Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1597344 > unrolled thread

[PATCH 3.2 000/199] 3.2.87-rc1 review

Back to article view | Back to linux.kernel

Contents

  [PATCH 3.2 000/199] 3.2.87-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:20 +0100
    [PATCH 3.2 191/199] tun: read vnet_hdr_sz once Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:20 +0100
    [PATCH 3.2 017/199] ext4: fix stack memory corruption with 64k  block size Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 028/199] thermal: hwmon: Properly report critical  temperature in sysfs Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 188/199] ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 186/199] can: Fix kernel panic at security_sock_rcv_skb Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 009/199] PCI: Check for PME in targeted sleep state Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 194/199] mld: do not remove mld souce list info when  set link down Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 012/199] powerpc/ibmebus: Fix device reference leaks  in sysfs interface Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 029/199] USB: serial: kl5kusb105: fix open error path Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 024/199] dm crypt: mark key as invalid until properly  loaded Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:30 +0100
    [PATCH 3.2 016/199] ext4: fix mballoc breakage with 64k block size Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 196/199] Revert "KVM: x86: expose MSR_TSC_AUX to  userspace" Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 195/199] igmp, mld: Fix memory leak in igmpv3/mld_del_delrec() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 015/199] usb: xhci-mem: use passed in GFP flags  instead of GFP_KERNEL Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 025/199] [media] DaVinci-VPFE-Capture: fix error handling Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 190/199] tun: Fix TUN_PKT_STRIP setting Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 019/199] scsi: mvsas: fix command_active typo Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:40 +0100
    [PATCH 3.2 014/199] powerpc/pci/rpadlpar: Fix device reference leaks Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 146/199] net/llc: avoid BUG_ON() in skb_orphan() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    Re: [PATCH 3.2 000/199] 3.2.87-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-03-10 13:50 +0100
      Re: [PATCH 3.2 000/199] 3.2.87-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 021/199] ext4: fix in-superblock mount options processing Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 137/199] catc: Combine failure cleanup code in  catc_probe() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 004/199] perf scripting: Avoid leaking the  scripting_context variable Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 001/199] staging: iio: ad7606: fix improper setting of  oversampling pins Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 110/199] xhci: fix deadlock at host remove by running  watchdog correctly Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 129/199] can: bcm: fix hrtimer/tasklet termination in  bcm op removal Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 104/199] gro: Disable frag0 optimization on IPv6 ext  headers Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 113/199] svcrpc: don't leak contexts on PROC_DESTROY Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 13:50 +0100
    [PATCH 3.2 086/199] x86/cpu: Fix bootup crashes by sanitizing the  argument of the 'clearcpuid=' command-line option Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 136/199] rtl8150: Use heap buffers for all register access Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 126/199] USB: Add quirk for WORLDE easykey.25 MIDI  keyboard Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 120/199] powerpc/ptrace: Preserve previous fprs/vsrs  on short regset write Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 087/199] usb: musb: Fix trying to free already-free IRQ 4 Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 141/199] ping: fix a null pointer dereference Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 082/199] USB: serial: pl2303: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 134/199] mac80211: Fix adding of mesh vendor IEs Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 132/199] mm, fs: check for fatal signals in  do_generic_file_read() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 116/199] can: ti_hecc: add missing prepare and  unprepare of the clock Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 145/199] net/sock: Add sock_efree() function Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 047/199] IB/mad: Fix an array index check Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 071/199] USB: serial: iuu_phoenix: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 119/199] nbd: only set MSG_MORE when we have more to send Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 122/199] platform/x86: intel_mid_powerbtn: Set IRQ_ONESHOT Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 083/199] USB: serial: spcp8x5: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 056/199] net: korina: Fix NAPI versus resources freeing Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 139/199] ALSA: seq: Fix race at creating a queue Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 117/199] ceph: fix bad endianness handling in  parse_reply_info_extra Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 106/199] sysrq: attach sysrq handler correctly for  32-bit kernel Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 103/199] gro: Enter slow-path if there is no tailroom Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 105/199] ocfs2: fix crash caused by stale lvb with  fsdlm plugin Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 125/199] mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW  for thp Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 068/199] USB: serial: io_edgeport: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 124/199] USB: serial: option: add device ID for HP  lt2523 (Novatel E371) Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 131/199] USB: serial: pl2303: add ATEN device ID Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 123/199] crypto: api - Clear CRYPTO_ALG_DEAD bit  before registering an alg Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 127/199] sysctl: fix proc_doulongvec_ms_jiffies_minmax() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 096/199] USB: serial: ch341: fix initial modem-control  state Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 092/199] USB: ch341: remove redundant close from open  error path Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 115/199] ubifs: Fix journal replay wrt. xattr nodes Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 101/199] USB: serial: ch341: fix baud rate and  line-control handling Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 050/199] scsi: zfcp: do not trace pure benign residual  HBA responses at default level Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 088/199] USB: fix problems with duplicate endpoint  addresses Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 128/199] parisc: Don't use BITS_PER_LONG in  userspace-exported swab.h header Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 108/199] USB: serial: ch341: fix control-message error  handling Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:00 +0100
    [PATCH 3.2 076/199] USB: serial: mos7720: fix parport  use-after-free on probe errors Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 090/199] ata: sata_mv:- Handle return value of  devm_ioremap. Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 080/199] USB: serial: omninet: fix NULL-derefs at open  and disconnect Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 061/199] usb: gadgetfs: restrict upper bound on device  configuration size Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 067/199] USB: serial: garmin_gps: fix memory leak on  failed URB submit Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 085/199] iommu/amd: Fix the left value check of cmd buffer Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 070/199] USB: serial: io_ti: fix another NULL-deref at  open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 062/199] USB: gadgetfs: fix unbounded memory  allocation bug Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 093/199] USB: ch341: set tty baud speed according to  tty struct Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 073/199] USB: serial: kobil_sct: fix NULL-deref in write Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 075/199] USB: serial: mos7720: fix use-after-free on  probe errors Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 063/199] USB: gadgetfs: fix use-after-free bug Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 048/199] IB/multicast: Check ib_find_pkey() return value Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 074/199] USB: serial: mos7720: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 053/199] target/iscsi: Fix double free in  lio_target_tiqn_addtpg() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 049/199] scsi: zfcp: fix use-after-"free" in FC  ingress path after TMF Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 079/199] USB: serial: mos7840: fix misleading  interrupt-URB comment Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 058/199] net/mlx4: Remove BUG_ON from ICM allocation  routine Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 069/199] USB: serial: io_ti: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 097/199] USB: serial: ch341: fix open and resume after B0 Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 064/199] USB: gadgetfs: fix checks of wTotalLength in  config descriptors Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 077/199] USB: serial: mos7720: fix parallel probe Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 078/199] USB: serial: mos7840: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 081/199] USB: serial: oti6858: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 066/199] USB: serial: cyberjack: fix NULL-deref at open Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 098/199] USB: serial: ch341: fix modem-control and B0  handling Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 089/199] HID: hid-cypress: validate length of report Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 094/199] USB: serial: ch341: add register and USB  request definitions Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 055/199] net, sched: fix soft lockup in tc_classify Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 040/199] ext4: reject inodes with negative size Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:10 +0100
    [PATCH 3.2 037/199] USB: serial: option: add support for Telit  LE922A PIDs 0x1040, 0x1041 Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 044/199] libceph: verify authorize reply on connect Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 005/199] usb: gadget: composite: correctly initialize  ep->maxpacket Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 051/199] scsi: zfcp: fix rport unblock race with LUN  recovery Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 059/199] usb: gadget: composite: Test get_alt()  presence instead of set_alt() Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 038/199] hwmon: (ds620) Fix overflows seen when  writing temperature limits Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 045/199] fsnotify: Fix possible use-after-free in  inode iteration on umount Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 046/199] block_dev: don't test bdev->bd_contains when  it is not stable Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 031/199] drivers: base: dma-mapping: Fix typo in  dmam_alloc_non_coherent comments Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 065/199] xhci: free xhci virtual devices with leaf  nodes first Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 034/199] USB: cdc-acm: add device id for GW Instek AFG-125 Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 036/199] ALSA: usb-audio: Add QuickCam Communicate  Deluxe/S7500 to volume_control_quirks Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 022/199] ext4: use more strict checks for  inodes_per_block on mount Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 002/199] net/sched: em_meta: Fix 'meta vlan' to  correctly recognize zero VID frames Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 041/199] kconfig/nconf: Fix hang when editing symbol  with a long prompt Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 032/199] powerpc/ps3: Fix system hang with GCC 5 builds Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 010/199] USB: UHCI: report non-PME wakeup signalling  for Intel hardware Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 057/199] net/mlx4_en: Fix bad WQE issue Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 006/199] drm/gma500: Add compat ioctl Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 008/199] xfs: fix up xfs_swap_extent_forks inline  extent handling Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 035/199] hotplug: Make register and unregister  notifier API symmetric Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 039/199] nfs_write_end(): fix handling of short copies Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 026/199] regmap: cache: Remove unused 'blksize' variable Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 052/199] scsi: avoid a permanent stop of the scsi  device's request queue Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 033/199] Btrfs: fix tree search logic when replaying  directory entry deletes Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 030/199] USB: serial: kl5kusb105: abort on open  exception path Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 054/199] Input: i8042 - add Pegatron touchpad to  noloop table Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 060/199] USB: dummy-hcd: fix bug in stop_activity  (handle ep0) Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:20 +0100
    [PATCH 3.2 000/202] 3.2.87-rc2 review Ben Hutchings <ben@decadent.org.uk> - 2017-03-11 16:30 +0100
      [PATCH 3.2 202/202] tty: n_hdlc: get rid of racy n_hdlc.tbuf Ben Hutchings <ben@decadent.org.uk> - 2017-03-11 16:30 +0100
      [PATCH 3.2 201/202] list: introduce list_first_entry_or_null Ben Hutchings <ben@decadent.org.uk> - 2017-03-11 16:30 +0100
      [PATCH 3.2 200/202] TTY: n_hdlc, fix lockdep false positive Ben Hutchings <ben@decadent.org.uk> - 2017-03-11 16:30 +0100
      Re: [PATCH 3.2 000/202] 3.2.87-rc2 review Guenter Roeck <linux@roeck-us.net> - 2017-03-12 19:20 +0100

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

#1597424

On 03/10/2017 03:46 AM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.2.87 release.
> There are 199 patches in this series, which will be posted as responses
> to this one.  If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Mar 15 00:00:00 UTC 2017.
> Anything received after that time might be too late.
>

Build results:
	total: 89 pass: 89 fail: 0
Qemu test results:
	total: 69 pass: 69 fail: 0

Details are available at http://kerneltests.org/builders/

Guenter

[toc] | [prev] | [next] | [standalone]

#1597487

[Multipart message — attachments visible in raw view] — view raw

On Fri, 2017-03-10 at 04:47 -0800, Guenter Roeck wrote:
> On 03/10/2017 03:46 AM, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.2.87
> > release.
> > There are 199 patches in this series, which will be posted as
> > responses
> > to this one.  If anyone has any issues with these being applied,
> > please
> > let me know.
> > 
> > Responses should be made by Wed Mar 15 00:00:00 UTC 2017.
> > Anything received after that time might be too late.
> > 
> 
> Build results:
> 	total: 89 pass: 89 fail: 0
> Qemu test results:
> 	total: 69 pass: 69 fail: 0
> 
> Details are available at http://kerneltests.org/builders/

Thanks for checking.

Ben.

-- 
Ben Hutchings
If you seem to know what you are doing, you'll be given more to do.

[toc] | [prev] | [next] | [standalone]

#1597425 — [PATCH 3.2 021/199] ext4: fix in-superblock mount options processing

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Theodore Ts'o <tytso@mit.edu>

commit 5aee0f8a3f42c94c5012f1673420aee96315925a upstream.

Fix a large number of problems with how we handle mount options in the
superblock.  For one, if the string in the superblock is long enough
that it is not null terminated, we could run off the end of the string
and try to interpret superblocks fields as characters.  It's unlikely
this will cause a security problem, but it could result in an invalid
parse.  Also, parse_options is destructive to the string, so in some
cases if there is a comma-separated string, it would be modified in
the superblock.  (Fortunately it only happens on file systems with a
1k block size.)

Signed-off-by: Theodore Ts'o <tytso@mit.edu>
[bwh: Backported to 3.2: adjust context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 fs/ext4/super.c | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -3240,7 +3240,7 @@ static int ext4_fill_super(struct super_
 	char *orig_data = kstrdup(data, GFP_KERNEL);
 	struct buffer_head *bh;
 	struct ext4_super_block *es = NULL;
-	struct ext4_sb_info *sbi;
+	struct ext4_sb_info *sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
 	ext4_fsblk_t block;
 	ext4_fsblk_t sb_block = get_sb_block(&data);
 	ext4_fsblk_t logical_sb_block;
@@ -3260,16 +3260,14 @@ static int ext4_fill_super(struct super_
 	unsigned int journal_ioprio = DEFAULT_JOURNAL_IOPRIO;
 	ext4_group_t first_not_zeroed;
 
-	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
-	if (!sbi)
-		goto out_free_orig;
+	if ((data && !orig_data) || !sbi)
+		goto out_free_base;
 
 	sbi->s_blockgroup_lock =
 		kzalloc(sizeof(struct blockgroup_lock), GFP_KERNEL);
-	if (!sbi->s_blockgroup_lock) {
-		kfree(sbi);
-		goto out_free_orig;
-	}
+	if (!sbi->s_blockgroup_lock)
+		goto out_free_base;
+
 	sb->s_fs_info = sbi;
 	sbi->s_mount_opt = 0;
 	sbi->s_resuid = EXT4_DEF_RESUID;
@@ -3378,11 +3376,19 @@ static int ext4_fill_super(struct super_
 	 */
 	sbi->s_li_wait_mult = EXT4_DEF_LI_WAIT_MULT;
 
-	if (!parse_options((char *) sbi->s_es->s_mount_opts, sb,
-			   &journal_devnum, &journal_ioprio, NULL, 0)) {
-		ext4_msg(sb, KERN_WARNING,
-			 "failed to parse options in superblock: %s",
-			 sbi->s_es->s_mount_opts);
+	if (sbi->s_es->s_mount_opts[0]) {
+		char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts,
+					      sizeof(sbi->s_es->s_mount_opts),
+					      GFP_KERNEL);
+		if (!s_mount_opts)
+			goto failed_mount;
+		if (!parse_options(s_mount_opts, sb, &journal_devnum,
+				   &journal_ioprio, NULL, 0)) {
+			ext4_msg(sb, KERN_WARNING,
+				 "failed to parse options in superblock: %s",
+				 s_mount_opts);
+		}
+		kfree(s_mount_opts);
 	}
 	if (!parse_options((char *) data, sb, &journal_devnum,
 			   &journal_ioprio, NULL, 0))
@@ -3978,7 +3984,9 @@ no_journal:
 		descr = "out journal";
 
 	ext4_msg(sb, KERN_INFO, "mounted filesystem with%s. "
-		 "Opts: %s%s%s", descr, sbi->s_es->s_mount_opts,
+		 "Opts: %.*s%s%s", descr,
+		 (int) sizeof(sbi->s_es->s_mount_opts),
+		 sbi->s_es->s_mount_opts,
 		 *sbi->s_es->s_mount_opts ? "; " : "", orig_data);
 
 	if (es->s_error_count)
@@ -4036,8 +4044,8 @@ failed_mount:
 out_fail:
 	sb->s_fs_info = NULL;
 	kfree(sbi->s_blockgroup_lock);
+out_free_base:
 	kfree(sbi);
-out_free_orig:
 	kfree(orig_data);
 	return ret;
 }

[toc] | [prev] | [next] | [standalone]

#1597427 — [PATCH 3.2 137/199] catc: Combine failure cleanup code in catc_probe()

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit d41149145f98fe26dcd0bfd1d6cc095e6e041418 upstream.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 drivers/net/usb/catc.c | 33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -765,7 +765,7 @@ static int catc_probe(struct usb_interfa
 	struct net_device *netdev;
 	struct catc *catc;
 	u8 broadcast[6];
-	int i, pktsz;
+	int i, pktsz, ret;
 
 	if (usb_set_interface(usbdev,
 			intf->altsetting->desc.bInterfaceNumber, 1)) {
@@ -800,12 +800,8 @@ static int catc_probe(struct usb_interfa
 	if ((!catc->ctrl_urb) || (!catc->tx_urb) || 
 	    (!catc->rx_urb) || (!catc->irq_urb)) {
 		err("No free urbs available.");
-		usb_free_urb(catc->ctrl_urb);
-		usb_free_urb(catc->tx_urb);
-		usb_free_urb(catc->rx_urb);
-		usb_free_urb(catc->irq_urb);
-		free_netdev(netdev);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto fail_free;
 	}
 
 	/* The F5U011 has the same vendor/product as the netmate but a device version of 0x130 */
@@ -902,16 +898,21 @@ static int catc_probe(struct usb_interfa
 	usb_set_intfdata(intf, catc);
 
 	SET_NETDEV_DEV(netdev, &intf->dev);
-	if (register_netdev(netdev) != 0) {
-		usb_set_intfdata(intf, NULL);
-		usb_free_urb(catc->ctrl_urb);
-		usb_free_urb(catc->tx_urb);
-		usb_free_urb(catc->rx_urb);
-		usb_free_urb(catc->irq_urb);
-		free_netdev(netdev);
-		return -EIO;
-	}
+	ret = register_netdev(netdev);
+	if (ret)
+		goto fail_clear_intfdata;
+
 	return 0;
+
+fail_clear_intfdata:
+	usb_set_intfdata(intf, NULL);
+fail_free:
+	usb_free_urb(catc->ctrl_urb);
+	usb_free_urb(catc->tx_urb);
+	usb_free_urb(catc->rx_urb);
+	usb_free_urb(catc->irq_urb);
+	free_netdev(netdev);
+	return ret;
 }
 
 static void catc_disconnect(struct usb_interface *intf)

[toc] | [prev] | [next] | [standalone]

#1597428 — [PATCH 3.2 004/199] perf scripting: Avoid leaking the scripting_context variable

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Arnaldo Carvalho de Melo <acme@redhat.com>

commit cf346d5bd4b9d61656df2f72565c9b354ef3ca0d upstream.

Both register_perl_scripting() and register_python_scripting() allocate
this variable, fix it by checking if it already was.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Tom Zanussi <tzanussi@gmail.com>
Cc: Wang Nan <wangnan0@huawei.com>
Fixes: 7e4b21b84c43 ("perf/scripts: Add Python scripting engine")
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 tools/perf/util/trace-event-scripting.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -88,7 +88,8 @@ static void register_python_scripting(st
 	if (err)
 		die("error registering py script extension");
 
-	scripting_context = malloc(sizeof(struct scripting_context));
+	if (scripting_context == NULL)
+		scripting_context = malloc(sizeof(*scripting_context));
 }
 
 #ifdef NO_LIBPYTHON
@@ -149,7 +150,8 @@ static void register_perl_scripting(stru
 	if (err)
 		die("error registering pl script extension");
 
-	scripting_context = malloc(sizeof(struct scripting_context));
+	if (scripting_context == NULL)
+		scripting_context = malloc(sizeof(*scripting_context));
 }
 
 #ifdef NO_LIBPERL

[toc] | [prev] | [next] | [standalone]

#1597429 — [PATCH 3.2 001/199] staging: iio: ad7606: fix improper setting of oversampling pins

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eva Rachel Retuya <eraretuya@gmail.com>

commit b321a38d2407c7e425c54bc09be909a34e49f740 upstream.

The oversampling ratio is controlled using the oversampling pins,
OS [2:0] with OS2 being the MSB control bit, and OS0 the LSB control
bit.

The gpio connected to the OS2 pin is not being set correctly, only OS0
and OS1 pins are being set. Fix the typo to allow proper control of the
oversampling pins.

Signed-off-by: Eva Rachel Retuya <eraretuya@gmail.com>
Fixes: b9618c0 ("staging: IIO: ADC: New driver for AD7606/AD7606-6/AD7606-4")
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/staging/iio/adc/ad7606_core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/staging/iio/adc/ad7606_core.c
+++ b/drivers/staging/iio/adc/ad7606_core.c
@@ -185,7 +185,7 @@ static ssize_t ad7606_store_oversampling
 	mutex_lock(&indio_dev->mlock);
 	gpio_set_value(st->pdata->gpio_os0, (ret >> 0) & 1);
 	gpio_set_value(st->pdata->gpio_os1, (ret >> 1) & 1);
-	gpio_set_value(st->pdata->gpio_os1, (ret >> 2) & 1);
+	gpio_set_value(st->pdata->gpio_os2, (ret >> 2) & 1);
 	st->oversampling = lval;
 	mutex_unlock(&indio_dev->mlock);
 

[toc] | [prev] | [next] | [standalone]

#1597430 — [PATCH 3.2 110/199] xhci: fix deadlock at host remove by running watchdog correctly

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Mathias Nyman <mathias.nyman@linux.intel.com>

commit d6169d04097fd9ddf811e63eae4e5cd71e6666e2 upstream.

If a URB is killed while the host is removed we can end up in a situation
where the hub thread takes the roothub device lock, and waits for
the URB to be given back by xhci-hcd, blocking the host remove code.

xhci-hcd tries to stop the endpoint and give back the urb, but can't
as the host is removed from PCI bus at the same time, preventing the normal
way of giving back urb.

Instead we need to rely on the stop command timeout function to give back
the urb. This xhci_stop_endpoint_command_watchdog() timeout function
used a XHCI_STATE_DYING flag to indicate if the timeout function is already
running, but later this flag has been taking into use in other places to
mark that xhci is dying.

Remove checks for XHCI_STATE_DYING in xhci_urb_dequeue. We are still
checking that reading from pci state does not return 0xffffffff or that
host is not halted before trying to stop the endpoint.

This whole area of stopping endpoints, giving back URBs, and the wathdog
timeout need rework, this fix focuses on solving a specific deadlock
issue that we can then send to stable before any major rework.

Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: the checks look slightly different]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/host/xhci-ring.c | 11 -----------
 drivers/usb/host/xhci.c      | 13 -------------
 2 files changed, 24 deletions(-)

--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -969,12 +969,6 @@ void xhci_stop_endpoint_command_watchdog
 	spin_lock_irqsave(&xhci->lock, flags);
 
 	ep->stop_cmds_pending--;
-	if (xhci->xhc_state & XHCI_STATE_DYING) {
-		xhci_dbg(xhci, "Stop EP timer ran, but another timer marked "
-				"xHCI as DYING, exiting.\n");
-		spin_unlock_irqrestore(&xhci->lock, flags);
-		return;
-	}
 	if (!(ep->stop_cmds_pending == 0 && (ep->ep_state & EP_HALT_PENDING))) {
 		xhci_dbg(xhci, "Stop EP timer ran, but no command pending, "
 				"exiting.\n");
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1549,18 +1549,6 @@ int xhci_urb_dequeue(struct usb_hcd *hcd
 		xhci_urb_free_priv(xhci, urb_priv);
 		return ret;
 	}
-	if ((xhci->xhc_state & XHCI_STATE_DYING) ||
-			(xhci->xhc_state & XHCI_STATE_HALTED)) {
-		xhci_dbg(xhci, "Ep 0x%x: URB %p to be canceled on "
-				"non-responsive xHCI host.\n",
-				urb->ep->desc.bEndpointAddress, urb);
-		/* Let the stop endpoint command watchdog timer (which set this
-		 * state) finish cleaning up the endpoint TD lists.  We must
-		 * have caught it in the middle of dropping a lock and giving
-		 * back an URB.
-		 */
-		goto done;
-	}
 
 	xhci_dbg(xhci, "Cancel URB %p\n", urb);
 	xhci_dbg(xhci, "Event ring:\n");

[toc] | [prev] | [next] | [standalone]

#1597431 — [PATCH 3.2 129/199] can: bcm: fix hrtimer/tasklet termination in bcm op removal

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <socketcan@hartkopp.net>

commit a06393ed03167771246c4c43192d9c264bc48412 upstream.

When removing a bcm tx operation either a hrtimer or a tasklet might run.
As the hrtimer triggers its associated tasklet and vice versa we need to
take care to mutually terminate both handlers.

Reported-by: Michael Josenhans <michael.josenhans@web.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Tested-by: Michael Josenhans <michael.josenhans@web.de>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/can/bcm.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -702,14 +702,23 @@ static struct bcm_op *bcm_find_op(struct
 
 static void bcm_remove_op(struct bcm_op *op)
 {
-	hrtimer_cancel(&op->timer);
-	hrtimer_cancel(&op->thrtimer);
+	if (op->tsklet.func) {
+		while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) ||
+		       test_bit(TASKLET_STATE_RUN, &op->tsklet.state) ||
+		       hrtimer_active(&op->timer)) {
+			hrtimer_cancel(&op->timer);
+			tasklet_kill(&op->tsklet);
+		}
+	}
 
-	if (op->tsklet.func)
-		tasklet_kill(&op->tsklet);
-
-	if (op->thrtsklet.func)
-		tasklet_kill(&op->thrtsklet);
+	if (op->thrtsklet.func) {
+		while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) ||
+		       test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) ||
+		       hrtimer_active(&op->thrtimer)) {
+			hrtimer_cancel(&op->thrtimer);
+			tasklet_kill(&op->thrtsklet);
+		}
+	}
 
 	if ((op->frames) && (op->frames != &op->sframe))
 		kfree(op->frames);

[toc] | [prev] | [next] | [standalone]

#1597435 — [PATCH 3.2 104/199] gro: Disable frag0 optimization on IPv6 ext headers

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Herbert Xu <herbert@gondor.apana.org.au>

commit 57ea52a865144aedbcd619ee0081155e658b6f7d upstream.

The GRO fast path caches the frag0 address.  This address becomes
invalid if frag0 is modified by pskb_may_pull or its variants.
So whenever that happens we must disable the frag0 optimization.

This is usually done through the combination of gro_header_hard
and gro_header_slow, however, the IPv6 extension header path did
the pulling directly and would continue to use the GRO fast path
incorrectly.

This patch fixes it by disabling the fast path when we enter the
IPv6 extension header path.

Fixes: 78a478d0efd9 ("gro: Inline skb_gro_header and cache frag0 virtual address")
Reported-by: Slava Shwartsman <slavash@mellanox.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 include/linux/netdevice.h | 9 +++++++--
 net/ipv6/af_inet6.c       | 1 +
 2 files changed, 8 insertions(+), 2 deletions(-)

--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1676,14 +1676,19 @@ static inline int skb_gro_header_hard(st
 	return NAPI_GRO_CB(skb)->frag0_len < hlen;
 }
 
+static inline void skb_gro_frag0_invalidate(struct sk_buff *skb)
+{
+	NAPI_GRO_CB(skb)->frag0 = NULL;
+	NAPI_GRO_CB(skb)->frag0_len = 0;
+}
+
 static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
 					unsigned int offset)
 {
 	if (!pskb_may_pull(skb, hlen))
 		return NULL;
 
-	NAPI_GRO_CB(skb)->frag0 = NULL;
-	NAPI_GRO_CB(skb)->frag0_len = 0;
+	skb_gro_frag0_invalidate(skb);
 	return skb->data + offset;
 }
 
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -879,6 +879,7 @@ static struct sk_buff **ipv6_gro_receive
 	ops = rcu_dereference(inet6_protos[proto]);
 	if (!ops || !ops->gro_receive) {
 		__pskb_pull(skb, skb_gro_offset(skb));
+		skb_gro_frag0_invalidate(skb);
 		proto = ipv6_gso_pull_exthdrs(skb, proto);
 		skb_gro_pull(skb, -skb_transport_offset(skb));
 		skb_reset_transport_header(skb);

[toc] | [prev] | [next] | [standalone]

#1597439 — [PATCH 3.2 113/199] svcrpc: don't leak contexts on PROC_DESTROY

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: "J. Bruce Fields" <bfields@redhat.com>

commit 78794d1890708cf94e3961261e52dcec2cc34722 upstream.

Context expiry times are in units of seconds since boot, not unix time.

The use of get_seconds() here therefore sets the expiry time decades in
the future.  This prevents timely freeing of contexts destroyed by
client RPC_GSS_PROC_DESTROY requests.  We'd still free them eventually
(when the module is unloaded or the container shut down), but a lot of
contexts could pile up before then.

Fixes: c5b29f885afe "sunrpc: use seconds since boot in expiry cache"
Reported-by: Andy Adamson <andros@netapp.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/sunrpc/auth_gss/svcauth_gss.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1151,7 +1151,7 @@ svcauth_gss_accept(struct svc_rqst *rqst
 	case RPC_GSS_PROC_DESTROY:
 		if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
 			goto auth_err;
-		rsci->h.expiry_time = get_seconds();
+		rsci->h.expiry_time = seconds_since_boot();
 		set_bit(CACHE_NEGATIVE, &rsci->h.flags);
 		if (resv->iov_len + 4 > PAGE_SIZE)
 			goto drop;

[toc] | [prev] | [next] | [standalone]

#1597442 — [PATCH 3.2 086/199] x86/cpu: Fix bootup crashes by sanitizing the argument of the 'clearcpuid=' command-line option

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Lukasz Odzioba <lukasz.odzioba@intel.com>

commit dd853fd216d1485ed3045ff772079cc8689a9a4a upstream.

A negative number can be specified in the cmdline which will be used as
setup_clear_cpu_cap() argument. With that we can clear/set some bit in
memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel
to misbehave. This patch adds lower bound check to setup_disablecpuid().

Boris Petkov reproduced a crash:

  [    1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540
  [    1.236535] IP: memcpy_erms+0x6/0x10

Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com>
Acked-by: Borislav Petkov <bp@suse.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: andi.kleen@intel.com
Cc: bp@alien8.de
Cc: dave.hansen@linux.intel.com
Cc: luto@kernel.org
Cc: slaoub@gmail.com
Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option")
Link: http://lkml.kernel.org/r/1482933340-11857-1-git-send-email-lukasz.odzioba@intel.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/x86/kernel/cpu/common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1012,7 +1012,7 @@ static __init int setup_disablecpuid(cha
 {
 	int bit;
 
-	if (get_option(&arg, &bit) && bit < NCAPINTS*32)
+	if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32)
 		setup_clear_cpu_cap(bit);
 	else
 		return 0;

[toc] | [prev] | [next] | [standalone]

#1597443 — [PATCH 3.2 136/199] rtl8150: Use heap buffers for all register access

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 7926aff5c57b577ab0f43364ff0c59d968f6a414 upstream.

Allocating USB buffers on the stack is not portable, and no longer
works on x86_64 (with VMAP_STACK enabled as per default).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
 drivers/net/usb/rtl8150.c | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -178,16 +178,36 @@ static const char driver_name [] = "rtl8
 */
 static int get_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
 {
-	return usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
-			       RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
-			       indx, 0, data, size, 500);
+	void *buf;
+	int ret;
+
+	buf = kmalloc(size, GFP_NOIO);
+	if (!buf)
+		return -ENOMEM;
+
+	ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+			      RTL8150_REQ_GET_REGS, RTL8150_REQT_READ,
+			      indx, 0, buf, size, 500);
+	if (ret > 0 && ret <= size)
+		memcpy(data, buf, ret);
+	kfree(buf);
+	return ret;
 }
 
-static int set_registers(rtl8150_t * dev, u16 indx, u16 size, void *data)
+static int set_registers(rtl8150_t * dev, u16 indx, u16 size, const void *data)
 {
-	return usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
-			       RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
-			       indx, 0, data, size, 500);
+	void *buf;
+	int ret;
+
+	buf = kmemdup(data, size, GFP_NOIO);
+	if (!buf)
+		return -ENOMEM;
+
+	ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+			      RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE,
+			      indx, 0, buf, size, 500);
+	kfree(buf);
+	return ret;
 }
 
 static void ctrl_callback(struct urb *urb)

[toc] | [prev] | [next] | [standalone]

#1597444 — [PATCH 3.2 126/199] USB: Add quirk for WORLDE easykey.25 MIDI keyboard

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Lukáš Lalinský <lukas@oxygene.sk>

commit d9b2997e4a0a874e452df7cdd7de5a54502bd0aa upstream.

Add a quirk for WORLDE easykey.25 MIDI keyboard (idVendor=0218,
idProduct=0401). The device reports that it has config string
descriptor at index 3, but when the system selects the configuration
and tries to get the description, it returns a -EPROTO error,
the communication restarts and this keeps repeating over and over again.
Not requesting the string descriptor makes the device work correctly.

Relevant info from Wireshark:

[...]

CONFIGURATION DESCRIPTOR
    bLength: 9
    bDescriptorType: 0x02 (CONFIGURATION)
    wTotalLength: 101
    bNumInterfaces: 2
    bConfigurationValue: 1
    iConfiguration: 3
    Configuration bmAttributes: 0xc0  SELF-POWERED  NO REMOTE-WAKEUP
        1... .... = Must be 1: Must be 1 for USB 1.1 and higher
        .1.. .... = Self-Powered: This device is SELF-POWERED
        ..0. .... = Remote Wakeup: This device does NOT support remote wakeup
    bMaxPower: 50  (100mA)

[...]

     45 0.369104       host                  2.38.0                USB      64     GET DESCRIPTOR Request STRING

[...]

URB setup
    bmRequestType: 0x80
        1... .... = Direction: Device-to-host
        .00. .... = Type: Standard (0x00)
        ...0 0000 = Recipient: Device (0x00)
    bRequest: GET DESCRIPTOR (6)
    Descriptor Index: 0x03
    bDescriptorType: 0x03
    Language Id: English (United States) (0x0409)
    wLength: 255

     46 0.369255       2.38.0                host                  USB      64     GET DESCRIPTOR Response STRING[Malformed Packet]

[...]

Frame 46: 64 bytes on wire (512 bits), 64 bytes captured (512 bits) on interface 0
USB URB
    [Source: 2.38.0]
    [Destination: host]
    URB id: 0xffff88021f62d480
    URB type: URB_COMPLETE ('C')
    URB transfer type: URB_CONTROL (0x02)
    Endpoint: 0x80, Direction: IN
    Device: 38
    URB bus id: 2
    Device setup request: not relevant ('-')
    Data: present (0)
    URB sec: 1484896277
    URB usec: 455031
    URB status: Protocol error (-EPROTO) (-71)
    URB length [bytes]: 0
    Data length [bytes]: 0
    [Request in: 45]
    [Time from request: 0.000151000 seconds]
    Unused Setup Header
    Interval: 0
    Start frame: 0
    Copy of Transfer Flags: 0x00000200
    Number of ISO descriptors: 0
[Malformed Packet: USB]
    [Expert Info (Error/Malformed): Malformed Packet (Exception occurred)]
        [Malformed Packet (Exception occurred)]
        [Severity level: Error]
        [Group: Malformed]

Signed-off-by: Lukáš Lalinský <lukas@oxygene.sk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/core/quirks.c | 4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -36,6 +36,10 @@ static const struct usb_device_id usb_qu
 	/* CBM - Flash disk */
 	{ USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME },
 
+	/* WORLDE easy key (easykey.25) MIDI controller  */
+	{ USB_DEVICE(0x0218, 0x0401), .driver_info =
+			USB_QUIRK_CONFIG_INTF_STRINGS },
+
 	/* HP 5300/5370C scanner */
 	{ USB_DEVICE(0x03f0, 0x0701), .driver_info =
 			USB_QUIRK_STRING_FETCH_255 },

[toc] | [prev] | [next] | [standalone]

#1597445 — [PATCH 3.2 120/199] powerpc/ptrace: Preserve previous fprs/vsrs on short regset write

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Martin <Dave.Martin@arm.com>

commit 99dfe80a2a246c600440a815741fd2e74a8b4977 upstream.

Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET
to fill all the registers, the thread's old registers are preserved.

Fixes: c6e6771b87d4 ("powerpc: Introduce VSX thread_struct and CONFIG_VSX")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
[bwh: Backported to 3.2:
 - fpscr and fpr are direct members of struct thread_struct
 - Use memcpy() for fpscr, like the reverse copy below, to avoid type error
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 arch/powerpc/kernel/ptrace.c | 7 +++++++
 1 file changed, 7 insertions(+)

--- a/arch/powerpc/kernel/ptrace.c
+++ b/arch/powerpc/kernel/ptrace.c
@@ -359,6 +359,10 @@ static int fpr_set(struct task_struct *t
 	flush_fp_to_thread(target);
 
 #ifdef CONFIG_VSX
+	for (i = 0; i < 32 ; i++)
+		buf[i] = target->thread.TS_FPR(i);
+	memcpy(&buf[32], &target->thread.fpscr, sizeof(double));
+
 	/* copy to local buffer then write that out */
 	i = user_regset_copyin(&pos, &count, &kbuf, &ubuf, buf, 0, -1);
 	if (i)
@@ -501,6 +505,9 @@ static int vsr_set(struct task_struct *t
 
 	flush_vsx_to_thread(target);
 
+	for (i = 0; i < 32 ; i++)
+		buf[i] = target->thread.fpr[i][TS_VSRLOWOFFSET];
+
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
 				 buf, 0, 32 * sizeof(double));
 	for (i = 0; i < 32 ; i++)

[toc] | [prev] | [next] | [standalone]

#1597446 — [PATCH 3.2 087/199] usb: musb: Fix trying to free already-free IRQ 4

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Tony Lindgren <tony@atomide.com>

commit 8c300fe282fa254ea730c92cb0983e2642dc1fff upstream.

When unloading omap2430, we can get the following splat:

WARNING: CPU: 1 PID: 295 at kernel/irq/manage.c:1478 __free_irq+0xa8/0x2c8
Trying to free already-free IRQ 4
...
[<c01a8b78>] (free_irq) from [<bf0aea84>]
(musbhs_dma_controller_destroy+0x28/0xb0 [musb_hdrc])
[<bf0aea84>] (musbhs_dma_controller_destroy [musb_hdrc]) from
[<bf09f88c>] (musb_remove+0xf0/0x12c [musb_hdrc])
[<bf09f88c>] (musb_remove [musb_hdrc]) from [<c056a384>]
(platform_drv_remove+0x24/0x3c)
...

This is because the irq number in use is 260 nowadays, and the dma
controller is using u8 instead of int.

Fixes: 6995eb68aab7 ("USB: musb: enable low level DMA operation for Blackfin")
Signed-off-by: Tony Lindgren <tony@atomide.com>
[b-liu@ti.com: added Fixes tag]
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/musb/musbhsdma.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/usb/musb/musbhsdma.h
+++ b/drivers/usb/musb/musbhsdma.h
@@ -161,5 +161,5 @@ struct musb_dma_controller {
 	void __iomem			*base;
 	u8				channel_count;
 	u8				used_channels;
-	u8				irq;
+	int				irq;
 };

[toc] | [prev] | [next] | [standalone]

#1597447 — [PATCH 3.2 141/199] ping: fix a null pointer dereference

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: WANG Cong <xiyou.wangcong@gmail.com>

commit 73d2c6678e6c3af7e7a42b1e78cd0211782ade32 upstream.

Andrey reported a kernel crash:

  general protection fault: 0000 [#1] SMP KASAN
  Dumping ftrace buffer:
     (ftrace buffer empty)
  Modules linked in:
  CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
  task: ffff880060048040 task.stack: ffff880069be8000
  RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline]
  RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837
  RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206
  RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000
  RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2
  RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000
  R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0
  R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000
  FS:  00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0
  Call Trace:
   inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
   sock_sendmsg_nosec net/socket.c:635 [inline]
   sock_sendmsg+0xca/0x110 net/socket.c:645
   SYSC_sendto+0x660/0x810 net/socket.c:1687
   SyS_sendto+0x40/0x50 net/socket.c:1655
   entry_SYSCALL_64_fastpath+0x1f/0xc2

This is because we miss a check for NULL pointer for skb_peek() when
the queue is empty. Other places already have the same check.

Fixes: c319b4d76b9e ("net: ipv4: add IPPROTO_ICMP socket kind")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/ipv4/ping.c | 2 ++
 1 file changed, 2 insertions(+)

--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -452,6 +452,8 @@ static int ping_push_pending_frames(stru
 {
 	struct sk_buff *skb = skb_peek(&sk->sk_write_queue);
 
+	if (!skb)
+		return 0;
 	pfh->wcheck = csum_partial((char *)&pfh->icmph,
 		sizeof(struct icmphdr), pfh->wcheck);
 	pfh->icmph.checksum = csum_fold(pfh->wcheck);

[toc] | [prev] | [next] | [standalone]

#1597448 — [PATCH 3.2 082/199] USB: serial: pl2303: fix NULL-deref at open

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit 76ab439ed1b68778e9059c79ecc5d14de76c89a8 upstream.

Fix NULL-pointer dereference in open() should a type-0 or type-1 device
lack the expected endpoints:

Unable to handle kernel NULL pointer dereference at virtual address 00000030
...
PC is at pl2303_open+0x38/0xec [pl2303]

Note that a missing interrupt-in endpoint would have caused open() to
fail.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/usb/serial/pl2303.c | 8 ++++++++
 1 file changed, 8 insertions(+)

--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -185,10 +185,18 @@ static int pl2303_vendor_write(__u16 val
 static int pl2303_startup(struct usb_serial *serial)
 {
 	struct pl2303_private *priv;
+	unsigned char num_ports = serial->num_ports;
 	enum pl2303_type type = type_0;
 	unsigned char *buf;
 	int i;
 
+	if (serial->num_bulk_in < num_ports ||
+			serial->num_bulk_out < num_ports ||
+			serial->num_interrupt_in < num_ports) {
+		dev_err(&serial->interface->dev, "missing endpoints\n");
+		return -ENODEV;
+	}
+
 	buf = kmalloc(10, GFP_KERNEL);
 	if (buf == NULL)
 		return -ENOMEM;

[toc] | [prev] | [next] | [standalone]

#1597449 — [PATCH 3.2 134/199] mac80211: Fix adding of mesh vendor IEs

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Thorsten Horstmann <thorsten@defutech.de>

commit da7061c82e4a1bc6a5e134ef362c86261906c860 upstream.

The function ieee80211_ie_split_vendor doesn't return 0 on errors. Instead
it returns any offset < ielen when WLAN_EID_VENDOR_SPECIFIC is found. The
return value in mesh_add_vendor_ies must therefore be checked against
ifmsh->ie_len and not 0. Otherwise all ifmsh->ie starting with
WLAN_EID_VENDOR_SPECIFIC will be rejected.

Fixes: 082ebb0c258d ("mac80211: fix mesh beacon format")
Signed-off-by: Thorsten Horstmann <thorsten@defutech.de>
Signed-off-by: Mathias Kretschmer <mathias.kretschmer@fit.fraunhofer.de>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[sven@narfation.org: Add commit message]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/mac80211/mesh.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -280,7 +280,7 @@ mesh_add_vendor_ies(struct sk_buff *skb,
 	/* fast-forward to vendor IEs */
 	offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0);
 
-	if (offset) {
+	if (offset < ifmsh->ie_len) {
 		len = ifmsh->ie_len - offset;
 		data = ifmsh->ie + offset;
 		if (skb_tailroom(skb) < len)

[toc] | [prev] | [next] | [standalone]

#1597450 — [PATCH 3.2 132/199] mm, fs: check for fatal signals in do_generic_file_read()

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Michal Hocko <mhocko@suse.com>

commit 5abf186a30a89d5b9c18a6bf93a2c192c9fd52f6 upstream.

do_generic_file_read() can be told to perform a large request from
userspace.  If the system is under OOM and the reading task is the OOM
victim then it has an access to memory reserves and finishing the full
request can lead to the full memory depletion which is dangerous.  Make
sure we rather go with a short read and allow the killed task to
terminate.

Link: http://lkml.kernel.org/r/20170201092706.9966-3-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 mm/filemap.c | 5 +++++
 1 file changed, 5 insertions(+)

--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -1117,6 +1117,11 @@ static void do_generic_file_read(struct
 
 		cond_resched();
 find_page:
+		if (fatal_signal_pending(current)) {
+			error = -EINTR;
+			goto out;
+		}
+
 		page = find_get_page(mapping, index);
 		if (!page) {
 			page_cache_sync_readahead(mapping,

[toc] | [prev] | [next] | [standalone]

#1597451 — [PATCH 3.2 116/199] can: ti_hecc: add missing prepare and unprepare of the clock

3.2.87-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Yegor Yefremov <yegorslists@googlemail.com>

commit befa60113ce7ea270cb51eada28443ca2756f480 upstream.

In order to make the driver work with the common clock framework, this
patch converts the clk_enable()/clk_disable() to
clk_prepare_enable()/clk_disable_unprepare().

Also add error checking for clk_prepare_enable().

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 drivers/net/can/ti_hecc.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -942,7 +942,12 @@ static int ti_hecc_probe(struct platform
 	netif_napi_add(ndev, &priv->napi, ti_hecc_rx_poll,
 		HECC_DEF_NAPI_WEIGHT);
 
-	clk_enable(priv->clk);
+	err = clk_prepare_enable(priv->clk);
+	if (err) {
+		dev_err(&pdev->dev, "clk_prepare_enable() failed\n");
+		goto probe_exit_clk;
+	}
+
 	err = register_candev(ndev);
 	if (err) {
 		dev_err(&pdev->dev, "register_candev() failed\n");
@@ -972,7 +977,7 @@ static int __devexit ti_hecc_remove(stru
 	struct ti_hecc_priv *priv = netdev_priv(ndev);
 
 	unregister_candev(ndev);
-	clk_disable(priv->clk);
+	clk_disable_unprepare(priv->clk);
 	clk_put(priv->clk);
 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
 	iounmap(priv->base);
@@ -998,7 +1003,7 @@ static int ti_hecc_suspend(struct platfo
 	hecc_set_bit(priv, HECC_CANMC, HECC_CANMC_PDR);
 	priv->can.state = CAN_STATE_SLEEPING;
 
-	clk_disable(priv->clk);
+	clk_disable_unprepare(priv->clk);
 
 	return 0;
 }
@@ -1007,8 +1012,11 @@ static int ti_hecc_resume(struct platfor
 {
 	struct net_device *dev = platform_get_drvdata(pdev);
 	struct ti_hecc_priv *priv = netdev_priv(dev);
+	int err;
 
-	clk_enable(priv->clk);
+	err = clk_prepare_enable(priv->clk);
+	if (err)
+		return err;
 
 	hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_PDR);
 	priv->can.state = CAN_STATE_ERROR_ACTIVE;

[toc] | [prev] | [next] | [standalone]

Page 2 of 7 — ← Prev page 1 [2] 3 4 5 6 7  Next page →

Back to top | Article view | linux.kernel

csiph-web