Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1644330 > unrolled thread

[PATCH 4.10 00/93] 4.10.17-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.10 00/93] 4.10.17-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 22/93] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 34/93] crypto: ccp - Disable interrupts early on unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 30/93] block: fix blk_integrity_register to use templates interval_exp if not 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 03/93] target/fileio: Fix zero-length READ and WRITE handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 54/93] orangefs: fix bounds check for listxattr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 62/93] Fix match_prepath() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 21/93] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 56/93] orangefs: do not set getattr_time on orangefs_lookup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 57/93] orangefs: do not check possibly stale size on truncate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 02/93] target: Fix compare_and_write_callback handling for non GOOD status Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 07/93] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 08/93] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 59/93] ceph: fix memory leak in __ceph_setxattr() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 43/93] IB/core: Fix sysfs registration error flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 26/93] perf/x86: Fix Broadwell-EP DRAM RAPL events Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 44/93] IB/core: For multicast functions, verify that LIDs are multicast LIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 13:50 +0200
    [PATCH 4.10 11/93] staging: vt6656: use off stack for out buffer USB transfers. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
    [PATCH 4.10 18/93] usb: Make sure usb/phy/of gets built-in Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
    [PATCH 4.10 01/93] xen: adjust early dom0 p2m handling to xen hypervisor behavior Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
    [PATCH 4.10 12/93] staging: gdm724x: gdm_mux: fix use-after-free on module unload Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
    [PATCH 4.10 14/93] staging: comedi: jr3_pci: fix possible null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-18 14:00 +0200
    Re: [PATCH 4.10 00/93] 4.10.17-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-18 19:40 +0200
    Re: [PATCH 4.10 00/93] 4.10.17-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-19 03:20 +0200

Page 1 of 2  [1] 2  Next page →

#1644330 — [PATCH 4.10 00/93] 4.10.17-stable review

This is the start of the stable review cycle for the 4.10.17 release.
There are 93 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat May 20 10:47:19 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.10.17-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 4.10.17-rc1

Kees Cook <keescook@chromium.org>
    pstore: Shut down worker when unregistering

Ankit Kumar <ankit@linux.vnet.ibm.com>
    pstore: Fix flags to enable dumps on powerpc

Dan Williams <dan.j.williams@intel.com>
    libnvdimm, pfn: fix 'npfns' vs section alignment

Dan Williams <dan.j.williams@intel.com>
    libnvdimm: fix nvdimm_bus_lock() vs device_lock() ordering

Toshi Kani <toshi.kani@hpe.com>
    libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify

Dan Williams <dan.j.williams@intel.com>
    libnvdimm, region: fix flush hint detection crash

Joeseph Chang <joechang@codeaurora.org>
    ipmi: Fix kernel panic at ipmi_ssif_thread()

Johan Hovold <johan@kernel.org>
    Bluetooth: hci_intel: add missing tty-device sanity check

Johan Hovold <johan@kernel.org>
    Bluetooth: hci_bcm: add missing tty-device sanity check

Szymon Janc <szymon.janc@codecoup.pl>
    Bluetooth: Fix user channel for 32bit userspace on 64bit kernel

Wang YanQing <udknight@gmail.com>
    tty: pty: Fix ldisc flush after userspace become aware of the data already

Johan Hovold <johan@kernel.org>
    serial: omap: suspend device on probe errors

Johan Hovold <johan@kernel.org>
    serial: omap: fix runtime-pm handling on unbind

Marek Szyprowski <m.szyprowski@samsung.com>
    serial: samsung: Use right device for DMA-mapping calls

Eric Biggers <ebiggers@google.com>
    fscrypt: fix context consistency check when key(s) unavailable

Jaegeuk Kim <jaegeuk@kernel.org>
    f2fs: fix fs corruption due to zero inode page

Jan Kara <jack@suse.cz>
    mm: fix data corruption due to stale mmap reads

Ross Zwisler <ross.zwisler@linux.intel.com>
    dax: prevent invalidation of mapped DAX entries

Dan Williams <dan.j.williams@intel.com>
    device-dax: fix sysfs attribute deadlock

Dan Williams <dan.j.williams@intel.com>
    device-dax: fix cdev leak

NeilBrown <neilb@suse.com>
    md/raid1: avoid reusing a resync bio after error handling.

Jason A. Donenfeld <Jason@zx2c4.com>
    padata: free correct variable

Amir Goldstein <amir73il@gmail.com>
    ovl: do not set overlay.opaque on non-dir create

Björn Jacke <bj@sernet.de>
    CIFS: add misssing SFM mapping for doublequote

David Disseldorp <ddiss@suse.de>
    cifs: fix CIFS_IOC_GET_MNT_INFO oops

Rabin Vincent <rabinv@axis.com>
    CIFS: fix oplock break deadlocks

David Disseldorp <ddiss@suse.de>
    cifs: fix CIFS_ENUMERATE_SNAPSHOTS oops

David Disseldorp <ddiss@suse.de>
    cifs: fix leak in FSCTL_ENUM_SNAPS response handling

Björn Jacke <bj@sernet.de>
    CIFS: fix mapping of SFM_SPACE and SFM_PERIOD

Steve French <smfrench@gmail.com>
    SMB3: Work around mount failure when using SMB3 dialect to Macs

Steve French <smfrench@gmail.com>
    Set unicode flag on cifs echo request to avoid Mac error

Sachin Prabhu <sprabhu@redhat.com>
    Fix match_prepath()

Vlastimil Babka <vbabka@suse.cz>
    mm: prevent potential recursive reclaim due to clearing PF_MEMALLOC

Andrey Ryabinin <aryabinin@virtuozzo.com>
    fs/block_dev: always invalidate cleancache in invalidate_bdev()

Luis Henriques <lhenriques@suse.com>
    ceph: fix memory leak in __ceph_setxattr()

Michal Hocko <mhocko@suse.com>
    fs/xattr.c: zero out memory copied to userspace in getxattr

Martin Brandenburg <martin@omnibond.com>
    orangefs: do not check possibly stale size on truncate

Martin Brandenburg <martin@omnibond.com>
    orangefs: do not set getattr_time on orangefs_lookup

Martin Brandenburg <martin@omnibond.com>
    orangefs: clean up oversize xattr validation

Martin Brandenburg <martin@omnibond.com>
    orangefs: fix bounds check for listxattr

Eric Biggers <ebiggers@google.com>
    ext4: evict inline data when writing to memory map

Jan Kara <jack@suse.cz>
    jbd2: fix dbench4 performance regression for 'nobarrier' mounts

Christian Borntraeger <borntraeger@de.ibm.com>
    perf annotate s390: Implement jump types for perf annotate

Christian Borntraeger <borntraeger@de.ibm.com>
    perf annotate s390: Fix perf annotate error -95 (4.10 regression)

Adrian Hunter <adrian.hunter@intel.com>
    perf auxtrace: Fix no_size logic in addr_filter__resolve_kernel_syms()

Mike Marciniszyn <mike.marciniszyn@intel.com>
    IB/hfi1: Prevent kernel QP post send hard lockups

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/mlx4: Reduce SRIOV multicast cleanup warning message to debug level

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/mlx4: Fix ib device initialization error flow

Shamir Rabinovitch <shamir.rabinovitch@oracle.com>
    IB/IPoIB: ibX: failed to create mcg debug file

Michael J. Ruhl <michael.j.ruhl@intel.com>
    IB/core: For multicast functions, verify that LIDs are multicast LIDs

Jack Morgenstein <jackm@dev.mellanox.co.il>
    IB/core: Fix sysfs registration error flow

Ding Tianhong <dingtianhong@huawei.com>
    iov_iter: don't revert iov buffer if csum error

Alex Williamson <alex.williamson@redhat.com>
    vfio/type1: Remove locked page accounting workqueue

Dennis Yang <dennisyang@qnap.com>
    dm thin: fix a memory leak when passing discard bio down

Bart Van Assche <bart.vanassche@sandisk.com>
    dm rq: check blk_mq_register_dev() return value in dm_mq_init_request_queue()

Somasundaram Krishnasamy <somasundaram.krishnasamy@oracle.com>
    dm era: save spacemap metadata root after the pre-commit

Ondrej Kozina <okozina@redhat.com>
    dm crypt: rewrite (wipe) key in crypto layer using random data

Gary R Hook <gary.hook@amd.com>
    crypto: ccp - Change ISR handler method for a v5 CCP

Gary R Hook <gary.hook@amd.com>
    crypto: ccp - Change ISR handler method for a v3 CCP

Gary R Hook <ghook@amd.com>
    crypto: ccp - Disable interrupts early on unload

Gary R Hook <gary.hook@amd.com>
    crypto: ccp - Use only the relevant interrupt bits

Stephan Mueller <smueller@chronox.de>
    crypto: algif_aead - Require setkey before accept(2)

Krzysztof Kozlowski <krzk@kernel.org>
    crypto: s5p-sss - Close possible race for completed requests

Mike Snitzer <snitzer@redhat.com>
    block: fix blk_integrity_register to use template's interval_exp if not 0

Marc Zyngier <marc.zyngier@arm.com>
    arm64: KVM: Fix decoding of Rt/Rt2 when trapping AArch32 CP accesses

Andrew Jones <drjones@redhat.com>
    KVM: arm/arm64: fix races in kvm_psci_vcpu_on

David Hildenbrand <david@redhat.com>
    KVM: x86: fix user triggerable warning in kvm_apic_accept_events()

Vince Weaver <vincent.weaver@maine.edu>
    perf/x86: Fix Broadwell-EP DRAM RAPL events

Richard Weinberger <richard@nod.at>
    um: Fix PTRACE_POKEUSER on x86_64

Ben Hutchings <ben.hutchings@codethink.co.uk>
    x86, pmem: Fix cache flushing for iovec write < 8 bytes

Andy Lutomirski <luto@kernel.org>
    selftests/x86/ldt_gdt_32: Work around a glibc sigaction() bug

Ashish Kalra <ashish@bluestacks.com>
    x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup

Maksim Salau <maksim.salau@gmail.com>
    usb: misc: legousbtower: Fix buffers on stack

Guenter Roeck <linux@roeck-us.net>
    usb: hub: Do not attempt to autosuspend disconnected devices

Guenter Roeck <linux@roeck-us.net>
    usb: hub: Fix error loop seen after hub communication errors

Alexey Brodkin <Alexey.Brodkin@synopsys.com>
    usb: Make sure usb/phy/of gets built-in

Romain Izard <romain.izard.pro@gmail.com>
    usb: gadget: legacy gadgets are optional

Gustavo A. R. Silva <garsilva@embeddedor.com>
    usb: misc: add missing continue in switch

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: jr3_pci: cope with jiffies wraparound

Ian Abbott <abbotti@mev.co.uk>
    staging: comedi: jr3_pci: fix possible null pointer dereference

Aditya Shankar <aditya.shankar@microchip.com>
    staging: wilc1000: Fix problem with wrong vif index

Johan Hovold <johan@kernel.org>
    staging: gdm724x: gdm_mux: fix use-after-free on module unload

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6656: use off stack for out buffer USB transfers.

Malcolm Priestley <tvboxspy@gmail.com>
    staging: vt6656: use off stack for in buffer USB transfers.

Bjørn Mork <bjorn@mork.no>
    USB: Revert "cdc-wdm: fix "out-of-sync" due to missing notifications"

Ajay Kaher <ajay.kaher@samsung.com>
    USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously

Marek Vasut <marex@denx.de>
    USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit

Peter Chen <peter.chen@nxp.com>
    usb: host: xhci: print correct command ring address

Roger Quadros <rogerq@ti.com>
    usb: xhci: bInterval quirk for TI TUSB73x0

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Set session_fall_back_to_erl0 when forcing reinstatement

Bart Van Assche <bart.vanassche@sandisk.com>
    target/fileio: Fix zero-length READ and WRITE handling

Nicholas Bellinger <nab@linux-iscsi.org>
    target: Fix compare_and_write_callback handling for non GOOD status

Juergen Gross <jgross@suse.com>
    xen: adjust early dom0 p2m handling to xen hypervisor behavior


-------------

Diffstat:

 Makefile                                     |   4 +-
 arch/arm/kvm/psci.c                          |   8 +-
 arch/arm64/include/asm/kvm_emulate.h         |   6 +
 arch/arm64/kvm/sys_regs.c                    |   8 +-
 arch/powerpc/kernel/nvram_64.c               |   1 +
 arch/x86/boot/boot.h                         |   2 +-
 arch/x86/events/intel/rapl.c                 |   2 +-
 arch/x86/include/asm/pmem.h                  |   2 +-
 arch/x86/kvm/x86.c                           |  12 ++
 arch/x86/um/ptrace_64.c                      |   2 +-
 arch/x86/xen/mmu.c                           |   7 +-
 block/blk-integrity.c                        |   3 +-
 crypto/algif_aead.c                          | 157 +++++++++++++++++++++++++--
 drivers/Makefile                             |   1 +
 drivers/bluetooth/hci_bcm.c                  |   5 +-
 drivers/bluetooth/hci_intel.c                |  13 ++-
 drivers/char/ipmi/ipmi_ssif.c                |   4 +-
 drivers/crypto/ccp/ccp-dev-v3.c              | 120 +++++++++++---------
 drivers/crypto/ccp/ccp-dev-v5.c              | 114 +++++++++++--------
 drivers/crypto/ccp/ccp-dev.h                 |   8 +-
 drivers/crypto/ccp/ccp-pci.c                 |   2 +
 drivers/crypto/s5p-sss.c                     |   5 +-
 drivers/dax/dax.c                            |  55 ++++------
 drivers/infiniband/core/sysfs.c              |   2 +-
 drivers/infiniband/core/verbs.c              |   8 +-
 drivers/infiniband/hw/hfi1/ruc.c             |  26 +++--
 drivers/infiniband/hw/hfi1/verbs.c           |   4 +-
 drivers/infiniband/hw/hfi1/verbs.h           |   6 +-
 drivers/infiniband/hw/mlx4/main.c            |   1 +
 drivers/infiniband/hw/mlx4/mcg.c             |   3 +-
 drivers/infiniband/ulp/ipoib/ipoib_fs.c      |   3 +
 drivers/infiniband/ulp/ipoib/ipoib_main.c    |  44 +++++++-
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c    |   3 -
 drivers/md/dm-crypt.c                        |   8 +-
 drivers/md/dm-era-target.c                   |   8 +-
 drivers/md/dm-rq.c                           |   6 +-
 drivers/md/dm-thin.c                         |   1 +
 drivers/md/raid1.c                           |   2 +
 drivers/nvdimm/btt_devs.c                    |   2 +-
 drivers/nvdimm/claim.c                       |  23 ++--
 drivers/nvdimm/dax_devs.c                    |   2 +-
 drivers/nvdimm/pfn_devs.c                    |   8 +-
 drivers/nvdimm/pmem.c                        |  37 +++++--
 drivers/nvdimm/region_devs.c                 |  11 +-
 drivers/staging/comedi/drivers/jr3_pci.c     |  13 ++-
 drivers/staging/gdm724x/gdm_mux.c            |   3 +-
 drivers/staging/vt6656/usbpipe.c             |  31 +++++-
 drivers/staging/wilc1000/linux_wlan.c        |   3 +-
 drivers/target/iscsi/iscsi_target.c          |   1 +
 drivers/target/iscsi/iscsi_target_configfs.c |   1 +
 drivers/target/iscsi/iscsi_target_login.c    |   1 +
 drivers/target/target_core_file.c            |   3 +-
 drivers/target/target_core_sbc.c             |   5 +-
 drivers/tty/pty.c                            |   7 +-
 drivers/tty/serial/omap-serial.c             |   9 +-
 drivers/tty/serial/samsung.c                 |   9 +-
 drivers/usb/class/cdc-wdm.c                  | 103 +-----------------
 drivers/usb/core/driver.c                    |  21 ++++
 drivers/usb/core/file.c                      |   9 +-
 drivers/usb/core/hub.c                       |  11 +-
 drivers/usb/gadget/Kconfig                   |   1 +
 drivers/usb/host/xhci-mem.c                  |  13 ++-
 drivers/usb/host/xhci-pci.c                  |   3 +
 drivers/usb/host/xhci.h                      |   1 +
 drivers/usb/misc/legousbtower.c              |  37 +++++--
 drivers/usb/misc/usbtest.c                   |   1 +
 drivers/usb/serial/ftdi_sio.c                |   1 +
 drivers/usb/serial/ftdi_sio_ids.h            |   6 +
 drivers/vfio/vfio_iommu_type1.c              | 110 +++++++++----------
 fs/block_dev.c                               |  11 +-
 fs/ceph/xattr.c                              |   3 +
 fs/cifs/cifs_unicode.c                       |   6 +
 fs/cifs/cifs_unicode.h                       |   5 +-
 fs/cifs/cifsfs.c                             |  15 ++-
 fs/cifs/cifsglob.h                           |   1 +
 fs/cifs/cifssmb.c                            |   3 +
 fs/cifs/connect.c                            |  14 +--
 fs/cifs/ioctl.c                              |   4 +
 fs/cifs/misc.c                               |   2 +-
 fs/cifs/smb2misc.c                           |   5 +-
 fs/cifs/smb2ops.c                            |   1 +
 fs/cifs/smb2pdu.c                            |  14 ++-
 fs/crypto/policy.c                           |  87 +++++++++++----
 fs/dax.c                                     |  31 +-----
 fs/ext4/inode.c                              |   5 +
 fs/f2fs/inode.c                              |   2 +-
 fs/f2fs/namei.c                              |  20 ++--
 fs/jbd2/journal.c                            |   2 +-
 fs/orangefs/inode.c                          |   3 +-
 fs/orangefs/namei.c                          |   2 -
 fs/orangefs/xattr.c                          |  26 ++---
 fs/overlayfs/dir.c                           |   2 +-
 fs/pstore/platform.c                         |  10 +-
 fs/xattr.c                                   |   2 +-
 include/linux/dax.h                          |   1 -
 kernel/padata.c                              |   2 +-
 mm/page_alloc.c                              |   3 +-
 mm/truncate.c                                |  20 +++-
 net/bluetooth/hci_sock.c                     |   3 +-
 net/core/datagram.c                          |  13 ++-
 tools/perf/arch/s390/annotate/instructions.c |  30 +++++
 tools/perf/util/annotate.c                   |   8 ++
 tools/perf/util/auxtrace.c                   |   4 +-
 tools/testing/selftests/x86/ldt_gdt.c        |  46 ++++++++
 104 files changed, 1009 insertions(+), 549 deletions(-)

[toc] | [next] | [standalone]

#1644331 — [PATCH 4.10 22/93] x86/boot: Fix BSS corruption/overwrite bug in early x86 kernel startup

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ashish Kalra <ashish@bluestacks.com>

commit d594aa0277e541bb997aef0bc0a55172d8138340 upstream.

The minimum size for a new stack (512 bytes) setup for arch/x86/boot components
when the bootloader does not setup/provide a stack for the early boot components
is not "enough".

The setup code executing as part of early kernel startup code, uses the stack
beyond 512 bytes and accidentally overwrites and corrupts part of the BSS
section. This is exposed mostly in the early video setup code, where
it was corrupting BSS variables like force_x, force_y, which in-turn affected
kernel parameters such as screen_info (screen_info.orig_video_cols) and
later caused an exception/panic in console_init().

Most recent boot loaders setup the stack for early boot components, so this
stack overwriting into BSS section issue has not been exposed.

Signed-off-by: Ashish Kalra <ashish@bluestacks.com>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/20170419152015.10011-1-ashishkalra@Ashishs-MacBook-Pro.local
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/boot/boot.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -16,7 +16,7 @@
 #ifndef BOOT_BOOT_H
 #define BOOT_BOOT_H
 
-#define STACK_SIZE	512	/* Minimum number of bytes for stack */
+#define STACK_SIZE	1024	/* Minimum number of bytes for stack */
 
 #ifndef __ASSEMBLY__
 

[toc] | [prev] | [next] | [standalone]

#1644333 — [PATCH 4.10 34/93] crypto: ccp - Disable interrupts early on unload

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Gary R Hook <ghook@amd.com>

commit 116591fe3eef11c6f06b662c9176385f13891183 upstream.

Ensure that we disable interrupts first when shutting down
the driver.

Signed-off-by: Gary R Hook <ghook@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/crypto/ccp/ccp-dev-v5.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -888,10 +888,10 @@ static void ccp5_destroy(struct ccp_devi
 		iowrite32(cmd_q->qcontrol & ~CMD5_Q_RUN, cmd_q->reg_control);
 
 		/* Disable the interrupts */
-		iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status);
+		iowrite32(0x00, cmd_q->reg_int_enable);
 
 		/* Clear the interrupt status */
-		iowrite32(0x00, cmd_q->reg_int_enable);
+		iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status);
 		ioread32(cmd_q->reg_int_status);
 		ioread32(cmd_q->reg_status);
 	}

[toc] | [prev] | [next] | [standalone]

#1644334 — [PATCH 4.10 30/93] block: fix blk_integrity_register to use templates interval_exp if not 0

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mike Snitzer <snitzer@redhat.com>

commit 2859323e35ab5fc42f351fbda23ab544eaa85945 upstream.

When registering an integrity profile: if the template's interval_exp is
not 0 use it, otherwise use the ilog2() of logical block size of the
provided gendisk.

This fixes a long-standing DM linear target bug where it cannot pass
integrity data to the underlying device if its logical block size
conflicts with the underlying device's logical block size.

Reported-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 block/blk-integrity.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -412,7 +412,8 @@ void blk_integrity_register(struct gendi
 
 	bi->flags = BLK_INTEGRITY_VERIFY | BLK_INTEGRITY_GENERATE |
 		template->flags;
-	bi->interval_exp = ilog2(queue_logical_block_size(disk->queue));
+	bi->interval_exp = template->interval_exp ? :
+		ilog2(queue_logical_block_size(disk->queue));
 	bi->profile = template->profile ? template->profile : &nop_profile;
 	bi->tuple_size = template->tuple_size;
 	bi->tag_size = template->tag_size;

[toc] | [prev] | [next] | [standalone]

#1644335 — [PATCH 4.10 03/93] target/fileio: Fix zero-length READ and WRITE handling

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Bart Van Assche <bart.vanassche@sandisk.com>

commit 59ac9c078141b8fd0186c0b18660a1b2c24e724e upstream.

This patch fixes zero-length READ and WRITE handling in target/FILEIO,
which was broken a long time back by:

Since:

  commit d81cb44726f050d7cf1be4afd9cb45d153b52066
  Author: Paolo Bonzini <pbonzini@redhat.com>
  Date:   Mon Sep 17 16:36:11 2012 -0700

      target: go through normal processing for all zero-length commands

which moved zero-length READ and WRITE completion out of target-core,
to doing submission into backend driver code.

To address this, go ahead and invoke target_complete_cmd() for any
non negative return value in fd_do_rw().

Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Andy Grover <agrover@redhat.com>
Cc: David Disseldorp <ddiss@suse.de>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_file.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -595,8 +595,7 @@ fd_execute_rw(struct se_cmd *cmd, struct
 	if (ret < 0)
 		return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
-	if (ret)
-		target_complete_cmd(cmd, SAM_STAT_GOOD);
+	target_complete_cmd(cmd, SAM_STAT_GOOD);
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1644336 — [PATCH 4.10 54/93] orangefs: fix bounds check for listxattr

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Brandenburg <martin@omnibond.com>

commit a956af337b9ff25822d9ce1a59c6ed0c09fc14b9 upstream.

Signed-off-by: Martin Brandenburg <martin@omnibond.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/orangefs/xattr.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -358,7 +358,7 @@ try_again:
 
 	returned_count = new_op->downcall.resp.listxattr.returned_count;
 	if (returned_count < 0 ||
-	    returned_count >= ORANGEFS_MAX_XATTR_LISTLEN) {
+	    returned_count > ORANGEFS_MAX_XATTR_LISTLEN) {
 		gossip_err("%s: impossible value for returned_count:%d:\n",
 		__func__,
 		returned_count);

[toc] | [prev] | [next] | [standalone]

#1644337 — [PATCH 4.10 62/93] Fix match_prepath()

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Sachin Prabhu <sprabhu@redhat.com>

commit cd8c42968ee651b69e00f8661caff32b0086e82d upstream.

Incorrect return value for shares not using the prefix path means that
we will never match superblocks for these shares.

Fixes: commit c1d8b24d1819 ("Compare prepaths when comparing superblocks")
Signed-off-by: Sachin Prabhu <sprabhu@redhat.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/connect.c |   14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2879,16 +2879,14 @@ match_prepath(struct super_block *sb, st
 {
 	struct cifs_sb_info *old = CIFS_SB(sb);
 	struct cifs_sb_info *new = mnt_data->cifs_sb;
+	bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+	bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
 
-	if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) {
-		if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH))
-			return 0;
-		/* The prepath should be null terminated strings */
-		if (strcmp(new->prepath, old->prepath))
-			return 0;
-
+	if (old_set && new_set && !strcmp(new->prepath, old->prepath))
+		return 1;
+	else if (!old_set && !new_set)
 		return 1;
-	}
+
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1644338 — [PATCH 4.10 21/93] usb: misc: legousbtower: Fix buffers on stack

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Maksim Salau <maksim.salau@gmail.com>

commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream.

Allocate buffers on HEAP instead of STACK for local structures
that are to be received using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Tested-by: Alfredo Rafael Vicente Boix <alviboi@gmail.com>;
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/misc/legousbtower.c |   37 +++++++++++++++++++++++++++----------
 1 file changed, 27 insertions(+), 10 deletions(-)

--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -317,9 +317,16 @@ static int tower_open (struct inode *ino
 	int subminor;
 	int retval = 0;
 	struct usb_interface *interface;
-	struct tower_reset_reply reset_reply;
+	struct tower_reset_reply *reset_reply;
 	int result;
 
+	reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL);
+
+	if (!reset_reply) {
+		retval = -ENOMEM;
+		goto exit;
+	}
+
 	nonseekable_open(inode, file);
 	subminor = iminor(inode);
 
@@ -364,8 +371,8 @@ static int tower_open (struct inode *ino
 				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
 				  0,
 				  0,
-				  &reset_reply,
-				  sizeof(reset_reply),
+				  reset_reply,
+				  sizeof(*reset_reply),
 				  1000);
 	if (result < 0) {
 		dev_err(&dev->udev->dev,
@@ -406,6 +413,7 @@ unlock_exit:
 	mutex_unlock(&dev->lock);
 
 exit:
+	kfree(reset_reply);
 	return retval;
 }
 
@@ -808,7 +816,7 @@ static int tower_probe (struct usb_inter
 	struct lego_usb_tower *dev = NULL;
 	struct usb_host_interface *iface_desc;
 	struct usb_endpoint_descriptor* endpoint;
-	struct tower_get_version_reply get_version_reply;
+	struct tower_get_version_reply *get_version_reply = NULL;
 	int i;
 	int retval = -ENOMEM;
 	int result;
@@ -886,6 +894,13 @@ static int tower_probe (struct usb_inter
 	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
 	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
 
+	get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL);
+
+	if (!get_version_reply) {
+		retval = -ENOMEM;
+		goto error;
+	}
+
 	/* get the firmware version and log it */
 	result = usb_control_msg (udev,
 				  usb_rcvctrlpipe(udev, 0),
@@ -893,18 +908,19 @@ static int tower_probe (struct usb_inter
 				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,
 				  0,
 				  0,
-				  &get_version_reply,
-				  sizeof(get_version_reply),
+				  get_version_reply,
+				  sizeof(*get_version_reply),
 				  1000);
 	if (result < 0) {
 		dev_err(idev, "LEGO USB Tower get version control request failed\n");
 		retval = result;
 		goto error;
 	}
-	dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d "
-		 "build %d\n", get_version_reply.major,
-		 get_version_reply.minor,
-		 le16_to_cpu(get_version_reply.build_no));
+	dev_info(&interface->dev,
+		 "LEGO USB Tower firmware version is %d.%d build %d\n",
+		 get_version_reply->major,
+		 get_version_reply->minor,
+		 le16_to_cpu(get_version_reply->build_no));
 
 	/* we can register the device now, as it is ready */
 	usb_set_intfdata (interface, dev);
@@ -928,6 +944,7 @@ exit:
 	return retval;
 
 error:
+	kfree(get_version_reply);
 	tower_delete(dev);
 	return retval;
 }

[toc] | [prev] | [next] | [standalone]

#1644339 — [PATCH 4.10 56/93] orangefs: do not set getattr_time on orangefs_lookup

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Brandenburg <martin@omnibond.com>

commit 17930b252cd6f31163c259eaa99dd8aa630fb9ba upstream.

Since orangefs_lookup calls orangefs_iget which calls
orangefs_inode_getattr, getattr_time will get set.

Signed-off-by: Martin Brandenburg <martin@omnibond.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/orangefs/namei.c |    2 --
 1 file changed, 2 deletions(-)

--- a/fs/orangefs/namei.c
+++ b/fs/orangefs/namei.c
@@ -193,8 +193,6 @@ static struct dentry *orangefs_lookup(st
 		goto out;
 	}
 
-	ORANGEFS_I(inode)->getattr_time = jiffies - 1;
-
 	gossip_debug(GOSSIP_NAME_DEBUG,
 		     "%s:%s:%d "
 		     "Found good inode [%lu] with count [%d]\n",

[toc] | [prev] | [next] | [standalone]

#1644341 — [PATCH 4.10 57/93] orangefs: do not check possibly stale size on truncate

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Martin Brandenburg <martin@omnibond.com>

commit 53950ef541675df48c219a8d665111a0e68dfc2f upstream.

Let the server figure this out because our size might be out of date or
not present.

The bug was that

	xfs_io -f -t -c "pread -v 0 100" /mnt/foo
	echo "Test" > /mnt/foo
	xfs_io -f -t -c "pread -v 0 100" /mnt/foo

fails because the second truncate did not happen if nothing had
requested the size after the write in echo.  Thus i_size was zero (not
present) and the orangefs_setattr though i_size was zero and there was
nothing to do.

Signed-off-by: Martin Brandenburg <martin@omnibond.com>
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/orangefs/inode.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/fs/orangefs/inode.c
+++ b/fs/orangefs/inode.c
@@ -224,8 +224,7 @@ int orangefs_setattr(struct dentry *dent
 	if (ret)
 		goto out;
 
-	if ((iattr->ia_valid & ATTR_SIZE) &&
-	    iattr->ia_size != i_size_read(inode)) {
+	if (iattr->ia_valid & ATTR_SIZE) {
 		ret = orangefs_setattr_size(inode, iattr);
 		if (ret)
 			goto out;

[toc] | [prev] | [next] | [standalone]

#1644342 — [PATCH 4.10 02/93] target: Fix compare_and_write_callback handling for non GOOD status

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit a71a5dc7f833943998e97ca8fa6a4c708a0ed1a9 upstream.

Following the bugfix for handling non SAM_STAT_GOOD COMPARE_AND_WRITE
status during COMMIT phase in commit 9b2792c3da1, the same bug exists
for the READ phase as well.

This would manifest first as a lost SCSI response, and eventual
hung task during fabric driver logout or re-login, as existing
shutdown logic waited for the COMPARE_AND_WRITE se_cmd->cmd_kref
to reach zero.

To address this bug, compare_and_write_callback() has been changed
to set post_ret = 1 and return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE
as necessary to signal failure status.

Reported-by: Bill Borsari <wgb@datera.io>
Cc: Bill Borsari <wgb@datera.io>
Tested-by: Gary Guo <ghg@datera.io>
Cc: Gary Guo <ghg@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/target_core_sbc.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -507,8 +507,11 @@ static sense_reason_t compare_and_write_
 	 * been failed with a non-zero SCSI status.
 	 */
 	if (cmd->scsi_status) {
-		pr_err("compare_and_write_callback: non zero scsi_status:"
+		pr_debug("compare_and_write_callback: non zero scsi_status:"
 			" 0x%02x\n", cmd->scsi_status);
+		*post_ret = 1;
+		if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
+			ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 		goto out;
 	}
 

[toc] | [prev] | [next] | [standalone]

#1644343 — [PATCH 4.10 07/93] USB: serial: ftdi_sio: add device ID for Microsemi/Arrow SF2PLUS Dev Kit

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marek Vasut <marex@denx.de>

commit 31c5d1922b90ddc1da6a6ddecef7cd31f17aa32b upstream.

This development kit has an FT4232 on it with a custom USB VID/PID.
The FT4232 provides four UARTs, but only two are used. The UART 0
is used by the FlashPro5 programmer and UART 2 is connected to the
SmartFusion2 CortexM3 SoC UART port.

Note that the USB VID is registered to Actel according to Linux USB
VID database, but that was acquired by Microsemi.

Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/serial/ftdi_sio.c     |    1 +
 drivers/usb/serial/ftdi_sio_ids.h |    6 ++++++
 2 files changed, 7 insertions(+)

--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -873,6 +873,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
 					USB_CLASS_VENDOR_SPEC,
 					USB_SUBCLASS_VENDOR_SPEC, 0x00) },
+	{ USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) },
 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -873,6 +873,12 @@
 #define	FIC_VID			0x1457
 #define	FIC_NEO1973_DEBUG_PID	0x5118
 
+/*
+ * Actel / Microsemi
+ */
+#define ACTEL_VID				0x1514
+#define MICROSEMI_ARROW_SF2PLUS_BOARD_PID	0x2008
+
 /* Olimex */
 #define OLIMEX_VID			0x15BA
 #define OLIMEX_ARM_USB_OCD_PID		0x0003

[toc] | [prev] | [next] | [standalone]

#1644344 — [PATCH 4.10 08/93] USB: Proper handling of Race Condition when two USB class drivers try to call init_usb_class simultaneously

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ajay Kaher <ajay.kaher@samsung.com>

commit 2f86a96be0ccb1302b7eee7855dbee5ce4dc5dfb upstream.

There is race condition when two USB class drivers try to call
init_usb_class at the same time and leads to crash.
code path: probe->usb_register_dev->init_usb_class

To solve this, mutex locking has been added in init_usb_class() and
destroy_usb_class().

As pointed by Alan, removed "if (usb_class)" test from destroy_usb_class()
because usb_class can never be NULL there.

Signed-off-by: Ajay Kaher <ajay.kaher@samsung.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/core/file.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -29,6 +29,7 @@
 #define MAX_USB_MINORS	256
 static const struct file_operations *usb_minors[MAX_USB_MINORS];
 static DECLARE_RWSEM(minor_rwsem);
+static DEFINE_MUTEX(init_usb_class_mutex);
 
 static int usb_open(struct inode *inode, struct file *file)
 {
@@ -111,8 +112,9 @@ static void release_usb_class(struct kre
 
 static void destroy_usb_class(void)
 {
-	if (usb_class)
-		kref_put(&usb_class->kref, release_usb_class);
+	mutex_lock(&init_usb_class_mutex);
+	kref_put(&usb_class->kref, release_usb_class);
+	mutex_unlock(&init_usb_class_mutex);
 }
 
 int usb_major_init(void)
@@ -173,7 +175,10 @@ int usb_register_dev(struct usb_interfac
 	if (intf->minor >= 0)
 		return -EADDRINUSE;
 
+	mutex_lock(&init_usb_class_mutex);
 	retval = init_usb_class();
+	mutex_unlock(&init_usb_class_mutex);
+
 	if (retval)
 		return retval;
 

[toc] | [prev] | [next] | [standalone]

#1644345 — [PATCH 4.10 59/93] ceph: fix memory leak in __ceph_setxattr()

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Luis Henriques <lhenriques@suse.com>

commit eeca958dce0a9231d1969f86196653eb50fcc9b3 upstream.

The ceph_inode_xattr needs to be released when removing an xattr.  Easily
reproducible running the 'generic/020' test from xfstests or simply by
doing:

  attr -s attr0 -V 0 /mnt/test && attr -r attr0 /mnt/test

While there, also fix the error path.

Here's the kmemleak splat:

unreferenced object 0xffff88001f86fbc0 (size 64):
  comm "attr", pid 244, jiffies 4294904246 (age 98.464s)
  hex dump (first 32 bytes):
    40 fa 86 1f 00 88 ff ff 80 32 38 1f 00 88 ff ff  @........28.....
    00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de  ................
  backtrace:
    [<ffffffff81560199>] kmemleak_alloc+0x49/0xa0
    [<ffffffff810f3e5b>] kmem_cache_alloc+0x9b/0xf0
    [<ffffffff812b157e>] __ceph_setxattr+0x17e/0x820
    [<ffffffff812b1c57>] ceph_set_xattr_handler+0x37/0x40
    [<ffffffff8111fb4b>] __vfs_removexattr+0x4b/0x60
    [<ffffffff8111fd37>] vfs_removexattr+0x77/0xd0
    [<ffffffff8111fdd1>] removexattr+0x41/0x60
    [<ffffffff8111fe65>] path_removexattr+0x75/0xa0
    [<ffffffff81120aeb>] SyS_lremovexattr+0xb/0x10
    [<ffffffff81564b20>] entry_SYSCALL_64_fastpath+0x13/0x94
    [<ffffffffffffffff>] 0xffffffffffffffff

Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/ceph/xattr.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -392,6 +392,7 @@ static int __set_xattr(struct ceph_inode
 
 	if (update_xattr) {
 		int err = 0;
+
 		if (xattr && (flags & XATTR_CREATE))
 			err = -EEXIST;
 		else if (!xattr && (flags & XATTR_REPLACE))
@@ -399,12 +400,14 @@ static int __set_xattr(struct ceph_inode
 		if (err) {
 			kfree(name);
 			kfree(val);
+			kfree(*newxattr);
 			return err;
 		}
 		if (update_xattr < 0) {
 			if (xattr)
 				__remove_xattr(ci, xattr);
 			kfree(name);
+			kfree(*newxattr);
 			return 0;
 		}
 	}

[toc] | [prev] | [next] | [standalone]

#1644346 — [PATCH 4.10 43/93] IB/core: Fix sysfs registration error flow

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jack Morgenstein <jackm@dev.mellanox.co.il>

commit b312be3d87e4c80872cbea869e569175c5eb0f9a upstream.

The kernel commit cited below restructured ib device management
so that the device kobject is initialized in ib_alloc_device.

As part of the restructuring, the kobject is now initialized in
procedure ib_alloc_device, and is later added to the device hierarchy
in the ib_register_device call stack, in procedure
ib_device_register_sysfs (which calls device_add).

However, in the ib_device_register_sysfs error flow, if an error
occurs following the call to device_add, the cleanup procedure
device_unregister is called. This call results in the device object
being deleted -- which results in various use-after-free crashes.

The correct cleanup call is device_del -- which undoes device_add
without deleting the device object.

The device object will then (correctly) be deleted in the
ib_register_device caller's error cleanup flow, when the caller invokes
ib_dealloc_device.

Fixes: 55aeed06544f6 ("IB/core: Make ib_alloc_device init the kobject")
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/sysfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1301,7 +1301,7 @@ err_put:
 	free_port_list_attributes(device);
 
 err_unregister:
-	device_unregister(class_dev);
+	device_del(class_dev);
 
 err:
 	return ret;

[toc] | [prev] | [next] | [standalone]

#1644347 — [PATCH 4.10 26/93] perf/x86: Fix Broadwell-EP DRAM RAPL events

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Vince Weaver <vincent.weaver@maine.edu>

commit 33b88e708e7dfa58dc896da2a98f5719d2eb315c upstream.

It appears as though the Broadwell-EP DRAM units share the special
units quirk with Haswell-EP/KNL.

Without this patch, you get really high results (a single DRAM using 20W
of power).

The powercap driver in drivers/powercap/intel_rapl.c already has this
change.

Signed-off-by: Vince Weaver <vincent.weaver@maine.edu>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@gmail.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/intel/rapl.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -761,7 +761,7 @@ static const struct x86_cpu_id rapl_cpu_
 
 	X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_CORE,   hsw_rapl_init),
 	X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_GT3E,   hsw_rapl_init),
-	X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X,	  hsw_rapl_init),
+	X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X,	  hsx_rapl_init),
 	X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_XEON_D, hsw_rapl_init),
 
 	X86_RAPL_MODEL_MATCH(INTEL_FAM6_XEON_PHI_KNL, knl_rapl_init),

[toc] | [prev] | [next] | [standalone]

#1644348 — [PATCH 4.10 44/93] IB/core: For multicast functions, verify that LIDs are multicast LIDs

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael J. Ruhl <michael.j.ruhl@intel.com>

commit 8561eae60ff9417a50fa1fb2b83ae950dc5c1e21 upstream.

The Infiniband spec defines "A multicast address is defined by a
MGID and a MLID" (section 10.5).  Currently the MLID value is not
validated.

Add check to verify that the MLID value is in the correct address
range.

Fixes: 0c33aeedb2cf ("[IB] Add checks to multicast attach and detach")
Reviewed-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Dasaratharaman Chandramouli <dasaratharaman.chandramouli@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/core/verbs.c |    8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1520,7 +1520,9 @@ int ib_attach_mcast(struct ib_qp *qp, un
 
 	if (!qp->device->attach_mcast)
 		return -ENOSYS;
-	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD)
+	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
+	    lid < be16_to_cpu(IB_MULTICAST_LID_BASE) ||
+	    lid == be16_to_cpu(IB_LID_PERMISSIVE))
 		return -EINVAL;
 
 	ret = qp->device->attach_mcast(qp, gid, lid);
@@ -1536,7 +1538,9 @@ int ib_detach_mcast(struct ib_qp *qp, un
 
 	if (!qp->device->detach_mcast)
 		return -ENOSYS;
-	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD)
+	if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
+	    lid < be16_to_cpu(IB_MULTICAST_LID_BASE) ||
+	    lid == be16_to_cpu(IB_LID_PERMISSIVE))
 		return -EINVAL;
 
 	ret = qp->device->detach_mcast(qp, gid, lid);

[toc] | [prev] | [next] | [standalone]

#1644361 — [PATCH 4.10 11/93] staging: vt6656: use off stack for out buffer USB transfers.

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit 12ecd24ef93277e4e5feaf27b0b18f2d3828bc5e upstream.

Since 4.9 mandated USB buffers be heap allocated this causes the driver
to fail.

Since there is a wide range of buffer sizes use kmemdup to create
allocated buffer.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/vt6656/usbpipe.c |   14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

--- a/drivers/staging/vt6656/usbpipe.c
+++ b/drivers/staging/vt6656/usbpipe.c
@@ -47,15 +47,25 @@ int vnt_control_out(struct vnt_private *
 		u16 index, u16 length, u8 *buffer)
 {
 	int status = 0;
+	u8 *usb_buffer;
 
 	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))
 		return STATUS_FAILURE;
 
 	mutex_lock(&priv->usb_lock);
 
+	usb_buffer = kmemdup(buffer, length, GFP_KERNEL);
+	if (!usb_buffer) {
+		mutex_unlock(&priv->usb_lock);
+		return -ENOMEM;
+	}
+
 	status = usb_control_msg(priv->usb,
-		usb_sndctrlpipe(priv->usb, 0), request, 0x40, value,
-			index, buffer, length, USB_CTL_WAIT);
+				 usb_sndctrlpipe(priv->usb, 0),
+				 request, 0x40, value,
+				 index, usb_buffer, length, USB_CTL_WAIT);
+
+	kfree(usb_buffer);
 
 	mutex_unlock(&priv->usb_lock);
 

[toc] | [prev] | [next] | [standalone]

#1644362 — [PATCH 4.10 18/93] usb: Make sure usb/phy/of gets built-in

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>

commit 3d6159640da9c9175d1ca42f151fc1a14caded59 upstream.

DWC3 driver uses of_usb_get_phy_mode() which is
implemented in drivers/usb/phy/of.c and in bare minimal
configuration it might not be pulled in kernel binary.

In case of ARC or ARM this could be easily reproduced with
"allnodefconfig" +CONFIG_USB=m +CONFIG_USB_DWC3=m.

On building all ends-up with:
---------------------->8------------------
  Kernel: arch/arm/boot/Image is ready
  Kernel: arch/arm/boot/zImage is ready
  Building modules, stage 2.
  MODPOST 5 modules
ERROR: "of_usb_get_phy_mode" [drivers/usb/dwc3/dwc3.ko] undefined!
make[1]: *** [__modpost] Error 1
make: *** [modules] Error 2
---------------------->8------------------

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Cc: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: Nicolas Pitre <nicolas.pitre@linaro.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Felipe Balbi <balbi@kernel.org>
Cc: Felix Fietkau <nbd@nbd.name>
Cc: Jeremy Kerr <jk@ozlabs.org>
Cc: linux-snps-arc@lists.infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/Makefile |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -101,6 +101,7 @@ obj-$(CONFIG_USB_PHY)		+= usb/
 obj-$(CONFIG_USB)		+= usb/
 obj-$(CONFIG_PCI)		+= usb/
 obj-$(CONFIG_USB_GADGET)	+= usb/
+obj-$(CONFIG_OF)		+= usb/
 obj-$(CONFIG_SERIO)		+= input/serio/
 obj-$(CONFIG_GAMEPORT)		+= input/gameport/
 obj-$(CONFIG_INPUT)		+= input/

[toc] | [prev] | [next] | [standalone]

#1644371 — [PATCH 4.10 01/93] xen: adjust early dom0 p2m handling to xen hypervisor behavior

4.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Juergen Gross <jgross@suse.com>

commit 69861e0a52f8733355ce246f0db15e1b240ad667 upstream.

When booted as pv-guest the p2m list presented by the Xen is already
mapped to virtual addresses. In dom0 case the hypervisor might make use
of 2M- or 1G-pages for this mapping. Unfortunately while being properly
aligned in virtual and machine address space, those pages might not be
aligned properly in guest physical address space.

So when trying to obtain the guest physical address of such a page
pud_pfn() and pmd_pfn() must be avoided as those will mask away guest
physical address bits not being zero in this special case.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/xen/mmu.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2028,7 +2028,8 @@ static unsigned long __init xen_read_phy
 
 /*
  * Translate a virtual address to a physical one without relying on mapped
- * page tables.
+ * page tables. Don't rely on big pages being aligned in (guest) physical
+ * space!
  */
 static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
 {
@@ -2049,7 +2050,7 @@ static phys_addr_t __init xen_early_virt
 						       sizeof(pud)));
 	if (!pud_present(pud))
 		return 0;
-	pa = pud_pfn(pud) << PAGE_SHIFT;
+	pa = pud_val(pud) & PTE_PFN_MASK;
 	if (pud_large(pud))
 		return pa + (vaddr & ~PUD_MASK);
 
@@ -2057,7 +2058,7 @@ static phys_addr_t __init xen_early_virt
 						       sizeof(pmd)));
 	if (!pmd_present(pmd))
 		return 0;
-	pa = pmd_pfn(pmd) << PAGE_SHIFT;
+	pa = pmd_val(pmd) & PTE_PFN_MASK;
 	if (pmd_large(pmd))
 		return pa + (vaddr & ~PMD_MASK);
 

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.kernel

csiph-web