)]}' { "log": [ { "commit": "7089db84e356562f8ba737c29e472cc42d530dbc", "tree": "60a6457cdae94cfbe4ce124864b9e0c9f44676b6", "parents": [ "1ce42845f987e92eabfc6e026d44d826c25c74a5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 12 13:03:20 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Feb 12 13:03:20 2017 -0800" }, "message": "Linux 4.10-rc8\n" }, { "commit": "1ce42845f987e92eabfc6e026d44d826c25c74a5", "tree": "d62cdad8adc590faad42bc656e31b2a8a786a77c", "parents": [ "fdb0ee7c65781464168e2943a3fd6f1e66a397c9", "146fbb766934dc003fcbf755b519acef683576bf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:31:46 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:31:46 2017 -0800" }, "message": "Merge branch \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n \"Last minute x86 fixes:\n\n - Fix a softlockup detector warning and long delays if using ptdump\n with KASAN enabled.\n\n - Two more TSC-adjust fixes for interesting firmware interactions.\n\n - Two commits to fix an AMD CPU topology enumeration bug that caused\n a measurable gaming performance regression\"\n\n* \u0027x86-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/mm/ptdump: Fix soft lockup in page table walker\n x86/tsc: Make the TSC ADJUST sanitizing work for tsc_reliable\n x86/tsc: Avoid the large time jump when sanitizing TSC ADJUST\n x86/CPU/AMD: Fix Zen SMT topology\n x86/CPU/AMD: Bring back Compute Unit ID\n" }, { "commit": "fdb0ee7c65781464168e2943a3fd6f1e66a397c9", "tree": "4c1e8f5d1be9b34087f29d76577d8e6ec40962e1", "parents": [ "d5b76bef01047843cc65bd018046c76182b1fc81", "7bdb59f1ad474bd7161adc8f923cdef10f2638d1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:24:16 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:24:16 2017 -0800" }, "message": "Merge branch \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n \"Fix a sporadic missed timer hw reprogramming bug that can result in\n random delays\"\n\n* \u0027timers-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n tick/nohz: Fix possible missing clock reprog after tick soft restart\n" }, { "commit": "d5b76bef01047843cc65bd018046c76182b1fc81", "tree": "13aa1b0019d2afeb53257edde54e36c3fa86ecdf", "parents": [ "4e4f74a7eebbc52eaa1dc3c0be6b3c68c0875b09", "451d24d1e5f40bad000fa9abe36ddb16fc9928cb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:20:06 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:20:06 2017 -0800" }, "message": "Merge branch \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf fixes from Ingo Molnar:\n \"A kernel crash fix plus three tooling fixes\"\n\n* \u0027perf-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fix crash in perf_event_read()\n perf callchain: Reference count maps\n perf diff: Fix -o/--order option behavior (again)\n perf diff: Fix segfault on \u0027perf diff -o N\u0027 option\n" }, { "commit": "4e4f74a7eebbc52eaa1dc3c0be6b3c68c0875b09", "tree": "18c2ea553d01596dcd309835d476ec745c9138db", "parents": [ "21a7061c5ec300a8a12a0d6468eb7094e9c54a32", "bfeda41d06d85ad9d52f2413cfc2b77be5022f75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:16:05 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:16:05 2017 -0800" }, "message": "Merge branch \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull lockdep fix from Ingo Molnar:\n \"This fixes an ugly lockdep stack trace output regression. (But also\n affects other stacktrace users such as kmemleak, KASAN, etc)\"\n\n* \u0027locking-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n stacktrace, lockdep: Fix address, newline ugliness\n" }, { "commit": "21a7061c5ec300a8a12a0d6468eb7094e9c54a32", "tree": "c87ed9874098073fb3411a8fbb12f2b1acd02186", "parents": [ "2b95550a4323e501e133dac1c9c9cad6ff17f4c1", "d128dfb514f55af040c38a6b3b131d72b6f115d0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:14:24 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 10:14:24 2017 -0800" }, "message": "Merge branch \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull irq fixes from Ingo Molnar:\n \"Two last minute ARM irqchip driver fixes\"\n\n* \u0027irq-urgent-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n irqchip/mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND\n irqchip/keystone: Fix \"scheduling while atomic\" on rt\n" }, { "commit": "2b95550a4323e501e133dac1c9c9cad6ff17f4c1", "tree": "c68b793cfc897e003d08164cb3f03db274766e6f", "parents": [ "13ebfd0601228fbbd92707ce4944ab1a09a4d821", "6e78b3f7a193546b1c00a6d084596e774f147169" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 09:15:58 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 09:15:58 2017 -0800" }, "message": "Merge branch \u0027for-linus-4.10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs\n\nPull btrfs fixes from Chris Mason:\n \"This has two last minute fixes. The highest priority here is a\n regression fix for the decompression code, but we also fixed up a\n problem with the 32-bit compat ioctls.\n\n The decompression bug could hand back the wrong data on big reads when\n zlib was used. I have a larger cleanup to make the math here less\n error prone, but at this stage in the release Omar\u0027s patch is the best\n choice\"\n\n* \u0027for-linus-4.10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:\n btrfs: fix btrfs_decompress_buf2page()\n btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n" }, { "commit": "13ebfd0601228fbbd92707ce4944ab1a09a4d821", "tree": "10efe652d9e1cda881d1ca57cfc81039a854bde1", "parents": [ "1ee18329fae936089c6c599250ae92482ff2b81f", "ed6de4560ad2f7578be3a9ca1364e268c641f3a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 09:01:03 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Feb 11 09:01:03 2017 -0800" }, "message": "Merge tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi\n\nPull SCSI fixes from James Bottomley:\n \"Six fairly small fixes. None is a real show stopper, two automation\n detected problems: one memory leak, one use after free and four others\n each of which fixes something that has been a significant source of\n annoyance to someone\"\n\n* tag \u0027scsi-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:\n scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send\n scsi: aacraid: Fix INTx/MSI-x issue with older controllers\n scsi: mpt3sas: disable ASPM for MPI2 controllers\n scsi: mpt3sas: Force request partial completion alignment\n scsi: qla2xxx: Avoid that issuing a LIP triggers a kernel crash\n scsi: qla2xxx: Fix a recently introduced memory leak\n" }, { "commit": "6e78b3f7a193546b1c00a6d084596e774f147169", "tree": "f9cb50e4e7ad54fa71359dab4aba0fe742987e0e", "parents": [ "f3c7bfbda7ce03c603b4292efddc944228dccc55" ], "author": { "name": "Omar Sandoval", "email": "osandov@fb.com", "time": "Fri Feb 10 15:03:35 2017 -0800" }, "committer": { "name": "Chris Mason", "email": "clm@fb.com", "time": "Fri Feb 10 19:11:03 2017 -0800" }, "message": "Btrfs: fix btrfs_decompress_buf2page()\n\nIf btrfs_decompress_buf2page() is handed a bio with its page in the\nmiddle of the working buffer, then we adjust the offset into the working\nbuffer. After we copy into the bio, we advance the iterator by the\nnumber of bytes we copied. Then, we have some logic to handle the case\nof discontiguous pages and adjust the offset into the working buffer\nagain. However, if we didn\u0027t advance the bio to a new page, we may enter\nthis case in error, essentially repeating the adjustment that we already\nmade when we entered the function. The end result is bogus data in the\nbio.\n\nPreviously, we only checked for this case when we advanced to a new\npage, but the conversion to bio iterators changed that. This restores\nthe old, correct behavior.\n\nA case I saw when testing with zlib was:\n\n buf_start \u003d 42769\n total_out \u003d 46865\n working_bytes \u003d total_out - buf_start \u003d 4096\n start_byte \u003d 45056\n\nThe condition (total_out \u003e start_byte \u0026\u0026 buf_start \u003c start_byte) is\ntrue, so we adjust the offset:\n\n buf_offset \u003d start_byte - buf_start \u003d 2287\n working_bytes -\u003d buf_offset \u003d 1809\n current_buf_start \u003d buf_start \u003d 42769\n\nThen, we copy\n\n bytes \u003d min(bvec.bv_len, PAGE_SIZE - buf_offset, working_bytes) \u003d 1809\n buf_offset +\u003d bytes \u003d 4096\n working_bytes -\u003d bytes \u003d 0\n current_buf_start +\u003d bytes \u003d 44578\n\nAfter bio_advance(), we are still in the same page, so start_byte is the\nsame. Then, we check (total_out \u003e start_byte \u0026\u0026 current_buf_start \u003c start_byte),\nwhich is true! So, we adjust the values again:\n\n buf_offset \u003d start_byte - buf_start \u003d 2287\n working_bytes \u003d total_out - start_byte \u003d 1809\n current_buf_start \u003d buf_start + buf_offset \u003d 45056\n\nBut note that working_bytes was already zero before this, so we should\nhave stopped copying.\n\nFixes: 974b1adc3b10 (\"btrfs: use bio iterators for the decompression handlers\")\nReported-by: Pat Erley \u003cpat-lkml@erley.org\u003e\nReviewed-by: Chris Mason \u003cclm@fb.com\u003e\nSigned-off-by: Omar Sandoval \u003cosandov@fb.com\u003e\nSigned-off-by: Chris Mason \u003cclm@fb.com\u003e\nReviewed-by: Liu Bo \u003cbo.li.liu@oracle.com\u003e\nTested-by: Liu Bo \u003cbo.li.liu@oracle.com\u003e\n" }, { "commit": "1ee18329fae936089c6c599250ae92482ff2b81f", "tree": "25afbc81cb70016d92cad1590a3f56163a3dc347", "parents": [ "a9dbf5c8d4c90f54777f89daf0e34d390808b672", "72fb96e7bdbbdd4421b0726992496531060f3636" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:44:49 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:44:49 2017 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net\n\nPull networking fixes from David Miller:\n\n 1) If the timing is wrong we can indefinitely stop generating new ipv6\n temporary addresses, from Marcus Huewe.\n\n 2) Don\u0027t double free per-cpu stats in ipv6 SIT tunnel driver, from Cong\n Wang.\n\n 3) Put protections in place so that AF_PACKET is not able to submit\n packets which don\u0027t even have a link level header to drivers. From\n Willem de Bruijn.\n\n 4) Fix memory leaks in ipv4 and ipv6 multicast code, from Hangbin Liu.\n\n 5) Don\u0027t use udp_ioctl() in l2tp code, UDP version expects a UDP socket\n and that doesn\u0027t go over very well when it is passed an L2TP one.\n Fix from Eric Dumazet.\n\n 6) Don\u0027t crash on NULL pointer in phy_attach_direct(), from Florian\n Fainelli.\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:\n l2tp: do not use udp_ioctl()\n xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()\n NET: mkiss: Fix panic\n net: hns: Fix the device being used for dma mapping during TX\n net: phy: Initialize mdio clock at probe function\n igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()\n xen-netfront: Improve error handling during initialization\n sierra_net: Skip validating irrelevant fields for IDLE LSIs\n sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications\n kcm: fix 0-length case for kcm_sendmsg()\n xen-netfront: Rework the fix for Rx stall during OOM and network stress\n net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()\n net: thunderx: Fix PHY autoneg for SGMII QLM mode\n net: dsa: Do not destroy invalid network devices\n ping: fix a null pointer dereference\n packet: round up linear to header len\n net: introduce device min_header_len\n sit: fix a double free on error path\n lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled\n ipv6: addrconf: fix generation of new temporary addresses\n" }, { "commit": "a9dbf5c8d4c90f54777f89daf0e34d390808b672", "tree": "a88262c9b95f6551d3d5baf89de0a9762e969253", "parents": [ "aca9fa0c8d225b1446dbed798b1d2f20e37e52cf", "646ebd4166ca00bdf682a36bd2e1c9a74d848ac6" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:41:16 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:41:16 2017 -0800" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma\n\nPull rdma fixes from Doug Ledford:\n \"Third round of -rc fixes for 4.10 kernel:\n\n - two security related issues in the rxe driver\n\n - one compile issue in the RDMA uapi header\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:\n RDMA: Don\u0027t reference kernel private header from UAPI header\n IB/rxe: Fix mem_check_range integer overflow\n IB/rxe: Fix resid update\n" }, { "commit": "aca9fa0c8d225b1446dbed798b1d2f20e37e52cf", "tree": "cf8d9f70ca376665da6b83eaae382ac0218395fc", "parents": [ "fc6f41ba8b2e705f91324db158c3cc28209a15b1", "bbb27fc33d44e7b8d96369810654df4ee1837566" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:39:08 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:39:08 2017 -0800" }, "message": "Merge branch \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux\n\nPull i2c bugfixes from Wolfram Sang:\n \"Two bugfixes (proper IO mapping and use of mutex) for a driver feature\n we introduced in this cycle\"\n\n* \u0027i2c/for-current\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:\n i2c: piix4: Request the SMBUS semaphore inside the mutex\n i2c: piix4: Fix request_region size\n" }, { "commit": "fc6f41ba8b2e705f91324db158c3cc28209a15b1", "tree": "567bede1cc6bd9f2dec3a3dc85e908e02557da2e", "parents": [ "1f369d1655c1de415a186c6ce9004e40ca790989", "5cad24d835772f9f709971a8d6fcf12afe53b2a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:35:22 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:35:22 2017 -0800" }, "message": "Merge tag \u0027mmc-v4.10-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc\n\nPull MMC host fix from Ulf Hansson:\n \"mmci: Fix hang while waiting for busy-end interrupt\"\n\n* tag \u0027mmc-v4.10-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:\n mmc: mmci: avoid clearing ST Micro busy end interrupt mistakenly\n" }, { "commit": "1f369d1655c1de415a186c6ce9004e40ca790989", "tree": "71a9a75378c49301d321e45cacd54852a83b4d13", "parents": [ "7fe654dca20892f37226c31bdd2d5b932f8d843a", "af677166cf63c179dc2485053166e02c4aea01eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:29:30 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:29:30 2017 -0800" }, "message": "Merge tag \u0027sound-4.10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"Here are some last-minute fixes: two fixes for races in ALSA sequencer\n queue spotted by syzkaller, a revert for a regression of LINE6 driver\n (since 4.9), and a trivial new codec ID addition for Nvidia HDMI\"\n\n* tag \u0027sound-4.10\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda - adding a new NV HDMI/DP codec ID in the driver\n ALSA: seq: Fix race at creating a queue\n Revert \"ALSA: line6: Only determine control port properties if needed\"\n ALSA: seq: Don\u0027t handle loop timeout at snd_seq_pool_done()\n" }, { "commit": "7fe654dca20892f37226c31bdd2d5b932f8d843a", "tree": "0a7d3c1e4eff0a0194fc265efae10ad1cbd2e0c5", "parents": [ "3ebc7033168d43d12e4941f48a6f257d3f1ea1b5", "0839ffb83e44e5ff1843e932592525fc2bff23ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:23:45 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:23:45 2017 -0800" }, "message": "Merge tag \u0027nfsd-4.10-3\u0027 of git://linux-nfs.org/~bfields/linux\n\nPull nfsd revert from Bruce Fields:\n \"This patch turned out to have a couple problems. The problems are\n fixable, but at least one of the fixes is a little ugly. The original\n bug has always been there, so we can wait another week or two to get\n this right\"\n\n* tag \u0027nfsd-4.10-3\u0027 of git://linux-nfs.org/~bfields/linux:\n nfsd: Revert \"nfsd: special case truncates some more\"\n" }, { "commit": "3ebc7033168d43d12e4941f48a6f257d3f1ea1b5", "tree": "86148ef43b4da95d656d29d4d4ba84e754aeca17", "parents": [ "3d88460dbd285e7f32437b530d5bb7cb916142fa", "f83e6862047e1e371bdc5d512dd6cabe8a3965b8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:10:35 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Feb 10 14:10:35 2017 -0800" }, "message": "Merge tag \u0027powerpc-4.10-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux\n\nPull powerpc fixes friom Michael Ellerman:\n \"Apologies for the late pull request, but Ben has been busy finding bugs.\n\n - Userspace was semi-randomly segfaulting on radix due to us\n incorrectly handling a fault triggered by autonuma, caused by a\n patch we merged earlier in v4.10 to prevent the kernel executing\n userspace.\n\n - We weren\u0027t marking host IPIs properly for KVM in the OPAL ICP\n backend.\n\n - The ERAT flushing on radix was missing an isync and was incorrectly\n marked as DD1 only.\n\n - The powernv CPU hotplug code was missing a wakeup type and failing\n to flush the interrupt correctly when using OPAL ICP\n\n Thanks to Benjamin Herrenschmidt\"\n\n* tag \u0027powerpc-4.10-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:\n powerpc/powernv: Properly set \"host-ipi\" on IPIs\n powerpc/powernv: Fix CPU hotplug to handle waking on HVI\n powerpc/mm/radix: Update ERAT flushes when invalidating TLB\n powerpc/mm: Fix spurrious segfaults on radix with autonuma\n" }, { "commit": "72fb96e7bdbbdd4421b0726992496531060f3636", "tree": "edd4c429c973566b233252d3d55343a2bea7c9e9", "parents": [ "74470954857c264168d2b5a113904cf0cfd27d18" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Feb 09 16:15:52 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 15:57:34 2017 -0500" }, "message": "l2tp: do not use udp_ioctl()\n\nudp_ioctl(), as its name suggests, is used by UDP protocols,\nbut is also used by L2TP :(\n\nL2TP should use its own handler, because it really does not\nlook the same.\n\nSIOCINQ for instance should not assume UDP checksum or headers.\n\nThanks to Andrey and syzkaller team for providing the report\nand a nice reproducer.\n\nWhile crashes only happen on recent kernels (after commit\n7c13f97ffde6 (\"udp: do fwd memory scheduling on dequeue\")), this\nprobably needs to be backported to older kernels.\n\nFixes: 7c13f97ffde6 (\"udp: do fwd memory scheduling on dequeue\")\nFixes: 85584672012e (\"udp: Fix udp_poll() and ioctl()\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nAcked-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f3c7bfbda7ce03c603b4292efddc944228dccc55", "tree": "a82a639c63ee3a78259c9ee909d19c2c48d9d3d3", "parents": [ "57b59ed2e5b91e958843609c7884794e29e6c4cb", "2a362249187a8d0f6d942d6e1d763d150a296f47" ], "author": { "name": "Chris Mason", "email": "clm@fb.com", "time": "Fri Feb 10 12:53:18 2017 -0800" }, "committer": { "name": "Chris Mason", "email": "clm@fb.com", "time": "Fri Feb 10 12:53:18 2017 -0800" }, "message": "Merge branch \u0027for-chris\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.10\n" }, { "commit": "74470954857c264168d2b5a113904cf0cfd27d18", "tree": "24385081f1db3e70506265c9e8da6f2ad03752ec", "parents": [ "7ba1b689038726d34e3244c1ac9e2e18c2ea4787" ], "author": { "name": "Boris Ostrovsky", "email": "boris.ostrovsky@oracle.com", "time": "Mon Jan 30 12:45:46 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 13:44:49 2017 -0500" }, "message": "xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()\n\nrx_refill_timer should be deleted as soon as we disconnect from the\nbackend since otherwise it is possible for the timer to go off before\nwe get to xennet_destroy_queues(). If this happens we may dereference\nqueue-\u003erx.sring which is set to NULL in xennet_disconnect_backend().\n\nSigned-off-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nCC: stable@vger.kernel.org\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "7ba1b689038726d34e3244c1ac9e2e18c2ea4787", "tree": "0487e65f3e5c1f72e1997c1c8f26c99c4f62e334", "parents": [ "b85ea006b6bebb692628f11882af41c3e12e1e09" ], "author": { "name": "Ralf Baechle", "email": "ralf@linux-mips.org", "time": "Thu Feb 09 14:12:11 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 13:41:13 2017 -0500" }, "message": "NET: mkiss: Fix panic\n\nIf a USB-to-serial adapter is unplugged, the driver re-initializes, with\ndev-\u003ehard_header_len and dev-\u003eaddr_len set to zero, instead of the correct\nvalues. If then a packet is sent through the half-dead interface, the\nkernel will panic due to running out of headroom in the skb when pushing\nfor the AX.25 headers resulting in this panic:\n\n[\u003cc0595468\u003e] (skb_panic) from [\u003cc0401f70\u003e] (skb_push+0x4c/0x50)\n[\u003cc0401f70\u003e] (skb_push) from [\u003cbf0bdad4\u003e] (ax25_hard_header+0x34/0xf4 [ax25])\n[\u003cbf0bdad4\u003e] (ax25_hard_header [ax25]) from [\u003cbf0d05d4\u003e] (ax_header+0x38/0x40 [mkiss])\n[\u003cbf0d05d4\u003e] (ax_header [mkiss]) from [\u003cc041b584\u003e] (neigh_compat_output+0x8c/0xd8)\n[\u003cc041b584\u003e] (neigh_compat_output) from [\u003cc043e7a8\u003e] (ip_finish_output+0x2a0/0x914)\n[\u003cc043e7a8\u003e] (ip_finish_output) from [\u003cc043f948\u003e] (ip_output+0xd8/0xf0)\n[\u003cc043f948\u003e] (ip_output) from [\u003cc043f04c\u003e] (ip_local_out_sk+0x44/0x48)\n\nThis patch makes mkiss behave like the 6pack driver. 6pack does not\npanic. In 6pack.c sp_setup() (same function name here) the values for\ndev-\u003ehard_header_len and dev-\u003eaddr_len are set to the same values as in\nmy mkiss patch.\n\n[ralf@linux-mips.org: Massages original submission to conform to the usual\nstandards for patch submissions.]\n\nSigned-off-by: Thomas Osterried \u003cthomas@osterried.de\u003e\nSigned-off-by: Ralf Baechle \u003cralf@linux-mips.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b85ea006b6bebb692628f11882af41c3e12e1e09", "tree": "ae0a5849478c04835e9dd2b7380a0df80b48ad53", "parents": [ "bb1a619735b4660f21bce3e728b937640024b4ad" ], "author": { "name": "Kejian Yan", "email": "yankejian@huawei.com", "time": "Thu Feb 09 11:46:15 2017 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Feb 10 13:40:30 2017 -0500" }, "message": "net: hns: Fix the device being used for dma mapping during TX\n\nThis patch fixes the device being used to DMA map skb-\u003edata.\nErroneous device assignment causes the crash when SMMU is enabled.\nThis happens during TX since buffer gets DMA mapped with device\ncorrespondign to net_device and gets unmapped using the device\nrelated to DSAF.\n\nSigned-off-by: Kejian Yan \u003cyankejian@huawei.com\u003e\nReviewed-by: Yisen Zhuang \u003cyisen.zhuang@huawei.com\u003e\nSigned-off-by: Salil Mehta \u003csalil.mehta@huawei.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d128dfb514f55af040c38a6b3b131d72b6f115d0", "tree": "c53755d2aa94bd71ca89008c2aaea8a39c24f24e", "parents": [ "3d88460dbd285e7f32437b530d5bb7cb916142fa", "88e20c74ee020f9e0c99dfce0dd9aa61c3f0cca0" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 14:44:01 2017 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 14:44:01 2017 +0100" }, "message": "Merge tag \u0027irqchip-fixes-4.10\u0027 of git://git.infradead.org/users/jcooper/linux into irq/urgent\n\nPull irqchip fixes for v4.10 from Jason Cooper\n\n- keystone: Fix scheduling while atomic for realtime\n- mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND\n" }, { "commit": "146fbb766934dc003fcbf755b519acef683576bf", "tree": "cb8a89a1a93abce2de66d5ded015154aebf3af75", "parents": [ "5f2e71e71410ecb858cfec184ba092adaca61626" ], "author": { "name": "Andrey Ryabinin", "email": "aryabinin@virtuozzo.com", "time": "Fri Feb 10 12:54:05 2017 +0300" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 11:00:23 2017 +0100" }, "message": "x86/mm/ptdump: Fix soft lockup in page table walker\n\nCONFIG_KASAN\u003dy needs a lot of virtual memory mapped for its shadow.\nIn that case ptdump_walk_pgd_level_core() takes a lot of time to\nwalk across all page tables and doing this without\na rescheduling causes soft lockups:\n\n NMI watchdog: BUG: soft lockup - CPU#3 stuck for 23s! [swapper/0:1]\n ...\n Call Trace:\n ptdump_walk_pgd_level_core+0x40c/0x550\n ptdump_walk_pgd_level_checkwx+0x17/0x20\n mark_rodata_ro+0x13b/0x150\n kernel_init+0x2f/0x120\n ret_from_fork+0x2c/0x40\n\nI guess that this issue might arise even without KASAN on huge machines\nwith several terabytes of RAM.\n\nStick cond_resched() in pgd loop to fix this.\n\nReported-by: Tobias Regnery \u003ctobias.regnery@gmail.com\u003e\nSigned-off-by: Andrey Ryabinin \u003caryabinin@virtuozzo.com\u003e\nCc: kasan-dev@googlegroups.com\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: \"Paul E . McKenney\" \u003cpaulmck@linux.vnet.ibm.com\u003e\nCc: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/20170210095405.31802-1-aryabinin@virtuozzo.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\n" }, { "commit": "5f2e71e71410ecb858cfec184ba092adaca61626", "tree": "dae498d353d35fd4e89597143e9f5e125c886968", "parents": [ "f2e04214ef7f7e49d1e06109ad1b2718155dab25" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Feb 09 16:08:42 2017 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 09:47:17 2017 +0100" }, "message": "x86/tsc: Make the TSC ADJUST sanitizing work for tsc_reliable\n\nWhen the TSC is marked reliable then the synchronization check is skipped,\nbut that also skips the TSC ADJUST sanitizing code. So on a machine with a\nwreckaged BIOS the TSC deviation between CPUs might go unnoticed.\n\nLet the TSC adjust sanitizing code run unconditionally and just skip the\nexpensive synchronization checks when TSC is marked reliable.\n\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Olof Johansson \u003colof@lixom.net\u003e\nLink: http://lkml.kernel.org/r/20170209151231.491189912@linutronix.de\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\n" }, { "commit": "f2e04214ef7f7e49d1e06109ad1b2718155dab25", "tree": "af46eb10416f26d1e7f45d8b214ff1af639b6d74", "parents": [ "08b259631b5a1d912af4832847b5642f377d9101" ], "author": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Thu Feb 09 16:08:41 2017 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 09:47:16 2017 +0100" }, "message": "x86/tsc: Avoid the large time jump when sanitizing TSC ADJUST\n\nOlof reported that on a machine which has a BIOS wreckaged TSC the\ntimestamps in dmesg are making a large jump because the TSC value is\njumping forward after resetting the TSC ADJUST register to a sane value.\n\nThis can be avoided by calling the TSC ADJUST saniziting function before\ninitializing the per cpu sched clock machinery. That takes the offset into\naccount and avoid the time jump.\n\nWhat cannot be avoided is that the \u0027Firmware Bug\u0027 warnings on the secondary\nCPUs are printed with the large time offsets because it would be too much\neffort and ugly hackery to print those warnings into a buffer and emit them\nafter the adjustemt on the starting CPUs. It\u0027s a firmware bug and should be\nfixed in firmware. The weird timestamps are collateral damage and just\nillustrate the sillyness of the BIOS folks:\n\n[ 0.397445] smp: Bringing up secondary CPUs ...\n[ 0.402100] x86: Booting SMP configuration:\n[ 0.406343] .... node #0, CPUs: #1\n[1265776479.930667] [Firmware Bug]: TSC ADJUST differs: Reference CPU0: -2978888639075328 CPU1: -2978888639183101\n[1265776479.944664] TSC ADJUST synchronize: Reference CPU0: 0 CPU1: -2978888639183101\n[ 0.508119] #2\n[1265776480.032346] [Firmware Bug]: TSC ADJUST differs: Reference CPU0: -2978888639075328 CPU2: -2978888639183677\n[1265776480.044192] TSC ADJUST synchronize: Reference CPU0: 0 CPU2: -2978888639183677\n[ 0.607643] #3\n[1265776480.131874] [Firmware Bug]: TSC ADJUST differs: Reference CPU0: -2978888639075328 CPU3: -2978888639184530\n[1265776480.143720] TSC ADJUST synchronize: Reference CPU0: 0 CPU3: -2978888639184530\n[ 0.707108] smp: Brought up 1 node, 4 CPUs\n[ 0.711271] smpboot: Total of 4 processors activated (21698.88 BogoMIPS)\n\nReported-by: Olof Johansson \u003colof@lixom.net\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: http://lkml.kernel.org/r/20170209151231.411460506@linutronix.de\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\n" }, { "commit": "7bdb59f1ad474bd7161adc8f923cdef10f2638d1", "tree": "a930c264e448fb7d89c14b29cb67bc8c4ba595e5", "parents": [ "3d88460dbd285e7f32437b530d5bb7cb916142fa" ], "author": { "name": "Frederic Weisbecker", "email": "fweisbec@gmail.com", "time": "Tue Feb 07 17:44:54 2017 +0100" }, "committer": { "name": "Thomas Gleixner", "email": "tglx@linutronix.de", "time": "Fri Feb 10 09:43:48 2017 +0100" }, "message": "tick/nohz: Fix possible missing clock reprog after tick soft restart\n\nts-\u003enext_tick keeps track of the next tick deadline in order to optimize\nclock programmation on irq exit and avoid redundant clock device writes.\n\nNow if ts-\u003enext_tick missed an update, we may spuriously miss a clock\nreprog later as the nohz code is fooled by an obsolete next_tick value.\n\nThis is what happens here on a specific path: when we observe an\nexpired timer from the nohz update code on irq exit, we perform a soft\ntick restart which simply fires the closest possible tick without\nactually exiting the nohz mode and restoring a periodic state. But we\nforget to update ts-\u003enext_tick accordingly.\n\nAs a result, after the next tick resulting from such soft tick restart,\nthe nohz code sees a stale value on ts-\u003enext_tick which doesn\u0027t match\nthe clock deadline that just expired. If that obsolete ts-\u003enext_tick\nvalue happens to collide with the actual next tick deadline to be\nscheduled, we may spuriously bypass the clock reprogramming. In the\nworst case, the tick may never fire again.\n\nFix this with a ts-\u003enext_tick reset on soft tick restart.\n\nSigned-off-by: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nReviewed: Wanpeng Li \u003cwanpeng.li@hotmail.com\u003e\nAcked-by: Rik van Riel \u003criel@redhat.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: stable@vger.kernel.org\nLink: http://lkml.kernel.org/r/1486485894-29173-1-git-send-email-fweisbec@gmail.com\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\n\n" }, { "commit": "451d24d1e5f40bad000fa9abe36ddb16fc9928cb", "tree": "532b1fe208f3223a3b447f535f4a761f08c2527a", "parents": [ "53e74a112ce5c1c9b6a6923bdd6612133625d579" ], "author": { "name": "Peter Zijlstra", "email": "peterz@infradead.org", "time": "Tue Jan 31 11:27:10 2017 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Feb 10 09:04:50 2017 +0100" }, "message": "perf/core: Fix crash in perf_event_read()\n\nAlexei had his box explode because doing read() on a package\n(rapl/uncore) event that isn\u0027t currently scheduled in ends up doing an\nout-of-bounds load.\n\nRework the code to more explicitly deal with event-\u003eoncpu being -1.\n\nReported-by: Alexei Starovoitov \u003calexei.starovoitov@gmail.com\u003e\nTested-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nTested-by: David Carrillo-Cisneros \u003cdavidcc@google.com\u003e\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: eranian@google.com\nFixes: d6a2f9035bfc (\"perf/core: Introduce PMU_EV_CAP_READ_ACTIVE_PKG\")\nLink: http://lkml.kernel.org/r/20170131102710.GL6515@twins.programming.kicks-ass.net\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "ed6de4560ad2f7578be3a9ca1364e268c641f3a7", "tree": "ef2fa19e0c9efba4791dff9e5a1d7854e2b62184", "parents": [ "ad3efdb72cd921ec52ac94e82595a5d2e7a7b054", "2dfa6688aafdc3f74efeb1cf05fb871465d67f79" ], "author": { "name": "James Bottomley", "email": "James.Bottomley@HansenPartnership.com", "time": "Thu Feb 09 21:00:46 2017 -0800" }, "committer": { "name": "James Bottomley", "email": "James.Bottomley@HansenPartnership.com", "time": "Thu Feb 09 21:00:46 2017 -0800" }, "message": "Merge remote-tracking branch \u0027mkp-scsi/4.10/scsi-fixes\u0027 into fixes\n" }, { "commit": "0839ffb83e44e5ff1843e932592525fc2bff23ff", "tree": "b5ac49bc5f31db6937c2333612148977efd395af", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Thu Feb 09 14:20:42 2017 -0500" }, "committer": { "name": "J. Bruce Fields", "email": "bfields@redhat.com", "time": "Thu Feb 09 20:49:20 2017 -0500" }, "message": "nfsd: Revert \"nfsd: special case truncates some more\"\n\nThis patch incorrectly attempted nested mnt_want_write, and incorrectly\ndisabled nfsd\u0027s owner override for truncate. We\u0027ll fix those problems\nand make another attempt soon, for the moment I think the safest is to\nrevert.\n\nSigned-off-by: J. Bruce Fields \u003cbfields@redhat.com\u003e\n" }, { "commit": "3d88460dbd285e7f32437b530d5bb7cb916142fa", "tree": "3cc4f479bb3813bb4804f5ed4d52a493003c9fa5", "parents": [ "55aac6ef53e114c28170ee3f79065cfa8ca9cf3f", "697d3a21615672b2bf7724a65755799260325dda" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 17:46:30 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 17:46:30 2017 -0800" }, "message": "Merge tag \u0027drm-fixes-for-v4.10-rc8\u0027 of git://people.freedesktop.org/~airlied/linux\n\nPull drm fixes from Dave Airlie:\n \"This should be the final set of drm fixes for 4.10: one vmwgfx boot\n fix, one vc4 fix, and a few i915 fixes:\n\n* tag \u0027drm-fixes-for-v4.10-rc8\u0027 of git://people.freedesktop.org/~airlied/linux:\n drm: vc4: adapt to new behaviour of drm_crtc.c\n drm/i915: Always convert incoming exec offsets to non-canonical\n drm/i915: Remove overzealous fence warn on runtime suspend\n drm/i915/bxt: Add MST support when do DPLL calculation\n drm/i915: don\u0027t warn about Skylake CPU - KabyPoint PCH combo\n drm/i915: fix i915 running as dom0 under Xen\n drm/i915: Flush untouched framebuffers before display on !llc\n drm/i915: fix use-after-free in page_flip_completed()\n drm/vmwgfx: Fix depth input into drm_mode_legacy_fb_format\n" }, { "commit": "2dfa6688aafdc3f74efeb1cf05fb871465d67f79", "tree": "b0d4f8150f5e0bb5581ebf521182420b5158332b", "parents": [ "8af8e1c22f9994bb1849c01d66c24fe23f9bc9a0" ], "author": { "name": "Steffen Maier", "email": "maier@linux.vnet.ibm.com", "time": "Wed Feb 08 15:34:22 2017 +0100" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Thu Feb 09 19:28:19 2017 -0500" }, "message": "scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send\n\nDan Carpenter kindly reported:\n\u003cquote\u003e\nThe patch d27a7cb91960: \"zfcp: trace on request for open and close of\nWKA port\" from Aug 10, 2016, leads to the following static checker\nwarning:\n\n\tdrivers/s390/scsi/zfcp_fsf.c:1615 zfcp_fsf_open_wka_port()\n\twarn: \u0027req\u0027 was already freed.\n\ndrivers/s390/scsi/zfcp_fsf.c\n 1609 zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);\n 1610 retval \u003d zfcp_fsf_req_send(req);\n 1611 if (retval)\n 1612 zfcp_fsf_req_free(req);\n ^^^\nFreed.\n\n 1613 out:\n 1614 spin_unlock_irq(\u0026qdio-\u003ereq_q_lock);\n 1615 if (req \u0026\u0026 !IS_ERR(req))\n 1616 zfcp_dbf_rec_run_wka(\"fsowp_1\", wka_port, req-\u003ereq_id);\n ^^^^^^^^^^^\nUse after free.\n\n 1617 return retval;\n 1618 }\n\nSame thing for zfcp_fsf_close_wka_port() as well.\n\u003c/quote\u003e\n\nRather than relying on req being NULL (or ERR_PTR) for all cases where\nwe don\u0027t want to trace or should not trace,\nsimply check retval which is unconditionally initialized with -EIO !\u003d 0\nand it can only become 0 on successful retval \u003d zfcp_fsf_req_send(req).\nWith that we can also remove the then again unnecessary unconditional\ninitialization of req which was introduced with that earlier commit.\n\nReported-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nSuggested-by: Benjamin Block \u003cbblock@linux.vnet.ibm.com\u003e\nSigned-off-by: Steffen Maier \u003cmaier@linux.vnet.ibm.com\u003e\nFixes: d27a7cb91960 (\"zfcp: trace on request for open and close of WKA port\")\nCc: \u003cstable@vger.kernel.org\u003e #2.6.38+\nReviewed-by: Benjamin Block \u003cbblock@linux.vnet.ibm.com\u003e\nReviewed-by: Jens Remus \u003cjremus@linux.vnet.ibm.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "8af8e1c22f9994bb1849c01d66c24fe23f9bc9a0", "tree": "4cd217a231cfd229e51b23d57c71bb73c9578865", "parents": [ "ffdadd68af5a397b8a52289ab39d62e1acb39e63" ], "author": { "name": "Dave Carroll", "email": "david.carroll@microsemi.com", "time": "Thu Feb 09 11:04:47 2017 -0700" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Thu Feb 09 19:28:11 2017 -0500" }, "message": "scsi: aacraid: Fix INTx/MSI-x issue with older controllers\n\ncommit 78cbccd3bd68 (\"aacraid: Fix for KDUMP driver hang\")\n\ncaused a problem on older controllers which do not support MSI-x (namely\nASR3405,ASR3805). This patch conditionalizes the previous patch to\ncontrollers which support MSI-x\n\nCc: \u003cstable@vger.kernel.org\u003e # v4.7+\nFixes: 78cbccd3bd68 (\"aacraid: Fix for KDUMP driver hang\")\nReported-by: Arkadiusz Miskiewicz \u003ca.miskiewicz@gmail.com\u003e\nSigned-off-by: Dave Carroll \u003cdavid.carroll@microsemi.com\u003e\nReviewed-by: Raghava Aditya Renukunta \u003cRaghavaAditya.Renukunta@microsemi.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "697d3a21615672b2bf7724a65755799260325dda", "tree": "79dfa1b95274ee71e9d8c4a35b377f88d1cdd9e0", "parents": [ "811b40c83db047ba22a0c5b638186ed2b8c9810c", "6e7eb1783be7f19eb071c96ddda0bbf22279ff46" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 10 10:14:24 2017 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 10 10:14:24 2017 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2017-02-09\u0027 of git://anongit.freedesktop.org/git/drm-intel into drm-fixes\n\nHopefully final fixes for v4.10, about half of them stable material.\n\n* tag \u0027drm-intel-fixes-2017-02-09\u0027 of git://anongit.freedesktop.org/git/drm-intel:\n drm/i915: Always convert incoming exec offsets to non-canonical\n drm/i915: Remove overzealous fence warn on runtime suspend\n drm/i915/bxt: Add MST support when do DPLL calculation\n drm/i915: don\u0027t warn about Skylake CPU - KabyPoint PCH combo\n drm/i915: fix i915 running as dom0 under Xen\n drm/i915: Flush untouched framebuffers before display on !llc\n drm/i915: fix use-after-free in page_flip_completed()\n" }, { "commit": "811b40c83db047ba22a0c5b638186ed2b8c9810c", "tree": "aa586d7c3da7c4a3630342c3f05d963dd5315a33", "parents": [ "5d18a619976944dc3114bbe1525880c431196c7a", "49d29a077af8d2ee3b291ccd8d053541bebe09d7" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 10 10:14:01 2017 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Feb 10 10:14:01 2017 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2017-02-09\u0027 of git://anongit.freedesktop.org/git/drm-misc into drm-fixes\n\nLast-minute vc4 fix for 4.10.\n\n* tag \u0027drm-misc-fixes-2017-02-09\u0027 of git://anongit.freedesktop.org/git/drm-misc:\n drm: vc4: adapt to new behaviour of drm_crtc.c\n" }, { "commit": "ffdadd68af5a397b8a52289ab39d62e1acb39e63", "tree": "6b3e1223847071aedd4e3b4a5dfbbc6dfa43ad68", "parents": [ "f2e767bb5d6ee0d988cb7d4e54b0b21175802b6b" ], "author": { "name": "ojab", "email": "ojab@ojab.ru", "time": "Wed Dec 28 11:05:24 2016 +0000" }, "committer": { "name": "Martin K. Petersen", "email": "martin.petersen@oracle.com", "time": "Thu Feb 09 18:54:12 2017 -0500" }, "message": "scsi: mpt3sas: disable ASPM for MPI2 controllers\n\nMPI2 controllers sometimes got lost (i.e. disappear from\n/sys/bus/pci/devices) if ASMP is enabled.\n\nSigned-off-by: Slava Kardakov \u003cojab@ojab.ru\u003e\nFixes: https://bugzilla.kernel.org/show_bug.cgi?id\u003d60644\nCc: \u003cstable@vger.kernel.org\u003e\nAcked-by: Sreekanth Reddy \u003cSreekanth.Reddy@broadcom.com\u003e\nSigned-off-by: Martin K. Petersen \u003cmartin.petersen@oracle.com\u003e\n" }, { "commit": "bb1a619735b4660f21bce3e728b937640024b4ad", "tree": "cf73ea48581dd23195bb427bd3e9c2c144928096", "parents": [ "9c8bb163ae784be4f79ae504e78c862806087c54" ], "author": { "name": "Yendapally Reddy Dhananjaya Reddy", "email": "yendapally.reddy@broadcom.com", "time": "Wed Feb 08 17:14:26 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 17:10:23 2017 -0500" }, "message": "net: phy: Initialize mdio clock at probe function\n\nUSB PHYs need the MDIO clock divisor enabled earlier to work.\nInitialize mdio clock divisor in probe function. The ext bus\nbit available in the same register will be used by mdio mux\nto enable external mdio.\n\nSigned-off-by: Yendapally Reddy Dhananjaya Reddy \u003cyendapally.reddy@broadcom.com\u003e\nFixes: ddc24ae1 (\"net: phy: Broadcom iProc MDIO bus driver\")\nReviewed-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: Jon Mason \u003cjon.mason@broadcom.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9c8bb163ae784be4f79ae504e78c862806087c54", "tree": "3a4f8ad0efffb2d1c63347819245ffd0dc59d273", "parents": [ "e2e004acc7cbe3c531e752a270a74e95cde3ea48" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@gmail.com", "time": "Wed Feb 08 21:16:45 2017 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:43:45 2017 -0500" }, "message": "igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()\n\nIn function igmpv3/mld_add_delrec() we allocate pmc and put it in\nidev-\u003emc_tomb, so we should free it when we don\u0027t need it in del_delrec().\nBut I removed kfree(pmc) incorrectly in latest two patches. Now fix it.\n\nFixes: 24803f38a5c0 (\"igmp: do not remove igmp souce list info when ...\")\nFixes: 1666d49e1d41 (\"mld: do not remove mld souce list info when ...\")\nReported-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "e2e004acc7cbe3c531e752a270a74e95cde3ea48", "tree": "1a1644a3498b13ff364b7a738f736a153ef4c3eb", "parents": [ "1b5805c29c7fffc569b749c760b2bafce925df87" ], "author": { "name": "Ross Lagerwall", "email": "ross.lagerwall@citrix.com", "time": "Wed Feb 08 10:57:37 2017 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:43:01 2017 -0500" }, "message": "xen-netfront: Improve error handling during initialization\n\nThis fixes a crash when running out of grant refs when creating many\nqueues across many netdevs.\n\n* If creating queues fails (i.e. there are no grant refs available),\ncall xenbus_dev_fatal() to ensure that the xenbus device is set to the\nclosed state.\n* If no queues are created, don\u0027t call xennet_disconnect_backend as\nnetdev-\u003ereal_num_tx_queues will not have been set correctly.\n* If setup_netfront() fails, ensure that all the queues created are\ncleaned up, not just those that have been set up.\n* If any queues were set up and an error occurs, call\nxennet_destroy_queues() to clean up the napi context.\n* If any fatal error occurs, unregister and destroy the netdev to avoid\nleaving around a half setup network device.\n\nSigned-off-by: Ross Lagerwall \u003cross.lagerwall@citrix.com\u003e\nReviewed-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1b5805c29c7fffc569b749c760b2bafce925df87", "tree": "63455badce6b917d1510cff4a4e0ef1dcb897037", "parents": [ "98e3862ca2b1ae595a13805dcab4c3a6d7718f4d", "764895d3039e903dac3a70f219949efe43d036a0" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:41:43 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:41:43 2017 -0500" }, "message": "Merge branch \u0027sierra_net-fixes\u0027\n\nStefan Brüns says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFixes for sierra_net driver\n\nWhen trying to initiate a dual-stack (ipv4v6) connection, a MC7710, FW\nversion SWI9200X_03.05.24.00ap answers with an unsupported LSI. Add support\nfor this LSI.\nAlso the link_type should be ignored when going idle, otherwise the modem\nis stuck in a bad link state.\nTested on MC7710, T-Mobile DE, APN internet.telekom, IPv4v6 PDP type. Both\nIPv4 and IPv6 connections work.\n\nv2: Do not overwrite protocol field in rx_fixup\nv3: Remove leftover struct ethhdr *eth declaration\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "764895d3039e903dac3a70f219949efe43d036a0", "tree": "63455badce6b917d1510cff4a4e0ef1dcb897037", "parents": [ "5a70348e1187c5bf1cbd0ec51843f36befed1c2d" ], "author": { "name": "Stefan Brüns", "email": "stefan.bruens@rwth-aachen.de", "time": "Wed Feb 08 02:46:33 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:41:43 2017 -0500" }, "message": "sierra_net: Skip validating irrelevant fields for IDLE LSIs\n\nWhen the context is deactivated, the link_type is set to 0xff, which\ntriggers a warning message, and results in a wrong link status, as\nthe LSI is ignored.\n\nSigned-off-by: Stefan Brüns \u003cstefan.bruens@rwth-aachen.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5a70348e1187c5bf1cbd0ec51843f36befed1c2d", "tree": "5dae0aa1df53f96af14cc7adad8f50173b640f00", "parents": [ "98e3862ca2b1ae595a13805dcab4c3a6d7718f4d" ], "author": { "name": "Stefan Brüns", "email": "stefan.bruens@rwth-aachen.de", "time": "Wed Feb 08 02:46:32 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:41:43 2017 -0500" }, "message": "sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications\n\nIf a context is configured as dualstack (\"IPv4v6\"), the modem indicates\nthe context activation with a slightly different indication message.\nThe dual-stack indication omits the link_type (IPv4/v6) and adds\nadditional address fields.\nIPv6 LSIs are identical to IPv4 LSIs, but have a different link type.\n\nSigned-off-by: Stefan Brüns \u003cstefan.bruens@rwth-aachen.de\u003e\nReviewed-by: Bjørn Mork \u003cbjorn@mork.no\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "98e3862ca2b1ae595a13805dcab4c3a6d7718f4d", "tree": "52879528ae93a9cc7aec463a1f1d1653c3da967f", "parents": [ "538d92912d3190a1dd809233a0d57277459f37b2" ], "author": { "name": "WANG Cong", "email": "xiyou.wangcong@gmail.com", "time": "Tue Feb 07 12:59:47 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:38:48 2017 -0500" }, "message": "kcm: fix 0-length case for kcm_sendmsg()\n\nDmitry reported a kernel warning:\n\n WARNING: CPU: 3 PID: 2936 at net/kcm/kcmsock.c:627\n kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627\n CPU: 3 PID: 2936 Comm: a.out Not tainted 4.10.0-rc6+ #209\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n Call Trace:\n __dump_stack lib/dump_stack.c:15 [inline]\n dump_stack+0x2ee/0x3ef lib/dump_stack.c:51\n panic+0x1fb/0x412 kernel/panic.c:179\n __warn+0x1c4/0x1e0 kernel/panic.c:539\n warn_slowpath_null+0x2c/0x40 kernel/panic.c:582\n kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627\n kcm_sendmsg+0x163a/0x2200 net/kcm/kcmsock.c:1029\n sock_sendmsg_nosec net/socket.c:635 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:645\n sock_write_iter+0x326/0x600 net/socket.c:848\n new_sync_write fs/read_write.c:499 [inline]\n __vfs_write+0x483/0x740 fs/read_write.c:512\n vfs_write+0x187/0x530 fs/read_write.c:560\n SYSC_write fs/read_write.c:607 [inline]\n SyS_write+0xfb/0x230 fs/read_write.c:599\n entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nwhen calling syscall(__NR_write, sock2, 0x208aaf27ul, 0x0ul) on a KCM\nseqpacket socket. It appears that kcm_sendmsg() does not handle len\u003d\u003d0\ncase correctly, which causes an empty skb is allocated and queued.\nFix this by skipping the skb allocation for len\u003d\u003d0 case.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: Tom Herbert \u003ctom@herbertland.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "538d92912d3190a1dd809233a0d57277459f37b2", "tree": "3a0ff3c7ae5e688124425606039b8ae960e5d5de", "parents": [ "6d9f66ac7fec2a6ccd649e5909806dfe36f1fc25" ], "author": { "name": "Vineeth Remanan Pillai", "email": "vineethp@amazon.com", "time": "Tue Feb 07 18:59:01 2017 +0000" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:34:05 2017 -0500" }, "message": "xen-netfront: Rework the fix for Rx stall during OOM and network stress\n\nThe commit 90c311b0eeea (\"xen-netfront: Fix Rx stall during network\nstress and OOM\") caused the refill timer to be triggerred almost on\nall invocations of xennet_alloc_rx_buffers for certain workloads.\nThis reworks the fix by reverting to the old behaviour and taking into\nconsideration the skb allocation failure. Refill timer is now triggered\non insufficient requests or skb allocation failure.\n\nSigned-off-by: Vineeth Remanan Pillai \u003cvineethp@amazon.com\u003e\nFixes: 90c311b0eeea (xen-netfront: Fix Rx stall during network stress and OOM)\nReported-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nReviewed-by: Boris Ostrovsky \u003cboris.ostrovsky@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "55aac6ef53e114c28170ee3f79065cfa8ca9cf3f", "tree": "7eac44b0f280f8faea96c9ff09d2f650f04e3d46", "parents": [ "2b369478e1856e3809f439495567474725931585", "b22bc27868e8c11fe3f00937a341b44f80b50364" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 13:22:54 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 13:22:54 2017 -0800" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending\n\nPull SCSI target fixes from Nicholas Bellinger:\n \"This target series for v4.10 contains fixes which address a few\n long-standing bugs that DATERA\u0027s QA + automation teams have uncovered\n while putting v4.1.y target code into production usage.\n\n We\u0027ve been running the top three in our nightly automated regression\n runs for the last two months, and the COMPARE_AND_WRITE fix Mr. Gary\n Guo has been manually verifying against a four node ESX cluster this\n past week.\n\n Note all of them have CC\u0027 stable tags.\n\n Summary:\n\n - Fix a bug with ESX EXTENDED_COPY + SAM_STAT_RESERVATION_CONFLICT\n status, where target_core_xcopy.c logic was incorrectly returning\n SAM_STAT_CHECK_CONDITION for all non SAM_STAT_GOOD cases (Nixon\n Vincent)\n\n - Fix a TMR LUN_RESET hung task bug while other in-flight TMRs are\n being aborted, before the new one had been dispatched into tmr_wq\n (Rob Millner)\n\n - Fix a long standing double free OOPs, where a dynamically generated\n \u0027demo-mode\u0027 NodeACL has multiple sessions associated with it, and\n the /sys/kernel/config/target/$FABRIC/$WWN/ subsequently disables\n demo-mode, but never converts the dynamic ACL into a explicit ACL\n (Rob Millner)\n\n - Fix a long standing reference leak with ESX VAAI COMPARE_AND_WRITE\n when the second phase WRITE COMMIT command fails, resulting in\n CHECK_CONDITION response never being sent and se_cmd-\u003ecmd_kref\n never reaching zero (Gary Guo)\n\n Beyond these items on v4.1.y we\u0027ve reproduced, fixed, and run through\n our regression test suite using iscsi-target exports, there are two\n additional outstanding list items:\n\n - Remove a \u003e\u003d v4.2 RCU conversion BUG_ON that would trigger when\n dynamic node NodeACLs where being converted to explicit NodeACLs.\n The patch drops the BUG_ON to follow how pre RCU conversion worked\n for this special case (Benjamin Estrabaud)\n\n - Add ibmvscsis target_core_fabric_ops-\u003emax_data_sg_nent assignment\n to match what IBM\u0027s Virtual SCSI hypervisor is already enforcing at\n transport layer. (Bryant Ly + Steven Royer)\"\n\n* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:\n ibmvscsis: Add SGL limit\n target: Fix COMPARE_AND_WRITE ref leak for non GOOD status\n target: Fix multi-session dynamic se_node_acl double free OOPs\n target: Fix early transport_generic_handle_tmr abort scenario\n target: Use correct SCSI status during EXTENDED_COPY exception\n target: Don\u0027t BUG_ON during NodeACL dynamic -\u003e explicit conversion\n" }, { "commit": "6d9f66ac7fec2a6ccd649e5909806dfe36f1fc25", "tree": "eee88d8cc491a121d8c587caebd7503fd5bb03e5", "parents": [ "075ad765ef7541b2860de8408c165a92b78aefa3" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Wed Feb 08 19:05:26 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Thu Feb 09 16:22:12 2017 -0500" }, "message": "net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()\n\nThe Generic PHY drivers gets assigned after we checked that the current\nPHY driver is NULL, so we need to check a few things before we can\nsafely dereference d-\u003edriver. This would be causing a NULL deference to\noccur when a system binds to the Generic PHY driver. Update\nphy_attach_direct() to do the following:\n\n- grab the driver module reference after we have assigned the Generic\n PHY drivers accordingly, and remember we came from the generic PHY\n path\n\n- update the error path to clean up the module reference in case the\n Generic PHY probe function fails\n\n- split the error path involving phy_detacht() to avoid double free/put\n since phy_detach() does all the clean up\n\n- finally, have phy_detach() drop the module reference count before we\n call device_release_driver() for the Generic PHY driver case\n\nFixes: cafe8df8b9bc (\"net: phy: Fix lack of reference count on PHY driver\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2b369478e1856e3809f439495567474725931585", "tree": "717b0016c8fcc0c5255b14778c89530070fbe475", "parents": [ "99378fd26803328cbab64ae60fa98e1394d07a6d", "8672aed7bd865774257efd40929702759a869329" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 12:25:42 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 12:25:42 2017 -0800" }, "message": "Merge tag \u0027pstore-v4.10-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull pstore fix from Kees Cook:\n \"Fix pstore regression (boot Oops) when ftrace disabled, from Brian\n Norris\"\n\n* tag \u0027pstore-v4.10-rc8\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n pstore: don\u0027t OOPS when there are no ftrace zones\n" }, { "commit": "99378fd26803328cbab64ae60fa98e1394d07a6d", "tree": "1ab2771c56963fec8669ac87c7058c84345365c4", "parents": [ "189addce85330208bea50ea7f1483b58822e93cf", "413d37326700aaf708730b940b04192c36e13ef4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:58:05 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:58:05 2017 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n \"A fix for a crash in uinput, and a fix for build errors when HID-RMI\n is built-in but SERIO is a module\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: synaptics-rmi4 - select \u0027SERIO\u0027 when needed\n Input: uinput - fix crash when mixing old and new init style\n" }, { "commit": "8672aed7bd865774257efd40929702759a869329", "tree": "7b1fa5d524bd20873e8f5f977e0f4b98c047c4be", "parents": [ "d966564fcdc19e13eb6ba1fbe6b8101070339c3d" ], "author": { "name": "Brian Norris", "email": "briannorris@chromium.org", "time": "Wed Feb 08 22:44:44 2017 -0800" }, "committer": { "name": "Kees Cook", "email": "keescook@chromium.org", "time": "Thu Feb 09 11:49:49 2017 -0800" }, "message": "pstore: don\u0027t OOPS when there are no ftrace zones\n\nWe\u0027ll OOPS in ramoops_get_next_prz() if the platform didn\u0027t ask for any\nftrace zones (i.e., cxt-\u003efprzs will be NULL). Let\u0027s just skip this\nentire FTRACE section if there\u0027s no \u0027fprzs\u0027.\n\nRegression seen on a coreboot/depthcharge-based Chromebook.\n\nFixes: 2fbea82bbb89 (\"pstore: Merge per-CPU ftrace records into one\")\nCc: Joel Fernandes \u003cjoelaf@google.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nSigned-off-by: Brian Norris \u003cbriannorris@chromium.org\u003e\nSigned-off-by: Kees Cook \u003ckeescook@chromium.org\u003e\n" }, { "commit": "189addce85330208bea50ea7f1483b58822e93cf", "tree": "39455d91caa0463c7c4fdcd9c76b81e18541b29d", "parents": [ "59e8f10ac16186c226ef81937994534b28b976f4", "930a42ded3fede7ca3acafc9153f4f2d0f56a92c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:34:15 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:34:15 2017 -0800" }, "message": "Merge tag \u0027vfio-v4.10-final\u0027 of git://github.com/awilliam/linux-vfio\n\nPull VFIO fix from Alex Williamson:\n \"Fix regression in attaching groups to existing container for SPAPR\n IOMMU backend (Alexey Kardashevskiy)\"\n\n* tag \u0027vfio-v4.10-final\u0027 of git://github.com/awilliam/linux-vfio:\n vfio/spapr_tce: Set window when adding additional groups to container\n" }, { "commit": "59e8f10ac16186c226ef81937994534b28b976f4", "tree": "66149a98d76008ac3e36a4cae624651f20659e07", "parents": [ "d966564fcdc19e13eb6ba1fbe6b8101070339c3d", "228dbbfb5d77f8e047b2a1d78da14b7158433027" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:30:56 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 09 11:30:56 2017 -0800" }, "message": "Merge branch \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm\n\nPull ARM fixes from Russell King:\n \"A couple more fixes for 4.10:\n\n - fix addressing the short regset write issue (Dave Martin)\n\n - fix for LPAE systems which leave a pending imprecise data abort\n before entering the kernel (Alexander Sverdlin)\"\n\n* \u0027fixes\u0027 of git://git.armlinux.org.uk/~rmk/linux-arm:\n ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write\n ARM: 8642/1: LPAE: catch pending imprecise abort on unmask\n" }, { "commit": "bbb27fc33d44e7b8d96369810654df4ee1837566", "tree": "b769e165ad52c0021054f1a048b62bd7e4fbec47", "parents": [ "f43128c75202f29ee71aa83e6c320a911137c189" ], "author": { "name": "Ricardo Ribalda", "email": "ricardo.ribalda@gmail.com", "time": "Thu Feb 02 20:15:16 2017 +0100" }, "committer": { "name": "Wolfram Sang", "email": "wsa@the-dreams.de", "time": "Thu Feb 09 17:13:01 2017 +0100" }, "message": "i2c: piix4: Request the SMBUS semaphore inside the mutex\n\nSMBSLVCNT must be protected with the piix4_mutex_sb800 in order to avoid\nmultiple buses accessing to the semaphore at the same time.\n\nFixes: 701dc207bf55 (\"i2c: piix4: Avoid race conditions with IMC\")\nReported-by: Jean Delvare \u003cjdelvare@suse.de\u003e\nSigned-off-by: Ricardo Ribalda Delgado \u003cricardo.ribalda@gmail.com\u003e\nSigned-off-by: Jean Delvare \u003cjdelvare@suse.de\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@the-dreams.de\u003e\n" }, { "commit": "f43128c75202f29ee71aa83e6c320a911137c189", "tree": "85280695db72c8ae27f6c0c312a8573a4d756c80", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "Ricardo Ribalda", "email": "ricardo.ribalda@gmail.com", "time": "Fri Jan 27 15:59:30 2017 +0100" }, "committer": { "name": "Wolfram Sang", "email": "wsa@the-dreams.de", "time": "Thu Feb 09 17:10:38 2017 +0100" }, "message": "i2c: piix4: Fix request_region size\n\nSince \u0027701dc207bf55 (\"i2c: piix4: Avoid race conditions with IMC\")\u0027 we\nare using the SMBSLVCNT register at offset 0x8. We need to request it.\n\nFixes: 701dc207bf55 (\"i2c: piix4: Avoid race conditions with IMC\")\nSigned-off-by: Ricardo Ribalda Delgado \u003cricardo.ribalda@gmail.com\u003e\nSigned-off-by: Jean Delvare \u003cjdelvare@suse.de\u003e\nSigned-off-by: Wolfram Sang \u003cwsa@the-dreams.de\u003e\n" }, { "commit": "af677166cf63c179dc2485053166e02c4aea01eb", "tree": "ef589f740720763a86609ad4e3c86d4edf67bbff", "parents": [ "4842e98f26dd80be3623c4714a244ba52ea096a8" ], "author": { "name": "Hui Wang", "email": "hui.wang@canonical.com", "time": "Thu Feb 09 09:20:54 2017 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Thu Feb 09 08:57:47 2017 +0100" }, "message": "ALSA: hda - adding a new NV HDMI/DP codec ID in the driver\n\nWithout this change, the HDMI/DP codec will be recognised as a\ngeneric codec, and there is no sound when playing through this codec.\n\nAs suggested by NVidia side, after adding the new ID in the driver,\nthe sound playing works well.\n\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Hui Wang \u003chui.wang@canonical.com\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "f83e6862047e1e371bdc5d512dd6cabe8a3965b8", "tree": "bccad1dfc0b25d5dc810a00e950468a80b2643f3", "parents": [ "9b256714979fad61ae11d90b53cf67dd5e6484eb" ], "author": { "name": "Benjamin Herrenschmidt", "email": "benh@kernel.crashing.org", "time": "Tue Feb 07 11:35:36 2017 +1100" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Thu Feb 09 15:51:21 2017 +1100" }, "message": "powerpc/powernv: Properly set \"host-ipi\" on IPIs\n\nOtherwise KVM will fail to pass them through to the host\n\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "9b256714979fad61ae11d90b53cf67dd5e6484eb", "tree": "4e800dc0430b413bb9c3b3f0c68f6099bbe8716a", "parents": [ "90c1e3c2fafec57fcb55b5d69bcf293b1a5fc8b3" ], "author": { "name": "Benjamin Herrenschmidt", "email": "benh@kernel.crashing.org", "time": "Tue Feb 07 11:35:31 2017 +1100" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Thu Feb 09 15:19:57 2017 +1100" }, "message": "powerpc/powernv: Fix CPU hotplug to handle waking on HVI\n\nThe IPIs come in as HVI not EE, so we need to test the appropriate\nSRR1 bits. The encoding is such that it won\u0027t have false positives\non P7 and P8 so we can just test it like that. We also need to handle\nthe icp-opal variant of the flush.\n\nFixes: d74361881f0d (\"powerpc/xics: Add ICP OPAL backend\")\nCc: stable@vger.kernel.org # v4.8+\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "90c1e3c2fafec57fcb55b5d69bcf293b1a5fc8b3", "tree": "ea2bf611c6112a0fe03d1277ab62cbfc51cded92", "parents": [ "d7df2443cd5f67fc6ee7c05a88e4996e8177f91b" ], "author": { "name": "Benjamin Herrenschmidt", "email": "benh@kernel.crashing.org", "time": "Mon Feb 06 13:05:16 2017 +1100" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Thu Feb 09 14:54:33 2017 +1100" }, "message": "powerpc/mm/radix: Update ERAT flushes when invalidating TLB\n\nThree tiny changes to the ERAT flushing logic: First don\u0027t make\nit depend on DD1. It hasn\u0027t been decided yet but we might run\nDD2 in a mode that also requires explicit flushes for performance\nreasons so make it unconditional. We also add a missing isync, and\nfinally remove the flush from _tlbiel_va as it is only necessary\nfor congruence-class invalidations (PID, LPID and full TLB), not\ntargetted invalidations.\n\nFixes: 96ed1fe511a8 (\"powerpc/mm/radix: Invalidate ERAT on tlbiel for POWER9 DD1\")\nCc: stable@vger.kernel.org # v4.9+\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "d966564fcdc19e13eb6ba1fbe6b8101070339c3d", "tree": "ed5dd611aef574c765a342ae9c7219d9c65e796f", "parents": [ "3b802c9455f973fa786eafb4d5bd4634a7dd5130" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 18:08:29 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 18:08:29 2017 -0800" }, "message": "Revert \"x86/ioapic: Restore IO-APIC irq_chip retrigger callback\"\n\nThis reverts commit 020eb3daaba2857b32c4cf4c82f503d6a00a67de.\n\nGabriel C reports that it causes his machine to not boot, and we haven\u0027t\ntracked down the reason for it yet. Since the bug it fixes has been\naround for a longish time, we\u0027re better off reverting the fix for now.\n\nGabriel says:\n \"It hangs early and freezes with a lot RCU warnings.\n\n I bisected it down to :\n\n \u003e Ruslan Ruslichenko (1):\n \u003e x86/ioapic: Restore IO-APIC irq_chip retrigger callback\n\n Reverting this one fixes the problem for me..\n\n The box is a PRIMERGY TX200 S5 , 2 socket , 2 x E5520 CPU(s) installed\"\n\nand Ruslan and Thomas are currently stumped.\n\nReported-and-bisected-by: Gabriel C \u003cnix.or.die@gmail.com\u003e\nCc: Ruslan Ruslichenko \u003crruslich@cisco.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@kernel.org # for the backport of the original commit\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "3b802c9455f973fa786eafb4d5bd4634a7dd5130", "tree": "34e4af9e1ea04a66d4af99db46a80e433a434af5", "parents": [ "507053d23b886fdedc8336ca2233883fe4c82aa2" ], "author": { "name": "David Daney", "email": "david.daney@cavium.com", "time": "Tue Feb 07 16:23:31 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 18:06:03 2017 -0800" }, "message": "Revert \"hwrng: core - zeroize buffers with random data\"\n\nThis reverts commit 2cc751545854d7bd7eedf4d7e377bb52e176cd07.\n\nWith this commit in place I get on a Cavium ThunderX (arm64) system:\n\n$ if\u003d/dev/hwrng bs\u003d256 count\u003d1 | od -t x1 -A x -v \u003e rng-bad.txt\n1+0 records in\n1+0 records out\n256 bytes (256 B) copied, 9.1171e-05 s, 2.8 MB/s\n$ dd if\u003d/dev/hwrng bs\u003d256 count\u003d1 | od -t x1 -A x -v \u003e\u003e rng-bad.txt\n1+0 records in\n1+0 records out\n256 bytes (256 B) copied, 9.6141e-05 s, 2.7 MB/s\n$ cat rng-bad.txt\n000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000050 00 00 00 00 37 20 46 ae d0 fc 1c 55 25 6e b0 b8\n000060 7c 7e d7 d4 00 0f 6f b2 91 1e 30 a8 fa 3e 52 0e\n000070 06 2d 53 30 be a1 20 0f aa 56 6e 0e 44 6e f4 35\n000080 b7 6a fe d2 52 70 7e 58 56 02 41 ea d1 9c 6a 6a\n000090 d1 bd d8 4c da 35 45 ef 89 55 fc 59 d5 cd 57 ba\n0000a0 4e 3e 02 1c 12 76 43 37 23 e1 9f 7a 9f 9e 99 24\n0000b0 47 b2 de e3 79 85 f6 55 7e ad 76 13 4f a0 b5 41\n0000c0 c6 92 42 01 d9 12 de 8f b4 7b 6e ae d7 24 fc 65\n0000d0 4d af 0a aa 36 d9 17 8d 0e 8b 7a 3b b6 5f 96 47\n0000e0 46 f7 d8 ce 0b e8 3e c6 13 a6 2c b6 d6 cc 17 26\n0000f0 e3 c3 17 8e 9e 45 56 1e 41 ef 29 1a a8 65 c8 3a\n000100\n000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n000050 00 00 00 00 f4 90 65 aa 8b f2 5e 31 01 53 b4 d4\n000060 06 c0 23 a2 99 3d 01 e4 b0 c1 b1 55 0f 80 63 cf\n000070 33 24 d8 3a 1d 5e cd 2c ba c0 d0 18 6f bc 97 46\n000080 1e 19 51 b1 90 15 af 80 5e d1 08 0d eb b0 6c ab\n000090 6a b4 fe 62 37 c5 e1 ee 93 c3 58 78 91 2a d5 23\n0000a0 63 50 eb 1f 3b 84 35 18 cf b2 a4 b8 46 69 9e cf\n0000b0 0c 95 af 03 51 45 a8 42 f1 64 c9 55 fc 69 76 63\n0000c0 98 9d 82 fa 76 85 24 da 80 07 29 fe 4e 76 0c 61\n0000d0 ff 23 94 4f c8 5c ce 0b 50 e8 31 bc 9d ce f4 ca\n0000e0 be ca 28 da e6 fa cc 64 1c ec a8 41 db fe 42 bd\n0000f0 a0 e2 4b 32 b4 52 ba 03 70 8e c1 8e d0 50 3a c6\n000100\n\nTo my untrained mental entropy detector, the first several bytes of\neach read from /dev/hwrng seem to not be very random (i.e. all zero).\n\nWhen I revert the patch (apply this patch), I get back to what we have\nin v4.9, which looks like (much more random appearing):\n\n$ dd if\u003d/dev/hwrng bs\u003d256 count\u003d1 | od -t x1 -A x -v \u003e rng-good.txt\n1+0 records in\n1+0 records out\n256 bytes (256 B) copied, 0.000252233 s, 1.0 MB/s\n$ dd if\u003d/dev/hwrng bs\u003d256 count\u003d1 | od -t x1 -A x -v \u003e\u003e rng-good.txt\n1+0 records in\n1+0 records out\n256 bytes (256 B) copied, 0.000113571 s, 2.3 MB/s\n$ cat rng-good.txt\n000000 75 d1 2d 19 68 1f d2 26 a1 49 22 61 66 e8 09 e5\n000010 e0 4e 10 d0 1a 2c 45 5d 59 04 79 8e e2 b7 2c 2e\n000020 e8 ad da 34 d5 56 51 3d 58 29 c7 7a 8e ed 22 67\n000030 f9 25 b9 fb c6 b7 9c 35 1f 84 21 35 c1 1d 48 34\n000040 45 7c f6 f1 57 63 1a 88 38 e8 81 f0 a9 63 ad 0e\n000050 be 5d 3e 74 2e 4e cb 36 c2 01 a8 14 e1 38 e1 bb\n000060 23 79 09 56 77 19 ff 98 e8 44 f3 27 eb 6e 0a cb\n000070 c9 36 e3 2a 96 13 07 a0 90 3f 3b bd 1d 04 1d 67\n000080 be 33 14 f8 02 c2 a4 02 ab 8b 5b 74 86 17 f0 5e\n000090 a1 d7 aa ef a6 21 7b 93 d1 85 86 eb 4e 8c d0 4c\n0000a0 56 ac e4 45 27 44 84 9f 71 db 36 b9 f7 47 d7 b3\n0000b0 f2 9c 62 41 a3 46 2b 5b e3 80 63 a4 35 b5 3c f4\n0000c0 bc 1e 3a ad e4 59 4a 98 6c e8 8d ff 1b 16 f8 52\n0000d0 05 5c 2f 52 2a 0f 45 5b 51 fb 93 97 a4 49 4f 06\n0000e0 f3 a0 d1 1e ba 3d ed a7 60 8f bb 84 2c 21 94 2d\n0000f0 b3 66 a6 61 1e 58 30 24 85 f8 c8 18 c3 77 00 22\n000100\n000000 73 ca cc a1 d9 bb 21 8d c3 5c f3 ab 43 6d a7 a4\n000010 4a fd c5 f4 9c ba 4a 0f b1 2e 19 15 4e 84 26 e0\n000020 67 c9 f2 52 4d 65 1f 81 b7 8b 6d 2b 56 7b 99 75\n000030 2e cd d0 db 08 0c 4b df f3 83 c6 83 00 2e 2b b8\n000040 0f af 61 1d f2 02 35 74 b5 a4 6f 28 f3 a1 09 12\n000050 f2 53 b5 d2 da 45 01 e5 12 d6 46 f8 0b db ed 51\n000060 7b f4 0d 54 e0 63 ea 22 e2 1d d0 d6 d0 e7 7e e0\n000070 93 91 fb 87 95 43 41 28 de 3d 8b a3 a8 8f c4 9e\n000080 30 95 12 7a b2 27 28 ff 37 04 2e 09 7c dd 7c 12\n000090 e1 50 60 fb 6d 5f a8 65 14 40 89 e3 4c d2 87 8f\n0000a0 34 76 7e 66 7a 8e 6b a3 fc cf 38 52 2e f9 26 f0\n0000b0 98 63 15 06 34 99 b2 88 4f aa d8 14 88 71 f1 81\n0000c0 be 51 11 2b f4 7e a0 1e 12 b2 44 2e f6 8d 84 ea\n0000d0 63 82 2b 66 b3 9a fd 08 73 5a c2 cc ab 5a af b1\n0000e0 88 e3 a6 80 4b fc db ed 71 e0 ae c0 0a a4 8c 35\n0000f0 eb 89 f9 8a 4b 52 59 6f 09 7c 01 3f 56 e7 c7 bf\n000100\n\nSigned-off-by: David Daney \u003cdavid.daney@cavium.com\u003e\nAcked-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "507053d23b886fdedc8336ca2233883fe4c82aa2", "tree": "a64839493e04ac8608c52156d97d40ecd1c78be8", "parents": [ "be11f436a80b19cb5ef4cdfba7371a5178bd43cd", "a810007afe239d59c1115fcaa06eb5b480f876e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 16:06:10 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 16:06:10 2017 -0800" }, "message": "Merge branch \u0027akpm\u0027 (patches from Andrew)\n\nMerge fixes from Andrew Morton:\n \"4 fixes\"\n\n* emailed patches from Andrew Morton \u003cakpm@linux-foundation.org\u003e:\n mm/slub.c: fix random_seq offset destruction\n cpumask: use nr_cpumask_bits for parsing functions\n mm: avoid returning VM_FAULT_RETRY from -\u003epage_mkwrite handlers\n kernel/ucount.c: mark user_header with kmemleak_ignore()\n" }, { "commit": "a810007afe239d59c1115fcaa06eb5b480f876e9", "tree": "25bbc5efa479af7cb1ca2defeeffb2040600a2fd", "parents": [ "4d59b6ccf000862beed6fc0765d3209f98a8d8a2" ], "author": { "name": "Sean Rees", "email": "sean@erifax.org", "time": "Wed Feb 08 14:30:59 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 15:41:43 2017 -0800" }, "message": "mm/slub.c: fix random_seq offset destruction\n\nCommit 210e7a43fa90 (\"mm: SLUB freelist randomization\") broke USB hub\ninitialisation as described in\n\n https://bugzilla.kernel.org/show_bug.cgi?id\u003d177551.\n\nBail out early from init_cache_random_seq if s-\u003erandom_seq is already\ninitialised. This prevents destroying the previously computed\nrandom_seq offsets later in the function.\n\nIf the offsets are destroyed, then shuffle_freelist will truncate\npage-\u003efreelist to just the first object (orphaning the rest).\n\nFixes: 210e7a43fa90 (\"mm: SLUB freelist randomization\")\nLink: http://lkml.kernel.org/r/20170207140707.20824-1-sean@erifax.org\nSigned-off-by: Sean Rees \u003csean@erifax.org\u003e\nReported-by: \u003cuserwithuid@gmail.com\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Pekka Enberg \u003cpenberg@kernel.org\u003e\nCc: David Rientjes \u003crientjes@google.com\u003e\nCc: Joonsoo Kim \u003ciamjoonsoo.kim@lge.com\u003e\nCc: Thomas Garnier \u003cthgarnie@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "4d59b6ccf000862beed6fc0765d3209f98a8d8a2", "tree": "598294e81b74149a78ebed29b3a9ce6c53b1e1e1", "parents": [ "0911d0041c22922228ca52a977d7b0b0159fee4b" ], "author": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Wed Feb 08 14:30:56 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 15:41:43 2017 -0800" }, "message": "cpumask: use nr_cpumask_bits for parsing functions\n\nCommit 513e3d2d11c9 (\"cpumask: always use nr_cpu_ids in formatting and\nparsing functions\") converted both cpumask printing and parsing\nfunctions to use nr_cpu_ids instead of nr_cpumask_bits. While this was\nokay for the printing functions as it just picked one of the two output\nformats that we were alternating between depending on a kernel config,\ndoing the same for parsing wasn\u0027t okay.\n\nnr_cpumask_bits can be either nr_cpu_ids or NR_CPUS. We can always use\nnr_cpu_ids but that is a variable while NR_CPUS is a constant, so it can\nbe more efficient to use NR_CPUS when we can get away with it.\nConverting the printing functions to nr_cpu_ids makes sense because it\naffects how the masks get presented to userspace and doesn\u0027t break\nanything; however, using nr_cpu_ids for parsing functions can\nincorrectly leave the higher bits uninitialized while reading in these\nmasks from userland. As all testing and comparison functions use\nnr_cpumask_bits which can be larger than nr_cpu_ids, the parsed cpumasks\ncan erroneously yield false negative results.\n\nThis made the taskstats interface incorrectly return -EINVAL even when\nthe inputs were correct.\n\nFix it by restoring the parse functions to use nr_cpumask_bits instead\nof nr_cpu_ids.\n\nLink: http://lkml.kernel.org/r/20170206182442.GB31078@htj.duckdns.org\nFixes: 513e3d2d11c9 (\"cpumask: always use nr_cpu_ids in formatting and parsing functions\")\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Martin Steigerwald \u003cmartin.steigerwald@teamix.de\u003e\nDebugged-by: Ben Hutchings \u003cben.hutchings@codethink.co.uk\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.0+]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "0911d0041c22922228ca52a977d7b0b0159fee4b", "tree": "ecd0e2bd3ec2f1e934409a43dd3b0798860c7d8b", "parents": [ "ed5bd7dc88edf4a4a9c67130742b1b59aa017a5f" ], "author": { "name": "Jan Kara", "email": "jack@suse.cz", "time": "Wed Feb 08 14:30:53 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 15:41:43 2017 -0800" }, "message": "mm: avoid returning VM_FAULT_RETRY from -\u003epage_mkwrite handlers\n\nSome -\u003epage_mkwrite handlers may return VM_FAULT_RETRY as its return\ncode (GFS2 or Lustre can definitely do this). However VM_FAULT_RETRY\nfrom -\u003epage_mkwrite is completely unhandled by the mm code and results\nin locking and writeably mapping the page which definitely is not what\nthe caller wanted.\n\nFix Lustre and block_page_mkwrite_ret() used by other filesystems\n(notably GFS2) to return VM_FAULT_NOPAGE instead which results in\nbailing out from the fault code, the CPU then retries the access, and we\nfault again effectively doing what the handler wanted.\n\nLink: http://lkml.kernel.org/r/20170203150729.15863-1-jack@suse.cz\nSigned-off-by: Jan Kara \u003cjack@suse.cz\u003e\nReported-by: Al Viro \u003cviro@ZenIV.linux.org.uk\u003e\nReviewed-by: Jinshan Xiong \u003cjinshan.xiong@intel.com\u003e\nCc: Matthew Wilcox \u003cwilly@infradead.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "ed5bd7dc88edf4a4a9c67130742b1b59aa017a5f", "tree": "d0729326c87b25f75f5b5ed5308ecc18a0428322", "parents": [ "926af6273fc683cd98cd0ce7bf0d04a02eed6742" ], "author": { "name": "Luis R. Rodriguez", "email": "mcgrof@kernel.org", "time": "Wed Feb 08 14:30:50 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 15:41:43 2017 -0800" }, "message": "kernel/ucount.c: mark user_header with kmemleak_ignore()\n\nThe user_header gets caught by kmemleak with the following splat as\nmissing a free:\n\n unreferenced object 0xffff99667a733d80 (size 96):\n comm \"swapper/0\", pid 1, jiffies 4294892317 (age 62191.468s)\n hex dump (first 32 bytes):\n a0 b6 92 b4 ff ff ff ff 00 00 00 00 01 00 00 00 ................\n 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n kmemleak_alloc+0x4a/0xa0\n __kmalloc+0x144/0x260\n __register_sysctl_table+0x54/0x5e0\n register_sysctl+0x1b/0x20\n user_namespace_sysctl_init+0x17/0x34\n do_one_initcall+0x52/0x1a0\n kernel_init_freeable+0x173/0x200\n kernel_init+0xe/0x100\n ret_from_fork+0x2c/0x40\n\nThe BUG_ON()s are intended to crash so no need to clean up after\nourselves on error there. This is also a kernel/ subsys_init() we don\u0027t\nneed a respective exit call here as this is never modular, so just white\nlist it.\n\nLink: http://lkml.kernel.org/r/20170203211404.31458-1-mcgrof@kernel.org\nSigned-off-by: Luis R. Rodriguez \u003cmcgrof@kernel.org\u003e\nCc: Eric W. Biederman \u003cebiederm@xmission.com\u003e\nCc: Kees Cook \u003ckeescook@chromium.org\u003e\nCc: Nikolay Borisov \u003cn.borisov.lkml@gmail.com\u003e\nCc: Serge Hallyn \u003cserge@hallyn.com\u003e\nCc: Jan Kara \u003cjack@suse.cz\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "49d29a077af8d2ee3b291ccd8d053541bebe09d7", "tree": "e309cf9bca9fc9c8d2f9e87757aa4901deefc727", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "Andrzej Pietrasiewicz", "email": "andrzej.p@samsung.com", "time": "Wed Feb 01 10:35:08 2017 +0100" }, "committer": { "name": "Eric Anholt", "email": "eric@anholt.net", "time": "Wed Feb 08 14:19:23 2017 -0800" }, "message": "drm: vc4: adapt to new behaviour of drm_crtc.c\n\nWhen drm_crtc_init_with_planes() was orignally added\n(in drm_crtc.c, e13161af80c185ecd8dc4641d0f5df58f9e3e0af\ndrm: Add drm_crtc_init_with_planes() (v2)), it only checked for \"primary\"\nbeing non-null. If that was the case, it modified primary-\u003epossible_crtcs.\n\nThen, when support for cursor planes was added\n(fc1d3e44ef7c1db93384150fdbf8948dcf949f15 drm: Allow drivers to register\ncursor planes with crtc), the same behaviour was implemented for cursor\nplanes.\n\nvc4_plane_init() since its inception has passed 0xff as \"possible_crtcs\"\nparameter to drm_universal_plane_init(). With a change in drm_crtc.c\n(7abc7d47510c75dd984380ebf819616e574c9604 drm: don\u0027t override\npossible_crtcs for primary/cursor planes) passing 0xff results in primary\u0027s\npossible_crtcs set to 0xff (cursor was updated manually by vc4_crtc.c).\nConsequently, it would be allowed to use the primary plane from CRTC 1 (for\nexample) on CRTC 0, which would result in the overlay and cursors being\nburied.\n\nSigned-off-by: Andrzej Pietrasiewicz \u003candrzej.p@samsung.com\u003e\nReviewed-by: Eric Anholt \u003ceric@anholt.net\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/1485941708-27892-1-git-send-email-andrzej.p@samsung.com\nFixes: 7abc7d47510c (\"drm: don\u0027t override possible_crtcs for primary/cursor planes\")\n" }, { "commit": "075ad765ef7541b2860de8408c165a92b78aefa3", "tree": "f9f9ff10aa2f1169ed88c1346a93686af23f94b3", "parents": [ "382e1eea2d983cd2343482c6a638f497bb44a636" ], "author": { "name": "Thanneeru Srinivasulu", "email": "tsrinivasulu@cavium.com", "time": "Wed Feb 08 18:09:00 2017 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 15:47:37 2017 -0500" }, "message": "net: thunderx: Fix PHY autoneg for SGMII QLM mode\n\nThis patch fixes the case where there is no phydev attached\nto a LMAC in DT due to non-existance of a PHY driver or due\nto usage of non-stanadard PHY which doesn\u0027t support autoneg.\nChanges dependeds on firmware to send correct info w.r.t\nPHY and autoneg capability.\n\nThis patch also covers a case where a 10G/40G interface is used\nas a 1G with convertors with Cortina PHY in between.\n\nSigned-off-by: Thanneeru Srinivasulu \u003ctsrinivasulu@cavium.com\u003e\nSigned-off-by: Sunil Goutham \u003csgoutham@cavium.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "be11f436a80b19cb5ef4cdfba7371a5178bd43cd", "tree": "757250a0fe53c3947d9f244ffb04e51b53d13143", "parents": [ "472ff5be61f9593ee2d3ebbd716768e14de4659d", "d98e0929071e7ef63d35c1838b0ad0805ae366dd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 12:23:49 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 12:23:49 2017 -0800" }, "message": "Merge tag \u0027pci-v4.10-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci\n\nPull PCI fixes from Bjorn Helgaas:\n\n - check MSI affinity vs. number of vectors to avoid memory corruption\n\n - drop runtime power management for PCIe hotplug ports for now to avoid\n regressing hotplug via sysfs\n\n* tag \u0027pci-v4.10-fixes-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:\n Revert \"PCI: pciehp: Add runtime PM support for PCIe hotplug ports\"\n PCI/MSI: Don\u0027t apply affinity if there aren\u0027t enough vectors left\n" }, { "commit": "382e1eea2d983cd2343482c6a638f497bb44a636", "tree": "0799402b4792dada8d205c23346dbdeddc571bd5", "parents": [ "73d2c6678e6c3af7e7a42b1e78cd0211782ade32" ], "author": { "name": "Florian Fainelli", "email": "f.fainelli@gmail.com", "time": "Tue Feb 07 23:10:13 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 14:50:51 2017 -0500" }, "message": "net: dsa: Do not destroy invalid network devices\n\ndsa_slave_create() can fail, and dsa_user_port_unapply() will properly check\nfor the network device not being NULL before attempting to destroy it. We were\nnot setting the slave network device as NULL if dsa_slave_create() failed, so\nwe would later on be calling dsa_slave_destroy() on a now free\u0027d and\nunitialized network device, causing crashes in dsa_slave_destroy().\n\nFixes: 83c0afaec7b7 (\"net: dsa: Add new binding implementation\")\nSigned-off-by: Florian Fainelli \u003cf.fainelli@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "73d2c6678e6c3af7e7a42b1e78cd0211782ade32", "tree": "5ac91e86822cec59e17a45488747dcae955b2f35", "parents": [ "9538132a9f3cb8ed1590bec2b32650f4d30dd688" ], "author": { "name": "WANG Cong", "email": "xiyou.wangcong@gmail.com", "time": "Tue Feb 07 12:59:46 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:58:21 2017 -0500" }, "message": "ping: fix a null pointer dereference\n\nAndrey reported a kernel crash:\n\n general protection fault: 0000 [#1] SMP KASAN\n Dumping ftrace buffer:\n (ftrace buffer empty)\n Modules linked in:\n CPU: 2 PID: 3880 Comm: syz-executor1 Not tainted 4.10.0-rc6+ #124\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011\n task: ffff880060048040 task.stack: ffff880069be8000\n RIP: 0010:ping_v4_push_pending_frames net/ipv4/ping.c:647 [inline]\n RIP: 0010:ping_v4_sendmsg+0x1acd/0x23f0 net/ipv4/ping.c:837\n RSP: 0018:ffff880069bef8b8 EFLAGS: 00010206\n RAX: dffffc0000000000 RBX: ffff880069befb90 RCX: 0000000000000000\n RDX: 0000000000000018 RSI: ffff880069befa30 RDI: 00000000000000c2\n RBP: ffff880069befbb8 R08: 0000000000000008 R09: 0000000000000000\n R10: 0000000000000002 R11: 0000000000000000 R12: ffff880069befab0\n R13: ffff88006c624a80 R14: ffff880069befa70 R15: 0000000000000000\n FS: 00007f6f7c716700(0000) GS:ffff88006de00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00000000004a6f28 CR3: 000000003a134000 CR4: 00000000000006e0\n Call Trace:\n inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744\n sock_sendmsg_nosec net/socket.c:635 [inline]\n sock_sendmsg+0xca/0x110 net/socket.c:645\n SYSC_sendto+0x660/0x810 net/socket.c:1687\n SyS_sendto+0x40/0x50 net/socket.c:1655\n entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nThis is because we miss a check for NULL pointer for skb_peek() when\nthe queue is empty. Other places already have the same check.\n\nFixes: c319b4d76b9e (\"net: ipv4: add IPPROTO_ICMP socket kind\")\nReported-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nTested-by: Andrey Konovalov \u003candreyknvl@google.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "9538132a9f3cb8ed1590bec2b32650f4d30dd688", "tree": "ffe0e21da8d4ae2b435561434cc391970196e42b", "parents": [ "d7426c69a1942b2b9b709bf66b944ff09f561484", "57031eb794906eea4e1c7b31dc1e2429c0af0c66" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:56:38 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:56:38 2017 -0500" }, "message": "Merge branch \u0027net-header-length-truncation\u0027\n\nWillem de Bruijn says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Fixes for header length truncation\n\nPackets should not enter the stack with truncated link layer headers\nand link layer headers should always be stored in the skb linear\nsegment.\n\nPatch 1 ensures the first for PF_PACKET sockets\nPatch 2 ensures the second for PF_PACKET GSO sockets without tx_ring\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "57031eb794906eea4e1c7b31dc1e2429c0af0c66", "tree": "ffe0e21da8d4ae2b435561434cc391970196e42b", "parents": [ "217e6fa24ce28ec87fca8da93c9016cb78028612" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Tue Feb 07 15:57:21 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:56:37 2017 -0500" }, "message": "packet: round up linear to header len\n\nLink layer protocols may unconditionally pull headers, as Ethernet\ndoes in eth_type_trans. Ensure that the entire link layer header\nalways lies in the skb linear segment. tpacket_snd has such a check.\nExtend this to packet_snd.\n\nVariable length link layer headers complicate the computation\nsomewhat. Here skb-\u003elen may be smaller than dev-\u003ehard_header_len.\n\nRound up the linear length to be at least as long as the smallest of\nthe two.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "217e6fa24ce28ec87fca8da93c9016cb78028612", "tree": "1964e4821fd14a8255df061419fc2e8745bc92e7", "parents": [ "d7426c69a1942b2b9b709bf66b944ff09f561484" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Tue Feb 07 15:57:20 2017 -0500" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:56:37 2017 -0500" }, "message": "net: introduce device min_header_len\n\nThe stack must not pass packets to device drivers that are shorter\nthan the minimum link layer header length.\n\nPreviously, packet sockets would drop packets smaller than or equal\nto dev-\u003ehard_header_len, but this has false positives. Zero length\npayload is used over Ethernet. Other link layer protocols support\nvariable length headers. Support for validation of these protocols\nremoved the min length check for all protocols.\n\nIntroduce an explicit dev-\u003emin_header_len parameter and drop all\npackets below this value. Initially, set it to non-zero only for\nEthernet and loopback. Other protocols can follow in a patch to\nnet-next.\n\nFixes: 9ed988cd5915 (\"packet: validate variable length ll headers\")\nReported-by: Sowmini Varadhan \u003csowmini.varadhan@oracle.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Sowmini Varadhan \u003csowmini.varadhan@oracle.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "b22bc27868e8c11fe3f00937a341b44f80b50364", "tree": "8e12f041bfab895abb587d1fe16c84953329e0cd", "parents": [ "9b2792c3da1e80f2d460167d319302a24c9ca2b7" ], "author": { "name": "Bryant G. Ly", "email": "bryantly@linux.vnet.ibm.com", "time": "Mon Feb 06 10:04:28 2017 -0600" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 10:51:24 2017 -0800" }, "message": "ibmvscsis: Add SGL limit\n\nThis patch adds internal LIO sgl limit since the driver already\nsets a max transfer limit on transport layer of 1MB to the client.\n\nCc: stable@vger.kernel.org\nTested-by: Steven Royer \u003cseroyer@linux.vnet.ibm.com\u003e\nSigned-off-by: Bryant G. Ly \u003cbryantly@linux.vnet.ibm.com\u003e\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "d7426c69a1942b2b9b709bf66b944ff09f561484", "tree": "f32d0d878d78b43106a831b4b8f510c8a4b4d673", "parents": [ "2bd137de531367fb573d90150d1872cb2a2095f7" ], "author": { "name": "WANG Cong", "email": "xiyou.wangcong@gmail.com", "time": "Wed Feb 08 10:02:13 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 13:12:22 2017 -0500" }, "message": "sit: fix a double free on error path\n\nDmitry reported a double free in sit_init_net():\n\n kernel BUG at mm/percpu.c:689!\n invalid opcode: 0000 [#1] SMP KASAN\n Dumping ftrace buffer:\n (ftrace buffer empty)\n Modules linked in:\n CPU: 0 PID: 15692 Comm: syz-executor1 Not tainted 4.10.0-rc6-next-20170206 #1\n Hardware name: Google Google Compute Engine/Google Compute Engine,\n BIOS Google 01/01/2011\n task: ffff8801c9cc27c0 task.stack: ffff88017d1d8000\n RIP: 0010:pcpu_free_area+0x68b/0x810 mm/percpu.c:689\n RSP: 0018:ffff88017d1df488 EFLAGS: 00010046\n RAX: 0000000000010000 RBX: 00000000000007c0 RCX: ffffc90002829000\n RDX: 0000000000010000 RSI: ffffffff81940efb RDI: ffff8801db841d94\n RBP: ffff88017d1df590 R08: dffffc0000000000 R09: 1ffffffff0bb3bdd\n R10: dffffc0000000000 R11: 00000000000135dd R12: ffff8801db841d80\n R13: 0000000000038e40 R14: 00000000000007c0 R15: 00000000000007c0\n FS: 00007f6ea608f700(0000) GS:ffff8801dbe00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000000002000aff8 CR3: 00000001c8d44000 CR4: 00000000001426f0\n DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600\n Call Trace:\n free_percpu+0x212/0x520 mm/percpu.c:1264\n ipip6_dev_free+0x43/0x60 net/ipv6/sit.c:1335\n sit_init_net+0x3cb/0xa10 net/ipv6/sit.c:1831\n ops_init+0x10a/0x530 net/core/net_namespace.c:115\n setup_net+0x2ed/0x690 net/core/net_namespace.c:291\n copy_net_ns+0x26c/0x530 net/core/net_namespace.c:396\n create_new_namespaces+0x409/0x860 kernel/nsproxy.c:106\n unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205\n SYSC_unshare kernel/fork.c:2281 [inline]\n SyS_unshare+0x64e/0xfc0 kernel/fork.c:2231\n entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nThis is because when tunnel-\u003edst_cache init fails, we free dev-\u003etstats\nonce in ipip6_tunnel_init() and twice in sit_init_net(). This looks\nredundant but its ndo_uinit() does not seem enough to clean up everything\nhere. So avoid this by setting dev-\u003etstats to NULL after the first free,\nat least for -net.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "472ff5be61f9593ee2d3ebbd716768e14de4659d", "tree": "f49df37c99948503c5e7c754aa1f506899847c10", "parents": [ "d3498fbaf386f9d540cdde7211ebb2d502b2b365", "5aff1d245e8cc1ab5c4517d916edaed9e3f7f973" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 10:01:39 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 10:01:39 2017 -0800" }, "message": "Merge tag \u0027fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc\n\nPull ARM SoC fixes from Arnd Bergmann:\n\n - A relatively large patch restores booting on i.MX platforms that\n failed to boot after a cleanup was merged for v4.10.\n\n - A quirk for USB needs to be enabled on the STi platform\n\n - On the Meson platform, we saw memory corruption with part of the\n memory used by the secure monitor, so we have to stay out of that\n area.\n\n - The same platform also has a problem with ethernet under load, which\n is fixed by disabling EEE negotiation.\n\n - imx6dl has an incorrect pin configuration, which prevents SPI from\n working.\n\n - Two maintainers have lost their access to their email addresses, so\n we should update the MAINTAINERS file before the release\n\n - Renaming one of the orion5x linkstation models to help simplify the\n debian install.\n\n - A couple of fixes for build warnings that were introduced during\n v4.10-rc.\n\n* tag \u0027fixes-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:\n ARM: defconfigs: make NF_CT_PROTO_SCTP and NF_CT_PROTO_UDPLITE built-in\n MAINTAINERS: socfpga: update email for Dinh Nguyen\n ARM: orion5x: fix Makefile for linkstation-lschl.dtb\n ARM: dts: orion5x-lschl: More consistent naming on linkstation series\n ARM: dts: orion5x-lschl: Fix model name\n MAINTAINERS: change email address from atmel to microchip\n MAINTAINERS: at91: change email address\n ARM64: dts: meson-gx: Add firmware reserved memory zones\n ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage\n ARM: dts: STiH407-family: set snps,dis_u3_susphy_quirk\n ARM: dts: imx: Pass \u0027chosen\u0027 and \u0027memory\u0027 nodes\n ARM: dts: imx6dl: fix GPIO4 range\n ARM: imx: hide unused variable in #ifdef\n" }, { "commit": "d3498fbaf386f9d540cdde7211ebb2d502b2b365", "tree": "df7cf98c566236986b6cc6f3ca4b95ee14e858a6", "parents": [ "23fbe2cdc1de80120cf9ccd478ac57c3a3a0764b", "0c461cb727d146c9ef2d3e86214f498b78b7d125" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 09:59:45 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 09:59:45 2017 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security\n\nPull selinux fix from James Morris:\n \"Fix off-by-one in setprocattr\"\n\n* \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:\n selinux: fix off-by-one in setprocattr\n" }, { "commit": "23fbe2cdc1de80120cf9ccd478ac57c3a3a0764b", "tree": "4aff32d5f2f6fe2f54028bfd4d1b66fdd2f8d281", "parents": [ "926af6273fc683cd98cd0ce7bf0d04a02eed6742", "eeeefd41843218c55a8782a6920f044d9bf6207a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 09:56:15 2017 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 08 09:56:15 2017 -0800" }, "message": "Merge branch \u0027for-linus\u0027 of git://git.kernel.dk/linux-block\n\nPull block fix from Jens Axboe:\n \"A single fix that should go into 4.10, fixing a regression on some\n devices with the WRITE_SAME command\"\n\n* \u0027for-linus\u0027 of git://git.kernel.dk/linux-block:\n block: don\u0027t try Write Same from __blkdev_issue_zeroout\n" }, { "commit": "2bd137de531367fb573d90150d1872cb2a2095f7", "tree": "7c352cf2a83c4bc7f47ea612f8deee36638b36c2", "parents": [ "a11a7f71cac209c7c9cca66eb506e1ebb033a3b3" ], "author": { "name": "David Ahern", "email": "dsa@cumulusnetworks.com", "time": "Wed Feb 08 09:29:00 2017 -0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 12:52:11 2017 -0500" }, "message": "lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled\n\nAn error was reported upgrading to 4.9.8:\n root@Typhoon:~# ip route add default table 210 nexthop dev eth0 via 10.68.64.1\n weight 1 nexthop dev eth0 via 10.68.64.2 weight 1\n RTNETLINK answers: Operation not supported\n\nThe problem occurs when CONFIG_LWTUNNEL is not enabled and a multipath\nroute is submitted.\n\nThe point of lwtunnel_valid_encap_type_attr is catch modules that\nneed to be loaded before any references are taken with rntl held. With\nCONFIG_LWTUNNEL disabled, there will be no modules to load so the\nlwtunnel_valid_encap_type_attr stub should just return 0.\n\nFixes: 9ed59592e3e3 (\"lwtunnel: fix autoload of lwt modules\")\nReported-by: pupilla@libero.it\nSigned-off-by: David Ahern \u003cdsa@cumulusnetworks.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "646ebd4166ca00bdf682a36bd2e1c9a74d848ac6", "tree": "77ef532d2a930d80da6f5803c9604816cd8792b5", "parents": [ "647bf3d8a8e5777319da92af672289b2a6c4dc66" ], "author": { "name": "Leon Romanovsky", "email": "leon@kernel.org", "time": "Wed Feb 08 17:04:09 2017 +0200" }, "committer": { "name": "Doug Ledford", "email": "dledford@redhat.com", "time": "Wed Feb 08 12:28:49 2017 -0500" }, "message": "RDMA: Don\u0027t reference kernel private header from UAPI header\n\nRemove references to private kernel header and defines from exported\nib_user_verb.h file.\n\nThe code snippet below is used to reproduce the issue:\n\n #include \u003cstdio.h\u003e\n #include \u003crdma/ib_user_verb.h\u003e\n\n int main(void)\n {\n\tprintf(\"IB_USER_VERBS_ABI_VERSION \u003d %d\\n\", IB_USER_VERBS_ABI_VERSION);\n\treturn 0;\n }\n\nIt fails during compilation phase with an error:\n➜ /tmp gcc main.c\nmain.c:2:31: fatal error: rdma/ib_user_verb.h: No such file or directory\n #include \u003crdma/ib_user_verb.h\u003e\n ^\ncompilation terminated.\n\nFixes: 189aba99e700 (\"IB/uverbs: Extend modify_qp and support packet pacing\")\nCC: Bodong Wang \u003cbodong@mellanox.com\u003e\nCC: Matan Barak \u003cmatanb@mellanox.com\u003e\nCC: Christoph Hellwig \u003chch@infradead.org\u003e\nTested-by: Slava Shwartsman \u003cslavash@mellanox.com\u003e\nSigned-off-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n" }, { "commit": "647bf3d8a8e5777319da92af672289b2a6c4dc66", "tree": "8d9a8e7885ba0e86ef6d52b1feffb3b698fc42ba", "parents": [ "628f07d33c1f2e7bf31e0a4a988bb07914bd5e73" ], "author": { "name": "Eyal Itkin", "email": "eyal.itkin@gmail.com", "time": "Tue Feb 07 16:45:19 2017 +0300" }, "committer": { "name": "Doug Ledford", "email": "dledford@redhat.com", "time": "Wed Feb 08 12:28:30 2017 -0500" }, "message": "IB/rxe: Fix mem_check_range integer overflow\n\nUpdate the range check to avoid integer-overflow in edge case.\nResolves CVE 2016-8636.\n\nSigned-off-by: Eyal Itkin \u003ceyal.itkin@gmail.com\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n" }, { "commit": "628f07d33c1f2e7bf31e0a4a988bb07914bd5e73", "tree": "c228c66498f9a4562093fbbf80a41bcede0c06f2", "parents": [ "b4cfe3971f6eab542dd7ecc398bfa1aeec889934" ], "author": { "name": "Eyal Itkin", "email": "eyal.itkin@gmail.com", "time": "Tue Feb 07 16:43:05 2017 +0300" }, "committer": { "name": "Doug Ledford", "email": "dledford@redhat.com", "time": "Wed Feb 08 12:28:30 2017 -0500" }, "message": "IB/rxe: Fix resid update\n\nUpdate the response\u0027s resid field when larger than MTU, instead of only\nupdating the local resid variable.\n\nFixes: 8700e3e7c485 (\"Soft RoCE driver\")\nSigned-off-by: Eyal Itkin \u003ceyal.itkin@gmail.com\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@oracle.com\u003e\nReviewed-by: Leon Romanovsky \u003cleonro@mellanox.com\u003e\nSigned-off-by: Doug Ledford \u003cdledford@redhat.com\u003e\n" }, { "commit": "a11a7f71cac209c7c9cca66eb506e1ebb033a3b3", "tree": "fe6133efabecfb467bda70d77607ca29492a5537", "parents": [ "926af6273fc683cd98cd0ce7bf0d04a02eed6742" ], "author": { "name": "Marcus Huewe", "email": "suse-tux@gmx.de", "time": "Mon Feb 06 18:34:56 2017 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Feb 08 11:54:40 2017 -0500" }, "message": "ipv6: addrconf: fix generation of new temporary addresses\n\nUnder some circumstances it is possible that no new temporary addresses\nwill be generated.\n\nFor instance, addrconf_prefix_rcv_add_addr() indirectly calls\nipv6_create_tempaddr(), which creates a tentative temporary address and\nstarts dad. Next, addrconf_prefix_rcv_add_addr() indirectly calls\naddrconf_verify_rtnl(). Now, assume that the previously created temporary\naddress has the least preferred lifetime among all existing addresses and\nis still tentative (that is, dad is still running). Hence, the next run of\naddrconf_verify_rtnl() is performed when the preferred lifetime of the\ntemporary address ends. If dad succeeds before the next run, the temporary\naddress becomes deprecated during the next run, but no new temporary\naddress is generated.\n\nIn order to fix this, schedule the next addrconf_verify_rtnl() run slightly\nbefore the temporary address becomes deprecated, if dad succeeded.\n\nSigned-off-by: Marcus Huewe \u003csuse-tux@gmx.de\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "2a362249187a8d0f6d942d6e1d763d150a296f47", "tree": "a82a639c63ee3a78259c9ee909d19c2c48d9d3d3", "parents": [ "57b59ed2e5b91e958843609c7884794e29e6c4cb" ], "author": { "name": "Jeff Mahoney", "email": "jeffm@suse.com", "time": "Mon Feb 06 19:39:09 2017 -0500" }, "committer": { "name": "David Sterba", "email": "dsterba@suse.com", "time": "Wed Feb 08 17:47:30 2017 +0100" }, "message": "btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls\n\nCommit 4c63c2454ef incorrectly assumed that returning -ENOIOCTLCMD would\ncause the native ioctl to be called. The -\u003ecompat_ioctl callback is\nexpected to handle all ioctls, not just compat variants. As a result,\nwhen using 32-bit userspace on 64-bit kernels, everything except those\nthree ioctls would return -ENOTTY.\n\nFixes: 4c63c2454ef (\"btrfs: bugfix: handle FS_IOC32_{GETFLAGS,SETFLAGS,GETVERSION} in btrfs_ioctl\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jeff Mahoney \u003cjeffm@suse.com\u003e\nReviewed-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n" }, { "commit": "9b2792c3da1e80f2d460167d319302a24c9ca2b7", "tree": "bb4d91a9afef948324092f9d4190773de79b8d5d", "parents": [ "01d4d673558985d9a118e1e05026633c3e2ade9b" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Mon Feb 06 14:28:09 2017 -0800" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 08:25:39 2017 -0800" }, "message": "target: Fix COMPARE_AND_WRITE ref leak for non GOOD status\n\nThis patch addresses a long standing bug where the commit phase\nof COMPARE_AND_WRITE would result in a se_cmd-\u003ecmd_kref reference\nleak if se_cmd-\u003escsi_status returned non SAM_STAT_GOOD.\n\nThis would manifest first as a lost SCSI response, and eventual\nhung task during fabric driver logout or re-login, as existing\nshutdown logic waited for the COMPARE_AND_WRITE se_cmd-\u003ecmd_kref\nto reach zero.\n\nTo address this bug, compare_and_write_post() has been changed\nto drop the incorrect !cmd-\u003escsi_status conditional that was\npreventing *post_ret \u003d 1 for being set during non SAM_STAT_GOOD\nstatus.\n\nThis patch has been tested with SAM_STAT_CHECK_CONDITION status\nfrom normal target_complete_cmd() callback path, as well as the\nincoming __target_execute_cmd() submission failure path when\nse_cmd-\u003eexecute_cmd() returns non zero status.\n\nReported-by: Donald White \u003cdew@datera.io\u003e\nCc: Donald White \u003cdew@datera.io\u003e\nTested-by: Gary Guo \u003cghg@datera.io\u003e\nCc: Gary Guo \u003cghg@datera.io\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v3.12+\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "01d4d673558985d9a118e1e05026633c3e2ade9b", "tree": "0aa259773374b5a919689c9db28d78274778b359", "parents": [ "c54eeffbe9338fa982dc853d816fda9202a13b5a" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Dec 07 12:55:54 2016 -0800" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 08:25:23 2017 -0800" }, "message": "target: Fix multi-session dynamic se_node_acl double free OOPs\n\nThis patch addresses a long-standing bug with multi-session\n(eg: iscsi-target + iser-target) se_node_acl dynamic free\nwithini transport_deregister_session().\n\nThis bug is caused when a storage endpoint is configured with\ndemo-mode (generate_node_acls \u003d 1 + cache_dynamic_acls \u003d 1)\ninitiators, and initiator login creates a new dynamic node acl\nand attaches two sessions to it.\n\nAfter that, demo-mode for the storage instance is disabled via\nconfigfs (generate_node_acls \u003d 0 + cache_dynamic_acls \u003d 0) and\nthe existing dynamic acl is never converted to an explicit ACL.\n\nThe end result is dynamic acl resources are released twice when\nthe sessions are shutdown in transport_deregister_session().\n\nIf the storage instance is not changed to disable demo-mode,\nor the dynamic acl is converted to an explict ACL, or there\nis only a single session associated with the dynamic ACL,\nthe bug is not triggered.\n\nTo address this big, move the release of dynamic se_node_acl\nmemory into target_complete_nacl() so it\u0027s only freed once\nwhen se_node_acl-\u003eacl_kref reaches zero.\n\n(Drop unnecessary list_del_init usage - HCH)\n\nReported-by: Rob Millner \u003crlm@daterainc.com\u003e\nTested-by: Rob Millner \u003crlm@daterainc.com\u003e\nCc: Rob Millner \u003crlm@daterainc.com\u003e\nCc: stable@vger.kernel.org # 4.1+\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "c54eeffbe9338fa982dc853d816fda9202a13b5a", "tree": "d2ae7722aa231eb23c2a89fcaf430461f9eed320", "parents": [ "0583c261e6325f392c1f7a1b9112e31298e1a4bd" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Tue Dec 06 22:45:46 2016 -0800" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 07:47:19 2017 -0800" }, "message": "target: Fix early transport_generic_handle_tmr abort scenario\n\nThis patch fixes a bug where incoming task management requests\ncan be explicitly aborted during an active LUN_RESET, but who\u0027s\nstruct work_struct are canceled in-flight before execution.\n\nThis occurs when core_tmr_drain_tmr_list() invokes cancel_work_sync()\nfor the incoming se_tmr_req-\u003etask_cmd-\u003ework, resulting in cmd-\u003ework\nfor target_tmr_work() never getting invoked and the aborted TMR\nwaiting indefinately within transport_wait_for_tasks().\n\nTo address this case, perform a CMD_T_ABORTED check early in\ntransport_generic_handle_tmr(), and invoke the normal path via\ntransport_cmd_check_stop_to_fabric() to complete any TMR kthreads\nblocked waiting for CMD_T_STOP in transport_wait_for_tasks().\n\nAlso, move the TRANSPORT_ISTATE_PROCESSING assignment earlier\ninto transport_generic_handle_tmr() so the existing check in\ncore_tmr_drain_tmr_list() avoids attempting abort the incoming\nse_tmr_req-\u003etask_cmd-\u003ework if it has already been queued into\nse_device-\u003etmr_wq.\n\nReported-by: Rob Millner \u003crlm@daterainc.com\u003e\nTested-by: Rob Millner \u003crlm@daterainc.com\u003e\nCc: Rob Millner \u003crlm@daterainc.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: stable@vger.kernel.org # 3.14+\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "0583c261e6325f392c1f7a1b9112e31298e1a4bd", "tree": "48819bdd2a955fb1e279c7aa1d13bd2551efc2cc", "parents": [ "391e2a6de9781e4906dd7e0b1cc097050bf43e11" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Mon Oct 31 00:54:40 2016 -0700" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 07:46:54 2017 -0800" }, "message": "target: Use correct SCSI status during EXTENDED_COPY exception\n\nThis patch adds the missing target_complete_cmd() SCSI status\nparameter change in target_xcopy_do_work(), that was originally\nmissing in commit 926317de33.\n\nIt correctly propigates up the correct SCSI status during\nEXTENDED_COPY exception cases, instead of always using the\nhardcoded SAM_STAT_CHECK_CONDITION from original code.\n\nThis is required for ESX host environments that expect to\nhit SAM_STAT_RESERVATION_CONFLICT for certain scenarios,\nand SAM_STAT_CHECK_CONDITION results in non-retriable\nstatus for these cases.\n\nReported-by: Nixon Vincent \u003cnixon.vincent@calsoftinc.com\u003e\nTested-by: Nixon Vincent \u003cnixon.vincent@calsoftinc.com\u003e\nCc: Nixon Vincent \u003cnixon.vincent@calsoftinc.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: stable@vger.kernel.org # 3.14+\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "391e2a6de9781e4906dd7e0b1cc097050bf43e11", "tree": "42ebf04325bc226435f330a75677dbe141f26a0b", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Sun Oct 23 14:28:15 2016 -0700" }, "committer": { "name": "Nicholas Bellinger", "email": "nab@linux-iscsi.org", "time": "Wed Feb 08 07:46:31 2017 -0800" }, "message": "target: Don\u0027t BUG_ON during NodeACL dynamic -\u003e explicit conversion\n\nAfter the v4.2+ RCU conversion to se_node_acl-\u003elun_entry_hlist,\na BUG_ON() was added in core_enable_device_list_for_node() to\ndetect when the located orig-\u003ese_lun_acl contains an existing\nse_lun_acl pointer reference.\n\nHowever, this scenario can happen when a dynamically generated\nNodeACL is being converted to an explicit NodeACL, when the\nexplicit NodeACL contains a different LUN mapping than the\ndefault provided by the WWN endpoint.\n\nSo instead of triggering BUG_ON(), go ahead and fail instead\nfollowing the original pre RCU conversion logic.\n\nReported-by: Benjamin ESTRABAUD \u003cben.estrabaud@mpstor.com\u003e\nCc: Benjamin ESTRABAUD \u003cben.estrabaud@mpstor.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nCc: stable@vger.kernel.org # 4.2+\nSigned-off-by: Nicholas Bellinger \u003cnab@linux-iscsi.org\u003e\n" }, { "commit": "d7df2443cd5f67fc6ee7c05a88e4996e8177f91b", "tree": "098a7c0ca4fceb8a65cb1f693c9d71990388933d", "parents": [ "a0615a16f7d0ceb5804d295203c302d496d8ee91" ], "author": { "name": "Benjamin Herrenschmidt", "email": "benh@kernel.crashing.org", "time": "Fri Feb 03 17:10:28 2017 +1100" }, "committer": { "name": "Michael Ellerman", "email": "mpe@ellerman.id.au", "time": "Wed Feb 08 23:36:29 2017 +1100" }, "message": "powerpc/mm: Fix spurrious segfaults on radix with autonuma\n\nWhen autonuma (Automatic NUMA balancing) marks a PTE inaccessible it\nclears all the protection bits but leave the PTE valid.\n\nWith the Radix MMU, an attempt at executing from such a PTE will\ntake a fault with bit 35 of SRR1 set \"SRR1_ISI_N_OR_G\".\n\nIt is thus incorrect to treat all such faults as errors. We should\npass them to handle_mm_fault() for autonuma to deal with. The case\nof pages that are really not executable is handled by the existing\ntest for VM_EXEC further down.\n\nThat leaves us with catching the kernel attempts at executing user\npages. We can catch that earlier, even before we do find_vma.\n\nIt is never valid on powerpc for the kernel to take an exec fault\nto begin with. So fold that test with the existing test for the\nkernel faulting on kernel addresses to bail out early.\n\nFixes: 1d18ad026844 (\"powerpc/mm: Detect instruction fetch denied and report\")\nSigned-off-by: Benjamin Herrenschmidt \u003cbenh@kernel.crashing.org\u003e\nReviewed-by: Aneesh Kumar K.V \u003caneesh.kumar@linux.vnet.ibm.com\u003e\nAcked-by: Balbir Singh \u003cbsingharora@gmail.com\u003e\nSigned-off-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\n" }, { "commit": "4842e98f26dd80be3623c4714a244ba52ea096a8", "tree": "08e56d4db3d9f4d720fbaf3091d31ff219c5b58e", "parents": [ "f3d83317a69e7d658e7c83e24f8b31ac533c39e3" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Feb 08 12:35:39 2017 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Feb 08 12:42:37 2017 +0100" }, "message": "ALSA: seq: Fix race at creating a queue\n\nWhen a sequencer queue is created in snd_seq_queue_alloc(),it adds the\nnew queue element to the public list before referencing it. Thus the\nqueue might be deleted before the call of snd_seq_queue_use(), and it\nresults in the use-after-free error, as spotted by syzkaller.\n\nThe fix is to reference the queue object at the right time.\n\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "6e7eb1783be7f19eb071c96ddda0bbf22279ff46", "tree": "a25d5167c39e758868b7add29ac7b87596eefde7", "parents": [ "83bf6d55c132d5c4f773e5a04149c05f4aa0c2ad" ], "author": { "name": "Michał Winiarski", "email": "michal.winiarski@intel.com", "time": "Tue Feb 07 20:55:59 2017 +0100" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:27:28 2017 +0200" }, "message": "drm/i915: Always convert incoming exec offsets to non-canonical\n\nWe\u0027re using non-canonical addresses in drm_mm, and we\u0027re making sure that\nuserspace is using canonical addressing - both in case of softpin\n(verifying incoming offset) and when relocating (converting to canonical\nwhen updating offset returned to userspace).\nUnfortunately when considering the need for relocations, we\u0027re comparing\noffset from userspace (in canonical form) with drm_mm node (in\nnon-canonical form), and as a result, we end up always relocating if our\noffsets are in the \"problematic\" range.\nLet\u0027s always convert the offsets to avoid the performance impact of\nrelocations.\n\nFixes: a5f0edf63bdf (\"drm/i915: Avoid writing relocs with addresses in non-canonical form\")\nCc: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Michel Thierry \u003cmichel.thierry@intel.com\u003e\nReported-by: Michał Pyrzowski \u003cmichal.pyrzowski@intel.com\u003e\nSigned-off-by: Michał Winiarski \u003cmichal.winiarski@intel.com\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/20170207195559.18798-1-michal.winiarski@intel.com\nReviewed-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\n(cherry picked from commit 038c95a313e4ca954ee5ab8a0c7559a646b0f462)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "83bf6d55c132d5c4f773e5a04149c05f4aa0c2ad", "tree": "c7417e82ba3bb8d1afd9ad924b5f28d8e8b38003", "parents": [ "789ea12500e5ce3911d0a6a822277c3133451927" ], "author": { "name": "Chris Wilson", "email": "chris@chris-wilson.co.uk", "time": "Fri Feb 03 12:57:17 2017 +0000" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:27:27 2017 +0200" }, "message": "drm/i915: Remove overzealous fence warn on runtime suspend\n\nThe goal of the WARN was to catch when we are still actively using the\nfence as we go into the runtime suspend. However, the reg-\u003epin_count is\ntoo coarse as it does not distinguish between exclusive ownership of the\nfence register from activity.\n\nI\u0027ve not improved on the WARN, nor have we captured this WARN in an\nexact igt, but it is showing up regularly in the wild:\n\n[ 1915.935332] WARNING: CPU: 1 PID: 10861 at drivers/gpu/drm/i915/i915_gem.c:2022 i915_gem_runtime_suspend+0x116/0x130 [i915]\n[ 1915.935383] WARN_ON(reg-\u003epin_count)[ 1915.935399] Modules linked in:\n snd_hda_intel i915 drm_kms_helper vgem netconsole scsi_transport_iscsi fuse vfat fat x86_pkg_temp_thermal coretemp intel_cstate intel_uncore snd_hda_codec_hdmi snd_hda_codec_generic snd_hda_codec snd_hwdep snd_hda_core snd_pcm snd_timer snd mei_me mei serio_raw intel_rapl_perf intel_pch_thermal soundcore wmi acpi_pad i2c_algo_bit syscopyarea sysfillrect sysimgblt fb_sys_fops drm r8169 mii video [last unloaded: drm_kms_helper]\n[ 1915.935785] CPU: 1 PID: 10861 Comm: kworker/1:0 Tainted: G U W 4.9.0-rc5+ #170\n[ 1915.935799] Hardware name: LENOVO 80MX/Lenovo E31-80, BIOS DCCN34WW(V2.03) 12/01/2015\n[ 1915.935822] Workqueue: pm pm_runtime_work\n[ 1915.935845] ffffc900044fbbf0 ffffffffac3220bc ffffc900044fbc40 0000000000000000\n[ 1915.935890] ffffc900044fbc30 ffffffffac059bcb 000007e6044fbc60 ffff8801626e3198\n[ 1915.935937] ffff8801626e0000 0000000000000002 ffffffffc05e5d4e 0000000000000000\n[ 1915.935985] Call Trace:\n[ 1915.936013] [\u003cffffffffac3220bc\u003e] dump_stack+0x4f/0x73\n[ 1915.936038] [\u003cffffffffac059bcb\u003e] __warn+0xcb/0xf0\n[ 1915.936060] [\u003cffffffffac059c4f\u003e] warn_slowpath_fmt+0x5f/0x80\n[ 1915.936158] [\u003cffffffffc052d916\u003e] i915_gem_runtime_suspend+0x116/0x130 [i915]\n[ 1915.936251] [\u003cffffffffc04f1c74\u003e] intel_runtime_suspend+0x64/0x280 [i915]\n[ 1915.936277] [\u003cffffffffac0926f1\u003e] ? dequeue_entity+0x241/0xbc0\n[ 1915.936298] [\u003cffffffffac36bb85\u003e] pci_pm_runtime_suspend+0x55/0x180\n[ 1915.936317] [\u003cffffffffac36bb30\u003e] ? pci_pm_runtime_resume+0xa0/0xa0\n[ 1915.936339] [\u003cffffffffac4514e2\u003e] __rpm_callback+0x32/0x70\n[ 1915.936356] [\u003cffffffffac451544\u003e] rpm_callback+0x24/0x80\n[ 1915.936375] [\u003cffffffffac36bb30\u003e] ? pci_pm_runtime_resume+0xa0/0xa0\n[ 1915.936392] [\u003cffffffffac45222d\u003e] rpm_suspend+0x12d/0x680\n[ 1915.936415] [\u003cffffffffac69f6d7\u003e] ? _raw_spin_unlock_irq+0x17/0x30\n[ 1915.936435] [\u003cffffffffac0810b8\u003e] ? finish_task_switch+0x88/0x220\n[ 1915.936455] [\u003cffffffffac4534bf\u003e] pm_runtime_work+0x6f/0xb0\n[ 1915.936477] [\u003cffffffffac074353\u003e] process_one_work+0x1f3/0x4d0\n[ 1915.936501] [\u003cffffffffac074678\u003e] worker_thread+0x48/0x4e0\n[ 1915.936523] [\u003cffffffffac074630\u003e] ? process_one_work+0x4d0/0x4d0\n[ 1915.936542] [\u003cffffffffac074630\u003e] ? process_one_work+0x4d0/0x4d0\n[ 1915.936559] [\u003cffffffffac07a2c9\u003e] kthread+0xd9/0xf0\n[ 1915.936580] [\u003cffffffffac07a1f0\u003e] ? kthread_park+0x60/0x60\n[ 1915.936600] [\u003cffffffffac69fe62\u003e] ret_from_fork+0x22/0x30\n\nIn the case the register is pinned, it should be present and we will\nneed to invalidate them to be restored upon resume as we cannot expect\nthe owner of the pin to call get_fence prior to use after resume.\n\nFixes: 7c108fd8feac (\"drm/i915: Move fence cancellation to runtime suspend\")\nBugzilla: https://bugs.freedesktop.org/show_bug.cgi?id\u003d98804\nReported-by: Lionel Landwerlin \u003clionel.g.landwerlin@linux.intel.com\u003e\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nCc: Imre Deak \u003cimre.deak@linux.intel.com\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: \u003cdrm-intel-fixes@lists.freedesktop.org\u003e # v4.10-rc1+\nLink: http://patchwork.freedesktop.org/patch/msgid/20170203125717.8431-1-chris@chris-wilson.co.uk\nReviewed-by: Joonas Lahtinen \u003cjoonas.lahtinen@linux.intel.com\u003e\n(cherry picked from commit e0ec3ec698851a6c97a12d696407b3ff77700c23)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "789ea12500e5ce3911d0a6a822277c3133451927", "tree": "a47485f4db30ee89b1b513239ac867f365078e45", "parents": [ "853277481178fdf14d1a4e9e6ac7174d6046176f" ], "author": { "name": "Lee, Shawn C", "email": "shawn.c.lee@intel.com", "time": "Fri Feb 03 12:32:09 2017 +0800" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:27:27 2017 +0200" }, "message": "drm/i915/bxt: Add MST support when do DPLL calculation\n\nAdd the missing INTEL_OUTPUT_DP_MST case in bxt_get_dpll()\nto correctly initialize the crtc_state and port plls when\nlink training a DP MST monitor on BXT/APL devices.\n\nFixes: a277ca7dc01d (\"drm/i915: Split bxt_ddi_pll_select()\")\nBugs: https://bugs.freedesktop.org/show_bug.cgi?id\u003d99572\nReviewed-by: Cooper Chiou \u003ccooper.chiou@intel.com\u003e\nReviewed-by: Gary C Wang \u003cgary.c.wang@intel.com\u003e\nReviewed-by: Ciobanu, Nathan D \u003cnathan.d.ciobanu@intel.com\u003e\nReviewed-by: Herbert, Marc \u003cmarc.herbert@intel.com\u003e\nReviewed-by: Bride, Jim \u003cjim.bride@intel.com\u003e\nReviewed-by: Navare, Manasi D \u003cmanasi.d.navare@intel.com\u003e\nCc: Jani Nikula \u003cjani.nikula@intel.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v4.9+\nSigned-off-by: Lee, Shawn C \u003cshawn.c.lee@intel.com\u003e\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/1486096329-6255-1-git-send-email-shawn.c.lee@intel.com\n(cherry picked from commit 0aab2c721d81590012a5021a516f00666646741f)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "5cad24d835772f9f709971a8d6fcf12afe53b2a7", "tree": "0c1a8bc700c3c219c45ca05dbc5ce3df6be89813", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "Jean-Nicolas Graux", "email": "jean-nicolas.graux@st.com", "time": "Tue Feb 07 12:12:41 2017 +0100" }, "committer": { "name": "Ulf Hansson", "email": "ulf.hansson@linaro.org", "time": "Wed Feb 08 12:22:27 2017 +0100" }, "message": "mmc: mmci: avoid clearing ST Micro busy end interrupt mistakenly\n\nThis fixes a race condition that may occur whenever ST micro busy end\ninterrupt is raised just after being unmasked but before leaving mmci\ninterrupt context.\n\nA dead-lock has been found if connecting mmci ST Micro variant whose amba\nid is 0x10480180 to some new eMMC that supports internal caches. Whenever\nmmci driver enables cache control by programming eMMC\u0027s EXT_CSD register,\nblock driver may request to flush the eMMC internal caches causing mmci\ndriver to send a MMC_SWITCH command to the card with FLUSH_CACHE operation.\nAnd because busy end interrupt may be mistakenly cleared while not yet\nprocessed, this mmc request may never complete. As a result, mmcqd task\nmay be stuck forever.\n\nHere is an instance caught by lockup detector which shows that mmcqd task\nwas hung while waiting for mmc_flush_cache command to complete:\n\n..\n[ 240.251595] INFO: task mmcqd/1:52 blocked for more than 120 seconds.\n[ 240.257973] Not tainted 4.1.13-00510-g9d91424 #2\n[ 240.263109] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 240.270955] mmcqd/1 D c047504c 0 52 2 0x00000000\n[ 240.277359] [\u003cc047504c\u003e] (__schedule) from [\u003cc04754a0\u003e] (schedule+0x40/0x98)\n[ 240.284418] [\u003cc04754a0\u003e] (schedule) from [\u003cc0477d40\u003e] (schedule_timeout+0x148/0x188)\n[ 240.292191] [\u003cc0477d40\u003e] (schedule_timeout) from [\u003cc0476040\u003e] (wait_for_common+0xa4/0x170)\n[ 240.300491] [\u003cc0476040\u003e] (wait_for_common) from [\u003cc02efc1c\u003e] (mmc_wait_for_req_done+0x4c/0x13c)\n[ 240.309224] [\u003cc02efc1c\u003e] (mmc_wait_for_req_done) from [\u003cc02efd90\u003e] (mmc_wait_for_cmd+0x64/0x84)\n[ 240.317953] [\u003cc02efd90\u003e] (mmc_wait_for_cmd) from [\u003cc02f5b14\u003e] (__mmc_switch+0xa4/0x2a8)\n[ 240.325964] [\u003cc02f5b14\u003e] (__mmc_switch) from [\u003cc02f5d40\u003e] (mmc_switch+0x28/0x30)\n[ 240.333389] [\u003cc02f5d40\u003e] (mmc_switch) from [\u003cc02f0984\u003e] (mmc_flush_cache+0x54/0x80)\n[ 240.341073] [\u003cc02f0984\u003e] (mmc_flush_cache) from [\u003cc02ff0c4\u003e] (mmc_blk_issue_rq+0x114/0x4e8)\n[ 240.349459] [\u003cc02ff0c4\u003e] (mmc_blk_issue_rq) from [\u003cc03008d4\u003e] (mmc_queue_thread+0xc0/0x180)\n[ 240.357844] [\u003cc03008d4\u003e] (mmc_queue_thread) from [\u003cc003cf90\u003e] (kthread+0xdc/0xf4)\n[ 240.365339] [\u003cc003cf90\u003e] (kthread) from [\u003cc0010068\u003e] (ret_from_fork+0x14/0x2c)\n..\n..\n[ 240.664311] INFO: task partprobe:564 blocked for more than 120 seconds.\n[ 240.670943] Not tainted 4.1.13-00510-g9d91424 #2\n[ 240.676078] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 240.683922] partprobe D c047504c 0 564 486 0x00000000\n[ 240.690318] [\u003cc047504c\u003e] (__schedule) from [\u003cc04754a0\u003e] (schedule+0x40/0x98)\n[ 240.697396] [\u003cc04754a0\u003e] (schedule) from [\u003cc0477d40\u003e] (schedule_timeout+0x148/0x188)\n[ 240.705149] [\u003cc0477d40\u003e] (schedule_timeout) from [\u003cc0476040\u003e] (wait_for_common+0xa4/0x170)\n[ 240.713446] [\u003cc0476040\u003e] (wait_for_common) from [\u003cc01f3300\u003e] (submit_bio_wait+0x58/0x64)\n[ 240.721571] [\u003cc01f3300\u003e] (submit_bio_wait) from [\u003cc01fbbd8\u003e] (blkdev_issue_flush+0x60/0x88)\n[ 240.729957] [\u003cc01fbbd8\u003e] (blkdev_issue_flush) from [\u003cc010ff84\u003e] (blkdev_fsync+0x34/0x44)\n[ 240.738083] [\u003cc010ff84\u003e] (blkdev_fsync) from [\u003cc0109594\u003e] (do_fsync+0x3c/0x64)\n[ 240.745319] [\u003cc0109594\u003e] (do_fsync) from [\u003cc000ffc0\u003e] (ret_fast_syscall+0x0/0x3c)\n..\n\nHere is the detailed sequence showing when this issue may happen:\n\n1) At probe time, mmci device is initialized and card busy detection based\non DAT[0] monitoring is enabled.\n\n2) Later during run time, since card reported to support internal caches, a\nMMCI_SWITCH command is sent to eMMC device with FLUSH_CACHE operation. On\nreceiving this command, eMMC may enter busy state (for a relatively short\ntime in the case of the dead-lock).\n\n3) Then mmci interrupt is raised and mmci_irq() is called:\n\nMMCISTATUS register is read and is equal to 0x01000440. So the following\nstatus bits are set:\n- MCI_CMDRESPEND (\u003d 6)\n- MCI_DATABLOCKEND (\u003d 10)\n- MCI_ST_CARDBUSY (\u003d 24)\n\nSince MMCIMASK0 register is 0x3FF, status variable is set to 0x00000040 and\nBIT MCI_CMDRESPEND is cleared by writing MMCICLEAR register.\n\nThen mmci_cmd_irq() is called. Considering the following conditions:\n- host-\u003ebusy_status is 0,\n- this is a \"busy response\",\n- reading again MMCISTATUS register gives 0x1000400,\nMMCIMASK0 is updated to unmask MCI_ST_BUSYEND bit.\n\nThus, MMCIMASK0 is set to 0x010003FF and host-\u003ebusy_status is set to wait\nfor busy end completion.\n\nBack again in status loop of mmci_irq(), we quickly go through\nmmci_data_irq() as there are no data in that case. And we finally go\nthrough following test at the end of while(status) loop:\n\n/*\n * Don\u0027t poll for busy completion in irq context.\n */\nif (host-\u003evariant-\u003ebusy_detect \u0026\u0026 host-\u003ebusy_status)\n\tstatus \u0026\u003d ~host-\u003evariant-\u003ebusy_detect_flag;\n\nBecause status variable is not yet null (is equal to 0x40), we do not leave\ninterrupt context yet but we loop again into while(status) loop. So we run\nacross following steps:\n\na) MMCISTATUS register is read again and this time is equal to 0x01000400.\nSo that following bits are set:\n- MCI_DATABLOCKEND (\u003d 10)\n- MCI_ST_CARDBUSY (\u003d 24)\n\nSince MMCIMASK0 register is equal to 0x010003FF:\n\nb) status variable is set to 0x01000000.\nc) MCI_ST_CARDBUSY bit is cleared by writing MMCICLEAR register.\n\nThen, mmci_cmd_irq() is called one more time. Since host-\u003ebusy_status is\nset and that MCI_ST_CARDBUSY is set in status variable, we just return from\nthis function.\n\nBack again in mmci_irq(), status variable is set to 0 and we finally leave\nthe while(status) loop. As a result we leave interrupt context, waiting for\nbusy end interrupt event.\n\nNow, consider that busy end completion is raised IN BETWEEN steps 3.a) and\n3.c). In such a case, we may mistakenly clear busy end interrupt at step\n3.c) while it has not yet been processed. This will result in mmc command\nto wait forever for a busy end completion that will never happen.\n\nTo fix the problem, this patch implements the following changes:\n\nConsidering that the mmci seems to be triggering the IRQ on both edges\nwhile monitoring DAT0 for busy completion and that same status bit is used\nto monitor start and end of busy detection, special care must be taken to\nmake sure that both start and end interrupts are always cleared one after\nthe other.\n\n1) Clearing of card busy bit is moved in mmc_cmd_irq() function where\nunmasking of busy end bit is effectively handled.\n2) Just before unmasking busy end event, busy start event is cleared by\nwriting card busy bit in MMCICLEAR register.\n3) Finally, once we are no more busy with a command, busy end event is\ncleared writing again card busy bit in MMCICLEAR register.\n\nThis patch has been tested with the ST Accordo5 machine, not yet supported\nupstream but relies on the mmci driver.\n\nSigned-off-by: Sarang Mairal \u003csarang.mairal@garmin.com\u003e\nSigned-off-by: Jean-Nicolas Graux \u003cjean-nicolas.graux@st.com\u003e\nReviewed-by: Linus Walleij \u003clinus.walleij@linaro.org\u003e\nTested-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\nSigned-off-by: Ulf Hansson \u003culf.hansson@linaro.org\u003e\n" }, { "commit": "853277481178fdf14d1a4e9e6ac7174d6046176f", "tree": "e657b885610527c8359fc2c6f4a11a7fa8958150", "parents": [ "7152187159193056f30ad5726741bb25028672bf" ], "author": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 01 15:46:09 2017 +0200" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:10:36 2017 +0200" }, "message": "drm/i915: don\u0027t warn about Skylake CPU - KabyPoint PCH combo\n\nApparently there are machines out there with Skylake CPU and KabyPoint\nPCH. Judging from our driver code, there doesn\u0027t seem to be any code\npaths that would do anything different between SunrisePoint and\nKabyPoint PCHs, so it would seem okay to accept the combo without\nwarnings.\n\nFixes: 22dea0be50b2 (\"drm/i915: Introduce Kabypoint PCH for Kabylake H/DT.\")\nReferences: https://lists.freedesktop.org/archives/intel-gfx/2017-February/118611.html\nReported-by: Rainer Koenig \u003cRainer.Koenig@ts.fujitsu.com\u003e\nCc: Rainer Koenig \u003cRainer.Koenig@ts.fujitsu.com\u003e\nCc: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v4.8+\nReviewed-by: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/1485956769-26015-1-git-send-email-jani.nikula@intel.com\n(cherry picked from commit 3aac4acb89710fe782c9e78e7b1febf76e112c6c)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "7152187159193056f30ad5726741bb25028672bf", "tree": "5191539c8e909b91be9fd02ba876a4838686c840", "parents": [ "e3818697e1d9140d0b990fecf4429d40c41ca0b5" ], "author": { "name": "Juergen Gross", "email": "jgross@suse.com", "time": "Thu Feb 02 10:47:11 2017 +0100" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:10:30 2017 +0200" }, "message": "drm/i915: fix i915 running as dom0 under Xen\n\nCommit 920cf4194954ec (\"drm/i915: Introduce an internal allocator for\ndisposable private objects\") introduced a regression for the kernel\nrunning as Xen dom0: when switching to graphics mode a GPU HANG\noccurred.\n\nReason seems to be a missing adaption similar to that done in\ncommit 7453c549f5f648 (\"swiotlb: Export swiotlb_max_segment to users\")\nto i915_gem_object_get_pages_internal().\n\nSo limit the maximum page order to be used according to the maximum\nswiotlb segment size instead to the complete swiotlb size.\n\nFixes: 920cf4194954 (\"drm/i915: Introduce an internal allocator for disposable private objects\")\nSigned-off-by: Juergen Gross \u003cjgross@suse.com\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/20170202094711.939-1-jgross@suse.com\nCc: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: Tvrtko Ursulin \u003ctvrtko.ursulin@linux.intel.com\u003e\nCc: Daniel Vetter \u003cdaniel.vetter@intel.com\u003e\nCc: Jani Nikula \u003cjani.nikula@linux.intel.com\u003e\nCc: intel-gfx@lists.freedesktop.org\nCc: \u003cdrm-intel-fixes@lists.freedesktop.org\u003e # v4.10-rc1+\nReviewed-by: Tvrtko Ursulin \u003ctvrtko.ursulin@intel.com\u003e\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\n(cherry picked from commit 5584f1b1d73e9cc95092734c316e467c6c4468f9)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "e3818697e1d9140d0b990fecf4429d40c41ca0b5", "tree": "ff9717fc8bb3a99735084c5b6f01385889b6e36e", "parents": [ "5351fbb1bf1413f6024892093528280769ca852f" ], "author": { "name": "Chris Wilson", "email": "chris@chris-wilson.co.uk", "time": "Mon Jan 09 11:19:32 2017 +0000" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:10:24 2017 +0200" }, "message": "drm/i915: Flush untouched framebuffers before display on !llc\n\nOn a non-llc system, the objects are created with .cache_level \u003d\nCACHE_NONE and so the transition to uncached for scanout is a no-op.\nHowever, if the object was never written to, it will still be in the CPU\ndomain (having been zeroed out by shmemfs). Those cachelines need to be\nflushed prior to display.\n\nReported-and-tested-by: Vito Caputo\nFixes: a6a7cc4b7db6 (\"drm/i915: Always flush the dirty CPU cache when pinning the scanout\")\nSigned-off-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nCc: \u003cdrm-intel-fixes@lists.freedesktop.org\u003e # v4.10-rc1+\nLink: http://patchwork.freedesktop.org/patch/msgid/20170109111932.6342-1-chris@chris-wilson.co.uk\nReviewed-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\n(cherry picked from commit 69aeafeae9b30d797c439a30d1a4ccc8dc5b0eb0)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "5351fbb1bf1413f6024892093528280769ca852f", "tree": "ec270f90f25882708a53ee88a0513ca6198c1d9d", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c" ], "author": { "name": "Andrey Ryabinin", "email": "aryabinin@virtuozzo.com", "time": "Thu Jan 26 17:32:11 2017 +0300" }, "committer": { "name": "Jani Nikula", "email": "jani.nikula@intel.com", "time": "Wed Feb 08 13:09:24 2017 +0200" }, "message": "drm/i915: fix use-after-free in page_flip_completed()\n\npage_flip_completed() dereferences \u0027work\u0027 variable after executing\nqueue_work(). This is not safe as the \u0027work\u0027 item might be already freed\nby queued work:\n\n BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr ffff8803dc010f90\n Call Trace:\n __asan_report_load8_noabort+0x59/0x80\n page_flip_completed+0x3ff/0x490\n intel_finish_page_flip_mmio+0xe3/0x130\n intel_pipe_handle_vblank+0x2d/0x40\n gen8_irq_handler+0x4a7/0xed0\n __handle_irq_event_percpu+0xf6/0x860\n handle_irq_event_percpu+0x6b/0x160\n handle_irq_event+0xc7/0x1b0\n handle_edge_irq+0x1f4/0xa50\n handle_irq+0x41/0x70\n do_IRQ+0x9a/0x200\n common_interrupt+0x89/0x89\n\n Freed:\n kfree+0x113/0x4d0\n intel_unpin_work_fn+0x29a/0x3b0\n process_one_work+0x79e/0x1b70\n worker_thread+0x611/0x1460\n kthread+0x241/0x3a0\n ret_from_fork+0x27/0x40\n\nMove queue_work() after\ttrace_i915_flip_complete() to fix this.\n\nFixes: e5510fac98a7 (\"drm/i915: add tracepoints for flip requests \u0026 completions\")\nSigned-off-by: Andrey Ryabinin \u003caryabinin@virtuozzo.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v2.6.36+\nReviewed-by: Chris Wilson \u003cchris@chris-wilson.co.uk\u003e\nSigned-off-by: Daniel Vetter \u003cdaniel.vetter@ffwll.ch\u003e\nLink: http://patchwork.freedesktop.org/patch/msgid/20170126143211.24013-1-aryabinin@virtuozzo.com\n(cherry picked from commit 05c41f926fcc7ef838c80a6a99d84f67b4e0b824)\nSigned-off-by: Jani Nikula \u003cjani.nikula@intel.com\u003e\n" }, { "commit": "0c461cb727d146c9ef2d3e86214f498b78b7d125", "tree": "da9bf004cd4041b0764441c77b7d906755575ca4", "parents": [ "926af6273fc683cd98cd0ce7bf0d04a02eed6742" ], "author": { "name": "Stephen Smalley", "email": "sds@tycho.nsa.gov", "time": "Tue Jan 31 11:54:04 2017 -0500" }, "committer": { "name": "James Morris", "email": "james.l.morris@oracle.com", "time": "Wed Feb 08 19:09:53 2017 +1100" }, "message": "selinux: fix off-by-one in setprocattr\n\nSELinux tries to support setting/clearing of /proc/pid/attr attributes\nfrom the shell by ignoring terminating newlines and treating an\nattribute value that begins with a NUL or newline as an attempt to\nclear the attribute. However, the test for clearing attributes has\nalways been wrong; it has an off-by-one error, and this could further\nlead to reading past the end of the allocated buffer since commit\nbb646cdb12e75d82258c2f2e7746d5952d3e321a (\"proc_pid_attr_write():\nswitch to memdup_user()\"). Fix the off-by-one error.\n\nEven with this fix, setting and clearing /proc/pid/attr attributes\nfrom the shell is not straightforward since the interface does not\nsupport multiple write() calls (so shells that write the value and\nnewline separately will set and then immediately clear the attribute,\nrequiring use of echo -n to set the attribute), whereas trying to use\necho -n \"\" to clear the attribute causes the shell to skip the\nwrite() call altogether since POSIX says that a zero-length write\ncauses no side effects. Thus, one must use echo -n to set and echo\nwithout -n to clear, as in the following example:\n$ echo -n unconfined_u:object_r:user_home_t:s0 \u003e /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\nunconfined_u:object_r:user_home_t:s0\n$ echo \"\" \u003e /proc/$$/attr/fscreate\n$ cat /proc/$$/attr/fscreate\n\nNote the use of /proc/$$ rather than /proc/self, as otherwise\nthe cat command will read its own attribute value, not that of the shell.\n\nThere are no users of this facility to my knowledge; possibly we\nshould just get rid of it.\n\nUPDATE: Upon further investigation it appears that a local process\nwith the process:setfscreate permission can cause a kernel panic as a\nresult of this bug. This patch fixes CVE-2017-2618.\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\n[PM: added the update about CVE-2017-2618 to the commit description]\nCc: stable@vger.kernel.org # 3.5: d6ea83ec6864e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n\nSigned-off-by: James Morris \u003cjames.l.morris@oracle.com\u003e\n" }, { "commit": "bfeda41d06d85ad9d52f2413cfc2b77be5022f75", "tree": "d91d679773a7873e4def6fdf535bd0c5739f1c8d", "parents": [ "926af6273fc683cd98cd0ce7bf0d04a02eed6742" ], "author": { "name": "Omar Sandoval", "email": "osandov@fb.com", "time": "Tue Feb 07 15:33:20 2017 -0800" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Wed Feb 08 08:21:31 2017 +0100" }, "message": "stacktrace, lockdep: Fix address, newline ugliness\n\nSince KERN_CONT became meaningful again, lockdep stack traces have had\nannoying extra newlines, like this:\n\n[ 5.561122] -\u003e #1 (B){+.+...}:\n[ 5.561528]\n[ 5.561532] [\u003cffffffff810d8873\u003e] lock_acquire+0xc3/0x210\n[ 5.562178]\n[ 5.562181] [\u003cffffffff816f6414\u003e] mutex_lock_nested+0x74/0x6d0\n[ 5.562861]\n[ 5.562880] [\u003cffffffffa01aa3c3\u003e] init_btrfs_fs+0x21/0x196 [btrfs]\n[ 5.563717]\n[ 5.563721] [\u003cffffffff81000472\u003e] do_one_initcall+0x52/0x1b0\n[ 5.564554]\n[ 5.564559] [\u003cffffffff811a3af6\u003e] do_init_module+0x5f/0x209\n[ 5.565357]\n[ 5.565361] [\u003cffffffff81122f4d\u003e] load_module+0x218d/0x2b80\n[ 5.566020]\n[ 5.566021] [\u003cffffffff81123beb\u003e] SyS_finit_module+0xeb/0x120\n[ 5.566694]\n[ 5.566696] [\u003cffffffff816fd241\u003e] entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nThat\u0027s happening because each printk() call now gets printed on its own\nline, and we do a separate call to print the spaces before the symbol.\nFix it by doing the printk() directly instead of using the\nprint_ip_sym() helper.\n\nAdditionally, the symbol address isn\u0027t very helpful, so let\u0027s get rid of\nthat, too. The final result looks like this:\n\n[ 5.194518] -\u003e #1 (B){+.+...}:\n[ 5.195002] lock_acquire+0xc3/0x210\n[ 5.195439] mutex_lock_nested+0x74/0x6d0\n[ 5.196491] do_one_initcall+0x52/0x1b0\n[ 5.196939] do_init_module+0x5f/0x209\n[ 5.197355] load_module+0x218d/0x2b80\n[ 5.197792] SyS_finit_module+0xeb/0x120\n[ 5.198251] entry_SYSCALL_64_fastpath+0x1f/0xc2\n\nSuggested-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Omar Sandoval \u003cosandov@fb.com\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: kernel-team@fb.com\nFixes: 4bcc595ccd80 (\"printk: reinstate KERN_CONT for printing continuation lines\")\nLink: http://lkml.kernel.org/r/43b4e114724b2bdb0308fa86cb33aa07d3d67fad.1486510315.git.osandov@fb.com\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "5d18a619976944dc3114bbe1525880c431196c7a", "tree": "9582bc2d7cffce63b27f0541ce71f3c95fd09208", "parents": [ "d5adbfcd5f7bcc6fa58a41c5c5ada0e5c826ce2c", "242ef5d483594a2bed6b8a2685849c83e7810d17" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Wed Feb 08 12:05:02 2017 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Wed Feb 08 12:05:02 2017 +1000" }, "message": "Merge branch \u0027drm-vmwgfx-fixes-4_10\u0027 of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes\n\nSingle vmwgfx boot crasher fix.\n\n* \u0027drm-vmwgfx-fixes-4_10\u0027 of git://people.freedesktop.org/~syeh/repos_linux:\n drm/vmwgfx: Fix depth input into drm_mode_legacy_fb_format\n" } ], "next": "413d37326700aaf708730b940b04192c36e13ef4" }