Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1481599 > unrolled thread
| Started by | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| First post | 2016-09-12 19:10 +0200 |
| Last post | 2016-09-15 08:20 +0200 |
| Articles | 20 on this page of 147 — 5 participants |
Back to article view | Back to linux.kernel
[PATCH 4.4 000/192] 4.4.21-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 049/192] [PATCH 050/135] lpfc: Fix the FLOGI discovery logic to comply with T11 standards Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 033/192] [PATCH 034/135] Drivers: hv: util: Increase the timeout for util services Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 059/192] [PATCH 061/135] s390/cio: update measurement characteristics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 077/192] [PATCH 080/135] qla2xxx: Use ATIO type to send correct tmr response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 041/192] [PATCH 042/135] cxl: Fix possible idr warning when contexts are released Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:10 +0200
[PATCH 4.4 112/192] [PATCH 116/135] blk-mq: End unstarted requests on dying queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 098/192] [PATCH 102/135] proc: revert /proc/<pid>/maps [stack:TID] annotation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 116/192] [PATCH 120/135] block: fix blk_rq_get_max_sectors for driver private requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 105/192] [PATCH 109/135] time: Verify time values in adjtimex ADJ_SETOFFSET to avoid overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 111/192] [PATCH 115/135] cxlflash: Fix to resolve dead-lock during EEH recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 070/192] [PATCH 073/135] mpt3sas: Fix for Asynchronous completion of timedout IO and task abort of timedout IO. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 130/192] [PATCH 134/135] tipc: fix an infoleak in tipc_nl_compat_link_dump Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 148/192] ext4: fix xattr shifting when expanding inodes part 2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 183/192] ALSA: hda - Enable subwoofer on Dell Inspiron 7559 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 093/192] [PATCH 097/135] Drivers: hv: vmbus: avoid infinite loop in init_vp_index() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 184/192] ALSA: timer: fix NULL pointer dereference in read()/ioctl() race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 141/192] [PATCH 4.4 12/16] cxlflash: Move to exponential back-off when cmd_room is not available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 101/192] [PATCH 105/135] perf/x86/cqm: Fix CQM memory leak and notifier leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 160/192] drm: Reject page_flip for !DRIVER_MODESET Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 117/192] [PATCH 121/135] lpfc: Fix DMA faults observed upon plugging loopback connector Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 144/192] kernel: Add noaudit variant of ns_capable() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 187/192] scsi: fix upper bounds check of sense key in scsi_sense_key_string() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 069/192] [PATCH 072/135] mpt3sas: A correction in unmap_resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 182/192] ALSA: hda - Add headset mic quirk for Dell Inspiron 5468 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 189/192] cpufreq: Fix GOV_LIMITS handling for the userspace governor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 174/192] vhost/scsi: fix reuse of &vq->iov[out] in response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 188/192] metag: Fix atomic_*_return inline asm constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 158/192] s390/sclp_ctl: fix potential information leak with /dev/sclp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 186/192] ALSA: timer: fix NULL pointer dereference on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 125/192] [PATCH 129/135] Input: xpad - move pending clear to the correct location Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 142/192] [PATCH 4.4 13/16] drivers:hv: Lock access to hyperv_mmio resource tree Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 118/192] [PATCH 122/135] HID: core: prevent out-of-bound readings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 138/192] [PATCH 4.4 08/16] cred: Reject inodes with invalid ids in set_create_file_as() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 176/192] uprobes: Fix the memcg accounting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 150/192] ext4: avoid deadlock when expanding inode size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 185/192] ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 106/192] [PATCH 110/135] ntp: Fix ADJ_SETOFFSET being used w/ ADJ_NANO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 192/192] lib/mpi: mpi_write_sgl(): fix skipping of leading zero limbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 091/192] [PATCH 095/135] arcmsr: fixed getting wrong configuration data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 128/192] [PATCH 132/135] Bluetooth: Add support for Intel Bluetooth device 8265 [8087:0a2b] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 190/192] hwrng: exynos - Disable runtime PM on probe failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 165/192] timekeeping: Avoid taking lock in NMI path with CONFIG_DEBUG_TIMEKEEPING Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 140/192] [PATCH 4.4 11/16] netfilter: x_tables: check for size overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 133/192] [PATCH 4.4 02/16] cxlflash: Fix to avoid virtual LUN failover failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 163/192] xfs: fix superblock inprogress check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 178/192] ALSA: usb-audio: Add sample rate inquiry quirk for B850V3 CP2114 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 164/192] timekeeping: Cap array access in timekeeping_debug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 122/192] [PATCH 126/135] crypto: vmx - IV size failing on skcipher API Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 068/192] [PATCH 071/135] net: cavium: liquidio: fix check for in progress flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 170/192] ovl: listxattr: use strnlen() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 073/192] [PATCH 076/135] drm/i915/bxt: update list of PCIIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 180/192] ALSA: fireworks: accessing to user space outside spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 147/192] ext4: fix xattr shifting when expanding inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 137/192] [PATCH 4.4 07/16] fs: Check for invalid i_uid in may_follow_link() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 071/192] [PATCH 074/135] i40e/i40evf: Fix RSS rx-flow-hash configuration through ethtool Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 152/192] block: Fix race triggered by blk_set_queue_dying() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 096/192] [PATCH 100/135] cxlflash: Fix to avoid unnecessary scan with internal LUNs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 132/192] [PATCH 4.4 01/16] cxlflash: Fix to escalate LINK_RESET also on port 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 102/192] [PATCH 106/135] net: thunderx: Fix for multiqset not configured upon interface toggle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 135/192] [PATCH 4.4 05/16] udp: properly support MSG_PEEK with truncated buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 169/192] ovl: remove posix_acl_default from workdir Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 181/192] ALSA: rawmidi: Fix possible deadlock with virmidi registration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 154/192] cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 173/192] bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 161/192] drm/msm: fix use of copy_from_user() while holding spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 156/192] powerpc/tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 109/192] [PATCH 113/135] ecryptfs: fix handling of directory opening Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:20 +0200
[PATCH 4.4 168/192] ovl: dont copy up opaqueness Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 149/192] ext4: properly align shifted xattrs when expanding inodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 155/192] nvme: Call pci_disable_device on the error path. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 131/192] [PATCH 135/135] tipc: fix nl compat regression for link statistics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 146/192] ext4: validate that metadata blocks do not overlap superblock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 162/192] ASoC: atmel_ssc_dai: Dont unconditionally reset SSC on stream startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 104/192] [PATCH 108/135] Input: xpad - correctly handle concurrent LED and FF requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 175/192] x86/apic: Do not init irq remapping if ioapic is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 129/192] [PATCH 133/135] netfilter: x_tables: check for size overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 153/192] block: make sure a big bio is split into at most 256 bvecs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 145/192] net: Use ns_capable_noaudit() when determining net sysctl permissions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 179/192] ALSA: firewire-tascam: accessing to user space outside spinlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 134/192] [PATCH 4.4 04/16] crypto: nx-842 - Mask XERS0 bit in return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 171/192] ovl: fix workdir creation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 166/192] lustre: remove unused declaration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 167/192] [PATCH] wrappers for ->i_mutex access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 157/192] rds: fix an infoleak in rds_inc_info_copy Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 143/192] [PATCH 4.4 14/16] KEYS: Fix ASN.1 indefinite length object parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 136/192] [PATCH 4.4 06/16] IB/IPoIB: Do not set skb truesize since using one linearskb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 124/192] [PATCH 128/135] net: thunderx: Fix link status reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 113/192] [PATCH 117/135] btrfs: Continue write in case of can_not_nocow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:30 +0200
[PATCH 4.4 123/192] [PATCH 127/135] x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 088/192] [PATCH 092/135] net/mlx5e: Dont try to modify CQ moderation if it is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 115/192] [PATCH 119/135] irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum 23144 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 092/192] [PATCH 096/135] arcmsr: fixes not release allocated resource Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 065/192] [PATCH 068/135] pwm: lpc32xx: fix and simplify duty cycle and period calculations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 082/192] [PATCH 086/135] tipc: fix nullptr crash during subscription cancel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 119/192] [PATCH 123/135] crypto: vmx - comply with ABIs that specify vrsave as reserved. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 100/192] [PATCH 104/135] perf/x86/cqm: Fix CQM handling of grouping events into a cache_group Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 081/192] [PATCH 085/135] arm64: Add workaround for Cavium erratum 27456 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 114/192] [PATCH 118/135] clocksource: Allow unregistering the watchdog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 078/192] [PATCH 081/135] drm/amdgpu: fix dp link rate selection (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 097/192] [PATCH 101/135] intel_idle: Support for Intel Xeon Phi Processor x200 Product Family Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 066/192] [PATCH 069/135] irqchip/gic-v3: Make sure read from ICC_IAR1_EL1 is visible on redestributor Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 099/192] [PATCH 103/135] s390/crypto: provide correct file mode at device register. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 120/192] [PATCH 124/135] crypto: vmx - Fix ABI detection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 121/192] [PATCH 125/135] tda10071: Fix dependency to REGMAP_I2C Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 086/192] [PATCH 090/135] UVC: Add support for R200 depth camera Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 103/192] [PATCH 107/135] net: thunderx: Fix receive packet stats Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 072/192] [PATCH 075/135] hrtimer: Catch illegal clockids Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 094/192] [PATCH 098/135] Drivers: hv: vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 095/192] [PATCH 099/135] Drivers: hv: vmbus: dont manipulate with clocksources on crash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 067/192] [PATCH 070/135] arm64: KVM: Configure TCR_EL2.PS at runtime Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 089/192] [PATCH 093/135] net/mlx5e: Dont modify CQ before it was created Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 076/192] [PATCH 079/135] mmc: sdhci: 64-bit DMA actually has 4-byte alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:40 +0200
[PATCH 4.4 054/192] [PATCH 056/135] lpfc: Fix mbox reuse in PLOGI completion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 026/192] [PATCH 026/135] cxlflash: a couple off by one bugs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 024/192] [PATCH 024/135] fm10k: Cleanup MSI-X interrupts in case of failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 064/192] [PATCH 067/135] pwm: lpc32xx: correct number of PWM channels from 2 to 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 038/192] [PATCH 039/135] Drivers: hv: vss: run only on supported host versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 044/192] [PATCH 045/135] cxlflash: Resolve oops in wait_port_offline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 061/192] [PATCH 064/135] megaraid_sas: Fix SMAP issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 050/192] [PATCH 051/135] lpfc: Fix RegLogin failed error seen on Lancer FC during port bounce Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 056/192] [PATCH 058/135] qeth: initialize net_device with carrier off Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 035/192] [PATCH 036/135] tools: hv: report ENOSPC errors in hv_fcopy_daemon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
Re: [PATCH 4.4 035/192] [PATCH 036/135] tools: hv: report ENOSPC errors in hv_fcopy_daemon Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 14:40 +0200
[PATCH 4.4 037/192] [PATCH 038/135] drivers/hv: cleanup synic msrs if vmbus connect failed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 010/192] [PATCH 010/135] i40e: Fix Rx hash reported to the stack by our driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 046/192] [PATCH 047/135] cxl: fix build for GCC 4.6.x Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 012/192] [PATCH 012/135] igb: use the correct i210 register for EEMNGCTL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 043/192] [PATCH 044/135] cxlflash: Fix to resolve cmd leak after host reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 048/192] [PATCH 049/135] lpfc: Fix FCF Infinite loop in lpfc_sli4_fcf_rr_next_index_get. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 008/192] [PATCH 008/135] i40evf: check rings before freeing resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 042/192] [PATCH 043/135] cxl: Fix DSI misses when the context owning task exits Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 040/192] [PATCH 041/135] Drivers: hv: vmbus: fix rescind-offer handling for device without a driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 19:50 +0200
[PATCH 4.4 018/192] [PATCH 018/135] fm10k: do not assume VF always has 1 queue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
[PATCH 4.4 022/192] [PATCH 022/135] fm10k: always check init_hw for errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
[PATCH 4.4 023/192] [PATCH 023/135] fm10k: reinitialize queuing scheme after calling init_hw Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
[PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 13:50 +0200
Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Loc Ho <lho@apm.com> - 2016-09-20 18:10 +0200
Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-20 18:30 +0200
Re: [PATCH 4.4 017/192] [PATCH 017/135] clk: xgene: Fix divider with non-zero shift value Loc Ho <lho@apm.com> - 2016-09-20 18:40 +0200
[PATCH 4.4 019/192] [PATCH 019/135] fm10k: Correct MTU for jumbo frames Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 20:00 +0200
[PATCH 4.4 110/192] [PATCH 114/135] drm/radeon/mst: fix regression in lane/link handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-12 21:10 +0200
Re: [PATCH 4.4 000/192] 4.4.21-stable review Guenter Roeck <linux@roeck-us.net> - 2016-09-13 05:10 +0200
Re: [PATCH 4.4 000/192] 4.4.21-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-09-13 20:40 +0200
Re: [PATCH 4.4 000/192] 4.4.21-stable review Ben Hutchings <ben.hutchings@codethink.co.uk> - 2016-09-15 00:30 +0200
Re: [PATCH 4.4 000/192] 4.4.21-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-09-15 08:20 +0200
Page 4 of 8 — ← Prev page 1 2 3 [4] 5 6 7 8 Next page →
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 135/192] [PATCH 4.4 05/16] udp: properly support MSG_PEEK with truncated buffers |
| Message-ID | <sgD3L-6fr-123@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 197c949e7798fbf28cfadc69d9ca0c2abbf93191 ]
Backport of this upstream commit into stable kernels :
89c22d8c3b27 ("net: Fix skb csum races when peeking")
exposed a bug in udp stack vs MSG_PEEK support, when user provides
a buffer smaller than skb payload.
In this case,
skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov);
returns -EFAULT.
This bug does not happen in upstream kernels since Al Viro did a great
job to replace this into :
skb_copy_and_csum_datagram_msg(skb, sizeof(struct udphdr), msg);
This variant is safe vs short buffers.
For the time being, instead reverting Herbert Xu patch and add back
skb->ip_summed invalid changes, simply store the result of
udp_lib_checksum_complete() so that we avoid computing the checksum a
second time, and avoid the problematic
skb_copy_and_csum_datagram_iovec() call.
This patch can be applied on recent kernels as it avoids a double
checksumming, then backported to stable kernels as a bug fix.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/udp.c | 6 ++++--
net/ipv6/udp.c | 6 ++++--
2 files changed, 8 insertions(+), 4 deletions(-)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1275,6 +1275,7 @@ int udp_recvmsg(struct sock *sk, struct
int peeked, off = 0;
int err;
int is_udplite = IS_UDPLITE(sk);
+ bool checksum_valid = false;
bool slow;
if (flags & MSG_ERRQUEUE)
@@ -1300,11 +1301,12 @@ try_again:
*/
if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
- if (udp_lib_checksum_complete(skb))
+ checksum_valid = !udp_lib_checksum_complete(skb);
+ if (!checksum_valid)
goto csum_copy_err;
}
- if (skb_csum_unnecessary(skb))
+ if (checksum_valid || skb_csum_unnecessary(skb))
err = skb_copy_datagram_msg(skb, sizeof(struct udphdr),
msg, copied);
else {
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -402,6 +402,7 @@ int udpv6_recvmsg(struct sock *sk, struc
int peeked, off = 0;
int err;
int is_udplite = IS_UDPLITE(sk);
+ bool checksum_valid = false;
int is_udp4;
bool slow;
@@ -433,11 +434,12 @@ try_again:
*/
if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
- if (udp_lib_checksum_complete(skb))
+ checksum_valid = !udp_lib_checksum_complete(skb);
+ if (!checksum_valid)
goto csum_copy_err;
}
- if (skb_csum_unnecessary(skb))
+ if (checksum_valid || skb_csum_unnecessary(skb))
err = skb_copy_datagram_msg(skb, sizeof(struct udphdr),
msg, copied);
else {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 169/192] ovl: remove posix_acl_default from workdir |
| Message-ID | <sgD3L-6fr-131@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit c11b9fdd6a612f376a5e886505f1c54c16d8c380 upstream.
Clear out posix acl xattrs on workdir and also reset the mode after
creation so that an inherited sgid bit is cleared.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/super.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -763,6 +763,10 @@ retry:
struct kstat stat = {
.mode = S_IFDIR | 0,
};
+ struct iattr attr = {
+ .ia_valid = ATTR_MODE,
+ .ia_mode = stat.mode,
+ };
if (work->d_inode) {
err = -EEXIST;
@@ -778,6 +782,21 @@ retry:
err = ovl_create_real(dir, work, &stat, NULL, NULL, true);
if (err)
goto out_dput;
+
+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_DEFAULT);
+ if (err && err != -ENODATA)
+ goto out_dput;
+
+ err = vfs_removexattr(work, XATTR_NAME_POSIX_ACL_ACCESS);
+ if (err && err != -ENODATA)
+ goto out_dput;
+
+ /* Clear any inherited mode bits */
+ inode_lock(work->d_inode);
+ err = notify_change(work, &attr, NULL);
+ inode_unlock(work->d_inode);
+ if (err)
+ goto out_dput;
}
out_unlock:
mutex_unlock(&dir->i_mutex);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 181/192] ALSA: rawmidi: Fix possible deadlock with virmidi registration |
| Message-ID | <sgD3L-6fr-119@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 816f318b2364262a51024096da7ca3b84e78e3b5 upstream.
When a seq-virmidi driver is initialized, it registers a rawmidi
instance with its callback to create an associated seq kernel client.
Currently it's done throughly in rawmidi's register_mutex context.
Recently it was found that this may lead to a deadlock another rawmidi
device that is being attached with the sequencer is accessed, as both
open with the same register_mutex. This was actually triggered by
syzkaller, as Dmitry Vyukov reported:
======================================================
[ INFO: possible circular locking dependency detected ]
4.8.0-rc1+ #11 Not tainted
-------------------------------------------------------
syz-executor/7154 is trying to acquire lock:
(register_mutex#5){+.+.+.}, at: [<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341
but task is already holding lock:
(&grp->list_mutex){++++.+}, at: [<ffffffff850138bb>] check_and_subscribe_port+0x5b/0x5c0 sound/core/seq/seq_ports.c:495
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&grp->list_mutex){++++.+}:
[<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
[<ffffffff863f6199>] down_read+0x49/0xc0 kernel/locking/rwsem.c:22
[< inline >] deliver_to_subscribers sound/core/seq/seq_clientmgr.c:681
[<ffffffff85005c5e>] snd_seq_deliver_event+0x35e/0x890 sound/core/seq/seq_clientmgr.c:822
[<ffffffff85006e96>] > snd_seq_kernel_client_dispatch+0x126/0x170 sound/core/seq/seq_clientmgr.c:2418
[<ffffffff85012c52>] snd_seq_system_broadcast+0xb2/0xf0 sound/core/seq/seq_system.c:101
[<ffffffff84fff70a>] snd_seq_create_kernel_client+0x24a/0x330 sound/core/seq/seq_clientmgr.c:2297
[< inline >] snd_virmidi_dev_attach_seq sound/core/seq/seq_virmidi.c:383
[<ffffffff8502d29f>] snd_virmidi_dev_register+0x29f/0x750 sound/core/seq/seq_virmidi.c:450
[<ffffffff84fd208c>] snd_rawmidi_dev_register+0x30c/0xd40 sound/core/rawmidi.c:1645
[<ffffffff84f816d3>] __snd_device_register.part.0+0x63/0xc0 sound/core/device.c:164
[< inline >] __snd_device_register sound/core/device.c:162
[<ffffffff84f8235d>] snd_device_register_all+0xad/0x110 sound/core/device.c:212
[<ffffffff84f7546f>] snd_card_register+0xef/0x6c0 sound/core/init.c:749
[<ffffffff85040b7f>] snd_virmidi_probe+0x3ef/0x590 sound/drivers/virmidi.c:123
[<ffffffff833ebf7b>] platform_drv_probe+0x8b/0x170 drivers/base/platform.c:564
......
-> #0 (register_mutex#5){+.+.+.}:
[< inline >] check_prev_add kernel/locking/lockdep.c:1829
[< inline >] check_prevs_add kernel/locking/lockdep.c:1939
[< inline >] validate_chain kernel/locking/lockdep.c:2266
[<ffffffff814791f4>] __lock_acquire+0x4d44/0x4d80 kernel/locking/lockdep.c:3335
[<ffffffff8147a3a8>] lock_acquire+0x208/0x430 kernel/locking/lockdep.c:3746
[< inline >] __mutex_lock_common kernel/locking/mutex.c:521
[<ffffffff863f0ef1>] mutex_lock_nested+0xb1/0xa20 kernel/locking/mutex.c:621
[<ffffffff84fd6d4b>] snd_rawmidi_kernel_open+0x4b/0x260 sound/core/rawmidi.c:341
[<ffffffff8502e7c7>] midisynth_subscribe+0xf7/0x350 sound/core/seq/seq_midi.c:188
[< inline >] subscribe_port sound/core/seq/seq_ports.c:427
[<ffffffff85013cc7>] check_and_subscribe_port+0x467/0x5c0 sound/core/seq/seq_ports.c:510
[<ffffffff85015da9>] snd_seq_port_connect+0x2c9/0x500 sound/core/seq/seq_ports.c:579
[<ffffffff850079b8>] snd_seq_ioctl_subscribe_port+0x1d8/0x2b0 sound/core/seq/seq_clientmgr.c:1480
[<ffffffff84ffe9e4>] snd_seq_do_ioctl+0x184/0x1e0 sound/core/seq/seq_clientmgr.c:2225
[<ffffffff84ffeae8>] snd_seq_kernel_client_ctl+0xa8/0x110 sound/core/seq/seq_clientmgr.c:2440
[<ffffffff85027664>] snd_seq_oss_midi_open+0x3b4/0x610 sound/core/seq/oss/seq_oss_midi.c:375
[<ffffffff85023d67>] snd_seq_oss_synth_setup_midi+0x107/0x4c0 sound/core/seq/oss/seq_oss_synth.c:281
[<ffffffff8501b0a8>] snd_seq_oss_open+0x748/0x8d0 sound/core/seq/oss/seq_oss_init.c:274
[<ffffffff85019d8a>] odev_open+0x6a/0x90 sound/core/seq/oss/seq_oss.c:138
[<ffffffff84f7040f>] soundcore_open+0x30f/0x640 sound/sound_core.c:639
......
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&grp->list_mutex);
lock(register_mutex#5);
lock(&grp->list_mutex);
lock(register_mutex#5);
*** DEADLOCK ***
======================================================
The fix is to simply move the registration parts in
snd_rawmidi_dev_register() to the outside of the register_mutex lock.
The lock is needed only to manage the linked list, and it's not
necessarily to cover the whole initialization process.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/rawmidi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -1633,11 +1633,13 @@ static int snd_rawmidi_dev_register(stru
return -EBUSY;
}
list_add_tail(&rmidi->list, &snd_rawmidi_devices);
+ mutex_unlock(®ister_mutex);
err = snd_register_device(SNDRV_DEVICE_TYPE_RAWMIDI,
rmidi->card, rmidi->device,
&snd_rawmidi_f_ops, rmidi, &rmidi->dev);
if (err < 0) {
rmidi_err(rmidi, "unable to register\n");
+ mutex_lock(®ister_mutex);
list_del(&rmidi->list);
mutex_unlock(®ister_mutex);
return err;
@@ -1645,6 +1647,7 @@ static int snd_rawmidi_dev_register(stru
if (rmidi->ops && rmidi->ops->dev_register &&
(err = rmidi->ops->dev_register(rmidi)) < 0) {
snd_unregister_device(&rmidi->dev);
+ mutex_lock(®ister_mutex);
list_del(&rmidi->list);
mutex_unlock(®ister_mutex);
return err;
@@ -1677,7 +1680,6 @@ static int snd_rawmidi_dev_register(stru
}
}
#endif /* CONFIG_SND_OSSEMUL */
- mutex_unlock(®ister_mutex);
sprintf(name, "midi%d", rmidi->device);
entry = snd_info_create_card_entry(rmidi->card, name, rmidi->card->proc_root);
if (entry) {
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 154/192] cgroup: reduce read locked section of cgroup_threadgroup_rwsem during fork |
| Message-ID | <sgD3L-6fr-129@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Balbir Singh <bsingharora@gmail.com> commit 568ac888215c7fb2fabe8ea739b00ec3c1f5d440 upstream. cgroup_threadgroup_rwsem is acquired in read mode during process exit and fork. It is also grabbed in write mode during __cgroups_proc_write(). I've recently run into a scenario with lots of memory pressure and OOM and I am beginning to see systemd __switch_to+0x1f8/0x350 __schedule+0x30c/0x990 schedule+0x48/0xc0 percpu_down_write+0x114/0x170 __cgroup_procs_write.isra.12+0xb8/0x3c0 cgroup_file_write+0x74/0x1a0 kernfs_fop_write+0x188/0x200 __vfs_write+0x6c/0xe0 vfs_write+0xc0/0x230 SyS_write+0x6c/0x110 system_call+0x38/0xb4 This thread is waiting on the reader of cgroup_threadgroup_rwsem to exit. The reader itself is under memory pressure and has gone into reclaim after fork. There are times the reader also ends up waiting on oom_lock as well. __switch_to+0x1f8/0x350 __schedule+0x30c/0x990 schedule+0x48/0xc0 jbd2_log_wait_commit+0xd4/0x180 ext4_evict_inode+0x88/0x5c0 evict+0xf8/0x2a0 dispose_list+0x50/0x80 prune_icache_sb+0x6c/0x90 super_cache_scan+0x190/0x210 shrink_slab.part.15+0x22c/0x4c0 shrink_zone+0x288/0x3c0 do_try_to_free_pages+0x1dc/0x590 try_to_free_pages+0xdc/0x260 __alloc_pages_nodemask+0x72c/0xc90 alloc_pages_current+0xb4/0x1a0 page_table_alloc+0xc0/0x170 __pte_alloc+0x58/0x1f0 copy_page_range+0x4ec/0x950 copy_process.isra.5+0x15a0/0x1870 _do_fork+0xa8/0x4b0 ppc_clone+0x8/0xc In the meanwhile, all processes exiting/forking are blocked almost stalling the system. This patch moves the threadgroup_change_begin from before cgroup_fork() to just before cgroup_canfork(). There is no nee to worry about threadgroup changes till the task is actually added to the threadgroup. This avoids having to call reclaim with cgroup_threadgroup_rwsem held. tj: Subject and description edits. Signed-off-by: Balbir Singh <bsingharora@gmail.com> Acked-by: Zefan Li <lizefan@huawei.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Tejun Heo <tj@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- kernel/fork.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1369,7 +1369,6 @@ static struct task_struct *copy_process( p->real_start_time = ktime_get_boot_ns(); p->io_context = NULL; p->audit_context = NULL; - threadgroup_change_begin(current); cgroup_fork(p); #ifdef CONFIG_NUMA p->mempolicy = mpol_dup(p->mempolicy); @@ -1521,6 +1520,7 @@ static struct task_struct *copy_process( INIT_LIST_HEAD(&p->thread_group); p->task_works = NULL; + threadgroup_change_begin(current); /* * Ensure that the cgroup subsystem policies allow the new process to be * forked. It should be noted the the new process's css_set can be changed @@ -1621,6 +1621,7 @@ static struct task_struct *copy_process( bad_fork_cancel_cgroup: cgroup_cancel_fork(p, cgrp_ss_priv); bad_fork_free_pid: + threadgroup_change_end(current); if (pid != &init_struct_pid) free_pid(pid); bad_fork_cleanup_io: @@ -1651,7 +1652,6 @@ bad_fork_cleanup_policy: mpol_put(p->mempolicy); bad_fork_cleanup_threadgroup_lock: #endif - threadgroup_change_end(current); delayacct_tsk_free(p); bad_fork_cleanup_count: atomic_dec(&p->cred->user->processes);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 173/192] bcache: RESERVE_PRIO is too small by one when prio_buckets() is a power of two. |
| Message-ID | <sgD3L-6fr-137@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Kent Overstreet <kent.overstreet@gmail.com> commit acc9cf8c66c66b2cbbdb4a375537edee72be64df upstream. This patch fixes a cachedev registration-time allocation deadlock. This can deadlock on boot if your initrd auto-registeres bcache devices: Allocator thread: [ 720.727614] INFO: task bcache_allocato:3833 blocked for more than 120 seconds. [ 720.732361] [<ffffffff816eeac7>] schedule+0x37/0x90 [ 720.732963] [<ffffffffa05192b8>] bch_bucket_alloc+0x188/0x360 [bcache] [ 720.733538] [<ffffffff810e6950>] ? prepare_to_wait_event+0xf0/0xf0 [ 720.734137] [<ffffffffa05302bd>] bch_prio_write+0x19d/0x340 [bcache] [ 720.734715] [<ffffffffa05190bf>] bch_allocator_thread+0x3ff/0x470 [bcache] [ 720.735311] [<ffffffff816ee41c>] ? __schedule+0x2dc/0x950 [ 720.735884] [<ffffffffa0518cc0>] ? invalidate_buckets+0x980/0x980 [bcache] Registration thread: [ 720.710403] INFO: task bash:3531 blocked for more than 120 seconds. [ 720.715226] [<ffffffff816eeac7>] schedule+0x37/0x90 [ 720.715805] [<ffffffffa05235cd>] __bch_btree_map_nodes+0x12d/0x150 [bcache] [ 720.716409] [<ffffffffa0522d30>] ? bch_btree_insert_check_key+0x1c0/0x1c0 [bcache] [ 720.717008] [<ffffffffa05236e4>] bch_btree_insert+0xf4/0x170 [bcache] [ 720.717586] [<ffffffff810e6950>] ? prepare_to_wait_event+0xf0/0xf0 [ 720.718191] [<ffffffffa0527d9a>] bch_journal_replay+0x14a/0x290 [bcache] [ 720.718766] [<ffffffff810cc90d>] ? ttwu_do_activate.constprop.94+0x5d/0x70 [ 720.719369] [<ffffffff810cf684>] ? try_to_wake_up+0x1d4/0x350 [ 720.719968] [<ffffffffa05317d0>] run_cache_set+0x580/0x8e0 [bcache] [ 720.720553] [<ffffffffa053302e>] register_bcache+0xe2e/0x13b0 [bcache] [ 720.721153] [<ffffffff81354cef>] kobj_attr_store+0xf/0x20 [ 720.721730] [<ffffffff812a2dad>] sysfs_kf_write+0x3d/0x50 [ 720.722327] [<ffffffff812a225a>] kernfs_fop_write+0x12a/0x180 [ 720.722904] [<ffffffff81225177>] __vfs_write+0x37/0x110 [ 720.723503] [<ffffffff81228048>] ? __sb_start_write+0x58/0x110 [ 720.724100] [<ffffffff812cedb3>] ? security_file_permission+0x23/0xa0 [ 720.724675] [<ffffffff812258a9>] vfs_write+0xa9/0x1b0 [ 720.725275] [<ffffffff8102479c>] ? do_audit_syscall_entry+0x6c/0x70 [ 720.725849] [<ffffffff81226755>] SyS_write+0x55/0xd0 [ 720.726451] [<ffffffff8106a390>] ? do_page_fault+0x30/0x80 [ 720.727045] [<ffffffff816f2cae>] system_call_fastpath+0x12/0x71 The fifo code in upstream bcache can't use the last element in the buffer, which was the cause of the bug: if you asked for a power of two size, it'd give you a fifo that could hold one less than what you asked for rather than allocating a buffer twice as big. Signed-off-by: Kent Overstreet <kent.overstreet@gmail.com> Tested-by: Eric Wheeler <bcache@linux.ewheeler.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- drivers/md/bcache/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -1818,7 +1818,7 @@ static int cache_alloc(struct cache_sb * free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || - !init_fifo(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || !init_fifo(&ca->free_inc, free << 2, GFP_KERNEL) ||
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 161/192] drm/msm: fix use of copy_from_user() while holding spinlock |
| Message-ID | <sgD3L-6fr-135@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <robdclark@gmail.com>
commit 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 upstream.
Use instead __copy_from_user_inatomic() and fallback to slow-path where
we drop and re-aquire the lock in case of fault.
Reported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/msm_gem_submit.c | 27 ++++++++++++++++++++++-----
1 file changed, 22 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/msm/msm_gem_submit.c
+++ b/drivers/gpu/drm/msm/msm_gem_submit.c
@@ -55,6 +55,14 @@ static struct msm_gem_submit *submit_cre
return submit;
}
+static inline unsigned long __must_check
+copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
+{
+ if (access_ok(VERIFY_READ, from, n))
+ return __copy_from_user_inatomic(to, from, n);
+ return -EFAULT;
+}
+
static int submit_lookup_objects(struct msm_gem_submit *submit,
struct drm_msm_gem_submit *args, struct drm_file *file)
{
@@ -62,6 +70,7 @@ static int submit_lookup_objects(struct
int ret = 0;
spin_lock(&file->table_lock);
+ pagefault_disable();
for (i = 0; i < args->nr_bos; i++) {
struct drm_msm_gem_submit_bo submit_bo;
@@ -70,10 +79,15 @@ static int submit_lookup_objects(struct
void __user *userptr =
to_user_ptr(args->bos + (i * sizeof(submit_bo)));
- ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
- if (ret) {
- ret = -EFAULT;
- goto out_unlock;
+ ret = copy_from_user_inatomic(&submit_bo, userptr, sizeof(submit_bo));
+ if (unlikely(ret)) {
+ pagefault_enable();
+ spin_unlock(&file->table_lock);
+ ret = copy_from_user(&submit_bo, userptr, sizeof(submit_bo));
+ if (ret)
+ goto out;
+ spin_lock(&file->table_lock);
+ pagefault_disable();
}
if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) {
@@ -113,9 +127,12 @@ static int submit_lookup_objects(struct
}
out_unlock:
- submit->nr_bos = i;
+ pagefault_enable();
spin_unlock(&file->table_lock);
+out:
+ submit->nr_bos = i;
+
return ret;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 156/192] powerpc/tm: Avoid SLB faults in treclaim/trecheckpoint when RI=0 |
| Message-ID | <sgD3L-6fr-139@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <mikey@neuling.org>
commit 190ce8693c23eae09ba5f303a83bf2fbeb6478b1 upstream.
Currently we have 2 segments that are bolted for the kernel linear
mapping (ie 0xc000... addresses). This is 0 to 1TB and also the kernel
stacks. Anything accessed outside of these regions may need to be
faulted in. (In practice machines with TM always have 1T segments)
If a machine has < 2TB of memory we never fault on the kernel linear
mapping as these two segments cover all physical memory. If a machine
has > 2TB of memory, there may be structures outside of these two
segments that need to be faulted in. This faulting can occur when
running as a guest as the hypervisor may remove any SLB that's not
bolted.
When we treclaim and trecheckpoint we have a window where we need to
run with the userspace GPRs. This means that we no longer have a valid
stack pointer in r1. For this window we therefore clear MSR RI to
indicate that any exceptions taken at this point won't be able to be
handled. This means that we can't take segment misses in this RI=0
window.
In this RI=0 region, we currently access the thread_struct for the
process being context switched to or from. This thread_struct access
may cause a segment fault since it's not guaranteed to be covered by
the two bolted segment entries described above.
We've seen this with a crash when running as a guest with > 2TB of
memory on PowerVM:
Unrecoverable exception 4100 at c00000000004f138
Oops: Unrecoverable exception, sig: 6 [#1]
SMP NR_CPUS=2048 NUMA pSeries
CPU: 1280 PID: 7755 Comm: kworker/1280:1 Tainted: G X 4.4.13-46-default #1
task: c000189001df4210 ti: c000189001d5c000 task.ti: c000189001d5c000
NIP: c00000000004f138 LR: 0000000010003a24 CTR: 0000000010001b20
REGS: c000189001d5f730 TRAP: 4100 Tainted: G X (4.4.13-46-default)
MSR: 8000000100001031 <SF,ME,IR,DR,LE> CR: 24000048 XER: 00000000
CFAR: c00000000004ed18 SOFTE: 0
GPR00: ffffffffc58d7b60 c000189001d5f9b0 00000000100d7d00 000000003a738288
GPR04: 0000000000002781 0000000000000006 0000000000000000 c0000d1f4d889620
GPR08: 000000000000c350 00000000000008ab 00000000000008ab 00000000100d7af0
GPR12: 00000000100d7ae8 00003ffe787e67a0 0000000000000000 0000000000000211
GPR16: 0000000010001b20 0000000000000000 0000000000800000 00003ffe787df110
GPR20: 0000000000000001 00000000100d1e10 0000000000000000 00003ffe787df050
GPR24: 0000000000000003 0000000000010000 0000000000000000 00003fffe79e2e30
GPR28: 00003fffe79e2e68 00000000003d0f00 00003ffe787e67a0 00003ffe787de680
NIP [c00000000004f138] restore_gprs+0xd0/0x16c
LR [0000000010003a24] 0x10003a24
Call Trace:
[c000189001d5f9b0] [c000189001d5f9f0] 0xc000189001d5f9f0 (unreliable)
[c000189001d5fb90] [c00000000001583c] tm_recheckpoint+0x6c/0xa0
[c000189001d5fbd0] [c000000000015c40] __switch_to+0x2c0/0x350
[c000189001d5fc30] [c0000000007e647c] __schedule+0x32c/0x9c0
[c000189001d5fcb0] [c0000000007e6b58] schedule+0x48/0xc0
[c000189001d5fce0] [c0000000000deabc] worker_thread+0x22c/0x5b0
[c000189001d5fd80] [c0000000000e7000] kthread+0x110/0x130
[c000189001d5fe30] [c000000000009538] ret_from_kernel_thread+0x5c/0xa4
Instruction dump:
7cb103a6 7cc0e3a6 7ca222a6 78a58402 38c00800 7cc62838 08860000 7cc000a6
38a00006 78c60022 7cc62838 0b060000 <e8c701a0> 7ccff120 e8270078 e8a70098
---[ end trace 602126d0a1dedd54 ]---
This fixes this by copying the required data from the thread_struct to
the stack before we clear MSR RI. Then once we clear RI, we only access
the stack, guaranteeing there's no segment miss.
We also tighten the region over which we set RI=0 on the treclaim()
path. This may have a slight performance impact since we're adding an
mtmsr instruction.
Fixes: 090b9284d725 ("powerpc/tm: Clear MSR RI in non-recoverable TM code")
Signed-off-by: Michael Neuling <mikey@neuling.org>
Reviewed-by: Cyril Bur <cyrilbur@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/tm.S | 61 +++++++++++++++++++++++++++++++++--------------
1 file changed, 44 insertions(+), 17 deletions(-)
--- a/arch/powerpc/kernel/tm.S
+++ b/arch/powerpc/kernel/tm.S
@@ -110,17 +110,11 @@ _GLOBAL(tm_reclaim)
std r3, STK_PARAM(R3)(r1)
SAVE_NVGPRS(r1)
- /* We need to setup MSR for VSX register save instructions. Here we
- * also clear the MSR RI since when we do the treclaim, we won't have a
- * valid kernel pointer for a while. We clear RI here as it avoids
- * adding another mtmsr closer to the treclaim. This makes the region
- * maked as non-recoverable wider than it needs to be but it saves on
- * inserting another mtmsrd later.
- */
+ /* We need to setup MSR for VSX register save instructions. */
mfmsr r14
mr r15, r14
ori r15, r15, MSR_FP
- li r16, MSR_RI
+ li r16, 0
ori r16, r16, MSR_EE /* IRQs hard off */
andc r15, r15, r16
oris r15, r15, MSR_VEC@h
@@ -176,7 +170,17 @@ dont_backup_fp:
1: tdeqi r6, 0
EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,0
- /* The moment we treclaim, ALL of our GPRs will switch
+ /* Clear MSR RI since we are about to change r1, EE is already off. */
+ li r4, 0
+ mtmsrd r4, 1
+
+ /*
+ * BE CAREFUL HERE:
+ * At this point we can't take an SLB miss since we have MSR_RI
+ * off. Load only to/from the stack/paca which are in SLB bolted regions
+ * until we turn MSR RI back on.
+ *
+ * The moment we treclaim, ALL of our GPRs will switch
* to user register state. (FPRs, CCR etc. also!)
* Use an sprg and a tm_scratch in the PACA to shuffle.
*/
@@ -197,6 +201,11 @@ dont_backup_fp:
/* Store the PPR in r11 and reset to decent value */
std r11, GPR11(r1) /* Temporary stash */
+
+ /* Reset MSR RI so we can take SLB faults again */
+ li r11, MSR_RI
+ mtmsrd r11, 1
+
mfspr r11, SPRN_PPR
HMT_MEDIUM
@@ -397,11 +406,6 @@ restore_gprs:
ld r5, THREAD_TM_DSCR(r3)
ld r6, THREAD_TM_PPR(r3)
- /* Clear the MSR RI since we are about to change R1. EE is already off
- */
- li r4, 0
- mtmsrd r4, 1
-
REST_GPR(0, r7) /* GPR0 */
REST_2GPRS(2, r7) /* GPR2-3 */
REST_GPR(4, r7) /* GPR4 */
@@ -439,10 +443,33 @@ restore_gprs:
ld r6, _CCR(r7)
mtcr r6
- REST_GPR(1, r7) /* GPR1 */
- REST_GPR(5, r7) /* GPR5-7 */
REST_GPR(6, r7)
- ld r7, GPR7(r7)
+
+ /*
+ * Store r1 and r5 on the stack so that we can access them
+ * after we clear MSR RI.
+ */
+
+ REST_GPR(5, r7)
+ std r5, -8(r1)
+ ld r5, GPR1(r7)
+ std r5, -16(r1)
+
+ REST_GPR(7, r7)
+
+ /* Clear MSR RI since we are about to change r1. EE is already off */
+ li r5, 0
+ mtmsrd r5, 1
+
+ /*
+ * BE CAREFUL HERE:
+ * At this point we can't take an SLB miss since we have MSR_RI
+ * off. Load only to/from the stack/paca which are in SLB bolted regions
+ * until we turn MSR RI back on.
+ */
+
+ ld r5, -8(r1)
+ ld r1, -16(r1)
/* Commit register state as checkpointed state: */
TRECHKPT
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:20 +0200 |
| Subject | [PATCH 4.4 109/192] [PATCH 113/135] ecryptfs: fix handling of directory opening |
| Message-ID | <sgD3L-6fr-143@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6a480a7842545ec520a91730209ec0bae41694c1 ]
First of all, trying to open them r/w is idiocy; it's guaranteed to fail.
Moreover, assigning ->f_pos and assuming that everything will work is
blatantly broken - try that with e.g. tmpfs as underlying layer and watch
the fireworks. There may be a non-trivial amount of state associated with
current IO position, well beyond the numeric offset. Using the single
struct file associated with underlying inode is really not a good idea;
we ought to open one for each ecryptfs directory struct file.
Additionally, file_operations both for directories and non-directories are
full of pointless methods; non-directories should *not* have ->iterate(),
directories should not have ->flush(), ->fasync() and ->splice_read().
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/file.c | 71 +++++++++++++++++++++++++++++++++++++++++------------
1 file changed, 55 insertions(+), 16 deletions(-)
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -112,7 +112,6 @@ static int ecryptfs_readdir(struct file
.sb = inode->i_sb,
};
lower_file = ecryptfs_file_to_lower(file);
- lower_file->f_pos = ctx->pos;
rc = iterate_dir(lower_file, &buf.ctx);
ctx->pos = buf.ctx.pos;
if (rc < 0)
@@ -236,14 +235,6 @@ static int ecryptfs_open(struct inode *i
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
- if (d_is_dir(ecryptfs_dentry)) {
- ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
- mutex_lock(&crypt_stat->cs_mutex);
- crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
- mutex_unlock(&crypt_stat->cs_mutex);
- rc = 0;
- goto out;
- }
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_put;
@@ -260,6 +251,45 @@ out:
return rc;
}
+/**
+ * ecryptfs_dir_open
+ * @inode: inode speciying file to open
+ * @file: Structure to return filled in
+ *
+ * Opens the file specified by inode.
+ *
+ * Returns zero on success; non-zero otherwise
+ */
+static int ecryptfs_dir_open(struct inode *inode, struct file *file)
+{
+ struct dentry *ecryptfs_dentry = file->f_path.dentry;
+ /* Private value of ecryptfs_dentry allocated in
+ * ecryptfs_lookup() */
+ struct ecryptfs_file_info *file_info;
+ struct file *lower_file;
+
+ /* Released in ecryptfs_release or end of function if failure */
+ file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
+ ecryptfs_set_file_private(file, file_info);
+ if (unlikely(!file_info)) {
+ ecryptfs_printk(KERN_ERR,
+ "Error attempting to allocate memory\n");
+ return -ENOMEM;
+ }
+ lower_file = dentry_open(ecryptfs_dentry_to_lower_path(ecryptfs_dentry),
+ file->f_flags, current_cred());
+ if (IS_ERR(lower_file)) {
+ printk(KERN_ERR "%s: Error attempting to initialize "
+ "the lower file for the dentry with name "
+ "[%pd]; rc = [%ld]\n", __func__,
+ ecryptfs_dentry, PTR_ERR(lower_file));
+ kmem_cache_free(ecryptfs_file_info_cache, file_info);
+ return PTR_ERR(lower_file);
+ }
+ ecryptfs_set_file_lower(file, lower_file);
+ return 0;
+}
+
static int ecryptfs_flush(struct file *file, fl_owner_t td)
{
struct file *lower_file = ecryptfs_file_to_lower(file);
@@ -280,6 +310,19 @@ static int ecryptfs_release(struct inode
return 0;
}
+static int ecryptfs_dir_release(struct inode *inode, struct file *file)
+{
+ fput(ecryptfs_file_to_lower(file));
+ kmem_cache_free(ecryptfs_file_info_cache,
+ ecryptfs_file_to_private(file));
+ return 0;
+}
+
+static loff_t ecryptfs_dir_llseek(struct file *file, loff_t offset, int whence)
+{
+ return vfs_llseek(ecryptfs_file_to_lower(file), offset, whence);
+}
+
static int
ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
{
@@ -359,20 +402,16 @@ const struct file_operations ecryptfs_di
#ifdef CONFIG_COMPAT
.compat_ioctl = ecryptfs_compat_ioctl,
#endif
- .open = ecryptfs_open,
- .flush = ecryptfs_flush,
- .release = ecryptfs_release,
+ .open = ecryptfs_dir_open,
+ .release = ecryptfs_dir_release,
.fsync = ecryptfs_fsync,
- .fasync = ecryptfs_fasync,
- .splice_read = generic_file_splice_read,
- .llseek = default_llseek,
+ .llseek = ecryptfs_dir_llseek,
};
const struct file_operations ecryptfs_main_fops = {
.llseek = generic_file_llseek,
.read_iter = ecryptfs_read_update_atime,
.write_iter = generic_file_write_iter,
- .iterate = ecryptfs_readdir,
.unlocked_ioctl = ecryptfs_unlocked_ioctl,
#ifdef CONFIG_COMPAT
.compat_ioctl = ecryptfs_compat_ioctl,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 168/192] ovl: dont copy up opaqueness |
| Message-ID | <sgDdo-6jb-13@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit 0956254a2d5b9e2141385514553aeef694dfe3b5 upstream.
When a copy up of a directory occurs which has the opaque xattr set, the
xattr remains in the upper directory. The immediate behavior with overlayfs
is that the upper directory is not treated as opaque, however after a
remount the opaque flag is used and upper directory is treated as opaque.
This causes files created in the lower layer to be hidden when using
multiple lower directories.
Fix by not copying up the opaque flag.
To reproduce:
----8<---------8<---------8<---------8<---------8<---------8<----
mkdir -p l/d/s u v w mnt
mount -t overlay overlay -olowerdir=l,upperdir=u,workdir=w mnt
rm -rf mnt/d/
mkdir -p mnt/d/n
umount mnt
mount -t overlay overlay -olowerdir=u:l,upperdir=v,workdir=w mnt
touch mnt/d/foo
umount mnt
mount -t overlay overlay -olowerdir=u:l,upperdir=v,workdir=w mnt
ls mnt/d
----8<---------8<---------8<---------8<---------8<---------8<----
output should be: "foo n"
Reported-by: Derek McGowan <dmcg@drizz.net>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=151291
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 2 ++
fs/overlayfs/inode.c | 2 +-
fs/overlayfs/overlayfs.h | 1 +
3 files changed, 4 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -48,6 +48,8 @@ int ovl_copy_xattr(struct dentry *old, s
}
for (name = buf; name < (buf + list_size); name += strlen(name) + 1) {
+ if (ovl_is_private_xattr(name))
+ continue;
retry:
size = vfs_getxattr(old, name, value, value_size);
if (size == -ERANGE)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -219,7 +219,7 @@ static int ovl_readlink(struct dentry *d
}
-static bool ovl_is_private_xattr(const char *name)
+bool ovl_is_private_xattr(const char *name)
{
return strncmp(name, OVL_XATTR_PRE_NAME, OVL_XATTR_PRE_LEN) == 0;
}
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -174,6 +174,7 @@ ssize_t ovl_getxattr(struct dentry *dent
ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
int ovl_removexattr(struct dentry *dentry, const char *name);
struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags);
+bool ovl_is_private_xattr(const char *name);
struct inode *ovl_new_inode(struct super_block *sb, umode_t mode,
struct ovl_entry *oe);
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 149/192] ext4: properly align shifted xattrs when expanding inodes |
| Message-ID | <sgDdo-6jb-15@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jan Kara <jack@suse.cz> commit 443a8c41cd49de66a3fda45b32b9860ea0292b84 upstream. We did not count with the padding of xattr value when computing desired shift of xattrs in the inode when expanding i_extra_isize. As a result we could create unaligned start of inline xattrs. Account for alignment properly. Signed-off-by: Jan Kara <jack@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- fs/ext4/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1429,7 +1429,7 @@ retry: if (entry_size + EXT4_XATTR_SIZE(size) >= isize_diff) shift_bytes = isize_diff; else - shift_bytes = entry_size + size; + shift_bytes = entry_size + EXT4_XATTR_SIZE(size); /* Adjust the offsets and shift the remaining entries ahead */ ext4_xattr_shift_entries(entry, -shift_bytes, (void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE +
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 155/192] nvme: Call pci_disable_device on the error path. |
| Message-ID | <sgDdo-6jb-5@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Commit 5706aca74fe4 ("NVMe: Don't unmap controller registers on reset"),
which backported b00a726a9fd8 to the 4.4.y kernel introduced a
regression in which it didn't call pci_disable_device in the error path
of nvme_pci_enable.
Reported-by: Jiri Slaby <jslaby@suse.cz>
Embarassed-developer: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2725,7 +2725,7 @@ static int nvme_pci_enable(struct nvme_d
return 0;
disable:
- pci_release_regions(pdev);
+ pci_disable_device(pdev);
return result;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 131/192] [PATCH 135/135] tipc: fix nl compat regression for link statistics |
| Message-ID | <sgDdo-6jb-7@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 55e77a3e8297581c919b45adcc4d0815b69afa84 ] Fix incorrect use of nla_strlcpy() where the first NLA_HDRLEN bytes of the link name where left out. Making the output of tipc-config -ls look something like: Link statistics: dcast-link 1:data0-1.1.2:data0 1:data0-1.1.3:data0 Also, for the record, the patch that introduce this regression claims "Sending the whole object out can cause a leak". Which isn't very likely as this is a compat layer, where the data we are parsing is generated by us and we know the string to be NULL terminated. But you can of course never be to secure. Fixes: 5d2be1422e02 (tipc: fix an infoleak in tipc_nl_compat_link_dump) Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/tipc/netlink_compat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/tipc/netlink_compat.c +++ b/net/tipc/netlink_compat.c @@ -574,7 +574,7 @@ static int tipc_nl_compat_link_dump(stru link_info.dest = nla_get_flag(link[TIPC_NLA_LINK_DEST]); link_info.up = htonl(nla_get_flag(link[TIPC_NLA_LINK_UP])); - nla_strlcpy(link_info.str, nla_data(link[TIPC_NLA_LINK_NAME]), + nla_strlcpy(link_info.str, link[TIPC_NLA_LINK_NAME], TIPC_MAX_LINK_NAME); return tipc_add_tlv(msg->rep, TIPC_TLV_LINK_INFO,
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 146/192] ext4: validate that metadata blocks do not overlap superblock |
| Message-ID | <sgDdo-6jb-9@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 829fa70dddadf9dd041d62b82cd7cea63943899d upstream.
A number of fuzzing failures seem to be caused by allocation bitmaps
or other metadata blocks being pointed at the superblock.
This can cause kernel BUG or WARNings once the superblock is
overwritten, so validate the group descriptor blocks to make sure this
doesn't happen.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2093,6 +2093,7 @@ void ext4_group_desc_csum_set(struct sup
/* Called at mount-time, super-block is locked */
static int ext4_check_descriptors(struct super_block *sb,
+ ext4_fsblk_t sb_block,
ext4_group_t *first_not_zeroed)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2123,6 +2124,11 @@ static int ext4_check_descriptors(struct
grp = i;
block_bitmap = ext4_block_bitmap(sb, gdp);
+ if (block_bitmap == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Block bitmap for group %u overlaps "
+ "superblock", i);
+ }
if (block_bitmap < first_block || block_bitmap > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
"Block bitmap for group %u not in group "
@@ -2130,6 +2136,11 @@ static int ext4_check_descriptors(struct
return 0;
}
inode_bitmap = ext4_inode_bitmap(sb, gdp);
+ if (inode_bitmap == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Inode bitmap for group %u overlaps "
+ "superblock", i);
+ }
if (inode_bitmap < first_block || inode_bitmap > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
"Inode bitmap for group %u not in group "
@@ -2137,6 +2148,11 @@ static int ext4_check_descriptors(struct
return 0;
}
inode_table = ext4_inode_table(sb, gdp);
+ if (inode_table == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Inode table for group %u overlaps "
+ "superblock", i);
+ }
if (inode_table < first_block ||
inode_table + sbi->s_itb_per_group - 1 > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3640,7 +3656,7 @@ static int ext4_fill_super(struct super_
goto failed_mount2;
}
}
- if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
ret = -EFSCORRUPTED;
goto failed_mount2;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 162/192] ASoC: atmel_ssc_dai: Dont unconditionally reset SSC on stream startup |
| Message-ID | <sgDdo-6jb-17@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Huber <c.huber@bct-electronic.com>
commit 3e103a65514c2947e53f3171b21255fbde8b60c6 upstream.
commit cbaadf0f90d6 ("ASoC: atmel_ssc_dai: refactor the startup and
shutdown") refactored code such that the SSC is reset on every
startup; this breaks duplex audio (e.g. first start audio playback,
then start record, causing the playback to stop/hang)
Fixes: cbaadf0f90d6 (ASoC: atmel_ssc_dai: refactor the startup and shutdown)
Signed-off-by: Christoph Huber <c.huber@bct-electronic.com>
Signed-off-by: Peter Meerwald-Stadler <p.meerwald@bct-electronic.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/atmel/atmel_ssc_dai.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -298,8 +298,9 @@ static int atmel_ssc_startup(struct snd_
clk_enable(ssc_p->ssc->clk);
ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk);
- /* Reset the SSC to keep it at a clean status */
- ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
+ /* Reset the SSC unless initialized to keep it in a clean state */
+ if (!ssc_p->initialized)
+ ssc_writel(ssc_p->ssc->regs, CR, SSC_BIT(CR_SWRST));
if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
dir = 0;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 104/192] [PATCH 108/135] Input: xpad - correctly handle concurrent LED and FF requests |
| Message-ID | <sgDdo-6jb-19@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7fc595f4c02636eadaeeecfe7bbc45b57c173004 ]
Track the status of the irq_out URB to prevent submission iof new requests
while current one is active. Failure to do so results in the "URB submitted
while active" warning/stack trace.
Store pending brightness and FF effect in the driver structure and replace
it with the latest requests until the device is ready to process next
request. Alternate serving LED vs FF requests to make sure one does not
starve another. See [1] for discussion. Inspired by patch of Sarah Bessmer
[2].
[1]: http://www.spinics.net/lists/linux-input/msg40708.html
[2]: http://www.spinics.net/lists/linux-input/msg31450.html
Signed-off-by: Pavel Rojtberg <rojtberg@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 322 +++++++++++++++++++++++++++++-------------
1 file changed, 223 insertions(+), 99 deletions(-)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -317,6 +317,19 @@ static struct usb_device_id xpad_table[]
MODULE_DEVICE_TABLE(usb, xpad_table);
+struct xpad_output_packet {
+ u8 data[XPAD_PKT_LEN];
+ u8 len;
+ bool pending;
+};
+
+#define XPAD_OUT_CMD_IDX 0
+#define XPAD_OUT_FF_IDX 1
+#define XPAD_OUT_LED_IDX (1 + IS_ENABLED(CONFIG_JOYSTICK_XPAD_FF))
+#define XPAD_NUM_OUT_PACKETS (1 + \
+ IS_ENABLED(CONFIG_JOYSTICK_XPAD_FF) + \
+ IS_ENABLED(CONFIG_JOYSTICK_XPAD_LEDS))
+
struct usb_xpad {
struct input_dev *dev; /* input device interface */
struct usb_device *udev; /* usb device */
@@ -329,9 +342,13 @@ struct usb_xpad {
dma_addr_t idata_dma;
struct urb *irq_out; /* urb for interrupt out report */
+ bool irq_out_active; /* we must not use an active URB */
unsigned char *odata; /* output data */
dma_addr_t odata_dma;
- struct mutex odata_mutex;
+ spinlock_t odata_lock;
+
+ struct xpad_output_packet out_packets[XPAD_NUM_OUT_PACKETS];
+ int last_out_packet;
#if defined(CONFIG_JOYSTICK_XPAD_LEDS)
struct xpad_led *led;
@@ -678,18 +695,71 @@ exit:
__func__, retval);
}
+/* Callers must hold xpad->odata_lock spinlock */
+static bool xpad_prepare_next_out_packet(struct usb_xpad *xpad)
+{
+ struct xpad_output_packet *pkt, *packet = NULL;
+ int i;
+
+ for (i = 0; i < XPAD_NUM_OUT_PACKETS; i++) {
+ if (++xpad->last_out_packet >= XPAD_NUM_OUT_PACKETS)
+ xpad->last_out_packet = 0;
+
+ pkt = &xpad->out_packets[xpad->last_out_packet];
+ if (pkt->pending) {
+ dev_dbg(&xpad->intf->dev,
+ "%s - found pending output packet %d\n",
+ __func__, xpad->last_out_packet);
+ packet = pkt;
+ break;
+ }
+ }
+
+ if (packet) {
+ memcpy(xpad->odata, packet->data, packet->len);
+ xpad->irq_out->transfer_buffer_length = packet->len;
+ return true;
+ }
+
+ return false;
+}
+
+/* Callers must hold xpad->odata_lock spinlock */
+static int xpad_try_sending_next_out_packet(struct usb_xpad *xpad)
+{
+ int error;
+
+ if (!xpad->irq_out_active && xpad_prepare_next_out_packet(xpad)) {
+ error = usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
+ if (error) {
+ dev_err(&xpad->intf->dev,
+ "%s - usb_submit_urb failed with result %d\n",
+ __func__, error);
+ return -EIO;
+ }
+
+ xpad->irq_out_active = true;
+ }
+
+ return 0;
+}
+
static void xpad_irq_out(struct urb *urb)
{
struct usb_xpad *xpad = urb->context;
struct device *dev = &xpad->intf->dev;
- int retval, status;
+ int status = urb->status;
+ int error;
+ unsigned long flags;
- status = urb->status;
+ spin_lock_irqsave(&xpad->odata_lock, flags);
switch (status) {
case 0:
/* success */
- return;
+ xpad->out_packets[xpad->last_out_packet].pending = false;
+ xpad->irq_out_active = xpad_prepare_next_out_packet(xpad);
+ break;
case -ECONNRESET:
case -ENOENT:
@@ -697,19 +767,26 @@ static void xpad_irq_out(struct urb *urb
/* this urb is terminated, clean up */
dev_dbg(dev, "%s - urb shutting down with status: %d\n",
__func__, status);
- return;
+ xpad->irq_out_active = false;
+ break;
default:
dev_dbg(dev, "%s - nonzero urb status received: %d\n",
__func__, status);
- goto exit;
+ break;
}
-exit:
- retval = usb_submit_urb(urb, GFP_ATOMIC);
- if (retval)
- dev_err(dev, "%s - usb_submit_urb failed with result %d\n",
- __func__, retval);
+ if (xpad->irq_out_active) {
+ error = usb_submit_urb(urb, GFP_ATOMIC);
+ if (error) {
+ dev_err(dev,
+ "%s - usb_submit_urb failed with result %d\n",
+ __func__, error);
+ xpad->irq_out_active = false;
+ }
+ }
+
+ spin_unlock_irqrestore(&xpad->odata_lock, flags);
}
static int xpad_init_output(struct usb_interface *intf, struct usb_xpad *xpad)
@@ -728,7 +805,7 @@ static int xpad_init_output(struct usb_i
goto fail1;
}
- mutex_init(&xpad->odata_mutex);
+ spin_lock_init(&xpad->odata_lock);
xpad->irq_out = usb_alloc_urb(0, GFP_KERNEL);
if (!xpad->irq_out) {
@@ -770,27 +847,57 @@ static void xpad_deinit_output(struct us
static int xpad_inquiry_pad_presence(struct usb_xpad *xpad)
{
+ struct xpad_output_packet *packet =
+ &xpad->out_packets[XPAD_OUT_CMD_IDX];
+ unsigned long flags;
int retval;
- mutex_lock(&xpad->odata_mutex);
+ spin_lock_irqsave(&xpad->odata_lock, flags);
- xpad->odata[0] = 0x08;
- xpad->odata[1] = 0x00;
- xpad->odata[2] = 0x0F;
- xpad->odata[3] = 0xC0;
- xpad->odata[4] = 0x00;
- xpad->odata[5] = 0x00;
- xpad->odata[6] = 0x00;
- xpad->odata[7] = 0x00;
- xpad->odata[8] = 0x00;
- xpad->odata[9] = 0x00;
- xpad->odata[10] = 0x00;
- xpad->odata[11] = 0x00;
- xpad->irq_out->transfer_buffer_length = 12;
+ packet->data[0] = 0x08;
+ packet->data[1] = 0x00;
+ packet->data[2] = 0x0F;
+ packet->data[3] = 0xC0;
+ packet->data[4] = 0x00;
+ packet->data[5] = 0x00;
+ packet->data[6] = 0x00;
+ packet->data[7] = 0x00;
+ packet->data[8] = 0x00;
+ packet->data[9] = 0x00;
+ packet->data[10] = 0x00;
+ packet->data[11] = 0x00;
+ packet->len = 12;
+ packet->pending = true;
+
+ /* Reset the sequence so we send out presence first */
+ xpad->last_out_packet = -1;
+ retval = xpad_try_sending_next_out_packet(xpad);
- retval = usb_submit_urb(xpad->irq_out, GFP_KERNEL);
+ spin_unlock_irqrestore(&xpad->odata_lock, flags);
- mutex_unlock(&xpad->odata_mutex);
+ return retval;
+}
+
+static int xpad_start_xbox_one(struct usb_xpad *xpad)
+{
+ struct xpad_output_packet *packet =
+ &xpad->out_packets[XPAD_OUT_CMD_IDX];
+ unsigned long flags;
+ int retval;
+
+ spin_lock_irqsave(&xpad->odata_lock, flags);
+
+ /* Xbox one controller needs to be initialized. */
+ packet->data[0] = 0x05;
+ packet->data[1] = 0x20;
+ packet->len = 2;
+ packet->pending = true;
+
+ /* Reset the sequence so we send out start packet first */
+ xpad->last_out_packet = -1;
+ retval = xpad_try_sending_next_out_packet(xpad);
+
+ spin_unlock_irqrestore(&xpad->odata_lock, flags);
return retval;
}
@@ -799,8 +906,11 @@ static int xpad_inquiry_pad_presence(str
static int xpad_play_effect(struct input_dev *dev, void *data, struct ff_effect *effect)
{
struct usb_xpad *xpad = input_get_drvdata(dev);
+ struct xpad_output_packet *packet = &xpad->out_packets[XPAD_OUT_FF_IDX];
__u16 strong;
__u16 weak;
+ int retval;
+ unsigned long flags;
if (effect->type != FF_RUMBLE)
return 0;
@@ -808,69 +918,80 @@ static int xpad_play_effect(struct input
strong = effect->u.rumble.strong_magnitude;
weak = effect->u.rumble.weak_magnitude;
+ spin_lock_irqsave(&xpad->odata_lock, flags);
+
switch (xpad->xtype) {
case XTYPE_XBOX:
- xpad->odata[0] = 0x00;
- xpad->odata[1] = 0x06;
- xpad->odata[2] = 0x00;
- xpad->odata[3] = strong / 256; /* left actuator */
- xpad->odata[4] = 0x00;
- xpad->odata[5] = weak / 256; /* right actuator */
- xpad->irq_out->transfer_buffer_length = 6;
+ packet->data[0] = 0x00;
+ packet->data[1] = 0x06;
+ packet->data[2] = 0x00;
+ packet->data[3] = strong / 256; /* left actuator */
+ packet->data[4] = 0x00;
+ packet->data[5] = weak / 256; /* right actuator */
+ packet->len = 6;
+ packet->pending = true;
break;
case XTYPE_XBOX360:
- xpad->odata[0] = 0x00;
- xpad->odata[1] = 0x08;
- xpad->odata[2] = 0x00;
- xpad->odata[3] = strong / 256; /* left actuator? */
- xpad->odata[4] = weak / 256; /* right actuator? */
- xpad->odata[5] = 0x00;
- xpad->odata[6] = 0x00;
- xpad->odata[7] = 0x00;
- xpad->irq_out->transfer_buffer_length = 8;
+ packet->data[0] = 0x00;
+ packet->data[1] = 0x08;
+ packet->data[2] = 0x00;
+ packet->data[3] = strong / 256; /* left actuator? */
+ packet->data[4] = weak / 256; /* right actuator? */
+ packet->data[5] = 0x00;
+ packet->data[6] = 0x00;
+ packet->data[7] = 0x00;
+ packet->len = 8;
+ packet->pending = true;
break;
case XTYPE_XBOX360W:
- xpad->odata[0] = 0x00;
- xpad->odata[1] = 0x01;
- xpad->odata[2] = 0x0F;
- xpad->odata[3] = 0xC0;
- xpad->odata[4] = 0x00;
- xpad->odata[5] = strong / 256;
- xpad->odata[6] = weak / 256;
- xpad->odata[7] = 0x00;
- xpad->odata[8] = 0x00;
- xpad->odata[9] = 0x00;
- xpad->odata[10] = 0x00;
- xpad->odata[11] = 0x00;
- xpad->irq_out->transfer_buffer_length = 12;
+ packet->data[0] = 0x00;
+ packet->data[1] = 0x01;
+ packet->data[2] = 0x0F;
+ packet->data[3] = 0xC0;
+ packet->data[4] = 0x00;
+ packet->data[5] = strong / 256;
+ packet->data[6] = weak / 256;
+ packet->data[7] = 0x00;
+ packet->data[8] = 0x00;
+ packet->data[9] = 0x00;
+ packet->data[10] = 0x00;
+ packet->data[11] = 0x00;
+ packet->len = 12;
+ packet->pending = true;
break;
case XTYPE_XBOXONE:
- xpad->odata[0] = 0x09; /* activate rumble */
- xpad->odata[1] = 0x08;
- xpad->odata[2] = 0x00;
- xpad->odata[3] = 0x08; /* continuous effect */
- xpad->odata[4] = 0x00; /* simple rumble mode */
- xpad->odata[5] = 0x03; /* L and R actuator only */
- xpad->odata[6] = 0x00; /* TODO: LT actuator */
- xpad->odata[7] = 0x00; /* TODO: RT actuator */
- xpad->odata[8] = strong / 256; /* left actuator */
- xpad->odata[9] = weak / 256; /* right actuator */
- xpad->odata[10] = 0x80; /* length of pulse */
- xpad->odata[11] = 0x00; /* stop period of pulse */
- xpad->irq_out->transfer_buffer_length = 12;
+ packet->data[0] = 0x09; /* activate rumble */
+ packet->data[1] = 0x08;
+ packet->data[2] = 0x00;
+ packet->data[3] = 0x08; /* continuous effect */
+ packet->data[4] = 0x00; /* simple rumble mode */
+ packet->data[5] = 0x03; /* L and R actuator only */
+ packet->data[6] = 0x00; /* TODO: LT actuator */
+ packet->data[7] = 0x00; /* TODO: RT actuator */
+ packet->data[8] = strong / 256; /* left actuator */
+ packet->data[9] = weak / 256; /* right actuator */
+ packet->data[10] = 0x80; /* length of pulse */
+ packet->data[11] = 0x00; /* stop period of pulse */
+ packet->len = 12;
+ packet->pending = true;
break;
default:
dev_dbg(&xpad->dev->dev,
"%s - rumble command sent to unsupported xpad type: %d\n",
__func__, xpad->xtype);
- return -EINVAL;
+ retval = -EINVAL;
+ goto out;
}
- return usb_submit_urb(xpad->irq_out, GFP_ATOMIC);
+ retval = xpad_try_sending_next_out_packet(xpad);
+
+out:
+ spin_unlock_irqrestore(&xpad->odata_lock, flags);
+ return retval;
}
static int xpad_init_ff(struct usb_xpad *xpad)
@@ -921,36 +1042,44 @@ struct xpad_led {
*/
static void xpad_send_led_command(struct usb_xpad *xpad, int command)
{
+ struct xpad_output_packet *packet =
+ &xpad->out_packets[XPAD_OUT_LED_IDX];
+ unsigned long flags;
+
command %= 16;
- mutex_lock(&xpad->odata_mutex);
+ spin_lock_irqsave(&xpad->odata_lock, flags);
switch (xpad->xtype) {
case XTYPE_XBOX360:
- xpad->odata[0] = 0x01;
- xpad->odata[1] = 0x03;
- xpad->odata[2] = command;
- xpad->irq_out->transfer_buffer_length = 3;
+ packet->data[0] = 0x01;
+ packet->data[1] = 0x03;
+ packet->data[2] = command;
+ packet->len = 3;
+ packet->pending = true;
break;
+
case XTYPE_XBOX360W:
- xpad->odata[0] = 0x00;
- xpad->odata[1] = 0x00;
- xpad->odata[2] = 0x08;
- xpad->odata[3] = 0x40 + command;
- xpad->odata[4] = 0x00;
- xpad->odata[5] = 0x00;
- xpad->odata[6] = 0x00;
- xpad->odata[7] = 0x00;
- xpad->odata[8] = 0x00;
- xpad->odata[9] = 0x00;
- xpad->odata[10] = 0x00;
- xpad->odata[11] = 0x00;
- xpad->irq_out->transfer_buffer_length = 12;
+ packet->data[0] = 0x00;
+ packet->data[1] = 0x00;
+ packet->data[2] = 0x08;
+ packet->data[3] = 0x40 + command;
+ packet->data[4] = 0x00;
+ packet->data[5] = 0x00;
+ packet->data[6] = 0x00;
+ packet->data[7] = 0x00;
+ packet->data[8] = 0x00;
+ packet->data[9] = 0x00;
+ packet->data[10] = 0x00;
+ packet->data[11] = 0x00;
+ packet->len = 12;
+ packet->pending = true;
break;
}
- usb_submit_urb(xpad->irq_out, GFP_KERNEL);
- mutex_unlock(&xpad->odata_mutex);
+ xpad_try_sending_next_out_packet(xpad);
+
+ spin_unlock_irqrestore(&xpad->odata_lock, flags);
}
/*
@@ -1048,13 +1177,8 @@ static int xpad_open(struct input_dev *d
if (usb_submit_urb(xpad->irq_in, GFP_KERNEL))
return -EIO;
- if (xpad->xtype == XTYPE_XBOXONE) {
- /* Xbox one controller needs to be initialized. */
- xpad->odata[0] = 0x05;
- xpad->odata[1] = 0x20;
- xpad->irq_out->transfer_buffer_length = 2;
- return usb_submit_urb(xpad->irq_out, GFP_KERNEL);
- }
+ if (xpad->xtype == XTYPE_XBOXONE)
+ return xpad_start_xbox_one(xpad);
return 0;
}
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 175/192] x86/apic: Do not init irq remapping if ioapic is disabled |
| Message-ID | <sgDdo-6jb-21@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wanpeng Li <wanpeng.li@hotmail.com>
commit 2e63ad4bd5dd583871e6602f9d398b9322d358d9 upstream.
native_smp_prepare_cpus
-> default_setup_apic_routing
-> enable_IR_x2apic
-> irq_remapping_prepare
-> intel_prepare_irq_remapping
-> intel_setup_irq_remapping
So IR table is setup even if "noapic" boot parameter is added. As a result we
crash later when the interrupt affinity is set due to a half initialized
remapping infrastructure.
Prevent remap initialization when IOAPIC is disabled.
Signed-off-by: Wanpeng Li <wanpeng.li@hotmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Joerg Roedel <joro@8bytes.org>
Link: http://lkml.kernel.org/r/1471954039-3942-1-git-send-email-wanpeng.li@hotmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/apic/apic.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -1587,6 +1587,9 @@ void __init enable_IR_x2apic(void)
unsigned long flags;
int ret, ir_stat;
+ if (skip_ioapic_setup)
+ return;
+
ir_stat = irq_remapping_prepare();
if (ir_stat < 0 && !x2apic_supported())
return;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 129/192] [PATCH 133/135] netfilter: x_tables: check for size overflow |
| Message-ID | <sgDdo-6jb-33@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit d157bd761585605b7882935ffb86286919f62ea1 ] Ben Hawkes says: integer overflow in xt_alloc_table_info, which on 32-bit systems can lead to small structure allocation and a copy_from_user based heap corruption. Reported-by: Ben Hawkes <hawkes@google.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Sasha Levin <alexander.levin@verizon.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- net/netfilter/x_tables.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/netfilter/x_tables.c +++ b/net/netfilter/x_tables.c @@ -897,6 +897,9 @@ struct xt_table_info *xt_alloc_table_inf struct xt_table_info *info = NULL; size_t sz = sizeof(*info) + size; + if (sz < sizeof(*info)) + return NULL; + /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages) return NULL;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 153/192] block: make sure a big bio is split into at most 256 bvecs |
| Message-ID | <sgDdo-6jb-23@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <ming.lei@canonical.com>
commit 4d70dca4eadf2f95abe389116ac02b8439c2d16c upstream.
After arbitrary bio size was introduced, the incoming bio may
be very big. We have to split the bio into small bios so that
each holds at most BIO_MAX_PAGES bvecs for safety reason, such
as bio_clone().
This patch fixes the following kernel crash:
> [ 172.660142] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
> [ 172.660229] IP: [<ffffffff811e53b4>] bio_trim+0xf/0x2a
> [ 172.660289] PGD 7faf3e067 PUD 7f9279067 PMD 0
> [ 172.660399] Oops: 0000 [#1] SMP
> [...]
> [ 172.664780] Call Trace:
> [ 172.664813] [<ffffffffa007f3be>] ? raid1_make_request+0x2e8/0xad7 [raid1]
> [ 172.664846] [<ffffffff811f07da>] ? blk_queue_split+0x377/0x3d4
> [ 172.664880] [<ffffffffa005fb5f>] ? md_make_request+0xf6/0x1e9 [md_mod]
> [ 172.664912] [<ffffffff811eb860>] ? generic_make_request+0xb5/0x155
> [ 172.664947] [<ffffffffa0445c89>] ? prio_io+0x85/0x95 [bcache]
> [ 172.664981] [<ffffffffa0448252>] ? register_cache_set+0x355/0x8d0 [bcache]
> [ 172.665016] [<ffffffffa04497d3>] ? register_bcache+0x1006/0x1174 [bcache]
The issue can be reproduced by the following steps:
- create one raid1 over two virtio-blk
- build bcache device over the above raid1 and another cache device
and bucket size is set as 2Mbytes
- set cache mode as writeback
- run random write over ext4 on the bcache device
Fixes: 54efd50(block: make generic_make_request handle arbitrarily sized bios)
Reported-by: Sebastian Roesner <sroesner-kernelorg@roesner-online.de>
Reported-by: Eric Wheeler <bcache@lists.ewheeler.net>
Cc: Shaohua Li <shli@fb.com>
Acked-by: Kent Overstreet <kent.overstreet@gmail.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-merge.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
--- a/block/blk-merge.c
+++ b/block/blk-merge.c
@@ -92,9 +92,31 @@ static struct bio *blk_bio_segment_split
bool do_split = true;
struct bio *new = NULL;
const unsigned max_sectors = get_max_io_size(q, bio);
+ unsigned bvecs = 0;
bio_for_each_segment(bv, bio, iter) {
/*
+ * With arbitrary bio size, the incoming bio may be very
+ * big. We have to split the bio into small bios so that
+ * each holds at most BIO_MAX_PAGES bvecs because
+ * bio_clone() can fail to allocate big bvecs.
+ *
+ * It should have been better to apply the limit per
+ * request queue in which bio_clone() is involved,
+ * instead of globally. The biggest blocker is the
+ * bio_clone() in bio bounce.
+ *
+ * If bio is splitted by this reason, we should have
+ * allowed to continue bios merging, but don't do
+ * that now for making the change simple.
+ *
+ * TODO: deal with bio bounce's bio_clone() gracefully
+ * and convert the global limit into per-queue limit.
+ */
+ if (bvecs++ >= BIO_MAX_PAGES)
+ goto split;
+
+ /*
* If the queue doesn't support SG gaps and adding this
* offset would create a gap, disallow it.
*/
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 145/192] net: Use ns_capable_noaudit() when determining net sysctl permissions |
| Message-ID | <sgDdo-6jb-25@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyler Hicks <tyhicks@canonical.com>
commit d6e0d306449bcb5fa3c80e7a3edf11d45abf9ae9 upstream.
The capability check should not be audited since it is only being used
to determine the inode permissions. A failed check does not indicate a
violation of security policy but, when an LSM is enabled, a denial audit
message was being generated.
The denial audit message caused confusion for some application authors
because root-running Go applications always triggered the denial. To
prevent this confusion, the capability check in net_ctl_permissions() is
switched to the noaudit variant.
BugLink: https://launchpad.net/bugs/1465724
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sysctl_net.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/sysctl_net.c
+++ b/net/sysctl_net.c
@@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
kgid_t root_gid = make_kgid(net->user_ns, 0);
/* Allow network administrator to have same access as root. */
- if (ns_capable(net->user_ns, CAP_NET_ADMIN) ||
+ if (ns_capable_noaudit(net->user_ns, CAP_NET_ADMIN) ||
uid_eq(root_uid, current_euid())) {
int mode = (table->mode >> 6) & 7;
return (mode << 6) | (mode << 3) | mode;
[toc] | [prev] | [next] | [standalone]
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Date | 2016-09-12 19:30 +0200 |
| Subject | [PATCH 4.4 179/192] ALSA: firewire-tascam: accessing to user space outside spinlock |
| Message-ID | <sgDdo-6jb-29@gated-at.bofh.it> |
| In reply to | #1481599 |
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit 04b2d9c9c319277ad4fbbb71855c256a9f4d5f98 upstream.
In hwdep interface of firewire-tascam driver, accessing to user space is
in a critical section with disabled local interrupt. Depending on
architecture, accessing to user space can cause page fault exception. Then
local processor stores machine status and handle the synchronous event. A
handler corresponding to the event can call task scheduler to wait for
preparing pages. In a case of usage of single core processor, the state to
disable local interrupt is worse because it doesn't handle usual interrupts
from hardware.
This commit fixes this bug, by performing the accessing outside spinlock.
Reported-by: Vaishali Thakkar <vaishali.thakkar@oracle.com>
Fixes: e5e0c3dd257b('ALSA: firewire-tascam: add hwdep interface')
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/firewire/tascam/tascam-hwdep.c | 33 +++++++++++----------------------
1 file changed, 11 insertions(+), 22 deletions(-)
--- a/sound/firewire/tascam/tascam-hwdep.c
+++ b/sound/firewire/tascam/tascam-hwdep.c
@@ -16,31 +16,14 @@
#include "tascam.h"
-static long hwdep_read_locked(struct snd_tscm *tscm, char __user *buf,
- long count)
-{
- union snd_firewire_event event;
-
- memset(&event, 0, sizeof(event));
-
- event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
- event.lock_status.status = (tscm->dev_lock_count > 0);
- tscm->dev_lock_changed = false;
-
- count = min_t(long, count, sizeof(event.lock_status));
-
- if (copy_to_user(buf, &event, count))
- return -EFAULT;
-
- return count;
-}
-
static long hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
loff_t *offset)
{
struct snd_tscm *tscm = hwdep->private_data;
DEFINE_WAIT(wait);
- union snd_firewire_event event;
+ union snd_firewire_event event = {
+ .lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS,
+ };
spin_lock_irq(&tscm->lock);
@@ -54,10 +37,16 @@ static long hwdep_read(struct snd_hwdep
spin_lock_irq(&tscm->lock);
}
- memset(&event, 0, sizeof(event));
- count = hwdep_read_locked(tscm, buf, count);
+ event.lock_status.status = (tscm->dev_lock_count > 0);
+ tscm->dev_lock_changed = false;
+
spin_unlock_irq(&tscm->lock);
+ count = min_t(long, count, sizeof(event.lock_status));
+
+ if (copy_to_user(buf, &event, count))
+ return -EFAULT;
+
return count;
}
[toc] | [prev] | [next] | [standalone]
Page 4 of 8 — ← Prev page 1 2 3 [4] 5 6 7 8 Next page →
Back to top | Article view | linux.kernel
csiph-web