff880114778a00
    R13: ffff880114778ab4 R14: ffff880114778b30 R15: 0000000000000000
    FS:  00007f071647c700(0000) GS:ffff88011aa80000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 0000000000603001 CR3: 0000000112021000 CR4: 00000000000006e0
    Stack:
     0000000000000000 ffff880114778ab8 ffff880112655ea0 0000000000004f76
     ffff880112655ec8 ffff880112655e80 ffff880112655e88 ffff88011aa98fc0
     00000000b97ccf2b dffffc0000000000 ffff88011aa98fc0 ffff88011aa87ef0
    Call Trace:
     <IRQ>
     [<ffffffff813abce7>] __hrtimer_run_queues+0x347/0xa00
     [<ffffffff82c8bbc0>] ? snd_hrtimer_close+0x130/0x130
     [<ffffffff813ab9a0>] ? retrigger_next_event+0x1b0/0x1b0
     [<ffffffff813ae1a6>] ? hrtimer_interrupt+0x136/0x4b0
     [<ffffffff813ae220>] hrtimer_interrupt+0x1b0/0x4b0
     [<ffffffff8120f91e>] local_apic_timer_interrupt+0x6e/0xf0
     [<ffffffff81227ad3>] ? kvm_guest_apic_eoi_write+0x13/0xc0
     [<ffffffff83c35086>] smp_apic_timer_interrupt+0x76/0xa0
     [<ffffffff83c3416c>] apic_timer_interrupt+0x8c/0xa0
     <EOI>
     [<ffffffff83c3239c>] ? _raw_spin_unlock_irqrestore+0x2c/0x60
     [<ffffffff82c8185d>] snd_timer_start1+0xdd/0x670
     [<ffffffff82c87015>] snd_timer_continue+0x45/0x80
     [<ffffffff82c88100>] snd_timer_user_ioctl+0x1030/0x2830
     [<ffffffff8159f3a0>] ? __follow_pte.isra.49+0x430/0x430
     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
     [<ffffffff815a26fa>] ? do_wp_page+0x3aa/0x1c90
     [<ffffffff815aa4f8>] ? handle_mm_fault+0xbc8/0x27f0
     [<ffffffff815a9930>] ? __pmd_alloc+0x370/0x370
     [<ffffffff82c870d0>] ? snd_timer_pause+0x80/0x80
     [<ffffffff816b0733>] do_vfs_ioctl+0x193/0x1050
     [<ffffffff816b05a0>] ? ioctl_preallocate+0x200/0x200
     [<ffffffff81002f2f>] ? syscall_trace_enter+0x3cf/0xdb0
     [<ffffffff815045ba>] ? __context_tracking_exit.part.4+0x9a/0x1e0
     [<ffffffff81002b60>] ? exit_to_usermode_loop+0x190/0x190
     [<ffffffff82001a97>] ? check_preemption_disabled+0x37/0x1e0
     [<ffffffff81d93889>] ? security_file_ioctl+0x89/0xb0
     [<ffffffff816b167f>] SyS_ioctl+0x8f/0xc0
     [<ffffffff816b15f0>] ? do_vfs_ioctl+0x1050/0x1050
     [<ffffffff81005524>] do_syscall_64+0x1c4/0x4e0
     [<ffffffff83c32b2a>] entry_SYSCALL64_slow_path+0x25/0x25
    Code: e8 fc 42 7b fe 8b 0d 06 8a 50 03 49 0f af cf 48 85 c9 0f 88 7c 01 00 00 48 89 4d a8 e8 e0 42 7b fe 48 8b 45 c0 48 8b 4d a8 48 99 <48> f7 f9 49 01 c7 e8 cb 42 7b fe 48 8b 55 d0 48 b8 00 00 00 00
    RIP  [<ffffffff82c8bd9a>] snd_hrtimer_callback+0x1da/0x3f0
     RSP <ffff88011aa87da8>
    ---[ end trace 6aa380f756a21074 ]---

The problem happens when you call ioctl(SNDRV_TIMER_IOCTL_CONTINUE) on a
completely new/unused timer -- it will have ->sticks == 0, which causes a
divide by 0 in snd_hrtimer_callback().

Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/core/timer.c |    1 +
 1 file changed, 1 insertion(+)

--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -837,6 +837,7 @@ int snd_timer_new(struct snd_card *card,
 	timer->tmr_subdevice = tid->subdevice;
 	if (id)
 		strlcpy(timer->id, id, sizeof(timer->id));
+	timer->sticks = 1;
 	INIT_LIST_HEAD(&timer->device_list);
 	INIT_LIST_HEAD(&timer->open_list_head);
 	INIT_LIST_HEAD(&timer->active_list_head);

[toc] | [prev] | [next] | [standalone]

#1481638 — [PATCH 4.4 106/192] [PATCH 110/135] ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit dd4e17ab704269bce71402285f5e8b9ac24b1eff ]

Recently, in commit 37cf4dc3370f I forgot to check if the timeval being passed
was actually a timespec (as is signaled with ADJ_NANO).

This resulted in that patch breaking ADJ_SETOFFSET users who set
ADJ_NANO, by rejecting valid timespecs that were compared with
valid timeval ranges.

This patch addresses this by checking for the ADJ_NANO flag and
using the timepsec check instead in that case.

Reported-by: Harald Hoyer <harald@redhat.com>
Reported-by: Kay Sievers <kay@vrfy.org>
Fixes: 37cf4dc3370f "time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow"
Signed-off-by: John Stultz <john.stultz@linaro.org>
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Richard Cochran <richardcochran@gmail.com>
Cc: Prarit Bhargava <prarit@redhat.com>
Cc: David Herrmann <dh.herrmann@gmail.com>
Link: http://lkml.kernel.org/r/1453417415-19110-2-git-send-email-john.stultz@linaro.org
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/time/ntp.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -679,8 +679,18 @@ int ntp_validate_timex(struct timex *txc
 		if (!capable(CAP_SYS_TIME))
 			return -EPERM;
 
-		if (!timeval_inject_offset_valid(&txc->time))
-			return -EINVAL;
+		if (txc->modes & ADJ_NANO) {
+			struct timespec ts;
+
+			ts.tv_sec = txc->time.tv_sec;
+			ts.tv_nsec = txc->time.tv_usec;
+			if (!timespec_inject_offset_valid(&ts))
+				return -EINVAL;
+
+		} else {
+			if (!timeval_inject_offset_valid(&txc->time))
+				return -EINVAL;
+		}
 	}
 
 	/*

[toc] | [prev] | [next] | [standalone]

#1481639 — [PATCH 4.4 192/192] lib/mpi: mpi_write_sgl(): fix skipping of leading zero limbs

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolai Stange <nicstange@gmail.com>

commit f2d1362ff7d266b3d2b1c764d6c2ef4a3b457f23 upstream.

Currently, if the number of leading zeros is greater than fits into a
complete limb, mpi_write_sgl() skips them by iterating over them limb-wise.

However, it fails to adjust its internal leading zeros tracking variable,
lzeros, accordingly: it does a

  p -= sizeof(alimb);
  continue;

which should really have been a

  lzeros -= sizeof(alimb);
  continue;

Since lzeros never decreases if its initial value >= sizeof(alimb), nothing
gets copied by mpi_write_sgl() in that case.

Instead of skipping the high order zero limbs within the loop as shown
above, fix the issue by adjusting the copying loop's bounds.

Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/mpi/mpicoder.c |   21 +++++++++------------
 1 file changed, 9 insertions(+), 12 deletions(-)

--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -367,7 +367,9 @@ int mpi_write_to_sgl(MPI a, struct scatt
 	buf_len = sgl->length;
 	p2 = sg_virt(sgl);
 
-	for (i = a->nlimbs - 1; i >= 0; i--) {
+	for (i = a->nlimbs - 1 - lzeros / BYTES_PER_MPI_LIMB,
+			lzeros %= BYTES_PER_MPI_LIMB;
+		i >= 0; i--) {
 		alimb = a->d[i];
 		p = (u8 *)&alimb2;
 #if BYTES_PER_MPI_LIMB == 4
@@ -388,17 +390,12 @@ int mpi_write_to_sgl(MPI a, struct scatt
 #error please implement for this limb size.
 #endif
 		if (lzeros > 0) {
-			if (lzeros >= sizeof(alimb)) {
-				p -= sizeof(alimb);
-				continue;
-			} else {
-				mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
-				mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
-							+ lzeros;
-				*limb1 = *limb2;
-				p -= lzeros;
-				y = lzeros;
-			}
+			mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
+			mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
+				+ lzeros;
+			*limb1 = *limb2;
+			p -= lzeros;
+			y = lzeros;
 			lzeros -= sizeof(alimb);
 		}
 

[toc] | [prev] | [next] | [standalone]

#1481640 — [PATCH 4.4 091/192] [PATCH 095/135] arcmsr: fixed getting wrong configuration data

4.4-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 251e2d25bfb72b69edd414abfa42a41191d9657a ]

Fixed getting wrong configuration data of adapter type B and type D.

Signed-off-by: Ching Huang <ching2048@areca.com.tw>
Reviewed-by: Hannes Reinicke <hare@suse.de>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/scsi/arcmsr/arcmsr_hba.c |   20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -2694,15 +2694,15 @@ static bool arcmsr_hbaB_get_config(struc
 		acb->firm_model,
 		acb->firm_version);
 
-	acb->signature = readl(&reg->message_rwbuffer[1]);
+	acb->signature = readl(&reg->message_rwbuffer[0]);
 	/*firm_signature,1,00-03*/
-	acb->firm_request_len = readl(&reg->message_rwbuffer[2]);
+	acb->firm_request_len = readl(&reg->message_rwbuffer[1]);
 	/*firm_request_len,1,04-07*/
-	acb->firm_numbers_queue = readl(&reg->message_rwbuffer[3]);
+	acb->firm_numbers_queue = readl(&reg->message_rwbuffer[2]);
 	/*firm_numbers_queue,2,08-11*/
-	acb->firm_sdram_size = readl(&reg->message_rwbuffer[4]);
+	acb->firm_sdram_size = readl(&reg->message_rwbuffer[3]);
 	/*firm_sdram_size,3,12-15*/
-	acb->firm_hd_channels = readl(&reg->message_rwbuffer[5]);
+	acb->firm_hd_channels = readl(&reg->message_rwbuffer[4]);
 	/*firm_ide_channels,4,16-19*/
 	acb->firm_cfg_version = readl(&reg->message_rwbuffer[25]);  /*firm_cfg_version,25,100-103*/
 	/*firm_ide_channels,4,16-19*/
@@ -2880,15 +2880,15 @@ static bool arcmsr_hbaD_get_config(struc
 		iop_device_map++;
 		count--;
 	}
-	acb->signature = readl(&reg->msgcode_rwbuffer[1]);
+	acb->signature = readl(&reg->msgcode_rwbuffer[0]);
 	/*firm_signature,1,00-03*/
-	acb->firm_request_len = readl(&reg->msgcode_rwbuffer[2]);
+	acb->firm_request_len = readl(&reg->msgcode_rwbuffer[1]);
 	/*firm_request_len,1,04-07*/
-	acb->firm_numbers_queue = readl(&reg->msgcode_rwbuffer[3]);
+	acb->firm_numbers_queue = readl(&reg->msgcode_rwbuffer[2]);
 	/*firm_numbers_queue,2,08-11*/
-	acb->firm_sdram_size = readl(&reg->msgcode_rwbuffer[4]);
+	acb->firm_sdram_size = readl(&reg->msgcode_rwbuffer[3]);
 	/*firm_sdram_size,3,12-15*/
-	acb->firm_hd_channels = readl(&reg->msgcode_rwbuffer[5]);
+	acb->firm_hd_channels = readl(&reg->msgcode_rwbuffer[4]);
 	/*firm_hd_channels,4,16-19*/
 	acb->firm_cfg_version = readl(&reg->msgcode_rwbuffer[25]);
 	pr_notice("Areca RAID Controller%d: Model %s, F/W %s\n",

[toc] | [prev] | [next] | [standalone]

Page 2 of 8 — ← Prev page 1 [2] 3 4 5 6 7 8  Next page →

Back to top | Article view | linux.kernel

csiph-web