Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1669592 > unrolled thread

[PATCH 3.10 000/268] 3.10.107-stable review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.10 000/268] 3.10.107-stable review Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 088/268] HID: hid-cypress: validate length of report Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 056/268] usb: dwc3: gadget: delay unmap of bounced requests Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 218/268] HID: i2c-hid: Add sleep between POWER ON and RESET Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 196/268] igb: add i211 to i210 PHY workaround Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 263/268] tun: read vnet_hdr_sz once Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 079/268] sg_write()/bsg_write() is not fit to be called under KERNEL_DS Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 174/268] crypto: improve gcc optimization flags for serpent and wp512 Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 260/268] nfsd: check for oversized NFSv2/v3 arguments Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 153/268] af_packet: remove a stray tab in packet_set_ring() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 194/268] cpufreq: Fix and clean up show_cpuinfo_cur_freq() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 259/268] p9_client_readdir() fix Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 101/268] pinctrl: sh-pfc: Do not unconditionally support PIN_CONFIG_BIAS_DISABLE Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 034/268] can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 234/268] xen, fbfront: fix connecting to backend Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 009/268] ext4: trim allocation requests to group size Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 073/268] scsi: sr: Sanity check returned mode data Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 180/268] dccp: Unlock sock before calling sk_free() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 221/268] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 092/268] Input: kbtab - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 053/268] USB: cdc-acm: fix failed open not being detected Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 182/268] uapi: fix linux/packet_diag.h userspace compilation error Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 187/268] give up on gcc ilog2() constant optimizations Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 063/268] xfs: clear _XBF_PAGES from buffers when readahead page Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 085/268] drop_monitor: add missing call to genlmsg_end Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 179/268] net: don't call strlen() on the user buffer in packet_bind_spkt() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 052/268] USB: cdc-acm: fix open and suspend race Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 099/268] vme: Fix wrong pointer utilization in ca91cx42_slave_get Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 004/268] ext4: fix in-superblock mount options processing Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 062/268] xfs: set AGI buffer type in xlog_recover_clear_agi_bucket Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 051/268] USB: cdc-acm: fix double usb_autopm_put_interface() in acm_port_activate() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 157/268] sd: get disk reference in sd_check_events() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 225/268] metag/usercopy: Drop unused macros Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 005/268] ext4: add sanity checking to count_overhead() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 113/268] apparmor: exec should not be returning ENOENT when it denies Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 205/268] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 145/268] packet: round up linear to header len Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 202/268] fbcon: Fix vc attr at deinit Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 211/268] ACPI: Fix incompatibility with mcount-based function graph tracing Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 089/268] Input: xpad - use correct product id for x360w controllers Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 164/268] KVM: VMX: use correct vmcs_read/write for guest segment selector/base Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 040/268] ALSA: seq: Fix racy cell insertions during snd_seq_pool_done() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 013/268] block: fix use-after-free in sys_ioprio_get() Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 201/268] uvcvideo: uvc_scan_fallback() for webcams with broken chain Willy Tarreau <w@1wt.eu> - 2017-06-19 20:40 +0200
    [PATCH 3.10 199/268] ACM gadget: fix endianness in notifications Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 118/268] apparmor: don't check for vmalloc_addr if kvzalloc() failed Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 027/268] ocfs2: fix crash caused by stale lvb with fsdlm plugin Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 095/268] Input: mpr121 - handle multiple bits change of status register Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 192/268] Drivers: hv: balloon: don't crash when memory is added in non-sorted order Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 038/268] ALSA: timer: Reject user params with too small ticks Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 123/268] bna: Add synchronization for tx ring. Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 186/268] futex: Add missing error handling to FUTEX_REQUEUE_PI Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 046/268] USB: gadgetfs: fix use-after-free bug Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 247/268] powerpc: Reject binutils 2.24 when building little endian Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 103/268] qla2xxx: Fix crash due to null pointer access Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 177/268] mvsas: fix misleading indentation Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 120/268] apparmor: fix module parameters can be changed after policy is locked Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 147/268] siano: make it work again with CONFIG_VMAP_STACK Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 125/268] move the call of __d_drop(anon) into __d_materialise_unique(dentry, anon) Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 132/268] parisc: Don't use BITS_PER_LONG in userspace-exported swab.h header Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 076/268] libceph: verify authorize reply on connect Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 236/268] platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 226/268] metag/usercopy: Zero rest of buffer from copy_from_user Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 024/268] CIFS: remove bad_network_name flag Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 262/268] kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 173/268] xhci: fix 10 second timeout on removal of PCI hotpluggable xhci controllers Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 235/268] char: lack of bool string made CONFIG_DEVPORT always on Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 227/268] powerpc: Don't try to fix up misaligned load-with-reservation instructions Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 114/268] apparmor: fix disconnected bind mnts reconnection Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 250/268] tty: nozomi: avoid a harmless gcc warning Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 070/268] scsi: storvsc: properly set residual data length on errors Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 267/268] x86/mm/32: Enable full randomization on i386 and X86_32 Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 152/268] rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 041/268] ALSA: seq: Fix race during FIFO resize Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 233/268] iscsi-target: Drop work-around for legacy GlobalSAN initiator Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 251/268] hostap: avoid uninitialized variable use in hfa384x_get_rid Willy Tarreau <w@1wt.eu> - 2017-06-19 20:50 +0200
    [PATCH 3.10 148/268] futex: Move futex_init() to core_initcall Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 138/268] ata: sata_mv:- Handle return value of devm_ioremap. Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 210/268] libceph: force GFP_NOIO for socket allocations Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 017/268] dm space map metadata: fix 'struct sm_metadata' leak on failed create Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 098/268] i2c: fix kernel memory disclosure in dev interface Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 217/268] HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2 Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 082/268] net: ti: cpmac: Fix compiler warning due to type confusion Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 212/268] ACPI / power: Avoid maybe-uninitialized warning Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 128/268] tile/ptrace: Preserve previous registers for short regset write Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 035/268] ALSA: hda - Fix up GPIO for ASUS ROG Ranger Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 237/268] platform/x86: acer-wmi: setup accelerometer when ACPI device was found Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 057/268] usb: hub: Wait for connection to be reestablished after port reset Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 144/268] macvtap: read vnet_hdr_size once Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 176/268] cpmac: remove hopeless #warning Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 048/268] xhci: free xhci virtual devices with leaf nodes first Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 167/268] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 150/268] irda: Fix lockdep annotations in hashbin_delete(). Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 097/268] Input: i8042 - add Clevo P650RS to the i8042 reset list Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 104/268] ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 231/268] x86/vdso: Plug race between mapping and ELF header setup Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 220/268] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 091/268] Input: iforce - validate number of endpoints before using them Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 122/268] vfio/pci: Fix integer overflows, bitmask check Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 166/268] s390: TASK_SIZE for kernel threads Willy Tarreau <w@1wt.eu> - 2017-06-19 21:00 +0200
    [PATCH 3.10 011/268] ext4: return EROFS if device is r/o and journal replay is needed Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 119/268] apparmor: fix oops in profile_unpack() when policy_db is not present Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 109/268] Compare prepaths when comparing superblocks Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 209/268] metag/ptrace: Reject partial NT_METAG_RPIPE writes Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 110/268] Move check for prefix path to within cifs_get_root() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 169/268] drm/ast: Fix test for VGA enabled Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 191/268] ACPI / video: skip evaluating _DOD when it does not exist Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 204/268] virtio_balloon: init 1st buffer in stats vq Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 193/268] s390/pci: fix use after free in dma_init Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 030/268] can: peak: fix bad memory access and free sequence Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 230/268] net/packet: fix overflow in check for priv area size Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 069/268] scsi: storvsc: properly handle SRB_ERROR when sense message is present Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 083/268] tick/broadcast: Prevent NULL pointer dereference Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 240/268] catc: Combine failure cleanup code in catc_probe() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 190/268] crypto: cryptd - Assign statesize properly Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 244/268] Drivers: hv: get rid of timeout in vmbus_open() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 252/268] gfs2: avoid uninitialized variable warning Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 127/268] bnx2x: Correct ringparam estimate when DOWN Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 121/268] apparmor: do not expose kernel stack Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 165/268] KVM: PPC: Book3S PR: Fix illegal opcode emulation Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 139/268] mm/memory_hotplug.c: check start_pfn in test_pages_in_a_zone() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 142/268] sched/debug: Don't dump sched debug info in SysRq-W Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 168/268] mac80211: flush delayed work when entering suspend Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 117/268] apparmor: add missing id bounds check on dfa verification Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 197/268] ipv4: provide stronger user input validation in nl_fib_input() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 172/268] drivers: hv: Turn off write permission on the hypercall page Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 198/268] tcp: initialize icsk_ack.lrcvtime at session start time Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 178/268] l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 154/268] MIPS: Fix special case in 64 bit IP checksumming. Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 137/268] crypto: api - Clear CRYPTO_ALG_DEAD bit before registering an alg Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 149/268] rtc: interface: ignore expired timers when enqueuing new timers Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 189/268] crypto: ghash-clmulni - Fix load failure Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 265/268] ipv6: check raw payload size correctly in ioctl Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 160/268] rdma_cm: fail iwarp accepts w/o connection params Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 266/268] x86: standardize mmap_rnd() usage Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 243/268] Drivers: hv: don't leak memory in vmbus_establish_gpadl() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 049/268] USB: serial: io_ti: bind to interface after fw download Willy Tarreau <w@1wt.eu> - 2017-06-19 21:10 +0200
    [PATCH 3.10 257/268] RDS: Fix the atomicity for congestion map update Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 245/268] ubi/upd: Always flush after prepared for an update Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 158/268] samples/seccomp: fix 64-bit comparison macros Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 140/268] mm, fs: check for fatal signals in do_generic_file_read() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 087/268] igmp: Make igmp group member RFC 3376 compliant Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 208/268] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 249/268] net/packet: fix overflow in check for tp_reserve Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 146/268] vfs: fix uninitialized flags in splice_to_pipe() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 006/268] ext4: validate s_first_meta_bg at mount time Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 241/268] catc: Use heap buffer for memory size test Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 124/268] sg: Fix double-free when drives detach during SG_IO Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 195/268] igb: Workaround for igb i210 firmware issue Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 264/268] printk: use rcuidle console tracepoint Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 050/268] usb: gadget: composite: always set ep->mult to a sensible value Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 064/268] ssb: Fix error routine when fallback SPROM fails Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 215/268] rtc: s35390a: improve irq handling Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 029/268] can: raw: raw_setsockopt: limit number of can_filter that can be set Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 107/268] vmxnet3: Wake queue from reset work Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 161/268] NFSv4: fix getacl ERANGE for some ACL buffer sizes Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 228/268] mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 159/268] ath5k: drop bogus warning on drv_set_key with unsupported cipher Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 108/268] Fix memory leaks in cifs_do_mount() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 068/268] scsi: don't BUG_ON() empty DMA transfers Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 151/268] tty: serial: msm: Fix module autoload Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 239/268] virtio-console: avoid DMA from stack Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 232/268] iscsi-target: Fix TMR reference leak during session shutdown Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 094/268] Input: tca8418 - use the interrupt trigger from the device tree Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 242/268] net: ipv6: check route protocol when deleting routes Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 224/268] Reset TreeId to zero on SMB2 TREE_CONNECT Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 229/268] mtd: bcm47xxpart: fix parsing first block after aligned TRX Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 248/268] net/packet: fix overflow in check for tp_frame_nr Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 188/268] cancel the setfilesize transation when io error happen Willy Tarreau <w@1wt.eu> - 2017-06-19 21:20 +0200
    [PATCH 3.10 022/268] CIFS: Fix missing nls unload in smb2_reconnect() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 207/268] metag/ptrace: Preserve previous registers for short regset write Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 223/268] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 116/268] apparmor: check that xindex is in trans_table bounds Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 258/268] xen/x86: don't lose event interrupts Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 216/268] padata: avoid race in reordering Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 077/268] nfs_write_end(): fix handling of short copies Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 268/268] mm: larger stack guard gap, between vmas Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
      Re: [PATCH 3.10 268/268] mm: larger stack guard gap, between vmas Hugh Dickins <hughd@google.com> - 2017-06-21 09:10 +0200
        Re: [PATCH 3.10 268/268] mm: larger stack guard gap, between vmas Willy Tarreau <w@1wt.eu> - 2017-06-21 09:20 +0200
          Re: [PATCH 3.10 268/268] mm: larger stack guard gap, between vmas Willy Tarreau <w@1wt.eu> - 2017-06-21 18:30 +0200
    [PATCH 3.10 184/268] dccp: fix memory leak during tear-down of unsuccessful connection request Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 135/268] af_unix: move unix_mknod() out of bindlock Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 084/268] netvsc: reduce maximum GSO size Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 163/268] powerpc/xmon: Fix data-breakpoint Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 246/268] x86/mce/AMD: Give a name to MCA bank 3 when accessed with legacy MSRs Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 096/268] Input: mpr121 - set missing event capability Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 183/268] ipv6: avoid write to a possibly cloned skb Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 067/268] scsi: move the nr_phys_segments assert into scsi_init_io Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 255/268] ip6mr: fix notification device destruction Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 016/268] dm crypt: mark key as invalid until properly loaded Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 126/268] serial: 8250_pci: Detach low-level driver during PCI error recovery Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 203/268] crypto: algif_hash - avoid zero-sized array Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 112/268] apparmor: fix uninitialized lsm_audit member Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 111/268] Fix regression which breaks DFS mounting Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 021/268] CIFS: Fix a possible memory corruption during reconnect Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 200/268] mmc: sdhci: Do not disable interrupts while waiting for clock Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 171/268] fat: fix using uninitialized fields of fat_inode/fsinfo_inode Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 175/268] mtd: pmcmsp: use kstrndup instead of kmalloc+strncpy Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 075/268] s390/vmlogrdr: fix IUCV buffer allocation Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 181/268] tcp: fix various issues for sockets morphing to listen state Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 214/268] rtc: s35390a: implement reset routine as suggested by the reference Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 105/268] ARM: dts: da850-evm: fix read access to SPI flash Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 058/268] usb: gadget: composite: correctly initialize ep->maxpacket Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 254/268] sctp: listen on the sock only when it's state is listening or closed Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 219/268] tty/serial: atmel: fix race condition (TX+DMA) Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
      Re: [PATCH 3.10 219/268] tty/serial: atmel: fix race condition (TX+DMA) Richard Genoud <richard.genoud@gmail.com> - 2017-06-20 09:10 +0200
        Re: [PATCH 3.10 219/268] tty/serial: atmel: fix race condition  (TX+DMA) Willy Tarreau <w@1wt.eu> - 2017-06-20 09:30 +0200
    [PATCH 3.10 039/268] ALSA: seq: Fix link corruption by event error handling Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 031/268] can: c_can_pci: fix null-pointer-deref in c_can_start() - set device pointer Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 155/268] mm: vmpressure: fix sending wrong events on underflow Willy Tarreau <w@1wt.eu> - 2017-06-19 21:30 +0200
    [PATCH 3.10 253/268] net: neigh: guard against NULL solicit() method Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 037/268] ALSA: seq: Don't handle loop timeout at snd_seq_pool_done() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 206/268] sparc/ptrace: Preserve previous registers for short regset write Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 143/268] tcp: fix 0 divide in __tcp_select_window() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 055/268] usb: host: xhci-plat: Fix timeout on removal of hot pluggable xhci controllers Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 129/268] sysctl: fix proc_doulongvec_ms_jiffies_minmax() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 106/268] NFSv4: Ensure nfs_atomic_open set the dentry verifier on ENOENT Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 028/268] ocfs2: fix BUG_ON() in ocfs2_ci_checkpointed() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 238/268] mm: Tighten x86 /dev/mem with zeroing reads Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 090/268] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 045/268] USB: gadgetfs: fix unbounded memory allocation bug Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 014/268] block: allow WRITE_SAME commands with the SG_IO ioctl Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 026/268] cifs: Do not send echoes before Negotiate is complete Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 060/268] xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
      Re: [PATCH 3.10 060/268] xen/gntdev: Use VM_MIXEDMAP instead of  VM_IO to avoid NUMA balancing Hugh Dickins <hughd@google.com> - 2017-06-20 05:00 +0200
        Re: [PATCH 3.10 060/268] xen/gntdev: Use VM_MIXEDMAP instead of  VM_IO to avoid NUMA balancing Willy Tarreau <w@1wt.eu> - 2017-06-20 07:40 +0200
    [PATCH 3.10 066/268] scsi: avoid a permanent stop of the scsi device's request queue Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 043/268] ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 136/268] drm/nouveau/nv1a,nv1f/disp: fix memory clock rate retrieval Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 072/268] scsi: lpfc: Add shutdown method for kexec Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 256/268] MIPS: Fix crash registers on non-crashing CPUs Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 170/268] drm/ttm: Make sure BOs being swapped out are cacheable Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 156/268] ipc/shm: Fix shmat mmap nil-page protection Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 008/268] ext4: fix fencepost in s_first_meta_bg validation Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 130/268] ISDN: eicon: silence misleading array-bounds warning Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 078/268] powerpc/ps3: Fix system hang with GCC 5 builds Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 025/268] fs/cifs: make share unaccessible at root level mountable Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 100/268] sysrq: attach sysrq handler correctly for 32-bit kernel Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 080/268] ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 102/268] x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 010/268] ext4: preserve the needs_recovery flag when the journal is aborted Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 115/268] apparmor: internal paths should be treated as disconnected Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 081/268] cred/userns: define current_user_ns() as a function Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 222/268] drm/vmwgfx: Remove getparam error message Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 061/268] arm/xen: Use alloc_percpu rather than __alloc_percpu Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 213/268] rtc: s35390a: make sure all members in the output are set Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 036/268] ALSA: seq: Fix race at creating a queue Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 162/268] bcma: use (get|put)_device when probing/removing device driver Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
      Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when probing/removing device driver Kalle Valo <kvalo@codeaurora.org> - 2017-06-20 07:20 +0200
        Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when  probing/removing device driver Willy Tarreau <w@1wt.eu> - 2017-06-20 08:20 +0200
          Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when  probing/removing device driver Willy Tarreau <w@1wt.eu> - 2017-06-20 10:00 +0200
            Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when  probing/removing device driver Willy Tarreau <w@1wt.eu> - 2017-06-20 10:20 +0200
            Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when  probing/removing device driver Rafał Miłecki <rafal@milecki.pl> - 2017-06-20 12:00 +0200
          Re: [PATCH 3.10 162/268] bcma: use (get|put)_device when  probing/removing device driver Rafał Miłecki <rafal@milecki.pl> - 2017-06-20 11:00 +0200
    [PATCH 3.10 086/268] drop_monitor: consider inserted data in genlmsg_end Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 023/268] CIFS: Fix a possible memory corruption in push locks Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 020/268] md linear: fix a race between linear_add() and linear_congested() Willy Tarreau <w@1wt.eu> - 2017-06-19 21:40 +0200
    [PATCH 3.10 015/268] block: fix del_gendisk() vs blkdev_ioctl crash Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 012/268] ext4: fix inode checksum calculation problem if i_extra_size is small Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 019/268] md:raid1: fix a dead loop when read from a WriteMostly disk Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 071/268] target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 059/268] USB: UHCI: report non-PME wakeup signalling for Intel hardware Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 033/268] can: bcm: fix hrtimer/tasklet termination in bcm op removal Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 032/268] can: ti_hecc: add missing prepare and unprepare of the clock Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 044/268] usb: gadgetfs: restrict upper bound on device configuration size Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 001/268] Revert "Btrfs: don't delay inode ref updates during log, replay" Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 002/268] Btrfs: fix memory leak in reading btree blocks Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 065/268] drivers/gpu/drm/ast: Fix infinite loop if read fails Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    [PATCH 3.10 042/268] ALSA: seq: Don't break snd_use_lock_sync() loop by timeout Willy Tarreau <w@1wt.eu> - 2017-06-19 21:50 +0200
    Re: [PATCH 3.10 000/268] 3.10.107-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-20 00:50 +0200
      Re: [PATCH 3.10 000/268] 3.10.107-stable review Willy Tarreau <w@1wt.eu> - 2017-06-20 01:00 +0200
        Re: [PATCH 3.10 000/268] 3.10.107-stable review Willy Tarreau <w@1wt.eu> - 2017-06-20 08:20 +0200
          Re: [PATCH 3.10 000/268] 3.10.107-stable review Guenter Roeck <linux@roeck-us.net> - 2017-06-20 11:20 +0200
            Re: [PATCH 3.10 000/268] 3.10.107-stable review Willy Tarreau <w@1wt.eu> - 2017-06-20 11:30 +0200

Page 5 of 14 — ← Prev page 1 … 3 4 [5] 6 7 … 14  Next page →

#1669685 — [PATCH 3.10 098/268] i2c: fix kernel memory disclosure in dev interface

From: Vlad Tsyrklevich <vlad@tsyrklevich.net>

commit 30f939feaeee23e21391cfc7b484f012eb189c3c upstream.

i2c_smbus_xfer() does not always fill an entire block, allowing
kernel stack memory disclosure through the temp variable. Clear
it before it's read to.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/i2c/i2c-dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index c3ccdea..fa3ecec 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -328,7 +328,7 @@ static noinline int i2cdev_ioctl_smbus(struct i2c_client *client,
 		unsigned long arg)
 {
 	struct i2c_smbus_ioctl_data data_arg;
-	union i2c_smbus_data temp;
+	union i2c_smbus_data temp = {};
 	int datasize, res;
 
 	if (copy_from_user(&data_arg,
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669687 — [PATCH 3.10 217/268] HID: hid-lg: Fix immediate disconnection of Logitech Rumblepad 2

From: Ardinartsev Nikita <pinguin255@gmail.com>

commit 877a021e08ccb6434718c0cc781fdf943c884cc0 upstream.

With NOGET quirk Logitech F510 is now fully workable in dinput mode including
rumble effects (according to fftest).

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=117091

[jkosina@suse.cz: fix patch format]
Signed-off-by: Ardinartsev Nikita <ardinar23@gmail.com>
Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/hid/hid-lg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
index 12fc48c..34dbb9d 100644
--- a/drivers/hid/hid-lg.c
+++ b/drivers/hid/hid-lg.c
@@ -790,7 +790,7 @@ static const struct hid_device_id lg_devices[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_WINGMAN_FFG),
 		.driver_data = LG_FF },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_RUMBLEPAD2),
-		.driver_data = LG_FF2 },
+		.driver_data = LG_NOGET | LG_FF2 },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_FLIGHT_SYSTEM_G940),
 		.driver_data = LG_FF3 },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_SPACENAVIGATOR),
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669688 — [PATCH 3.10 082/268] net: ti: cpmac: Fix compiler warning due to type confusion

From: Paul Burton <paul.burton@imgtec.com>

commit 2f5281ba2a8feaf6f0aee93356f350855bb530fc upstream.

cpmac_start_xmit() used the max() macro on skb->len (an unsigned int)
and ETH_ZLEN (a signed int literal). This led to the following compiler
warning:

  In file included from include/linux/list.h:8:0,
                   from include/linux/module.h:9,
                   from drivers/net/ethernet/ti/cpmac.c:19:
  drivers/net/ethernet/ti/cpmac.c: In function 'cpmac_start_xmit':
  include/linux/kernel.h:748:17: warning: comparison of distinct pointer
  types lacks a cast
    (void) (&_max1 == &_max2);  \
                   ^
  drivers/net/ethernet/ti/cpmac.c:560:8: note: in expansion of macro 'max'
    len = max(skb->len, ETH_ZLEN);
          ^

On top of this, it assigned the result of the max() macro to a signed
integer whilst all further uses of it result in it being cast to varying
widths of unsigned integer.

Fix this up by using max_t to ensure the comparison is performed as
unsigned integers, and for consistency change the type of the len
variable to unsigned int.

Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/net/ethernet/ti/cpmac.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 31bbbca..6bcb2b8 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -557,7 +557,8 @@ fatal_error:
 
 static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
-	int queue, len;
+	int queue;
+	unsigned int len;
 	struct cpmac_desc *desc;
 	struct cpmac_priv *priv = netdev_priv(dev);
 
@@ -567,7 +568,7 @@ static int cpmac_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	if (unlikely(skb_padto(skb, ETH_ZLEN)))
 		return NETDEV_TX_OK;
 
-	len = max(skb->len, ETH_ZLEN);
+	len = max_t(unsigned int, skb->len, ETH_ZLEN);
 	queue = skb_get_queue_mapping(skb);
 	netif_stop_subqueue(dev, queue);
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669690 — [PATCH 3.10 212/268] ACPI / power: Avoid maybe-uninitialized warning

From: Arnd Bergmann <arnd@arndb.de>

commit fe8c470ab87d90e4b5115902dd94eced7e3305c3 upstream.

gcc -O2 cannot always prove that the loop in acpi_power_get_inferred_state()
is enterered at least once, so it assumes that cur_state might not get
initialized:

drivers/acpi/power.c: In function 'acpi_power_get_inferred_state':
drivers/acpi/power.c:222:9: error: 'cur_state' may be used uninitialized in this function [-Werror=maybe-uninitialized]

This sets the variable to zero at the start of the loop, to ensure that
there is well-defined behavior even for an empty list. This gets rid of
the warning.

The warning first showed up when the -Os flag got removed in a bug fix
patch in linux-4.11-rc5.

I would suggest merging this addon patch on top of that bug fix to avoid
introducing a new warning in the stable kernels.

Fixes: 61b79e16c68d (ACPI: Fix incompatibility with mcount-based function graph tracing)
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/acpi/power.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index 288bb27..9954200 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -211,6 +211,7 @@ static int acpi_power_get_list_state(struct list_head *list, int *state)
 		return -EINVAL;
 
 	/* The state of the list is 'on' IFF all resources are 'on'. */
+	cur_state = 0;
 	list_for_each_entry(entry, list, node) {
 		struct acpi_power_resource *resource = entry->resource;
 		acpi_handle handle = resource->device.handle;
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669691 — [PATCH 3.10 128/268] tile/ptrace: Preserve previous registers for short regset write

From: Dave Martin <Dave.Martin@arm.com>

commit fd7c99142d77dc4a851879a66715abf12a3193fb upstream.

Ensure that if userspace supplies insufficient data to
PTRACE_SETREGSET to fill all the registers, the thread's old
registers are preserved.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Chris Metcalf <cmetcalf@mellanox.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/tile/kernel/ptrace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/tile/kernel/ptrace.c b/arch/tile/kernel/ptrace.c
index 0f83ed4..d0dac73 100644
--- a/arch/tile/kernel/ptrace.c
+++ b/arch/tile/kernel/ptrace.c
@@ -110,7 +110,7 @@ static int tile_gpr_set(struct task_struct *target,
 			  const void *kbuf, const void __user *ubuf)
 {
 	int ret;
-	struct pt_regs regs;
+	struct pt_regs regs = *task_pt_regs(target);
 
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &regs, 0,
 				 sizeof(regs));
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669692 — [PATCH 3.10 035/268] ALSA: hda - Fix up GPIO for ASUS ROG Ranger

From: Takashi Iwai <tiwai@suse.de>

commit 85bcf96caba8b4a7c0805555638629ba3c67ea0c upstream.

ASUS ROG Ranger VIII with ALC1150 codec requires the extra GPIO pin to
up for the front panel.  Just use the existing fixup for setting up
the GPIO pins.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=189411
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 sound/pci/hda/patch_realtek.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index babbf23..af27d67 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -2185,6 +2185,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
 	SND_PCI_QUIRK(0x1043, 0x1971, "Asus W2JC", ALC882_FIXUP_ASUS_W2JC),
 	SND_PCI_QUIRK(0x1043, 0x835f, "Asus Eee 1601", ALC888_FIXUP_EEE1601),
 	SND_PCI_QUIRK(0x1043, 0x84bc, "ASUS ET2700", ALC887_FIXUP_ASUS_BASS),
+	SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3),
 	SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT),
 	SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP),
 	SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP),
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669693 — [PATCH 3.10 237/268] platform/x86: acer-wmi: setup accelerometer when ACPI device was found

From: "Lee, Chun-Yi" <joeyli.kernel@gmail.com>

commit f9ac89f5ad613b462339e845aeb8494646fd9be2 upstream.

The 98d610c3739a patch was introduced since v4.11-rc1 that it causes
that the accelerometer input device will not be created on workable
machines because the HID string comparing logic is wrong.

And, the patch doesn't prevent that the accelerometer input device
be created on the machines that have no BST0001. That's because
the acpi_get_devices() returns success even it didn't find any
match device.

This patch fixed the HID string comparing logic of BST0001 device.
And, it also makes sure that the acpi_get_devices() returns
acpi_handle for BST0001.

Fixes: 98d610c3739a ("acer-wmi: setup accelerometer when machine has appropriate notify event")
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=193761
Reported-by: Samuel Sieb <samuel-kbugs@sieb.net>
Signed-off-by: "Lee, Chun-Yi" <jlee@suse.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/platform/x86/acer-wmi.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 9e4f870..e4d9a90 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -1870,7 +1870,7 @@ static acpi_status __init acer_wmi_get_handle_cb(acpi_handle ah, u32 level,
 	if (!strcmp(ctx, "SENR")) {
 		if (acpi_bus_get_device(ah, &dev))
 			return AE_OK;
-		if (!strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev)))
+		if (strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev)))
 			return AE_OK;
 	} else
 		return AE_OK;
@@ -1891,8 +1891,7 @@ static int __init acer_wmi_get_handle(const char *name, const char *prop,
 	handle = NULL;
 	status = acpi_get_devices(prop, acer_wmi_get_handle_cb,
 					(void *)name, &handle);
-
-	if (ACPI_SUCCESS(status)) {
+	if (ACPI_SUCCESS(status) && handle) {
 		*ah = handle;
 		return 0;
 	} else {
@@ -2276,8 +2275,8 @@ static int __init acer_wmi_init(void)
 		if (err)
 			return err;
 		err = acer_wmi_accel_setup();
-		if (err)
-			return err;
+		if (err && err != -ENODEV)
+			pr_warn("Cannot enable accelerometer\n");
 	}
 
 	err = platform_driver_register(&acer_platform_driver);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669696 — [PATCH 3.10 057/268] usb: hub: Wait for connection to be reestablished after port reset

From: Guenter Roeck <linux@roeck-us.net>

commit 22547c4cc4fe20698a6a85a55b8788859134b8e4 upstream.

On a system with a defective USB device connected to an USB hub,
an endless sequence of port connect events was observed. The sequence
of events as observed is as follows:

- Port reports connected event (port status=USB_PORT_STAT_CONNECTION).
- Event handler debounces port and resets it by calling hub_port_reset().
- hub_port_reset() calls hub_port_wait_reset() to wait for the reset
  to complete.
- The reset completes, but USB_PORT_STAT_CONNECTION is not immediately
  set in the port status register.
- hub_port_wait_reset() returns -ENOTCONN.
- Port initialization sequence is aborted.
- A few milliseconds later, the port again reports a connected event,
  and the sequence repeats.

This continues either forever or, randomly, stops if the connection
is already re-established when the port status is read. It results in
a high rate of udev events. This in turn destabilizes userspace since
the above sequence holds the device mutex pretty much continuously
and prevents userspace from actually reading the device status.

To prevent the problem from happening, let's wait for the connection
to be re-established after a port reset. If the device was actually
disconnected, the code will still return an error, but it will do so
only after the long reset timeout.

Cc: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/usb/core/hub.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 4e5156d..55a8e84 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2579,8 +2579,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
 		if (ret < 0)
 			return ret;
 
-		/* The port state is unknown until the reset completes. */
-		if (!(portstatus & USB_PORT_STAT_RESET))
+		/*
+		 * The port state is unknown until the reset completes.
+		 *
+		 * On top of that, some chips may require additional time
+		 * to re-establish a connection after the reset is complete,
+		 * so also wait for the connection to be re-established.
+		 */
+		if (!(portstatus & USB_PORT_STAT_RESET) &&
+		    (portstatus & USB_PORT_STAT_CONNECTION))
 			break;
 
 		/* switch to the long delay after two short delay failures */
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669699 — [PATCH 3.10 144/268] macvtap: read vnet_hdr_size once

From: Willem de Bruijn <willemb@google.com>

commit 837585a5375c38d40361cfe64e6fd11e1addb936 upstream.

When IFF_VNET_HDR is enabled, a virtio_net header must precede data.
Data length is verified to be greater than or equal to expected header
length tun->vnet_hdr_sz before copying.

Macvtap functions read the value once, but unless READ_ONCE is used,
the compiler may ignore this and read multiple times. Enforce a single
read and locally cached value to avoid updates between test and use.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Suggested-by: Eric Dumazet <edumazet@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[wt: s/READ_ONCE/ACCESS_ONCE]

Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/net/macvtap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 8fc46fc..1c51abb 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -678,7 +678,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
 	size_t linear;
 
 	if (q->flags & IFF_VNET_HDR) {
-		vnet_hdr_len = q->vnet_hdr_sz;
+		vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz);
 
 		err = -EINVAL;
 		if (len < vnet_hdr_len)
@@ -809,7 +809,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
 	if (q->flags & IFF_VNET_HDR) {
 		struct virtio_net_hdr vnet_hdr;
-		vnet_hdr_len = q->vnet_hdr_sz;
+		vnet_hdr_len = ACCESS_ONCE(q->vnet_hdr_sz);
 		if ((len -= vnet_hdr_len) < 0)
 			return -EINVAL;
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669700 — [PATCH 3.10 176/268] cpmac: remove hopeless #warning

From: Arnd Bergmann <arnd@arndb.de>

commit d43e6fb4ac4abfe4ef7c102833ed02330ad701e0 upstream.

The #warning was present 10 years ago when the driver first got merged.
As the platform is rather obsolete by now, it seems very unlikely that
the warning will cause anyone to fix the code properly.

kernelci.org reports the warning for every build in the meantime, so
I think it's better to just turn it into a code comment to reduce
noise.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/net/ethernet/ti/cpmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c
index 6bcb2b8..922f7dd 100644
--- a/drivers/net/ethernet/ti/cpmac.c
+++ b/drivers/net/ethernet/ti/cpmac.c
@@ -1242,7 +1242,7 @@ int cpmac_init(void)
 		goto fail_alloc;
 	}
 
-#warning FIXME: unhardcode gpio&reset bits
+	/* FIXME: unhardcode gpio&reset bits */
 	ar7_gpio_disable(26);
 	ar7_gpio_disable(27);
 	ar7_device_reset(AR7_RESET_BIT_CPMAC_LO);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669701 — [PATCH 3.10 048/268] xhci: free xhci virtual devices with leaf nodes first

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit ee8665e28e8d90ce69d4abe5a469c14a8707ae0e upstream.

the tt_info provided by a HS hub might be in use to by a child device
Make sure we free the devices in the correct order.

This is needed in special cases such as when xhci controller is
reset when resuming from hibernate, and all virt_devices are freed.

Also free the virt_devices starting from max slot_id as children
more commonly have higher slot_id than parent.

Reported-by: Guenter Roeck <groeck@chromium.org>
Tested-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/usb/host/xhci-mem.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index b07e075..f4348a9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -925,6 +925,40 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id)
 	xhci->devs[slot_id] = NULL;
 }
 
+/*
+ * Free a virt_device structure.
+ * If the virt_device added a tt_info (a hub) and has children pointing to
+ * that tt_info, then free the child first. Recursive.
+ * We can't rely on udev at this point to find child-parent relationships.
+ */
+void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id)
+{
+	struct xhci_virt_device *vdev;
+	struct list_head *tt_list_head;
+	struct xhci_tt_bw_info *tt_info, *next;
+	int i;
+
+	vdev = xhci->devs[slot_id];
+	if (!vdev)
+		return;
+
+	tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts);
+	list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) {
+		/* is this a hub device that added a tt_info to the tts list */
+		if (tt_info->slot_id == slot_id) {
+			/* are any devices using this tt_info? */
+			for (i = 1; i < HCS_MAX_SLOTS(xhci->hcs_params1); i++) {
+				vdev = xhci->devs[i];
+				if (vdev && (vdev->tt_info == tt_info))
+					xhci_free_virt_devices_depth_first(
+						xhci, i);
+			}
+		}
+	}
+	/* we are now at a leaf device */
+	xhci_free_virt_device(xhci, slot_id);
+}
+
 int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 		struct usb_device *udev, gfp_t flags)
 {
@@ -1804,8 +1838,8 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
 		}
 	}
 
-	for (i = 1; i < MAX_HC_SLOTS; ++i)
-		xhci_free_virt_device(xhci, i);
+	for (i = HCS_MAX_SLOTS(xhci->hcs_params1); i > 0; i--)
+		xhci_free_virt_devices_depth_first(xhci, i);
 
 	if (xhci->segment_pool)
 		dma_pool_destroy(xhci->segment_pool);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669702 — [PATCH 3.10 167/268] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD

From: Max Filippov <jcmvbkbc@gmail.com>

commit 4ab18701c66552944188dbcd0ce0012729baab84 upstream.

FDT tag parsing is not related to whether BLK_DEV_INITRD is configured
or not, move it out of the corresponding #ifdef/#endif block.
This fixes passing external FDT to the kernel configured w/o
BLK_DEV_INITRD support.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/xtensa/kernel/setup.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c
index 14c6c3a..8164f05 100644
--- a/arch/xtensa/kernel/setup.c
+++ b/arch/xtensa/kernel/setup.c
@@ -160,6 +160,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag)
 
 __tagtable(BP_TAG_INITRD, parse_tag_initrd);
 
+#endif /* CONFIG_BLK_DEV_INITRD */
+
 #ifdef CONFIG_OF
 
 static int __init parse_tag_fdt(const bp_tag_t *tag)
@@ -180,8 +182,6 @@ void __init early_init_dt_setup_initrd_arch(unsigned long start,
 
 #endif /* CONFIG_OF */
 
-#endif /* CONFIG_BLK_DEV_INITRD */
-
 static int __init parse_tag_cmdline(const bp_tag_t* tag)
 {
 	strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE);
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669704 — [PATCH 3.10 150/268] irda: Fix lockdep annotations in hashbin_delete().

From: "David S. Miller" <davem@davemloft.net>

commit 4c03b862b12f980456f9de92db6d508a4999b788 upstream.

A nested lock depth was added to the hasbin_delete() code but it
doesn't actually work some well and results in tons of lockdep splats.

Fix the code instead to properly drop the lock around the operation
and just keep peeking the head of the hashbin queue.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 net/irda/irqueue.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c
index 7152624..26ccd65 100644
--- a/net/irda/irqueue.c
+++ b/net/irda/irqueue.c
@@ -385,9 +385,6 @@ EXPORT_SYMBOL(hashbin_new);
  *    for deallocating this structure if it's complex. If not the user can
  *    just supply kfree, which should take care of the job.
  */
-#ifdef CONFIG_LOCKDEP
-static int hashbin_lock_depth = 0;
-#endif
 int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 {
 	irda_queue_t* queue;
@@ -398,22 +395,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 	IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;);
 
 	/* Synchronize */
-	if ( hashbin->hb_type & HB_LOCK ) {
-		spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags,
-					 hashbin_lock_depth++);
-	}
+	if (hashbin->hb_type & HB_LOCK)
+		spin_lock_irqsave(&hashbin->hb_spinlock, flags);
 
 	/*
 	 *  Free the entries in the hashbin, TODO: use hashbin_clear when
 	 *  it has been shown to work
 	 */
 	for (i = 0; i < HASHBIN_SIZE; i ++ ) {
-		queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
-		while (queue ) {
-			if (free_func)
-				(*free_func)(queue);
-			queue = dequeue_first(
-				(irda_queue_t**) &hashbin->hb_queue[i]);
+		while (1) {
+			queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]);
+
+			if (!queue)
+				break;
+
+			if (free_func) {
+				if (hashbin->hb_type & HB_LOCK)
+					spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
+				free_func(queue);
+				if (hashbin->hb_type & HB_LOCK)
+					spin_lock_irqsave(&hashbin->hb_spinlock, flags);
+			}
 		}
 	}
 
@@ -422,12 +424,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func)
 	hashbin->magic = ~HB_MAGIC;
 
 	/* Release lock */
-	if ( hashbin->hb_type & HB_LOCK) {
+	if (hashbin->hb_type & HB_LOCK)
 		spin_unlock_irqrestore(&hashbin->hb_spinlock, flags);
-#ifdef CONFIG_LOCKDEP
-		hashbin_lock_depth--;
-#endif
-	}
 
 	/*
 	 *  Free the hashbin structure
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669705 — [PATCH 3.10 097/268] Input: i8042 - add Clevo P650RS to the i8042 reset list

From: Dmitry Torokhov <dmitry.torokhov@gmail.com>

commit 7c5bb4ac2b76d2a09256aec8a7d584bf3e2b0466 upstream.

Clevo P650RS and other similar devices require i8042 to be reset in order
to detect Synaptics touchpad.

Reported-by: Paweł Bylica <chfast@gmail.com>
Tested-by: Ed Bordin <edbordin@gmail.com>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=190301
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/input/serio/i8042-x86ia64io.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index c5e00c8..566ced8 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -587,6 +587,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
 			DMI_MATCH(DMI_PRODUCT_NAME, "20046"),
 		},
 	},
+	{
+		/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
+			DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
+		},
+	},
 	{ }
 };
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669706 — [PATCH 3.10 104/268] ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs

From: Mark Rutland <mark.rutland@arm.com>

commit ddc37832a1349f474c4532de381498020ed71d31 upstream.

On APQ8060, the kernel crashes in arch_hw_breakpoint_init, taking an
undefined instruction trap within write_wb_reg. This is because Scorpion
CPUs erroneously appear to set DBGPRSR.SPD when WFI is issued, even if
the core is not powered down. When DBGPRSR.SPD is set, breakpoint and
watchpoint registers are treated as undefined.

It's possible to trigger similar crashes later on from userspace, by
requesting the kernel to install a breakpoint or watchpoint, as we can
go idle at any point between the reset of the debug registers and their
later use. This has always been the case.

Given that this has always been broken, no-one has complained until now,
and there is no clear workaround, disable hardware breakpoints and
watchpoints on Scorpion to avoid these issues.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reported-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Stephen Boyd <sboyd@codeaurora.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/arm/include/asm/cputype.h  |  3 +++
 arch/arm/kernel/hw_breakpoint.c | 16 ++++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
index dba62cb..f389107 100644
--- a/arch/arm/include/asm/cputype.h
+++ b/arch/arm/include/asm/cputype.h
@@ -58,6 +58,9 @@
 #define ARM_CPU_XSCALE_ARCH_V2		0x4000
 #define ARM_CPU_XSCALE_ARCH_V3		0x6000
 
+/* Qualcomm implemented cores */
+#define ARM_CPU_PART_SCORPION		0x510002d0
+
 extern unsigned int processor_id;
 
 #ifdef CONFIG_CPU_CP15
diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
index 1fd749e..b0b69e9 100644
--- a/arch/arm/kernel/hw_breakpoint.c
+++ b/arch/arm/kernel/hw_breakpoint.c
@@ -1066,6 +1066,22 @@ static int __init arch_hw_breakpoint_init(void)
 		return 0;
 	}
 
+	/*
+	 * Scorpion CPUs (at least those in APQ8060) seem to set DBGPRSR.SPD
+	 * whenever a WFI is issued, even if the core is not powered down, in
+	 * violation of the architecture.  When DBGPRSR.SPD is set, accesses to
+	 * breakpoint and watchpoint registers are treated as undefined, so
+	 * this results in boot time and runtime failures when these are
+	 * accessed and we unexpectedly take a trap.
+	 *
+	 * It's not clear if/how this can be worked around, so we blacklist
+	 * Scorpion CPUs to avoid these issues.
+	*/
+	if ((read_cpuid_id() & 0xff00fff0) == ARM_CPU_PART_SCORPION) {
+		pr_info("Scorpion CPU detected. Hardware breakpoints and watchpoints disabled\n");
+		return 0;
+	}
+
 	has_ossr = core_has_os_save_restore();
 
 	/* Determine how many BRPs/WRPs are available. */
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669707 — [PATCH 3.10 231/268] x86/vdso: Plug race between mapping and ELF header setup

From: Thomas Gleixner <tglx@linutronix.de>

commit 6fdc6dd90272ce7e75d744f71535cfbd8d77da81 upstream.

The vsyscall32 sysctl can racy against a concurrent fork when it switches
from disabled to enabled:

    arch_setup_additional_pages()
	if (vdso32_enabled)
           --> No mapping
                                        sysctl.vsysscall32()
                                          --> vdso32_enabled = true
    create_elf_tables()
      ARCH_DLINFO_IA32
        if (vdso32_enabled) {
           --> Add VDSO entry with NULL pointer

Make ARCH_DLINFO_IA32 check whether the VDSO mapping has been set up for
the newly forked process or not.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Mathias Krause <minipli@googlemail.com>
Link: http://lkml.kernel.org/r/20170410151723.602367196@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/x86/include/asm/elf.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index 01f15b2..2fa7f4f 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -272,7 +272,7 @@ struct task_struct;
 
 #define	ARCH_DLINFO_IA32(vdso_enabled)					\
 do {									\
-	if (vdso_enabled) {						\
+	if (VDSO_CURRENT_BASE) {					\
 		NEW_AUX_ENT(AT_SYSINFO,	VDSO_ENTRY);			\
 		NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);	\
 	}								\
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669708 — [PATCH 3.10 220/268] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

From: Murray McAllister <murray.mcallister@insomniasec.com>

commit 36274ab8c596f1240c606bb514da329add2a1bcd upstream.

Before memory allocations vmw_surface_define_ioctl() checks the
upper-bounds of a user-supplied size, but does not check if the
supplied size is 0.

Add check to avoid NULL pointer dereferences.

Signed-off-by: Murray McAllister <murray.mcallister@insomniasec.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
index 5828143..a518493 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -680,8 +680,8 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 	for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
 		num_sizes += req->mip_levels[i];
 
-	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES *
-	    DRM_VMW_MAX_MIP_LEVELS)
+	if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS ||
+	    num_sizes == 0)
 		return -EINVAL;
 
 	size = vmw_user_surface_size + 128 +
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669709 — [PATCH 3.10 091/268] Input: iforce - validate number of endpoints before using them

From: Johan Hovold <johan@kernel.org>

commit 59cf8bed44a79ec42303151dd014fdb6434254bb upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer or accessing memory that lie beyond the end of the endpoint
array should a malicious device lack the expected endpoints.

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/input/joystick/iforce/iforce-usb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index d96aa27..db64adf 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf,
 
 	interface = intf->cur_altsetting;
 
+	if (interface->desc.bNumEndpoints < 2)
+		return -ENODEV;
+
 	epirq = &interface->endpoint[0].desc;
 	epout = &interface->endpoint[1].desc;
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669710 — [PATCH 3.10 122/268] vfio/pci: Fix integer overflows, bitmask check

From: Vlad Tsyrklevich <vlad@tsyrklevich.net>

commit 05692d7005a364add85c6e25a6c4447ce08f913a upstream.

The VFIO_DEVICE_SET_IRQS ioctl did not sufficiently sanitize
user-supplied integers, potentially allowing memory corruption. This
patch adds appropriate integer overflow checks, checks the range bounds
for VFIO_IRQ_SET_DATA_NONE, and also verifies that only single element
in the VFIO_IRQ_SET_DATA_TYPE_MASK bitmask is set.
VFIO_IRQ_SET_ACTION_TYPE_MASK is already correctly checked later in
vfio_pci_set_irqs_ioctl().

Furthermore, a kzalloc is changed to a kcalloc because the use of a
kzalloc with an integer multiplication allowed an integer overflow
condition to be reached without this patch. kcalloc checks for overflow
and should prevent a similar occurrence.

Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 drivers/vfio/pci/vfio_pci.c       | 33 +++++++++++++++++++++------------
 drivers/vfio/pci/vfio_pci_intrs.c |  2 +-
 2 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
index dc55bc2..a1d0fc4 100644
--- a/drivers/vfio/pci/vfio_pci.c
+++ b/drivers/vfio/pci/vfio_pci.c
@@ -344,8 +344,9 @@ static long vfio_pci_ioctl(void *device_data,
 
 	} else if (cmd == VFIO_DEVICE_SET_IRQS) {
 		struct vfio_irq_set hdr;
+		size_t size;
 		u8 *data = NULL;
-		int ret = 0;
+		int max, ret = 0;
 
 		minsz = offsetofend(struct vfio_irq_set, count);
 
@@ -353,23 +354,31 @@ static long vfio_pci_ioctl(void *device_data,
 			return -EFAULT;
 
 		if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS ||
+		    hdr.count >= (U32_MAX - hdr.start) ||
 		    hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK |
 				  VFIO_IRQ_SET_ACTION_TYPE_MASK))
 			return -EINVAL;
 
-		if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
-			size_t size;
-			int max = vfio_pci_get_irq_count(vdev, hdr.index);
+		max = vfio_pci_get_irq_count(vdev, hdr.index);
+		if (hdr.start >= max || hdr.start + hdr.count > max)
+			return -EINVAL;
 
-			if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
-				size = sizeof(uint8_t);
-			else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD)
-				size = sizeof(int32_t);
-			else
-				return -EINVAL;
+		switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) {
+		case VFIO_IRQ_SET_DATA_NONE:
+			size = 0;
+			break;
+		case VFIO_IRQ_SET_DATA_BOOL:
+			size = sizeof(uint8_t);
+			break;
+		case VFIO_IRQ_SET_DATA_EVENTFD:
+			size = sizeof(int32_t);
+			break;
+		default:
+			return -EINVAL;
+		}
 
-			if (hdr.argsz - minsz < hdr.count * size ||
-			    hdr.start >= max || hdr.start + hdr.count > max)
+		if (size) {
+			if (hdr.argsz - minsz < hdr.count * size)
 				return -EINVAL;
 
 			data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
index 4bc704e..bfe72a9 100644
--- a/drivers/vfio/pci/vfio_pci_intrs.c
+++ b/drivers/vfio/pci/vfio_pci_intrs.c
@@ -468,7 +468,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix)
 	if (!is_irq_none(vdev))
 		return -EINVAL;
 
-	vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
+	vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL);
 	if (!vdev->ctx)
 		return -ENOMEM;
 
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

#1669711 — [PATCH 3.10 166/268] s390: TASK_SIZE for kernel threads

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit fb94a687d96c570d46332a4a890f1dcb7310e643 upstream.

Return a sensible value if TASK_SIZE if called from a kernel thread.

This gets us around an issue with copy_mount_options that does a magic
size calculation "TASK_SIZE - (unsigned long)data" while in a kernel
thread and data pointing to kernel space.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
 arch/s390/include/asm/processor.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h
index 6b49987..77a0cb4 100644
--- a/arch/s390/include/asm/processor.h
+++ b/arch/s390/include/asm/processor.h
@@ -47,7 +47,8 @@ extern void execve_tail(void);
 
 #else /* CONFIG_64BIT */
 
-#define TASK_SIZE_OF(tsk)	((tsk)->mm->context.asce_limit)
+#define TASK_SIZE_OF(tsk)	((tsk)->mm ? \
+				 (tsk)->mm->context.asce_limit : TASK_MAX_SIZE)
 #define TASK_UNMAPPED_BASE	(test_thread_flag(TIF_31BIT) ? \
 					(1UL << 30) : (1UL << 41))
 #define TASK_SIZE		TASK_SIZE_OF(current)
-- 
2.8.0.rc2.1.gbe9624a

[toc] | [prev] | [next] | [standalone]

Page 5 of 14 — ← Prev page 1 … 3 4 [5] 6 7 … 14  Next page →

Back to top | Article view | linux.kernel

csiph-web