Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1627030 > unrolled thread

[PATCH 3.18 000/124] 3.18.50-stable review

Started byGreg Kroah-Hartman <gregkh@linuxfoundation.org>
First post2017-04-20 08:40 +0200
Last post2017-04-21 12:20 +0200
Articles 20 on this page of 116 — 4 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 047/124] xen/acpi: upload PM state from init-domain to Xen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 055/124] rtc: tegra: Implement clock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 019/124] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 027/124] metag/ptrace: Reject partial NT_METAG_RPIPE writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 006/124] iscsi-target: Fix TMR reference leak during session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 013/124] char: lack of bool string made CONFIG_DEVPORT always on Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 025/124] metag/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 004/124] x86/vdso: Plug race between mapping and ELF header setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 050/124] zram: do not use copy_page with non-page aligned address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 001/124] CIFS: store results of cifs_reopen_file to avoid infinite wait Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 062/124] catc: Combine failure cleanup code in catc_probe() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 024/124] sparc/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 031/124] ptrace: fix PTRACE_LISTEN race corrupting task->state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 063/124] catc: Use heap buffer for memory size test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 045/124] scsi: sg: check length passed to SG_NEXT_CMD_LEN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:40 +0200
    [PATCH 3.18 103/124] xfs: fix up xfs_swap_extent_forks inline extent handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 104/124] xfs: clear _XBF_PAGES from buffers when readahead page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 080/124] Input: hanwang - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 105/124] ACPI: Fix incompatibility with mcount-based function graph tracing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 074/124] isdn/gigaset: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 100/124] igb: Workaround for igb i210 firmware issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 084/124] Input: sur40 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 075/124] percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 117/124] metag/usercopy: Drop unused macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 109/124] block: allow WRITE_SAME commands with the SG_IO ioctl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 124/124] give up on gcc ilog2() constant optimizations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 040/124] powerpc: Dont try to fix up misaligned load-with-reservation instructions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 120/124] metag/usercopy: Zero rest of buffer from copy_from_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 083/124] Input: kbtab - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 081/124] Input: yealink - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 115/124] ring-buffer: Fix return value check in test_ringbuffer() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 123/124] metag/usercopy: Add missing fixups Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 116/124] MIPS: Flush wrong invalid FTLB entry for huge page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 106/124] ACPI: Do not create a platform_device for IOAPIC/IOxAPIC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 097/124] ext4: mark inode dirty after converting inline directory Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 082/124] Input: cm109 - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 114/124] mm/mempolicy.c: fix error handling in set_mempolicy and mbind. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 092/124] mmc: ushc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 102/124] xfs: dont allow di_size with high bit set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 079/124] Input: ims-pcu - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 078/124] Input: iforce - validate number of endpoints before using them Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 118/124] metag/usercopy: Fix alignment error checking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 119/124] metag/usercopy: Add early abort to copy_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 086/124] net/mlx5: Increase number of max QPs in default profile Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 122/124] metag/usercopy: Fix src fixup in from user rapf loops Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 121/124] metag/usercopy: Set flags before ADDZ Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 077/124] Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 107/124] serial: 8250_pci: Detach low-level driver during PCI error recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 101/124] igb: add i211 to i210 PHY workaround Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 073/124] target: Fix VERIFY_16 handling in sbc_parse_cdb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 112/124] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 108/124] [media] uvcvideo: uvc_scan_fallback() for webcams with broken chain Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 110/124] virtio_balloon: init 1st buffer in stats vq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 111/124] pinctrl: qcom: Dont clear status bit on irq_unmask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 08:50 +0200
    [PATCH 3.18 098/124] mmc: sdhci: Do not disable interrupts while waiting for clock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 032/124] Drivers: hv: balloon: dont crash when memory is added in non-sorted order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 059/124] virtio-console: avoid DMA from stack Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 069/124] KVM: kvm_io_bus_unregister_dev() should never fail Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 041/124] powerpc/boot: Fix zImage TOC alignment Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 067/124] KVM: PPC: Book3S PR: Fix illegal opcode emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 093/124] uwb: hwa-rc: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 088/124] net: properly release sk_frag.page Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 076/124] ipv4: provide stronger user input validation in nl_fib_input() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 094/124] uwb: i1480-dfu: fix NULL-deref at probe Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 066/124] net sched actions: decrement module reference count after table flush. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 095/124] USB: usbtmc: add missing endpoint sanity check Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 056/124] mm: Tighten x86 /dev/mem with zeroing reads Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 061/124] rtl8150: Use heap buffers for all register access Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 096/124] iio: adc: ti_am335x_adc: fix fifo overrun recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 090/124] socket, bpf: fix sk_filter use after free in sk_clone_lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 052/124] crypto: ahash - Fix EINPROGRESS notification callback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 071/124] perf/core: Fix event inheritance on fork() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 072/124] md/raid1/10: fix potential deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 099/124] iommu/vt-d: Fix NULL pointer dereference in device_to_iommu Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 089/124] net: unix: properly re-increment inflight counter of GC discarded candidates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 039/124] powerpc/mm: Add missing global TLB invalidate if cxl is active Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 038/124] ALSA: seq: Fix race during FIFO resize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 051/124] powerpc: Disable HFSCR[TM] if TM is not supported Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 087/124] net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 091/124] tcp: initialize icsk_ack.lrcvtime at session start time Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:00 +0200
    [PATCH 3.18 014/124] Revert "ARM: 8457/1: psci-smp is built only for SMP" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 012/124] char: Drop bogus dependency of DEVPORT on !M68K Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 002/124] Input: xpad - add support for Razer Wildcat gamepad Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 053/124] [media] dvb-usb-v2: avoid use-after-free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 023/124] mips/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 022/124] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 043/124] scsi: lpfc: Add shutdown method for kexec Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 017/124] drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 008/124] scsi: sr: Sanity check returned mode data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 009/124] scsi: sd: Fix capacity calculation with 32-bit sector_t Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 049/124] tty/serial: atmel: fix race condition (TX+DMA) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
      Re: [PATCH 3.18 049/124] tty/serial: atmel: fix race condition  (TX+DMA) Richard Genoud <richard.genoud@gmail.com> - 2017-04-20 09:50 +0200
        Re: [PATCH 3.18 049/124] tty/serial: atmel: fix race condition  (TX+DMA) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 15:40 +0200
    [PATCH 3.18 021/124] drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 028/124] s390/decompressor: fix initrd corruption caused by bss clear Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 015/124] kvm: fix page struct leak in handle_vmon Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 026/124] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 029/124] s390/uaccess: get_user() should zero on failure (again) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 007/124] iscsi-target: Drop work-around for legacy GlobalSAN initiator Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 042/124] target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 005/124] x86/vdso: Ensure vdso32_enabled gets set to valid values only Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 044/124] scsi: libiscsi: add lock around task lists to fix list corruption regression Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 020/124] drm/vmwgfx: Remove getparam error message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 030/124] Reset TreeId to zero on SMB2 TREE_CONNECT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 046/124] scsi: libsas: fix ata xfer length Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    [PATCH 3.18 018/124] drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 09:10 +0200
    Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-20 15:50 +0200
      Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 16:30 +0200
        Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-20 22:00 +0200
          Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-21 05:40 +0200
            Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 06:40 +0200
              Re: [PATCH 3.18 000/124] 3.18.50-stable review Guenter Roeck <linux@roeck-us.net> - 2017-04-21 19:10 +0200
                Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 20:20 +0200
    Re: [PATCH 3.18 000/124] 3.18.50-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-04-21 09:20 +0200
      Re: [PATCH 3.18 000/124] 3.18.50-stable review Mark Brown <broonie@kernel.org> - 2017-04-21 12:20 +0200

Page 1 of 6  [1] 2 3 4 5 6  Next page →


#1627030 — [PATCH 3.18 000/124] 3.18.50-stable review

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 000/124] 3.18.50-stable review
Message-ID<tydUZ-5tf-5@gated-at.bofh.it>
This is the start of the stable review cycle for the 3.18.50 release.
There are 124 patches in this series, all will be posted as a response
to this one.  If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat Apr 22 06:35:33 UTC 2017.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
	kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.50-rc1.gz
or in the git tree and branch at:
  git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Linux 3.18.50-rc1

Linus Torvalds <torvalds@linux-foundation.org>
    give up on gcc ilog2() constant optimizations

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Add missing fixups

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Fix src fixup in from user rapf loops

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Set flags before ADDZ

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Zero rest of buffer from copy_from_user

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Add early abort to copy_to_user

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Fix alignment error checking

James Hogan <james.hogan@imgtec.com>
    metag/usercopy: Drop unused macros

Huacai Chen <chenhc@lemote.com>
    MIPS: Flush wrong invalid FTLB entry for huge page

Wei Yongjun <yongjun_wei@trendmicro.com.cn>
    ring-buffer: Fix return value check in test_ringbuffer()

Chris Salls <salls@cs.ucsb.edu>
    mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

Rafał Miłecki <rafal@milecki.pl>
    mtd: bcm47xxpart: fix parsing first block after aligned TRX

Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()

Bjorn Andersson <bjorn.andersson@linaro.org>
    pinctrl: qcom: Don't clear status bit on irq_unmask

Ladi Prosek <lprosek@redhat.com>
    virtio_balloon: init 1st buffer in stats vq

Mauricio Faria de Oliveira <mauricfo@linux.vnet.ibm.com>
    block: allow WRITE_SAME commands with the SG_IO ioctl

Henrik Ingo <henrik.ingo@avoinelama.fi>
    uvcvideo: uvc_scan_fallback() for webcams with broken chain

Gabriel Krisman Bertazi <krisman@linux.vnet.ibm.com>
    serial: 8250_pci: Detach low-level driver during PCI error recovery

Joerg Roedel <jroedel@suse.de>
    ACPI: Do not create a platform_device for IOAPIC/IOxAPIC

Josh Poimboeuf <jpoimboe@redhat.com>
    ACPI: Fix incompatibility with mcount-based function graph tracing

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: clear _XBF_PAGES from buffers when readahead page

Eric Sandeen <sandeen@sandeen.net>
    xfs: fix up xfs_swap_extent_forks inline extent handling

Darrick J. Wong <darrick.wong@oracle.com>
    xfs: don't allow di_size with high bit set

Todd Fujinaka <todd.fujinaka@intel.com>
    igb: add i211 to i210 PHY workaround

Chris J Arges <christopherarges@gmail.com>
    igb: Workaround for igb i210 firmware issue

Koos Vriezen <koos.vriezen@gmail.com>
    iommu/vt-d: Fix NULL pointer dereference in device_to_iommu

Adrian Hunter <adrian.hunter@intel.com>
    mmc: sdhci: Do not disable interrupts while waiting for clock

Eric Biggers <ebiggers@google.com>
    ext4: mark inode dirty after converting inline directory

Michael Engl <michael.engl@wjw-solutions.com>
    iio: adc: ti_am335x_adc: fix fifo overrun recovery

Johan Hovold <johan@kernel.org>
    USB: usbtmc: add missing endpoint sanity check

Johan Hovold <johan@kernel.org>
    uwb: i1480-dfu: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    uwb: hwa-rc: fix NULL-deref at probe

Johan Hovold <johan@kernel.org>
    mmc: ushc: fix NULL-deref at probe

Eric Dumazet <edumazet@google.com>
    tcp: initialize icsk_ack.lrcvtime at session start time

Daniel Borkmann <daniel@iogearbox.net>
    socket, bpf: fix sk_filter use after free in sk_clone_lock

Andrey Ulanov <andreyu@google.com>
    net: unix: properly re-increment inflight counter of GC discarded candidates

Eric Dumazet <edumazet@google.com>
    net: properly release sk_frag.page

Florian Fainelli <f.fainelli@gmail.com>
    net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled

Maor Gottlieb <maorg@mellanox.com>
    net/mlx5: Increase number of max QPs in default profile

Oliver Neukum <oneukum@suse.com>
    ACM gadget: fix endianness in notifications

Johan Hovold <johan@kernel.org>
    Input: sur40 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: kbtab - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: cm109 - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: yealink - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: hanwang - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: ims-pcu - validate number of endpoints before using them

Johan Hovold <johan@kernel.org>
    Input: iforce - validate number of endpoints before using them

Kai-Heng Feng <kai.heng.feng@canonical.com>
    Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000

Eric Dumazet <edumazet@google.com>
    ipv4: provide stronger user input validation in nl_fib_input()

Tahsin Erdogan <tahsin@google.com>
    percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages

Johan Hovold <johan@kernel.org>
    isdn/gigaset: fix NULL-deref at probe

Max Lohrmann <post@wickenrode.com>
    target: Fix VERIFY_16 handling in sbc_parse_cdb

Shaohua Li <shli@fb.com>
    md/raid1/10: fix potential deadlock

Peter Zijlstra <peterz@infradead.org>
    perf/core: Fix event inheritance on fork()

Marc Zyngier <marc.zyngier@arm.com>
    arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region

David Hildenbrand <david@redhat.com>
    KVM: kvm_io_bus_unregister_dev() should never fail

Peter Xu <peterx@redhat.com>
    KVM: x86: clear bus pointer when destroyed

Thomas Huth <thuth@redhat.com>
    KVM: PPC: Book3S PR: Fix illegal opcode emulation

Roman Mashak <mrv@mojatatu.com>
    net sched actions: decrement module reference count after table flush.

Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    sctp: deny peeloff operation on asocs with threads sleeping on it

Mantas M <grawity@gmail.com>
    net: ipv6: check route protocol when deleting routes

Ben Hutchings <ben@decadent.org.uk>
    catc: Use heap buffer for memory size test

Ben Hutchings <ben@decadent.org.uk>
    catc: Combine failure cleanup code in catc_probe()

Ben Hutchings <ben@decadent.org.uk>
    rtl8150: Use heap buffers for all register access

Ben Hutchings <ben@decadent.org.uk>
    pegasus: Use heap buffers for all register access

Omar Sandoval <osandov@fb.com>
    virtio-console: avoid DMA from stack

Stefan Brüns <stefan.bruens@rwth-aachen.de>
    dvb-usb-firmware: don't do DMA on stack

Mauro Carvalho Chehab <mchehab@s-opensource.com>
    dvb-usb: don't use stack for firmware load

Kees Cook <keescook@chromium.org>
    mm: Tighten x86 /dev/mem with zeroing reads

Thierry Reding <treding@nvidia.com>
    rtc: tegra: Implement clock handling

Lee, Chun-Yi <joeyli.kernel@gmail.com>
    platform/x86: acer-wmi: setup accelerometer when machine has appropriate notify event

Arnd Bergmann <arnd@arndb.de>
    dvb-usb-v2: avoid use-after-free

Herbert Xu <herbert@gondor.apana.org.au>
    crypto: ahash - Fix EINPROGRESS notification callback

Benjamin Herrenschmidt <benh@kernel.crashing.org>
    powerpc: Disable HFSCR[TM] if TM is not supported

Minchan Kim <minchan@kernel.org>
    zram: do not use copy_page with non-page aligned address

Richard Genoud <richard.genoud@gmail.com>
    tty/serial: atmel: fix race condition (TX+DMA)

Horia Geantă <horia.geanta@nxp.com>
    crypto: caam - fix RNG deinstantiation error checking

Ankur Arora <ankur.a.arora@oracle.com>
    xen/acpi: upload PM state from init-domain to Xen

John Garry <john.garry@huawei.com>
    scsi: libsas: fix ata xfer length

peter chang <dpf@google.com>
    scsi: sg: check length passed to SG_NEXT_CMD_LEN

Chris Leech <cleech@redhat.com>
    scsi: libiscsi: add lock around task lists to fix list corruption regression

Anton Blanchard <anton@samba.org>
    scsi: lpfc: Add shutdown method for kexec

Nicholas Bellinger <nab@linux-iscsi.org>
    target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export

Michael Ellerman <mpe@ellerman.id.au>
    powerpc/boot: Fix zImage TOC alignment

Paul Mackerras <paulus@ozlabs.org>
    powerpc: Don't try to fix up misaligned load-with-reservation instructions

Frederic Barrat <fbarrat@linux.vnet.ibm.com>
    powerpc/mm: Add missing global TLB invalidate if cxl is active

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix race during FIFO resize

Takashi Iwai <tiwai@suse.de>
    ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: improve irq handling

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: implement reset routine as suggested by the reference

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: make sure all members in the output are set

Uwe Kleine-König <uwe@kleine-koenig.org>
    rtc: s35390a: fix reading out alarm

Vitaly Kuznetsov <vkuznets@redhat.com>
    Drivers: hv: balloon: don't crash when memory is added in non-sorted order

bsegall@google.com <bsegall@google.com>
    ptrace: fix PTRACE_LISTEN race corrupting task->state

Jan-Marek Glogowski <glogow@fbihome.de>
    Reset TreeId to zero on SMB2 TREE_CONNECT

Heiko Carstens <heiko.carstens@de.ibm.com>
    s390/uaccess: get_user() should zero on failure (again)

Marcelo Henrique Cerri <marcelo.cerri@canonical.com>
    s390/decompressor: fix initrd corruption caused by bss clear

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Reject partial NT_METAG_RPIPE writes

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS

Dave Martin <Dave.Martin@arm.com>
    metag/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    sparc/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    mips/ptrace: Preserve previous registers for short regset write

Dave Martin <Dave.Martin@arm.com>
    c6x/ptrace: Remove useless PTRACE_SETREGSET implementation

Li Qiang <liq3ea@gmail.com>
    drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()

Thomas Hellstrom <thellstrom@vmware.com>
    drm/vmwgfx: Remove getparam error message

Thomas Hellstrom <thellstrom@vmware.com>
    drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

Murray McAllister <murray.mcallister@insomniasec.com>
    drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()

Murray McAllister <murray.mcallister@insomniasec.com>
    drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()

Thomas Hellstrom <thellstrom@vmware.com>
    drm/vmwgfx: Type-check lookups of fence objects

Paolo Bonzini <pbonzini@redhat.com>
    kvm: fix page struct leak in handle_vmon

Amit Pundir <amit.pundir@linaro.org>
    Revert "ARM: 8457/1: psci-smp is built only for SMP"

Max Bires <jbires@google.com>
    char: lack of bool string made CONFIG_DEVPORT always on

Geert Uytterhoeven <geert@linux-m68k.org>
    char: Drop bogus dependency of DEVPORT on !M68K

Steven Rostedt (VMware) <rostedt@goodmis.org>
    ftrace: Fix removing of second function probe

Juergen Gross <jgross@suse.com>
    xen, fbfront: fix connecting to backend

Martin K. Petersen <martin.petersen@oracle.com>
    scsi: sd: Fix capacity calculation with 32-bit sector_t

Martin K. Petersen <martin.petersen@oracle.com>
    scsi: sr: Sanity check returned mode data

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Drop work-around for legacy GlobalSAN initiator

Nicholas Bellinger <nab@linux-iscsi.org>
    iscsi-target: Fix TMR reference leak during session shutdown

Mathias Krause <minipli@googlemail.com>
    x86/vdso: Ensure vdso32_enabled gets set to valid values only

Thomas Gleixner <tglx@linutronix.de>
    x86/vdso: Plug race between mapping and ELF header setup

Peter Zijlstra <peterz@infradead.org>
    perf/x86: Avoid exposing wrong/stale data in intel_pmu_lbr_read_32()

Cameron Gutman <aicommander@gmail.com>
    Input: xpad - add support for Razer Wildcat gamepad

Germano Percossi <germano.percossi@citrix.com>
    CIFS: store results of cifs_reopen_file to avoid infinite wait


-------------

Diffstat:

 Makefile                                       |   4 +-
 arch/arm/include/asm/psci.h                    |   2 +-
 arch/arm/kvm/mmu.c                             |   3 +
 arch/c6x/kernel/ptrace.c                       |  41 ----
 arch/metag/include/asm/uaccess.h               |  15 +-
 arch/metag/kernel/ptrace.c                     |  19 +-
 arch/metag/lib/usercopy.c                      | 312 ++++++++++---------------
 arch/mips/kernel/ptrace.c                      |   3 +-
 arch/mips/mm/tlbex.c                           |  25 +-
 arch/powerpc/boot/zImage.lds.S                 |   1 +
 arch/powerpc/kernel/align.c                    |  27 ++-
 arch/powerpc/kernel/setup_64.c                 |   9 +
 arch/powerpc/kvm/emulate.c                     |   1 -
 arch/powerpc/mm/hash_native_64.c               |   7 +-
 arch/s390/boot/compressed/misc.c               |  35 +--
 arch/s390/include/asm/uaccess.h                |   2 +-
 arch/sparc/kernel/ptrace_64.c                  |   2 +-
 arch/x86/include/asm/elf.h                     |   2 +-
 arch/x86/kernel/cpu/perf_event_intel_lbr.c     |   2 +
 arch/x86/kvm/vmx.c                             |  10 +-
 arch/x86/mm/init.c                             |  40 +++-
 arch/x86/vdso/vdso32-setup.c                   |  11 +-
 block/scsi_ioctl.c                             |   3 +
 crypto/ahash.c                                 |  79 ++++---
 drivers/acpi/Makefile                          |   1 -
 drivers/acpi/acpi_platform.c                   |   8 +-
 drivers/block/zram/zram_drv.c                  |   6 +-
 drivers/char/Kconfig                           |   6 +-
 drivers/char/mem.c                             |  82 ++++---
 drivers/char/virtio_console.c                  |  12 +-
 drivers/crypto/caam/ctrl.c                     |   3 +-
 drivers/gpu/drm/ttm/ttm_object.c               |  10 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c          |  79 ++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c          |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c       |   4 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c        |  31 ++-
 drivers/hv/hv_balloon.c                        |   4 +-
 drivers/iio/adc/ti_am335x_adc.c                |  13 +-
 drivers/input/joystick/iforce/iforce-usb.c     |   3 +
 drivers/input/joystick/xpad.c                  |   2 +
 drivers/input/misc/cm109.c                     |   4 +
 drivers/input/misc/ims-pcu.c                   |   4 +
 drivers/input/misc/yealink.c                   |   4 +
 drivers/input/serio/i8042-x86ia64io.h          |   7 +
 drivers/input/tablet/hanwang.c                 |   3 +
 drivers/input/tablet/kbtab.c                   |   3 +
 drivers/input/touchscreen/sur40.c              |   3 +
 drivers/iommu/intel-iommu.c                    |   2 +-
 drivers/isdn/gigaset/bas-gigaset.c             |   3 +
 drivers/md/raid10.c                            |  18 ++
 drivers/media/usb/dvb-usb-v2/dvb_usb_core.c    |  10 +-
 drivers/media/usb/dvb-usb/dvb-usb-firmware.c   |  33 ++-
 drivers/media/usb/uvc/uvc_driver.c             | 118 +++++++++-
 drivers/mmc/host/sdhci.c                       |   4 +-
 drivers/mmc/host/ushc.c                        |   3 +
 drivers/mtd/bcm47xxpart.c                      |  10 +-
 drivers/net/ethernet/broadcom/genet/bcmgenet.c |   6 +-
 drivers/net/ethernet/intel/igb/e1000_phy.c     |   4 +
 drivers/net/ethernet/mellanox/mlx5/core/main.c |   2 +-
 drivers/net/usb/catc.c                         |  56 +++--
 drivers/net/usb/pegasus.c                      |  29 ++-
 drivers/net/usb/rtl8150.c                      |  34 ++-
 drivers/pinctrl/qcom/pinctrl-msm.c             |   4 -
 drivers/platform/x86/acer-wmi.c                |  22 +-
 drivers/rtc/rtc-s35390a.c                      | 167 ++++++++++---
 drivers/rtc/rtc-tegra.c                        |  28 ++-
 drivers/scsi/libiscsi.c                        |  26 ++-
 drivers/scsi/libsas/sas_ata.c                  |   2 +-
 drivers/scsi/lpfc/lpfc_init.c                  |   1 +
 drivers/scsi/sd.c                              |  20 +-
 drivers/scsi/sg.c                              |   2 +
 drivers/scsi/sr.c                              |   6 +-
 drivers/target/iscsi/iscsi_target_parameters.c |  16 --
 drivers/target/iscsi/iscsi_target_util.c       |  12 +-
 drivers/target/target_core_pscsi.c             |  47 +---
 drivers/target/target_core_sbc.c               |  10 +-
 drivers/tty/serial/8250/8250_pci.c             |  23 +-
 drivers/tty/serial/atmel_serial.c              |   5 +
 drivers/usb/class/usbtmc.c                     |   7 +
 drivers/usb/gadget/function/f_acm.c            |   4 +-
 drivers/uwb/hwa-rc.c                           |   3 +
 drivers/uwb/i1480/dfu/usb.c                    |   3 +
 drivers/video/fbdev/xen-fbfront.c              |   4 +-
 drivers/virtio/virtio_balloon.c                |   2 +
 drivers/xen/xen-acpi-processor.c               |  34 ++-
 fs/cifs/file.c                                 |   6 +-
 fs/cifs/smb2pdu.c                              |   4 +
 fs/ext4/inline.c                               |   5 +-
 fs/xfs/libxfs/xfs_inode_buf.c                  |   8 +
 fs/xfs/xfs_bmap_util.c                         |   7 +-
 fs/xfs/xfs_buf.c                               |   1 +
 include/crypto/internal/hash.h                 |  10 +
 include/drm/ttm/ttm_object.h                   |   5 +-
 include/linux/kvm_host.h                       |   4 +-
 include/linux/log2.h                           |  13 +-
 include/scsi/libiscsi.h                        |   1 +
 kernel/events/core.c                           |   5 +-
 kernel/ptrace.c                                |  14 +-
 kernel/trace/ftrace.c                          |  20 +-
 kernel/trace/ring_buffer.c                     |   8 +-
 mm/hugetlb.c                                   |   6 +-
 mm/mempolicy.c                                 |  20 +-
 mm/percpu.c                                    |   5 +-
 net/core/sock.c                                |  16 +-
 net/ipv4/fib_frontend.c                        |   3 +-
 net/ipv4/tcp_input.c                           |   2 +-
 net/ipv4/tcp_minisocks.c                       |   1 +
 net/ipv6/route.c                               |   2 +
 net/sched/act_api.c                            |   5 +-
 net/sctp/socket.c                              |   8 +-
 net/unix/garbage.c                             |  18 +-
 sound/core/seq/seq_clientmgr.c                 |   1 +
 sound/core/seq/seq_fifo.c                      |   7 +
 sound/core/seq/seq_memory.c                    |  17 +-
 sound/core/seq/seq_memory.h                    |   1 +
 virt/kvm/eventfd.c                             |   3 +-
 virt/kvm/kvm_main.c                            |  40 +++-
 117 files changed, 1293 insertions(+), 704 deletions(-)

[toc] | [next] | [standalone]


#1627031 — [PATCH 3.18 047/124] xen/acpi: upload PM state from init-domain to Xen

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 047/124] xen/acpi: upload PM state from init-domain to Xen
Message-ID<tydV0-5tf-31@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ankur Arora <ankur.a.arora@oracle.com>

commit 1914f0cd203c941bba72f9452c8290324f1ef3dc upstream.

This was broken in commit cd979883b9ed ("xen/acpi-processor:
fix enabling interrupts on syscore_resume"). do_suspend (from
xen/manage.c) and thus xen_resume_notifier never get called on
the initial-domain at resume (it is if running as guest.)

The rationale for the breaking change was that upload_pm_data()
potentially does blocking work in syscore_resume(). This patch
addresses the original issue by scheduling upload_pm_data() to
execute in workqueue context.

Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Based-on-patch-by: Konrad Wilk <konrad.wilk@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: Ankur Arora <ankur.a.arora@oracle.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/xen/xen-acpi-processor.c |   34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

--- a/drivers/xen/xen-acpi-processor.c
+++ b/drivers/xen/xen-acpi-processor.c
@@ -27,10 +27,10 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/syscore_ops.h>
 #include <linux/acpi.h>
 #include <acpi/processor.h>
 #include <xen/xen.h>
-#include <xen/xen-ops.h>
 #include <xen/interface/platform.h>
 #include <asm/xen/hypercall.h>
 
@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(
 	return rc;
 }
 
-static int xen_acpi_processor_resume(struct notifier_block *nb,
-				     unsigned long action, void *data)
+static void xen_acpi_processor_resume_worker(struct work_struct *dummy)
 {
+	int rc;
+
 	bitmap_zero(acpi_ids_done, nr_acpi_bits);
-	return xen_upload_processor_pm_data();
+
+	rc = xen_upload_processor_pm_data();
+	if (rc != 0)
+		pr_info("ACPI data upload failed, error = %d\n", rc);
+}
+
+static void xen_acpi_processor_resume(void)
+{
+	static DECLARE_WORK(wq, xen_acpi_processor_resume_worker);
+
+	/*
+	 * xen_upload_processor_pm_data() calls non-atomic code.
+	 * However, the context for xen_acpi_processor_resume is syscore
+	 * with only the boot CPU online and in an atomic context.
+	 *
+	 * So defer the upload for some point safer.
+	 */
+	schedule_work(&wq);
 }
 
-struct notifier_block xen_acpi_processor_resume_nb = {
-	.notifier_call = xen_acpi_processor_resume,
+static struct syscore_ops xap_syscore_ops = {
+	.resume	= xen_acpi_processor_resume,
 };
 
 static int __init xen_acpi_processor_init(void)
@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_ini
 	if (rc)
 		goto err_unregister;
 
-	xen_resume_notifier_register(&xen_acpi_processor_resume_nb);
+	register_syscore_ops(&xap_syscore_ops);
 
 	return 0;
 err_unregister:
@@ -546,7 +564,7 @@ static void __exit xen_acpi_processor_ex
 {
 	int i;
 
-	xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb);
+	unregister_syscore_ops(&xap_syscore_ops);
 	kfree(acpi_ids_done);
 	kfree(acpi_id_present);
 	kfree(acpi_id_cst_present);

[toc] | [prev] | [next] | [standalone]


#1627032 — [PATCH 3.18 055/124] rtc: tegra: Implement clock handling

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 055/124] rtc: tegra: Implement clock handling
Message-ID<tydV0-5tf-23@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thierry Reding <treding@nvidia.com>

commit 5fa4086987506b2ab8c92f8f99f2295db9918856 upstream.

Accessing the registers of the RTC block on Tegra requires the module
clock to be enabled. This only works because the RTC module clock will
be enabled by default during early boot. However, because the clock is
unused, the CCF will disable it at late_init time. This causes the RTC
to become unusable afterwards. This can easily be reproduced by trying
to use the RTC:

	$ hwclock --rtc /dev/rtc1

This will hang the system. I ran into this by following up on a report
by Martin Michlmayr that reboot wasn't working on Tegra210 systems. It
turns out that the rtc-tegra driver's ->shutdown() implementation will
hang the CPU, because of the disabled clock, before the system can be
rebooted.

What confused me for a while is that the same driver is used on prior
Tegra generations where the hang can not be observed. However, as Peter
De Schrijver pointed out, this is because on 32-bit Tegra chips the RTC
clock is enabled by the tegra20_timer.c clocksource driver, which uses
the RTC to provide a persistent clock. This code is never enabled on
64-bit Tegra because the persistent clock infrastructure does not exist
on 64-bit ARM.

The proper fix for this is to add proper clock handling to the RTC
driver in order to ensure that the clock is enabled when the driver
requires it. All device trees contain the clock already, therefore
no additional changes are required.

Reported-by: Martin Michlmayr <tbm@cyrius.com>
Acked-By Peter De Schrijver <pdeschrijver@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
[bwh: Backported to 4.9: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/rtc/rtc-tegra.c |   28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

--- a/drivers/rtc/rtc-tegra.c
+++ b/drivers/rtc/rtc-tegra.c
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 #include <linux/kernel.h>
+#include <linux/clk.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
@@ -59,6 +60,7 @@ struct tegra_rtc_info {
 	struct platform_device	*pdev;
 	struct rtc_device	*rtc_dev;
 	void __iomem		*rtc_base; /* NULL if not initialized. */
+	struct clk		*clk;
 	int			tegra_rtc_irq; /* alarm and periodic irq */
 	spinlock_t		tegra_rtc_lock;
 };
@@ -330,6 +332,14 @@ static int __init tegra_rtc_probe(struct
 	if (info->tegra_rtc_irq <= 0)
 		return -EBUSY;
 
+	info->clk = devm_clk_get(&pdev->dev, NULL);
+	if (IS_ERR(info->clk))
+		return PTR_ERR(info->clk);
+
+	ret = clk_prepare_enable(info->clk);
+	if (ret < 0)
+		return ret;
+
 	/* set context info. */
 	info->pdev = pdev;
 	spin_lock_init(&info->tegra_rtc_lock);
@@ -350,7 +360,7 @@ static int __init tegra_rtc_probe(struct
 		ret = PTR_ERR(info->rtc_dev);
 		dev_err(&pdev->dev, "Unable to register device (err=%d).\n",
 			ret);
-		return ret;
+		goto disable_clk;
 	}
 
 	ret = devm_request_irq(&pdev->dev, info->tegra_rtc_irq,
@@ -360,12 +370,25 @@ static int __init tegra_rtc_probe(struct
 		dev_err(&pdev->dev,
 			"Unable to request interrupt for device (err=%d).\n",
 			ret);
-		return ret;
+		goto disable_clk;
 	}
 
 	dev_notice(&pdev->dev, "Tegra internal Real Time Clock\n");
 
 	return 0;
+
+disable_clk:
+	clk_disable_unprepare(info->clk);
+	return ret;
+}
+
+static int tegra_rtc_remove(struct platform_device *pdev)
+{
+	struct tegra_rtc_info *info = platform_get_drvdata(pdev);
+
+	clk_disable_unprepare(info->clk);
+
+	return 0;
 }
 
 #ifdef CONFIG_PM_SLEEP
@@ -417,6 +440,7 @@ static void tegra_rtc_shutdown(struct pl
 
 MODULE_ALIAS("platform:tegra_rtc");
 static struct platform_driver tegra_rtc_driver = {
+	.remove		= tegra_rtc_remove,
 	.shutdown	= tegra_rtc_shutdown,
 	.driver		= {
 		.name	= "tegra_rtc",

[toc] | [prev] | [next] | [standalone]


#1627034 — [PATCH 3.18 019/124] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 019/124] drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
Message-ID<tydV0-5tf-35@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Hellstrom <thellstrom@vmware.com>

commit fe25deb7737ce6c0879ccf79c99fa1221d428bf2 upstream.

Previously, when a surface was opened using a legacy (non prime) handle,
it was verified to have been created by a client in the same master realm.
Relax this so that opening is also allowed recursively if the client
already has the surface open.

This works around a regression in svga mesa where opening of a shared
surface is used recursively to obtain surface information.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/gpu/drm/ttm/ttm_object.c         |   10 +++++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c    |    6 ++----
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c |    4 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c  |   22 +++++++++-------------
 include/drm/ttm/ttm_object.h             |    5 ++++-
 5 files changed, 24 insertions(+), 23 deletions(-)

--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_obje
 	if (unlikely(ret != 0))
 		goto out_err0;
 
-	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 	if (unlikely(ret != 0))
 		goto out_err1;
 
@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists);
 
 int ttm_ref_object_add(struct ttm_object_file *tfile,
 		       struct ttm_base_object *base,
-		       enum ttm_ref_type ref_type, bool *existed)
+		       enum ttm_ref_type ref_type, bool *existed,
+		       bool require_existed)
 {
 	struct drm_open_hash *ht = &tfile->ref_hash[ref_type];
 	struct ttm_ref_object *ref;
@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object
 		}
 
 		rcu_read_unlock();
+		if (require_existed)
+			return -EPERM;
+
 		ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),
 					   false, false);
 		if (unlikely(ret != 0))
@@ -635,7 +639,7 @@ int ttm_prime_fd_to_handle(struct ttm_ob
 	prime = (struct ttm_prime_object *) dma_buf->priv;
 	base = &prime->base;
 	*handle = base->hash.key;
-	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+	ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false);
 
 	dma_buf_put(dma_buf);
 
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -1144,10 +1144,8 @@ int vmw_fence_event_ioctl(struct drm_dev
 		(void) vmw_fence_obj_reference(fence);
 
 		if (user_fence_rep != NULL) {
-			bool existed;
-
-			ret = ttm_ref_object_add(tfile, base,
-						 TTM_REF_USAGE, &existed);
+			ret = ttm_ref_object_add(vmw_fp->tfile, base,
+						 TTM_REF_USAGE, NULL, false);
 			if (unlikely(ret != 0)) {
 				DRM_ERROR("Failed to reference a fence "
 					  "object.\n");
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -588,7 +588,7 @@ static int vmw_user_dmabuf_synccpu_grab(
 		return ret;
 
 	ret = ttm_ref_object_add(tfile, &user_bo->prime.base,
-				 TTM_REF_SYNCCPU_WRITE, &existed);
+				 TTM_REF_SYNCCPU_WRITE, &existed, false);
 	if (ret != 0 || existed)
 		ttm_bo_synccpu_write_release(&user_bo->dma.base);
 
@@ -764,7 +764,7 @@ int vmw_user_dmabuf_reference(struct ttm
 
 	*handle = user_bo->prime.base.hash.key;
 	return ttm_ref_object_add(tfile, &user_bo->prime.base,
-				  TTM_REF_USAGE, NULL);
+				  TTM_REF_USAGE, NULL, false);
 }
 
 /*
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
@@ -895,17 +895,16 @@ vmw_surface_handle_reference(struct vmw_
 	uint32_t handle;
 	struct ttm_base_object *base;
 	int ret;
+	bool require_exist = false;
 
 	if (handle_type == DRM_VMW_HANDLE_PRIME) {
 		ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle);
 		if (unlikely(ret != 0))
 			return ret;
 	} else {
-		if (unlikely(drm_is_render_client(file_priv))) {
-			DRM_ERROR("Render client refused legacy "
-				  "surface reference.\n");
-			return -EACCES;
-		}
+		if (unlikely(drm_is_render_client(file_priv)))
+			require_exist = true;
+
 		handle = u_handle;
 	}
 
@@ -927,17 +926,14 @@ vmw_surface_handle_reference(struct vmw_
 
 		/*
 		 * Make sure the surface creator has the same
-		 * authenticating master.
+		 * authenticating master, or is already registered with us.
 		 */
 		if (drm_is_primary_client(file_priv) &&
-		    user_srf->master != file_priv->master) {
-			DRM_ERROR("Trying to reference surface outside of"
-				  " master domain.\n");
-			ret = -EACCES;
-			goto out_bad_resource;
-		}
+		    user_srf->master != file_priv->master)
+			require_exist = true;
 
-		ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL);
+		ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL,
+					 require_exist);
 		if (unlikely(ret != 0)) {
 			DRM_ERROR("Could not add a reference to a surface.\n");
 			goto out_bad_resource;
--- a/include/drm/ttm/ttm_object.h
+++ b/include/drm/ttm/ttm_object.h
@@ -229,6 +229,8 @@ extern void ttm_base_object_unref(struct
  * @ref_type: The type of reference.
  * @existed: Upon completion, indicates that an identical reference object
  * already existed, and the refcount was upped on that object instead.
+ * @require_existed: Fail with -EPERM if an identical ref object didn't
+ * already exist.
  *
  * Checks that the base object is shareable and adds a ref object to it.
  *
@@ -243,7 +245,8 @@ extern void ttm_base_object_unref(struct
  */
 extern int ttm_ref_object_add(struct ttm_object_file *tfile,
 			      struct ttm_base_object *base,
-			      enum ttm_ref_type ref_type, bool *existed);
+			      enum ttm_ref_type ref_type, bool *existed,
+			      bool require_existed);
 
 extern bool ttm_ref_object_exists(struct ttm_object_file *tfile,
 				  struct ttm_base_object *base);

[toc] | [prev] | [next] | [standalone]


#1627035 — [PATCH 3.18 027/124] metag/ptrace: Reject partial NT_METAG_RPIPE writes

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 027/124] metag/ptrace: Reject partial NT_METAG_RPIPE writes
Message-ID<tydV1-5tf-37@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Martin <Dave.Martin@arm.com>

commit 7195ee3120d878259e8d94a5d9f808116f34d5ea upstream.

It's not clear what behaviour is sensible when doing partial write of
NT_METAG_RPIPE, so just don't bother.

This patch assumes that userspace will never rely on a partial SETREGSET
in this case, since it's not clear what should happen anyway.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/kernel/ptrace.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -253,6 +253,8 @@ int metag_rp_state_copyin(struct pt_regs
 	unsigned long long *ptr;
 	int ret, i;
 
+	if (count < 4*13)
+		return -EINVAL;
 	/* Read the entire pipeline before making any changes */
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
 				 &rp, 0, 4*13);

[toc] | [prev] | [next] | [standalone]


#1627037 — [PATCH 3.18 006/124] iscsi-target: Fix TMR reference leak during session shutdown

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 006/124] iscsi-target: Fix TMR reference leak during session shutdown
Message-ID<tydV1-5tf-49@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Nicholas Bellinger <nab@linux-iscsi.org>

commit efb2ea770bb3b0f40007530bc8b0c22f36e1c5eb upstream.

This patch fixes a iscsi-target specific TMR reference leak
during session shutdown, that could occur when a TMR was
quiesced before the hand-off back to iscsi-target code
via transport_cmd_check_stop_to_fabric().

The reference leak happens because iscsit_free_cmd() was
incorrectly skipping the final target_put_sess_cmd() for
TMRs when transport_generic_free_cmd() returned zero because
the se_cmd->cmd_kref did not reach zero, due to the missing
se_cmd assignment in original code.

The result was iscsi_cmd and it's associated se_cmd memory
would be freed once se_sess->sess_cmd_map where released,
but the associated se_tmr_req was leaked and remained part
of se_device->dev_tmr_list.

This bug would manfiest itself as kernel paging request
OOPsen in core_tmr_lun_reset(), when a left-over se_tmr_req
attempted to dereference it's se_cmd pointer that had
already been released during normal session shutdown.

To address this bug, go ahead and treat ISCSI_OP_SCSI_CMD
and ISCSI_OP_SCSI_TMFUNC the same when there is an extra
se_cmd->cmd_kref to drop in iscsit_free_cmd(), and use
op_scsi to signal __iscsit_free_cmd() when the former
needs to clear any further iscsi related I/O state.

Reported-by: Rob Millner <rlm@daterainc.com>
Cc: Rob Millner <rlm@daterainc.com>
Reported-by: Chu Yuan Lin <cyl@datera.io>
Cc: Chu Yuan Lin <cyl@datera.io>
Tested-by: Chu Yuan Lin <cyl@datera.io>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/target/iscsi/iscsi_target_util.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

--- a/drivers/target/iscsi/iscsi_target_util.c
+++ b/drivers/target/iscsi/iscsi_target_util.c
@@ -731,21 +731,23 @@ void iscsit_free_cmd(struct iscsi_cmd *c
 {
 	struct se_cmd *se_cmd = NULL;
 	int rc;
+	bool op_scsi = false;
 	/*
 	 * Determine if a struct se_cmd is associated with
 	 * this struct iscsi_cmd.
 	 */
 	switch (cmd->iscsi_opcode) {
 	case ISCSI_OP_SCSI_CMD:
-		se_cmd = &cmd->se_cmd;
-		__iscsit_free_cmd(cmd, true, shutdown);
+		op_scsi = true;
 		/*
 		 * Fallthrough
 		 */
 	case ISCSI_OP_SCSI_TMFUNC:
-		rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown);
-		if (!rc && shutdown && se_cmd && se_cmd->se_sess) {
-			__iscsit_free_cmd(cmd, true, shutdown);
+		se_cmd = &cmd->se_cmd;
+		__iscsit_free_cmd(cmd, op_scsi, shutdown);
+		rc = transport_generic_free_cmd(se_cmd, shutdown);
+		if (!rc && shutdown && se_cmd->se_sess) {
+			__iscsit_free_cmd(cmd, op_scsi, shutdown);
 			target_put_sess_cmd(se_cmd);
 		}
 		break;

[toc] | [prev] | [next] | [standalone]


#1627038 — [PATCH 3.18 013/124] char: lack of bool string made CONFIG_DEVPORT always on

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 013/124] char: lack of bool string made CONFIG_DEVPORT always on
Message-ID<tydV1-5tf-39@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Max Bires <jbires@google.com>

commit f2cfa58b136e4b06a9b9db7af5ef62fbb5992f62 upstream.

Without a bool string present, using "# CONFIG_DEVPORT is not set" in
defconfig files would not actually unset devport. This esnured that
/dev/port was always on, but there are reasons a user may wish to
disable it (smaller kernel, attack surface reduction) if it's not being
used. Adding a message here in order to make this user visible.

Signed-off-by: Max Bires <jbires@google.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/char/Kconfig |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -574,9 +574,12 @@ config TELCLOCK
 	  controlling the behavior of this hardware.
 
 config DEVPORT
-	bool
+	bool "/dev/port character device"
 	depends on ISA || PCI
 	default y
+	help
+	  Say Y here if you want to support the /dev/port device. The /dev/port
+	  device is similar to /dev/mem, but for I/O ports.
 
 source "drivers/s390/char/Kconfig"
 

[toc] | [prev] | [next] | [standalone]


#1627039 — [PATCH 3.18 025/124] metag/ptrace: Preserve previous registers for short regset write

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 025/124] metag/ptrace: Preserve previous registers for short regset write
Message-ID<tydV1-5tf-45@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Martin <Dave.Martin@arm.com>

commit a78ce80d2c9178351b34d78fec805140c29c193e upstream.

Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET
to fill all the registers, the thread's old registers are preserved.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/metag/kernel/ptrace.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/metag/kernel/ptrace.c
+++ b/arch/metag/kernel/ptrace.c
@@ -303,7 +303,7 @@ static int metag_tls_set(struct task_str
 			const void *kbuf, const void __user *ubuf)
 {
 	int ret;
-	void __user *tls;
+	void __user *tls = target->thread.tls_ptr;
 
 	ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
 	if (ret)

[toc] | [prev] | [next] | [standalone]


#1627040 — [PATCH 3.18 004/124] x86/vdso: Plug race between mapping and ELF header setup

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 004/124] x86/vdso: Plug race between mapping and ELF header setup
Message-ID<tydV1-5tf-43@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <tglx@linutronix.de>

commit 6fdc6dd90272ce7e75d744f71535cfbd8d77da81 upstream.

The vsyscall32 sysctl can racy against a concurrent fork when it switches
from disabled to enabled:

    arch_setup_additional_pages()
	if (vdso32_enabled)
           --> No mapping
                                        sysctl.vsysscall32()
                                          --> vdso32_enabled = true
    create_elf_tables()
      ARCH_DLINFO_IA32
        if (vdso32_enabled) {
           --> Add VDSO entry with NULL pointer

Make ARCH_DLINFO_IA32 check whether the VDSO mapping has been set up for
the newly forked process or not.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Andy Lutomirski <luto@amacapital.net>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Mathias Krause <minipli@googlemail.com>
Link: http://lkml.kernel.org/r/20170410151723.602367196@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/include/asm/elf.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -277,7 +277,7 @@ struct task_struct;
 
 #define	ARCH_DLINFO_IA32						\
 do {									\
-	if (vdso32_enabled) {						\
+	if (VDSO_CURRENT_BASE) {					\
 		NEW_AUX_ENT(AT_SYSINFO,	VDSO_ENTRY);			\
 		NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE);	\
 	}								\

[toc] | [prev] | [next] | [standalone]


#1627041 — [PATCH 3.18 050/124] zram: do not use copy_page with non-page aligned address

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 050/124] zram: do not use copy_page with non-page aligned address
Message-ID<tydV1-5tf-59@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Minchan Kim <minchan@kernel.org>

commit d72e9a7a93e4f8e9e52491921d99e0c8aa89eb4e upstream.

The copy_page is optimized memcpy for page-alinged address.  If it is
used with non-page aligned address, it can corrupt memory which means
system corruption.  With zram, it can happen with

1. 64K architecture
2. partial IO
3. slub debug

Partial IO need to allocate a page and zram allocates it via kmalloc.
With slub debug, kmalloc(PAGE_SIZE) doesn't return page-size aligned
address.  And finally, copy_page(mem, cmem) corrupts memory.

So, this patch changes it to memcpy.

Actuaully, we don't need to change zram_bvec_write part because zsmalloc
returns page-aligned address in case of PAGE_SIZE class but it's not
good to rely on the internal of zsmalloc.

Note:
 When this patch is merged to stable, clear_page should be fixed, too.
 Unfortunately, recent zram removes it by "same page merge" feature so
 it's hard to backport this patch to -stable tree.

I will handle it when I receive the mail from stable tree maintainer to
merge this patch to backport.

Fixes: 42e99bd ("zram: optimize memory operations with clear_page()/copy_page()")
Link: http://lkml.kernel.org/r/1492042622-12074-2-git-send-email-minchan@kernel.org
Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>


---
 drivers/block/zram/zram_drv.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -431,13 +431,13 @@ static int zram_decompress_page(struct z
 
 	if (!handle || zram_test_flag(meta, index, ZRAM_ZERO)) {
 		bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value);
-		clear_page(mem);
+		memset(mem, 0, PAGE_SIZE);
 		return 0;
 	}
 
 	cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO);
 	if (size == PAGE_SIZE)
-		copy_page(mem, cmem);
+		memcpy(mem, cmem, PAGE_SIZE);
 	else
 		ret = zcomp_decompress(zram->comp, cmem, size, mem);
 	zs_unmap_object(meta->mem_pool, handle);
@@ -612,7 +612,7 @@ static int zram_bvec_write(struct zram *
 
 	if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) {
 		src = kmap_atomic(page);
-		copy_page(cmem, src);
+		memcpy(cmem, src, PAGE_SIZE);
 		kunmap_atomic(src);
 	} else {
 		memcpy(cmem, src, clen);

[toc] | [prev] | [next] | [standalone]


#1627042 — [PATCH 3.18 001/124] CIFS: store results of cifs_reopen_file to avoid infinite wait

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 001/124] CIFS: store results of cifs_reopen_file to avoid infinite wait
Message-ID<tydV1-5tf-51@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Germano Percossi <germano.percossi@citrix.com>

commit 1fa839b4986d648b907d117275869a0e46c324b9 upstream.

This fixes Continuous Availability when errors during
file reopen are encountered.

cifs_user_readv and cifs_user_writev would wait for ever if
results of cifs_reopen_file are not stored and for later inspection.

In fact, results are checked and, in case of errors, a chain
of function calls leading to reads and writes to be scheduled in
a separate thread is skipped.
These threads will wake up the corresponding waiters once reads
and writes are done.

However, given the return value is not stored, when rc is checked
for errors a previous one (always zero) is inspected instead.
This leads to pending reads/writes added to the list, making
cifs_user_readv and cifs_user_writev wait for ever.

Signed-off-by: Germano Percossi <germano.percossi@citrix.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/cifs/file.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2542,7 +2542,7 @@ cifs_write_from_iter(loff_t offset, size
 		wdata->credits = credits;
 
 		if (!wdata->cfile->invalidHandle ||
-		    !cifs_reopen_file(wdata->cfile, false))
+		    !(rc = cifs_reopen_file(wdata->cfile, false)))
 			rc = server->ops->async_writev(wdata,
 					cifs_uncached_writedata_release);
 		if (rc) {
@@ -2977,7 +2977,7 @@ cifs_send_async_read(loff_t offset, size
 		rdata->credits = credits;
 
 		if (!rdata->cfile->invalidHandle ||
-		    !cifs_reopen_file(rdata->cfile, true))
+		    !(rc = cifs_reopen_file(rdata->cfile, true)))
 			rc = server->ops->async_readv(rdata);
 error:
 		if (rc) {
@@ -3564,7 +3564,7 @@ static int cifs_readpages(struct file *f
 		}
 
 		if (!rdata->cfile->invalidHandle ||
-		    !cifs_reopen_file(rdata->cfile, true))
+		    !(rc = cifs_reopen_file(rdata->cfile, true)))
 			rc = server->ops->async_readv(rdata);
 		if (rc) {
 			add_credits_and_wake_if(server, rdata->credits, 0);

[toc] | [prev] | [next] | [standalone]


#1627043 — [PATCH 3.18 062/124] catc: Combine failure cleanup code in catc_probe()

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 062/124] catc: Combine failure cleanup code in catc_probe()
Message-ID<tydV1-5tf-53@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit d41149145f98fe26dcd0bfd1d6cc095e6e041418 upstream.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/catc.c |   33 +++++++++++++++++----------------
 1 file changed, 17 insertions(+), 16 deletions(-)

--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -777,7 +777,7 @@ static int catc_probe(struct usb_interfa
 	struct net_device *netdev;
 	struct catc *catc;
 	u8 broadcast[ETH_ALEN];
-	int i, pktsz;
+	int i, pktsz, ret;
 
 	if (usb_set_interface(usbdev,
 			intf->altsetting->desc.bInterfaceNumber, 1)) {
@@ -812,12 +812,8 @@ static int catc_probe(struct usb_interfa
 	if ((!catc->ctrl_urb) || (!catc->tx_urb) || 
 	    (!catc->rx_urb) || (!catc->irq_urb)) {
 		dev_err(&intf->dev, "No free urbs available.\n");
-		usb_free_urb(catc->ctrl_urb);
-		usb_free_urb(catc->tx_urb);
-		usb_free_urb(catc->rx_urb);
-		usb_free_urb(catc->irq_urb);
-		free_netdev(netdev);
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto fail_free;
 	}
 
 	/* The F5U011 has the same vendor/product as the netmate but a device version of 0x130 */
@@ -914,16 +910,21 @@ static int catc_probe(struct usb_interfa
 	usb_set_intfdata(intf, catc);
 
 	SET_NETDEV_DEV(netdev, &intf->dev);
-	if (register_netdev(netdev) != 0) {
-		usb_set_intfdata(intf, NULL);
-		usb_free_urb(catc->ctrl_urb);
-		usb_free_urb(catc->tx_urb);
-		usb_free_urb(catc->rx_urb);
-		usb_free_urb(catc->irq_urb);
-		free_netdev(netdev);
-		return -EIO;
-	}
+	ret = register_netdev(netdev);
+	if (ret)
+		goto fail_clear_intfdata;
+
 	return 0;
+
+fail_clear_intfdata:
+	usb_set_intfdata(intf, NULL);
+fail_free:
+	usb_free_urb(catc->ctrl_urb);
+	usb_free_urb(catc->tx_urb);
+	usb_free_urb(catc->rx_urb);
+	usb_free_urb(catc->irq_urb);
+	free_netdev(netdev);
+	return ret;
 }
 
 static void catc_disconnect(struct usb_interface *intf)

[toc] | [prev] | [next] | [standalone]


#1627044 — [PATCH 3.18 024/124] sparc/ptrace: Preserve previous registers for short regset write

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 024/124] sparc/ptrace: Preserve previous registers for short regset write
Message-ID<tydV1-5tf-47@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dave Martin <Dave.Martin@arm.com>

commit d3805c546b275c8cc7d40f759d029ae92c7175f2 upstream.

Ensure that if userspace supplies insufficient data to PTRACE_SETREGSET
to fill all the registers, the thread's old registers are preserved.

Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/sparc/kernel/ptrace_64.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/sparc/kernel/ptrace_64.c
+++ b/arch/sparc/kernel/ptrace_64.c
@@ -311,7 +311,7 @@ static int genregs64_set(struct task_str
 	}
 
 	if (!ret) {
-		unsigned long y;
+		unsigned long y = regs->y;
 
 		ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
 					 &y,

[toc] | [prev] | [next] | [standalone]


#1627045 — [PATCH 3.18 031/124] ptrace: fix PTRACE_LISTEN race corrupting task->state

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 031/124] ptrace: fix PTRACE_LISTEN race corrupting task->state
Message-ID<tydV1-5tf-55@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: bsegall@google.com <bsegall@google.com>

commit 5402e97af667e35e54177af8f6575518bf251d51 upstream.

In PT_SEIZED + LISTEN mode STOP/CONT signals cause a wakeup against
__TASK_TRACED.  If this races with the ptrace_unfreeze_traced at the end
of a PTRACE_LISTEN, this can wake the task /after/ the check against
__TASK_TRACED, but before the reset of state to TASK_TRACED.  This
causes it to instead clobber TASK_WAKING, allowing a subsequent wakeup
against TRACED while the task is still on the rq wake_list, corrupting
it.

Oleg said:
 "The kernel can crash or this can lead to other hard-to-debug problems.
  In short, "task->state = TASK_TRACED" in ptrace_unfreeze_traced()
  assumes that nobody else can wake it up, but PTRACE_LISTEN breaks the
  contract. Obviusly it is very wrong to manipulate task->state if this
  task is already running, or WAKING, or it sleeps again"

[akpm@linux-foundation.org: coding-style fixes]
Fixes: 9899d11f ("ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL")
Link: http://lkml.kernel.org/r/xm26y3vfhmkp.fsf_-_@bsegall-linux.mtv.corp.google.com
Signed-off-by: Ben Segall <bsegall@google.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 kernel/ptrace.c |   14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -144,11 +144,17 @@ static void ptrace_unfreeze_traced(struc
 
 	WARN_ON(!task->ptrace || task->parent != current);
 
+	/*
+	 * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely.
+	 * Recheck state under the lock to close this race.
+	 */
 	spin_lock_irq(&task->sighand->siglock);
-	if (__fatal_signal_pending(task))
-		wake_up_state(task, __TASK_TRACED);
-	else
-		task->state = TASK_TRACED;
+	if (task->state == __TASK_TRACED) {
+		if (__fatal_signal_pending(task))
+			wake_up_state(task, __TASK_TRACED);
+		else
+			task->state = TASK_TRACED;
+	}
 	spin_unlock_irq(&task->sighand->siglock);
 }
 

[toc] | [prev] | [next] | [standalone]


#1627046 — [PATCH 3.18 063/124] catc: Use heap buffer for memory size test

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 063/124] catc: Use heap buffer for memory size test
Message-ID<tydV1-5tf-57@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ben Hutchings <ben@decadent.org.uk>

commit 2d6a0e9de03ee658a9adc3bfb2f0ca55dff1e478 upstream.

Allocating USB buffers on the stack is not portable, and no longer
works on x86_64 (with VMAP_STACK enabled as per default).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/catc.c |   25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -777,7 +777,7 @@ static int catc_probe(struct usb_interfa
 	struct net_device *netdev;
 	struct catc *catc;
 	u8 broadcast[ETH_ALEN];
-	int i, pktsz, ret;
+	int pktsz, ret;
 
 	if (usb_set_interface(usbdev,
 			intf->altsetting->desc.bInterfaceNumber, 1)) {
@@ -841,15 +841,24 @@ static int catc_probe(struct usb_interfa
                 catc->irq_buf, 2, catc_irq_done, catc, 1);
 
 	if (!catc->is_f5u011) {
+		u32 *buf;
+		int i;
+
 		dev_dbg(dev, "Checking memory size\n");
 
-		i = 0x12345678;
-		catc_write_mem(catc, 0x7a80, &i, 4);
-		i = 0x87654321;	
-		catc_write_mem(catc, 0xfa80, &i, 4);
-		catc_read_mem(catc, 0x7a80, &i, 4);
+		buf = kmalloc(4, GFP_KERNEL);
+		if (!buf) {
+			ret = -ENOMEM;
+			goto fail_free;
+		}
+
+		*buf = 0x12345678;
+		catc_write_mem(catc, 0x7a80, buf, 4);
+		*buf = 0x87654321;
+		catc_write_mem(catc, 0xfa80, buf, 4);
+		catc_read_mem(catc, 0x7a80, buf, 4);
 	  
-		switch (i) {
+		switch (*buf) {
 		case 0x12345678:
 			catc_set_reg(catc, TxBufCount, 8);
 			catc_set_reg(catc, RxBufCount, 32);
@@ -864,6 +873,8 @@ static int catc_probe(struct usb_interfa
 			dev_dbg(dev, "32k Memory\n");
 			break;
 		}
+
+		kfree(buf);
 	  
 		dev_dbg(dev, "Getting MAC from SEEROM.\n");
 	  

[toc] | [prev] | [next] | [standalone]


#1627047 — [PATCH 3.18 045/124] scsi: sg: check length passed to SG_NEXT_CMD_LEN

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:40 +0200
Subject[PATCH 3.18 045/124] scsi: sg: check length passed to SG_NEXT_CMD_LEN
Message-ID<tydV1-5tf-61@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: peter chang <dpf@google.com>

commit bf33f87dd04c371ea33feb821b60d63d754e3124 upstream.

The user can control the size of the next command passed along, but the
value passed to the ioctl isn't checked against the usable max command
size.

Signed-off-by: Peter Chang <dpf@google.com>
Acked-by: Douglas Gilbert <dgilbert@interlog.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/scsi/sg.c |    2 ++
 1 file changed, 2 insertions(+)

--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1017,6 +1017,8 @@ sg_ioctl(struct file *filp, unsigned int
 		result = get_user(val, ip);
 		if (result)
 			return result;
+		if (val > SG_MAX_CDB_SIZE)
+			return -ENOMEM;
 		sfp->next_cmd_len = (val > 0) ? val : 0;
 		return 0;
 	case SG_GET_VERSION_NUM:

[toc] | [prev] | [next] | [standalone]


#1627048 — [PATCH 3.18 103/124] xfs: fix up xfs_swap_extent_forks inline extent handling

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:50 +0200
Subject[PATCH 3.18 103/124] xfs: fix up xfs_swap_extent_forks inline extent handling
Message-ID<tye4F-5xb-1@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Sandeen <sandeen@sandeen.net>

commit 4dfce57db6354603641132fac3c887614e3ebe81 upstream.

There have been several reports over the years of NULL pointer
dereferences in xfs_trans_log_inode during xfs_fsr processes,
when the process is doing an fput and tearing down extents
on the temporary inode, something like:

BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
PID: 29439  TASK: ffff880550584fa0  CPU: 6   COMMAND: "xfs_fsr"
    [exception RIP: xfs_trans_log_inode+0x10]
 #9 [ffff8800a57bbbe0] xfs_bunmapi at ffffffffa037398e [xfs]
#10 [ffff8800a57bbce8] xfs_itruncate_extents at ffffffffa0391b29 [xfs]
#11 [ffff8800a57bbd88] xfs_inactive_truncate at ffffffffa0391d0c [xfs]
#12 [ffff8800a57bbdb8] xfs_inactive at ffffffffa0392508 [xfs]
#13 [ffff8800a57bbdd8] xfs_fs_evict_inode at ffffffffa035907e [xfs]
#14 [ffff8800a57bbe00] evict at ffffffff811e1b67
#15 [ffff8800a57bbe28] iput at ffffffff811e23a5
#16 [ffff8800a57bbe58] dentry_kill at ffffffff811dcfc8
#17 [ffff8800a57bbe88] dput at ffffffff811dd06c
#18 [ffff8800a57bbea8] __fput at ffffffff811c823b
#19 [ffff8800a57bbef0] ____fput at ffffffff811c846e
#20 [ffff8800a57bbf00] task_work_run at ffffffff81093b27
#21 [ffff8800a57bbf30] do_notify_resume at ffffffff81013b0c
#22 [ffff8800a57bbf50] int_signal at ffffffff8161405d

As it turns out, this is because the i_itemp pointer, along
with the d_ops pointer, has been overwritten with zeros
when we tear down the extents during truncate.  When the in-core
inode fork on the temporary inode used by xfs_fsr was originally
set up during the extent swap, we mistakenly looked at di_nextents
to determine whether all extents fit inline, but this misses extents
generated by speculative preallocation; we should be using if_bytes
instead.

This mistake corrupts the in-memory inode, and code in
xfs_iext_remove_inline eventually gets bad inputs, causing
it to memmove and memset incorrect ranges; this became apparent
because the two values in ifp->if_u2.if_inline_ext[1] contained
what should have been in d_ops and i_itemp; they were memmoved due
to incorrect array indexing and then the original locations
were zeroed with memset, again due to an array overrun.

Fix this by properly using i_df.if_bytes to determine the number
of extents, not di_nextents.

Thanks to dchinner for looking at this with me and spotting the
root cause.

[nborisov: backported to 4.4]

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_bmap_util.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1622,6 +1622,7 @@ xfs_swap_extents(
 	xfs_trans_t	*tp;
 	xfs_bstat_t	*sbp = &sxp->sx_stat;
 	xfs_ifork_t	*tempifp, *ifp, *tifp;
+	xfs_extnum_t	nextents;
 	int		src_log_flags, target_log_flags;
 	int		error = 0;
 	int		aforkblks = 0;
@@ -1802,7 +1803,8 @@ xfs_swap_extents(
 		 * pointer.  Otherwise it's already NULL or
 		 * pointing to the extent.
 		 */
-		if (ip->i_d.di_nextents <= XFS_INLINE_EXTS) {
+		nextents = ip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
+		if (nextents <= XFS_INLINE_EXTS) {
 			ifp->if_u1.if_extents =
 				ifp->if_u2.if_inline_ext;
 		}
@@ -1821,7 +1823,8 @@ xfs_swap_extents(
 		 * pointer.  Otherwise it's already NULL or
 		 * pointing to the extent.
 		 */
-		if (tip->i_d.di_nextents <= XFS_INLINE_EXTS) {
+		nextents = tip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t);
+		if (nextents <= XFS_INLINE_EXTS) {
 			tifp->if_u1.if_extents =
 				tifp->if_u2.if_inline_ext;
 		}

[toc] | [prev] | [next] | [standalone]


#1627049 — [PATCH 3.18 104/124] xfs: clear _XBF_PAGES from buffers when readahead page

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:50 +0200
Subject[PATCH 3.18 104/124] xfs: clear _XBF_PAGES from buffers when readahead page
Message-ID<tye4G-5xb-13@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Darrick J. Wong <darrick.wong@oracle.com>

commit 2aa6ba7b5ad3189cc27f14540aa2f57f0ed8df4b upstream.

If we try to allocate memory pages to back an xfs_buf that we're trying
to read, it's possible that we'll be so short on memory that the page
allocation fails.  For a blocking read we'll just wait, but for
readahead we simply dump all the pages we've collected so far.

Unfortunately, after dumping the pages we neglect to clear the
_XBF_PAGES state, which means that the subsequent call to xfs_buf_free
thinks that b_pages still points to pages we own.  It then double-frees
the b_pages pages.

This results in screaming about negative page refcounts from the memory
manager, which xfs oughtn't be triggering.  To reproduce this case,
mount a filesystem where the size of the inodes far outweighs the
availalble memory (a ~500M inode filesystem on a VM with 300MB memory
did the trick here) and run bulkstat in parallel with other memory
eating processes to put a huge load on the system.  The "check summary"
phase of xfs_scrub also works for this purpose.

Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/xfs/xfs_buf.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -376,6 +376,7 @@ retry:
 out_free_pages:
 	for (i = 0; i < bp->b_page_count; i++)
 		__free_page(bp->b_pages[i]);
+	bp->b_flags &= ~_XBF_PAGES;
 	return error;
 }
 

[toc] | [prev] | [next] | [standalone]


#1627051 — [PATCH 3.18 080/124] Input: hanwang - validate number of endpoints before using them

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:50 +0200
Subject[PATCH 3.18 080/124] Input: hanwang - validate number of endpoints before using them
Message-ID<tye4F-5xb-5@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johan Hovold <johan@kernel.org>

commit ba340d7b83703768ce566f53f857543359aa1b98 upstream.

Make sure to check the number of endpoints to avoid dereferencing a
NULL-pointer should a malicious device lack endpoints.

Fixes: bba5394ad3bd ("Input: add support for Hanwang tablets")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/input/tablet/hanwang.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/input/tablet/hanwang.c
+++ b/drivers/input/tablet/hanwang.c
@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_inte
 	int error;
 	int i;
 
+	if (intf->cur_altsetting->desc.bNumEndpoints < 1)
+		return -ENODEV;
+
 	hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL);
 	input_dev = input_allocate_device();
 	if (!hanwang || !input_dev) {

[toc] | [prev] | [next] | [standalone]


#1627053 — [PATCH 3.18 105/124] ACPI: Fix incompatibility with mcount-based function graph tracing

FromGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Date2017-04-20 08:50 +0200
Subject[PATCH 3.18 105/124] ACPI: Fix incompatibility with mcount-based function graph tracing
Message-ID<tye4G-5xb-19@gated-at.bofh.it>
In reply to#1627030
3.18-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Josh Poimboeuf <jpoimboe@redhat.com>

commit 61b79e16c68d703dde58c25d3935d67210b7d71b upstream.

Paul Menzel reported a warning:

  WARNING: CPU: 0 PID: 774 at /build/linux-ROBWaj/linux-4.9.13/kernel/trace/trace_functions_graph.c:233 ftrace_return_to_handler+0x1aa/0x1e0
  Bad frame pointer: expected f6919d98, received f6919db0
    from func acpi_pm_device_sleep_wake return to c43b6f9d

The warning means that function graph tracing is broken for the
acpi_pm_device_sleep_wake() function.  That's because the ACPI Makefile
unconditionally sets the '-Os' gcc flag to optimize for size.  That's an
issue because mcount-based function graph tracing is incompatible with
'-Os' on x86, thanks to the following gcc bug:

  https://gcc.gnu.org/bugzilla/show_bug.cgi?id=42109

I have another patch pending which will ensure that mcount-based
function graph tracing is never used with CONFIG_CC_OPTIMIZE_FOR_SIZE on
x86.

But this patch is needed in addition to that one because the ACPI
Makefile overrides that config option for no apparent reason.  It has
had this flag since the beginning of git history, and there's no related
comment, so I don't know why it's there.  As far as I can tell, there's
no reason for it to be there.  The appropriate behavior is for it to
honor CONFIG_CC_OPTIMIZE_FOR_{SIZE,PERFORMANCE} like the rest of the
kernel.

Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/acpi/Makefile |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/acpi/Makefile
+++ b/drivers/acpi/Makefile
@@ -2,7 +2,6 @@
 # Makefile for the Linux ACPI interpreter
 #
 
-ccflags-y			:= -Os
 ccflags-$(CONFIG_ACPI_DEBUG)	+= -DACPI_DEBUG_OUTPUT
 
 #

[toc] | [prev] | [next] | [standalone]


Page 1 of 6  [1] 2 3 4 5 6  Next page →

Back to top | Article view | linux.kernel


csiph-web