Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1496251 > unrolled thread

[PATCH 4.7 000/141] 4.7.7-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.7 000/141] 4.7.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 024/141] hwmon: (adt7411) set bit 3 in CFG1 register Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 061/141] regulator: pwm: Fix regulator ramp delay for continuous mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 003/141] scripts/recordmcount.c: account for .softirqentry.text Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 045/141] i40iw: Send last streaming mode message for loopback connections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 023/141] nvmem: Declare nvmem_cell_read() consistently Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 029/141] iwlwifi: mvm: write the correct internal TXF index Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 032/141] iwlwifi: mvm: free RX reorder buffer on restart Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 008/141] x86/boot: Initialize FPU and X86_FEATURE_ALWAYS even if we dont have CPUID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 046/141] i40iw: Update hw_iwarp_state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 064/141] regulator: qcom_spmi: Update mvs1/mvs2 switches on pm8941 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 006/141] can: dev: fix deadlock reported after bus-off Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 028/141] iwlwifi: mvm: fix txq aggregation bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 011/141] drm/radeon/si/dpm: add workaround for for Jet parts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 013/141] ARM: 8617/1: dma: fix dma_max_pfn() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 039/141] i40iw: Add missing check for interface already open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 018/141] i2c: mux: demux-pinctrl: run properly with multiple instances Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 007/141] x86/init: Fix cr4_init_shadow() on CR4-less machines Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 054/141] MIPS: fix uretprobe implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 002/141] cgroup: fix invalid controller enable rejections with cgroup namespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 010/141] drm/nouveau/fifo/nv04: avoid ramht race against cookie insertion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:40 +0200
    [PATCH 4.7 141/141] ALSA: hda - Add the top speaker pin config for HP Spectre x360 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 107/141] powerpc/prom: Fix sub-processor option passed to ibm, client-architecture-support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 101/141] xprtrdma: Remove FMRs from the unmap list after unmapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 050/141] irqchip/gicv3: Silence noisy DEBUG_PER_CPU_MAPS warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 089/141] fnic: pci_dma_mapping_error() doesnt return an error code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 093/141] dmaengine: at_xdmac: fix debug string Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 080/141] iwlmvm: mvm: set correct state in smart-fifo configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of is_sas_attached Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
      Re: [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of  is_sas_attached James Bottomley <jejb@linux.vnet.ibm.com> - 2016-10-06 15:30 +0200
        Re: [PATCH 4.7 122/141] scsi: ses: use scsi_is_sas_rphy instead of  is_sas_attached Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-07 06:10 +0200
    [PATCH 4.7 137/141] USB: serial: cp210x: Add ID for a Juniper console Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 078/141] tile: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 071/141] ARM: sa1100: clear reset status prior to reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 076/141] blk-mq: actually hook up defer list when running requests Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 096/141] NFS: Dont drop CB requests with invalid principals Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 099/141] watchdog: core: Clear WDOG_HW_RUNNING before calling the stop function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 138/141] Revert "usbtmc: convert to devm_kzalloc" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 073/141] ARM: sa1111: fix pcmcia suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 072/141] ARM: shmobile: fix regulator quirk for Gen2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 090/141] mm, kasan: account for object redzone in SLUBs nearest_obj() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 126/141] IB/mlx4: Use correct subnet-prefix in QP1 mads under SR-IOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 074/141] pcmcia: ds: fix suspend/resume Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 077/141] pstore: drop file opened reference count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 127/141] IB/mlx5: Enable MAD_IFC commands for IB ports only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 110/141] IB/core: Fix possible memory leak in cma_resolve_iboe_route() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 053/141] MIPS: uprobes: remove incorrect set_orig_insn Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 139/141] ALSA: hda - Adding one more ALC255 pin definition for headset problem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 106/141] staging: comedi: adv_pci1760: Do not return EINVAL for CMDF_ROUND_DOWN. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 083/141] [media] v4l: vsp1: Fix crash when resetting pipeline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 088/141] qla2xxx: Fix BBCR offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 136/141] usb: usbip: vudc: fix left shift overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 125/141] IB/mlx4: Fix code indentation in QP1 MAD flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 094/141] NFS/pnfs: Do not clobber existing pgio_done_cb in nfs4_proc_read_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 134/141] usb: misc: legousbtower: Fix NULL pointer deference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 102/141] ASoC: Intel: Skylake: Fix error return code in skl_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 100/141] cxl: fix potential NULL dereference in free_adapter() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 051/141] ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 069/141] ARM: sa1100: register clocks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 135/141] Staging: fbtft: Fix bug in fbtft-core Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 048/141] batman-adv: Add missing refcnt for last_candidate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 121/141] regmap: rbtree: Avoid overlapping nodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 115/141] dmaengine: at_xdmac: fix to pass correct device identity to free_irq() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 103/141] brcmfmac: Fix glob_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 070/141] ARM: sa1100: fix 3.6864MHz clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 087/141] avr32: off by one in at32_init_pio() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 085/141] ath9k: Fix programming of minCCA power threshold Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 047/141] i40iw: Receive notification events correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 079/141] fm10k: fix incorrect index calculation in fm10k_write_reta Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 075/141] hwrng: omap - Fix assumption that runtime_get_sync will always succeed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 095/141] svc: Avoid garbage replies when pc_func() returns rpc_drop_reply Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 109/141] ASoC: omap-mcpdm: Fix irq resource handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 098/141] pNFS/flexfiles: Fix layoutcommit after a commit to DS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 092/141] dmaengine: bcm2835: fix 64-bit warning Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 052/141] arm64: debug: avoid resetting stepping state machine when TIF_SINGLESTEP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 111/141] kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 112/141] SUNRPC: Silence WARN_ON when NFSv4.1 over RDMA is in use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 097/141] pNFS/files: Fix layoutcommit after a commit to DS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 104/141] brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 082/141] [media] em28xx-i2c: rt_mutex_trylock() returns zero on failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 123/141] IB/ipoib: Dont allow MC joins during light MC flush Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 084/141] [media] gspca: avoid unused variable warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 10:50 +0200
    [PATCH 4.7 131/141] tpm_crb: fix mapping of the buffers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 132/141] aio: mark AIO pseudo-fs noexec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 124/141] IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 130/141] tpm_crb: drop struct resource res from struct crb_priv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 128/141] IB/mlx5: Set source mac address in FTE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 133/141] dm log writes: fix bug with too large bios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:00 +0200
    [PATCH 4.7 091/141] tracing: Have HIST_TRIGGERS select TRACING Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 140/141] ALSA: hda - Fix headset mic detection problem for several Dell laptops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 129/141] batman-adv: remove unused callback from batadv_algo_ops struct Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:30 +0200
    [PATCH 4.7 118/141] IB/ipoib: Fix memory corruption in ipoib cm mode connect flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 086/141] mailbox: mailbox-test: set tdev->signal to NULL after freeing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 120/141] IB/core: Fix use after free in send_leave function Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 119/141] ath10k: fix get rx_status from htt context Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 113/141] pNFS/flexfiles: Fix layoutstat periodic reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 117/141] ceph: do not modify fi->frag in need_reset_readdir() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 114/141] lib/test_hash.c: fix warning in preprocessor symbol evaluation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:40 +0200
    [PATCH 4.7 105/141] brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 108/141] sysctl: handle error writing UINT_MAX to u32 fields Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 044/141] i40iw: Add missing NULL check for MPA private data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 11:50 +0200
    [PATCH 4.7 038/141] i40iw: Protect req_resource_num update Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 056/141] MIPS: uprobes: fix use of uninitialised variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 058/141] Bluetooth: split sk_filter in l2cap_sock_recv_cb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 005/141] mm,ksm: fix endless looping in allocating memory when ksm enable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 014/141] mwifiex: illegal assignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 036/141] gpio: sa1100: fix irq probing for ucb1x00 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    [PATCH 4.7 055/141] MIPS: Malta: Fix IOCU disable switch read for MIPS64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-06 12:00 +0200
    Re: [PATCH 4.7 000/141] 4.7.7-stable review Guenter Roeck <linux@roeck-us.net> - 2016-10-06 21:00 +0200
      Re: [PATCH 4.7 000/141] 4.7.7-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-10-07 06:10 +0200
    Re: [PATCH 4.7 000/141] 4.7.7-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-10-06 22:00 +0200

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

#1496337 — [PATCH 4.7 123/141] IB/ipoib: Dont allow MC joins during light MC flush

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Vesker <valex@mellanox.com>

commit 344bacca8cd811809fc33a249f2738ab757d327f upstream.

This fix solves a race between light flush and on the fly joins.
Light flush doesn't set the device to down and unset IPOIB_OPER_UP
flag, this means that if while flushing we have a MC join in progress
and the QP was attached to BC MGID we can have a mismatches when
re-attaching a QP to the BC MGID.

The light flush would set the broadcast group to NULL causing an on
the fly join to rejoin and reattach to the BC MCG as well as adding
the BC MGID to the multicast list. The flush process would later on
remove the BC MGID and detach it from the QP. On the next flush
the BC MGID is present in the multicast list but not found when trying
to detach it because of the previous double attach and single detach.

[18332.714265] ------------[ cut here ]------------
[18332.717775] WARNING: CPU: 6 PID: 3767 at drivers/infiniband/core/verbs.c:280 ib_dealloc_pd+0xff/0x120 [ib_core]
...
[18332.775198] Hardware name: Red Hat KVM, BIOS Bochs 01/01/2011
[18332.779411]  0000000000000000 ffff8800b50dfbb0 ffffffff813fed47 0000000000000000
[18332.784960]  0000000000000000 ffff8800b50dfbf0 ffffffff8109add1 0000011832f58300
[18332.790547]  ffff880226a596c0 ffff880032482000 ffff880032482830 ffff880226a59280
[18332.796199] Call Trace:
[18332.798015]  [<ffffffff813fed47>] dump_stack+0x63/0x8c
[18332.801831]  [<ffffffff8109add1>] __warn+0xd1/0xf0
[18332.805403]  [<ffffffff8109aebd>] warn_slowpath_null+0x1d/0x20
[18332.809706]  [<ffffffffa025d90f>] ib_dealloc_pd+0xff/0x120 [ib_core]
[18332.814384]  [<ffffffffa04f3d7c>] ipoib_transport_dev_cleanup+0xfc/0x1d0 [ib_ipoib]
[18332.820031]  [<ffffffffa04ed648>] ipoib_ib_dev_cleanup+0x98/0x110 [ib_ipoib]
[18332.825220]  [<ffffffffa04e62c8>] ipoib_dev_cleanup+0x2d8/0x550 [ib_ipoib]
[18332.830290]  [<ffffffffa04e656f>] ipoib_uninit+0x2f/0x40 [ib_ipoib]
[18332.834911]  [<ffffffff81772a8a>] rollback_registered_many+0x1aa/0x2c0
[18332.839741]  [<ffffffff81772bd1>] rollback_registered+0x31/0x40
[18332.844091]  [<ffffffff81773b18>] unregister_netdevice_queue+0x48/0x80
[18332.848880]  [<ffffffffa04f489b>] ipoib_vlan_delete+0x1fb/0x290 [ib_ipoib]
[18332.853848]  [<ffffffffa04df1cd>] delete_child+0x7d/0xf0 [ib_ipoib]
[18332.858474]  [<ffffffff81520c08>] dev_attr_store+0x18/0x30
[18332.862510]  [<ffffffff8127fe4a>] sysfs_kf_write+0x3a/0x50
[18332.866349]  [<ffffffff8127f4e0>] kernfs_fop_write+0x120/0x170
[18332.870471]  [<ffffffff81207198>] __vfs_write+0x28/0xe0
[18332.874152]  [<ffffffff810e09bf>] ? percpu_down_read+0x1f/0x50
[18332.878274]  [<ffffffff81208062>] vfs_write+0xa2/0x1a0
[18332.881896]  [<ffffffff812093a6>] SyS_write+0x46/0xa0
[18332.885632]  [<ffffffff810039b7>] do_syscall_64+0x57/0xb0
[18332.889709]  [<ffffffff81883321>] entry_SYSCALL64_slow_path+0x25/0x25
[18332.894727] ---[ end trace 09ebbe31f831ef17 ]---

Fixes: ee1e2c82c245 ("IPoIB: Refresh paths instead of flushing them on SM change events")
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/ulp/ipoib/ipoib_ib.c |    9 +++++++++
 1 file changed, 9 insertions(+)

--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -1161,8 +1161,17 @@ static void __ipoib_ib_dev_flush(struct
 	}
 
 	if (level == IPOIB_FLUSH_LIGHT) {
+		int oper_up;
 		ipoib_mark_paths_invalid(dev);
+		/* Set IPoIB operation as down to prevent races between:
+		 * the flush flow which leaves MCG and on the fly joins
+		 * which can happen during that time. mcast restart task
+		 * should deal with join requests we missed.
+		 */
+		oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_mcast_dev_flush(dev);
+		if (oper_up)
+			set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
 		ipoib_flush_ah(dev);
 	}
 

[toc] | [prev] | [next] | [standalone]

#1496338 — [PATCH 4.7 084/141] [media] gspca: avoid unused variable warnings

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit d7e92e15e92fc987640772bf110586898b5f15aa upstream.

When CONFIG_INPUT is disabled, multiple gspca backend drivers
print compile-time warnings about unused variables:

media/usb/gspca/cpia1.c: In function 'sd_stopN':
media/usb/gspca/cpia1.c:1627:13: error: unused variable 'sd' [-Werror=unused-variable]
media/usb/gspca/konica.c: In function 'sd_stopN':
media/usb/gspca/konica.c:246:13: error: unused variable 'sd' [-Werror=unused-variable]

This annotates the variables as __maybe_unused, to let the compiler
know that they are declared intentionally.

Fixes: ee186fd96a5f ("[media] gscpa_t613: Add support for the camera button")
Fixes: c2f644aeeba3 ("[media] gspca_cpia1: Add support for button")
Fixes: b517af722860 ("V4L/DVB: gspca_konica: New gspca subdriver for konica chipset using cams")

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/gspca/cpia1.c  |    2 +-
 drivers/media/usb/gspca/konica.c |    2 +-
 drivers/media/usb/gspca/t613.c   |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/media/usb/gspca/cpia1.c
+++ b/drivers/media/usb/gspca/cpia1.c
@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	command_pause(gspca_dev);
 
--- a/drivers/media/usb/gspca/konica.c
+++ b/drivers/media/usb/gspca/konica.c
@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gs
 
 static void sd_stopN(struct gspca_dev *gspca_dev)
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 
 	konica_stream_off(gspca_dev);
 #if IS_ENABLED(CONFIG_INPUT)
--- a/drivers/media/usb/gspca/t613.c
+++ b/drivers/media/usb/gspca/t613.c
@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev
 			u8 *data,			/* isoc packet */
 			int len)			/* iso packet length */
 {
-	struct sd *sd = (struct sd *) gspca_dev;
+	struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
 	int pkt_type;
 
 	if (data[0] == 0x5a) {

[toc] | [prev] | [next] | [standalone]

#1496381 — [PATCH 4.7 131/141] tpm_crb: fix mapping of the buffers

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

commit 422eac3f7deae34dbaffd08e03e27f37a5394a56 upstream.

On my Lenovo x250 the following situation occurs:

[18697.813871] tpm_crb MSFT0101:00: can't request region for resource
[mem 0xacdff080-0xacdfffff]

The mapping of the control area overlaps the mapping of the command
buffer. The control area is mapped over page, which is not right. It
should mapped over sizeof(struct crb_control_area).

Fixing this issue unmasks another issue. Command and response buffers
can overlap and they do interleave on this machine. According to the PTP
specification the overlapping means that they are mapped to the same
buffer.

The commit has been also on a Haswell NUC where things worked before
applying this fix so that the both code paths for response buffer
initialization are tested.

Cc: stable@vger.kernel.org
Fixes: 1bd047be37d9 ("tpm_crb: Use devm_ioremap_resource")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm_crb.c |   39 ++++++++++++++++++++++++++++-----------
 1 file changed, 28 insertions(+), 11 deletions(-)

--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -259,7 +259,10 @@ static int crb_map_io(struct acpi_device
 	struct list_head resources;
 	struct resource io_res;
 	struct device *dev = &device->dev;
-	u64 pa;
+	u64 cmd_pa;
+	u32 cmd_size;
+	u64 rsp_pa;
+	u32 rsp_size;
 	int ret;
 
 	INIT_LIST_HEAD(&resources);
@@ -280,22 +283,36 @@ static int crb_map_io(struct acpi_device
 		return PTR_ERR(priv->iobase);
 
 	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
-				0x1000);
+				sizeof(struct crb_control_area));
 	if (IS_ERR(priv->cca))
 		return PTR_ERR(priv->cca);
 
-	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
-	      (u64) ioread32(&priv->cca->cmd_pa_low);
-	priv->cmd = crb_map_res(dev, priv, &io_res, pa,
-				ioread32(&priv->cca->cmd_size));
+	cmd_pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
+		  (u64) ioread32(&priv->cca->cmd_pa_low);
+	cmd_size = ioread32(&priv->cca->cmd_size);
+	priv->cmd = crb_map_res(dev, priv, &io_res, cmd_pa, cmd_size);
 	if (IS_ERR(priv->cmd))
 		return PTR_ERR(priv->cmd);
 
-	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
-	pa = le64_to_cpu(pa);
-	priv->rsp = crb_map_res(dev, priv, &io_res, pa,
-				ioread32(&priv->cca->rsp_size));
-	return PTR_ERR_OR_ZERO(priv->rsp);
+	memcpy_fromio(&rsp_pa, &priv->cca->rsp_pa, 8);
+	rsp_pa = le64_to_cpu(rsp_pa);
+	rsp_size = ioread32(&priv->cca->rsp_size);
+
+	if (cmd_pa != rsp_pa) {
+		priv->rsp = crb_map_res(dev, priv, &io_res, rsp_pa, rsp_size);
+		return PTR_ERR_OR_ZERO(priv->rsp);
+	}
+
+	/* According to the PTP specification, overlapping command and response
+	 * buffer sizes must be identical.
+	 */
+	if (cmd_size != rsp_size) {
+		dev_err(dev, FW_BUG "overlapping command and response buffer sizes are not identical");
+		return -EINVAL;
+	}
+
+	priv->rsp = priv->cmd;
+	return 0;
 }
 
 static int crb_acpi_add(struct acpi_device *device)

[toc] | [prev] | [next] | [standalone]

#1496386 — [PATCH 4.7 132/141] aio: mark AIO pseudo-fs noexec

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jann Horn <jann@thejh.net>

commit 22f6b4d34fcf039c63a94e7670e0da24f8575a5a upstream.

This ensures that do_mmap() won't implicitly make AIO memory mappings
executable if the READ_IMPLIES_EXEC personality flag is set.  Such
behavior is problematic because the security_mmap_file LSM hook doesn't
catch this case, potentially permitting an attacker to bypass a W^X
policy enforced by SELinux.

I have tested the patch on my machine.

To test the behavior, compile and run this:

    #define _GNU_SOURCE
    #include <unistd.h>
    #include <sys/personality.h>
    #include <linux/aio_abi.h>
    #include <err.h>
    #include <stdlib.h>
    #include <stdio.h>
    #include <sys/syscall.h>

    int main(void) {
        personality(READ_IMPLIES_EXEC);
        aio_context_t ctx = 0;
        if (syscall(__NR_io_setup, 1, &ctx))
            err(1, "io_setup");

        char cmd[1000];
        sprintf(cmd, "cat /proc/%d/maps | grep -F '/[aio]'",
            (int)getpid());
        system(cmd);
        return 0;
    }

In the output, "rw-s" is good, "rwxs" is bad.

Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/aio.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/fs/aio.c
+++ b/fs/aio.c
@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct f
 	static const struct dentry_operations ops = {
 		.d_dname	= simple_dname,
 	};
-	return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
+	struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
+					   AIO_RING_MAGIC);
+
+	if (!IS_ERR(root))
+		root->d_sb->s_iflags |= SB_I_NOEXEC;
+	return root;
 }
 
 /* aio_setup

[toc] | [prev] | [next] | [standalone]

#1496393 — [PATCH 4.7 124/141] IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alex Vesker <valex@mellanox.com>

commit e5ac40cd66c2f3cd11bc5edc658f012661b16347 upstream.

Because of an incorrect bit-masking done on the join state bits, when
handling a join request we failed to detect a difference between the
group join state and the request join state when joining as send only
full member (0x8). This caused the MC join request not to be sent.
This issue is relevant only when SRIOV is enabled and SM supports
send only full member.

This fix separates scope bits and join states bits a nibble each.

Fixes: b9c5d6a64358 ('IB/mlx4: Add multicast group (MCG) paravirtualization for SR-IOV')
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx4/mcg.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_g
 		if (!group->members[i])
 			leave_state |= (1 << i);
 
-	return leave_state & (group->rec.scope_join_state & 7);
+	return leave_state & (group->rec.scope_join_state & 0xf);
 }
 
 static int join_group(struct mcast_group *group, int slave, u8 join_mask)
@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(
 		} else
 			mcg_warn_group(group, "DRIVER BUG\n");
 	} else if (group->state == MCAST_LEAVE_SENT) {
-		if (group->rec.scope_join_state & 7)
-			group->rec.scope_join_state &= 0xf8;
+		if (group->rec.scope_join_state & 0xf)
+			group->rec.scope_join_state &= 0xf0;
 		group->state = MCAST_IDLE;
 		mutex_unlock(&group->lock);
 		if (release_group(group, 1))
@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast
 static int handle_join_req(struct mcast_group *group, u8 join_mask,
 			   struct mcast_req *req)
 {
-	u8 group_join_state = group->rec.scope_join_state & 7;
+	u8 group_join_state = group->rec.scope_join_state & 0xf;
 	int ref = 0;
 	u16 status;
 	struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(str
 			u8 cur_join_state;
 
 			resp_join_state = ((struct ib_sa_mcmember_data *)
-						group->response_sa_mad.data)->scope_join_state & 7;
-			cur_join_state = group->rec.scope_join_state & 7;
+						group->response_sa_mad.data)->scope_join_state & 0xf;
+			cur_join_state = group->rec.scope_join_state & 0xf;
 
 			if (method == IB_MGMT_METHOD_GET_RESP) {
 				/* successfull join */
@@ -710,7 +710,7 @@ process_requests:
 		req = list_first_entry(&group->pending_list, struct mcast_req,
 				       group_list);
 		sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
-		req_join_state = sa_data->scope_join_state & 0x7;
+		req_join_state = sa_data->scope_join_state & 0xf;
 
 		/* For a leave request, we will immediately answer the VF, and
 		 * update our internal counters. The actual leave will be sent

[toc] | [prev] | [next] | [standalone]

#1496399 — [PATCH 4.7 130/141] tpm_crb: drop struct resource res from struct crb_priv

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

commit 14ddfbf488a0223b19abf7e4634e6e676a91a12d upstream.

The iomem resource is needed only temporarily so it is better to pass
it on instead of storing it permanently. Named the variable as io_res
so that the code better documents itself.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/tpm/tpm_crb.c |   29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -77,7 +77,6 @@ enum crb_flags {
 
 struct crb_priv {
 	unsigned int flags;
-	struct resource res;
 	void __iomem *iobase;
 	struct crb_control_area __iomem *cca;
 	u8 __iomem *cmd;
@@ -224,19 +223,19 @@ static int crb_init(struct acpi_device *
 
 static int crb_check_resource(struct acpi_resource *ares, void *data)
 {
-	struct crb_priv *priv = data;
+	struct resource *io_res = data;
 	struct resource res;
 
 	if (acpi_dev_resource_memory(ares, &res)) {
-		priv->res = res;
-		priv->res.name = NULL;
+		*io_res = res;
+		io_res->name = NULL;
 	}
 
 	return 1;
 }
 
 static void __iomem *crb_map_res(struct device *dev, struct crb_priv *priv,
-				 u64 start, u32 size)
+				 struct resource *io_res, u64 start, u32 size)
 {
 	struct resource new_res = {
 		.start	= start,
@@ -248,50 +247,54 @@ static void __iomem *crb_map_res(struct
 	if (start != new_res.start)
 		return (void __iomem *) ERR_PTR(-EINVAL);
 
-	if (!resource_contains(&priv->res, &new_res))
+	if (!resource_contains(io_res, &new_res))
 		return devm_ioremap_resource(dev, &new_res);
 
-	return priv->iobase + (new_res.start - priv->res.start);
+	return priv->iobase + (new_res.start - io_res->start);
 }
 
 static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
 		      struct acpi_table_tpm2 *buf)
 {
 	struct list_head resources;
+	struct resource io_res;
 	struct device *dev = &device->dev;
 	u64 pa;
 	int ret;
 
 	INIT_LIST_HEAD(&resources);
 	ret = acpi_dev_get_resources(device, &resources, crb_check_resource,
-				     priv);
+				     &io_res);
 	if (ret < 0)
 		return ret;
 	acpi_dev_free_resource_list(&resources);
 
-	if (resource_type(&priv->res) != IORESOURCE_MEM) {
+	if (resource_type(&io_res) != IORESOURCE_MEM) {
 		dev_err(dev,
 			FW_BUG "TPM2 ACPI table does not define a memory resource\n");
 		return -EINVAL;
 	}
 
-	priv->iobase = devm_ioremap_resource(dev, &priv->res);
+	priv->iobase = devm_ioremap_resource(dev, &io_res);
 	if (IS_ERR(priv->iobase))
 		return PTR_ERR(priv->iobase);
 
-	priv->cca = crb_map_res(dev, priv, buf->control_address, 0x1000);
+	priv->cca = crb_map_res(dev, priv, &io_res, buf->control_address,
+				0x1000);
 	if (IS_ERR(priv->cca))
 		return PTR_ERR(priv->cca);
 
 	pa = ((u64) ioread32(&priv->cca->cmd_pa_high) << 32) |
 	      (u64) ioread32(&priv->cca->cmd_pa_low);
-	priv->cmd = crb_map_res(dev, priv, pa, ioread32(&priv->cca->cmd_size));
+	priv->cmd = crb_map_res(dev, priv, &io_res, pa,
+				ioread32(&priv->cca->cmd_size));
 	if (IS_ERR(priv->cmd))
 		return PTR_ERR(priv->cmd);
 
 	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
 	pa = le64_to_cpu(pa);
-	priv->rsp = crb_map_res(dev, priv, pa, ioread32(&priv->cca->rsp_size));
+	priv->rsp = crb_map_res(dev, priv, &io_res, pa,
+				ioread32(&priv->cca->rsp_size));
 	return PTR_ERR_OR_ZERO(priv->rsp);
 }
 

[toc] | [prev] | [next] | [standalone]

#1496406 — [PATCH 4.7 128/141] IB/mlx5: Set source mac address in FTE

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maor Gottlieb <maorg@mellanox.com>

commit ee3da804ad1b1dd4c766199a6e8443542b0aaaef upstream.

Set the source mac address in the FTE when L2 specification
is provided.

Fixes: 038d2ef87572 ('IB/mlx5: Add flow steering support')
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/mlx5/main.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1277,6 +1277,13 @@ static int parse_flow_attr(u32 *match_c,
 					     dmac_47_16),
 				ib_spec->eth.val.dst_mac);
 
+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_c,
+					     smac_47_16),
+				ib_spec->eth.mask.src_mac);
+		ether_addr_copy(MLX5_ADDR_OF(fte_match_set_lyr_2_4, outer_headers_v,
+					     smac_47_16),
+				ib_spec->eth.val.src_mac);
+
 		if (ib_spec->eth.mask.vlan_tag) {
 			MLX5_SET(fte_match_set_lyr_2_4, outer_headers_c,
 				 vlan_tag, 1);

[toc] | [prev] | [next] | [standalone]

#1496408 — [PATCH 4.7 133/141] dm log writes: fix bug with too large bios

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mikulas Patocka <mpatocka@redhat.com>

commit 7efb367320f56fc4d549875b6f3a6940018ef2e5 upstream.

bio_alloc() can allocate a bio with at most BIO_MAX_PAGES (256) vector
entries.  However, the incoming bio may have more vector entries if it
was allocated by other means.  For example, bcache submits bios with
more than BIO_MAX_PAGES entries.  This results in bio_alloc() failure.

To avoid the failure, change the code so that it allocates bio with at
most BIO_MAX_PAGES entries.  If the incoming bio has more entries,
bio_add_page() will fail and a new bio will be allocated - the code that
handles bio_add_page() failure already exists in the dm-log-writes
target.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/md/dm-log-writes.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/md/dm-log-writes.c
+++ b/drivers/md/dm-log-writes.c
@@ -259,7 +259,7 @@ static int log_one_block(struct log_writ
 	sector++;
 
 	atomic_inc(&lc->io_blocks);
-	bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
+	bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
 	if (!bio) {
 		DMERR("Couldn't alloc log bio");
 		goto error;
@@ -280,7 +280,7 @@ static int log_one_block(struct log_writ
 		if (ret != block->vecs[i].bv_len) {
 			atomic_inc(&lc->io_blocks);
 			submit_bio(WRITE, bio);
-			bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
+			bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, BIO_MAX_PAGES));
 			if (!bio) {
 				DMERR("Couldn't alloc log bio");
 				goto error;

[toc] | [prev] | [next] | [standalone]

#1496474 — [PATCH 4.7 091/141] tracing: Have HIST_TRIGGERS select TRACING

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tom Zanussi <tom.zanussi@linux.intel.com>

commit 7ad8fb61c4abf589596f0a4da34d987471481569 upstream.

The kbuild test robot reported a compile error if HIST_TRIGGERS was
enabled but nothing else that selected TRACING was configured in.

HIST_TRIGGERS should directly select it and not rely on anything else
to do it.

Link: http://lkml.kernel.org/r/57791866.8080505@linux.intel.com

Reported-by: kbuild test robot <fennguang.wu@intel.com>
Fixes: 7ef224d1d0e3a ("tracing: Add 'hist' event trigger command")
Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/trace/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -542,6 +542,7 @@ config HIST_TRIGGERS
 	bool "Histogram triggers"
 	depends on ARCH_HAVE_NMI_SAFE_CMPXCHG
 	select TRACING_MAP
+	select TRACING
 	default n
 	help
 	  Hist triggers allow one or more arbitrary trace event fields

[toc] | [prev] | [next] | [standalone]

#1496477 — [PATCH 4.7 140/141] ALSA: hda - Fix headset mic detection problem for several Dell laptops

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Hui Wang <hui.wang@canonical.com>

commit 3f640970a41429f0a076c01270bbd014c9eae61c upstream.

One of the laptops has the codec ALC256 on it, applying the
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE can fix the problem, the rest
of laptops have the codec ALC295 on them, they are similar to machines
with ALC225, applying the ALC269_FIXUP_DELL1_MIC_NO_PRESENCE can fix
the problem.

Signed-off-by: Hui Wang <hui.wang@canonical.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 sound/pci/hda/patch_realtek.c |   13 +++++++++++++
 1 file changed, 13 insertions(+)

--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup alc2
 	{0x14, 0x90170110}, \
 	{0x15, 0x0221401f}
 
+#define ALC295_STANDARD_PINS \
+	{0x12, 0xb7a60130}, \
+	{0x14, 0x90170110}, \
+	{0x17, 0x21014020}, \
+	{0x18, 0x21a19030}, \
+	{0x21, 0x04211020}
+
 #define ALC298_STANDARD_PINS \
 	{0x12, 0x90a60130}, \
 	{0x21, 0x03211020}
@@ -5899,6 +5906,10 @@ static const struct snd_hda_pin_quirk al
 		{0x14, 0x90170120},
 		{0x21, 0x02211030}),
 	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+		{0x12, 0xb7a60130},
+		{0x14, 0x90170110},
+		{0x21, 0x02211020}),
+	SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC256_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
 		{0x12, 0x90a60130},
@@ -6009,6 +6020,8 @@ static const struct snd_hda_pin_quirk al
 	SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC292_STANDARD_PINS,
 		{0x13, 0x90a60140}),
+	SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+		ALC295_STANDARD_PINS),
 	SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
 		ALC298_STANDARD_PINS,
 		{0x17, 0x90170110}),

[toc] | [prev] | [next] | [standalone]

#1496483 — [PATCH 4.7 129/141] batman-adv: remove unused callback from batadv_algo_ops struct

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Lindner <mareklindner@neomailbox.ch>

commit d9f179877e50ae2681fe7b0b83e0d9f63b6165ad upstream.

Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/batman-adv/originator.c |    5 -----
 net/batman-adv/types.h      |    3 ---
 2 files changed, 8 deletions(-)

--- a/net/batman-adv/originator.c
+++ b/net/batman-adv/originator.c
@@ -251,10 +251,8 @@ static void batadv_neigh_node_release(st
 	struct hlist_node *node_tmp;
 	struct batadv_neigh_node *neigh_node;
 	struct batadv_neigh_ifinfo *neigh_ifinfo;
-	struct batadv_algo_ops *bao;
 
 	neigh_node = container_of(ref, struct batadv_neigh_node, refcount);
-	bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
 
 	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
 				  &neigh_node->ifinfo_list, list) {
@@ -263,9 +261,6 @@ static void batadv_neigh_node_release(st
 
 	batadv_hardif_neigh_put(neigh_node->hardif_neigh);
 
-	if (bao->bat_neigh_free)
-		bao->bat_neigh_free(neigh_node);
-
 	batadv_hardif_put(neigh_node->if_incoming);
 
 	kfree_rcu(neigh_node, rcu);
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -1284,8 +1284,6 @@ struct batadv_forw_packet {
  *  better than neigh2 for their respective outgoing interface from the metric
  *  prospective
  * @bat_neigh_print: print the single hop neighbor list (optional)
- * @bat_neigh_free: free the resources allocated by the routing algorithm for a
- *  neigh_node object
  * @bat_orig_print: print the originator table (optional)
  * @bat_orig_free: free the resources allocated by the routing algorithm for an
  *  orig_node object
@@ -1316,7 +1314,6 @@ struct batadv_algo_ops {
 		 struct batadv_neigh_node *neigh2,
 		 struct batadv_hard_iface *if_outgoing2);
 	void (*bat_neigh_print)(struct batadv_priv *priv, struct seq_file *seq);
-	void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
 	/* orig_node handling API */
 	void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
 			       struct batadv_hard_iface *hard_iface);

[toc] | [prev] | [next] | [standalone]

#1496489 — [PATCH 4.7 118/141] IB/ipoib: Fix memory corruption in ipoib cm mode connect flow

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Erez Shitrit <erezsh@mellanox.com>

commit 546481c2816ea3c061ee9d5658eb48070f69212e upstream.

When a new CM connection is being requested, ipoib driver copies data
from the path pointer in the CM/tx object, the path object might be
invalid at the point and memory corruption will happened later when now
the CM driver will try using that data.

The next scenario demonstrates it:
	neigh_add_path --> ipoib_cm_create_tx -->
	queue_work (pointer to path is in the cm/tx struct)
	#while the work is still in the queue,
	#the port goes down and causes the ipoib_flush_paths:
	ipoib_flush_paths --> path_free --> kfree(path)
	#at this point the work scheduled starts.
	ipoib_cm_tx_start --> copy from the (invalid)path pointer:
	(memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);)
	 -> memory corruption.

To fix that the driver now starts the CM/tx connection only if that
specific path exists in the general paths database.
This check is protected with the relevant locks, and uses the gid from
the neigh member in the CM/tx object which is valid according to the ref
count that was taken by the CM/tx.

Fixes: 839fcaba35 ('IPoIB: Connected mode experimental support')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/ulp/ipoib/ipoib.h      |    1 +
 drivers/infiniband/ulp/ipoib/ipoib_cm.c   |   16 ++++++++++++++++
 drivers/infiniband/ulp/ipoib/ipoib_main.c |    2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -478,6 +478,7 @@ void ipoib_send(struct net_device *dev,
 		struct ipoib_ah *address, u32 qpn);
 void ipoib_reap_ah(struct work_struct *work);
 
+struct ipoib_path *__path_find(struct net_device *dev, void *gid);
 void ipoib_mark_paths_invalid(struct net_device *dev);
 void ipoib_flush_paths(struct net_device *dev);
 int ipoib_check_sm_sendonly_fullmember_support(struct ipoib_dev_priv *priv);
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -1318,6 +1318,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm
 	}
 }
 
+#define QPN_AND_OPTIONS_OFFSET	4
+
 static void ipoib_cm_tx_start(struct work_struct *work)
 {
 	struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
@@ -1326,6 +1328,7 @@ static void ipoib_cm_tx_start(struct wor
 	struct ipoib_neigh *neigh;
 	struct ipoib_cm_tx *p;
 	unsigned long flags;
+	struct ipoib_path *path;
 	int ret;
 
 	struct ib_sa_path_rec pathrec;
@@ -1338,7 +1341,19 @@ static void ipoib_cm_tx_start(struct wor
 		p = list_entry(priv->cm.start_list.next, typeof(*p), list);
 		list_del_init(&p->list);
 		neigh = p->neigh;
+
 		qpn = IPOIB_QPN(neigh->daddr);
+		/*
+		 * As long as the search is with these 2 locks,
+		 * path existence indicates its validity.
+		 */
+		path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+		if (!path) {
+			pr_info("%s ignore not valid path %pI6\n",
+				__func__,
+				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
+			goto free_neigh;
+		}
 		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
 
 		spin_unlock_irqrestore(&priv->lock, flags);
@@ -1350,6 +1365,7 @@ static void ipoib_cm_tx_start(struct wor
 		spin_lock_irqsave(&priv->lock, flags);
 
 		if (ret) {
+free_neigh:
 			neigh = p->neigh;
 			if (neigh) {
 				neigh->cm = NULL;
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -485,7 +485,7 @@ int ipoib_set_mode(struct net_device *de
 	return -EINVAL;
 }
 
-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+struct ipoib_path *__path_find(struct net_device *dev, void *gid)
 {
 	struct ipoib_dev_priv *priv = netdev_priv(dev);
 	struct rb_node *n = priv->path_tree.rb_node;

[toc] | [prev] | [next] | [standalone]

#1496500 — [PATCH 4.7 086/141] mailbox: mailbox-test: set tdev->signal to NULL after freeing

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sudeep Holla <sudeep.holla@arm.com>

commit 9ef3c5112139cc5c5666ee096e05bc1e00e94015 upstream.

tdev->signal is not set NULL after it's freed. This will cause random
exceptions when the stale pointer is accessed after tdev->signal is
freed. Also, since tdev->signal allocation is skipped the next time
it's written, this leads to continuous fault finally leading to the
total death of the system.

Fixes: d1c2f87c9a8f ("mailbox: mailbox-test: Prevent memory leak")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Acked-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mailbox/mailbox-test.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -133,6 +133,7 @@ static ssize_t mbox_test_message_write(s
 out:
 	kfree(tdev->signal);
 	kfree(tdev->message);
+	tdev->signal = NULL;
 
 	return ret < 0 ? ret : count;
 }

[toc] | [prev] | [next] | [standalone]

#1496503 — [PATCH 4.7 120/141] IB/core: Fix use after free in send_leave function

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Erez Shitrit <erezsh@mellanox.com>

commit 68c6bcdd8bd00394c234b915ab9b97c74104130c upstream.

The function send_leave sets the member: group->query_id
(group->query_id = ret) after calling the sa_query, but leave_handler
can be executed before the setting and it might delete the group object,
and will get a memory corruption.

Additionally, this patch gets rid of group->query_id variable which is
not used.

Fixes: faec2f7b96b5 ('IB/sa: Track multicast join/leave requests')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/multicast.c |   13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

--- a/drivers/infiniband/core/multicast.c
+++ b/drivers/infiniband/core/multicast.c
@@ -118,7 +118,6 @@ struct mcast_group {
 	atomic_t		refcount;
 	enum mcast_group_state	state;
 	struct ib_sa_query	*query;
-	int			query_id;
 	u16			pkey_index;
 	u8			leave_state;
 	int			retries;
@@ -352,11 +351,7 @@ static int send_join(struct mcast_group
 				       member->multicast.comp_mask,
 				       3000, GFP_KERNEL, join_handler, group,
 				       &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static int send_leave(struct mcast_group *group, u8 leave_state)
@@ -376,11 +371,7 @@ static int send_leave(struct mcast_group
 				       IB_SA_MCMEMBER_REC_JOIN_STATE,
 				       3000, GFP_KERNEL, leave_handler,
 				       group, &group->query);
-	if (ret >= 0) {
-		group->query_id = ret;
-		ret = 0;
-	}
-	return ret;
+	return (ret > 0) ? 0 : ret;
 }
 
 static void join_group(struct mcast_group *group, struct mcast_member *member,

[toc] | [prev] | [next] | [standalone]

#1496508 — [PATCH 4.7 119/141] ath10k: fix get rx_status from htt context

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>

commit 237e15dfd5d651868726111c3a9d828bec700490 upstream.

On handling amsdu on rx path, get the rx_status from htt context. Without this
fix, we are seeing warnings when running DBDC traffic like this.

WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:4105 ieee80211_rx_napi+0x88/0x7d8 [mac80211]()

[ 1715.878248] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 3.18.21 #1
[ 1715.878273] [<c001d3f4>] (unwind_backtrace) from [<c001a4b0>] (show_stack+0x10/0x14)
[ 1715.878293] [<c001a4b0>] (show_stack) from [<c01bee64>] (dump_stack+0x70/0xbc)
[ 1715.878315] [<c01bee64>] (dump_stack) from [<c002a61c>] (warn_slowpath_common+0x64/0x88)
[ 1715.878339] [<c002a61c>] (warn_slowpath_common) from [<c002a6d0>] (warn_slowpath_null+0x18/0x20)
[ 1715.878395] [<c002a6d0>] (warn_slowpath_null) from [<bf4caa98>] (ieee80211_rx_napi+0x88/0x7d8 [mac80211])
[ 1715.878474] [<bf4caa98>] (ieee80211_rx_napi [mac80211]) from [<bf568658>] (ath10k_htt_t2h_msg_handler+0xb48/0xbfc [ath10k_core])
[ 1715.878535] [<bf568658>] (ath10k_htt_t2h_msg_handler [ath10k_core]) from [<bf568708>] (ath10k_htt_t2h_msg_handler+0xbf8/0xbfc [ath10k_core])
[ 1715.878597] [<bf568708>] (ath10k_htt_t2h_msg_handler [ath10k_core]) from [<bf569160>] (ath10k_htt_txrx_compl_task+0xa54/0x1170 [ath10k_core])
[ 1715.878639] [<bf569160>] (ath10k_htt_txrx_compl_task [ath10k_core]) from [<c002db14>] (tasklet_action+0xb4/0x130)
[ 1715.878659] [<c002db14>] (tasklet_action) from [<c002d110>] (__do_softirq+0xe0/0x210)
[ 1715.878678] [<c002d110>] (__do_softirq) from [<c002d4b4>] (irq_exit+0x84/0xe0)
[ 1715.878700] [<c002d4b4>] (irq_exit) from [<c005a544>] (__handle_domain_irq+0x98/0xd0)
[ 1715.878722] [<c005a544>] (__handle_domain_irq) from [<c00085f4>] (gic_handle_irq+0x38/0x5c)
[ 1715.878741] [<c00085f4>] (gic_handle_irq) from [<c0009680>] (__irq_svc+0x40/0x74)
[ 1715.878753] Exception stack(0xc05f9f50 to 0xc05f9f98)
[ 1715.878767] 9f40: ffffffed 00000000 00399e1e c000a220
[ 1715.878786] 9f60: 00000000 c05f6780 c05f8000 00000000 c05f5db8 ffffffed c05f8000 c04d1980
[ 1715.878802] 9f80: 00000000 c05f9f98 c0018110 c0018114 60000013 ffffffff
[ 1715.878822] [<c0009680>] (__irq_svc) from [<c0018114>] (arch_cpu_idle+0x2c/0x50)
[ 1715.878844] [<c0018114>] (arch_cpu_idle) from [<c00530d4>] (cpu_startup_entry+0x108/0x234)
[ 1715.878866] [<c00530d4>] (cpu_startup_entry) from [<c05c7be0>] (start_kernel+0x33c/0x3b8)
[ 1715.878879] ---[ end trace 6d5e1cc0fef8ed6a ]---
[ 1715.878899] ------------[ cut here ]------------

Fixes: 18235664e7f9 ("ath10k: cleanup amsdu processing for rx indication")
Signed-off-by: Ashok Raj Nagarajan <arnagara@qti.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/ath/ath10k/htt_rx.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -1524,7 +1524,7 @@ static void ath10k_htt_rx_h_filter(struc
 static int ath10k_htt_rx_handle_amsdu(struct ath10k_htt *htt)
 {
 	struct ath10k *ar = htt->ar;
-	static struct ieee80211_rx_status rx_status;
+	struct ieee80211_rx_status *rx_status = &htt->rx_status;
 	struct sk_buff_head amsdu;
 	int ret;
 
@@ -1548,11 +1548,11 @@ static int ath10k_htt_rx_handle_amsdu(st
 		return ret;
 	}
 
-	ath10k_htt_rx_h_ppdu(ar, &amsdu, &rx_status, 0xffff);
+	ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff);
 	ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0);
-	ath10k_htt_rx_h_filter(ar, &amsdu, &rx_status);
-	ath10k_htt_rx_h_mpdu(ar, &amsdu, &rx_status);
-	ath10k_htt_rx_h_deliver(ar, &amsdu, &rx_status);
+	ath10k_htt_rx_h_filter(ar, &amsdu, rx_status);
+	ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status);
+	ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status);
 
 	return 0;
 }

[toc] | [prev] | [next] | [standalone]

#1496512 — [PATCH 4.7 113/141] pNFS/flexfiles: Fix layoutstat periodic reporting

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 1c8d477a77e2d1d3504419e7f2e02e6422becf9a upstream.

Putting the periodicity timer in the mirror instances is causing
non-scalable reporting behaviour and missed reporting intervals.
When you recall layouts and/or implement client side mirroring, it
leads to consecutive reports with only a few ms between RPC calls.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Fixes: d0379a5d066a9 ("pNFS/flexfiles: Support server-supplied...")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/flexfilelayout/flexfilelayout.c |    8 ++++----
 fs/nfs/flexfilelayout/flexfilelayout.h |    2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

--- a/fs/nfs/flexfilelayout/flexfilelayout.c
+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
@@ -37,6 +37,7 @@ ff_layout_alloc_layout_hdr(struct inode
 	if (ffl) {
 		INIT_LIST_HEAD(&ffl->error_list);
 		INIT_LIST_HEAD(&ffl->mirrors);
+		ffl->last_report_time = ktime_get();
 		return &ffl->generic_hdr;
 	} else
 		return NULL;
@@ -640,19 +641,18 @@ nfs4_ff_layoutstat_start_io(struct nfs4_
 {
 	static const ktime_t notime = {0};
 	s64 report_interval = FF_LAYOUTSTATS_REPORT_INTERVAL;
+	struct nfs4_flexfile_layout *ffl = FF_LAYOUT_FROM_HDR(mirror->layout);
 
 	nfs4_ff_start_busy_timer(&layoutstat->busy_timer, now);
 	if (ktime_equal(mirror->start_time, notime))
 		mirror->start_time = now;
-	if (ktime_equal(mirror->last_report_time, notime))
-		mirror->last_report_time = now;
 	if (mirror->report_interval != 0)
 		report_interval = (s64)mirror->report_interval * 1000LL;
 	else if (layoutstats_timer != 0)
 		report_interval = (s64)layoutstats_timer * 1000LL;
-	if (ktime_to_ms(ktime_sub(now, mirror->last_report_time)) >=
+	if (ktime_to_ms(ktime_sub(now, ffl->last_report_time)) >=
 			report_interval) {
-		mirror->last_report_time = now;
+		ffl->last_report_time = now;
 		return true;
 	}
 
--- a/fs/nfs/flexfilelayout/flexfilelayout.h
+++ b/fs/nfs/flexfilelayout/flexfilelayout.h
@@ -84,7 +84,6 @@ struct nfs4_ff_layout_mirror {
 	struct nfs4_ff_layoutstat	read_stat;
 	struct nfs4_ff_layoutstat	write_stat;
 	ktime_t				start_time;
-	ktime_t				last_report_time;
 	u32				report_interval;
 };
 
@@ -101,6 +100,7 @@ struct nfs4_flexfile_layout {
 	struct pnfs_ds_commit_info commit_info;
 	struct list_head	mirrors;
 	struct list_head	error_list; /* nfs4_ff_layout_ds_err */
+	ktime_t			last_report_time; /* Layoutstat report times */
 };
 
 static inline struct nfs4_flexfile_layout *

[toc] | [prev] | [next] | [standalone]

#1496514 — [PATCH 4.7 117/141] ceph: do not modify fi->frag in need_reset_readdir()

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicolas Iooss <nicolas.iooss_linux@m4x.org>

commit 0f5aa88a7bb28b73253fb42b3df8202142769f39 upstream.

Commit f3c4ebe65ea1 ("ceph: using hash value to compose dentry offset")
modified "if (fpos_frag(new_pos) != fi->frag)" to "if (fi->frag |=
fpos_frag(new_pos))" in need_reset_readdir(), thus replacing a
comparison operator with an assignment one.

This looks like a typo which is reported by clang when building the
kernel with some warning flags:

    fs/ceph/dir.c:600:22: error: using the result of an assignment as a
    condition without parentheses [-Werror,-Wparentheses]
            } else if (fi->frag |= fpos_frag(new_pos)) {
                       ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~
    fs/ceph/dir.c:600:22: note: place parentheses around the assignment
    to silence this warning
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^
                       (                             )
    fs/ceph/dir.c:600:22: note: use '!=' to turn this compound
    assignment into an inequality comparison
            } else if (fi->frag |= fpos_frag(new_pos)) {
                                ^~
                                !=

Fixes: f3c4ebe65ea1 ("ceph: using hash value to compose dentry offset")
Signed-off-by: Nicolas Iooss <nicolas.iooss_linux@m4x.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ceph/dir.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -597,7 +597,7 @@ static bool need_reset_readdir(struct ce
 	if (is_hash_order(new_pos)) {
 		/* no need to reset last_name for a forward seek when
 		 * dentries are sotred in hash order */
-	} else if (fi->frag |= fpos_frag(new_pos)) {
+	} else if (fi->frag != fpos_frag(new_pos)) {
 		return true;
 	}
 	rinfo = fi->last_readdir ? &fi->last_readdir->r_reply_info : NULL;

[toc] | [prev] | [next] | [standalone]

#1496519 — [PATCH 4.7 114/141] lib/test_hash.c: fix warning in preprocessor symbol evaluation

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Geert Uytterhoeven <geert@linux-m68k.org>

commit e6173ba42bbdba05fd4f3021c0beda0506271507 upstream.

Some versions of gcc don't like tests for the value of an undefined
preprocessor symbol, even in the #else branch of an #ifndef:

    lib/test_hash.c:224:7: warning: "HAVE_ARCH__HASH_32" is not defined [-Wundef]
     #elif HAVE_ARCH__HASH_32 != 1
	   ^
    lib/test_hash.c:229:7: warning: "HAVE_ARCH_HASH_32" is not defined [-Wundef]
     #elif HAVE_ARCH_HASH_32 != 1
	   ^
    lib/test_hash.c:234:7: warning: "HAVE_ARCH_HASH_64" is not defined [-Wundef]
     #elif HAVE_ARCH_HASH_64 != 1
	   ^

Seen with gcc 4.9, not seen with 4.1.2.

Change the logic to only check the value inside an #ifdef to fix this.

Fixes: 468a9428521e7d00 ("<linux/hash.h>: Add support for architecture-specific functions")
Link: http://lkml.kernel.org/r/20160829214952.1334674-4-arnd@arndb.de
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: George Spelvin <linux@sciencehorizons.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 lib/test_hash.c |   24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

--- a/lib/test_hash.c
+++ b/lib/test_hash.c
@@ -219,21 +219,27 @@ test_hash_init(void)
 	}
 
 	/* Issue notices about skipped tests. */
-#ifndef HAVE_ARCH__HASH_32
-	pr_info("__hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH__HASH_32 != 1
+#ifdef HAVE_ARCH__HASH_32
+#if HAVE_ARCH__HASH_32 != 1
 	pr_info("__hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_32
-	pr_info("hash_32() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_32 != 1
+#else
+	pr_info("__hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_32
+#if HAVE_ARCH_HASH_32 != 1
 	pr_info("hash_32() is arch-specific; not compared to generic.");
 #endif
-#ifndef HAVE_ARCH_HASH_64
-	pr_info("hash_64() has no arch implementation to test.");
-#elif HAVE_ARCH_HASH_64 != 1
+#else
+	pr_info("hash_32() has no arch implementation to test.");
+#endif
+#ifdef HAVE_ARCH_HASH_64
+#if HAVE_ARCH_HASH_64 != 1
 	pr_info("hash_64() is arch-specific; not compared to generic.");
 #endif
+#else
+	pr_info("hash_64() has no arch implementation to test.");
+#endif
 
 	pr_notice("%u tests passed.", tests);
 

[toc] | [prev] | [next] | [standalone]

#1496522 — [PATCH 4.7 105/141] brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Florian Fainelli <f.fainelli@gmail.com>

commit f823a2aa8f4674c095a5413b9e3ba12d82df06f2 upstream.

wlc_phy_txpower_get_current() does a logical OR of power->flags, which
presumes that power.flags was initiliazed earlier by the caller,
unfortunately, this is not the case, so make sure we zero out the struct
tx_power before calling into wlc_phy_txpower_get_current().

Reported-by: coverity (CID 146011)
Fixes: 5b435de0d7868 ("net: wireless: add brcm80211 drivers")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/stf.c
@@ -87,7 +87,7 @@ void
 brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 *ss_algo_channel,
 			    u16 chanspec)
 {
-	struct tx_power power;
+	struct tx_power power = { };
 	u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
 
 	/* Clear previous settings */

[toc] | [prev] | [next] | [standalone]

#1496525 — [PATCH 4.7 108/141] sysctl: handle error writing UINT_MAX to u32 fields

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>

commit e7d316a02f683864a12389f8808570e37fb90aa3 upstream.

We have scripts which write to certain fields on 3.18 kernels but this
seems to be failing on 4.4 kernels.  An entry which we write to here is
xfrm_aevent_rseqth which is u32.

  echo 4294967295  > /proc/sys/net/core/xfrm_aevent_rseqth

Commit 230633d109e3 ("kernel/sysctl.c: detect overflows when converting
to int") prevented writing to sysctl entries when integer overflow
occurs.  However, this does not apply to unsigned integers.

Heinrich suggested that we introduce a new option to handle 64 bit
limits and set min as 0 and max as UINT_MAX.  This might not work as it
leads to issues similar to __do_proc_doulongvec_minmax.  Alternatively,
we would need to change the datatype of the entry to 64 bit.

  static int __do_proc_doulongvec_minmax(void *data, struct ctl_table
  {
      i = (unsigned long *) data;   //This cast is causing to read beyond the size of data (u32)
      vleft = table->maxlen / sizeof(unsigned long); //vleft is 0 because maxlen is sizeof(u32) which is lesser than sizeof(unsigned long) on x86_64.

Introduce a new proc handler proc_douintvec.  Individual proc entries
will need to be updated to use the new handler.

[akpm@linux-foundation.org: coding-style fixes]
Fixes: 230633d109e3 ("kernel/sysctl.c:detect overflows when converting to int")
Link: http://lkml.kernel.org/r/1471479806-5252-1-git-send-email-subashab@codeaurora.org
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
Cc: Heinrich Schuchardt <xypron.glpk@gmx.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Ingo Molnar <mingo@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/sysctl.h |    2 ++
 kernel/sysctl.c        |   45 +++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 45 insertions(+), 2 deletions(-)

--- a/include/linux/sysctl.h
+++ b/include/linux/sysctl.h
@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_tabl
 			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
 			 void __user *, size_t *, loff_t *);
+extern int proc_douintvec(struct ctl_table *, int,
+			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
 				void __user *, size_t *, loff_t *);
 extern int proc_dointvec_jiffies(struct ctl_table *, int,
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2122,6 +2122,21 @@ static int do_proc_dointvec_conv(bool *n
 	return 0;
 }
 
+static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
+				 int *valp,
+				 int write, void *data)
+{
+	if (write) {
+		if (*negp)
+			return -EINVAL;
+		*valp = *lvalp;
+	} else {
+		unsigned int val = *valp;
+		*lvalp = (unsigned long)val;
+	}
+	return 0;
+}
+
 static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
 
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
@@ -2241,8 +2256,27 @@ static int do_proc_dointvec(struct ctl_t
 int proc_dointvec(struct ctl_table *table, int write,
 		     void __user *buffer, size_t *lenp, loff_t *ppos)
 {
-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
-		    	    NULL,NULL);
+	return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
+}
+
+/**
+ * proc_douintvec - read a vector of unsigned integers
+ * @table: the sysctl table
+ * @write: %TRUE if this is a write to the sysctl file
+ * @buffer: the user buffer
+ * @lenp: the size of the user buffer
+ * @ppos: file position
+ *
+ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
+ * values from/to the user buffer, treated as an ASCII string.
+ *
+ * Returns 0 on success.
+ */
+int proc_douintvec(struct ctl_table *table, int write,
+		     void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	return do_proc_dointvec(table, write, buffer, lenp, ppos,
+				do_proc_douintvec_conv, NULL);
 }
 
 /*
@@ -2840,6 +2874,12 @@ int proc_dointvec(struct ctl_table *tabl
 	return -ENOSYS;
 }
 
+int proc_douintvec(struct ctl_table *table, int write,
+		  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	return -ENOSYS;
+}
+
 int proc_dointvec_minmax(struct ctl_table *table, int write,
 		    void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -2885,6 +2925,7 @@ int proc_doulongvec_ms_jiffies_minmax(st
  * exception granted :-)
  */
 EXPORT_SYMBOL(proc_dointvec);
+EXPORT_SYMBOL(proc_douintvec);
 EXPORT_SYMBOL(proc_dointvec_jiffies);
 EXPORT_SYMBOL(proc_dointvec_minmax);
 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);

[toc] | [prev] | [next] | [standalone]

Page 5 of 6 — ← Prev page 1 2 3 4 [5] 6  Next page →

Back to top | Article view | linux.kernel

csiph-web