Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1648416 > unrolled thread

[PATCH 4.11 000/197] 4.11.3-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 4.11 000/197] 4.11.3-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 022/197] infiniband: call ipv6 route lookup via the stub interface Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 059/197] drm/nouveau/tmr: avoid processing completed alarms when adding a new one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 045/197] regulator: rk808: Fix RK818 LDO2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 075/197] IB/hfi1: Return an error on memory allocation failure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 002/197] usb: misc: legousbtower: Fix memory leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 019/197] tpm: fix handling of the TPM 2.0 event logs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 080/197] USB: serial: ftdi_sio: add Olimex ARM-USB-TINY(H) PIDs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 109/197] iio: hid-sensor: Store restore poll and hysteresis on S3 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 110/197] [media] cec: Fix runtime BUG when (CONFIG_RC_CORE && !CEC_CAP_RC) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 052/197] drm/amdgpu: Avoid overflows/divide-by-zero in latency_watermark calculations. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 007/197] tpm_tis_core: Choose appropriate timeout for reading burstcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 111/197] [media] s5p-mfc: Fix race between interrupt routine and device functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 082/197] Make stat/lstat/fstatat pass AT_NO_AUTOMOUNT to vfs_statx() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 071/197] scsi: lpfc: Fix panic on BFS configuration Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 034/197] dm space map disk: fix some book keeping in the disk space map Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 117/197] [media] digitv: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 008/197] ALSA: hda: Fix cpu lockup when stopping the cmd dmas Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 087/197] xhci: remove GFP_DMA flag from allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 106/197] USB: hub: fix non-SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 105/197] USB: hub: fix SS hub-descriptor handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 115/197] [media] zr364xx: enforce minimum size when reading header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 036/197] md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 097/197] usb: dwc3: gadget: Prevent losing events in event cache Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 050/197] ath9k_htc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 093/197] [media] usbvision: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 058/197] drm/nouveau/tmr: fix corruption of the pending list when rescheduling an alarm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 027/197] dm mpath: requeue after a small delay if blk_get_request() fails Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 029/197] dm mpath: avoid that path removal can trigger an infinite loop Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 024/197] dm raid: select the Kconfig option CONFIG_MD_RAID0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 023/197] dm btree: fix for dm_btree_find_lowest_key() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 031/197] dm cache metadata: fail operations if fail_io mode has been established Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 092/197] net: irda: irda-usb: fix firmware name on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 001/197] usb: misc: legousbtower: Fix buffers on stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 020/197] ASoC: cs4271: configure reset GPIO as output Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:20 +0200
    [PATCH 4.11 124/197] powerpc/book3s/mce: Move add_taint() later in virtual mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 169/197] osf_wait4(): fix infoleak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 156/197] staging: rtl8192e: GetTs Fix invalid TID 7 warning. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 139/197] ARM: 8670/1: V7M: Do not corrupt vector table around v7m_invalidate_l1 call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 184/197] mtd: nand: omap2: Fix partition creation via cmdline mtdparts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 155/197] staging: rtl8192e: rtl92e_get_eeprom_size Fix read size of EPROM_CMD. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 164/197] nvme: unmap CMB and remove sysfs file in reset path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 144/197] arm64: xchg: hazard against entire exchange variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 142/197] ARM: dts: imx6sx-sdb: Remove OPP override Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 195/197] drivers: char: mem: Check for address space wraparound with mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 193/197] nfsd: encoders mustnt use unitialized values in error cases Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 133/197] arm: KVM: Do not use stack-protector to compile HYP code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 157/197] iommu/vt-d: Flush the IOTLB to get rid of the initial kdump mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 138/197] ARM: 8667/3: Fix memory attribute inconsistencies when using fixmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 134/197] KVM: arm/arm64: vgic-v2: Do not use Active+Pending state for a HW interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 181/197] PCI: Only allow WC mmap on prefetchable resources Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 130/197] powerpc/mm: Fix crash in page table dump with huge pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 188/197] NFS: Fix use after free in write error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 160/197] metag/uaccess: Check access_ok in strncpy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 128/197] powerpc/powernv: Fix TCE kill on NVLink2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    Re: [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64() Linus Torvalds <torvalds@linux-foundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 146/197] arm64: armv8_deprecated: ensure extension of addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 196/197] drm/i915/gvt: Disable access to stolen memory as a guest Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 150/197] arm64: entry: improve data abort handling of tagged pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 173/197] tracing/kprobes: Enforce kprobes teardown after testing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 174/197] thermal: mt8173: minor mtk_thermal.c cleanups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 185/197] mtd: nand: add ooblayout for old hamming layout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 137/197] ARM: 8662/1: module: split core and init PLT sections Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 187/197] NFSv4: Fix a hang in OPEN related to server reboot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 186/197] drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 129/197] powerpc/64e: Fix hang when debugging programs with relocated kernel Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 172/197] firmware: ti_sci: fix strncat length check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 179/197] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 148/197] arm64: traps: fix userspace cache maintenance emulation on a tagged pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 22:30 +0200
    [PATCH 4.11 158/197] cpuidle: check dev before usage in cpuidle_use_deepest_state() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-23 23:10 +0200
    [PATCH 4.11 191/197] NFSv4: Fix an rcu lock leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 197/197] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 194/197] nfsd: Fix up the "supattr_exclcreat" attributes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 190/197] pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 165/197] MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 159/197] metag/uaccess: Fix access_ok() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 168/197] kvm: arm/arm64: Force reading uncached stage2 PGD Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 192/197] nfsd: fix undefined behavior in nfsd4_layout_verify Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:00 +0200
    [PATCH 4.11 176/197] PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 120/197] [media] cx231xx-audio: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 178/197] PCI: hv: Specify CPU_AFFINITY_ALL for MSI affinity when >= 32 CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 149/197] arm64: hw_breakpoint: fix watchpoint matching for tagged pointers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 183/197] mtd: nand: orion: fix clk handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 177/197] PCI: hv: Allocate interrupt descriptors with GFP_ATOMIC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 180/197] PCI: Fix another sanity check bug in /proc/pci mmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 127/197] powerpc/iommu: Do not call PageTransHuge() on tail pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 152/197] staging: vc04_services: Fix bulk cache maintenance Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 162/197] uwb: fix device quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 153/197] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 151/197] arm64: documentation: document tagged pointer stack constraints Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 170/197] drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 161/197] stackprotector: Increase the per-task stack canarys random range from 32 bits to 64 bits on 64-bit platforms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 171/197] um: Fix to call read_initrd after init_bootmem Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 175/197] PCI/ACPI: Tidy up MCFG quirk whitespace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 189/197] NFS: Use GFP_NOIO for two allocations in writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 163/197] genirq: Fix chained interrupt data ordering Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 154/197] staging: rtl8192e: fix 2 byte alignment of register BSSIDR. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 125/197] powerpc/pseries: Fix of_node_put() underflow during DLPAR remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 126/197] powerpc/sysfs: Fix reference leak of cpu device_nodes present at boot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:10 +0200
    [PATCH 4.11 145/197] arm64: ensure extension of smp_store_release value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 147/197] arm64: uaccess: ensure extension of access_ok() addr Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 114/197] [media] dib0700: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 118/197] [media] dw2102: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 101/197] usb: serial: option: add Telit ME910 support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 091/197] usb: host: xhci-mem: allocate zeroed Scratchpad Buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 103/197] USB: serial: mct_u232: fix big-endian baud-rate handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 090/197] xhci: apply PME_STUCK_QUIRK and MISSING_CAS quirk for Denverton Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 086/197] xhci: Fix command ring stop regression in 4.11 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 108/197] iio: proximity: as3935: fix as3935_write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 141/197] ARM: dts: at91: sama5d3_xplained: not all ADC channels are available Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 135/197] KVM: arm/arm64: vgic-v3: Do not use Active+Pending state for a HW interrupt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 143/197] arm64: dts: hi6220: Reset the mmc hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 122/197] powerpc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 116/197] [media] dvb-frontends/cxd2841er: define symbol_rate_min/max in T/C fe-ops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 121/197] [media] cx231xx-cards: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 131/197] powerpc/tm: Fix FP and VMX register corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 123/197] powerpc/eeh: Avoid use after free in eeh_handle_special_event() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 104/197] USB: serial: io_ti: fix div-by-zero in set_termios Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 119/197] [media] cx231xx-audio: fix init error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 113/197] [media] s5p-mfc: Fix unbalanced call to clock management Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 140/197] ARM: dts: at91: sama5d3_xplained: fix ADC vref Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 132/197] arm64: KVM: Do not use stack-protector to compile EL2 code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:20 +0200
    [PATCH 4.11 072/197] iio: dac: ad7303: fix channel description Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 061/197] gpio: omap: return error if requested debounce time is not possible Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 076/197] IB/hfi1: Fix a subcontext memory leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 014/197] tpm_tis_spi: Add small delay after last transfer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 073/197] IIO: bmp280-core.c: fix error in humidity calculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 021/197] mlx5: Fix mlx5_ib_map_mr_sg mr length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 054/197] drm/nouveau/therm: remove ineffective workarounds for alarm bugs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 096/197] [media] dvb-usb-dibusb-mc-common: Add MODULE_LICENSE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 047/197] s390/kdump: Add final note Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 081/197] USB: chaoskey: fix Alea quirk on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 044/197] x86: fix 32-bit case of __get_user_asm_u64() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 074/197] iio: stm32 trigger: fix sampling_frequency read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 100/197] USB: iowarrior: fix info ioctl on big-endian hosts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 064/197] cxl: Force context lock during EEH flow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 083/197] libnvdimm: fix clear length of nvdimm_forget_poison() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 057/197] drm/nouveau/tmr: ack interrupt before processing alarms Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 095/197] [media] ttusb2: limit messages to buffer size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 048/197] s390/cputime: fix incorrect system time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 078/197] pid_ns: Fix race between setnsed fork() and zap_pid_ns_processes() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 070/197] ibmvscsis: Do not send aborted task response Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 067/197] of: fix sparse warning in of_pci_range_parser_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 062/197] cdc-acm: fix possible invalid access when processing notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 039/197] mwifiex: pcie: fix cmd_buf use-after-free in remove/reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 055/197] drm/nouveau/kms/nv50: fix source-rect-only plane updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 018/197] vTPM: Fix missing NULL check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 060/197] drm/nouveau/tmr: handle races with hw when updating the next alarm time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 051/197] drm/amdgpu: Make display watermark calculations more accurate Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:30 +0200
    [PATCH 4.11 009/197] fanotify: dont expose EOPENSTALE to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 025/197] dm bufio: avoid a possible ABBA deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 003/197] USB: ene_usb6250: fix DMA to the stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 012/197] tpm_tis_spi: Check correct byte for wait state indicator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 006/197] USB: core: replace %p with %pK Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 013/197] tpm_tis_spi: Remove limitation of transfers to MAX_SPI_FRAMESIZE bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 033/197] dm thin metadata: call precommit before saving the roots Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 026/197] dm bufio: check new buffer allocation watermark every 30 seconds Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 028/197] dm mpath: split and rename activate_path() to prepare for its expanded use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 037/197] rtlwifi: rtl8821ae: setup 8812ae RFE according to device type Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 015/197] tpm: msleep() delays - replace with usleep_range() in i2c nuvoton driver Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 035/197] md: update slab_cache before releasing new stripes when stripes resizing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 030/197] dm mpath: delay requeuing while path initialization is in progress Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    [PATCH 4.11 005/197] char: lp: fix possible integer overflow in lp_setup() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-24 00:40 +0200
    Re: [PATCH 4.11 000/197] 4.11.3-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-24 19:00 +0200

Page 4 of 9 — ← Prev page 1 2 3 [4] 5 6 7 8 9  Next page →

#1648507 — [PATCH 4.11 174/197] thermal: mt8173: minor mtk_thermal.c cleanups

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dawei Chien <dawei.chien@mediatek.com>

commit 05d7839aa290901429d8edcd8f7974c9df2bcaa5 upstream.

If thermal bank with 4 sensors, thermal driver should read TEMP_MSR3.

However, currently thermal driver would not read TEMP_MSR3 since mt8173
thermal driver only use 3 sensors on each thermal bank at the same time,
so this patch would not effect temperature.
Only if mt mt8173 thermal driver use 4 sensors on any thermal bank, would
read third sensor two times, and lose fourth sensor of vale.

Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.")
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Dawei Chien <dawei.chien@mediatek.com>
Signed-off-by: Eduardo Valentin <edubezval@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/thermal/mtk_thermal.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/thermal/mtk_thermal.c
+++ b/drivers/thermal/mtk_thermal.c
@@ -191,7 +191,7 @@ static const int mt8173_bank_data[MT8173
 };
 
 static const int mt8173_msr[MT8173_NUM_SENSORS_PER_ZONE] = {
-	TEMP_MSR0, TEMP_MSR1, TEMP_MSR2, TEMP_MSR2
+	TEMP_MSR0, TEMP_MSR1, TEMP_MSR2, TEMP_MSR3
 };
 
 static const int mt8173_adcpnp[MT8173_NUM_SENSORS_PER_ZONE] = {

[toc] | [prev] | [next] | [standalone]

#1648509 — [PATCH 4.11 185/197] mtd: nand: add ooblayout for old hamming layout

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexander Couzens <lynxis@fe80.eu>

commit 6a623e07694437ad09f382a13f76cffc32239a7f upstream.

The old 1-bit hamming layout requires ECC data to be placed at a
fixed offset, and not necessarily at the end of the OOB area.
Add this old layout back in order to fix legacy setups.

Fixes: 41b207a70d3a ("mtd: nand: implement the default mtd_ooblayout_ops")
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/mtd/nand/nand_base.c |   70 ++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 69 insertions(+), 1 deletion(-)

--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -139,6 +139,74 @@ const struct mtd_ooblayout_ops nand_oobl
 };
 EXPORT_SYMBOL_GPL(nand_ooblayout_lp_ops);
 
+/*
+ * Support the old "large page" layout used for 1-bit Hamming ECC where ECC
+ * are placed at a fixed offset.
+ */
+static int nand_ooblayout_ecc_lp_hamming(struct mtd_info *mtd, int section,
+					 struct mtd_oob_region *oobregion)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+
+	if (section)
+		return -ERANGE;
+
+	switch (mtd->oobsize) {
+	case 64:
+		oobregion->offset = 40;
+		break;
+	case 128:
+		oobregion->offset = 80;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	oobregion->length = ecc->total;
+	if (oobregion->offset + oobregion->length > mtd->oobsize)
+		return -ERANGE;
+
+	return 0;
+}
+
+static int nand_ooblayout_free_lp_hamming(struct mtd_info *mtd, int section,
+					  struct mtd_oob_region *oobregion)
+{
+	struct nand_chip *chip = mtd_to_nand(mtd);
+	struct nand_ecc_ctrl *ecc = &chip->ecc;
+	int ecc_offset = 0;
+
+	if (section < 0 || section > 1)
+		return -ERANGE;
+
+	switch (mtd->oobsize) {
+	case 64:
+		ecc_offset = 40;
+		break;
+	case 128:
+		ecc_offset = 80;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	if (section == 0) {
+		oobregion->offset = 2;
+		oobregion->length = ecc_offset - 2;
+	} else {
+		oobregion->offset = ecc_offset + ecc->total;
+		oobregion->length = mtd->oobsize - oobregion->offset;
+	}
+
+	return 0;
+}
+
+const struct mtd_ooblayout_ops nand_ooblayout_lp_hamming_ops = {
+	.ecc = nand_ooblayout_ecc_lp_hamming,
+	.free = nand_ooblayout_free_lp_hamming,
+};
+
 static int check_offs_len(struct mtd_info *mtd,
 					loff_t ofs, uint64_t len)
 {
@@ -4653,7 +4721,7 @@ int nand_scan_tail(struct mtd_info *mtd)
 			break;
 		case 64:
 		case 128:
-			mtd_set_ooblayout(mtd, &nand_ooblayout_lp_ops);
+			mtd_set_ooblayout(mtd, &nand_ooblayout_lp_hamming_ops);
 			break;
 		default:
 			WARN(1, "No oob scheme defined for oobsize %d\n",

[toc] | [prev] | [next] | [standalone]

#1648511 — [PATCH 4.11 137/197] ARM: 8662/1: module: split core and init PLT sections

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

commit b7ede5a1f5905ac394cc8e61712a13e3c5cb7b8f upstream.

Since commit 35fa91eed817 ("ARM: kernel: merge core and init PLTs"),
the ARM module PLT code allocates all PLT entries in a single core
section, since the overhead of having a separate init PLT section is
not justified by the small number of PLT entries usually required for
init code.

However, the core and init module regions are allocated independently,
and there is a corner case where the core region may be allocated from
the VMALLOC region if the dedicated module region is exhausted, but the
init region, being much smaller, can still be allocated from the module
region. This puts the PLT entries out of reach of the relocated branch
instructions, defeating the whole purpose of PLTs.

So split the core and init PLT regions, and name the latter ".init.plt"
so it gets allocated along with (and sufficiently close to) the .init
sections that it serves. Also, given that init PLT entries may need to
be emitted for branches that target the core module, modify the logic
that disregards defined symbols to only disregard symbols that are
defined in the same section.

Fixes: 35fa91eed817 ("ARM: kernel: merge core and init PLTs")
Reported-by: Angus Clark <angus@angusclark.org>
Tested-by: Angus Clark <angus@angusclark.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/include/asm/module.h |    9 +++-
 arch/arm/kernel/module-plts.c |   85 +++++++++++++++++++++++++++++-------------
 arch/arm/kernel/module.lds    |    1 
 3 files changed, 67 insertions(+), 28 deletions(-)

--- a/arch/arm/include/asm/module.h
+++ b/arch/arm/include/asm/module.h
@@ -18,13 +18,18 @@ enum {
 };
 #endif
 
+struct mod_plt_sec {
+	struct elf32_shdr	*plt;
+	int			plt_count;
+};
+
 struct mod_arch_specific {
 #ifdef CONFIG_ARM_UNWIND
 	struct unwind_table *unwind[ARM_SEC_MAX];
 #endif
 #ifdef CONFIG_ARM_MODULE_PLTS
-	struct elf32_shdr   *plt;
-	int		    plt_count;
+	struct mod_plt_sec	core;
+	struct mod_plt_sec	init;
 #endif
 };
 
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014 Linaro Ltd. <ard.biesheuvel@linaro.org>
+ * Copyright (C) 2014-2017 Linaro Ltd. <ard.biesheuvel@linaro.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -31,9 +31,17 @@ struct plt_entries {
 	u32	lit[PLT_ENT_COUNT];
 };
 
+static bool in_init(const struct module *mod, unsigned long loc)
+{
+	return loc - (u32)mod->init_layout.base < mod->init_layout.size;
+}
+
 u32 get_module_plt(struct module *mod, unsigned long loc, Elf32_Addr val)
 {
-	struct plt_entries *plt = (struct plt_entries *)mod->arch.plt->sh_addr;
+	struct mod_plt_sec *pltsec = !in_init(mod, loc) ? &mod->arch.core :
+							  &mod->arch.init;
+
+	struct plt_entries *plt = (struct plt_entries *)pltsec->plt->sh_addr;
 	int idx = 0;
 
 	/*
@@ -41,9 +49,9 @@ u32 get_module_plt(struct module *mod, u
 	 * relocations are sorted, this will be the last entry we allocated.
 	 * (if one exists).
 	 */
-	if (mod->arch.plt_count > 0) {
-		plt += (mod->arch.plt_count - 1) / PLT_ENT_COUNT;
-		idx = (mod->arch.plt_count - 1) % PLT_ENT_COUNT;
+	if (pltsec->plt_count > 0) {
+		plt += (pltsec->plt_count - 1) / PLT_ENT_COUNT;
+		idx = (pltsec->plt_count - 1) % PLT_ENT_COUNT;
 
 		if (plt->lit[idx] == val)
 			return (u32)&plt->ldr[idx];
@@ -53,8 +61,8 @@ u32 get_module_plt(struct module *mod, u
 			plt++;
 	}
 
-	mod->arch.plt_count++;
-	BUG_ON(mod->arch.plt_count * PLT_ENT_SIZE > mod->arch.plt->sh_size);
+	pltsec->plt_count++;
+	BUG_ON(pltsec->plt_count * PLT_ENT_SIZE > pltsec->plt->sh_size);
 
 	if (!idx)
 		/* Populate a new set of entries */
@@ -129,7 +137,7 @@ static bool duplicate_rel(Elf32_Addr bas
 
 /* Count how many PLT entries we may need */
 static unsigned int count_plts(const Elf32_Sym *syms, Elf32_Addr base,
-			       const Elf32_Rel *rel, int num)
+			       const Elf32_Rel *rel, int num, Elf32_Word dstidx)
 {
 	unsigned int ret = 0;
 	const Elf32_Sym *s;
@@ -144,13 +152,17 @@ static unsigned int count_plts(const Elf
 		case R_ARM_THM_JUMP24:
 			/*
 			 * We only have to consider branch targets that resolve
-			 * to undefined symbols. This is not simply a heuristic,
-			 * it is a fundamental limitation, since the PLT itself
-			 * is part of the module, and needs to be within range
-			 * as well, so modules can never grow beyond that limit.
+			 * to symbols that are defined in a different section.
+			 * This is not simply a heuristic, it is a fundamental
+			 * limitation, since there is no guaranteed way to emit
+			 * PLT entries sufficiently close to the branch if the
+			 * section size exceeds the range of a branch
+			 * instruction. So ignore relocations against defined
+			 * symbols if they live in the same section as the
+			 * relocation target.
 			 */
 			s = syms + ELF32_R_SYM(rel[i].r_info);
-			if (s->st_shndx != SHN_UNDEF)
+			if (s->st_shndx == dstidx)
 				break;
 
 			/*
@@ -161,7 +173,12 @@ static unsigned int count_plts(const Elf
 			 * So we need to support them, but there is no need to
 			 * take them into consideration when trying to optimize
 			 * this code. So let's only check for duplicates when
-			 * the addend is zero.
+			 * the addend is zero. (Note that calls into the core
+			 * module via init PLT entries could involve section
+			 * relative symbol references with non-zero addends, for
+			 * which we may end up emitting duplicates, but the init
+			 * PLT is released along with the rest of the .init
+			 * region as soon as module loading completes.)
 			 */
 			if (!is_zero_addend_relocation(base, rel + i) ||
 			    !duplicate_rel(base, rel, i))
@@ -174,7 +191,8 @@ static unsigned int count_plts(const Elf
 int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 			      char *secstrings, struct module *mod)
 {
-	unsigned long plts = 0;
+	unsigned long core_plts = 0;
+	unsigned long init_plts = 0;
 	Elf32_Shdr *s, *sechdrs_end = sechdrs + ehdr->e_shnum;
 	Elf32_Sym *syms = NULL;
 
@@ -184,13 +202,15 @@ int module_frob_arch_sections(Elf_Ehdr *
 	 */
 	for (s = sechdrs; s < sechdrs_end; ++s) {
 		if (strcmp(".plt", secstrings + s->sh_name) == 0)
-			mod->arch.plt = s;
+			mod->arch.core.plt = s;
+		else if (strcmp(".init.plt", secstrings + s->sh_name) == 0)
+			mod->arch.init.plt = s;
 		else if (s->sh_type == SHT_SYMTAB)
 			syms = (Elf32_Sym *)s->sh_addr;
 	}
 
-	if (!mod->arch.plt) {
-		pr_err("%s: module PLT section missing\n", mod->name);
+	if (!mod->arch.core.plt || !mod->arch.init.plt) {
+		pr_err("%s: module PLT section(s) missing\n", mod->name);
 		return -ENOEXEC;
 	}
 	if (!syms) {
@@ -213,16 +233,29 @@ int module_frob_arch_sections(Elf_Ehdr *
 		/* sort by type and symbol index */
 		sort(rels, numrels, sizeof(Elf32_Rel), cmp_rel, NULL);
 
-		plts += count_plts(syms, dstsec->sh_addr, rels, numrels);
+		if (strncmp(secstrings + dstsec->sh_name, ".init", 5) != 0)
+			core_plts += count_plts(syms, dstsec->sh_addr, rels,
+						numrels, s->sh_info);
+		else
+			init_plts += count_plts(syms, dstsec->sh_addr, rels,
+						numrels, s->sh_info);
 	}
 
-	mod->arch.plt->sh_type = SHT_NOBITS;
-	mod->arch.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
-	mod->arch.plt->sh_addralign = L1_CACHE_BYTES;
-	mod->arch.plt->sh_size = round_up(plts * PLT_ENT_SIZE,
-					  sizeof(struct plt_entries));
-	mod->arch.plt_count = 0;
+	mod->arch.core.plt->sh_type = SHT_NOBITS;
+	mod->arch.core.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
+	mod->arch.core.plt->sh_addralign = L1_CACHE_BYTES;
+	mod->arch.core.plt->sh_size = round_up(core_plts * PLT_ENT_SIZE,
+					       sizeof(struct plt_entries));
+	mod->arch.core.plt_count = 0;
+
+	mod->arch.init.plt->sh_type = SHT_NOBITS;
+	mod->arch.init.plt->sh_flags = SHF_EXECINSTR | SHF_ALLOC;
+	mod->arch.init.plt->sh_addralign = L1_CACHE_BYTES;
+	mod->arch.init.plt->sh_size = round_up(init_plts * PLT_ENT_SIZE,
+					       sizeof(struct plt_entries));
+	mod->arch.init.plt_count = 0;
 
-	pr_debug("%s: plt=%x\n", __func__, mod->arch.plt->sh_size);
+	pr_debug("%s: plt=%x, init.plt=%x\n", __func__,
+		 mod->arch.core.plt->sh_size, mod->arch.init.plt->sh_size);
 	return 0;
 }
--- a/arch/arm/kernel/module.lds
+++ b/arch/arm/kernel/module.lds
@@ -1,3 +1,4 @@
 SECTIONS {
 	.plt : { BYTE(0) }
+	.init.plt : { BYTE(0) }
 }

[toc] | [prev] | [next] | [standalone]

#1648513 — [PATCH 4.11 187/197] NFSv4: Fix a hang in OPEN related to server reboot

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 56e0d71ef12f026d96213e45a662bde6bbff4676 upstream.

If the server fails to return the attributes as part of an OPEN
reply, and then reboots, we can end up hanging. The reason is that
the client attempts to send a GETATTR in order to pick up the
missing OPEN call, but fails to release the slot first, causing
reboot recovery to deadlock.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Fixes: 2e80dbe7ac51a ("NFSv4.1: Close callback races for OPEN, LAYOUTGET...")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/nfs4proc.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -2300,8 +2300,10 @@ static int _nfs4_proc_open(struct nfs4_o
 		if (status != 0)
 			return status;
 	}
-	if (!(o_res->f_attr->valid & NFS_ATTR_FATTR))
+	if (!(o_res->f_attr->valid & NFS_ATTR_FATTR)) {
+		nfs4_sequence_free_slot(&o_res->seq_res);
 		nfs4_proc_getattr(server, &o_res->fh, o_res->f_attr, o_res->f_label);
+	}
 	return 0;
 }
 

[toc] | [prev] | [next] | [standalone]

#1648522 — [PATCH 4.11 186/197] drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Mario Kleiner <mario.kleiner.de@gmail.com>

commit e345da82bd6bdfa8492f80b3ce4370acfd868d95 upstream.

The builtin eDP panel in the HP zBook 17 G2 supports 10 bpc,
as advertised by the Laptops product specs and verified via
injecting a fixed edid + photometer measurements, but edid
reports unknown depth, so drivers fall back to 6 bpc.

Add a quirk to get the full 10 bpc.

Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Acked-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1492787108-23959-1-git-send-email-mario.kleiner.de@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/drm_edid.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -79,6 +79,8 @@
 #define EDID_QUIRK_FORCE_12BPC			(1 << 9)
 /* Force 6bpc */
 #define EDID_QUIRK_FORCE_6BPC			(1 << 10)
+/* Force 10bpc */
+#define EDID_QUIRK_FORCE_10BPC			(1 << 11)
 
 struct detailed_mode_closure {
 	struct drm_connector *connector;
@@ -121,6 +123,9 @@ static const struct edid_quirk {
 	{ "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 |
 	  EDID_QUIRK_DETAILED_IN_CM },
 
+	/* LGD panel of HP zBook 17 G2, eDP 10 bpc, but reports unknown bpc */
+	{ "LGD", 764, EDID_QUIRK_FORCE_10BPC },
+
 	/* LG Philips LCD LP154W01-A5 */
 	{ "LPL", 0, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE },
 	{ "LPL", 0x2a00, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE },
@@ -4174,6 +4179,9 @@ int drm_add_edid_modes(struct drm_connec
 	if (quirks & EDID_QUIRK_FORCE_8BPC)
 		connector->display_info.bpc = 8;
 
+	if (quirks & EDID_QUIRK_FORCE_10BPC)
+		connector->display_info.bpc = 10;
+
 	if (quirks & EDID_QUIRK_FORCE_12BPC)
 		connector->display_info.bpc = 12;
 

[toc] | [prev] | [next] | [standalone]

#1648524 — [PATCH 4.11 129/197] powerpc/64e: Fix hang when debugging programs with relocated kernel

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: LiuHailong <liu.hailong6@zte.com.cn>

commit fd615f69a18a9d4aa5ef02a1dc83f319f75da8e7 upstream.

Debug interrupts can be taken during interrupt entry, since interrupt
entry does not automatically turn them off.  The kernel will check
whether the faulting instruction is between [interrupt_base_book3e,
__end_interrupts], and if so clear MSR[DE] and return.

However, when the kernel is built with CONFIG_RELOCATABLE, it can't use
LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) and
LOAD_REG_IMMEDIATE(r15,__end_interrupts), as they ignore relocation.
Thus, if the kernel is actually running at a different address than it
was built at, the address comparison will fail, and the exception entry
code will hang at kernel_dbg_exc.

r2(toc) is also not usable here, as r2 still holds data from the
interrupted context, so LOAD_REG_ADDR() doesn't work either.  So we use
the *name@got* to get the EV of two labels directly.

Test programs test.c shows as follows:
int main(int argc, char *argv[])
{
	if (access("/proc/sys/kernel/perf_event_paranoid", F_OK) == -1)
		printf("Kernel doesn't have perf_event support\n");
}

Steps to reproduce the bug, for example:
 1) ./gdb ./test
 2) (gdb) b access
 3) (gdb) r
 4) (gdb) s

Signed-off-by: Liu Hailong <liu.hailong6@zte.com.cn>
Signed-off-by: Jiang Xuexin <jiang.xuexin@zte.com.cn>
Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
Reviewed-by: Liu Song <liu.song11@zte.com.cn>
Reviewed-by: Huang Jian <huang.jian@zte.com.cn>
[scottwood: cleaned up commit message, and specified bad behavior
 as a hang rather than an oops to correspond to mainline kernel behavior]
Fixes: 1cb6e0649248 ("powerpc/book3e: support CONFIG_RELOCATABLE")
Signed-off-by: Scott Wood <oss@buserror.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/powerpc/kernel/exceptions-64e.S |   12 ++++++++++++
 1 file changed, 12 insertions(+)

--- a/arch/powerpc/kernel/exceptions-64e.S
+++ b/arch/powerpc/kernel/exceptions-64e.S
@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC)
 	andis.	r15,r14,(DBSR_IC|DBSR_BT)@h
 	beq+	1f
 
+#ifdef CONFIG_RELOCATABLE
+	ld	r15,PACATOC(r13)
+	ld	r14,interrupt_base_book3e@got(r15)
+	ld	r15,__end_interrupts@got(r15)
+#else
 	LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
 	LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
 	cmpld	cr0,r10,r14
 	cmpld	cr1,r10,r15
 	blt+	cr0,1f
@@ -799,8 +805,14 @@ kernel_dbg_exc:
 	andis.	r15,r14,(DBSR_IC|DBSR_BT)@h
 	beq+	1f
 
+#ifdef CONFIG_RELOCATABLE
+	ld	r15,PACATOC(r13)
+	ld	r14,interrupt_base_book3e@got(r15)
+	ld	r15,__end_interrupts@got(r15)
+#else
 	LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e)
 	LOAD_REG_IMMEDIATE(r15,__end_interrupts)
+#endif
 	cmpld	cr0,r10,r14
 	cmpld	cr1,r10,r15
 	blt+	cr0,1f

[toc] | [prev] | [next] | [standalone]

#1648526 — [PATCH 4.11 172/197] firmware: ti_sci: fix strncat length check

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>

commit 76cefef8e838304a71725a0b5007c375619d78fb upstream.

gcc-7 notices that the length we pass to strncat is wrong:

drivers/firmware/ti_sci.c: In function 'ti_sci_probe':
drivers/firmware/ti_sci.c:204:32: error: specified bound 50 equals the size of the destination [-Werror=stringop-overflow=]

Instead of the total length, we must pass the length of the
remaining space here.

Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
Acked-by: Nishanth Menon <nm@ti.com>
Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/firmware/ti_sci.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -202,7 +202,8 @@ static int ti_sci_debugfs_create(struct
 	info->debug_buffer[info->debug_region_size] = 0;
 
 	info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
-					      sizeof(debug_name)),
+					      sizeof(debug_name) -
+					      sizeof("ti_sci_debug@")),
 				      0444, NULL, info, &ti_sci_debug_fops);
 	if (IS_ERR(info->d))
 		return PTR_ERR(info->d);

[toc] | [prev] | [next] | [standalone]

#1648527 — [PATCH 4.11 179/197] PCI: Fix pci_mmap_fits() for HAVE_PCI_RESOURCE_TO_USER platforms

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Woodhouse <dwmw@amazon.co.uk>

commit 6bccc7f426abd640f08d8c75fb22f99483f201b4 upstream.

In the PCI_MMAP_PROCFS case when the address being passed by the user is a
'user visible' resource address based on the bus window, and not the actual
contents of the resource, that's what we need to be checking it against.

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/pci/pci-sysfs.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -985,15 +985,19 @@ void pci_remove_legacy_files(struct pci_
 int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma,
 		  enum pci_mmap_api mmap_api)
 {
-	unsigned long nr, start, size, pci_start;
+	unsigned long nr, start, size;
+	resource_size_t pci_start = 0, pci_end;
 
 	if (pci_resource_len(pdev, resno) == 0)
 		return 0;
 	nr = vma_pages(vma);
 	start = vma->vm_pgoff;
 	size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1;
-	pci_start = (mmap_api == PCI_MMAP_PROCFS) ?
-			pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0;
+	if (mmap_api == PCI_MMAP_PROCFS) {
+		pci_resource_to_user(pdev, resno, &pdev->resource[resno],
+				     &pci_start, &pci_end);
+		pci_start >>= PAGE_SHIFT;
+	}
 	if (start >= pci_start && start < pci_start + size &&
 			start + nr <= pci_start + size)
 		return 1;

[toc] | [prev] | [next] | [standalone]

#1648528 — [PATCH 4.11 148/197] arm64: traps: fix userspace cache maintenance emulation on a tagged pointer

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kristina Martsenko <kristina.martsenko@arm.com>

commit 81cddd65b5c82758ea5571a25e31ff6f1f89ff02 upstream.

When we emulate userspace cache maintenance in the kernel, we can
currently send the task a SIGSEGV even though the maintenance was done
on a valid address. This happens if the address has a non-zero address
tag, and happens to not be mapped in.

When we get the address from a user register, we don't currently remove
the address tag before performing cache maintenance on it. If the
maintenance faults, we end up in either __do_page_fault, where find_vma
can't find the VMA if the address has a tag, or in do_translation_fault,
where the tagged address will appear to be above TASK_SIZE. In both
cases, the address is not mapped in, and the task is sent a SIGSEGV.

This patch removes the tag from the address before using it. With this
patch, the fault is handled correctly, the address gets mapped in, and
the cache maintenance succeeds.

As a second bug, if cache maintenance (correctly) fails on an invalid
tagged address, the address gets passed into arm64_notify_segfault,
where find_vma fails to find the VMA due to the tag, and the wrong
si_code may be sent as part of the siginfo_t of the segfault. With this
patch, the correct si_code is sent.

Fixes: 7dd01aef0557 ("arm64: trap userspace "dc cvau" cache operation on errata-affected core")
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/traps.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -443,7 +443,7 @@ int cpu_enable_cache_maint_trap(void *__
 }
 
 #define __user_cache_maint(insn, address, res)			\
-	if (untagged_addr(address) >= user_addr_max()) {	\
+	if (address >= user_addr_max()) {			\
 		res = -EFAULT;					\
 	} else {						\
 		uaccess_ttbr0_enable();				\
@@ -469,7 +469,7 @@ static void user_cache_maint_handler(uns
 	int crm = (esr & ESR_ELx_SYS64_ISS_CRM_MASK) >> ESR_ELx_SYS64_ISS_CRM_SHIFT;
 	int ret = 0;
 
-	address = pt_regs_read_reg(regs, rt);
+	address = untagged_addr(pt_regs_read_reg(regs, rt));
 
 	switch (crm) {
 	case ESR_ELx_SYS64_ISS_CRM_DC_CVAU:	/* DC CVAU, gets promoted */

[toc] | [prev] | [next] | [standalone]

#1648713 — [PATCH 4.11 158/197] cpuidle: check dev before usage in cpuidle_use_deepest_state()

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Li, Fei <fei.li@intel.com>

commit 41dc750ea67f317c0deedde713d1728425524ef2 upstream.

In case of there is no cpuidle devices registered, dev will be null, and
panic will be triggered like below;
In this patch, add checking of dev before usage, like that done in
cpuidle_idle_call.

Panic without fix:
[  184.961328] BUG: unable to handle kernel NULL pointer dereference at
  (null)
[  184.961328] IP: cpuidle_use_deepest_state+0x30/0x60
...
[  184.961328]  play_idle+0x8d/0x210
[  184.961328]  ? __schedule+0x359/0x8e0
[  184.961328]  ? _raw_spin_unlock_irqrestore+0x28/0x50
[  184.961328]  ? kthread_queue_delayed_work+0x41/0x80
[  184.961328]  clamp_idle_injection_func+0x64/0x1e0

Fixes: bb8313b603eb8 (cpuidle: Allow enforcing deepest idle state selection)
Signed-off-by: Li, Fei <fei.li@intel.com>
Tested-by: Shi, Feng <fengx.shi@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/cpuidle/cpuidle.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -111,7 +111,8 @@ void cpuidle_use_deepest_state(bool enab
 
 	preempt_disable();
 	dev = cpuidle_get_device();
-	dev->use_deepest_state = enable;
+	if (dev)
+		dev->use_deepest_state = enable;
 	preempt_enable();
 }
 

[toc] | [prev] | [next] | [standalone]

#1648850 — [PATCH 4.11 191/197] NFSv4: Fix an rcu lock leak

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 2e84611b3f4fa50e1f4c12f2966fcc7fb955d944 upstream.

The intention in the original patch was to release the lock when
we put the inode, however something got screwed up.

Reported-by: Jason Yan <yanaijie@huawei.com>
Fixes: 7b410d9ce460f ("pNFS: Delay getting the layout header in..")
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/callback_proc.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/fs/nfs/callback_proc.c
+++ b/fs/nfs/callback_proc.c
@@ -131,10 +131,11 @@ restart:
 			if (!inode)
 				continue;
 			if (!nfs_sb_active(inode->i_sb)) {
-				rcu_read_lock();
+				rcu_read_unlock();
 				spin_unlock(&clp->cl_lock);
 				iput(inode);
 				spin_lock(&clp->cl_lock);
+				rcu_read_lock();
 				goto restart;
 			}
 			return inode;
@@ -170,10 +171,11 @@ restart:
 			if (!inode)
 				continue;
 			if (!nfs_sb_active(inode->i_sb)) {
-				rcu_read_lock();
+				rcu_read_unlock();
 				spin_unlock(&clp->cl_lock);
 				iput(inode);
 				spin_lock(&clp->cl_lock);
+				rcu_read_lock();
 				goto restart;
 			}
 			return inode;

[toc] | [prev] | [next] | [standalone]

#1648851 — [PATCH 4.11 197/197] IB/hfi1: Protect the global dev_cntr_names and port_cntr_names

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tadeusz Struk <tadeusz.struk@intel.com>

commit 62eed66e98b4c2286fef2ce5911d8d75b7515f7b upstream.

Protect the global dev_cntr_names and port_cntr_names with the global
mutex as they are allocated and freed in a function called per device.
Otherwise there is a danger of double free and memory leaks.

Fixes: Commit b7481944b06e ("IB/hfi1: Show statistics counters under IB stats interface")
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Reviewed-by: Easwar Hariharan <easwar.hariharan@intel.com>
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/infiniband/hw/hfi1/verbs.c |   12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1524,6 +1524,7 @@ static const char * const driver_cntr_na
 	"DRIVER_EgrHdrFull"
 };
 
+static DEFINE_MUTEX(cntr_names_lock); /* protects the *_cntr_names bufers */
 static const char **dev_cntr_names;
 static const char **port_cntr_names;
 static int num_driver_cntrs = ARRAY_SIZE(driver_cntr_names);
@@ -1578,6 +1579,7 @@ static struct rdma_hw_stats *alloc_hw_st
 {
 	int i, err;
 
+	mutex_lock(&cntr_names_lock);
 	if (!cntr_names_initialized) {
 		struct hfi1_devdata *dd = dd_from_ibdev(ibdev);
 
@@ -1586,8 +1588,10 @@ static struct rdma_hw_stats *alloc_hw_st
 				      num_driver_cntrs,
 				      &num_dev_cntrs,
 				      &dev_cntr_names);
-		if (err)
+		if (err) {
+			mutex_unlock(&cntr_names_lock);
 			return NULL;
+		}
 
 		for (i = 0; i < num_driver_cntrs; i++)
 			dev_cntr_names[num_dev_cntrs + i] =
@@ -1601,10 +1605,12 @@ static struct rdma_hw_stats *alloc_hw_st
 		if (err) {
 			kfree(dev_cntr_names);
 			dev_cntr_names = NULL;
+			mutex_unlock(&cntr_names_lock);
 			return NULL;
 		}
 		cntr_names_initialized = 1;
 	}
+	mutex_unlock(&cntr_names_lock);
 
 	if (!port_num)
 		return rdma_alloc_hw_stats_struct(
@@ -1823,9 +1829,13 @@ void hfi1_unregister_ib_device(struct hf
 	del_timer_sync(&dev->mem_timer);
 	verbs_txreq_exit(dev);
 
+	mutex_lock(&cntr_names_lock);
 	kfree(dev_cntr_names);
 	kfree(port_cntr_names);
+	dev_cntr_names = NULL;
+	port_cntr_names = NULL;
 	cntr_names_initialized = 0;
+	mutex_unlock(&cntr_names_lock);
 }
 
 void hfi1_cnp_rcv(struct hfi1_packet *packet)

[toc] | [prev] | [next] | [standalone]

#1648853 — [PATCH 4.11 194/197] nfsd: Fix up the "supattr_exclcreat" attributes

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit b26b78cb726007533d81fdf90a62e915002ef5c8 upstream.

If an NFSv4 client asks us for the supattr_exclcreat, then we must
not return attributes that are unsupported by this minor version.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Fixes: 75976de6556f ("NFSD: Return word2 bitmask if setting security..,")
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfs4xdr.c |   11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -2831,9 +2831,14 @@ out_acl:
 	}
 #endif /* CONFIG_NFSD_PNFS */
 	if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
-		status = nfsd4_encode_bitmap(xdr, NFSD_SUPPATTR_EXCLCREAT_WORD0,
-						  NFSD_SUPPATTR_EXCLCREAT_WORD1,
-						  NFSD_SUPPATTR_EXCLCREAT_WORD2);
+		u32 supp[3];
+
+		memcpy(supp, nfsd_suppattrs[minorversion], sizeof(supp));
+		supp[0] &= NFSD_SUPPATTR_EXCLCREAT_WORD0;
+		supp[1] &= NFSD_SUPPATTR_EXCLCREAT_WORD1;
+		supp[2] &= NFSD_SUPPATTR_EXCLCREAT_WORD2;
+
+		status = nfsd4_encode_bitmap(xdr, supp[0], supp[1], supp[2]);
 		if (status)
 			goto out;
 	}

[toc] | [prev] | [next] | [standalone]

#1648854 — [PATCH 4.11 190/197] pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Trond Myklebust <trond.myklebust@primarydata.com>

commit 260f32adb88dadfaac29f47f761a088238ca164c upstream.

The check in nfs4_ff_layout_prepare_ds() seems to be missing.

Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Fixes: a33e4b036d461 ("pNFS: return status from nfs4_pnfs_ds_connect")
Cc: Weston Andros Adamson <dros@primarydata.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfs/flexfilelayout/flexfilelayoutdev.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
@@ -415,7 +415,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_la
 			     mirror->mirror_ds->ds_versions[0].minor_version);
 
 	/* connect success, check rsize/wsize limit */
-	if (ds->ds_clp) {
+	if (!status) {
 		max_payload =
 			nfs_block_size(rpc_max_payload(ds->ds_clp->cl_rpcclient),
 				       NULL);

[toc] | [prev] | [next] | [standalone]

#1648860 — [PATCH 4.11 165/197] MIPS: Loongson-3: Select MIPS_L1_CACHE_SHIFT_6

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Huacai Chen <chenhc@lemote.com>

commit 17c99d9421695a0e0de18bf1e7091d859e20ec1d upstream.

Some newer Loongson-3 have 64 bytes cache lines, so select
MIPS_L1_CACHE_SHIFT_6.

Signed-off-by: Huacai Chen <chenhc@lemote.com>
Cc: John Crispin <john@phrozen.org>
Cc: Steven J . Hill <Steven.Hill@caviumnetworks.com>
Cc: Fuxin Zhang <zhangfx@lemote.com>
Cc: Zhangjin Wu <wuzhangjin@gmail.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/15755/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/mips/Kconfig |    1 +
 1 file changed, 1 insertion(+)

--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1373,6 +1373,7 @@ config CPU_LOONGSON3
 	select WEAK_ORDERING
 	select WEAK_REORDERING_BEYOND_LLSC
 	select MIPS_PGD_C0_CONTEXT
+	select MIPS_L1_CACHE_SHIFT_6
 	select GPIOLIB
 	help
 		The Loongson 3 processor implements the MIPS64R2 instruction

[toc] | [prev] | [next] | [standalone]

#1648861 — [PATCH 4.11 159/197] metag/uaccess: Fix access_ok()

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: James Hogan <james.hogan@imgtec.com>

commit 8a8b56638bcac4e64cccc88bf95a0f9f4b19a2fb upstream.

The __user_bad() macro used by access_ok() has a few corner cases
noticed by Al Viro where it doesn't behave correctly:

 - The kernel range check has off by 1 errors which permit access to the
   first and last byte of the kernel mapped range.

 - The kernel range check ends at LINCORE_BASE rather than
   META_MEMORY_LIMIT, which is ineffective when the kernel is in global
   space (an extremely uncommon configuration).

There are a couple of other shortcomings here too:

 - Access to the whole of the other address space is permitted (i.e. the
   global half of the address space when the kernel is in local space).
   This isn't ideal as it could theoretically still contain privileged
   mappings set up by the bootloader.

 - The size argument is unused, permitting user copies which start on
   valid pages at the end of the user address range and cross the
   boundary into the kernel address space (e.g. addr = 0x3ffffff0, size
   > 0x10).

It isn't very convenient to add size checks when disallowing certain
regions, and it seems far safer to be sure and explicit about what
userland is able to access, so invert the logic to allow certain regions
instead, and fix the off by 1 errors and missing size checks. This also
allows the get_fs() == KERNEL_DS check to be more easily optimised into
the user address range case.

We now have 3 such allowed regions:

 - The user address range (incorporating the get_fs() == KERNEL_DS
   check).

 - NULL (some kernel code expects this to work, and we'll always catch
   the fault anyway).

 - The core code memory region.

Fixes: 373cd784d0fc ("metag: Memory handling")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: linux-metag@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/include/asm/uaccess.h |   40 +++++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 16 deletions(-)

--- a/arch/metag/include/asm/uaccess.h
+++ b/arch/metag/include/asm/uaccess.h
@@ -28,24 +28,32 @@
 
 #define segment_eq(a, b)	((a).seg == (b).seg)
 
-#define __kernel_ok (segment_eq(get_fs(), KERNEL_DS))
-/*
- * Explicitly allow NULL pointers here. Parts of the kernel such
- * as readv/writev use access_ok to validate pointers, but want
- * to allow NULL pointers for various reasons. NULL pointers are
- * safe to allow through because the first page is not mappable on
- * Meta.
- *
- * We also wish to avoid letting user code access the system area
- * and the kernel half of the address space.
- */
-#define __user_bad(addr, size) (((addr) > 0 && (addr) < META_MEMORY_BASE) || \
-				((addr) > PAGE_OFFSET &&		\
-				 (addr) < LINCORE_BASE))
-
 static inline int __access_ok(unsigned long addr, unsigned long size)
 {
-	return __kernel_ok || !__user_bad(addr, size);
+	/*
+	 * Allow access to the user mapped memory area, but not the system area
+	 * before it. The check extends to the top of the address space when
+	 * kernel access is allowed (there's no real reason to user copy to the
+	 * system area in any case).
+	 */
+	if (likely(addr >= META_MEMORY_BASE && addr < get_fs().seg &&
+		   size <= get_fs().seg - addr))
+		return true;
+	/*
+	 * Explicitly allow NULL pointers here. Parts of the kernel such
+	 * as readv/writev use access_ok to validate pointers, but want
+	 * to allow NULL pointers for various reasons. NULL pointers are
+	 * safe to allow through because the first page is not mappable on
+	 * Meta.
+	 */
+	if (!addr)
+		return true;
+	/* Allow access to core code memory area... */
+	if (addr >= LINCORE_CODE_BASE && addr <= LINCORE_CODE_LIMIT &&
+	    size <= LINCORE_CODE_LIMIT + 1 - addr)
+		return true;
+	/* ... but no other areas. */
+	return false;
 }
 
 #define access_ok(type, addr, size) __access_ok((unsigned long)(addr),	\

[toc] | [prev] | [next] | [standalone]

#1648868 — [PATCH 4.11 168/197] kvm: arm/arm64: Force reading uncached stage2 PGD

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Suzuki K Poulose <suzuki.poulose@arm.com>

commit 2952a6070e07ebdd5896f1f5b861acad677caded upstream.

Make sure we don't use a cached value of the KVM stage2 PGD while
resetting the PGD.

Cc: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Christoffer Dall <cdall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm/kvm/mmu.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -844,7 +844,7 @@ void kvm_free_stage2_pgd(struct kvm *kvm
 	spin_lock(&kvm->mmu_lock);
 	if (kvm->arch.pgd) {
 		unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE);
-		pgd = kvm->arch.pgd;
+		pgd = READ_ONCE(kvm->arch.pgd);
 		kvm->arch.pgd = NULL;
 	}
 	spin_unlock(&kvm->mmu_lock);

[toc] | [prev] | [next] | [standalone]

#1648876 — [PATCH 4.11 192/197] nfsd: fix undefined behavior in nfsd4_layout_verify

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ari Kauppi <ari@synopsys.com>

commit b550a32e60a4941994b437a8d662432a486235a5 upstream.

  UBSAN: Undefined behaviour in fs/nfsd/nfs4proc.c:1262:34
  shift exponent 128 is too large for 32-bit type 'int'

Depending on compiler+architecture, this may cause the check for
layout_type to succeed for overly large values (which seems to be the
case with amd64). The large value will be later used in de-referencing
nfsd4_layout_ops for function pointers.

Reported-by: Jani Tuovila <tuovila@synopsys.com>
Signed-off-by: Ari Kauppi <ari@synopsys.com>
[colin.king@canonical.com: use LAYOUT_TYPE_MAX instead of 32]
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/nfsd/nfs4proc.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -1259,7 +1259,8 @@ nfsd4_layout_verify(struct svc_export *e
 		return NULL;
 	}
 
-	if (!(exp->ex_layout_types & (1 << layout_type))) {
+	if (layout_type >= LAYOUT_TYPE_MAX ||
+	    !(exp->ex_layout_types & (1 << layout_type))) {
 		dprintk("%s: layout type %d not supported\n",
 			__func__, layout_type);
 		return NULL;

[toc] | [prev] | [next] | [standalone]

#1648878 — [PATCH 4.11 176/197] PCI/ACPI: Add ThunderX pass2.x 2nd node MCFG quirk

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Tomasz Nowicki <tn@semihalf.com>

commit cd183740480f045600aa1fa38fe70809b5498f05 upstream.

Currently SoCs pass2.x do not emulate EA headers for ACPI boot method at
all.  However, for pass2.x some devices (like EDAC) advertise incorrect
base addresses in their BARs which results in driver probe failure during
resource request.  Since all problematic blocks are on 2nd NUMA node under
domain 10 add necessary quirk entry to obtain BAR addresses correction
using EA header emulation.

Fixes: 44f22bd91e88 ("PCI: Add MCFG quirks for Cavium ThunderX pass2.x host controller")
Signed-off-by: Tomasz Nowicki <tn@semihalf.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Robert Richter <rrichter@cavium.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/pci_mcfg.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/acpi/pci_mcfg.c
+++ b/drivers/acpi/pci_mcfg.c
@@ -101,6 +101,7 @@ static struct mcfg_fixup mcfg_quirks[] =
 	/* SoC pass2.x */
 	THUNDER_PEM_QUIRK(1, 0),
 	THUNDER_PEM_QUIRK(1, 1),
+	THUNDER_ECAM_QUIRK(1, 10),
 
 	/* SoC pass1.x */
 	THUNDER_PEM_QUIRK(2, 0),	/* off-chip devices */

[toc] | [prev] | [next] | [standalone]

#1648879 — [PATCH 4.11 120/197] [media] cx231xx-audio: fix NULL-deref at probe

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 65f921647f4c89a2068478c89691f39b309b58f7 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory beyond the endpoint array should a
malicious device lack the expected endpoints.

Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver")

Cc: Sri Deevi <Srinivasa.Deevi@conexant.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/media/usb/cx231xx/cx231xx-audio.c |   17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

--- a/drivers/media/usb/cx231xx/cx231xx-audio.c
+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c
@@ -697,6 +697,11 @@ static int cx231xx_audio_init(struct cx2
 					    hs_config_info[0].interface_info.
 					    audio_index + 1];
 
+	if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) {
+		err = -ENODEV;
+		goto err_free_card;
+	}
+
 	adev->end_point_addr =
 	    uif->altsetting[0].endpoint[isoc_pipe].desc.
 			bEndpointAddress;
@@ -712,8 +717,14 @@ static int cx231xx_audio_init(struct cx2
 	}
 
 	for (i = 0; i < adev->num_alt; i++) {
-		u16 tmp =
-		    le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
+		u16 tmp;
+
+		if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) {
+			err = -ENODEV;
+			goto err_free_pkt_size;
+		}
+
+		tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.
 				wMaxPacketSize);
 		adev->alt_max_pkt_size[i] =
 		    (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1);
@@ -724,6 +735,8 @@ static int cx231xx_audio_init(struct cx2
 
 	return 0;
 
+err_free_pkt_size:
+	kfree(adev->alt_max_pkt_size);
 err_free_card:
 	snd_card_free(card);
 

[toc] | [prev] | [next] | [standalone]

Page 4 of 9 — ← Prev page 1 2 3 [4] 5 6 7 8 9  Next page →

Back to top | Article view | linux.kernel

csiph-web