Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1648416 > unrolled thread

[PATCH 4.11 000/197] 4.11.3-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.11 000/197] 4.11.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 022/197] infiniband: call ipv6 route lookup via the stub interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 059/197] drm/nouveau/tmr: avoid processing completed alarms when adding a new one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 045/197] regulator: rk808: Fix RK818 LDO2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 075/197] IB/hfi1: Return an error on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 002/197] usb: misc: legousbtower: Fix memory leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 019/197] tpm: fix handling of the TPM 2.0 event logs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 080/197] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 109/197] iio: hid-sensor: Store restore poll and hysteresis on S3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 110/197] [media] cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 052/197] drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 007/197] tpm_tis_core: Choose appropriate timeout for reading burstcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 111/197] [media] s5p-mfc: Fix race between interrupt routine and device functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 082/197] Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 071/197] scsi: lpfc: Fix panic on BFS configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 034/197] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 117/197] [media] digitv: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 008/197] ALSA: hda: Fix cpu lockup when stopping the cmd dmas Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 087/197] xhci: remove GFP_DMA flag from allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 106/197] USB: hub: fix non-SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 105/197] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 115/197] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 036/197] md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 097/197] usb: dwc3: gadget: Prevent losing events in event cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 050/197] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 093/197] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 058/197] drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 027/197] dm mpath: requeue after a small delay if blk_get_request() fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 029/197] dm mpath: avoid that path removal can trigger an infinite loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 024/197] dm raid: select the Kconfig option CONFIG_MD_RAID0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 023/197] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 031/197] dm cache metadata: fail operations if fail_io mode has been established Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 092/197] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 001/197] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 020/197] ASoC: cs4271: configure reset GPIO as output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 124/197] powerpc/book3s/mce: Move add_taint() later in virtual mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 169/197] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 156/197] staging: rtl8192e: GetTs Fix invalid TID 7 warning. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 139/197] ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 184/197] mtd: nand: omap2: Fix partition creation via cmdline mtdparts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 155/197] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 164/197] nvme: unmap CMB and remove sysfs file in reset path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 144/197] arm64: xchg: hazard against entire exchange variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 142/197] ARM: dts: imx6sx-sdb: Remove OPP override Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 195/197] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 193/197] nfsd: encoders mustnt use unitialized values in error cases Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 133/197] arm: KVM: Do not use stack-protector to compile HYP code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 157/197] iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 138/197] ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 134/197] KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 181/197] PCI: Only allow WC mmap on prefetchable resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 130/197] powerpc/mm: Fix crash in page table dump with huge pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 188/197] NFS: Fix use after free in write error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 160/197] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 128/197] powerpc/powernv: Fix TCE kill on NVLink2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    Re: [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64() Linus Torvalds <torvalds@linux-foundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 146/197] arm64: armv8_deprecated: ensure extension of addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 196/197] drm/i915/gvt: Disable access to stolen memory as a guest Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 150/197] arm64: entry: improve data abort handling of tagged pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 173/197] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 174/197] thermal: mt8173: minor mtk_thermal.c cleanups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 185/197] mtd: nand: add ooblayout for old hamming layout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 137/197] ARM: 8662/1: module: split core and init PLT sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 187/197] NFSv4: Fix a hang in OPEN related to server reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 186/197] drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 129/197] powerpc/64e: Fix hang when debugging programs with relocated kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 172/197] firmware: ti_sci: fix strncat length check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 179/197] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 148/197] arm64: traps: fix userspace cache maintenance emulation on a tagged pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 158/197] cpuidle: check dev before usage in cpuidle_use_deepest_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 4.11 191/197] NFSv4: Fix an rcu lock leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 197/197] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 194/197] nfsd: Fix up the "supattr_exclcreat" attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 190/197] pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 165/197] MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 159/197] metag/uaccess: Fix access_ok() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 168/197] kvm: arm/arm64: Force reading uncached stage2 PGD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 192/197] nfsd: fix undefined behavior in nfsd4_layout_verify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 176/197] PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 120/197] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 178/197] PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 149/197] arm64: hw_breakpoint: fix watchpoint matching for tagged pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 183/197] mtd: nand: orion: fix clk handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 177/197] PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 180/197] PCI: Fix another sanity check bug in /proc/pci mmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 127/197] powerpc/iommu: Do not call PageTransHuge() on tail pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 152/197] staging: vc04_services: Fix bulk cache maintenance Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 162/197] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 153/197] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 151/197] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 170/197] drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 161/197] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 171/197] um: Fix to call read_initrd after init_bootmem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 175/197] PCI/ACPI: Tidy up MCFG quirk whitespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 189/197] NFS: Use GFP_NOIO for two allocations in writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 163/197] genirq: Fix chained interrupt data ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 154/197] staging: rtl8192e: fix 2 byte alignment of register BSSIDR. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 125/197] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 126/197] powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 145/197] arm64: ensure extension of smp_store_release value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 147/197] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 114/197] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 118/197] [media] dw2102: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 101/197] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 091/197] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 103/197] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 090/197] xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 086/197] xhci: Fix command ring stop regression in 4.11 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 108/197] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 141/197] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 135/197] KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 143/197] arm64: dts: hi6220: Reset the mmc hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 122/197] powerpc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 116/197] [media] dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 121/197] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 131/197] powerpc/tm: Fix FP and VMX register corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 123/197] powerpc/eeh: Avoid use after free in eeh_handle_special_event() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 104/197] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 119/197] [media] cx231xx-audio: fix init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 113/197] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 140/197] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 132/197] arm64: KVM: Do not use stack-protector to compile EL2 code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 072/197] iio: dac: ad7303: fix channel description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 061/197] gpio: omap: return error if requested debounce time is not possible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 076/197] IB/hfi1: Fix a subcontext memory leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 014/197] tpm_tis_spi: Add small delay after last transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 073/197] IIO: bmp280-core.c: fix error in humidity calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 021/197] mlx5: Fix mlx5_ib_map_mr_sg mr length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 054/197] drm/nouveau/therm: remove ineffective workarounds for alarm bugs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 096/197] [media] dvb-usb-dibusb-mc-common: Add MODULE_LICENSE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 047/197] s390/kdump: Add final note Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 081/197] USB: chaoskey: fix Alea quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 074/197] iio: stm32 trigger: fix sampling_frequency read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 100/197] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 064/197] cxl: Force context lock during EEH flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 083/197] libnvdimm: fix clear length of nvdimm_forget_poison() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 057/197] drm/nouveau/tmr: ack interrupt before processing alarms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 095/197] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 048/197] s390/cputime: fix incorrect system time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 078/197] pid_ns: Fix race between setnsed fork() and zap_pid_ns_processes() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 070/197] ibmvscsis: Do not send aborted task response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 067/197] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 062/197] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 039/197] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 055/197] drm/nouveau/kms/nv50: fix source-rect-only plane updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 018/197] vTPM: Fix missing NULL check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 060/197] drm/nouveau/tmr: handle races with hw when updating the next alarm time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 051/197] drm/amdgpu: Make display watermark calculations more accurate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 009/197] fanotify: dont expose EOPENSTALE to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 025/197] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 003/197] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 012/197] tpm_tis_spi: Check correct byte for wait state indicator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 006/197] USB: core: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 013/197] tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 033/197] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 026/197] dm bufio: check new buffer allocation watermark every 30 seconds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 028/197] dm mpath: split and rename activate_path() to prepare for its expanded use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 037/197] rtlwifi: rtl8821ae: setup 8812ae RFE according to device type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 015/197] tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 035/197] md: update slab_cache before releasing new stripes when stripes resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 030/197] dm mpath: delay requeuing while path initialization is in progress Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 005/197] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    Re: [PATCH 4.11 000/197] 4.11.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 19:00 +0200

Page 3 of 9 — ← Prev page 1 2 [3] 4 5 6 7 8 9  Next page →

#1648467 — [PATCH 4.11 155/197] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD.

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Malcolm Priestley <tvboxspy@gmail.com>

commit 90be652c9f157d44b9c2803f902a8839796c090d upstream.

EPROM_CMD is 2 byte aligned on PCI map so calling with rtl92e_readl
will return invalid data so use rtl92e_readw.

The device is unable to select the right eeprom type.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -627,7 +627,7 @@ void rtl92e_get_eeprom_size(struct net_d
 	struct r8192_priv *priv = rtllib_priv(dev);
 
 	RT_TRACE(COMP_INIT, "===========>%s()\n", __func__);
-	curCR = rtl92e_readl(dev, EPROM_CMD);
+	curCR = rtl92e_readw(dev, EPROM_CMD);
 	RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD,
 		 curCR);
 	priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 :

[toc] | [prev] | [next] | [standalone]

#1648468 — [PATCH 4.11 164/197] nvme: unmap CMB and remove sysfs file in reset path

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jon Derrick <jonathan.derrick@intel.com>

commit f63572dff1421b6ca6abce71d46e03411e605c94 upstream.

CMB doesn't get unmapped until removal while getting remapped on every
reset. Add the unmapping and sysfs file removal to the reset path in
nvme_pci_disable to match the mapping path in nvme_pci_enable.

Fixes: 202021c1a ("nvme : Add sysfs entry for NVMe CMBs when appropriate")

Signed-off-by: Jon Derrick <jonathan.derrick@intel.com>
Acked-by: Keith Busch <keith.busch@intel.com>
Reviewed-By: Stephen Bates <sbates@raithlin.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/nvme/host/pci.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1394,6 +1394,11 @@ static inline void nvme_release_cmb(stru
 	if (dev->cmb) {
 		iounmap(dev->cmb);
 		dev->cmb = NULL;
+		if (dev->cmbsz) {
+			sysfs_remove_file_from_group(&dev->ctrl.device->kobj,
+						     &dev_attr_cmb.attr, NULL);
+			dev->cmbsz = 0;
+		}
 	}
 }
 
@@ -1665,6 +1670,7 @@ static void nvme_pci_disable(struct nvme
 {
 	struct pci_dev *pdev = to_pci_dev(dev->dev);
 
+	nvme_release_cmb(dev);
 	pci_free_irq_vectors(pdev);
 
 	if (pci_is_enabled(pdev)) {
@@ -2062,7 +2068,6 @@ static void nvme_remove(struct pci_dev *
 	nvme_dev_disable(dev, true);
 	nvme_dev_remove_admin(dev);
 	nvme_free_queues(dev, 0);
-	nvme_release_cmb(dev);
 	nvme_release_prp_pools(dev);
 	nvme_dev_unmap(dev);
 	nvme_put_ctrl(&dev->ctrl);

[toc] | [prev] | [next] | [standalone]

#1648471 — [PATCH 4.11 144/197] arm64: xchg: hazard against entire exchange variable

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

commit fee960bed5e857eb126c4e56dd9ff85938356579 upstream.

The inline assembly in __XCHG_CASE() uses a +Q constraint to hazard
against other accesses to the memory location being exchanged. However,
the pointer passed to the constraint is a u8 pointer, and thus the
hazard only applies to the first byte of the location.

GCC can take advantage of this, assuming that other portions of the
location are unchanged, as demonstrated with the following test case:

union u {
	unsigned long l;
	unsigned int i[2];
};

unsigned long update_char_hazard(union u *u)
{
	unsigned int a, b;

	a = u->i[1];
	asm ("str %1, %0" : "+Q" (*(char *)&u->l) : "r" (0UL));
	b = u->i[1];

	return a ^ b;
}

unsigned long update_long_hazard(union u *u)
{
	unsigned int a, b;

	a = u->i[1];
	asm ("str %1, %0" : "+Q" (*(long *)&u->l) : "r" (0UL));
	b = u->i[1];

	return a ^ b;
}

The linaro 15.08 GCC 5.1.1 toolchain compiles the above as follows when
using -O2 or above:

0000000000000000 <update_char_hazard>:
   0:	d2800001 	mov	x1, #0x0                   	// #0
   4:	f9000001 	str	x1, [x0]
   8:	d2800000 	mov	x0, #0x0                   	// #0
   c:	d65f03c0 	ret

0000000000000010 <update_long_hazard>:
  10:	b9400401 	ldr	w1, [x0,#4]
  14:	d2800002 	mov	x2, #0x0                   	// #0
  18:	f9000002 	str	x2, [x0]
  1c:	b9400400 	ldr	w0, [x0,#4]
  20:	4a000020 	eor	w0, w1, w0
  24:	d65f03c0 	ret

This patch fixes the issue by passing an unsigned long pointer into the
+Q constraint, as we do for our cmpxchg code. This may hazard against
more than is necessary, but this is better than missing a necessary
hazard.

Fixes: 305d454aaa29 ("arm64: atomics: implement native {relaxed, acquire, release} atomics")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/cmpxchg.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -46,7 +46,7 @@ static inline unsigned long __xchg_case_
 	"	swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n"	\
 		__nops(3)						\
 	"	" #nop_lse)						\
-	: "=&r" (ret), "=&r" (tmp), "+Q" (*(u8 *)ptr)			\
+	: "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr)	\
 	: "r" (x)							\
 	: cl);								\
 									\

[toc] | [prev] | [next] | [standalone]

#1648476 — [PATCH 4.11 142/197] ARM: dts: imx6sx-sdb: Remove OPP override

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Leonard Crestez <leonard.crestez@nxp.com>

commit d8581c7c8be172dac156a19d261f988a72ce596f upstream.

The board file for imx6sx-sdb overrides cpufreq operating points to use
higher voltages. This is done because the board has a shared rail for
VDD_ARM_IN and VDD_SOC_IN and when using LDO bypass the shared voltage
needs to be a value suitable for both ARM and SOC.

This only applies to LDO bypass mode, a feature not present in upstream.
When LDOs are enabled the effect is to use higher voltages than necessary
for no good reason.

Setting these higher voltages can make some boards fail to boot with ugly
semi-random crashes reminiscent of memory corruption. These failures only
happen on board rev. C, rev. B is reported to still work.

Signed-off-by: Leonard Crestez <leonard.crestez@nxp.com>
Fixes: 54183bd7f766 ("ARM: imx6sx-sdb: add revb board and make it default")
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/boot/dts/imx6sx-sdb.dts |   17 -----------------
 1 file changed, 17 deletions(-)

--- a/arch/arm/boot/dts/imx6sx-sdb.dts
+++ b/arch/arm/boot/dts/imx6sx-sdb.dts
@@ -12,23 +12,6 @@
 	model = "Freescale i.MX6 SoloX SDB RevB Board";
 };
 
-&cpu0 {
-	operating-points = <
-		/* kHz    uV */
-		996000  1250000
-		792000  1175000
-		396000  1175000
-		198000  1175000
-		>;
-	fsl,soc-operating-points = <
-		/* ARM kHz      SOC uV */
-		996000	1250000
-		792000	1175000
-		396000	1175000
-		198000  1175000
-	>;
-};
-
 &i2c1 {
 	clock-frequency = <100000>;
 	pinctrl-names = "default";

[toc] | [prev] | [next] | [standalone]

#1648478 — [PATCH 4.11 195/197] drivers: char: mem: Check for address space wraparound with mmap()

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Julius Werner <jwerner@chromium.org>

commit b299cde245b0b76c977f4291162cf668e087b408 upstream.

/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).

This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/mem.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -340,6 +340,11 @@ static const struct vm_operations_struct
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
 	size_t size = vma->vm_end - vma->vm_start;
+	phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+	/* It's illegal to wrap around the end of the physical address space. */
+	if (offset + (phys_addr_t)size < offset)
+		return -EINVAL;
 
 	if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
 		return -EINVAL;

[toc] | [prev] | [next] | [standalone]

#1648481 — [PATCH 4.11 193/197] nfsd: encoders mustnt use unitialized values in error cases

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: J. Bruce Fields <bfields@redhat.com>

commit f961e3f2acae94b727380c0b74e2d3954d0edf79 upstream.

In error cases, lgp->lg_layout_type may be out of bounds; so we
shouldn't be using it until after the check of nfserr.

This was seen to crash nfsd threads when the server receives a LAYOUTGET
request with a large layout type.

GETDEVICEINFO has the same problem.

Reported-by: Ari Kauppi <Ari.Kauppi@synopsys.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfs4xdr.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4119,8 +4119,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_
 		struct nfsd4_getdeviceinfo *gdev)
 {
 	struct xdr_stream *xdr = &resp->xdr;
-	const struct nfsd4_layout_ops *ops =
-		nfsd4_layout_ops[gdev->gd_layout_type];
+	const struct nfsd4_layout_ops *ops;
 	u32 starting_len = xdr->buf->len, needed_len;
 	__be32 *p;
 
@@ -4137,6 +4136,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_
 
 	/* If maxcount is 0 then just update notifications */
 	if (gdev->gd_maxcount != 0) {
+		ops = nfsd4_layout_ops[gdev->gd_layout_type];
 		nfserr = ops->encode_getdeviceinfo(xdr, gdev);
 		if (nfserr) {
 			/*
@@ -4189,8 +4189,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp
 		struct nfsd4_layoutget *lgp)
 {
 	struct xdr_stream *xdr = &resp->xdr;
-	const struct nfsd4_layout_ops *ops =
-		nfsd4_layout_ops[lgp->lg_layout_type];
+	const struct nfsd4_layout_ops *ops;
 	__be32 *p;
 
 	dprintk("%s: err %d\n", __func__, nfserr);
@@ -4213,6 +4212,7 @@ nfsd4_encode_layoutget(struct nfsd4_comp
 	*p++ = cpu_to_be32(lgp->lg_seg.iomode);
 	*p++ = cpu_to_be32(lgp->lg_layout_type);
 
+	ops = nfsd4_layout_ops[lgp->lg_layout_type];
 	nfserr = ops->encode_layoutget(xdr, lgp);
 out:
 	kfree(lgp->lg_content);

[toc] | [prev] | [next] | [standalone]

#1648485 — [PATCH 4.11 133/197] arm: KVM: Do not use stack-protector to compile HYP code

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit 501ad27c67ed0b90df465f23d33e9aed64058a47 upstream.

We like living dangerously. Nothing explicitely forbids stack-protector
to be used in the HYP code, while distributions routinely compile their
kernel with it. We're just lucky that no code actually triggers the
instrumentation.

Let's not try our luck for much longer, and disable stack-protector
for code living at HYP.

Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kvm/hyp/Makefile |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/arm/kvm/hyp/Makefile
+++ b/arch/arm/kvm/hyp/Makefile
@@ -2,6 +2,8 @@
 # Makefile for Kernel-based Virtual Machine module, HYP part
 #
 
+ccflags-y += -fno-stack-protector
+
 KVM=../../../../virt/kvm
 
 obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o

[toc] | [prev] | [next] | [standalone]

#1648487 — [PATCH 4.11 157/197] iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: KarimAllah Ahmed <karahmed@amazon.de>

commit f73a7eee900e95404b61408a23a1df5c5811704c upstream.

Ever since commit 091d42e43d ("iommu/vt-d: Copy translation tables from
old kernel") the kdump kernel copies the IOMMU context tables from the
previous kernel. Each device mappings will be destroyed once the driver
for the respective device takes over.

This unfortunately breaks the workflow of mapping and unmapping a new
context to the IOMMU. The mapping function assumes that either:

1) Unmapping did the proper IOMMU flushing and it only ever flush if the
   IOMMU unit supports caching invalid entries.
2) The system just booted and the initialization code took care of
   flushing all IOMMU caches.

This assumption is not true for the kdump kernel since the context
tables have been copied from the previous kernel and translations could
have been cached ever since. So make sure to flush the IOTLB as well
when we destroy these old copied mappings.

Cc: Joerg Roedel <joro@8bytes.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Anthony Liguori <aliguori@amazon.com>
Signed-off-by: KarimAllah Ahmed <karahmed@amazon.de>
Acked-by: David Woodhouse <dwmw@amazon.co.uk>
Fixes: 091d42e43d ("iommu/vt-d: Copy translation tables from old kernel")
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/iommu/intel-iommu.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2050,11 +2050,14 @@ static int domain_context_mapping_one(st
 	if (context_copied(context)) {
 		u16 did_old = context_domain_id(context);
 
-		if (did_old >= 0 && did_old < cap_ndoms(iommu->cap))
+		if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) {
 			iommu->flush.flush_context(iommu, did_old,
 						   (((u16)bus) << 8) | devfn,
 						   DMA_CCMD_MASK_NOBIT,
 						   DMA_CCMD_DEVICE_INVL);
+			iommu->flush.flush_iotlb(iommu, did_old, 0, 0,
+						 DMA_TLB_DSI_FLUSH);
+		}
 	}
 
 	pgd = domain->pgd;

[toc] | [prev] | [next] | [standalone]

#1648488 — [PATCH 4.11 138/197] ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Jon Medhurst <tixy@linaro.org>

commit b089c31c519c3906c14801b6ec483e18a5152a50 upstream.

To cope with the variety in ARM architectures and configurations, the
pagetable attributes for kernel memory are generated at runtime to match
the system the kernel finds itself on. This calculated value is stored
in pgprot_kernel.

However, when early fixmap support was added for ARM (commit
a5f4c561b3b1) the attributes used for mappings were hard coded because
pgprot_kernel is not set up early enough. Unfortunately, when fixmap is
used after early boot this means the memory being mapped can have
different attributes to existing mappings, potentially leading to
unpredictable behaviour. A specific problem also exists due to the hard
coded values not include the 'shareable' attribute which means on
systems where this matters (e.g. those with multiple CPU clusters) the
cache contents for a memory location can become inconsistent between
CPUs.

To resolve these issues we change fixmap to use the same memory
attributes (from pgprot_kernel) that the rest of the kernel uses. To
enable this we need to refactor the initialisation code so
build_mem_type_table() is called early enough. Note, that relies on early
param parsing for memory type overrides passed via the kernel command
line, so we need to make sure this call is still after
parse_early_params().

[ardb: keep early_fixmap_init() before param parsing, for earlycon]

Fixes: a5f4c561b3b1 ("ARM: 8415/1: early fixmap support for earlycon")
Tested-by: afzal mohammed <afzal.mohd.ma@gmail.com>
Signed-off-by: Jon Medhurst <tixy@linaro.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/include/asm/fixmap.h |    2 +-
 arch/arm/kernel/setup.c       |    4 ++--
 arch/arm/mm/mmu.c             |   16 +++++++++++++---
 3 files changed, 16 insertions(+), 6 deletions(-)

--- a/arch/arm/include/asm/fixmap.h
+++ b/arch/arm/include/asm/fixmap.h
@@ -41,7 +41,7 @@ static const enum fixed_addresses __end_
 
 #define FIXMAP_PAGE_COMMON	(L_PTE_YOUNG | L_PTE_PRESENT | L_PTE_XN | L_PTE_DIRTY)
 
-#define FIXMAP_PAGE_NORMAL	(FIXMAP_PAGE_COMMON | L_PTE_MT_WRITEBACK)
+#define FIXMAP_PAGE_NORMAL	(pgprot_kernel | L_PTE_XN)
 #define FIXMAP_PAGE_RO		(FIXMAP_PAGE_NORMAL | L_PTE_RDONLY)
 
 /* Used by set_fixmap_(io|nocache), both meant for mapping a device */
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -80,7 +80,7 @@ __setup("fpe=", fpe_setup);
 
 extern void init_default_cache_policy(unsigned long);
 extern void paging_init(const struct machine_desc *desc);
-extern void early_paging_init(const struct machine_desc *);
+extern void early_mm_init(const struct machine_desc *);
 extern void adjust_lowmem_bounds(void);
 extern enum reboot_mode reboot_mode;
 extern void setup_dma_zone(const struct machine_desc *desc);
@@ -1088,7 +1088,7 @@ void __init setup_arch(char **cmdline_p)
 	parse_early_param();
 
 #ifdef CONFIG_MMU
-	early_paging_init(mdesc);
+	early_mm_init(mdesc);
 #endif
 	setup_dma_zone(mdesc);
 	xen_early_init();
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -414,6 +414,11 @@ void __set_fixmap(enum fixed_addresses i
 		     FIXADDR_END);
 	BUG_ON(idx >= __end_of_fixed_addresses);
 
+	/* we only support device mappings until pgprot_kernel has been set */
+	if (WARN_ON(pgprot_val(prot) != pgprot_val(FIXMAP_PAGE_IO) &&
+		    pgprot_val(pgprot_kernel) == 0))
+		return;
+
 	if (pgprot_val(prot))
 		set_pte_at(NULL, vaddr, pte,
 			pfn_pte(phys >> PAGE_SHIFT, prot));
@@ -1492,7 +1497,7 @@ pgtables_remap lpae_pgtables_remap_asm;
  * early_paging_init() recreates boot time page table setup, allowing machines
  * to switch over to a high (>4G) address space on LPAE systems
  */
-void __init early_paging_init(const struct machine_desc *mdesc)
+static void __init early_paging_init(const struct machine_desc *mdesc)
 {
 	pgtables_remap *lpae_pgtables_remap;
 	unsigned long pa_pgd;
@@ -1560,7 +1565,7 @@ void __init early_paging_init(const stru
 
 #else
 
-void __init early_paging_init(const struct machine_desc *mdesc)
+static void __init early_paging_init(const struct machine_desc *mdesc)
 {
 	long long offset;
 
@@ -1616,7 +1621,6 @@ void __init paging_init(const struct mac
 {
 	void *zero_page;
 
-	build_mem_type_table();
 	prepare_page_table();
 	map_lowmem();
 	memblock_set_current_limit(arm_lowmem_limit);
@@ -1636,3 +1640,9 @@ void __init paging_init(const struct mac
 	empty_zero_page = virt_to_page(zero_page);
 	__flush_dcache_page(NULL, empty_zero_page);
 }
+
+void __init early_mm_init(const struct machine_desc *mdesc)
+{
+	build_mem_type_table();
+	early_paging_init(mdesc);
+}

[toc] | [prev] | [next] | [standalone]

#1648490 — [PATCH 4.11 134/197] KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Marc Zyngier <marc.zyngier@arm.com>

commit ddf42d068f8802de122bb7efdfcb3179336053f1 upstream.

When an interrupt is injected with the HW bit set (indicating that
deactivation should be propagated to the physical distributor),
special care must be taken so that we never mark the corresponding
LR with the Active+Pending state (as the pending state is kept in
the physycal distributor).

Fixes: 140b086dd197 ("KVM: arm/arm64: vgic-new: Add GICv2 world switch backend")
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 virt/kvm/arm/vgic/vgic-v2.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- a/virt/kvm/arm/vgic/vgic-v2.c
+++ b/virt/kvm/arm/vgic/vgic-v2.c
@@ -181,6 +181,13 @@ void vgic_v2_populate_lr(struct kvm_vcpu
 	if (irq->hw) {
 		val |= GICH_LR_HW;
 		val |= irq->hwintid << GICH_LR_PHYSID_CPUID_SHIFT;
+		/*
+		 * Never set pending+active on a HW interrupt, as the
+		 * pending state is kept at the physical distributor
+		 * level.
+		 */
+		if (irq->active && irq_is_pending(irq))
+			val &= ~GICH_LR_PENDING_BIT;
 	} else {
 		if (irq->config == VGIC_CONFIG_LEVEL)
 			val |= GICH_LR_EOI;

[toc] | [prev] | [next] | [standalone]

#1648493 — [PATCH 4.11 181/197] PCI: Only allow WC mmap on prefetchable resources

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Woodhouse <dwmw@amazon.co.uk>

commit cef4d02305a06be581bb7f4353446717a1b319ec upstream.

The /proc/bus/pci mmap interface allows the user to specify whether they
want WC or not.  Don't let them do so on non-prefetchable BARs.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/proc.c |   13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

--- a/drivers/pci/proc.c
+++ b/drivers/pci/proc.c
@@ -231,7 +231,7 @@ static int proc_bus_pci_mmap(struct file
 {
 	struct pci_dev *dev = PDE_DATA(file_inode(file));
 	struct pci_filp_private *fpriv = file->private_data;
-	int i, ret, write_combine, res_bit;
+	int i, ret, write_combine = 0, res_bit;
 
 	if (!capable(CAP_SYS_RAWIO))
 		return -EPERM;
@@ -251,10 +251,13 @@ static int proc_bus_pci_mmap(struct file
 	if (i >= PCI_ROM_RESOURCE)
 		return -ENODEV;
 
-	if (fpriv->mmap_state == pci_mmap_mem)
-		write_combine = fpriv->write_combine;
-	else
-		write_combine = 0;
+	if (fpriv->mmap_state == pci_mmap_mem &&
+	    fpriv->write_combine) {
+		if (dev->resource[i].flags & IORESOURCE_PREFETCH)
+			write_combine = 1;
+		else
+			return -EINVAL;
+	}
 	ret = pci_mmap_page_range(dev, vma,
 				  fpriv->mmap_state, write_combine);
 	if (ret < 0)

[toc] | [prev] | [next] | [standalone]

#1648494 — [PATCH 4.11 130/197] powerpc/mm: Fix crash in page table dump with huge pages

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Michael Ellerman <mpe@ellerman.id.au>

commit bfb9956ab4d8242f4594b5f4bee534b935384fd9 upstream.

The page table dump code doesn't know about huge pages, so currently
it crashes (or walks random memory, usually leading to a crash), if it
finds a huge page. On Book3S we only see huge pages in the Linux page
tables when we're using the P9 Radix MMU.

Teaching the code to properly handle huge pages is a bit more involved,
so for now just prevent the crash.

Fixes: 8eb07b187000 ("powerpc/mm: Dump linux pagetables")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/mm/dump_linuxpagetables.c |    7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

--- a/arch/powerpc/mm/dump_linuxpagetables.c
+++ b/arch/powerpc/mm/dump_linuxpagetables.c
@@ -16,6 +16,7 @@
  */
 #include <linux/debugfs.h>
 #include <linux/fs.h>
+#include <linux/hugetlb.h>
 #include <linux/io.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
@@ -331,7 +332,7 @@ static void walk_pmd(struct pg_state *st
 
 	for (i = 0; i < PTRS_PER_PMD; i++, pmd++) {
 		addr = start + i * PMD_SIZE;
-		if (!pmd_none(*pmd))
+		if (!pmd_none(*pmd) && !pmd_huge(*pmd))
 			/* pmd exists */
 			walk_pte(st, pmd, addr);
 		else
@@ -347,7 +348,7 @@ static void walk_pud(struct pg_state *st
 
 	for (i = 0; i < PTRS_PER_PUD; i++, pud++) {
 		addr = start + i * PUD_SIZE;
-		if (!pud_none(*pud))
+		if (!pud_none(*pud) && !pud_huge(*pud))
 			/* pud exists */
 			walk_pmd(st, pud, addr);
 		else
@@ -367,7 +368,7 @@ static void walk_pagetables(struct pg_st
 	 */
 	for (i = 0; i < PTRS_PER_PGD; i++, pgd++) {
 		addr = KERN_VIRT_START + i * PGDIR_SIZE;
-		if (!pgd_none(*pgd))
+		if (!pgd_none(*pgd) && !pgd_huge(*pgd))
 			/* pgd exists */
 			walk_pud(st, pgd, addr);
 		else

[toc] | [prev] | [next] | [standalone]

#1648495 — [PATCH 4.11 188/197] NFS: Fix use after free in write error path

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Fred Isaman <fred.isaman@gmail.com>

commit 1f84ccdf37d0db3a70714d02d51b0b6d45887fb8 upstream.

Signed-off-by: Fred Isaman <fred.isaman@gmail.com>
Fixes: 0bcbf039f6b2b ("nfs: handle request add failure properly")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/write.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -548,9 +548,9 @@ static void nfs_write_error_remove_page(
 {
 	nfs_unlock_request(req);
 	nfs_end_page_writeback(req);
-	nfs_release_request(req);
 	generic_error_remove_page(page_file_mapping(req->wb_page),
 				  req->wb_page);
+	nfs_release_request(req);
 }
 
 /*

[toc] | [prev] | [next] | [standalone]

#1648496 — [PATCH 4.11 160/197] metag/uaccess: Check access_ok in strncpy_from_user

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hogan <james.hogan@imgtec.com>

commit 3a158a62da0673db918b53ac1440845a5b64fd90 upstream.

The metag implementation of strncpy_from_user() doesn't validate the src
pointer, which could allow reading of arbitrary kernel memory. Add a
short access_ok() check to prevent that.

Its still possible for it to read across the user/kernel boundary, but
it will invariably reach a NUL character after only 9 bytes, leaking
only a static kernel address being loaded into D0Re0 at the beginning of
__start, which is acceptable for the immediate fix.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/include/asm/uaccess.h |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -194,8 +194,13 @@ do {
 extern long __must_check __strncpy_from_user(char *dst, const char __user *src,
 					     long count);
 
-#define strncpy_from_user(dst, src, count) __strncpy_from_user(dst, src, count)
-
+static inline long
+strncpy_from_user(char *dst, const char __user *src, long count)
+{
+	if (!access_ok(VERIFY_READ, src, 1))
+		return -EFAULT;
+	return __strncpy_from_user(dst, src, count);
+}
 /*
  * Return the size of a string (including the ending 0)
  *

[toc] | [prev] | [next] | [standalone]

#1648497 — [PATCH 4.11 128/197] powerpc/powernv: Fix TCE kill on NVLink2

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alistair Popple <alistair@popple.id.au>

commit 6b3d12a948d27977816a15eb48409a298902a548 upstream.

Commit 616badd2fb49 ("powerpc/powernv: Use OPAL call for TCE kill on
NVLink2") forced all TCE kills to go via the OPAL call for
NVLink2. However the PHB3 implementation of TCE kill was still being
called directly from some functions which in some circumstances caused
a machine check.

This patch adds an equivalent IODA2 version of the function which uses
the correct invalidation method depending on PHB model and changes all
external callers to use it instead.

Fixes: 616badd2fb49 ("powerpc/powernv: Use OPAL call for TCE kill on NVLink2")
Signed-off-by: Alistair Popple <alistair@popple.id.au>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/platforms/powernv/npu-dma.c  |    8 ++++----
 arch/powerpc/platforms/powernv/pci-ioda.c |   10 +++++++++-
 arch/powerpc/platforms/powernv/pci.h      |    2 +-
 3 files changed, 14 insertions(+), 6 deletions(-)

--- a/arch/powerpc/platforms/powernv/npu-dma.c
+++ b/arch/powerpc/platforms/powernv/npu-dma.c
@@ -180,7 +180,7 @@ long pnv_npu_set_window(struct pnv_ioda_
 		pe_err(npe, "Failed to configure TCE table, err %lld\n", rc);
 		return rc;
 	}
-	pnv_pci_phb3_tce_invalidate_entire(phb, false);
+	pnv_pci_ioda2_tce_invalidate_entire(phb, false);
 
 	/* Add the table to the list so its TCE cache will get invalidated */
 	pnv_pci_link_table_and_group(phb->hose->node, num,
@@ -204,7 +204,7 @@ long pnv_npu_unset_window(struct pnv_iod
 		pe_err(npe, "Unmapping failed, ret = %lld\n", rc);
 		return rc;
 	}
-	pnv_pci_phb3_tce_invalidate_entire(phb, false);
+	pnv_pci_ioda2_tce_invalidate_entire(phb, false);
 
 	pnv_pci_unlink_table_and_group(npe->table_group.tables[num],
 			&npe->table_group);
@@ -270,7 +270,7 @@ static int pnv_npu_dma_set_bypass(struct
 			0 /* bypass base */, top);
 
 	if (rc == OPAL_SUCCESS)
-		pnv_pci_phb3_tce_invalidate_entire(phb, false);
+		pnv_pci_ioda2_tce_invalidate_entire(phb, false);
 
 	return rc;
 }
@@ -334,7 +334,7 @@ void pnv_npu_take_ownership(struct pnv_i
 		pe_err(npe, "Failed to disable bypass, err %lld\n", rc);
 		return;
 	}
-	pnv_pci_phb3_tce_invalidate_entire(npe->phb, false);
+	pnv_pci_ioda2_tce_invalidate_entire(npe->phb, false);
 }
 
 struct pnv_ioda_pe *pnv_pci_npu_setup_iommu(struct pnv_ioda_pe *npe)
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -1883,7 +1883,7 @@ static struct iommu_table_ops pnv_ioda1_
 #define PHB3_TCE_KILL_INVAL_PE		PPC_BIT(1)
 #define PHB3_TCE_KILL_INVAL_ONE		PPC_BIT(2)
 
-void pnv_pci_phb3_tce_invalidate_entire(struct pnv_phb *phb, bool rm)
+static void pnv_pci_phb3_tce_invalidate_entire(struct pnv_phb *phb, bool rm)
 {
 	__be64 __iomem *invalidate = pnv_ioda_get_inval_reg(phb, rm);
 	const unsigned long val = PHB3_TCE_KILL_INVAL_ALL;
@@ -1979,6 +1979,14 @@ static void pnv_pci_ioda2_tce_invalidate
 	}
 }
 
+void pnv_pci_ioda2_tce_invalidate_entire(struct pnv_phb *phb, bool rm)
+{
+	if (phb->model == PNV_PHB_MODEL_NPU || phb->model == PNV_PHB_MODEL_PHB3)
+		pnv_pci_phb3_tce_invalidate_entire(phb, rm);
+	else
+		opal_pci_tce_kill(phb->opal_id, OPAL_PCI_TCE_KILL, 0, 0, 0, 0);
+}
+
 static int pnv_ioda2_tce_build(struct iommu_table *tbl, long index,
 		long npages, unsigned long uaddr,
 		enum dma_data_direction direction,
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -229,7 +229,7 @@ extern void pe_level_printk(const struct
 
 /* Nvlink functions */
 extern void pnv_npu_try_dma_set_bypass(struct pci_dev *gpdev, bool bypass);
-extern void pnv_pci_phb3_tce_invalidate_entire(struct pnv_phb *phb, bool rm);
+extern void pnv_pci_ioda2_tce_invalidate_entire(struct pnv_phb *phb, bool rm);
 extern struct pnv_ioda_pe *pnv_pci_npu_setup_iommu(struct pnv_ioda_pe *npe);
 extern long pnv_npu_set_window(struct pnv_ioda_pe *npe, int num,
 		struct iommu_table *tbl);

[toc] | [prev] | [next] | [standalone]

#1648499 — Re: [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64()

On Tue, May 23, 2017 at 1:06 PM, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> 4.11-stable review patch.  If anyone has any objections, please let me know.

No objections, but I do want to note that I verified with a
"allyesconfig" build on i386 that this code actually never triggers at
least in current -git. I might have screwed something up, but I added
a "fsin" instruction to that inline asm, and then verified that
"objdump" didn't find any fsin instructions in any object files after
the build.

There are people who do 64-bit reads from user space, but they all
seem to happily use "get_user()" that gets it right, not the
"__get_user()" helper that did not.

So it's still worth putting in stable (just in case of future or
external users), but at least it doesn't seem to be a potential
security issue (which it might have been - with the right unlucky code
generation you could make the 64-bit load basically be a pointer
following thing).

                     Linus

[toc] | [prev] | [next] | [standalone]

#1648500 — [PATCH 4.11 146/197] arm64: armv8_deprecated: ensure extension of addr

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mark Rutland <mark.rutland@arm.com>

commit 55de49f9aa17b0b2b144dd2af587177b9aadf429 upstream.

Our compat swp emulation holds the compat user address in an unsigned
int, which it passes to __user_swpX_asm(). When a 32-bit value is passed
in a register, the upper 32 bits of the register are unknown, and we
must extend the value to 64 bits before we can use it as a base address.

This patch casts the address to unsigned long to ensure it has been
suitably extended, avoiding the potential issue, and silencing a related
warning from clang.

Fixes: bd35a4adc413 ("arm64: Port SWP/SWPB emulation support from arm")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/armv8_deprecated.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -306,7 +306,8 @@ do {								\
 	_ASM_EXTABLE(0b, 4b)					\
 	_ASM_EXTABLE(1b, 4b)					\
 	: "=&r" (res), "+r" (data), "=&r" (temp), "=&r" (temp2)	\
-	: "r" (addr), "i" (-EAGAIN), "i" (-EFAULT),		\
+	: "r" ((unsigned long)addr), "i" (-EAGAIN),		\
+	  "i" (-EFAULT),					\
 	  "i" (__SWP_LL_SC_LOOPS)				\
 	: "memory");						\
 	uaccess_disable();					\

[toc] | [prev] | [next] | [standalone]

#1648502 — [PATCH 4.11 196/197] drm/i915/gvt: Disable access to stolen memory as a guest

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit 04a68a35ce6d7b54749989f943993020f48fed62 upstream.

Explicitly disable stolen memory when running as a guest in a virtual
machine, since the memory is not mediated between clients and reserved
entirely for the host. The actual size should be reported as zero, but
like every other quirk we want to tell the user what is happening.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99028
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20161109103905.17860-1-chris@chris-wilson.co.uk
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/i915/i915_gem_stolen.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/drivers/gpu/drm/i915/i915_gem_stolen.c
+++ b/drivers/gpu/drm/i915/i915_gem_stolen.c
@@ -410,6 +410,11 @@ int i915_gem_init_stolen(struct drm_i915
 		return 0;
 	}
 
+	if (intel_vgpu_active(dev_priv)) {
+		DRM_INFO("iGVT-g active, disabling use of stolen memory\n");
+		return 0;
+	}
+
 #ifdef CONFIG_INTEL_IOMMU
 	if (intel_iommu_gfx_mapped && INTEL_GEN(dev_priv) < 8) {
 		DRM_INFO("DMAR active, disabling use of stolen memory\n");

[toc] | [prev] | [next] | [standalone]

#1648503 — [PATCH 4.11 150/197] arm64: entry: improve data abort handling of tagged pointers

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kristina Martsenko <kristina.martsenko@arm.com>

commit 276e93279a630657fff4b086ba14c95955912dfa upstream.

When handling a data abort from EL0, we currently zero the top byte of
the faulting address, as we assume the address is a TTBR0 address, which
may contain a non-zero address tag. However, the address may be a TTBR1
address, in which case we should not zero the top byte. This patch fixes
that. The effect is that the full TTBR1 address is passed to the task's
signal handler (or printed out in the kernel log).

When handling a data abort from EL1, we leave the faulting address
intact, as we assume it's either a TTBR1 address or a TTBR0 address with
tag 0x00. This is true as far as I'm aware, we don't seem to access a
tagged TTBR0 address anywhere in the kernel. Regardless, it's easy to
forget about address tags, and code added in the future may not always
remember to remove tags from addresses before accessing them. So add tag
handling to the EL1 data abort handler as well. This also makes it
consistent with the EL0 data abort handler.

Fixes: d50240a5f6ce ("arm64: mm: permit use of tagged pointers at EL0")
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/include/asm/asm-uaccess.h |    9 +++++++++
 arch/arm64/kernel/entry.S            |    5 +++--
 2 files changed, 12 insertions(+), 2 deletions(-)

--- a/arch/arm64/include/asm/asm-uaccess.h
+++ b/arch/arm64/include/asm/asm-uaccess.h
@@ -62,4 +62,13 @@ alternative_if ARM64_ALT_PAN_NOT_UAO
 alternative_else_nop_endif
 	.endm
 
+/*
+ * Remove the address tag from a virtual address, if present.
+ */
+	.macro	clear_address_tag, dst, addr
+	tst	\addr, #(1 << 55)
+	bic	\dst, \addr, #(0xff << 56)
+	csel	\dst, \dst, \addr, eq
+	.endm
+
 #endif
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -428,12 +428,13 @@ el1_da:
 	/*
 	 * Data abort handling
 	 */
-	mrs	x0, far_el1
+	mrs	x3, far_el1
 	enable_dbg
 	// re-enable interrupts if they were enabled in the aborted context
 	tbnz	x23, #7, 1f			// PSR_I_BIT
 	enable_irq
 1:
+	clear_address_tag x0, x3
 	mov	x2, sp				// struct pt_regs
 	bl	do_mem_abort
 
@@ -594,7 +595,7 @@ el0_da:
 	// enable interrupts before calling the main handler
 	enable_dbg_and_irq
 	ct_user_exit
-	bic	x0, x26, #(0xff << 56)
+	clear_address_tag x0, x26
 	mov	x1, x25
 	mov	x2, sp
 	bl	do_mem_abort

[toc] | [prev] | [next] | [standalone]

#1648505 — [PATCH 4.11 173/197] tracing/kprobes: Enforce kprobes teardown after testing

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 30e7d894c1478c88d50ce94ddcdbd7f9763d9cdd upstream.

Enabling the tracer selftest triggers occasionally the warning in
text_poke(), which warns when the to be modified page is not marked
reserved.

The reason is that the tracer selftest installs kprobes on functions marked
__init for testing. These probes are removed after the tests, but that
removal schedules the delayed kprobes_optimizer work, which will do the
actual text poke. If the work is executed after the init text is freed,
then the warning triggers. The bug can be reproduced reliably when the work
delay is increased.

Flush the optimizer work and wait for the optimizing/unoptimizing lists to
become empty before returning from the kprobes tracer selftest. That
ensures that all operations which were queued due to the probes removal
have completed.

Link: http://lkml.kernel.org/r/20170516094802.76a468bb@gandalf.local.home

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 6274de498 ("kprobes: Support delayed unoptimizing")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 include/linux/kprobes.h     |    3 +++
 kernel/kprobes.c            |    2 +-
 kernel/trace/trace_kprobe.c |    5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)

--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -347,6 +347,9 @@ extern int proc_kprobes_optimization_han
 					     int write, void __user *buffer,
 					     size_t *length, loff_t *ppos);
 #endif
+extern void wait_for_kprobe_optimizer(void);
+#else
+static inline void wait_for_kprobe_optimizer(void) { }
 #endif /* CONFIG_OPTPROBES */
 #ifdef CONFIG_KPROBES_ON_FTRACE
 extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip,
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -598,7 +598,7 @@ static void kprobe_optimizer(struct work
 }
 
 /* Wait for completing optimization and unoptimization */
-static void wait_for_kprobe_optimizer(void)
+void wait_for_kprobe_optimizer(void)
 {
 	mutex_lock(&kprobe_mutex);
 
--- a/kernel/trace/trace_kprobe.c
+++ b/kernel/trace/trace_kprobe.c
@@ -1511,6 +1511,11 @@ static __init int kprobe_trace_self_test
 
 end:
 	release_all_trace_kprobes();
+	/*
+	 * Wait for the optimizer work to finish. Otherwise it might fiddle
+	 * with probes in already freed __init text.
+	 */
+	wait_for_kprobe_optimizer();
 	if (warn)
 		pr_cont("NG: Some tests are failed. Please check them.\n");
 	else

[toc] | [prev] | [next] | [standalone]

Page 3 of 9 — ← Prev page 1 2 [3] 4 5 6 7 8 9  Next page →

Back to top | Article view | linux.kernel

csiph-web